OpenPXE/docs/NEXT_PHASE.md

Phase 6 — recommendations

The v0.2.0 cut leaves PXEForge in a state where the entire protocol stack and operator UI are exercised by 66 automated tests, the container is multi-arch buildable, and the image ships at ~97 MB. What's left before this looks and feels like a 1.0 product is mostly real-hardware validation plus a small batch of features that can only sensibly be designed once we've watched real machines image.

This doc is a punch list, ordered by what I'd do first if I had a week.

Tier 1 — must-do before we call anything "stable"

1. Real-hardware validation matrix

We have CI tests for every protocol leg, but no end-to-end PXE on real firmware. Build a small matrix:

client	firmware	OS family	pass criteria
any 10-y-old mini-PC	Legacy BIOS	Ubuntu Server 24.04	gets to GRUB / installer
Intel NUC / similar	UEFI x64	Windows 11	reaches "where do you want to install"
Raspberry Pi 4	UEFI ARM64	Raspberry Pi OS	gets to login prompt
Dell / HP business laptop	UEFI x64	Fedora	one of: kernel boot or wimboot

Add a docs/HARDWARE_VALIDATION.md checklist that records what worked, firmware versions, and any quirks. Anything weird gets a regression test in the relevant crate.

2. Boot menu hotkey + UI accessibility audit

The iPXE menu has number-key + letter hotkeys but no documentation on what they map to. Generate a printable cheat-sheet from crates/http-api/src/ipxe_script.rs so operators don't have to read the source. Run a screen-reader pass over the web UI — most of it should be fine since we're mostly tables + form labels, but the Terminal pane and the SSE log output need explicit aria-live regions.

3. Boot.wim re-patch detection

Bootimus v0.1.62's "fingerprint of patched inputs + Save & Re-patch" pattern is a small but high-value feature: when an operator changes the SMB host override or upgrades wimboot, the existing patched boot.wim is silently stale. We should:

• Hash the inputs (smb_host, smb_share, startnet.cmd content, wimboot binary digest) into the IsoMeta;
• Surface a "needs re-patch" warning on the Storage tab when the hash drifts;
• Add a "Re-patch SMB" button that re-runs the WimPatcher.

Tier 2 — features that round out pre-beta

4. Auto-install file library

iVentoy and Bootimus both support attaching autounattend.xml / preseed.cfg / kickstart.cfg to an image. The mechanics are straightforward: store files under <work_dir>/autoinstall/<distro>/, expose CRUD via /api/autoinstall-files, and modify the WimPatcher

• Linux kernel cmdline to fetch + apply the right file. Placeholders worth supporting (Bootimus pattern): {{MAC}}, {{HOSTNAME}}, {{IP}}, {{SERVER_ADDR}}, {{IMAGE_FILENAME}}, substituted serve-side per request.

5. Wake-on-LAN trigger

A natural pair with per-MAC host bindings: bind a MAC to an image, then click "Wake & Image" to send the magic packet and let PXEForge do the rest. Implementation is small (udp/9 broadcast, magic packet construction) but it makes the bound-host workflow feel instant.

6. Distro profile manifest

Today, distro detection lives as Rust match arms in introspect.rs and the kernel cmdline templates live in store.rs. Bootimus extracts this into a JSON manifest that ships embedded in the binary AND is overridable by the operator at runtime — so a new distro can be added without rebuilding the container. Worth porting; it'd let community contributions land as PRs to a single JSON file.

7. Syslog receiver

smee ships one. The use case: WinPE / Linux installers can be configured to syslog over the network to the PXE server; if we have an endpoint and a place in the UI to view per-client diagnostics, post-mortem on a failed install gets dramatically easier.

8. UEFI HTTP Boot validation

Option 60 = HTTPClient is wired up in decide() already, but we've never tested it on real firmware. Some Dell + Lenovo UEFIs prefer it over PXE-via-TFTP. A quick check on a real machine (disable TFTP boot in firmware, force HTTP boot) and a regression test would be nice.

Tier 3 — bigger lifts, only if there's demand

9. Pure-Rust SMB server

smbd from Samba is ~80 MB of the runtime image. There are pure-Rust SMB2 server crates (smbd-server, smb-rs) of varying maturity. Replacing the dep would slim the image by ~40% and remove the CAP_SYS_ADMIN requirement for SMB. Worth a spike, not necessarily landable in Phase 6.

10. IPv6 / DHCPv6

PXE-over-IPv6 is real (RFC 5970). Some sites are v6-only. Worth implementing once we know we have one. Until then, IPv4-only is the right default — flipping the bit on v6 without v6 testing is asking for silent breakage.

11. Multi-replica deployment

The current design assumes one PXEForge per broadcast domain. Two proxies on the same L2 will race; the gate queue is in-memory, etc. For HA we'd need to:

• Externalize the gate queue (Redis, etcd) or lean into "the menu is cheap to refetch if a replica dies";
• Ensure DHCP proxy replies are deterministic so a client always gets the same answer regardless of which replica replied;
• Document the L2 collision domain story.

This is a large lift and should only happen if someone's actually asking for it.

12. Pi 4 / SBC quirks

Raspberry Pi netboot uses a specific DHCP option-43 vendor field + TFTP path layout that PXEForge doesn't currently special-case. There's a spec; the work is small once we have a Pi to test on.

What I'd skip

• A custom DHCP server (not proxy). The proxy mode is the right abstraction; full DHCP would need raw sockets + a lot of corner-case handling for problems no operator wants us to solve.
• A pluggable backend abstraction à la Tinkerbell. Tinkerbell does it because they integrate with k8s CRDs. PXEForge's "the file system IS the database" model is simpler and good enough for the target audience. Don't add a Backend trait until something asks for it.
• Multiple language UIs. Bootimus added these in v0.1.62 and the translations are LLM-generated. Skip until we have real users asking for non-English.

Quick wins (could land in a single afternoon)

• Add a Grafana dashboard JSON to deploy/grafana/ driven off the new /metrics endpoint.
• A pxeforge bench subcommand that runs a 10-second internal load test (synthetic gate joins) so an operator can sanity-check tuning.
• Ship a basic docker-compose.yml for the Unraid path that demos the new themes / progress widget.
• Generate a printable single-page operator runbook from the README
  • architecture.md (e.g. cargo xtask runbook).