v0.8.2: fix iPXE menu item selection (issue #2)

In 0.8.1 on x86_64 UEFI (snponly.efi) the boot menu drew and the keyboard
worked, but every item except the first one bounced straight back to the
menu with the default Queued Deployment entry highlighted; the `x` Exit
item did the same. Root cause was the generated dispatch lines:

  iseq ${target} linux && chain .../boot/_linux_menu.ipxe || goto menu

iPXE evaluates `&&`/`||` strictly left to right (src/core/exec.c
`system()`), so for `A && B || C` the `goto menu` runs whenever A fails --
for every item except the first. Only `local` ever reached its chain line,
which is exactly the reported symptom. The same shape made `x` useless,
and `goto menu` redraws with `--default queue`. The bug report's Ctrl-B
test (chaining an entry script by hand) booted fine, confirming the
scripts and HTTP/TFTP paths were healthy.

Fix, all in crates/http-api/src/ipxe_script.rs:

- Dispatch with `goto ${target} || goto menu` to `:label` blocks (the
  canonical iPXE menu pattern) in the top menu, both installer submenus,
  the tools menu and the utilities menu, so a non-matching item can never
  fall through into a stray `goto menu`.
- Menu-to-menu transitions use `chain --replace`, so the previous menu
  image is replaced: `exit` from any submenu reaches the firmware and
  repeated Back/forward navigation no longer nests script images.
- Boot-entry scripts now recover to the menu themselves (kernel/initrd
  fetches `|| goto failed`, `:failed` chain --replace boot.ipxe), since
  with --replace the calling menu can no longer catch their errors.
- Arch-label mapping: three `|| echo` probes instead of one chain ending
  in `|| true` (`true` is not an iPXE command; non-allowlisted pairs such
  as i386+efi aborted the script before the menu was drawn).
- Utilities menu Back really returns to Tools (it used to redraw
  Utilities); `prompt --timeout` expiry no longer aborts NIC info;
  password prompt tests emptiness with `isset` instead of a literal `""`
  token (iPXE has no quoting, so an empty Enter skipped the main-menu
  path); queue entry view falls back to the main menu if the queue
  endpoint is unreachable.

Tests: new `menu_dispatch_tests` interpreter that mirrors iPXE's
`system()`/`process_script()` (whitespace tokenisation, left-associative
`&&`/`||`, goto labels, abort on nonzero line) and asserts each top-menu
and submenu item reaches its expected chain URL (the old lines would
fail these), plus exit/reboot/firmware, unknown-architecture, password
prompt, shell and queue flows. Text assertions, the insta snapshot and the
tools-menu wiring assertion in tests/full_flow.rs updated to match.
`cargo fmt --check` clean, no new clippy warnings, `cargo test
--workspace` green (all crates).

.gitea/scripts/ci.Dockerfile

@@ -0,0 +1,21 @@
+# CI-only image for the dependency check.
+#
+# The report is a Node script because it has to compare semantic versions and
+# read four different HTTP APIs, and the official `rust` image ships no Node —
+# while the `node` image ships no cargo, which `cargo metadata` needs to resolve
+# the workspace graph. Rather than maintain the parsing twice in two languages,
+# this layers the two together.
+#
+# Node is copied from the official image rather than installed from a
+# third-party apt repository: no extra signing key, no extra network
+# dependency at build time, and the same binaries everyone else runs.
+ARG RUST_VERSION=1.95
+ARG NODE_VERSION=22-bookworm-slim
+
+FROM node:${NODE_VERSION} AS node
+
+FROM rust:${RUST_VERSION}-bookworm
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+ && node --version

.gitea/scripts/dependency-report.mjs

@@ -0,0 +1,516 @@
+//! Report every dependency that has a newer release than the one in use.
+//!
+//! Runs from `.gitea/workflows/dependency-check.yml` on a six-hour schedule.
+//! Prints a Markdown report on stdout and exits 0 whether or not anything is
+//! out of date — "up to date" is a normal outcome, not a failure. The workflow
+//! decides what to do with the report; this file only gathers facts.
+//!
+//! Three things are checked, because all three go stale independently and none
+//! of them is visible from the others:
+//!
+//!   * **Crates** — every locked dependency in `Cargo.lock` against crates.io.
+//!   * **The Rust pin** — `rust-toolchain.toml`'s channel against the latest
+//!     stable release, and the Dockerfile's `RUST_VERSION` against both, since
+//!     those two drifting apart is how a local build and a shipped image end up
+//!     on different compilers.
+//!   * **Base images** — the Dockerfile's `FROM` tags against their upstream
+//!     registries.
+//!
+//! Network only: no crates are downloaded, nothing is built, and the working
+//! tree is never modified.
+
+import { readFileSync, existsSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+
+const UA = "dependency-check (+https://gitea.milesward.dev/mward4)";
+
+// ── version comparison ──────────────────────────────────────────────────────
+
+/// Parse `1.2.3`, `1.2`, `1.2.3-alpha.1`, and `=1.2.3` into a comparable
+/// tuple. Returns null for anything that isn't a version we understand, so an
+/// unparseable requirement is reported as "unknown" rather than silently
+/// sorting to the top.
+function parseVersion(text) {
+  const m = /^[=~^]?\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:[-+](.*))?$/.exec(text.trim());
+  if (!m) return null;
+  return {
+    major: Number(m[1]),
+    minor: Number(m[2] ?? 0),
+    patch: Number(m[3] ?? 0),
+    pre: m[4] ?? "",
+  };
+}
+
+/// Order two parsed versions. A pre-release sorts below its release, so
+/// `2.0.0-rc.1` never displaces a stable `1.9.0` as "the newest".
+function compare(a, b) {
+  for (const key of ["major", "minor", "patch"]) {
+    if (a[key] !== b[key]) return a[key] < b[key] ? -1 : 1;
+  }
+  if (a.pre === b.pre) return 0;
+  if (!a.pre) return 1;
+  if (!b.pre) return -1;
+  return a.pre < b.pre ? -1 : 1;
+}
+
+/// How a version difference is allowed to be taken.
+///
+/// The pre-1.0 rule is the one that matters here: semver treats `0.x.y` as
+/// unstable, so `0.5 → 0.6` breaks exactly as hard as `1.5 → 2.0`. Getting this
+/// wrong would label half the RustCrypto family "minor or patch" when in fact
+/// `cargo update` will refuse every one of them.
+function bumpKind(from, to) {
+  if (to.major !== from.major) return "breaking";
+  if (from.major === 0 && to.minor !== from.minor) return "breaking";
+  return "compatible";
+}
+
+/// The newest release reached without crossing a breaking boundary — what
+/// `cargo update` will move to on its own.
+function bestCompatible(from, versions) {
+  let best = null;
+  for (const raw of versions) {
+    const v = parseVersion(raw);
+    // `bumpKind` is checked before comparing against `from`: `0.14.7` is not
+    // semver-compatible with `1.0.0` even though it is numerically lower, and
+    // the naive `compare > 0` test would let `0.14 → 1.4` through as routine.
+    if (!v || bumpKind(from, v) !== "compatible" || compare(v, from) <= 0) continue;
+    if (!best || compare(v, best) > 0) best = v;
+  }
+  return best;
+}
+
+/// The newest release of any kind, which for a breaking bump is what a human
+/// would have to adopt.
+function bestOverall(from, versions) {
+  let best = null;
+  for (const raw of versions) {
+    const v = parseVersion(raw);
+    if (!v || compare(v, from) <= 0) continue;
+    if (!best || compare(v, best) > 0) best = v;
+  }
+  return best;
+}
+
+const fmt = (v) => (v ? `${v.major}.${v.minor}.${v.patch}${v.pre ? `-${v.pre}` : ""}` : "?");
+
+// ── inputs ──────────────────────────────────────────────────────────────────
+
+/// Resolve the dependency graph with cargo itself.
+///
+/// `--locked` rather than a hand-rolled Cargo.lock parse: it fails instead of
+/// silently rewriting the lockfile, which matters because this runs on a
+/// schedule and must never mutate the repository it is reporting on. Cargo.toml
+/// is still read directly below for the declared requirement, since metadata
+/// reports the resolved version rather than the constraint.
+function cargoMetadata() {
+  let raw;
+  try {
+    raw = execFileSync("cargo", ["metadata", "--format-version", "1", "--locked"], {
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch (e) {
+    // A cargo failure here means no report at all. Say why in one line rather
+    // than letting a raw stack trace stand in for an explanation.
+    const detail = (e.stderr || e.message || "").toString().trim().split("\n")[0];
+    throw new Error(`cargo metadata failed: ${detail}`);
+  }
+  return JSON.parse(raw);
+}
+
+function declaredRequirements() {
+  // Handles the `dep = "1.2"` and `dep = { version = "1.2", ... }` forms and
+  // nothing else, which is every dependency this workspace declares.
+  const text = readFileSync("Cargo.toml", "utf8");
+  const out = new Map();
+  let section = "";
+  for (const line of text.split("\n")) {
+    const header = /^\[([^\]]+)\]/.exec(line);
+    if (header) {
+      section = header[1];
+      continue;
+    }
+    if (!/dependencies/.test(section)) continue;
+    const m = /^\s*([A-Za-z0-9_-]+)\s*=\s*(.+?)\s*$/.exec(line);
+    if (!m) continue;
+    const [, name, value] = m;
+    const quoted = /^"([^"]+)"/.exec(value);
+    if (quoted) out.set(name, quoted[1]);
+    else {
+      const v = /version\s*=\s*"([^"]+)"/.exec(value);
+      if (v) out.set(name, v[1]);
+    }
+  }
+  return out;
+}
+
+// ── external lookups ────────────────────────────────────────────────────────
+
+/// The latest stable Rust, from the release channel manifest.
+///
+/// Read from the sparse index rather than the crates.io API. The API is rate
+/// limited and answers 429 under a burst of ~130 lookups, which silently
+/// turned most of this report into "could not check" on the first run; the
+/// index is the same data, one request per crate, no limit and no user agent
+/// requirement.
+async function publishedVersions(name) {
+  // The index shards by name length and case: 1-char names live under "1",
+  // 2-char under "2", 3-char under "3/<first letter>", and everything else
+  // under the first two characters. Names are lowercased on the way in.
+  const lower = name.toLowerCase();
+  const prefix =
+    lower.length === 1
+      ? `1/${lower}`
+      : lower.length === 2
+        ? `2/${lower}`
+        : lower.length === 3
+          ? `3/${lower[0]}/${lower}`
+          : `${lower.slice(0, 2)}/${lower.slice(2, 4)}/${lower}`;
+
+  try {
+    const res = await fetch(`https://index.crates.io/${prefix}`, {
+      headers: { "user-agent": UA },
+    });
+    // The index answers 404 for a crate that does not exist and 410 for one
+    // that was removed; both mean "nothing to compare against".
+    if (!res.ok) return null;
+    return (await res.text())
+      .split("\n")
+      .filter(Boolean)
+      .map((line) => JSON.parse(line))
+      .filter((entry) => !entry.yanked && !entry.vers.includes("-"))
+      .map((entry) => entry.vers);
+  } catch {
+    return null;
+  }
+}
+
+/// The latest stable Rust, from the release channel manifest.
+async function latestRust() {
+  try {
+    const res = await fetch("https://static.rust-lang.org/dist/channel-rust-stable.toml", {
+      headers: { "user-agent": UA },
+    });
+    if (!res.ok) return null;
+    const m = /\[pkg\.rust\]\nversion = "([^"]+)"/.exec(await res.text());
+    // The manifest value carries the commit: "1.98.1 (48a229cea 2026-09-01)".
+    // Only the number is comparable to the Dockerfile's RUST_VERSION.
+    return m ? m[1].split(/\s+/)[0] : null;
+  } catch {
+    return null;
+  }
+}
+
+/// Tags for a Docker Hub repository, or null if it can't be read.
+async function dockerTags(repo) {
+  const [ns, name] = repo.includes("/") ? repo.split("/") : ["library", repo];
+  try {
+    const res = await fetch(`https://hub.docker.com/v2/repositories/${ns}/${name}/tags?page_size=100`, {
+      headers: { "user-agent": UA },
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.results.map((t) => t.name);
+  } catch {
+    return null;
+  }
+}
+
+// ── checks ──────────────────────────────────────────────────────────────────
+
+async function checkCrates() {
+  const meta = cargoMetadata();
+  const requirements = declaredRequirements();
+
+  // One row per crate actually compiled into the workspace. Dev-dependencies
+  // and build-dependencies are real dependencies too, so they are included —
+  // a stale build script is still a stale build script.
+  const seen = new Map();
+  for (const pkg of meta.packages) {
+    if (meta.workspace_members.includes(pkg.id)) continue;
+    seen.set(pkg.name, { from: pkg.version, kind: pkg.source ? "registry" : "path" });
+  }
+
+  const rows = [];
+  for (const [name, info] of [...seen].sort((a, b) => a[0].localeCompare(b[0]))) {
+    if (info.kind === "path") continue;
+
+    // Direct means "named in Cargo.toml", which is the only set the author can
+    // act on. The rest move when whatever pulls them in moves, so they are
+    // reported but never counted as work.
+    const direct = requirements.has(name);
+
+    const current = parseVersion(info.from);
+    const versions = await publishedVersions(name);
+    if (!current || !versions) {
+      rows.push({ name, from: info.from, to: null, kind: "unknown", direct, note: "could not check" });
+      continue;
+    }
+
+    const compatible = bestCompatible(current, versions);
+    const overall = bestOverall(current, versions);
+    if (!overall) continue; // already newest
+
+    // `compatible` is what `cargo update` will do unaided. If the newest
+    // release is further out than that, the gap is a breaking change someone
+    // has to adopt deliberately.
+    const kind = compatible ? "compatible" : bumpKind(current, overall);
+    rows.push({
+      name,
+      from: info.from,
+      to: fmt(overall),
+      kind,
+      direct,
+      note: kind === "compatible" ? "`cargo update`" : "**breaking — needs review**",
+    });
+  }
+  return rows;
+}
+
+function rustPin() {
+  const toolchain = existsSync("rust-toolchain.toml")
+    ? readFileSync("rust-toolchain.toml", "utf8")
+    : "";
+  const channel = /channel\s*=\s*"([^"]+)"/.exec(toolchain)?.[1] ?? null;
+
+  // The image bakes its own toolchain, so this is the number that decides what
+  // actually compiles the release binary.
+  const dockerfile = existsSync("deploy/docker/Dockerfile")
+    ? readFileSync("deploy/docker/Dockerfile", "utf8")
+    : existsSync("Dockerfile")
+      ? readFileSync("Dockerfile", "utf8")
+      : "";
+  const image = /ARG\s+RUST_VERSION=([0-9.]+)/.exec(dockerfile)?.[1] ?? null;
+
+  // The number `cargo` enforces as the minimum supported toolchain.
+  const manifest = readFileSync("Cargo.toml", "utf8");
+  const msrv = /rust-version\s*=\s*"([^"]+)"/.exec(manifest)?.[1] ?? null;
+
+  return { channel, image, msrv };
+}
+
+/// Every `FROM` in the Dockerfile, with the `ARG` substitution applied for the
+/// one argument this build actually parameterises.
+function baseImages() {
+  const path = existsSync("deploy/docker/Dockerfile")
+    ? "deploy/docker/Dockerfile"
+    : existsSync("Dockerfile")
+      ? "Dockerfile"
+      : null;
+  if (!path) return [];
+
+  const text = readFileSync(path, "utf8");
+  const args = new Map(
+    [...text.matchAll(/^ARG\s+([A-Za-z0-9_]+)=(\S+)/gm)].map((m) => [m[1], m[2]]),
+  );
+  const images = [];
+  for (const m of text.matchAll(/^FROM\s+(?:--platform=\S+\s+)?(\S+)/gm)) {
+    let ref = m[1];
+    // `node:${NODE_VERSION}-slim` and friends.
+    ref = ref.replace(/\$\{?([A-Za-z0-9_]+)\}?/g, (whole, name) => args.get(name) ?? whole);
+    if (ref.includes("$")) continue; // still unresolved; skip rather than guess
+    const [repo, tag = "latest"] = ref.split(":");
+    images.push({ repo, tag });
+  }
+  return images;
+}
+
+async function checkRustToolchain() {
+  const pin = rustPin();
+  const latest = await latestRust();
+  return { ...pin, latest };
+}
+
+/// The newest tag that keeps the variant suffix the Dockerfile asked for.
+///
+/// `rust:1.95-bookworm` and `node:22-bookworm-slim` are not interchangeable
+/// with their plain counterparts, so a tag is only a candidate if it ends in
+/// exactly the suffix already in use.
+function bestTagFor(currentTag, tags) {
+  const m = /^([\d.]+)(-.*)?$/.exec(currentTag);
+  if (!m) return null;
+  const [, , suffix = ""] = m;
+
+  let best = null;
+  for (const tag of tags) {
+    if (suffix) {
+      if (!tag.endsWith(suffix)) continue;
+    } else if (!/^[\d.]+$/.test(tag)) {
+      continue;
+    }
+    const v = parseVersion(suffix ? tag.slice(0, -suffix.length) : tag);
+    // Date-stamped tags like `alpine:20260805` parse as versions but are edge
+    // or snapshot builds, not releases. No official image we track is anywhere
+    // near a three-digit major.
+    if (v && !suffix && v.major >= 100) continue;
+    if (v && (!best || compare(v, best) > 0)) best = v;
+  }
+  return best;
+}
+
+async function checkImages() {
+  const rows = [];
+  for (const { repo, tag } of baseImages()) {
+    const tags = await dockerTags(repo);
+    if (!tags) {
+      rows.push({ repo, from: tag, to: null, note: "could not check" });
+      continue;
+    }
+    const parsed = parseVersion(tag);
+    const best = bestTagFor(tag, tags);
+    if (!parsed || !best) {
+      rows.push({ repo, from: tag, to: null, note: "tag is not a version" });
+      continue;
+    }
+    // A base image major bump is a whole new distro release; same rule as a
+    // crate, so it is reported but flagged rather than treated as routine.
+    const bump = bumpKind(parsed, best);
+    rows.push({
+      repo,
+      from: tag,
+      to: fmt(best),
+      note: bump === "compatible" ? "" : "**breaking — needs review**",
+    });
+  }
+  return rows;
+}
+
+// ── report ──────────────────────────────────────────────────────────────────
+
+function table(rows, columns) {
+  const head = `| ${columns.map((c) => c.title).join(" | ")} |`;
+  const rule = `| ${columns.map(() => "---").join(" | ")} |`;
+  const body = rows.map((r) => `| ${columns.map((c) => c.get(r)).join(" | ")} |`);
+  return [head, rule, ...body].join("\n");
+}
+
+async function main() {
+  const [crates, rust, images] = await Promise.all([checkCrates(), checkRustToolchain(), checkImages()]);
+
+  // Split by who can act. Only a crate named in Cargo.toml can be moved by
+  // hand; everything else follows whichever direct dependency pulls it in, so
+  // listing those as tasks would be noise that trains the reader to ignore the
+  // report.
+  const direct = crates.filter((r) => r.direct);
+  const transitive = crates.filter((r) => !r.direct);
+  const routine = direct.filter((r) => r.kind === "compatible");
+  const breaking = direct.filter((r) => r.kind === "breaking");
+  const rustOutdated = Boolean(rust.latest && rust.image && rust.image !== rust.latest);
+  // Transitive crates held back by a version boundary upstream has not crossed.
+  // Worth knowing, not worth acting on.
+  const heldBack = transitive.filter((r) => r.kind === "breaking");
+
+  const parts = [];
+  const actionable = routine.length + breaking.length + images.length + (rustOutdated ? 1 : 0);
+  parts.push(
+    actionable === 0
+      ? "Everything you can act on is current."
+      : `${routine.length} routine bump${routine.length === 1 ? "" : "s"}, ` +
+          `${breaking.length} breaking change${breaking.length === 1 ? "" : "s"}` +
+          (images.length ? `, ${images.length} base image${images.length === 1 ? "" : "s"}` : "") +
+          (rustOutdated ? ", and a newer Rust" : "") +
+          ".",
+  );
+  if (heldBack.length) {
+    parts.push(
+      `_A further ${heldBack.length} transitive crates have newer releases blocked behind a ` +
+        "breaking boundary upstream has not crossed yet. They are omitted below because " +
+        "nothing here can move them._",
+    );
+  }
+
+  if (routine.length) {
+    parts.push(
+      "### Direct dependencies — `cargo update` covers these\n\n" +
+        table(routine, [
+          { title: "Crate", get: (r) => `\`${r.name}\`` },
+          { title: "In use", get: (r) => `\`${r.from}\`` },
+          { title: "Latest", get: (r) => `\`${r.to}\`` },
+        ]),
+    );
+  }
+
+  if (breaking.length) {
+    parts.push(
+      "### Direct dependencies — breaking, a human has to decide\n\n" +
+        "These cross a version boundary where semver allows anything to change. " +
+        "`cargo update` will not touch them: `Cargo.toml` needs editing and the " +
+        "changelog reading.\n\n" +
+        table(breaking, [
+          { title: "Crate", get: (r) => `\`${r.name}\`` },
+          { title: "In use", get: (r) => `\`${r.from}\`` },
+          { title: "Latest", get: (r) => `\`${r.to}\`` },
+        ]),
+    );
+  }
+
+  const rustRows = rust.latest
+    ? [
+        {
+          what: "Dockerfile `RUST_VERSION`",
+          using: rust.image ?? "not pinned",
+          latest: rust.latest,
+          note: rustOutdated ? "**the shipped binary is built by an older compiler**" : "current",
+        },
+        {
+          what: "`rust-toolchain.toml` channel",
+          using: rust.channel ?? "unknown",
+          latest: rust.latest,
+          note:
+            rust.channel === "stable"
+              ? "tracks stable, so it is already current"
+              : "pinned to a fixed release",
+        },
+      ]
+    : [
+        {
+          what: "latest stable Rust",
+          using: rust.image ?? "unknown",
+          latest: "—",
+          note: "could not reach static.rust-lang.org",
+        },
+      ];
+  parts.push(
+    "### Rust\n\n" +
+      table(rustRows, [
+        { title: "What", get: (r) => r.what },
+        { title: "Declared", get: (r) => `\`${r.using}\`` },
+        { title: "Latest", get: (r) => `\`${r.latest}\`` },
+        { title: "Note", get: (r) => r.note },
+      ]) +
+      (rust.msrv ? `\n\nMinimum supported Rust version: \`${rust.msrv}\`.` : ""),
+  );
+
+  if (images.length) {
+    parts.push(
+      "### Base images\n\n" +
+        table(images, [
+          { title: "Image", get: (r) => `\`${r.repo}\`` },
+          { title: "In use", get: (r) => `\`${r.from}\`` },
+          { title: "Latest", get: (r) => `\`${r.to}\`` },
+          { title: "Note", get: (r) => r.note },
+        ]),
+    );
+  }
+
+  parts.push("_Checked every 6 hours by `.gitea/workflows/dependency-check.yml`._");
+
+  console.log(parts.join("\n\n"));
+  // Machine-readable footer, so the workflow never has to parse prose.
+  console.error(
+    `::dep-check:: routine=${routine.length} breaking=${breaking.length} ` +
+      `images=${images.length} rust=${rustOutdated ? 1 : 0}`,
+  );
+}
+
+try {
+  await main();
+} catch (e) {
+  // Print the reason and exit non-zero. The workflow treats a missing report as
+  // a broken check rather than a clean bill of health, so this keeps the
+  // tracking issue open instead of closing it on no evidence.
+  console.error(`dependency check failed: ${e.message}`);
+  process.exit(1);
+}

