Miles WardandClaude Opus 4.7
900b65b3ec
v0.4.64's NFS path didn't work on Unraid even with --privileged
because Unraid's base kernel ships without the nfs/nfsv4 client
modules — and no container-side configuration can load a host kernel
module. SMB has the same kernel-mount problem (`mount -t cifs` needs
the cifs module) but it also has a usable *userspace* client: Samba's
`smbclient` CLI, which speaks the SMB protocol over a plain TCP socket
with no kernel involvement. This is the same approach Bootimus uses,
and works in every container regardless of host kernel modules or
container capabilities.
What's gone:
* `crates/iso-store/src/nfs.rs` (in entirety)
* `NfsManager`, `NfsMount`, `NfsAddRequest`, `NfsVersion` types
* `IsoSource::Nfs` variant
* `IsoStore::nfs_root` / `IsoStore::set_nfs_root`
* `/api/nfs`, `/api/nfs/:id`, `/api/nfs/:id/scan` routes
* `nfs` terminal command
* Storage tab's NFS shares card and the v0.4.64 fstab-options
diagnostics work (the whole error path is moot now)
What's new:
* `crates/iso-store/src/smb_share.rs` — `SmbShareManager` that drives
`smbclient` as a subprocess. Indexes shares via `smbclient -c "ls
*.iso"` and streams files via `smbclient -c "get file -"` piped
straight into HTTP response bodies. No local cache, no double disk
usage.
* `IsoSource::Smb { share_id, relative_path }` variant.
* `IsoStore::iso_path_for` returns None for SMB sources — the HTTP
ISO download handler dispatches on the source kind and streams via
the SmbShareManager when it's SMB.
* `/api/smb-shares` + `/api/smb-shares/:id` + `/api/smb-shares/:id/scan`
routes.
* `share` terminal command (`list | add //srv/share [auth] | remove |
scan`). Auth spec is `guest` or `user:password`.
* Storage tab: SMB shares card replaces the NFS one. Two-column form
for server + share name, three-column form for guest checkbox /
username / password. Username and password fields auto-disable when
Guest is checked.
* Credentials live under <work_dir>/smb_creds/<id>.cred at 0600
permissions so they don't leak through `ps`. Persisted state at
<work_dir>/smb_shares.json (sans password — re-entered on add /
re-scan).
Why subprocess and not a Rust crate:
* The Debian runtime image already ships the `samba` package
(Dockerfile line 84) — `smbclient` is right there.
* Library options (pavao, etc.) wrap libsmbclient so they still pull
in the same C library at runtime.
* Subprocess gives operators a verifiable mental model — anything
OpenPXE can do over SMB, they can reproduce by running `smbclient`
manually at a shell.
Range-request limitation, called out in the smb_share.rs module docs
and the UI explainer: `smbclient -c 'get file -'` is a sequential
whole-file stream. HTTP range requests on SMB-sourced ISOs return
416. PXE workloads (iPXE chain, casper sanboot, wimboot) do
whole-file sequential reads, so this works in practice. A follow-up
release can add libsmbclient-based seek if a real workload needs it.
Stderr-to-hint translation patterns mirror v0.4.64's NFS work:
NT_STATUS_LOGON_FAILURE → "check credentials", BAD_NETWORK_NAME →
"check share name", connection refused / timeout → "verify
reachability + firewall", etc. UI renders the raw smbclient error
plus the hint as two lines.
Tests (149 total, was 142 in v0.4.64):
* smb_share parser tests covering ISO + skipped directory, filenames
with spaces, non-ISO filtering.
* hint_for() translation tests for the dominant NT_STATUS codes.
* Server normalization (smb://, cifs://, \\, // prefixes all stripped).
* HTTP integration: shares list starts empty, invalid server / missing
username / path in share name all rejected with actionable hints.
