{% extends "ui/_layout.html" %}
{% block title %}Settings - bty-web{% endblock %}

{% block subnav %}
{# Settings is the one page with real sub-nav: in-page jump links to
   each card, separated by vertical rules. #}
<nav class="navbar subnav-strip" aria-label="Settings sections">
    <div class="container">
        <span class="subnav-jumps d-flex align-items-center flex-wrap">
            <a href="#upstream-sources">Upstream sources</a>
            <span class="vr"></span>
            <a href="#settings-identity">Identity</a>
            <span class="vr"></span>
            <a href="#settings-storage-paths">Storage paths</a>
            <span class="vr"></span>
            <a href="#settings-network">Network</a>
            <span class="vr"></span>
            <a href="#settings-background-workers">Background workers</a>
            <span class="vr"></span>
            <a href="#dhcp-pxe">DHCP / Network boot</a>
        </span>
    </div>
</nav>
{% endblock %}

{% block intro %}
{% from "ui/_intro_box.html" import render as intro_box %}
{% call intro_box() %}
    Where every bty magic value comes from. Most are read-only (set via
    environment variable or derived from the state directory); the
    <strong>Upstream sources</strong> card is editable and persists in
    the database. The <strong>DHCP / Network boot</strong> cheatsheet below
    is the router-side config to point PXE / HTTP-Boot clients at this
    appliance. Operator
    authentication lives on the <a href="/ui/account">Account</a> page.
{% endcall %}
{% endblock %}

{% block content %}
{# Editable: the two upstream URLs. Empty field clears the override and
   reverts to env / default. Both take effect on the next fetch. #}
<div class="card mb-4" id="upstream-sources">
    <div class="card-header bg-light fw-semibold">
        <i class="bi bi-cloud-arrow-down me-1"></i>Upstream sources
    </div>
    <div class="card-body">
        <form method="post" action="/ui/settings/upstream">
            <div class="mb-3">
                <label for="release_repo" class="form-label">Netboot release repo</label>
                <input type="text" class="form-control font-monospace" id="release_repo"
                       name="release_repo" placeholder="{{ upstream.release_repo_default }}"
                       value="{{ upstream.release_repo_override or '' }}">
                <div class="form-text small">
                    GitHub <code>owner/repo</code> the netboot artifacts (and the
                    default catalog URL) are pulled from. Effective:
                    <code>{{ upstream.release_repo }}</code>{% if not upstream.release_repo_override %}
                    (default; leave blank to keep){% endif %}.
                </div>
            </div>
            <div class="mb-3">
                <label for="catalog_url" class="form-label">Catalog URL</label>
                <input type="text" class="form-control font-monospace" id="catalog_url"
                       name="catalog_url" placeholder="{{ upstream.catalog_url_default }}"
                       value="{{ upstream.catalog_url_override or '' }}">
                <div class="form-text small">
                    Full URL the <em>Fetch latest catalog</em> action downloads
                    <code>catalog.toml</code> from. Effective:
                    <code>{{ upstream.catalog_url }}</code>{% if not upstream.catalog_url_override %}
                    (derived from the release repo; leave blank to keep){% endif %}.
                </div>
            </div>
            <div class="mb-3">
                <label for="release_tag" class="form-label">Netboot release tag</label>
                <input type="text" class="form-control font-monospace" id="release_tag"
                       name="release_tag" placeholder="{{ upstream.release_tag_default }}"
                       value="{{ upstream.release_tag_override or '' }}">
                <div class="form-text small">
                    Which release the <em>Fetch artifacts</em> button on the
                    <a href="/ui/netboot">Netboot</a> page pulls: <code>latest</code>
                    or a tag like <code>v0.23.0</code>. Effective:
                    <code>{{ upstream.release_tag }}</code>{% if not upstream.release_tag_override %}
                    (default; leave blank to keep){% endif %}.
                </div>
            </div>
            <button type="submit" class="btn btn-primary">
                <i class="bi bi-save me-1"></i>Save upstream sources
            </button>
            <span class="form-text small ms-2">Clear a field to revert it to the default.</span>
        </form>
    </div>
</div>