.gitea/workflows/dependency-check.yml

@@ -0,0 +1,184 @@
+name: Check for dependency updates
+
+# Runs every six hours and reports anything out of date in one place: the
+# crates in Cargo.lock, the Rust pin in rust-toolchain.toml and the Dockerfile,
+# and the Dockerfile's base images.
+#
+# Everything lands in ONE issue titled "Dependency updates", edited in place
+# rather than commented on, so there is a single current answer instead of a
+# pile of history. When nothing is out of date the issue is closed — an empty
+# issue left open is a thing people stop reading, which defeats the point.
+#
+# Nothing is upgraded automatically. `cargo update` on a schedule would land
+# unreviewed code in a service that holds the operator's second factor, and a
+# breaking bump needs a human regardless.
+on:
+  schedule:
+    # Every six hours, off the hour so this doesn't compete with an image
+    # rebuild for a runner.
+    - cron: '23 */6 * * *'
+  workflow_dispatch:
+
+# One run at a time. A manual dispatch during a scheduled run would otherwise
+# race it and could open the issue twice.
+concurrency:
+  group: dependency-check
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # The toolchain comes from the repo rather than being hard-coded here, so
+      # the check runs on the same compiler the image ships with and this file
+      # can be copied between repos unchanged.
+      - name: Resolve the pinned Rust version
+        id: rust
+        run: |
+          set -eu
+          FILE=deploy/docker/Dockerfile
+          [ -f "$FILE" ] || FILE=Dockerfile
+          VERSION=$(grep -E '^ARG RUST_VERSION=' "$FILE" | head -1 | cut -d= -f2)
+          [ -n "$VERSION" ] || { echo "::error::no ARG RUST_VERSION in $FILE"; exit 1; }
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "checking with rust ${VERSION}"
+
+      # The workspace is streamed into the container over stdin rather than
+      # bind-mounted, so this works whether the runner shares a filesystem with
+      # the daemon or not.
+      #
+      # The image is rust + node, built from .gitea/scripts/ci.Dockerfile: the
+      # report needs cargo to resolve the workspace graph and Node to read the
+      # registries, and neither official image has both.
+      #
+      # RUSTUP_TOOLCHAIN overrides rust-toolchain.toml: the image's own
+      # toolchain is enough to read Cargo.lock, and honouring the file would
+      # make every run fetch a second compiler for no benefit.
+      #
+      # Cargo is deliberately *not* run offline: at least one project here
+      # depends on a crate published to a private registry, and `--offline`
+      # turns that into a failed resolution and therefore no report at all.
+      - name: Generate report
+        run: |
+          set -eu
+          VERSION="${{ steps.rust.outputs.version }}"
+          docker build \
+            --build-arg "RUST_VERSION=${VERSION}" \
+            --tag "dep-check:${VERSION}" \
+            --file .gitea/scripts/ci.Dockerfile \
+            .gitea/scripts > /dev/null
+
+          tar cf - --exclude=./.git --exclude=./target . | docker run --rm -i \
+            -e RUSTUP_TOOLCHAIN="${VERSION}" \
+            -e CARGO_TERM_COLOR=never \
+            "dep-check:${VERSION}" \
+            sh -ec 'mkdir -p /work && cd /work && tar xf - && exec node .gitea/scripts/dependency-report.mjs' \
+            > /tmp/report.md 2> /tmp/report.err || {
+              echo "::error::the dependency report failed to generate"
+              cat /tmp/report.err
+              exit 1
+            }
+
+          cat /tmp/report.md
+          grep -E '::dep-check::' /tmp/report.err || true
+
+          # An empty report is a broken check, not a clean bill of health.
+          # Failing here keeps the tracking issue open rather than closing it on
+          # the strength of a file that never got written.
+          test -s /tmp/report.md
+
+          grep -oE 'routine=[0-9]+ breaking=[0-9]+ images=[0-9]+ rust=[0-9]+' /tmp/report.err \
+            > /tmp/counts
+          cat /tmp/counts
+
+      - name: Open, update or close the tracking issue
+        env:
+          GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -eu
+          API="https://gitea.milesward.dev/api/v1"
+
+          node -e '
+            const fs = require("fs");
+
+            const report = fs.readFileSync("/tmp/report.md", "utf8").trim();
+            const counts = fs.readFileSync("/tmp/counts", "utf8").trim();
+            const [routine, breaking, images, rust] = counts.match(/[0-9]+/g).map(Number);
+            const actionable = routine + breaking + images + rust;
+
+            const body =
+              (actionable === 0
+                ? "Everything tracked is current. Closing this until something changes.\n\n"
+                : "") +
+              report +
+              "\n\n---\n\n" +
+              "Rewritten by `.gitea/workflows/dependency-check.yml` every 6 hours, so this is " +
+              "always the latest report rather than a pile of comments.";
+
+            fs.writeFileSync("/tmp/state.json", JSON.stringify({ actionable, body }));
+          '
+
+          ACTIONABLE=$(node -e 'process.stdout.write(String(require("/tmp/state.json").actionable))')
+          echo "actionable=$ACTIONABLE"
+
+          # Existing issue by title, any state: a previously closed one is
+          # exactly the one to update and reopen, and searching all states is
+          # also what stops a duplicate being created after a close.
+          #
+          # The `|| true` matters: `set -e` plus `pipefail` would abort the step
+          # on a transient API error, and creating a second issue is a far worse
+          # outcome than missing one run.
+          NUMBER=$(curl -sf -H "Authorization: token ${GITEA_TOKEN}" \
+            "${API}/repos/${REPO}/issues?state=all&type=issues&limit=100" \
+            | node -e '
+                let s = "";
+                process.stdin.on("data", d => s += d).on("end", () => {
+                  try {
+                    const issues = JSON.parse(s);
+                    const hit = issues.find(i => i.title === "Dependency updates");
+                    process.stdout.write(hit ? String(hit.number) : "");
+                  } catch { process.stdout.write(""); }
+                });
+              ' || true)
+
+          BODY=$(node -e 'process.stdout.write(JSON.stringify({ body: require("/tmp/state.json").body }))')
+
+          if [ -z "$NUMBER" ]; then
+            if [ "$ACTIONABLE" = "0" ]; then
+              echo "everything current and no issue open — nothing to do"
+              exit 0
+            fi
+            curl -sf -X POST -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "$(node -e 'process.stdout.write(JSON.stringify({ title: "Dependency updates", body: require("/tmp/state.json").body }))')" \
+              "${API}/repos/${REPO}/issues" > /dev/null
+            echo "opened the tracking issue"
+            exit 0
+          fi
+
+          curl -sf -X PATCH -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$BODY" "${API}/repos/${REPO}/issues/${NUMBER}" > /dev/null
+          echo "updated issue #${NUMBER}"
+
+          # Reopen when there is work, close when there isn't. Done as a second
+          # call because the state is not part of the body above.
+          if [ "$ACTIONABLE" = "0" ]; then WANT=closed; else WANT=open; fi
+          STATE=$(curl -sf -H "Authorization: token ${GITEA_TOKEN}" \
+            "${API}/repos/${REPO}/issues/${NUMBER}" \
+            | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>process.stdout.write(JSON.parse(s).state))')
+          if [ "$STATE" != "$WANT" ]; then
+            curl -sf -X PATCH -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "{\"state\":\"${WANT}\"}" "${API}/repos/${REPO}/issues/${NUMBER}" > /dev/null
+            echo "issue #${NUMBER}: ${STATE} -> ${WANT}"
+          fi

Cargo.lock

@@ -175,45 +175,6 @@ dependencies = [
  "password-hash",
 ]
 
-[[package]]
-name = "asn1-rs"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
-dependencies = [
- "asn1-rs-derive",
- "asn1-rs-impl",
- "displaydoc",
- "nom 7.1.3",
- "num-traits",
- "rusticata-macros",
- "thiserror",
- "time",
-]
-
-[[package]]
-name = "asn1-rs-derive"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
-]
-
-[[package]]
-name = "asn1-rs-impl"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "assert-json-diff"
 version = "2.0.2"
@@ -1144,20 +1105,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "der-parser"
-version = "10.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
-dependencies = [
- "asn1-rs",
- "displaydoc",
- "nom 7.1.3",
- "num-bigint",
- "num-traits",
- "rusticata-macros",
-]
-
 [[package]]
 name = "der_derive"
 version = "0.7.3"
@@ -2445,7 +2392,7 @@ dependencies = [
  "httpdate",
  "idna",
  "mime",
- "nom 8.0.0",
+ "nom",
  "percent-encoding",
  "quoted_printable",
  "rustls",
@@ -2564,12 +2511,6 @@ dependencies = [
  "unicase",
 ]
 
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -2702,16 +2643,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
 [[package]]
 name = "nom"
 version = "8.0.0"
@@ -2803,15 +2734,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "oid-registry"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
-dependencies = [
- "asn1-rs",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -2836,7 +2758,7 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "openpxe"
-version = "0.7.5"
+version = "0.8.2"
 dependencies = [
  "anyhow",
  "axum",
@@ -2848,17 +2770,15 @@ dependencies = [
  "openpxe-ipxe-assets",
  "openpxe-iso-store",
  "openpxe-tftp",
- "serde",
  "time",
  "tokio",
- "toml",
  "tracing",
  "tracing-subscriber",
 ]
 
 [[package]]
 name = "openpxe-core"
-version = "0.7.5"
+version = "0.8.2"
 dependencies = [
  "anyhow",
  "base64",
@@ -2867,7 +2787,6 @@ dependencies = [
  "figment",
  "flate2",
  "parking_lot",
- "quick-xml",
  "rcgen",
  "roxmltree",
  "serde",
@@ -2880,29 +2799,26 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "uuid",
- "x509-parser",
 ]
 
 [[package]]
 name = "openpxe-dhcp-proxy"
-version = "0.7.5"
+version = "0.8.2"
 dependencies = [
  "anyhow",
- "bytes",
  "dhcproto",
  "openpxe-core",
  "parking_lot",
  "serde_json",
  "socket2",
  "tempfile",
- "thiserror",
  "tokio",
  "tracing",
 ]
 
 [[package]]
 name = "openpxe-http-api"
-version = "0.7.5"
+version = "0.8.2"
 dependencies = [
  "anyhow",
  "axum",
@@ -2910,7 +2826,6 @@ dependencies = [
  "bergshamra",
  "bytes",
  "futures",
- "hyper",
  "image",
  "insta",
  "lettre",
@@ -2924,7 +2839,6 @@ dependencies = [
  "serde",
  "serde_json",
  "tempfile",
- "thiserror",
  "time",
  "tokio",
  "tokio-stream",
@@ -2938,17 +2852,16 @@ dependencies = [
 
 [[package]]
 name = "openpxe-ipxe-assets"
-version = "0.7.5"
+version = "0.8.2"
 dependencies = [
  "openpxe-core",
  "rust-embed",
- "thiserror",
  "tracing",
 ]
 
 [[package]]
 name = "openpxe-iso-store"
-version = "0.7.5"
+version = "0.8.2"
 dependencies = [
  "anyhow",
  "bcrypt",
@@ -2967,31 +2880,26 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "tempfile",
- "thiserror",
  "time",
  "tokio",
- "tokio-util",
  "tracing",
- "uuid",
 ]
 
 [[package]]
 name = "openpxe-tftp"
-version = "0.7.5"
+version = "0.8.2"
 dependencies = [
  "anyhow",
- "bytes",
  "openpxe-core",
  "openpxe-ipxe-assets",
  "socket2",
- "thiserror",
  "tokio",
  "tracing",
 ]
 
 [[package]]
 name = "openpxe-webui"
-version = "0.7.5"
+version = "0.8.2"
 
 [[package]]
 name = "p256"
@@ -3438,15 +3346,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
-[[package]]
-name = "quick-xml"
-version = "0.40.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2474bd2e5029e7ccb6abb2ba48cf2383a333851dedf495901544281590c7da7f"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "quinn"
 version = "0.11.9"
@@ -3933,15 +3832,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rusticata-macros"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
-dependencies = [
- "nom 7.1.3",
-]
-
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -5644,23 +5534,6 @@ dependencies = [
  "tls_codec",
 ]
 
-[[package]]
-name = "x509-parser"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
-dependencies = [
- "asn1-rs",
- "data-encoding",
- "der-parser",
- "lazy_static",
- "nom 7.1.3",
- "oid-registry",
- "rusticata-macros",
- "thiserror",
- "time",
-]
-
 [[package]]
 name = "yansi"
 version = "1.0.1"

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.7.5"
+version = "0.8.2"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -82,8 +82,6 @@ lettre = { version = "0.11", default-features = false, features = ["smtp-transpo
 # SP layer (AuthnRequest, metadata parse, SAMLResponse semantics) on top.
 bergshamra = "0.5"
 roxmltree = "0.21"
-quick-xml = "0.40"
-x509-parser = "0.18"
 # flate2 default backend is miniz_oxide (pure Rust) — do NOT enable the
 # zlib/zlib-ng C backends, which would break the musl-static build.
 flate2 = "1.1"

README.md

@@ -65,7 +65,10 @@ OpenPXE collapses that whole stack into **one statically-linked binary in one co
   hierarchy — generated fresh on every request from current settings.
 
