[新增] OpenFlare Pages

2026-10-04 07:06:36 +08:00 · 2026-06-03 17:09:02 +08:00
parent 3ec607106d
commit 2c74d042ed
38 changed files with 2630 additions and 72 deletions
@@ -0,0 +1,162 @@
+package controller
+
+import (
+	"openflare/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+func ListPagesProjects(c *gin.Context) {
+	projects, err := service.ListPagesProjects()
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, projects)
+}
+
+func GetPagesProject(c *gin.Context) {
+	id, ok := parseIDParam(c)
+	if !ok {
+		return
+	}
+	project, err := service.GetPagesProject(id)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, project)
+}
+
+func CreatePagesProject(c *gin.Context) {
+	var input service.PagesProjectInput
+	if !bindJSON(c, &input) {
+		return
+	}
+	project, err := service.CreatePagesProject(input)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, project)
+}
+
+func UpdatePagesProject(c *gin.Context) {
+	id, ok := parseIDParam(c)
+	if !ok {
+		return
+	}
+	var input service.PagesProjectInput
+	if !bindJSON(c, &input) {
+		return
+	}
+	project, err := service.UpdatePagesProject(id, input)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, project)
+}
+
+func DeletePagesProject(c *gin.Context) {
+	id, ok := parseIDParam(c)
+	if !ok {
+		return
+	}
+	if err := service.DeletePagesProject(id); err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, nil)
+}
+
+func ListPagesDeployments(c *gin.Context) {
+	id, ok := parseIDParam(c)
+	if !ok {
+		return
+	}
+	deployments, err := service.ListPagesProjectDeployments(id)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, deployments)
+}
+
+func UploadPagesDeployment(c *gin.Context) {
+	id, ok := parseIDParam(c)
+	if !ok {
+		return
+	}
+	file, err := c.FormFile("package")
+	if err != nil {
+		respondBadRequest(c, "缺少 Pages 部署包")
+		return
+	}
+	deployment, err := service.UploadPagesDeployment(id, file, c.PostForm("entry_file"), c.GetString("username"))
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, deployment)
+}
+
+func ActivatePagesDeployment(c *gin.Context) {
+	projectID, ok := parseIDParam(c)
+	if !ok {
+		return
+	}
+	deploymentID, ok := parseIDParamByName(c, "deployment_id")
+	if !ok {
+		return
+	}
+	project, err := service.ActivatePagesDeployment(projectID, deploymentID)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, project)
+}
+
+func DeletePagesDeployment(c *gin.Context) {
+	projectID, ok := parseIDParam(c)
+	if !ok {
+		return
+	}
+	deploymentID, ok := parseIDParamByName(c, "deployment_id")
+	if !ok {
+		return
+	}
+	if err := service.DeletePagesDeployment(projectID, deploymentID); err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, nil)
+}
+
+func ListPagesDeploymentFiles(c *gin.Context) {
+	deploymentID, ok := parseIDParamByName(c, "deployment_id")
+	if !ok {
+		return
+	}
+	files, err := service.ListPagesDeploymentFiles(deploymentID)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, files)
+}
+
+func AgentDownloadPagesDeploymentPackage(c *gin.Context) {
+	deploymentID, ok := parseIDParamByName(c, "deployment_id")
+	if !ok {
+		return
+	}
+	filePath, fileName, err := service.GetPagesDeploymentPackagePath(deploymentID)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	c.Header("Content-Disposition", "attachment; filename="+fileName)
+	c.File(filePath)
+}
@@ -75,7 +75,11 @@ func decodeOptionalJSONBody(body io.Reader, target any) error {
 }