{# Read-only: the magic values, grouped, each row tagged with where the
   live value came from (env var / derived path / default). #}
{% for group in config_groups %}
<div class="card mb-4" id="settings-{{ group.title|lower|replace(' ', '-') }}">
    <div class="card-header bg-light fw-semibold">
        <i class="bi bi-{{ group.icon }} me-1"></i>{{ group.title }}
    </div>
    <div class="table-responsive">
        <table class="table table-sm mb-0 align-middle">
            <thead class="table-light">
                <tr>
                    <th style="width: 18rem;">Setting</th>
                    <th>Value</th>
                    <th style="width: 1%; white-space: nowrap;">Source</th>
                    <th style="width: 1%; white-space: nowrap;">Env var</th>
                </tr>
            </thead>
            <tbody>
                {% for r in group.rows %}
                <tr>
                    <td>{{ r.label }}</td>
                    <td><code class="small">{{ r.value }}</code></td>
                    <td>
                        {% if r.source == "env" %}
                        <span class="badge bg-primary" title="set via environment variable">env</span>
                        {% elif r.source == "derived" %}
                        <span class="badge bg-secondary" title="derived from another path">derived</span>
                        {% else %}
                        <span class="badge bg-light text-dark border"
                              title="built-in default: {{ r.default }}">default</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if r.env %}<code class="small text-muted">{{ r.env }}</code>
                        {% else %}<span class="text-muted small">-</span>{% endif %}
                    </td>
                </tr>
                {% endfor %}
            </tbody>
        </table>
    </div>
</div>
{% endfor %}

{# Router-side cheatsheet (moved here from the Netboot page). The bits
   the operator pastes into UniFi / pfSense / dnsmasq DHCP config to
   point PXE clients at this appliance. Reference-only; no editable
   fields -- bty doesn't run DHCP, the LAN router does. #}
<div class="card mb-4" id="dhcp-pxe">
    <div class="card-header bg-light fw-semibold">
        <i class="bi bi-hdd-network me-1"></i>DHCP / Network boot
    </div>
    <div class="card-body">
        <p class="text-muted">
            bty-server runs a TFTP daemon (dnsmasq) and serves boot
            artifacts over HTTP, so targets can net-boot two ways:
            <strong>PXE</strong> (legacy + UEFI, iPXE fetched over TFTP)
            and <strong>UEFI HTTP Boot</strong> (iPXE fetched over HTTP,
            no TFTP). The DHCP side stays with your LAN's router (or DHCP
            server); bty deliberately doesn't try to replace it. Point
            your router at this appliance with the settings below.
        </p>

        {% if missing_netboot_artifacts %}
        <div class="alert alert-warning d-flex justify-content-between align-items-start">
            <div>
                <i class="bi bi-exclamation-triangle-fill me-1"></i>
                <strong>Netboot environment incomplete.</strong>
                Missing under <code>{{ boot_root }}</code>:
                {% for name in missing_netboot_artifacts %}
                <code>{{ name }}</code>{% if not loop.last %}, {% endif %}
                {% endfor %}.
                PXE clients will chain into iPXE but get 404 on the
                kernel fetch until these files are present.
            </div>
            <a href="/ui/fetches" class="btn btn-sm btn-primary ms-3 flex-shrink-0 text-nowrap">
                <i class="bi bi-cloud-download me-1"></i>Fetch latest
            </a>
        </div>
        {% endif %}

        <h3 class="h6 mt-3">This appliance</h3>
        <table class="table table-sm mb-3">
            <thead class="table-light">
                <tr>
                    <th scope="col">Interface</th>
                    <th scope="col">State</th>
                    <th scope="col">IPv4</th>
                </tr>
            </thead>
            <tbody>
                {% for iface in interfaces %}
                <tr>
                    <td><code>{{ iface.name }}</code></td>
                    <td>{{ iface.operstate }}</td>
                    <td>
                        {% if iface.ipv4 %}
                        <code>{{ iface.ipv4 }}/{{ iface.prefix }}</code>
                        {% else %}
                        <span class="text-muted">(no address)</span>
                        {% endif %}
                    </td>
                </tr>
                {% else %}
                <tr><td colspan="3" class="text-muted">(no interfaces detected)</td></tr>
                {% endfor %}
            </tbody>
        </table>