 #### ISO management & remote libraries
-- **Drag-and-drop chunked uploads** that don't 502 on multi-GB images.
+- **Drag-and-drop chunked uploads** that don't 502 on multi-GB images — drop several at once
+  and they upload concurrently.
+- **Add by URL** — paste an ISO link and the server streams it straight into storage and
+  auto-detects it, with progress; no download-then-reupload.
 - **Automatic introspection** — detects the distro family and generates the right
   kernel+initrd or Windows `wimboot` chain. No manual config.
 - **Remote ISO libraries, streamed on demand** (no local cache) over **SMB, NFS, or SFTP** —
@@ -88,6 +91,9 @@ OpenPXE collapses that whole stack into **one statically-linked binary in one co
 - **Prometheus `/metrics`**, a built-in operator **terminal**, live tracing log, and
   `/healthz` · `/readyz` probes.
 - **Layered config** — defaults → TOML file → `OPENPXE_*` env, in that order.
+- **Zero-touch first run** — set `OPENPXE_ADMIN_USERNAME` + `OPENPXE_ADMIN_PASSWORD` and a
+  fresh container comes up with the admin already created, no setup wizard. Automate the rest
+  from scripts/Postman with a per-install **API key** (`x-api-key`), shown in Settings → Advanced.
 
 ## Built in Rust
 
@@ -236,6 +242,8 @@ All settings have defaults and layer **defaults → TOML (`--config` / `OPENPXE_
 | `OPENPXE_ISO_DIR` | `/var/lib/openpxe/isos` | Uploaded ISOs |
 | `OPENPXE_WORK_DIR` | `/var/lib/openpxe/work` | Scratch, settings, share + branding state |
 | `OPENPXE_LOG` | `info,openpxe=info` | `tracing` filter |
+| `OPENPXE_ADMIN_USERNAME` | — | First-run only: with `OPENPXE_ADMIN_PASSWORD`, auto-creates the admin so no setup wizard is needed. Ignored once an admin exists. |
+| `OPENPXE_ADMIN_PASSWORD` | — | First-run admin password. Use `OPENPXE_ADMIN_PASSWORD_FILE` to read it from a file (Docker/K8s secret). |
 
 ## OpenShift
 

crates/core/Cargo.toml

@@ -27,13 +27,11 @@ tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
 bcrypt.workspace = true
 
 # v0.5.1: pure-Rust SAML 2.0 SP. bergshamra = XML-DSig verify + exclusive
-# c14n (no OpenSSL/C). roxmltree/quick-xml parse + build SAML XML;
-# x509-parser pulls the IdP signing cert out of metadata; flate2+base64
-# encode the HTTP-Redirect binding's SAMLRequest.
+# c14n (no OpenSSL/C), plus IdP signing-cert extraction from metadata.
+# roxmltree parses the SAML/metadata XML; flate2+base64 encode the
+# HTTP-Redirect binding's SAMLRequest.
 bergshamra.workspace = true
 roxmltree.workspace = true
-quick-xml.workspace = true
-x509-parser.workspace = true
 flate2.workspace = true
 base64.workspace = true
 

crates/core/src/api_key.rs

@@ -0,0 +1,158 @@
+//! Operator API key — a single persisted secret that authenticates
+//! programmatic `/api/*` callers (Postman, scripts, CI) via the
+//! `x-api-key` header, as an alternative to the browser session cookie.
+//!
+//! Generated on first load and persisted to `<work_dir>/api_key.json` so
+//! it survives restarts — an operator pastes it into their client once.
+//! Regenerable from Settings → Advanced; the previous key stops working
+//! the moment a new one is minted. Grants the same access as a logged-in
+//! operator (the middleware treats a valid key exactly like a session).
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+use uuid::Uuid;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ApiKeyFile {
+    key: String,
+}
+
+/// Persisted operator API key. Cheap to clone (Arc-shared); contention is
+/// nil (read on every authenticated request, written only on regenerate).
+#[derive(Debug, Clone)]
+pub struct ApiKeyStore {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<String>>,
+}
+
+impl ApiKeyStore {
+    /// Load the stored key, minting + persisting a fresh one on first run
+    /// (or when the file is missing / corrupt / empty).
+    #[must_use]
+    pub fn load_or_init(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("api_key.json");
+        let key = match std::fs::read_to_string(&path) {
+            Ok(text) => serde_json::from_str::<ApiKeyFile>(&text)
+                .map(|f| f.key)
+                .ok()
+                .filter(|k| !k.is_empty())
+                .unwrap_or_else(generate_key),
+            Err(_) => generate_key(),
+        };
+        let store = Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(key)),
+        };
+        // Land a first-run (or repaired) key on disk immediately so it's
+        // stable across the very next restart.
+        store.persist();
+        store
+    }
+
+    #[must_use]
+    pub fn current(&self) -> String {
+        self.inner.read().clone()
+    }
+
+    /// Constant-time comparison against the stored key. An empty candidate
+    /// never matches, so a blank/absent header can't authenticate.
+    #[must_use]
+    pub fn verify(&self, candidate: &str) -> bool {
+        if candidate.is_empty() {
+            return false;
+        }
+        ct_eq(self.inner.read().as_bytes(), candidate.as_bytes())
+    }
+
+    /// Mint a fresh key, persist it, and return it. The previous key is
+    /// invalid the instant this returns.
+    #[must_use]
+    pub fn regenerate(&self) -> String {
+        let key = generate_key();
+        self.inner.write().clone_from(&key);
+        self.persist();
+        tracing::info!(target: "openpxe::auth", "operator API key regenerated");
+        key
+    }
+
+    fn persist(&self) {
+        let body = match serde_json::to_vec_pretty(&ApiKeyFile {
+            key: self.current(),
+        }) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::auth", "serialize api_key.json: {e}");
+                return;
+            }
+        };
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let tmp = self.path.with_extension("json.tmp");
+        if let Err(e) = std::fs::write(&tmp, body) {
+            tracing::warn!(target: "openpxe::auth", "write api_key.json tmp: {e}");
+            return;
+        }
+        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
+            tracing::warn!(target: "openpxe::auth", "rename api_key.json: {e}");
+        }
+    }
+}
+
+/// 128 random bits as 32 lowercase hex chars — unambiguous to copy-paste
+/// into an `x-api-key` header. UUID v4 is already our CSPRNG-backed source
+/// for session ids, so no new dependency.
+fn generate_key() -> String {
+    Uuid::new_v4().simple().to_string()
+}
+
+/// Length-checked constant-time byte compare — keeps key verification from
+/// leaking the matched-prefix length via timing. A 128-bit random secret
+/// isn't practically timing-attackable over a network, but the check is
+/// four lines, so we keep it.
+fn ct_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0u8;
+    for (x, y) in a.iter().zip(b.iter()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn generates_persists_and_reloads() {
+        let dir = tempdir().unwrap();
+        let s = ApiKeyStore::load_or_init(dir.path());
+        let k = s.current();
+        assert_eq!(k.len(), 32, "32 hex chars = 128 bits");
+        assert!(s.verify(&k));
+        assert!(!s.verify("wrong"));
+        assert!(!s.verify(""), "blank header must not authenticate");
+        // Reload from disk → same key (survives restart).
+        let s2 = ApiKeyStore::load_or_init(dir.path());
+        assert_eq!(s2.current(), k);
+    }
+
+    #[test]
+    fn regenerate_invalidates_old() {
+        let dir = tempdir().unwrap();
+        let s = ApiKeyStore::load_or_init(dir.path());
+        let old = s.current();
+        let new = s.regenerate();
+        assert_ne!(old, new);
+        assert!(s.verify(&new));
+        assert!(!s.verify(&old), "old key must stop working");
+        // Persisted: a reload sees the new key.
+        let s2 = ApiKeyStore::load_or_init(dir.path());
+        assert_eq!(s2.current(), new);
+    }
+}

crates/core/src/lib.rs

@@ -2,6 +2,7 @@
 //! runtime settings, and the Queued Deployment queue.
 #![forbid(unsafe_code)]
 
+pub mod api_key;
 pub mod arch;
 pub mod auth;
 pub mod boot_log;
@@ -23,6 +24,7 @@ pub mod settings;
 pub mod sso;
 pub mod wol;
 
+pub use api_key::ApiKeyStore;
 pub use arch::{ClientArch, DriverMode, FirmwareClass};
 pub use auth::{AdminAccount, AdminPublic, AdminStore};
 pub use boot_log::{BootEvent, BootLog};

crates/dhcp-proxy/Cargo.toml

@@ -15,9 +15,7 @@ tokio.workspace = true
 socket2.workspace = true
 dhcproto.workspace = true
 tracing.workspace = true
-thiserror.workspace = true
 anyhow.workspace = true
-bytes.workspace = true
 parking_lot.workspace = true
 # v0.7.1: learned driver modes persist to <work_dir>/driver_modes.json.
 serde_json.workspace = true

crates/http-api/Cargo.toml

@@ -25,11 +25,9 @@ time.workspace = true
 axum.workspace = true
 tower.workspace = true
 tower-http.workspace = true
-hyper.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 tracing.workspace = true
-thiserror.workspace = true
 anyhow.workspace = true
 bytes.workspace = true
 futures.workspace = true

crates/http-api/src/app.rs

@@ -94,6 +94,17 @@ pub fn build_router(state: AppState) -> Router {
         // JSON API.
         .route("/api/isos", get(api_list_isos).post(api_upload_iso))
         .route("/api/isos/{id}", delete(api_delete_iso))
+        // v0.8.1: add ISO by URL — server-side streaming download + progress
+        // polling. Static `fetch` coexists with `{id}` above (matchit
+        // prioritizes the literal), same as `/api/queue/join` vs `{entry_id}`.
+        .route(
+            "/api/isos/fetch",
+            get(crate::fetch::api_iso_fetch_list).post(crate::fetch::api_iso_fetch_start),
+        )
+        .route(
+            "/api/isos/fetch/{id}",
+            delete(crate::fetch::api_iso_fetch_cancel),
+        )
         .route("/api/uploads", post(api_upload_begin))
         .route(
             "/api/uploads/{upload_id}",
@@ -147,6 +158,14 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/logout", post(auth_api::api_logout))
         .route("/api/me", get(auth_api::api_me))
         .route("/api/me/credentials", put(auth_api::api_update_credentials))
+        // v0.8.0: operator API key surface (read current + regenerate).
+        // Gated by require_auth like the rest of /api/*; a logged-in
+        // operator or an x-api-key holder can read/rotate it.
+        .route("/api/api-key", get(auth_api::api_api_key_get))
+        .route(
+            "/api/api-key/regenerate",
+            post(auth_api::api_api_key_regenerate),
+        )
         // SAML SSO configuration (FleetDM-shaped). Gated behind auth — the
         // operator pastes their IdP metadata, Entity ID, and toggles here.
         .route("/api/sso", get(api_sso_get).put(api_sso_put))
@@ -1849,6 +1868,12 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Clear an ISO's boot password."},
                     {"method": "PUT", "path": "/api/isos/{id}/category",
                      "summary": "Set the menu category. Body: { \"category\": \"os\" | \"tools\" }."},
+                    {"method": "POST", "path": "/api/isos/fetch",
+                     "summary": "Add an ISO by URL. Body: { \"url\", \"filename\"? }. The server streams the .iso into storage and introspects it. Returns { fetch_id }."},
+                    {"method": "GET", "path": "/api/isos/fetch",
+                     "summary": "Poll URL-fetch progress — [{ id, filename, url, downloaded, total, state }]. Completed jobs are returned once."},
+                    {"method": "DELETE", "path": "/api/isos/fetch/{id}",
+                     "summary": "Cancel an in-flight URL fetch, or dismiss a finished/failed one."},
                 ],
             },
             {
@@ -1944,6 +1969,10 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Auth status — { setup_required, authenticated, user }. Always 200."},
                     {"method": "PUT", "path": "/api/me/credentials",
                      "summary": "Rotate the admin's credentials. Body: { current_password, new_username?, new_password? }. Revokes all other sessions on success."},
+                    {"method": "GET", "path": "/api/api-key",
+                     "summary": "Return the operator API key + the header to send it in (x-api-key). That header authenticates API calls without a browser session — full operator access."},
+                    {"method": "POST", "path": "/api/api-key/regenerate",
+                     "summary": "Mint a fresh API key, invalidating the previous one immediately."},
                 ],
             },
             {

crates/http-api/src/auth.rs

@@ -52,6 +52,12 @@ const SESSION_TTL: Duration = Duration::from_hours(24);
 /// to avoid collisions with anything else sharing the host.
 pub const SESSION_COOKIE: &str = "openpxe_session";
 
+/// Header an API client sends to authenticate without a browser session.
+/// Matches the de-facto `x-api-key` convention operators already use with
+/// other appliances. A valid key grants the same access as a logged-in
+/// operator. See [`crate::state::AppState::api_key`].
+pub const API_KEY_HEADER: &str = "x-api-key";
+
 #[derive(Debug, Clone)]
 struct Session {
     username: String,
@@ -223,13 +229,18 @@ pub async fn require_auth(
     if is_public_path(path) {
         return next.run(req).await;
     }
-    // Authenticated path. The cookie must be present, map to a live
-    // session, and the TTL refresh happens as a side-effect.
-    let token = parse_cookie(req.headers());
-    if let Some(t) = token {
-        if state.sessions.touch(&t).is_some() {
-            return next.run(req).await;
-        }
+    // Authenticated path: either a live operator session cookie (the
+    // browser) or the x-api-key header (scripts / Postman). Touching the
+    // cookie refreshes its idle TTL as a side-effect.
+    let session_ok =
+        parse_cookie(req.headers()).is_some_and(|t| state.sessions.touch(&t).is_some());
+    let key_ok = req
+        .headers()
+        .get(API_KEY_HEADER)
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(|k| state.api_key.verify(k));
+    if session_ok || key_ok {
+        return next.run(req).await;
     }
     (
         StatusCode::UNAUTHORIZED,
@@ -447,6 +458,28 @@ pub async fn api_update_credentials(
     }
 }
 
+/// Return the current operator API key plus the header to send it in.
+/// Gated by the auth middleware, so only a logged-in operator (or a
+/// caller already holding the key) can read it.
+pub async fn api_api_key_get(State(state): State<AppState>) -> Response {
+    (
+        StatusCode::OK,
+        Json(json!({ "key": state.api_key.current(), "header": API_KEY_HEADER })),
+    )
+        .into_response()
+}
+
+/// Mint a fresh operator API key, invalidating the previous one, and
+/// return it. Same gating as the GET.
+pub async fn api_api_key_regenerate(State(state): State<AppState>) -> Response {
+    let key = state.api_key.regenerate();
+    (
+        StatusCode::OK,
+        Json(json!({ "key": key, "header": API_KEY_HEADER })),
+    )
+        .into_response()
+}
+
 #[derive(Debug, Serialize)]
 struct LoginPayload<'a> {
     user: &'a AdminPublic,

