{% extends "ui/_layout.html" %}
{% block title %}Settings - bty-web{% endblock %}
{% block content %}
{# Hoisted once: ``primary`` is the first listed non-loopback
   interface, used by the router-config cheatsheet to suggest
   the appliance's LAN IP. Computed up front so the same
   reference is available everywhere on the page. #}
{% set primary = interfaces[0] if interfaces else None %}
<h1 class="h3 mb-4"><i class="bi bi-gear me-2"></i>Settings</h1>

<!-- ----------------------------------------------------------------- -->
<div class="card mb-4">
    <div class="card-body">
        <h2 class="h5 mb-3"><i class="bi bi-shield-lock me-2"></i>Authentication</h2>
        <p class="text-muted mb-0">
            bty-web is gated by the OS password of the
            <code>{{ service_user }}</code> account. To rotate the credential,
            run <code>sudo passwd {{ service_user }}</code> on the server.
            Sessions are server-signed cookies (Starlette's
            <code>SessionMiddleware</code>) with a sliding 7-day TTL. To
            invalidate every existing session in one shot, rotate the
            session secret:
            <code>sudo rm /var/lib/bty/session-secret &amp;&amp; sudo systemctl
            restart bty-web</code>. The restart regenerates the secret on
            startup; no reboot needed.
        </p>
    </div>
</div>

<!-- ----------------------------------------------------------------- -->
<div class="card mb-4">
    <div class="card-body">
        <h2 class="h5 mb-3"><i class="bi bi-hdd-network me-2"></i>PXE / network boot</h2>
        <p class="text-muted">
            bty-server runs a TFTP daemon (dnsmasq) and serves boot
            artefacts over HTTP. The DHCP side stays with your LAN's
            router/DHCP server -- bty deliberately doesn't try to
            replace it. Point your router at this appliance with the
            settings below.
        </p>

        {% if missing_netboot_artifacts %}
        <div class="alert alert-warning d-flex justify-content-between align-items-start">
            <div>
                <i class="bi bi-exclamation-triangle-fill me-1"></i>
                <strong>Netboot environment incomplete.</strong>
                Missing under <code>{{ boot_root }}</code>:
                {% for name in missing_netboot_artifacts %}
                <code>{{ name }}</code>{% if not loop.last %}, {% endif %}
                {% endfor %}.
                PXE clients will chain into iPXE but get 404 on the
                kernel fetch until these files are present.
            </div>
            <a href="/ui/boot" class="btn btn-sm btn-outline-warning ms-3 flex-shrink-0">
                <i class="bi bi-arrow-right-circle me-1"></i>Boot artifacts
            </a>
        </div>
        {% endif %}

        <h3 class="h6 mt-3">This appliance</h3>
        <table class="table table-sm mb-3">
            <thead>
                <tr>
                    <th scope="col">Interface</th>
                    <th scope="col">State</th>
                    <th scope="col">IPv4</th>
                </tr>
            </thead>
            <tbody>
                {% for iface in interfaces %}
                <tr>
                    <td><code>{{ iface.name }}</code></td>
                    <td>{{ iface.operstate }}</td>
                    <td>
                        {% if iface.ipv4 %}
                        <code>{{ iface.ipv4 }}/{{ iface.prefix }}</code>
                        {% else %}
                        <span class="text-muted">(no address)</span>
                        {% endif %}
                    </td>
                </tr>
                {% else %}
                <tr><td colspan="3" class="text-muted">(no interfaces detected)</td></tr>
                {% endfor %}
            </tbody>
        </table>

        <h3 class="h6 mt-4">Router-side configuration</h3>
        <p class="text-muted">
            Configure your LAN's DHCP server to tag PXE clients with
            the options below. For UniFi: <em>Settings &rarr; Networks
            &rarr; [your LAN] &rarr; Advanced &rarr; DHCP &rarr; Network
            Boot</em>. For pfSense / OpenWRT / dnsmasq: equivalent
            options on the DHCP service.
        </p>