`cargo clippy --workspace --all-targets -- -D warnings` clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
77 lines
3.7 KiB
Rust
77 lines
3.7 KiB
Rust
use crate::uploads::UploadSessions;
|
|
use crate::auth::SessionStore;
|
|
use openpxe_core::{
|
|
AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
|
|
Metrics, SettingsStore, SsoStore,
|
|
};
|
|
use openpxe_iso_store::{IsoStore, SmbManager, SmbShareManager};
|
|
use std::sync::Arc;
|
|
use time::OffsetDateTime;
|
|
|
|
#[derive(Clone)]
|
|
pub struct AppState {
|
|
pub iso_store: IsoStore,
|
|
pub clients: Arc<ClientRegistry>,
|
|
pub settings: Arc<SettingsStore>,
|
|
pub queue: Arc<DeploymentQueue>,
|
|
/// Per-MAC iPXE script overrides. When a client matching one of
|
|
/// these MACs requests `/boot.ipxe`, we chain straight to the
|
|
/// configured target instead of rendering the menu.
|
|
pub hosts: HostBindings,
|
|
/// Persistent boot-event log surfaced under the Hosts tab. Records
|
|
/// every `/boot/<entry>.ipxe` chain that goes on to serve a script
|
|
/// (i.e. an image actually starting to install on a machine).
|
|
pub boot_log: BootLog,
|
|
/// Operator-controlled UI overrides (custom logo). When the
|
|
/// operator hasn't uploaded anything, the WebUI serves the bundled
|
|
/// rainbow-horizon mark.
|
|
pub branding: BrandingStore,
|
|
/// Forms-auth admin record + first-run bootstrap state. When
|
|
/// `admin.is_configured() == false`, the auth middleware passes
|
|
/// every request through and `/api/me` reports `setup_required`.
|
|
pub admin: AdminStore,
|
|
/// In-memory session table for active operator logins. Cleared on
|
|
/// process restart (sessions are tied to UI state, not persisted —
|
|
/// matches Sonarr/Radarr behaviour).
|
|
pub sessions: SessionStore,
|
|
/// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
|
|
/// flow ships in a later release.
|
|
pub sso: SsoStore,
|
|
/// Lock-free metrics counters surfaced at `/metrics` in Prometheus
|
|
/// text format. Cheap to clone (handles to atomics).
|
|
pub metrics: Metrics,
|
|
/// Optional SMB manager. Present when the binary was given a writable
|
|
/// `smb_dir` at startup; `None` in pure-Linux-only deployments where
|
|
/// Windows support is not wired in. Settings toggle drives start/stop.
|
|
pub smb: Option<Arc<SmbManager>>,
|
|
/// v0.4.65: SMB share manager — userspace consumer of remote SMB
|
|
/// shares via Samba's `smbclient` CLI. Replaces the kernel-mount
|
|
/// NFS path that v0.4.64 shipped; that path didn't work on hosts
|
|
/// (Unraid, etc.) whose kernel ships without the nfs/cifs client
|
|
/// modules, and no container-side configuration could fix it.
|
|
/// `smbclient` does the SMB protocol over a plain TCP socket in
|
|
/// userspace — works in any container, no special caps required.
|
|
pub smb_shares: SmbShareManager,
|
|
/// Browser chunked upload state. Multipart uploads still go straight
|
|
/// through `IsoStore`, but the UI uses sessions so large ISO transfers
|
|
/// can show deterministic progress and leave visible partial files.
|
|
pub uploads: UploadSessions,
|
|
/// Live log bus consumed by the Terminal tab via SSE. Operator-issued
|
|
/// terminal commands also push synthetic lines onto it so the tail
|
|
/// shows them inline.
|
|
pub log_bus: Arc<LogBus>,
|
|
/// Wall-clock instant the server bound — used for the uptime chip.
|
|
pub started_at: OffsetDateTime,
|
|
/// Base URL advertised to PXE clients (e.g. `http://10.0.0.5`). Used when
|
|
/// rendering iPXE scripts so every URL resolves offline.
|
|
pub public_base_url: String,
|
|
/// Name of the network interface auto-detected at startup (e.g.
|
|
/// `enp1s0`). Surfaced read-only on the Network tab. Empty if the
|
|
/// interface couldn't be identified.
|
|
pub nic_name: String,
|
|
/// Subnet mask of the public interface in dotted-quad form.
|
|
pub subnet_mask: String,
|
|
/// Default gateway IPv4 address.
|
|
pub gateway: String,
|
|
}
|