crates/http-api/src/fetch.rs

@@ -0,0 +1,485 @@
+//! Server-side "add ISO by URL" — stream a remote `.iso` straight into the
+//! store, reusing the chunked-upload handle + introspection pipeline so a
+//! URL-fetched image classifies and gains boot entries exactly like an
+//! uploaded one. A small in-memory job registry tracks progress; the web UI
+//! polls it and renders rows just like browser uploads.
+//!
+//! This is operator-initiated and auth-gated (`/api/*`), never runs at boot,
+//! and adds no CDN assets — so it doesn't touch OpenPXE's offline-boot
+//! guarantee. On an air-gapped network it simply goes unused (upload
+//! instead). It's the same class of optional outbound the server already
+//! makes for webhooks and the update check.
+
+use crate::state::AppState;
+use axum::{
+    extract::{Path, State},
+    http::{header, StatusCode},
+    response::{IntoResponse, Response},
+    Json,
+};
+use futures::StreamExt;
+use openpxe_core::{Error, Result};
+use openpxe_iso_store::IsoStore;
+use parking_lot::Mutex;
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use uuid::Uuid;
+
+/// Hard ceiling on a URL-fetched image — matches the HTTP upload body cap
+/// (`DefaultBodyLimit` in `app.rs`).
+const MAX_ISO_BYTES: u64 = 16 * 1024 * 1024 * 1024;
+
+/// How long a finished-with-error job lingers so the operator can read the
+/// failure before it's swept. Successful jobs are read-once (see
+/// [`FetchJobs::snapshot`]).
+const FAILED_TTL: Duration = Duration::from_mins(10);
+
+#[derive(Clone)]
+enum Phase {
+    Downloading,
+    Done { iso_id: String },
+    Failed { error: String },
+    Canceled,
+}
+
+struct Job {
+    /// Best-known target filename (provisional from the URL, refined once
+    /// the response headers arrive).
+    filename: String,
+    /// Display-safe source URL — any `user:pass@` userinfo is stripped so
+    /// the UI/logs never echo embedded credentials.
+    url: String,
+    downloaded: u64,
+    /// Total bytes from `Content-Length`, or `0` when the server didn't
+    /// send one (progress then shows bytes-so-far without a percentage).
+    total: u64,
+    phase: Phase,
+    cancel: bool,
+    finished_at: Option<Instant>,
+}
+
+/// One row in the fetch-progress list the UI polls.
+#[derive(Serialize)]
+pub struct JobDto {
+    id: String,
+    filename: String,
+    url: String,
+    downloaded: u64,
+    total: u64,
+    /// `downloading` | `done` | `failed` | `canceled`.
+    state: &'static str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    iso_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    error: Option<String>,
+}
+
+/// In-memory registry of in-flight and recently-finished URL fetches.
+/// Cheap to clone (Arc-shared); contention is nil (a handful of jobs, brief
+/// per-chunk progress bumps).
+#[derive(Clone, Default)]
+pub struct FetchJobs {
+    inner: Arc<Mutex<HashMap<String, Arc<Mutex<Job>>>>>,
+}
+
+impl FetchJobs {
+    /// Validate the URL, register a job, and spawn the background download.
+    /// Returns the job id. Fails fast on a bad/unsupported URL so the POST
+    /// gets an immediate error instead of a job that dies a moment later.
+    pub fn start(
+        &self,
+        store: IsoStore,
+        raw_url: &str,
+        filename_hint: Option<&str>,
+    ) -> Result<String> {
+        let (url, display) = parse_and_sanitize(raw_url)?;
+        // Provisional filename for the first render; the task refines it
+        // from Content-Disposition / the post-redirect URL.
+        let provisional = filename_hint
+            .map(sanitize_filename)
+            .or_else(|| basename(&url))
+            .unwrap_or_else(|| "download.iso".to_string());
+
+        let id = Uuid::new_v4().simple().to_string();
+        let job = Arc::new(Mutex::new(Job {
+            filename: provisional,
+            url: display,
+            downloaded: 0,
+            total: 0,
+            phase: Phase::Downloading,
+            cancel: false,
+            finished_at: None,
+        }));
+        self.inner.lock().insert(id.clone(), job.clone());
+
+        let hint = filename_hint.map(str::to_string);
+        tokio::spawn(async move {
+            if let Err(e) = download(&store, &job, url, hint).await {
+                let mut g = job.lock();
+                // A cancel flips the phase itself; don't overwrite it.
+                if !matches!(g.phase, Phase::Canceled) {
+                    g.phase = Phase::Failed {
+                        error: format!("{e}"),
+                    };
+                }
+                g.finished_at = Some(Instant::now());
+            }
+        });
+        Ok(id)
+    }
+
+    /// Snapshot every job for the UI, then sweep the terminal ones:
+    /// `Done`/`Canceled` are **read-once** (removed after this call, so the
+    /// UI reacts to completion exactly once and never loops on a lingering
+    /// "done" row), while `Failed` is retained until [`FAILED_TTL`] so the
+    /// error stays visible.
+    pub fn snapshot(&self) -> Vec<JobDto> {
+        let mut g = self.inner.lock();
+        let mut out = Vec::with_capacity(g.len());
+        for (id, job) in g.iter() {
+            let j = job.lock();
+            let (state, iso_id, error) = match &j.phase {
+                Phase::Downloading => ("downloading", None, None),
+                Phase::Done { iso_id } => ("done", Some(iso_id.clone()), None),
+                Phase::Failed { error } => ("failed", None, Some(error.clone())),
+                Phase::Canceled => ("canceled", None, None),
+            };
+            out.push(JobDto {
+                id: id.clone(),
+                filename: j.filename.clone(),
+                url: j.url.clone(),
+                downloaded: j.downloaded,
+                total: j.total,
+                state,
+                iso_id,
+                error,
+            });
+        }
+        let now = Instant::now();
+        g.retain(|_, job| {
+            let j = job.lock();
+            match &j.phase {
+                Phase::Downloading => true,
+                Phase::Done { .. } | Phase::Canceled => false, // read-once
+                Phase::Failed { .. } => j
+                    .finished_at
+                    .is_none_or(|t| now.duration_since(t) < FAILED_TTL),
+            }
+        });
+        out
+    }
+
+    /// Cancel an in-flight download, or dismiss a terminal one. Returns
+    /// `true` if a job with that id existed.
+    pub fn cancel(&self, id: &str) -> bool {
+        let g = self.inner.lock();
+        let Some(job) = g.get(id) else { return false };
+        let mut j = job.lock();
+        if matches!(j.phase, Phase::Downloading) {
+            j.cancel = true; // the download loop checks this each chunk
+        } else {
+            drop(j);
+            drop(g);
+            self.inner.lock().remove(id);
+        }
+        true
+    }
+}
+
+/// The background download: GET the URL, derive + validate the filename,
+/// then stream the body through an `UploadHandle` (which hashes, writes the
+/// `.partial`, and on `finish` renames + introspects).
+async fn download(
+    store: &IsoStore,
+    job: &Arc<Mutex<Job>>,
+    url: reqwest::Url,
+    filename_hint: Option<String>,
+) -> Result<()> {
+    let client = reqwest::Client::builder()
+        .connect_timeout(Duration::from_secs(15))
+        .user_agent(concat!("OpenPXE/", env!("CARGO_PKG_VERSION")))
+        .build()
+        .map_err(|e| Error::Other(e.into()))?;
+
+    let resp = client
+        .get(url)
+        .send()
+        .await
+        .map_err(|e| Error::Invalid(format!("request failed: {e}")))?;
+    if !resp.status().is_success() {
+        return Err(Error::Invalid(format!("server returned {}", resp.status())));
+    }
+
+    let cd = resp
+        .headers()
+        .get(header::CONTENT_DISPOSITION)
+        .and_then(|v| v.to_str().ok());
+    let filename = pick_filename(filename_hint.as_deref(), cd, resp.url())?;
+    let total = resp.content_length().unwrap_or(0);
+    if total > MAX_ISO_BYTES {
+        return Err(Error::Invalid(format!(
+            "declared size {total} exceeds the {MAX_ISO_BYTES}-byte cap"
+        )));
+    }
+    {
+        let mut g = job.lock();
+        g.filename.clone_from(&filename);
+        g.total = total;
+    }
+
+    let mut handle = store.begin_upload(&filename).await?;
+    let mut stream = resp.bytes_stream();
+    let mut received: u64 = 0;
+    while let Some(item) = stream.next().await {
+        if job.lock().cancel {
+            let _ = handle.abort().await;
+            job.lock().phase = Phase::Canceled;
+            job.lock().finished_at = Some(Instant::now());
+            return Ok(());
+        }
+        let chunk = item.map_err(|e| Error::Invalid(format!("transfer error: {e}")))?;
+        received += chunk.len() as u64;
+        if received > MAX_ISO_BYTES {
+            let _ = handle.abort().await;
+            return Err(Error::Invalid(format!(
+                "download exceeded the {MAX_ISO_BYTES}-byte cap"
+            )));
+        }
+        if let Err(e) = handle.write_chunk(&chunk).await {
+            let _ = handle.abort().await;
+            return Err(e);
+        }
+        job.lock().downloaded = received;
+    }
+
+    let meta = handle.finish(store).await?;
+    tracing::info!(
+        target: "openpxe::http::fetch",
+        filename = %filename, bytes = received, family = ?meta.introspection.family,
+        "fetched ISO from URL"
+    );
+    let mut g = job.lock();
+    g.downloaded = received;
+    g.phase = Phase::Done { iso_id: meta.id };
+    g.finished_at = Some(Instant::now());
+    Ok(())
+}
+
+/// Parse the URL, require an `http`/`https` scheme (no `file:`/`gopher:`/…),
+/// and return it alongside a credential-stripped display form.
+fn parse_and_sanitize(raw: &str) -> Result<(reqwest::Url, String)> {
+    let url = reqwest::Url::parse(raw.trim())
+        .map_err(|_| Error::Invalid("not a valid URL".to_string()))?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(Error::Invalid(
+            "only http:// and https:// URLs are accepted".to_string(),
+        ));
+    }
+    let mut display = url.clone();
+    let _ = display.set_username("");
+    let _ = display.set_password(None);
+    Ok((url, display.to_string()))
+}
+
+/// Choose the target filename: explicit hint > `Content-Disposition` >
+/// post-redirect URL basename. Must end in `.iso` (case-insensitive).
+fn pick_filename(
+    explicit: Option<&str>,
+    content_disposition: Option<&str>,
+    final_url: &reqwest::Url,
+) -> Result<String> {
+    let candidate = explicit
+        .map(sanitize_filename)
+        .or_else(|| content_disposition.and_then(filename_from_disposition))
+        .or_else(|| basename(final_url))
+        .ok_or_else(|| Error::Invalid("could not determine a filename".to_string()))?;
+    if !candidate.to_ascii_lowercase().ends_with(".iso") {
+        return Err(Error::Invalid(format!(
+            "URL does not point at an .iso (got '{candidate}')"
+        )));
+    }
+    Ok(candidate)
+}
+
+/// Last path segment of a URL, percent-decoded and reduced to a bare
+/// filename. `None` for a pathless URL.
+fn basename(url: &reqwest::Url) -> Option<String> {
+    let seg = url.path_segments()?.next_back()?;
+    if seg.is_empty() {
+        return None;
+    }
+    let decoded = percent_decode(seg);
+    Some(sanitize_filename(&decoded))
+}
+
+/// Pull `filename="x.iso"` (or bare `filename=x.iso`) out of a
+/// `Content-Disposition` header. RFC 5987 `filename*` is ignored — the
+/// common case is enough, and the URL basename is the fallback.
+fn filename_from_disposition(cd: &str) -> Option<String> {
+    let idx = cd.to_ascii_lowercase().find("filename=")?;
+    let rest = &cd[idx + "filename=".len()..];
+    let val = rest.trim_start().trim_start_matches('"');
+    let end = val.find(['"', ';']).unwrap_or(val.len());
+    let name = val[..end].trim();
+    if name.is_empty() {
+        None
+    } else {
+        Some(sanitize_filename(name))
+    }
+}
+
+/// Reduce any path-ish string to a safe bare filename: last component only,
+/// no `/`, `\`, or NULs. Prevents a crafted `Content-Disposition`/URL from
+/// escaping the ISO directory.
+fn sanitize_filename(s: &str) -> String {
+    s.rsplit(['/', '\\'])
+        .next()
+        .unwrap_or(s)
+        .replace('\0', "")
+        .trim()
+        .to_string()
+}
+
+/// Minimal percent-decoding for a single path segment (enough for `%20`
+/// spaces in an ISO name); leaves malformed escapes untouched.
+fn percent_decode(s: &str) -> String {
+    let bytes = s.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == b'%' && i + 2 < bytes.len() {
+            if let (Some(h), Some(l)) = (hexval(bytes[i + 1]), hexval(bytes[i + 2])) {
+                out.push(h << 4 | l);
+                i += 3;
+                continue;
+            }
+        }
+        out.push(bytes[i]);
+        i += 1;
+    }
+    String::from_utf8_lossy(&out).into_owned()
+}
+
+fn hexval(b: u8) -> Option<u8> {
+    match b {
+        b'0'..=b'9' => Some(b - b'0'),
+        b'a'..=b'f' => Some(b - b'a' + 10),
+        b'A'..=b'F' => Some(b - b'A' + 10),
+        _ => None,
+    }
+}
+
+// ── Handlers ──────────────────────────────────────────────────────────────
+
+#[derive(Deserialize)]
+pub struct FetchBody {
+    pub url: String,
+    #[serde(default)]
+    pub filename: Option<String>,
+}
+
+/// `POST /api/isos/fetch` — start a URL download.
+pub async fn api_iso_fetch_start(
+    State(state): State<AppState>,
+    Json(body): Json<FetchBody>,
+) -> Response {
+    match state
+        .fetch_jobs
+        .start(state.iso_store.clone(), &body.url, body.filename.as_deref())
+    {
+        Ok(id) => (StatusCode::ACCEPTED, Json(json!({ "fetch_id": id }))).into_response(),
+        Err(Error::Invalid(msg)) => {
+            (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
+        }
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({ "error": format!("{e}") })),
+        )
+            .into_response(),
+    }
+}
+
+/// `GET /api/isos/fetch` — poll progress. Successful jobs appear once.
+pub async fn api_iso_fetch_list(State(state): State<AppState>) -> Response {
+    (
+        StatusCode::OK,
+        Json(json!({ "jobs": state.fetch_jobs.snapshot() })),
+    )
+        .into_response()
+}
+
+/// `DELETE /api/isos/fetch/{id}` — cancel an in-flight download or dismiss a
+/// finished/failed row.
+pub async fn api_iso_fetch_cancel(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Response {
+    if state.fetch_jobs.cancel(&id) {
+        StatusCode::NO_CONTENT.into_response()
+    } else {
+        (
+            StatusCode::NOT_FOUND,
+            Json(json!({ "error": "no such fetch job" })),
+        )
+            .into_response()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn scheme_is_restricted_and_credentials_are_stripped() {
+        assert!(parse_and_sanitize("file:///etc/passwd").is_err());
+        assert!(parse_and_sanitize("gopher://x/1").is_err());
+        assert!(parse_and_sanitize("not a url").is_err());
+        let (_, display) = parse_and_sanitize("https://user:[email protected]/a.iso").unwrap();
+        assert!(
+            !display.contains("secret"),
+            "credentials must be stripped: {display}"
+        );
+        assert!(display.starts_with("https://example.com/"));
+    }
+
+    #[test]
+    fn filename_prefers_explicit_then_disposition_then_url() {
+        let u = reqwest::Url::parse("https://example.com/path/final.iso").unwrap();
+        // Explicit wins, and path traversal is stripped.
+        assert_eq!(
+            pick_filename(Some("../../evil/custom.iso"), None, &u).unwrap(),
+            "custom.iso"
+        );
+        // Content-Disposition next.
+        assert_eq!(
+            pick_filename(None, Some(r#"attachment; filename="rescue.iso""#), &u).unwrap(),
+            "rescue.iso"
+        );
+        // URL basename fallback (with percent-decoding).
+        let sp = reqwest::Url::parse("https://example.com/System%20Rescue.iso").unwrap();
+        assert_eq!(pick_filename(None, None, &sp).unwrap(), "System Rescue.iso");
+        // Non-.iso is rejected.
+        assert!(pick_filename(
+            None,
+            None,
+            &reqwest::Url::parse("https://x/y.tar.gz").unwrap()
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn disposition_parsing_handles_quotes_and_bare() {
+        assert_eq!(
+            filename_from_disposition(r#"attachment; filename="a.iso"; size=1"#).as_deref(),
+            Some("a.iso")
+        );
+        assert_eq!(
+            filename_from_disposition("inline; filename=b.iso").as_deref(),
+            Some("b.iso")
+        );
+        assert_eq!(filename_from_disposition("attachment").as_deref(), None);
+    }
+}

crates/http-api/src/ipxe_script.rs

@@ -85,10 +85,25 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
     // iPXE evaluates `iseq` lazily, so we only set whichever line
     // matches. Anything not on the allowlist falls through to a generic
     // `<buildarch> <platform>` display.
+    //
+    // v0.8.2: one probe per line, each terminated with `|| echo` (`echo`
+    // is the harmless rc-0 no-op; there is no `true` command in iPXE).
+    // The previous single line tried to chain the probes with `||` and
+    // ended in `|| true`, which is not an iPXE command: on any
+    // arch/platform pair outside the allowlist (e.g. i386 + efi) the
+    // command failed and aborted the script before the menu was drawn.
     let _ = writeln!(s, "set arch-label ${{buildarch}} ${{platform}}");
     let _ = writeln!(
         s,
-        "iseq ${{buildarch}} i386   && iseq ${{platform}} pcbios && set arch-label x86 BIOS         || iseq ${{buildarch}} x86_64 && iseq ${{platform}} efi    && set arch-label x86_64 UEFI      || iseq ${{buildarch}} arm64  && iseq ${{platform}} efi    && set arch-label arm64 UEFI       || true"
+        "iseq ${{buildarch}} i386   && iseq ${{platform}} pcbios && set arch-label x86 BIOS     || echo"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{buildarch}} x86_64 && iseq ${{platform}} efi    && set arch-label x86_64 UEFI  || echo"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{buildarch}} arm64  && iseq ${{platform}} efi    && set arch-label arm64 UEFI   || echo"
     );
     let _ = writeln!(s, ":menu");
     let _ = writeln!(s, "menu OpenPXE - network boot menu");
@@ -151,34 +166,44 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
         );
     }
 
-    // iPXE's `||` is strict about what follows. Each test uses `goto menu`
-    // as the fallthrough target so the parser never sees a bare `||` with
-    // trailing whitespace — some iPXE builds reject that.
+    // v0.8.2: dispatch via `goto <item-value>` labels. This is the
+    // canonical iPXE menu pattern (ipxe.org examples) and, unlike
+    // `iseq ... && chain ... || goto menu`, it is not sensitive to the
+    // left-associative `&&`/`||` evaluation order that broke item
+    // selection in issue #2: for `A && B || C` iPXE runs C whenever A
+    // fails, so every item except the first used to skip its chain and
+    // bounce straight back to `goto menu` — redrawing the menu with the
+    // default (Queued Deployment) item highlighted, as if Enter did
+    // nothing.
+    //
+    // Menu-to-menu transitions use `chain --replace`: the replacement
+    // image becomes the top-most image, so `exit` from any submenu
+    // reaches the firmware and repeated Back/forward navigation does not
+    // nest script images (iPXE tail-recurses into replacements, so the
+    // stack stays flat). A failed fetch still returns an error, which
+    // the trailing `|| goto menu` turns into a menu redraw.
+    let _ = writeln!(s, "goto ${{target}} || goto menu");
+    let _ = writeln!(s, ":local");
+    let _ = writeln!(s, "chain --replace {base}/boot/_local.ipxe || goto menu");
+    let _ = writeln!(s, ":linux");
     let _ = writeln!(
         s,
-        "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu"
+        "chain --replace {base}/boot/_linux_menu.ipxe || goto menu"
     );
+    let _ = writeln!(s, ":windows");
     let _ = writeln!(
         s,
-        "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu"
+        "chain --replace {base}/boot/_windows_menu.ipxe || goto menu"
     );
+    let _ = writeln!(s, ":tools");
     let _ = writeln!(
         s,
-        "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu"
+        "chain --replace {base}/boot/_tools_menu.ipxe || goto menu"
     );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} queue   && chain {base}/boot/_queue.ipxe         || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} exit    && exit                                 || goto menu"
-    );
-    let _ = writeln!(s, "goto menu");
+    let _ = writeln!(s, ":queue");
+    let _ = writeln!(s, "chain --replace {base}/boot/_queue.ipxe || goto menu");
+    let _ = writeln!(s, ":exit");
+    let _ = writeln!(s, "exit 0");
     s
 }
 