 func parseIDParam(c *gin.Context) (uint, bool) {
-	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	return parseIDParamByName(c, "id")
+}
+
+func parseIDParamByName(c *gin.Context, name string) (uint, bool) {
+	id, err := strconv.ParseUint(c.Param(name), 10, 64)
 	if err != nil || id == 0 {
 		respondBadRequest(c, "")
 		return 0, false
@@ -0,0 +1,61 @@
+package goose
+
+import (
+	"fmt"
+
+	presslygoose "github.com/pressly/goose/v3"
+	"gorm.io/gorm"
+)
+
+const versionPagesStaticHosting int64 = 202606030001
+
+// migration202606030001 adds OpenFlare Pages static hosting tables and the
+// proxy_routes.pages_project_id binding used by the global release snapshot.
+func migration202606030001(backend string, ctx Context) *presslygoose.Migration {
+	return newGORMMigration(
+		versionPagesStaticHosting,
+		"202606030001_add_pages_static_hosting.go",
+		backend,
+		ctx,
+		migratePagesStaticHosting,
+	)
+}
+
+func migratePagesStaticHosting(ctx Context, db *gorm.DB, backend string) error {
+	if err := ctx.ApplyCurrentSchema(db, backend); err != nil {
+		return err
+	}
+	if err := db.Exec(
+		`UPDATE proxy_routes SET upstream_type = 'direct' WHERE upstream_type IS NULL OR TRIM(upstream_type) = ''`,
+	).Error; err != nil {
+		return fmt.Errorf("backfill proxy_routes.upstream_type: %w", err)
+	}
+	return validatePagesStaticHosting(db)
+}
+
+func validatePagesStaticHosting(db *gorm.DB) error {
+	if db == nil {
+		return fmt.Errorf("database handle is nil")
+	}
+	for _, table := range []string{"pages_projects", "pages_deployments", "pages_deployment_files"} {
+		if !db.Migrator().HasTable(table) {
+			return fmt.Errorf("table %s is missing", table)
+		}
+	}
+	for _, column := range []string{"upstream_type", "pages_project_id"} {
+		if !db.Migrator().HasColumn("proxy_routes", column) {
+			return fmt.Errorf("column proxy_routes.%s is missing", column)
+		}
+	}
+	for _, column := range []string{"slug", "active_deployment_id", "spa_fallback_enabled"} {
+		if !db.Migrator().HasColumn("pages_projects", column) {
+			return fmt.Errorf("column pages_projects.%s is missing", column)
+		}
+	}
+	for _, column := range []string{"project_id", "checksum", "artifact_path", "entry_file"} {
+		if !db.Migrator().HasColumn("pages_deployments", column) {
+			return fmt.Errorf("column pages_deployments.%s is missing", column)
+		}
+	}
+	return nil
+}
@@ -41,6 +41,7 @@ func newGORMMigration(version int64, source string, backend string, ctx Context,
 func registeredMigrations(backend string, ctx Context) []*presslygoose.Migration {
 	return []*presslygoose.Migration{
 		migration202606020001(backend, ctx),
+		migration202606030001(backend, ctx),
 	}
 }

@@ -32,6 +32,9 @@ func registeredModels() []any {
 		&Option{},
 		&Origin{},
 		&ProxyRoute{},
+		&PagesProject{},
+		&PagesDeployment{},
+		&PagesDeploymentFile{},
 		&ConfigVersion{},
 		&Node{},

@@ -0,0 +1,77 @@
+package model
+
+import "time"
+
+const (
+	PagesDeploymentStatusUploaded = "uploaded"
+	PagesDeploymentStatusActive   = "active"
+)
+
+type PagesProject struct {
+	ID                 uint      `json:"id" gorm:"primaryKey"`
+	Name               string    `json:"name" gorm:"size:255;not null"`
+	Slug               string    `json:"slug" gorm:"uniqueIndex;size:128;not null"`
+	Description        string    `json:"description" gorm:"type:text;not null;default:''"`
+	Enabled            bool      `json:"enabled" gorm:"not null;default:true"`
+	SPAFallbackEnabled bool      `json:"spa_fallback_enabled" gorm:"not null;default:false"`
+	ActiveDeploymentID *uint     `json:"active_deployment_id" gorm:"index"`
+	CreatedAt          time.Time `json:"created_at"`
+	UpdatedAt          time.Time `json:"updated_at"`
+}
+
+type PagesDeployment struct {
+	ID               uint       `json:"id" gorm:"primaryKey"`
+	ProjectID        uint       `json:"project_id" gorm:"not null;index"`
+	DeploymentNumber int        `json:"deployment_number" gorm:"not null"`
+	Checksum         string     `json:"checksum" gorm:"size:64;not null;index"`
+	Status           string     `json:"status" gorm:"size:32;not null;default:'uploaded';index"`
+	ArtifactPath     string     `json:"artifact_path" gorm:"size:2048;not null"`
+	FileCount        int        `json:"file_count" gorm:"not null;default:0"`
+	TotalSize        int64      `json:"total_size" gorm:"not null;default:0"`
+	EntryFile        string     `json:"entry_file" gorm:"size:512;not null;default:'index.html'"`
+	CreatedBy        string     `json:"created_by" gorm:"size:64;not null;default:''"`
+	CreatedAt        time.Time  `json:"created_at"`
+	ActivatedAt      *time.Time `json:"activated_at"`
+}
+
+type PagesDeploymentFile struct {
+	ID           uint      `json:"id" gorm:"primaryKey"`
+	DeploymentID uint      `json:"deployment_id" gorm:"not null;index"`
+	Path         string    `json:"path" gorm:"size:2048;not null"`
+	Size         int64     `json:"size" gorm:"not null;default:0"`
+	Checksum     string    `json:"checksum" gorm:"size:64;not null"`
+	CreatedAt    time.Time `json:"created_at"`
+}
+
+func ListPagesProjects() (projects []*PagesProject, err error) {
+	err = DB.Order("id desc").Find(&projects).Error
+	return projects, err
+}
+
+func GetPagesProjectByID(id uint) (*PagesProject, error) {
+	project := &PagesProject{}
+	err := DB.First(project, id).Error
+	return project, err
+}
+
+func GetPagesProjectBySlug(slug string) (*PagesProject, error) {
+	project := &PagesProject{}
+	err := DB.Where("slug = ?", slug).First(project).Error
+	return project, err
+}
+
+func ListPagesDeployments(projectID uint) (deployments []*PagesDeployment, err error) {
+	err = DB.Where("project_id = ?", projectID).Order("id desc").Find(&deployments).Error
+	return deployments, err
+}
+
+func GetPagesDeploymentByID(id uint) (*PagesDeployment, error) {
+	deployment := &PagesDeployment{}
+	err := DB.First(deployment, id).Error
+	return deployment, err
+}
+
+func ListPagesDeploymentFiles(deploymentID uint) (files []*PagesDeploymentFile, err error) {
+	err = DB.Where("deployment_id = ?", deploymentID).Order("path asc").Find(&files).Error
+	return files, err
+}
@@ -34,6 +34,7 @@ type ProxyRoute struct {
 	TunnelNodeID         *uint     `json:"tunnel_node_id" gorm:"index"`
 	TunnelTargetAddr     string    `json:"tunnel_target_addr" gorm:"size:512"`
 	TunnelTargetProtocol string    `json:"tunnel_target_protocol" gorm:"size:16"`
+	PagesProjectID       *uint     `json:"pages_project_id" gorm:"index"`
 	CreatedAt            time.Time `json:"created_at"`
 	UpdatedAt            time.Time `json:"updated_at"`
 }
@@ -95,6 +96,7 @@ func (route *ProxyRoute) Update() error {
 		"tunnel_node_id":         route.TunnelNodeID,
 		"tunnel_target_addr":     route.TunnelTargetAddr,
 		"tunnel_target_protocol": route.TunnelTargetProtocol,
+		"pages_project_id":       route.PagesProjectID,
 	}).Error
 }