        <table class="table table-sm">
            <thead>
                <tr>
                    <th scope="col">Option</th>
                    <th scope="col">Value</th>
                    <th scope="col">Notes</th>
                </tr>
            </thead>
            <tbody>
                <tr>
                    <td><code>option 60</code></td>
                    <td><code>PXEClient</code></td>
                    <td>Vendor-class echo. Strict UEFI firmware filters offers without it.</td>
                </tr>
                <tr>
                    <td><code>option 66</code> / Next-Server</td>
                    <td>
                        {% if primary and primary.ipv4 %}
                        <code>{{ primary.ipv4 }}</code>
                        {% else %}
                        <code>(this appliance's LAN IP)</code>
                        {% endif %}
                    </td>
                    <td>The TFTP server. Same box as bty-web.</td>
                </tr>
                <tr>
                    <td><code>option 67</code> / Boot-Filename</td>
                    <td><code>ipxe.efi</code></td>
                    <td>For UEFI PXEClient (arch 6/7/9). Use <code>undionly.kpxe</code> for legacy BIOS (arch 0).</td>
                </tr>
                <tr>
                    <td><code>option 67</code> for <code>user-class=iPXE</code></td>
                    <td>
                        <code>http://{% if primary and primary.ipv4 %}{{ primary.ipv4 }}{% else %}&lt;bty-server&gt;{% endif %}:8080/pxe-bootstrap.ipxe</code>
                    </td>
                    <td>Stops iPXE chain-loop. Different bootfile when iPXE re-DHCPs.</td>
                </tr>
            </tbody>
        </table>

        <p class="form-text mt-2 mb-0">
            For UEFI HTTP-Boot (vendor-class <code>HTTPClient</code>), point
            <code>option 67</code> at
            <code>http://{% if primary and primary.ipv4 %}{{ primary.ipv4 }}{% else %}&lt;bty-server&gt;{% endif %}:8080/boot/ipxe.efi</code>
            instead -- no TFTP roundtrip.
        </p>
    </div>
</div>

<!-- ----------------------------------------------------------------- -->
{# TFTP daemon (dnsmasq) state + control panel. Distinct from the
   info card above: this lets the operator triage the local TFTP
   service. Start / Stop are the "take PXE offline briefly" knobs;
   Restart picks up any TFTP-root changes the operator made by hand. #}
<div class="card">
    <div class="card-body">
        <h2 class="h5 mb-3"><i class="bi bi-cpu me-2"></i>TFTP daemon</h2>
        <p class="text-muted">
            The local <code>dnsmasq.service</code> serves the TFTP root
            (<code>/var/lib/tftpboot</code>). Stop it to take PXE offline
            without disabling DHCP; restart it to pick up new bootfiles
            staged into the TFTP root.
        </p>
        <div class="d-flex align-items-center gap-3">
            <div>
                {% if tftp.state == 'active' %}
                <span class="badge bg-success fs-6">{{ tftp.state }}</span>
                {% elif tftp.state == 'failed' %}
                <span class="badge bg-danger fs-6">{{ tftp.state }}</span>
                {% elif tftp.state in ('activating', 'deactivating', 'reloading') %}
                <span class="badge bg-warning text-dark fs-6">{{ tftp.state }}</span>
                {% else %}
                <span class="badge bg-secondary fs-6">{{ tftp.state }}</span>
                {% endif %}
                <code class="ms-2">dnsmasq.service</code>
            </div>
            {% if tftp_controllable %}
            <form action="/ui/settings/tftp-control" method="post" class="d-inline-flex gap-1 m-0 ms-auto">
                <button type="submit" name="action" value="start"
                        class="btn btn-sm btn-outline-success"
                        {% if tftp.is_active %}disabled{% endif %}>
                    <i class="bi bi-play-fill"></i> Start
                </button>
                <button type="submit" name="action" value="stop"
                        class="btn btn-sm btn-outline-secondary"
                        {% if not tftp.is_active %}disabled{% endif %}>
                    <i class="bi bi-stop-fill"></i> Stop
                </button>
                <button type="submit" name="action" value="restart"
                        class="btn btn-sm btn-outline-warning">
                    <i class="bi bi-arrow-clockwise"></i> Restart
                </button>
            </form>
            {% else %}
            {# No sudo'd helper available in this deployment (Docker
               container, dev shell, etc). dnsmasq lifecycle is owned
               by the entrypoint / supervisor instead of bty-web. #}
            <span class="text-muted ms-auto small">
                <i class="bi bi-info-circle me-1"></i>Controls disabled (no daemon helper here)
            </span>
            {% endif %}
        </div>
    </div>
</div>

{% endblock %}