@@ -244,18 +269,21 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back   < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
-    );
+    // v0.8.2: `back` is the only fixed item here; every other item value
+    // is a boot-entry id that can only be resolved at runtime, so dispatch
+    // on it directly. `echo` is iPXE's rc-0 no-op and keeps a
+    // non-matching test from aborting the script (issue #2).
+    let _ = writeln!(s, "iseq ${{target}} back && goto back || echo");
     // Pass `?mac=${mac}` so the per-entry handler can record the booting
     // client into the Host log. iPXE substitutes `${mac}` before
     // the HTTP fetch; if the firmware can't resolve it the literal
     // `${mac}` is sent and the server treats it as "unknown".
     let _ = writeln!(
         s,
-        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+        "chain --replace {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
     );
+    let _ = writeln!(s, ":back");
+    let _ = writeln!(s, "chain --replace {base}/boot.ipxe || goto menu");
     s
 }
 
@@ -331,36 +359,34 @@ pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item --key b back     < Back to main menu");
     let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} reboot   && reboot                        || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} firmware && exit 0                        || goto menu"
-    );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
-    );
+    // v0.8.2: fixed item labels jump to their block; category-Tools ISO
+    // ids (only known at runtime) fall through to the entry chain. Every
+    // probe ends in `|| echo` so a non-matching test cannot abort the
+    // script (issue #2).
+    let _ = writeln!(s, "iseq ${{target}} util     && goto util     || echo");
+    let _ = writeln!(s, "iseq ${{target}} shell    && goto shell    || echo");
+    let _ = writeln!(s, "iseq ${{target}} nic      && goto nic      || echo");
+    let _ = writeln!(s, "iseq ${{target}} reboot   && goto reboot   || echo");
+    let _ = writeln!(s, "iseq ${{target}} firmware && goto firmware || echo");
+    let _ = writeln!(s, "iseq ${{target}} back     && goto back     || echo");
     // Fall-through for category-Tools ISO ids — same as the family
     // submenu, carrying `?mac=${mac}` for the boot log.
     let _ = writeln!(
         s,
-        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+        "chain --replace {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
     );
+    let _ = writeln!(s, ":util");
+    let _ = writeln!(s, "chain --replace {base}/boot/_util.ipxe || goto menu");
+    let _ = writeln!(s, ":shell");
+    let _ = writeln!(s, "chain --replace {base}/boot/_shell.ipxe || goto menu");
+    let _ = writeln!(s, ":nic");
+    let _ = writeln!(s, "chain --replace {base}/boot/_nic.ipxe || goto menu");
+    let _ = writeln!(s, ":reboot");
+    let _ = writeln!(s, "reboot || goto menu");
+    let _ = writeln!(s, ":firmware");
+    let _ = writeln!(s, "exit 0");
+    let _ = writeln!(s, ":back");
+    let _ = writeln!(s, "chain --replace {base}/boot.ipxe || goto menu");
     s
 }
 
@@ -384,7 +410,7 @@ pub fn render_local_hdd(base_url: &str) -> String {
     );
     let _ = writeln!(s, "exit 0");
     let _ = writeln!(s, "# If the above exit returns, loop back to the main menu");
-    let _ = writeln!(s, "chain {base}/boot.ipxe");
+    let _ = writeln!(s, "chain --replace {base}/boot.ipxe");
     s
 }
 
@@ -402,15 +428,18 @@ pub fn render_util(base_url: &str) -> String {
     let _ = writeln!(s, "item --gap");
     let _ = writeln!(s, "item back         < Back");
     let _ = writeln!(s, "choose target || goto menu");
+    // v0.8.2: dispatch to `:memtest`; anything else (only `back` exists
+    // today) returns to the Tools menu. The old `iseq back && chain
+    // _tools_menu || goto menu` pair never ran the Tools chain: the
+    // `back` line's own `iseq` failed first, so `|| goto menu` redrew
+    // Utilities and Back appeared dead (issue #2).
+    let _ = writeln!(s, "iseq ${{target}} memtest && goto memtest || echo");
     let _ = writeln!(
         s,
-        "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || goto menu"
+        "chain --replace {base}/boot/_tools_menu.ipxe || goto menu"
     );
-    let _ = writeln!(
-        s,
-        "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || goto menu"
-    );
-    let _ = writeln!(s, "goto menu");
+    let _ = writeln!(s, ":memtest");
+    let _ = writeln!(s, "chain --replace {base}/ipxe/memtest.bin || goto menu");
     s
 }
 
@@ -425,7 +454,7 @@ pub fn render_shell(base_url: &str) -> String {
     let _ = writeln!(s, "echo   'exit' returns to the main menu");
     let _ = writeln!(s, "echo ==========================================");
     let _ = writeln!(s, "shell");
-    let _ = writeln!(s, "chain {base}/boot.ipxe");
+    let _ = writeln!(s, "chain --replace {base}/boot.ipxe");
     s
 }
 
@@ -443,8 +472,11 @@ pub fn render_nic_info(base_url: &str) -> String {
     let _ = writeln!(s, "route");
     let _ = writeln!(s, "echo");
     let _ = writeln!(s, "echo 'Press any key to return to menu'");
-    let _ = writeln!(s, "prompt --timeout 30000");
-    let _ = writeln!(s, "chain {base}/boot.ipxe");
+    // v0.8.2: `prompt` returns -ETIMEDOUT when nobody presses a key, and
+    // a bare failing line aborts the script (dropping the client back to
+    // firmware). `|| echo` treats the timeout as "return to menu now".
+    let _ = writeln!(s, "prompt --timeout 30000 || echo");
+    let _ = writeln!(s, "chain --replace {base}/boot.ipxe");
     s
 }
 
@@ -464,7 +496,13 @@ pub fn render_queue_entry(base_url: &str) -> String {
     // imgfetch writes the body to a file in iPXE's transient FS; we read
     // the queue entry id out of the Location-style header by asking the server
     // to put it in the response body as a single token.
-    let _ = writeln!(s, "chain --replace {base}/api/queue/join?mac=${{mac}}");
+    // v0.8.2: if the queue endpoint is unreachable, fall back to the main
+    // menu instead of aborting the whole boot chain into firmware.
+    let _ = writeln!(
+        s,
+        "chain --replace {base}/api/queue/join?mac=${{mac}} \
+         || chain --replace {base}/boot.ipxe"
+    );
     s
 }
 
@@ -505,16 +543,21 @@ pub fn render_entry(
                     cmdline.push_str(extra.trim());
                 }
             }
-            let _ = writeln!(s, "kernel {base}/{kernel_url} {cmdline}");
+            // v0.8.2: every fetch line carries its own failure branch.
+            // Menus now enter boot entries with `chain --replace`, so a
+            // failing line here can no longer be caught by the *menu's*
+            // `|| goto menu` — the entry script must return to the menu
+            // itself.
+            let _ = writeln!(s, "kernel {base}/{kernel_url} {cmdline} || goto failed");
             for u in initrd_urls {
-                let _ = writeln!(s, "initrd {base}/{u}");
+                let _ = writeln!(s, "initrd {base}/{u} || goto failed");
             }
             let _ = writeln!(s, "boot || goto failed");
         }
         BootKind::Wimboot { wimboot_url, files } => {
-            let _ = writeln!(s, "kernel {base}/{wimboot_url}");
+            let _ = writeln!(s, "kernel {base}/{wimboot_url} || goto failed");
             for (tag, url) in files {
-                let _ = writeln!(s, "initrd --name {tag} {base}/{url} {tag}");
+                let _ = writeln!(s, "initrd --name {tag} {base}/{url} {tag} || goto failed");
             }
             let _ = writeln!(s, "boot || goto failed");
         }
@@ -525,7 +568,7 @@ pub fn render_entry(
     let _ = writeln!(s, ":failed");
     let _ = writeln!(s, "echo Boot failed - returning to menu in 5s");
     let _ = writeln!(s, "sleep 5");
-    let _ = writeln!(s, "chain {base}/boot.ipxe");
+    let _ = writeln!(s, "chain --replace {base}/boot.ipxe");
     s
 }
 
@@ -589,9 +632,14 @@ pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str
     let _ = writeln!(s, "echo ==========================================");
     let _ = writeln!(s, "set password ");
     let _ = writeln!(s, "read --secret password");
+    // v0.8.2: `isset` (empty → nonzero rc) is the correct emptiness
+    // test. `iseq ${password} ""` compared against the *literal* token
+    // `""` — iPXE's tokenizer is whitespace-only and has no quoting, so
+    // an empty Enter never matched and fell through to the failed-login
+    // path instead of returning to the menu as the banner promises.
     let _ = writeln!(
         s,
-        "iseq ${{password}} \"\" && chain {base}/boot.ipxe || goto submit"
+        "isset ${{password}} && goto submit || chain --replace {base}/boot.ipxe"
     );
     let _ = writeln!(s, ":submit");
     let _ = writeln!(s, "echo Verifying...");
@@ -601,8 +649,8 @@ pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str
     // as "unknown" rather than refusing to boot.
     let _ = writeln!(
         s,
-        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}}&mac=${{mac}} \
-         || chain {base}/boot.ipxe"
+        "chain --replace {base}/boot/{entry_id}.ipxe?token=${{password:uristring}}&mac=${{mac}} \
+         || chain --replace {base}/boot.ipxe"
     );
     s
 }
@@ -621,7 +669,7 @@ pub fn render_password_failed(entry_id: &str, base_url: &str) -> String {
     let _ = writeln!(s, "sleep 2");
     let _ = writeln!(
         s,
-        "chain {base}/boot/{entry_id}.ipxe || chain {base}/boot.ipxe"
+        "chain --replace {base}/boot/{entry_id}.ipxe || chain --replace {base}/boot.ipxe"
     );
     s
 }
@@ -640,7 +688,13 @@ mod password_tests {
         assert!(s.contains("token=${password:uristring}"));
         // Empty enter sends back to the main menu, not back into the prompt
         // (avoids a wedged client if the operator chose by mistake).
-        assert!(s.contains("&& chain http://10.0.0.5/boot.ipxe || goto submit"));
+        assert!(
+            s.contains(
+                "isset ${password} && goto submit \
+                 || chain --replace http://10.0.0.5/boot.ipxe"
+            ),
+            "empty-password path missing:\n{s}"
+        );
         // Never log/echo the value.
         assert!(!s.contains("echo ${password"));
     }
@@ -650,7 +704,7 @@ mod password_tests {
         let s = render_password_failed("alpha-linux", "http://10.0.0.5");
         assert!(s.contains("Wrong password."));
         // Re-target the entry so the prompt flow runs again.
-        assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
+        assert!(s.contains("chain --replace http://10.0.0.5/boot/alpha-linux.ipxe"));
     }
 