@@ -127,6 +127,20 @@ func SetApiRouter(router *gin.Engine) {
 			originRoute.POST("/:id/update", controller.UpdateOrigin)
 			originRoute.POST("/:id/delete", controller.DeleteOrigin)
 		}
+		pagesRoute := apiRouter.Group("/pages")
+		pagesRoute.Use(middleware.AdminAuth())
+		{
+			pagesRoute.GET("/", controller.ListPagesProjects)
+			pagesRoute.GET("/:id", controller.GetPagesProject)
+			pagesRoute.POST("/", controller.CreatePagesProject)
+			pagesRoute.POST("/:id/update", controller.UpdatePagesProject)
+			pagesRoute.POST("/:id/delete", controller.DeletePagesProject)
+			pagesRoute.GET("/:id/deployments", controller.ListPagesDeployments)
+			pagesRoute.POST("/:id/deployments/upload", controller.UploadPagesDeployment)
+			pagesRoute.POST("/:id/deployments/:deployment_id/activate", controller.ActivatePagesDeployment)
+			pagesRoute.POST("/:id/deployments/:deployment_id/delete", controller.DeletePagesDeployment)
+			pagesRoute.GET("/deployments/:deployment_id/files", controller.ListPagesDeploymentFiles)
+		}
 		managedDomainRoute := apiRouter.Group("/managed-domains")
 		managedDomainRoute.Use(middleware.AdminAuth())
 		{
@@ -227,6 +241,7 @@ func SetApiRouter(router *gin.Engine) {
 				authorizedRoute.GET("/ws", controller.AgentWebSocket)
 				authorizedRoute.POST("/nodes/heartbeat", controller.AgentHeartbeat)
 				authorizedRoute.GET("/config-versions/active", controller.AgentGetActiveConfig)
+				authorizedRoute.GET("/pages/deployments/:deployment_id/package", controller.AgentDownloadPagesDeploymentPackage)
 				authorizedRoute.POST("/waf/ip-groups/sync", controller.AgentSyncWAFIPGroups)
 				authorizedRoute.POST("/apply-logs", controller.AgentReportApplyLog)
 			}
@@ -93,6 +93,19 @@ type snapshotRoute struct {
 	TunnelNodeID       *uint                         `json:"tunnel_node_id,omitempty"`
 	TunnelTargetAddr   string                        `json:"tunnel_target_addr,omitempty"`
 	TunnelTargetProto  string                        `json:"tunnel_target_protocol,omitempty"`
+	PagesProjectID     *uint                         `json:"pages_project_id,omitempty"`
+	PagesDeployment    *snapshotPagesDeployment      `json:"pages_deployment,omitempty"`
+}
+
+type snapshotPagesDeployment struct {
+	ProjectID          uint   `json:"project_id"`
+	ProjectSlug        string `json:"project_slug"`
+	DeploymentID       uint   `json:"deployment_id"`
+	DeploymentNumber   int    `json:"deployment_number"`
+	Checksum           string `json:"checksum"`
+	EntryFile          string `json:"entry_file"`
+	SPAFallbackEnabled bool   `json:"spa_fallback_enabled"`
+	LocalRoot          string `json:"local_root"`
 }