        <h3 class="h6 mt-4">Router-side configuration</h3>
        <p class="text-muted">
            Configure your LAN's DHCP server to tag PXE clients with
            the options below. For UniFi: <em>Settings &rarr; Networks
            &rarr; [your LAN] &rarr; Advanced &rarr; DHCP &rarr; Network
            Boot</em>. For pfSense / OpenWRT / dnsmasq: equivalent
            options on the DHCP service.
        </p>

        {# Shorthand for "this appliance's IP", reused across both tables. #}
        {% set bty_ip = primary.ipv4 if primary and primary.ipv4 else "<bty-server>" %}

        <h4 class="h6 mt-3 fw-semibold">Option A &mdash; PXE (via TFTP)</h4>
        <p class="text-muted small mb-2">
            Legacy BIOS and UEFI PXE. The firmware TFTPs the iPXE binary
            from this appliance, then iPXE chains on over HTTP.
        </p>
        <table class="table table-sm">
            <thead class="table-light">
                <tr>
                    <th scope="col">Option</th>
                    <th scope="col">Value</th>
                    <th scope="col">Notes</th>
                </tr>
            </thead>
            <tbody>
                <tr>
                    <td><code>option 60</code></td>
                    <td><code>PXEClient</code></td>
                    <td>Vendor-class echo. Strict UEFI firmware filters offers without it.</td>
                </tr>
                <tr>
                    <td><code>option 66</code> / Next-Server</td>
                    <td><code>{{ bty_ip }}</code></td>
                    <td>The TFTP server. Same box as bty-web.</td>
                </tr>
                <tr>
                    <td><code>option 67</code> / Boot-Filename</td>
                    <td><code>ipxe.efi</code></td>
                    <td>For UEFI PXEClient (arch 6/7/9). Use <code>undionly.kpxe</code> for legacy BIOS (arch 0).</td>
                </tr>
                <tr>
                    <td><code>option 67</code> for <code>user-class=iPXE</code></td>
                    <td><code>http://{{ bty_ip }}:8080/pxe-bootstrap.ipxe</code></td>
                    <td>Stops iPXE chain-loop. Different bootfile when iPXE re-DHCPs.</td>
                </tr>
            </tbody>
        </table>

        <h4 class="h6 mt-4 fw-semibold">Option B &mdash; UEFI HTTP Boot (no TFTP)</h4>
        <p class="text-muted small mb-2">
            For firmware with UEFI HTTP Boot, the target fetches iPXE
            directly over HTTP &mdash; no TFTP server in the path. Tag
            HTTP-Boot clients (vendor-class <code>HTTPClient</code>) with
            these instead of the PXE options above. Everything after iPXE
            loads is identical to the PXE flow.
        </p>
        <table class="table table-sm">
            <thead class="table-light">
                <tr>
                    <th scope="col">Option</th>
                    <th scope="col">Value</th>
                    <th scope="col">Notes</th>
                </tr>
            </thead>
            <tbody>
                <tr>
                    <td><code>option 60</code></td>
                    <td><code>HTTPClient</code></td>
                    <td>Vendor-class echo. UEFI HTTP-Boot firmware filters offers without it (the HTTP-Boot counterpart of <code>PXEClient</code>).</td>
                </tr>
                <tr>
                    <td><code>option 66</code> / Next-Server</td>
                    <td><code>{{ bty_ip }}</code></td>
                    <td><strong>Still required.</strong> bty's iPXE binary chains on to <code>http://&lt;next-server&gt;:8080/pxe-bootstrap.ipxe</code>, so this must point here even though the bootfile below is a full URL.</td>
                </tr>
                <tr>
                    <td><code>option 67</code> / Boot-Filename</td>
                    <td><code>http://{{ bty_ip }}:8080/boot/ipxe.efi</code></td>
                    <td>Full URL. The firmware HTTP-downloads iPXE directly &mdash; no TFTP roundtrip.</td>
                </tr>
            </tbody>
        </table>
        <p class="form-text mt-2 mb-0">
            Both paths converge: once iPXE is running it fetches
            <code>http://{{ bty_ip }}:8080/pxe-bootstrap.ipxe</code> and
            then the per-MAC plan at <code>/pxe/&lt;mac&gt;</code>. The
            only differences are the vendor class and how the iPXE binary
            is delivered (TFTP vs HTTP).
        </p>
    </div>
</div>

{% endblock %}