     #[test]
@@ -741,3 +795,489 @@ mod password_tests {
         }
     }
 }
+
+/// Control-flow regression tests for the generated iPXE menus.
+///
+/// Issue #2 ("menu cannot select items") was a script-semantics bug:
+/// iPXE evaluates `&&` / `||` strictly left to right, so
+/// `iseq ${target} X && chain … || goto menu` runs `goto menu` whenever
+/// the `iseq` fails — for every item except the first one. Text
+/// assertions cannot catch that, so these tests run the generated
+/// scripts through a small interpreter that mirrors the parts of iPXE's
+/// `system()` (`src/core/exec.c`) and `process_script()`
+/// (`src/image/script.c`) that the menus rely on, and check which URL
+/// each menu item actually reaches.
+#[cfg(test)]
+mod menu_dispatch_tests {
+    use super::*;
+    use openpxe_iso_store::{IsoCategory, IsoSource, KernelArgs};
+    use std::collections::HashMap;
+
+    const BASE: &str = "http://10.0.0.5";
+
+    /// What a script did before it left the interpreter.
+    #[derive(Debug, Default)]
+    struct Run {
+        /// URLs passed to `chain`, in order (normally exactly one).
+        chains: Vec<String>,
+        /// Exit status if the script reached `exit`.
+        exit: Option<u32>,
+        /// Whether the script reached `reboot`.
+        rebooted: bool,
+    }
+
+    #[derive(Clone, Copy)]
+    enum Sep {
+        /// `&&`
+        And,
+        /// `||`
+        Or,
+        /// `;`
+        Always,
+    }
+
+    enum LineOutcome {
+        Continue,
+        Jump(usize),
+        Done,
+        Abort(String),
+    }
+
+    enum CmdOutcome {
+        Rc(i32),
+        Jump(usize),
+        Done,
+        Abort(String),
+    }
+
+    /// Minimal interpreter for the subset of iPXE's script language used
+    /// by the generated menus.
+    struct IpxeSim {
+        vars: HashMap<String, String>,
+        selection: String,
+        /// Value the simulated operator types at `read`.
+        input: String,
+        /// Model `prompt --timeout` expiring with no key pressed.
+        prompt_times_out: bool,
+        run: Run,
+    }
+
+    impl IpxeSim {
+        fn new(selection: &str) -> Self {
+            let mut vars = HashMap::new();
+            vars.insert("buildarch".to_string(), "x86_64".to_string());
+            vars.insert("platform".to_string(), "efi".to_string());
+            vars.insert("mac".to_string(), "aa:bb:cc:dd:ee:ff".to_string());
+            vars.insert("password".to_string(), String::new());
+            Self {
+                vars,
+                selection: selection.to_string(),
+                input: String::new(),
+                prompt_times_out: false,
+                run: Run::default(),
+            }
+        }
+
+        fn with_var(mut self, name: &str, value: &str) -> Self {
+            self.vars.insert(name.to_string(), value.to_string());
+            self
+        }
+
+        fn with_input(mut self, value: &str) -> Self {
+            self.input = value.to_string();
+            self
+        }
+
+        /// Run a script to completion and report what it did. Panics if
+        /// the script aborts or never reaches a terminal command — which
+        /// is exactly how a bad dispatch line manifests on a real client.
+        fn run(mut self, script: &str) -> Run {
+            let lines: Vec<&str> = script.lines().collect();
+            let mut labels: HashMap<String, usize> = HashMap::new();
+            for (index, line) in lines.iter().enumerate() {
+                if let Some(name) = line.trim().strip_prefix(':') {
+                    labels.insert(name.trim().to_string(), index);
+                }
+            }
+            let mut pc = 0;
+            let mut steps = 0;
+            while pc < lines.len() {
+                steps += 1;
+                assert!(
+                    steps < 10_000,
+                    "script looped without making progress\n--- script ---\n{script}"
+                );
+                let line = lines[pc].trim().to_string();
+                if line.is_empty() || line.starts_with('#') || line.starts_with(':') {
+                    pc += 1;
+                    continue;
+                }
+                match self.exec_line(&line, &labels) {
+                    LineOutcome::Continue => pc += 1,
+                    LineOutcome::Jump(target) => pc = target + 1,
+                    LineOutcome::Done => return self.run,
+                    LineOutcome::Abort(why) => {
+                        panic!("script aborted at line {pc}: {why}\n--- script ---\n{script}");
+                    }
+                }
+            }
+            panic!("script ended without booting or exiting\n--- script ---\n{script}");
+        }
+
+        /// Expand `${name}` / `${name:modifier}` from the simulated
+        /// settings. iPXE expands *after* tokenising, so a value
+        /// containing spaces stays a single argument.
+        fn expand(&self, token: &str) -> String {
+            let mut out = String::new();
+            let mut rest = token;
+            while let Some(start) = rest.find("${") {
+                out.push_str(&rest[..start]);
+                let after = &rest[start + 2..];
+                let Some(end) = after.find('}') else {
+                    out.push_str(&rest[start..]);
+                    return out;
+                };
+                let spec = &after[..end];
+                let name = spec.split(':').next().unwrap_or(spec);
+                if let Some(value) = self.vars.get(name) {
+                    out.push_str(value);
+                }
+                rest = &after[end + 1..];
+            }
+            out.push_str(rest);
+            out
+        }
+
+        /// Execute one command line, mirroring `system()`: commands are
+        /// separated by `&&` / `||` / `;`, and each separator decides
+        /// whether the *next* command runs based on the last status.
+        fn exec_line(&mut self, line: &str, labels: &HashMap<String, usize>) -> LineOutcome {
+            let mut commands: Vec<(Vec<String>, Option<Sep>)> = Vec::new();
+            let mut current: Vec<String> = Vec::new();
+            for token in tokenize(line) {
+                match token.as_str() {
+                    "&&" => commands.push((std::mem::take(&mut current), Some(Sep::And))),
+                    "||" => commands.push((std::mem::take(&mut current), Some(Sep::Or))),
+                    ";" => commands.push((std::mem::take(&mut current), Some(Sep::Always))),
+                    _ => current.push(token),
+                }
+            }
+            commands.push((current, None));
+
+            let mut rc = 0;
+            let mut process = true;
+            for (argv, sep) in &commands {
+                if process {
+                    if argv.is_empty() {
+                        return LineOutcome::Abort(format!("empty command in `{line}`"));
+                    }
+                    match self.exec_cmd(argv, labels) {
+                        CmdOutcome::Rc(status) => rc = status,
+                        CmdOutcome::Jump(target) => return LineOutcome::Jump(target),
+                        CmdOutcome::Done => return LineOutcome::Done,
+                        CmdOutcome::Abort(why) => return LineOutcome::Abort(why),
+                    }
+                }
+                match sep {
+                    Some(Sep::And) => process = rc == 0,
+                    Some(Sep::Or) => process = rc != 0,
+                    Some(Sep::Always) => process = true,
+                    None => break,
+                }
+            }
+            if rc != 0 {
+                return LineOutcome::Abort(format!("`{line}` failed with status {rc}"));
+            }
+            LineOutcome::Continue
+        }
+
+        fn exec_cmd(&mut self, argv: &[String], labels: &HashMap<String, usize>) -> CmdOutcome {
+            let cmd = self.expand(&argv[0]);
+            let args: Vec<String> = argv[1..].iter().map(|a| self.expand(a)).collect();
+            match cmd.as_str() {
+                "set" => {
+                    if let Some(name) = args.first() {
+                        let value = if args.len() > 1 {
+                            args[1..].join(" ")
+                        } else {
+                            String::new()
+                        };
+                        self.vars.insert(name.clone(), value);
+                    }
+                    CmdOutcome::Rc(0)
+                }
+                "iseq" => {
+                    let equal = args.len() >= 2 && args[0] == args[1];
+                    CmdOutcome::Rc(i32::from(!equal))
+                }
+                "isset" => {
+                    let nonempty = args.first().is_some_and(|value| !value.is_empty());
+                    CmdOutcome::Rc(i32::from(!nonempty))
+                }
+                "goto" => match args.first().and_then(|label| labels.get(label)) {
+                    Some(target) => CmdOutcome::Jump(*target),
+                    None => CmdOutcome::Abort(format!("goto to missing label in `{argv:?}`")),
+                },
+                "exit" => {
+                    let code = args
+                        .first()
+                        .and_then(|value| value.parse::<u32>().ok())
+                        .unwrap_or(0);
+                    self.run.exit = Some(code);
+                    CmdOutcome::Done
+                }
+                // A boot takes over the machine (and `chain --replace`
+                // additionally replaces the current script image), so the
+                // interpreter records the URL and stops.
+                "chain" | "boot" | "imgexec" | "sanboot" => {
+                    let url = args
+                        .iter()
+                        .find(|arg| !arg.starts_with('-'))
+                        .cloned()
+                        .unwrap_or_default();
+                    self.run.chains.push(url);
+                    CmdOutcome::Done
+                }
+                "reboot" => {
+                    self.run.rebooted = true;
+                    CmdOutcome::Done
+                }
+                "choose" => {
+                    let mut index = 0;
+                    let mut setting = None;
+                    while index < args.len() {
+                        match args[index].as_str() {
+                            "--default" | "--timeout" | "--key" => index += 2,
+                            option if option.starts_with('-') => index += 1,
+                            name => {
+                                setting = Some(name.to_string());
+                                index += 1;
+                            }
+                        }
+                    }
+                    if let Some(name) = setting {
+                        self.vars.insert(name, self.selection.clone());
+                    }
+                    CmdOutcome::Rc(0)
+                }
+                "read" => {
+                    if let Some(name) = args.iter().find(|arg| !arg.starts_with('-')) {
+                        let typed = self.input.clone();
+                        self.vars.insert(name.clone(), typed);
+                    }
+                    CmdOutcome::Rc(0)
+                }
+                "prompt" => CmdOutcome::Rc(i32::from(self.prompt_times_out)),
+                "echo" | "console" | "menu" | "item" | "sleep" | "ifstat" | "route" | "shell"
+                | "kernel" | "initrd" | "imgfetch" => CmdOutcome::Rc(0),
+                other => CmdOutcome::Abort(format!("unknown iPXE command `{other}`")),
+            }
+        }
+    }
+
+    /// iPXE splits on whitespace only — it has no shell quoting.
+    fn tokenize(line: &str) -> Vec<String> {
+        line.split_whitespace().map(str::to_string).collect()
+    }
+
+    // ---- fixtures ----
+
+    fn test_iso(id: &str, family: DistroFamily, entries: Vec<BootEntry>) -> IsoMeta {
+        IsoMeta {
+            id: id.to_string(),
+            filename: format!("{id}.iso"),
+            size_bytes: 700 * 1024 * 1024,
+            sha256_hex: None,
+            uploaded_at: time::OffsetDateTime::UNIX_EPOCH,
+            introspection: openpxe_iso_store::IntrospectionReport {
+                family,
+                ..Default::default()
+            },
+            boot_entries: entries,
+            source: IsoSource::Local,
+            password_hash: None,
+            category: IsoCategory::default(),
+        }
+    }
+
+    fn linux_entry(id: &str) -> BootEntry {
+        BootEntry {
+            id: id.to_string(),
+            title: format!("Title {id}"),
+            kind: BootKind::LinuxKernel {
+                kernel_url: format!("iso/{id}/boot/vmlinuz"),
+                initrd_urls: vec![format!("iso/{id}/boot/initrd")],
+                args: KernelArgs::default(),
+            },
+        }
+    }
+
+    // ---- top-level menu ----
+
+    #[test]
+    fn every_top_menu_item_reaches_its_own_script() {
+        let settings = Settings::default();
+        let menu = render_menu(&[], &settings, BASE);
+        for (item, expected) in [
+            ("local", "/boot/_local.ipxe"),
+            ("linux", "/boot/_linux_menu.ipxe"),
+            ("windows", "/boot/_windows_menu.ipxe"),
+            ("tools", "/boot/_tools_menu.ipxe"),
+            ("queue", "/boot/_queue.ipxe"),
+        ] {
+            let run = IpxeSim::new(item).run(&menu);
+            assert_eq!(
+                run.chains,
+                vec![format!("{BASE}{expected}")],
+                "item `{item}` did not reach its script"
+            );
+            assert_eq!(run.exit, None, "item `{item}` should not exit");
+        }
+    }
+
+    #[test]
+    fn exit_item_exits_the_firmware() {
+        let menu = render_menu(&[], &Settings::default(), BASE);
+        let run = IpxeSim::new("exit").run(&menu);
+        assert_eq!(run.exit, Some(0));
+        assert!(run.chains.is_empty(), "{:?}", run.chains);
+    }
+
+    #[test]
+    fn unknown_architecture_does_not_abort_the_menu() {
+        // The old arch-label line ended in `|| true`, which is not an
+        // iPXE command: any arch/platform pair outside the allowlist
+        // aborted the whole script. `|| echo` keeps the generic label.
+        for (arch, platform) in [("riscv64", "efi"), ("arm64", "pcbios"), ("i386", "efi")] {
+            let run = IpxeSim::new("local")
+                .with_var("buildarch", arch)
+                .with_var("platform", platform)
+                .run(&render_menu(&[], &Settings::default(), BASE));
+            assert_eq!(run.chains.len(), 1, "menu aborted on {arch}/{platform}");
+        }
+    }
+
+    // ---- family (installer) menu ----
+
+    #[test]
+    fn family_menu_dispatches_each_entry_and_back() {
+        let isos = vec![
+            test_iso(
+                "alpha",
+                DistroFamily::DebianUbuntu,
+                vec![linux_entry("alpha-linux")],
+            ),
+            test_iso(
+                "beta",
+                DistroFamily::Alpine,
+                vec![linux_entry("beta-linux")],
+            ),
+        ];
+        let menu = render_family_menu(&isos, BASE, false);
+        for id in ["alpha-linux", "beta-linux"] {
+            let run = IpxeSim::new(id).run(&menu);
+            assert_eq!(
+                run.chains,
+                vec![format!("{BASE}/boot/{id}.ipxe?mac=aa:bb:cc:dd:ee:ff")],
+                "entry `{id}` fell through to the menu"
+            );
+        }
+        let run = IpxeSim::new("back").run(&menu);
+        assert_eq!(run.chains, vec![format!("{BASE}/boot.ipxe")]);
+    }
+
+    // ---- tools menu ----
+
+    #[test]
+    fn tools_menu_dispatches_every_item() {
+        let mut iso = test_iso(
+            "tool",
+            DistroFamily::Unknown,
+            vec![linux_entry("tool-disk")],
+        );
+        iso.category = IsoCategory::Tools;
+        let menu = render_tools_menu(&[iso], BASE);
+        for (item, expected) in [
+            ("util", format!("{BASE}/boot/_util.ipxe")),
+            ("shell", format!("{BASE}/boot/_shell.ipxe")),
+            ("nic", format!("{BASE}/boot/_nic.ipxe")),
+            ("back", format!("{BASE}/boot.ipxe")),
+            (
+                "tool-disk",
+                format!("{BASE}/boot/tool-disk.ipxe?mac=aa:bb:cc:dd:ee:ff"),
+            ),
+        ] {
+            let run = IpxeSim::new(item).run(&menu);
+            assert_eq!(run.chains, vec![expected], "item `{item}`");
+        }
+        let run = IpxeSim::new("reboot").run(&menu);
+        assert!(run.rebooted, "reboot item did not reboot");
+        let run = IpxeSim::new("firmware").run(&menu);
+        assert_eq!(run.exit, Some(0), "firmware item did not exit");
+    }
+
+    // ---- utilities menu ----
+
+    #[test]
+    fn util_menu_dispatches_memtest_and_back() {
+        let menu = render_util(BASE);
+        let run = IpxeSim::new("memtest").run(&menu);
+        assert_eq!(run.chains, vec![format!("{BASE}/ipxe/memtest.bin")]);
+        let run = IpxeSim::new("back").run(&menu);
+        assert_eq!(run.chains, vec![format!("{BASE}/boot/_tools_menu.ipxe")]);
+    }
+
+    // ---- small scripts reached from the menus ----
+
+    #[test]
+    fn shell_and_queue_scripts_end_in_their_chain() {
+        let run = IpxeSim::new("").run(&render_shell(BASE));
+        assert_eq!(run.chains, vec![format!("{BASE}/boot.ipxe")]);
+        let run = IpxeSim::new("").run(&render_queue_entry(BASE));
+        assert_eq!(
+            run.chains,
+            vec![format!("{BASE}/api/queue/join?mac=aa:bb:cc:dd:ee:ff")]
+        );
+    }
+
+    #[test]
+    fn nic_info_prompt_timeout_returns_to_menu() {
+        let mut sim = IpxeSim::new("");
+        sim.prompt_times_out = true;
+        let run = sim.run(&render_nic_info(BASE));
+        assert_eq!(run.chains, vec![format!("{BASE}/boot.ipxe")]);
+    }
+
+    #[test]
+    fn password_prompt_empty_enter_returns_to_main_menu() {
+        let menu = render_password_prompt("alpha-linux", "Alpha.iso", BASE);
+        let run = IpxeSim::new("").run(&menu);
+        assert_eq!(run.chains, vec![format!("{BASE}/boot.ipxe")]);
+        let run = IpxeSim::new("").with_input("hunter2").run(&menu);
+        assert_eq!(
+            run.chains,
+            vec![format!(
+                "{BASE}/boot/alpha-linux.ipxe?token=hunter2&mac=aa:bb:cc:dd:ee:ff"
+            )]
+        );
+    }
+
+    #[test]
+    fn boot_entry_scripts_recover_to_the_menu_on_failed_fetches() {
+        // Menus now chain entries with `--replace`, so the entry script —
+        // not the caller — has to recover from a failed kernel/initrd
+        // fetch. Otherwise a flaky mirror drops the client to firmware.
+        let settings = Settings::default();
+        let s = render_entry(&linux_entry("alpha-linux"), &settings, BASE, None);
+        for line in s
+            .lines()
+            .filter(|line| line.starts_with("kernel ") || line.starts_with("initrd "))
+        {
+            assert!(
+                line.ends_with("|| goto failed"),
+                "missing failure branch on `{line}`"
+            );
+        }
+        assert!(s.contains("chain --replace http://10.0.0.5/boot.ipxe"));
+    }
+}

crates/http-api/src/lib.rs

@@ -17,6 +17,7 @@
 pub mod app;
 pub mod auth;
 pub mod error;
+pub mod fetch;
 pub mod grub_script;
 pub mod ipxe_script;
 pub mod log_stream;

crates/http-api/src/snapshots/openpxe_http_api__ipxe_script__password_tests__render_menu_snapshot.snap

@@ -1,5 +1,6 @@
 ---
 source: crates/http-api/src/ipxe_script.rs
+assertion_line: 787
 expression: rendered
 ---
 #!ipxe
@@ -9,7 +10,9 @@ set esc:hex 1b
 set cls ${esc:string}[2J
 iseq ${platform} efi && console --picture http://10.0.0.5/branding/pxe-logo --top 290 || console
 set arch-label ${buildarch} ${platform}
-iseq ${buildarch} i386   && iseq ${platform} pcbios && set arch-label x86 BIOS         || iseq ${buildarch} x86_64 && iseq ${platform} efi    && set arch-label x86_64 UEFI      || iseq ${buildarch} arm64  && iseq ${platform} efi    && set arch-label arm64 UEFI       || true
+iseq ${buildarch} i386   && iseq ${platform} pcbios && set arch-label x86 BIOS     || echo
+iseq ${buildarch} x86_64 && iseq ${platform} efi    && set arch-label x86_64 UEFI  || echo
+iseq ${buildarch} arm64  && iseq ${platform} efi    && set arch-label arm64 UEFI   || echo
 :menu
 menu OpenPXE - network boot menu
 item --gap
@@ -27,10 +30,16 @@ item --key x exit     Exit iPXE
 item --gap
 item --gap --                 OpenPXE vX.Y.Z  -  ${arch-label}
 choose --default queue --timeout 600000 target || goto menu
-iseq ${target} local   && chain http://10.0.0.5/boot/_local.ipxe        || goto menu
-iseq ${target} linux   && chain http://10.0.0.5/boot/_linux_menu.ipxe   || goto menu
-iseq ${target} windows && chain http://10.0.0.5/boot/_windows_menu.ipxe || goto menu
-iseq ${target} tools   && chain http://10.0.0.5/boot/_tools_menu.ipxe   || goto menu
-iseq ${target} queue   && chain http://10.0.0.5/boot/_queue.ipxe         || goto menu
-iseq ${target} exit    && exit                                 || goto menu
-goto menu
+goto ${target} || goto menu
+:local
+chain --replace http://10.0.0.5/boot/_local.ipxe || goto menu
+:linux
+chain --replace http://10.0.0.5/boot/_linux_menu.ipxe || goto menu
+:windows
+chain --replace http://10.0.0.5/boot/_windows_menu.ipxe || goto menu
+:tools
+chain --replace http://10.0.0.5/boot/_tools_menu.ipxe || goto menu
+:queue
+chain --replace http://10.0.0.5/boot/_queue.ipxe || goto menu
+:exit
+exit 0

crates/http-api/src/state.rs

@@ -1,8 +1,9 @@
 use crate::auth::SessionStore;
+use crate::fetch::FetchJobs;
 use crate::saml_routes::SamlRuntime;
 use crate::uploads::UploadSessions;
 use openpxe_core::{
-    AdminStore, BootLog, BootRulesStore, BootTokens, BrandingStore, ClientRegistry,
+    AdminStore, ApiKeyStore, BootLog, BootRulesStore, BootTokens, BrandingStore, ClientRegistry,
     DeploymentQueue, HostBindings, LogBus, Metrics, NotifyStore, SettingsStore, SsoStore,
 };
 use openpxe_iso_store::{
@@ -55,6 +56,11 @@ pub struct AppState {
     /// process restart (sessions are tied to UI state, not persisted —
     /// matches Sonarr/Radarr behaviour).
     pub sessions: SessionStore,
+    /// v0.8.0: persisted operator API key. A request carrying a matching
+    /// `x-api-key` header authenticates exactly like an operator session,
+    /// so scripts / Postman can drive `/api/*` without a browser login.
+    /// Generated on first run; regenerable from Settings → Advanced.
+    pub api_key: ApiKeyStore,
     /// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
     pub sso: SsoStore,
     /// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs
@@ -103,6 +109,10 @@ pub struct AppState {
     /// through `IsoStore`, but the UI uses sessions so large ISO transfers
     /// can show deterministic progress and leave visible partial files.
     pub uploads: UploadSessions,
+    /// v0.8.1: server-side "add ISO by URL" jobs. Background downloads
+    /// streamed straight into the store (reusing the upload handle +
+    /// introspection); the Storage view polls their progress.
+    pub fetch_jobs: FetchJobs,
     /// Live log bus consumed by the Terminal tab via SSE. Operator-issued
     /// terminal commands also push synthetic lines onto it so the tail
     /// shows them inline.

crates/http-api/tests/full_flow.rs

@@ -99,6 +99,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let admin = openpxe_core::AdminStore::load_or_default(dir.path());
     let sso = openpxe_core::SsoStore::load_or_default(dir.path());
     let notify = openpxe_core::NotifyStore::load_or_default(dir.path());
+    let api_key = openpxe_core::ApiKeyStore::load_or_init(dir.path());
     let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
     let state = AppState {
@@ -114,6 +115,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         pxe_bg_cache: openpxe_http_api::state::PxeBgCache::default(),
         admin,
         sessions,
+        api_key,
         sso,
         saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
         notify,
@@ -124,6 +126,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         sftp_shares,
         unattended,
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
+        fetch_jobs: openpxe_http_api::fetch::FetchJobs::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: "http://127.0.0.1".into(),
@@ -135,6 +138,109 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     (state, dir)
 }
 
+#[tokio::test]
+async fn api_key_authenticates_gated_endpoints() {
+    // v0.8.0: the x-api-key header authenticates /api/* like an operator
+    // session. The middleware only enforces once an admin is configured
+    // (before that everything is open), so bootstrap one first.
+    let (state, _dir) = build_state().await;
+    state
+        .admin
+        .bootstrap("admin", "correct-horse-battery-staple")
+        .unwrap();
+    let key = state.api_key.current();
+    let app = build_router(state);
+
+    // No credentials → 401.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/api/isos")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "no auth must 401");
+
+    // Wrong key → 401.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/api/isos")
+                .header("x-api-key", "not-the-key")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "wrong key must 401");
+
+    // Correct key → 200 (operator-equivalent access).
+    let res = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/isos")
+                .header("x-api-key", key)
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK, "valid key must authenticate");
+}
+
+#[tokio::test]
+async fn fetch_iso_by_url_downloads_into_store() {
+    // v0.8.1: add-ISO-by-URL. Serve a real ISO over HTTP, POST its URL, poll
+    // the fetch registry until the background download finishes, then assert
+    // the image landed in the store (classified like an upload).
+    use wiremock::matchers::{method, path};
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let iso = fake_alpine_iso();
+    let server = MockServer::start().await;
+    Mock::given(method("GET"))
+        .and(path("/rescue.iso"))
+        .respond_with(ResponseTemplate::new(200).set_body_bytes(iso))
+        .mount(&server)
+        .await;
+    let url = format!("{}/rescue.iso", server.uri());
+
+    let (code, _) = post_json(&app, "/api/isos/fetch", &format!(r#"{{"url":"{url}"}}"#)).await;
+    assert_eq!(code, StatusCode::ACCEPTED, "fetch should start");
+
+    // Bounded poll for completion (the download runs on a spawned task).
+    let mut done = false;
+    for _ in 0..100 {
+        let (_, body) = get(&app, "/api/isos/fetch").await;
+        let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+        let jobs = v["jobs"].as_array().cloned().unwrap_or_default();
+        assert!(
+            !jobs.iter().any(|j| j["state"] == "failed"),
+            "fetch failed: {jobs:?}"
+        );
+        if jobs.iter().any(|j| j["state"] == "done") {
+            done = true;
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+    }
+    assert!(done, "fetch did not complete in time");
+
+    // The fetched ISO is now in the store under the URL basename.
+    let (_, body) = get(&app, "/api/isos").await;
+    assert!(
+        String::from_utf8_lossy(&body).contains("rescue.iso"),
+        "fetched ISO should appear in /api/isos"
+    );
+}
+
 #[tokio::test]
 async fn health_and_ready_endpoints() {
     let (state, _dir) = build_state().await;
@@ -389,11 +495,11 @@ async fn reboot_and_firmware_exit_in_tools_menu() {
         "tools menu missing firmware-exit item:\n{tools}"
     );
     assert!(
-        tools.contains("&& reboot"),
+        tools.contains(":reboot\nreboot || goto menu"),
         "reboot command not wired:\n{tools}"
     );
     assert!(
-        tools.contains("&& exit 0"),
+        tools.contains(":firmware\nexit 0"),
         "firmware exit command not wired:\n{tools}"
     );
 }

crates/ipxe-assets/Cargo.toml

@@ -13,4 +13,3 @@ workspace = true
 openpxe-core.workspace = true
 rust-embed.workspace = true
 tracing.workspace = true
-thiserror.workspace = true

crates/iso-store/Cargo.toml

@@ -12,16 +12,13 @@ workspace = true
 [dependencies]
 openpxe-core.workspace = true
 tokio = { workspace = true }
-tokio-util = { workspace = true }
 serde.workspace = true
 serde_json.workspace = true
 tracing.workspace = true
-thiserror.workspace = true
 anyhow.workspace = true
 sha2.workspace = true
 hex.workspace = true
 bcrypt.workspace = true
-uuid.workspace = true
 time.workspace = true
 parking_lot.workspace = true
 bytes.workspace = true

crates/iso-store/src/introspect.rs

@@ -60,7 +60,12 @@ pub enum DistroFamily {
 /// descriptor scans. Without this bump, images the rev-2 logic flagged
 /// as data ISOs (mangled-primary appliance images, filler-sector boot
 /// records) would never re-probe and stay mislabeled.
-pub const INTROSPECT_REV: u32 = 3;
+/// rev 4 (v0.8.0): dropped the over-broad "microsoft" UTF-16 bulk-scan
+/// marker that classified any Secure-Boot-signed non-Windows bootable
+/// (memtest86, signed BSDs, firmware tools) as Windows — the string
+/// lives in the FAT long-filename entries of their MS-signed EFI loader.
+/// The bump re-probes those so they drop the bogus Windows label.
+pub const INTROSPECT_REV: u32 = 4;
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct IntrospectionReport {
@@ -414,7 +419,13 @@ async fn bulk_windows_scan<R: IsoReadAt + Send>(r: &mut R, total_len: u64) -> Op
         return Some(true);
     }
     let ascii_markers: [&[u8]; 3] = [b"bootmgr", b"sources/install.wim", b"sources/install.esd"];
-    let utf16_markers = ["bootmgr", "install.wim", "microsoft"];
+    // v0.8.0: dropped the bare "microsoft" marker. It matched the
+    // Microsoft-signed Secure-Boot EFI loader that memtest86 (and signed
+    // BSDs / firmware tools) ship — the string lives in the loader's FAT
+    // long-filename entries — so any signed non-Windows bootable
+    // false-classified as Windows. The remaining markers are all
+    // Windows-exclusive filenames.
+    let utf16_markers = ["bootmgr", "install.wim"];
     let hit = ascii_markers.iter().any(|m| contains_ascii(&haystack, m))
         || utf16_markers
             .iter()
@@ -775,4 +786,26 @@ mod tests {
         assert_eq!(r.family, DistroFamily::WindowsPe);
         assert!(!r.has_boot_wim);
     }
+
+    #[test]
+    fn memtest_signed_efi_is_not_windows() {
+        // v0.8.0 regression: PassMark MemTest86 ships a Microsoft-signed
+        // Secure-Boot EFI loader, and "Microsoft" appears in its FAT
+        // long-filename entries as UTF-16LE. The old bulk-scan "microsoft"
+        // marker classified it (and any signed BSD / firmware tool) as
+        // Windows. It must now classify as a generic bootable (sanboot).
+        let mut img = TestIsoBuilder::new("MEMTEST86")
+            .el_torito(true)
+            .file("/EFI/BOOT/BOOTX64.EFI", b"signed-efi-app")
+            .build();
+        let marker: Vec<u8> = "Microsoft".bytes().flat_map(|b| [b, 0]).collect();
+        img.extend_from_slice(&marker);
+        let r = introspect_mem(img, "memtest86-iso.iso", true);
+        assert_ne!(
+            r.family,
+            DistroFamily::WindowsPe,
+            "a Microsoft-signed EFI loader is not Windows media"
+        );
+        assert!(r.el_torito, "still a bootable image");
+    }
 }

crates/iso-store/src/store.rs

@@ -300,7 +300,19 @@ impl IsoStore {
         }
         let partial_path = self.iso_dir.join(format!("{id}.partial"));
         if partial_path.exists() {
-            return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
+            // A leftover .partial is an upload abandoned mid-flight (browser
+            // refresh, tab close, dropped connection) — nothing reaps it
+            // otherwise, and the operator hits a bogus "already uploading"
+            // on retry. The chunked protocol can't resume it anyway (a
+            // fresh session restarts at offset 0), so reclaim it.
+            // ponytail: two tabs uploading the *same filename* at once would
+            // race here — last writer wins, and the truncating create below
+            // keeps that from corrupting a half-written file.
+            tracing::info!(
+                target: "openpxe::iso", %id,
+                "reclaiming abandoned .partial from a prior upload attempt"
+            );
+            tokio::fs::remove_file(&partial_path).await.ok();
         }
         let file = tokio::fs::File::create(&partial_path).await?;
         Ok(UploadHandle {
@@ -872,15 +884,39 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn begin_upload_rejects_existing_partial_file() {
+    async fn begin_upload_reclaims_stale_partial_file() {
+        // v0.8.0: an abandoned .partial (browser refresh / crash / dropped
+        // connection) must not block a re-upload with a bogus "already
+        // uploading" — begin_upload reclaims it and starts fresh, since the
+        // chunked protocol can't resume a dead session anyway.
         let dir = tempdir().unwrap();
         let store = IsoStore::new(dir.path().to_path_buf());
         store.ensure_dirs().await.unwrap();
-        tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
+        let partial = dir.path().join("ubuntu.partial");
+        tokio::fs::write(&partial, b"in-flight").await.unwrap();
+
+        let handle = store
+            .begin_upload("ubuntu.iso")
+            .await
+            .expect("stale .partial is reclaimed, not rejected");
+        assert_eq!(handle.id, "ubuntu");
+        // Reclaimed: the leftover bytes are gone (fresh, empty file).
+        let meta = tokio::fs::metadata(&partial).await.unwrap();
+        assert_eq!(meta.len(), 0, "stale .partial must be truncated on reclaim");
+    }
+
+    #[tokio::test]
+    async fn begin_upload_still_rejects_completed_iso() {
+        // A finished upload (final .iso on disk) is a genuine duplicate, not
+        // an abandoned attempt — that case must still be refused.
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        tokio::fs::write(dir.path().join("rocky.iso"), b"done")
             .await
             .unwrap();
 
-        let r = store.begin_upload("ubuntu.iso").await;
+        let r = store.begin_upload("rocky.iso").await;
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
 

crates/openpxe/Cargo.toml

@@ -26,7 +26,5 @@ tracing.workspace = true
 tracing-subscriber.workspace = true
 anyhow.workspace = true
 clap.workspace = true
-serde.workspace = true
-toml.workspace = true
 bytes.workspace = true
 time.workspace = true

crates/openpxe/src/main.rs

@@ -120,8 +120,41 @@ async fn main() -> anyhow::Result<()> {
     let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
     let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
     let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
+    // v0.8.1: zero-touch first-run bootstrap. If no admin exists yet and the
+    // operator supplied OPENPXE_ADMIN_USERNAME + OPENPXE_ADMIN_PASSWORD (or
+    // …_PASSWORD_FILE, for Docker/K8s secrets), create the admin now so a
+    // fresh container is usable without the web setup wizard. Seeds the
+    // first run only — once an admin exists (including one made in the UI)
+    // this is a no-op, so a lingering env var can't reset a rotated password.
+    if !admin.is_configured() {
+        if let Ok(username) = std::env::var("OPENPXE_ADMIN_USERNAME") {
+            let password = std::env::var("OPENPXE_ADMIN_PASSWORD_FILE")
+                .ok()
+                .and_then(|p| std::fs::read_to_string(p).ok())
+                .map(|s| s.trim_end_matches(['\n', '\r']).to_string())
+                .or_else(|| std::env::var("OPENPXE_ADMIN_PASSWORD").ok());
+            if let Some(password) = password {
+                match admin.bootstrap(&username, &password) {
+                    Ok(p) => tracing::info!(
+                        target: "openpxe::auth", username = %p.username,
+                        "admin bootstrapped from environment"
+                    ),
+                    Err(e) => tracing::warn!(
+                        target: "openpxe::auth",
+                        "env admin bootstrap failed ({e}); use the web setup wizard"
+                    ),
+                }
+            } else {
+                tracing::warn!(
+                    target: "openpxe::auth",
+                    "OPENPXE_ADMIN_USERNAME set without OPENPXE_ADMIN_PASSWORD[_FILE]; skipping bootstrap"
+                );
+            }
+        }
+    }
     let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
     let notify = openpxe_core::NotifyStore::load_or_default(&config.paths.work_dir);
+    let api_key = openpxe_core::ApiKeyStore::load_or_init(&config.paths.work_dir);
     let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
 
@@ -201,6 +234,7 @@ async fn main() -> anyhow::Result<()> {
         pxe_bg_cache: openpxe_http_api::state::PxeBgCache::default(),
         admin: admin.clone(),
         sessions: sessions.clone(),
+        api_key,
         sso: sso.clone(),
         saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
         notify: notify.clone(),
@@ -211,6 +245,7 @@ async fn main() -> anyhow::Result<()> {
         sftp_shares: sftp_shares.clone(),
         unattended: unattended.clone(),
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
+        fetch_jobs: openpxe_http_api::fetch::FetchJobs::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),
         public_base_url: public_base_url.clone(),

crates/tftp/Cargo.toml

@@ -15,6 +15,4 @@ openpxe-ipxe-assets.workspace = true
 tokio.workspace = true
 socket2.workspace = true
 tracing.workspace = true
-thiserror.workspace = true
 anyhow.workspace = true
-bytes.workspace = true

crates/webui/src/app.js

@@ -603,36 +603,85 @@
 
       // ── Upload card ──
       const drop = el('div', {class:'drop', id:'drop'}, [
-        el('div', {}, ['Drop an ', el('strong', {}, '.iso'), ' here, or click to choose.']),
+        el('div', {}, ['Drop one or more ', el('strong', {}, '.iso'), ' files here, or click to choose.']),
         el('div', {style:'font-size:12px;margin-top:6px'},
-           'Linux + Windows installers auto-detected on upload. Streaming, no 502s on big files.'),
+           'Linux + Windows installers auto-detected on upload. Multiple files upload at once. Streaming, no 502s on big files.'),
       ]);
       const file = el('input', {type:'file', accept:'.iso,application/octet-stream',
-                                style:'display:none', id:'file'});
-      const prog = el('div', {class:'progress', id:'prog'}, el('div', {class:'bar', id:'bar'}));
-      const upMsg = el('div', {class:'msg', id:'upmsg'});
-      // v0.5.8: cancel button — shown only while an upload is in flight.
-      const cancelUpload = el('button', {class:'danger', type:'button',
-        style:'display:none;margin-top:12px', id:'cancel-upload'}, 'Cancel upload');
+                                multiple:true, style:'display:none', id:'file'});
+      // v0.8.0: one progress row per file, appended here. Replaces the
+      // single shared bar/msg/cancel that a second concurrent upload used
+      // to clobber.
+      const uploadsList = el('div', {id:'uploads', style:'display:grid;gap:12px'});
+
+      // One page-leave guard + one tab-hide cleanup for the whole card,
+      // registered only while ≥1 upload is in flight (added on 0→1, removed
+      // on 1→0) so listeners never pile up across re-renders.
+      let activeUploads = 0;
+      const activeIds = new Set();
+      const warnLeave = (e) => { if (activeUploads > 0) { e.preventDefault(); e.returnValue = ''; return ''; } };
+      const abortOnHide = () => {
+        // keepalive lets these DELETEs outlive the unload; the server also
+        // reclaims an orphaned .partial on the next upload, so best-effort
+        // is fine here.
+        for (const id of activeIds) {
+          try { fetch('/api/uploads/' + encodeURIComponent(id), {method:'DELETE', keepalive:true}); } catch (_) {}
+        }
+      };
+      const addGuards = () => {
+        window.addEventListener('beforeunload', warnLeave);
+        window.addEventListener('pagehide', abortOnHide);
+      };
+      const removeGuards = () => {
+        window.removeEventListener('beforeunload', warnLeave);
+        window.removeEventListener('pagehide', abortOnHide);
+      };
+
+      const failText = async (r) => {
+        const text = (await r.text()).slice(0, 240);
+        let hint = '';
+        if (r.status === 413)      hint = ' - body too large. A proxy likely rejected this chunk.';
+        else if (r.status === 502) hint = ' - bad gateway. Proxy lost the upstream mid-stream.';
+        else if (r.status === 504) hint = ' - gateway timeout. Try the LAN IP directly.';
+        else if (r.status === 409) hint = ' - name conflict or offset mismatch. Remove the old ISO and retry.';
+        return 'HTTP ' + r.status + ' ' + text + hint;
+      };
+
+      // Launch an upload per dropped/selected .iso. The browser's ~6
+      // connections-per-origin cap naturally bounds how many stream at
+      // once, so there's no hand-rolled queue. Non-.iso files are ignored.
+      const startMany = (fileList) => {
+        [...fileList].filter(f => /\.iso$/i.test(f.name)).forEach(uploadOne);
+      };
 
       drop.onclick = () => file.click();
       drop.addEventListener('dragover', e => { e.preventDefault(); drop.classList.add('hover'); });
       drop.addEventListener('dragleave', () => drop.classList.remove('hover'));
       drop.addEventListener('drop', e => {
         e.preventDefault(); drop.classList.remove('hover');
-        if (e.dataTransfer.files[0]) upload(e.dataTransfer.files[0]);
+        startMany(e.dataTransfer.files);
       });
-      file.onchange = () => { if (file.files[0]) upload(file.files[0]); };
+      // Reset value so re-selecting the same filename still fires onchange.
+      file.onchange = () => { startMany(file.files); file.value = ''; };
 
-      // Chunked upload telemetry. The old browser path posted one huge
-      // multipart body, which left operators staring at 0% when a reverse
-      // proxy buffered or rejected the request before OpenPXE saw it. This
-      // path writes small raw chunks; each acknowledged chunk advances the
-      // bar and leaves a visible .partial file in the ISO directory.
-      async function upload(f) {
+      // One independent chunked upload with its own progress row. The old
+      // browser path posted one huge multipart body, which left operators
+      // staring at 0% when a reverse proxy buffered or rejected the request
+      // before OpenPXE saw it. This path writes small raw chunks; each
+      // acknowledged chunk advances the bar and leaves a visible .partial.
+      async function uploadOne(f) {
         const started = Date.now();
-        const bar = $('#bar');
-        const setStatus = (text, cls) => { upMsg.textContent = text; upMsg.className = 'msg ' + (cls || ''); };
+        const bar = el('div', {class:'bar'});
+        const prog = el('div', {class:'progress active'}, bar);
+        const rowMsg = el('div', {class:'msg'});
+        const cancelBtn = el('button', {class:'danger', type:'button', style:'margin-top:8px'}, 'Cancel');
+        const row = el('div', {}, [
+          el('div', {style:'font-weight:600;font-size:13px;margin-bottom:6px;word-break:break-all'}, f.name),
+          prog, rowMsg, cancelBtn,
+        ]);
+        uploadsList.appendChild(row);
+
+        const setStatus = (text, cls) => { rowMsg.textContent = text; rowMsg.className = 'msg ' + (cls || ''); };
         const update = (loaded, total, phase) => {
           const pct = total > 0 ? Math.min(100, (loaded / total) * 100) : 100;
           bar.style.width = pct.toFixed(1) + '%';
@@ -640,34 +689,24 @@
           const rate = loaded > 0 ? loaded / elapsed : 0;
           const remain = rate > 0 ? (total - loaded) / rate : 0;
           setStatus(
-            phase + ' ' + f.name + ' - ' +
+            phase + ' - ' +
             fmtBytes(loaded) + ' of ' + fmtBytes(total) +
             ' (' + pct.toFixed(1) + '%, ' + fmtBytes(rate) + '/s' +
             (remain > 0 ? ', ' + Math.ceil(remain) + 's left' : '') + ')');
         };
-        const failText = async (r) => {
-          const text = (await r.text()).slice(0, 240);
-          let hint = '';
-          if (r.status === 413)      hint = ' - body too large. A proxy likely rejected this chunk.';
-          else if (r.status === 502) hint = ' - bad gateway. Proxy lost the upstream mid-stream.';
-          else if (r.status === 504) hint = ' - gateway timeout. Try the LAN IP directly.';
-          else if (r.status === 409) hint = ' - name conflict or offset mismatch. Remove the old ISO and retry.';
-          return 'HTTP ' + r.status + ' ' + text + hint;
-        };
 
         let uploadId = null;
-        // v0.5.8: cancel + leave-page guard. The AbortController stops the
-        // in-flight chunk; the beforeunload listener warns the operator
-        // that navigating away aborts the upload (the server-side partial
-        // is then cleaned up by the DELETE in the catch below).
+        // The AbortController stops this upload's in-flight chunk on Cancel.
+        // The card-level beforeunload guard (added while activeUploads > 0)
+        // warns on navigation; the server reclaims an abandoned .partial on
+        // the next upload either way.
         const ac = new AbortController();
         let canceled = false;
-        const warnLeave = (e) => { e.preventDefault(); e.returnValue = ''; return ''; };
-        window.addEventListener('beforeunload', warnLeave);
-        cancelUpload.style.display = '';
-        cancelUpload.onclick = () => { canceled = true; ac.abort(); };
-        setStatus('Preparing upload for ' + f.name + ' (' + fmtBytes(f.size) + ')');
-        prog.classList.add('active');
+        cancelBtn.onclick = () => { canceled = true; ac.abort(); };
+
+        activeUploads += 1;
+        if (activeUploads === 1) addGuards();
+        setStatus('Preparing ' + f.name + ' (' + fmtBytes(f.size) + ')');
         bar.style.width = '1%';
 
         try {
@@ -678,6 +717,7 @@
           if (!begin.ok) throw new Error(await failText(begin));
           const session = await begin.json();
           uploadId = session.upload_id;
+          activeIds.add(uploadId);
           const chunkSize = Math.max(1024 * 1024, Number(session.chunk_size || 8 * 1024 * 1024));
 
           let offset = Number(session.offset || 0);
@@ -702,26 +742,101 @@
           } while (!finished);
 
           setStatus('Uploaded and analyzed: ' + f.name + ' (' + fmtBytes(f.size) + ')', 'ok');
-          render('storage');
         } catch (err) {
           if (uploadId) {
             try { await fetch('/api/uploads/' + encodeURIComponent(uploadId), {method: 'DELETE'}); }
-            catch {}
+            catch (_) {}
           }
           if (canceled || (err && err.name === 'AbortError')) {
-            setStatus('Upload canceled — partial file discarded.', '');
+            setStatus('Canceled — partial file discarded.', '');
           } else {
             setStatus('Upload failed: ' + (err && err.message ? err.message : String(err)), 'err');
           }
         } finally {
-          window.removeEventListener('beforeunload', warnLeave);
-          cancelUpload.style.display = 'none';
-          cancelUpload.onclick = null;
+          if (uploadId) activeIds.delete(uploadId);
+          cancelBtn.style.display = 'none';
           prog.classList.remove('active');
-          if (!upMsg.className.includes('ok')) bar.style.width = '0';
+          activeUploads -= 1;
+          if (activeUploads === 0) {
+            removeGuards();
+            // Refresh the table to show the new image(s) — but only if the
+            // operator is still on Storage. isConnected goes false once
+            // render() swapped the view, so a mid-upload tab change won't
+            // yank them back here.
+            if (uploadsList.isConnected) render('storage');
+          }
         }
       }
 
+      // v0.8.1: add ISO by URL. Paste a link and the server streams it
+      // straight into the store and auto-detects it — no download-then-
+      // reupload. Progress polls /api/isos/fetch and shows rows below,
+      // mirroring uploads. On an air-gapped network, use the drop zone.
+      const urlInput = el('input', {type:'url', id:'iso-url', style:'flex:1',
+        placeholder:'https://example.com/systemrescue.iso'});
+      const fetchBtn = el('button', {class:'ghost', type:'button', style:'margin-left:8px'}, 'Fetch');
+      const fetchMsg = el('div', {class:'msg', style:'margin-top:6px'});
+      const fetchList = el('div', {id:'fetches', style:'display:grid;gap:12px;margin-top:12px'});
+      const urlRow = el('div', {style:'margin-top:14px'}, [
+        el('label', {class:'field', style:'margin-bottom:0'}, [
+          el('span', {class:'name'}, 'Or add by URL'),
+          el('div', {style:'display:flex;align-items:center'}, [urlInput, fetchBtn]),
+          el('span', {class:'hint'},
+            'The server downloads the .iso into storage and auto-detects it — same result as a drag-drop. Any http(s) .iso link works.'),
+        ]),
+        fetchMsg,
+      ]);
+
+      let fetchTimer = null;
+      const renderFetchRows = (jobs) => {
+        fetchList.replaceChildren(...jobs.map(j => {
+          const pct = j.total > 0 ? Math.min(100, (j.downloaded / j.total) * 100)
+                                  : (j.state === 'done' ? 100 : 0);
+          let text, cls = '';
+          if (j.state === 'downloading')
+            text = 'Downloading ' + fmtBytes(j.downloaded) +
+              (j.total ? ' of ' + fmtBytes(j.total) + ' (' + pct.toFixed(0) + '%)' : '');
+          else if (j.state === 'done') { text = 'Downloaded and analyzed.'; cls = 'ok'; }
+          else if (j.state === 'failed') { text = 'Failed: ' + (j.error || 'unknown error'); cls = 'err'; }
+          else text = 'Canceled — partial discarded.';
+          const btn = el('button', {class:'danger', type:'button', style:'margin-top:8px'},
+            j.state === 'downloading' ? 'Cancel' : 'Dismiss');
+          btn.onclick = async () => {
+            try { await fetch('/api/isos/fetch/' + encodeURIComponent(j.id), {method:'DELETE'}); } catch (_) {}
+            pollFetches();
+          };
+          return el('div', {}, [
+            el('div', {style:'font-weight:600;font-size:13px;margin-bottom:6px;word-break:break-all'},
+              j.filename + '  ·  ' + j.url),
+            el('div', {class:'progress' + (j.state === 'downloading' ? ' active' : '')},
+              el('div', {class:'bar', style:'width:' + pct.toFixed(1) + '%'})),
+            el('div', {class:'msg ' + cls}, text),
+            btn,
+          ]);
+        }));
+      };
+      async function pollFetches() {
+        if (fetchTimer) { clearTimeout(fetchTimer); fetchTimer = null; }
+        let jobs = [];
+        try { jobs = (await getJSON('/api/isos/fetch')).jobs || []; } catch (_) {}
+        renderFetchRows(jobs);
+        // A successful fetch is read-once on the server, so refreshing here
+        // shows the new image and won't re-trigger on the next poll. Keep
+        // polling only while a download is still in flight.
+        if (jobs.some(j => j.state === 'done')) { render('storage'); return; }
+        if (jobs.some(j => j.state === 'downloading')) fetchTimer = setTimeout(pollFetches, 1500);
+      }
+      async function startFetch() {
+        const url = urlInput.value.trim();
+        if (!url) return;
+        fetchMsg.textContent = 'Starting…'; fetchMsg.className = 'msg';
+        const r = await postJSON('/api/isos/fetch', { url });
+        if (r.ok) { urlInput.value = ''; fetchMsg.textContent = ''; pollFetches(); }
+        else { fetchMsg.textContent = 'Could not start: ' + (await r.text()).slice(0, 160); fetchMsg.className = 'msg err'; }
+      }
+      fetchBtn.onclick = startFetch;
+      urlInput.addEventListener('keydown', e => { if (e.key === 'Enter') { e.preventDefault(); startFetch(); } });
+
       // ── ISO table (mixed local + SMB) ──
       // Each row gets a "Password" cell that toggles a small inline
       // editor (a checkbox + a password field + Save button) inside the
@@ -1351,11 +1466,11 @@
         ]),
       ]);
 
-      return el('div', {}, [el('div', {class:'grid'}, [
+      const root = el('div', {}, [el('div', {class:'grid'}, [
         diskCard,
         el('div', {class:'card'}, [
           el('header', {}, el('h2', {}, 'Upload ISO')),
-          el('div', {class:'body'}, [drop, file, prog, upMsg, cancelUpload]),
+          el('div', {class:'body'}, [drop, file, urlRow, uploadsList, fetchList]),
         ]),
         // v0.5.1: SMB + NFS unified into one "Remote shares" card with a
         // protocol dropdown. Backend endpoints are unchanged; this is a
@@ -1394,6 +1509,10 @@
           isoPager,
         ]),
       ]), unattendedAdvanced]);
+      // v0.8.1: resume/kick URL-fetch progress polling; stop it on view swap.
+      root._cleanup = () => { if (fetchTimer) clearTimeout(fetchTimer); };
+      pollFetches();
+      return root;
     },
 
     hosts: async () => {
@@ -1732,7 +1851,7 @@
     },
 
     settings: async () => {
-      const [status, me, sso, notify, docs] = await Promise.all([
+      const [status, me, sso, notify, docs, apiKey] = await Promise.all([
         getJSON('/api/status'),
         getJSON('/api/me').catch(() => ({})),
         getJSON('/api/sso').catch(() => ({
@@ -1742,6 +1861,7 @@
         // fetches the notify config + API docs it needs too.
         getJSON('/api/notify').catch(() => ({ enabled:false, kind:'slack' })),
         getJSON('/api/docs').catch(() => ({ groups: [] })),
+        getJSON('/api/api-key').catch(() => ({ key:'', header:'x-api-key' })),
       ]);
 
       // ── Account card (Forms admin credentials, v0.4.5).
@@ -2055,7 +2175,7 @@
       // into a collapsible disclosure beneath the core settings cards —
       // webhook/email notifications + the API reference. Keeps Settings
       // clean by default while leaving the knobs one click away.
-      const [notifyCard, apiCard] = views._advancedCards(notify, docs);
+      const [notifyCard, apiCard] = views._advancedCards(notify, docs, apiKey);
       const advanced = el('details', {class:'advanced-disclosure', style:'margin-top:18px'}, [
         el('summary', {class:'advanced-summary'}, 'Advanced'),
         el('div', {class:'grid', style:'margin-top:14px'}, [notifyCard, apiCard]),
@@ -2070,7 +2190,7 @@
     // and the API reference. There is no longer an Advanced sidebar tab;
     // the Settings view folds these into a collapsible disclosure and
     // passes in the pre-fetched `notify` + `docs` payloads.
-    _advancedCards: (notify, docs) => {
+    _advancedCards: (notify, docs, apiKey) => {
 
       // ── Notification config ──
       const nMsg = el('div', {class:'msg', style:'margin-top:12px'});
@@ -2185,14 +2305,47 @@
         ]),
       ]);
 
-      // ── API reference (relocated from Settings) ──
+      // ── API key + reference (relocated from Settings) ──
       const groups = docs.groups || [];
+
+      // v0.8.0: operator API key. Paste into the `x-api-key` request
+      // header to drive /api/* from Postman / scripts without a browser
+      // session (full operator access). Read + rotate via /api/api-key.
+      const keyHeader = (apiKey && apiKey.header) || 'x-api-key';
+      const keyField = el('input', {type:'text', readonly:true,
+        value: (apiKey && apiKey.key) || '(unavailable)',
+        style:'width:100%;font-family:var(--mono)'});
+      const keyMsg = el('span', {class:'hint', style:'margin-left:10px'});
+      const copyKey = el('button', {class:'ghost', type:'button', onclick: async () => {
+        try { await navigator.clipboard.writeText(keyField.value); keyMsg.textContent = 'Copied to clipboard.'; }
+        catch { keyField.select(); keyMsg.textContent = 'Select the field and copy.'; }
+      }}, 'Copy');
+      const regenKey = el('button', {class:'danger', type:'button', style:'margin-left:8px',
+        onclick: async () => {
+          if (!confirm('Regenerate the API key? The current key stops working immediately and any client using it must be updated.')) return;
+          const r = await postJSON('/api/api-key/regenerate', {});
+          if (r.ok) { const j = await r.json(); keyField.value = j.key || ''; keyMsg.textContent = 'New key generated.'; }
+          else { keyMsg.textContent = 'Regenerate failed: ' + (await r.text()).slice(0, 120); }
+        }}, 'Regenerate');
+      const apiKeyBlock = el('div', {style:'padding:16px;border-bottom:1px solid var(--border)'}, [
+        el('label', {class:'field', style:'margin-bottom:10px'}, [
+          el('span', {class:'name'}, 'API key'),
+          keyField,
+          el('span', {class:'hint'}, [
+            'Send as the ', el('code', {}, keyHeader),
+            ' request header to call the API from Postman or scripts — full operator access, so keep it secret.',
+          ]),
+        ]),
+        el('div', {}, [copyKey, regenKey, keyMsg]),
+      ]);
+
       const apiCard = el('div', {class:'card'}, [
         el('header', {}, [
-          el('h2', {}, 'API reference'),
+          el('h2', {}, 'API'),
           el('span', {class:'sub'},
             groups.reduce((n, g) => n + (g.endpoints || []).length, 0) + ' endpoints'),
         ]),
+        apiKeyBlock,
         el('div', {class:'api-ref'},
           groups.length
             ? groups.map(g => el('div', {class:'group'}, [

docker-compose.yml

@@ -1,66 +1,42 @@
-# docker-compose for local / homelab deployment.
+# OpenPXE — single-host / homelab deployment.
 #
-# Two usage patterns:
+# One container: DHCP proxy + TFTP + iPXE chainload + HTTP (web UI, boot
+# scripts, and ISO range streaming).
 #
-#   1. Local MVP test — host network, proxy-DHCP off (don't fight your
-#      existing DHCP server on the LAN), TFTP + HTTP exposed on the host:
+#   OPENPXE_PUBLIC_IP=192.168.1.49 docker compose up -d
 #
-#         docker compose up openpxe-dev
+# (or put OPENPXE_PUBLIC_IP in a .env file beside this one). That's this
+# host's LAN IP, advertised to PXE clients so the iPXE URLs resolve —
+# OpenPXE refuses to start rather than advertise an address clients can't
+# reach, so compose errors out below if it's unset.
 #
-#   2. Real PXE deployment — host network, proxy-DHCP on, runs on a box
-#      plugged into the PXE network:
+# Host networking is REQUIRED: DHCPDISCOVER is a broadcast, and Docker
+# bridges / CNI overlays don't forward it into containers. In host mode
+# the container binds these ports directly on the host:
 #
-#         # First set OPENPXE_PUBLIC_IP to this host's LAN address in .env
-#         docker compose up openpxe
+#   udp/67    DHCP proxy          udp/4011  PXE Boot Server
+#   udp/69    TFTP                tcp/4200  web UI + HTTP boot assets
 #
-# On Linux hosts, `network_mode: host` gives the container direct access to
-# the physical NIC — required for DHCP proxy because CNI overlays and Docker
-# bridges do not forward DHCPDISCOVER broadcasts into containers.
-#
-# On macOS / Windows hosts, `network_mode: host` is limited — the daemon
-# runs in a Linux VM (Colima/Docker Desktop) so the "host" network is the
-# VM, not your Mac. Proxy-DHCP is not feasible on macOS; use `openpxe-dev`
-# with published ports and set DHCP-MODE=disabled.
+# Web UI:  http://<this-host>:4200/
 
 services:
-  # Real PXE deployment (Linux hosts).
   openpxe:
-    image: openpxe:0.1.0
-    build:
-      context: .
-      dockerfile: deploy/docker/Dockerfile
+    image: gitea.milesward.dev/mward4/openpxe:latest
+    container_name: openpxe
     restart: unless-stopped
     network_mode: host
+    # The binary carries cap_net_bind_service as a file capability, so it
+    # binds the low DHCP/TFTP ports as a non-root user — no privileged mode.
+    cap_add:
+      - NET_BIND_SERVICE
     environment:
-      # REQUIRED on multi-homed hosts. Set to this machine's LAN IP so the
-      # advertised iPXE URLs actually resolve from the PXE clients. Without
-      # this, OpenPXE will refuse to start rather than advertise a
-      # loopback address that can't be reached.
-      OPENPXE_PUBLIC_IP: ${OPENPXE_PUBLIC_IP:?set this to the host LAN IP}
+      OPENPXE_PUBLIC_IP: ${OPENPXE_PUBLIC_IP:?set this to the host LAN IP, e.g. 192.168.1.49}
+      # Web UI + HTTP boot assets. 4200 keeps clear of anything on :80
+      # (an Unraid webGUI, a reverse proxy, …).
+      OPENPXE_HTTP_PORT: "4200"
+      # proxy = coexist with the LAN's existing DHCP server (recommended).
       OPENPXE_DHCP_MODE: proxy
       OPENPXE_LOG: info
     volumes:
-      - ./data/isos:/var/lib/openpxe/isos
-      - ./data/work:/var/lib/openpxe/work
-
-  # Dev / MVP container: published ports, DHCP disabled, HTTP on 8080.
-  # Use this on laptops where you want to curl the API or UI without
-  # running an actual PXE chain.
-  openpxe-dev:
-    image: openpxe:0.1.0
-    build:
-      context: .
-      dockerfile: deploy/docker/Dockerfile
-    environment:
-      OPENPXE_PUBLIC_IP: ${OPENPXE_PUBLIC_IP:-127.0.0.1}
-      OPENPXE_DHCP_MODE: disabled
-      OPENPXE_HTTP_PORT: "8080"
-      OPENPXE_TFTP_PORT: "6969"
-      OPENPXE_DHCP_PORT: "6767"
-      OPENPXE_LOG: info,openpxe=debug
-    ports:
-      - "8080:8080/tcp"
-      - "6969:6969/udp"
-    volumes:
-      - ./data/isos:/var/lib/openpxe/isos
-      - ./data/work:/var/lib/openpxe/work
+      - ./data/isos:/var/lib/openpxe/isos   # uploaded / seeded .iso files
+      - ./data/work:/var/lib/openpxe/work   # settings, share state, scratch