 type snapshotWAFRuleGroup struct {
@@ -515,12 +528,23 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 		var tunnelNodeID *uint
 		var tunnelTargetAddr string
 		var tunnelTargetProtocol string
+		var pagesProjectID *uint
+		var pagesDeployment *snapshotPagesDeployment
 		if upstreamType == "tunnel" {
 			originURL = resolveTunnelOpenRestyUpstreamURL()
 			upstreams = []string{originURL}
 			tunnelNodeID = route.TunnelNodeID
 			tunnelTargetAddr = strings.TrimSpace(route.TunnelTargetAddr)
 			tunnelTargetProtocol = normalizeTunnelTargetProtocol(route.TunnelTargetProtocol)
+		} else if upstreamType == "pages" {
+			deployment, err := buildSnapshotPagesDeployment(route.PagesProjectID)
+			if err != nil {
+				return nil, fmt.Errorf("路由 %s Pages 配置无效: %w", route.Domain, err)
+			}
+			originURL = fmt.Sprintf("openflare-pages://project/%d", deployment.ProjectID)
+			upstreams = []string{originURL}
+			pagesProjectID = route.PagesProjectID
+			pagesDeployment = deployment
 		}
 		cacheRules, err := decodeStoredCacheRules(route.CacheRules)
 		if err != nil {
@@ -564,11 +588,46 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 			TunnelNodeID:       tunnelNodeID,
 			TunnelTargetAddr:   tunnelTargetAddr,
 			TunnelTargetProto:  tunnelTargetProtocol,
+			PagesProjectID:     pagesProjectID,
+			PagesDeployment:    pagesDeployment,
 		})
 	}
 	return items, nil
 }

+func buildSnapshotPagesDeployment(projectID *uint) (*snapshotPagesDeployment, error) {
+	if projectID == nil || *projectID == 0 {
+		return nil, errors.New("pages_project_id is required")
+	}
+	project, err := model.GetPagesProjectByID(*projectID)
+	if err != nil {
+		return nil, err
+	}
+	if !project.Enabled {
+		return nil, errors.New("Pages 项目未启用")
+	}
+	if project.ActiveDeploymentID == nil || *project.ActiveDeploymentID == 0 {
+		return nil, errors.New("Pages 项目没有激活部署")
+	}
+	deployment, err := model.GetPagesDeploymentByID(*project.ActiveDeploymentID)
+	if err != nil {
+		return nil, err
+	}
+	if deployment.ProjectID != project.ID {
+		return nil, errors.New("Pages 激活部署不属于当前项目")
+	}
+	return &snapshotPagesDeployment{
+		ProjectID:          project.ID,
+		ProjectSlug:        project.Slug,
+		DeploymentID:       deployment.ID,
+		DeploymentNumber:   deployment.DeploymentNumber,
+		Checksum:           deployment.Checksum,
+		EntryFile:          deployment.EntryFile,
+		SPAFallbackEnabled: project.SPAFallbackEnabled,
+		LocalRoot:          fmt.Sprintf("%s/deployments/%d/current", openrestyrender.PagesDirPlaceholder, deployment.ID),
+	}, nil
+}
+
 func resolveTunnelOpenRestyUpstreamURL() string {
 	relayNodes, err := model.ListNodesByType("tunnel_relay")
 	if err == nil && len(relayNodes) > 0 {
@@ -819,10 +878,18 @@ func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
 		if routes[index].UpstreamType == "tunnel" {
 			routes[index].TunnelTargetAddr = strings.TrimSpace(routes[index].TunnelTargetAddr)
 			routes[index].TunnelTargetProto = normalizeTunnelTargetProtocol(routes[index].TunnelTargetProto)
+			routes[index].PagesProjectID = nil
+			routes[index].PagesDeployment = nil
+		} else if routes[index].UpstreamType == "pages" {
+			routes[index].TunnelNodeID = nil
+			routes[index].TunnelTargetAddr = ""
+			routes[index].TunnelTargetProto = ""
 		} else {
 			routes[index].TunnelNodeID = nil
 			routes[index].TunnelTargetAddr = ""
 			routes[index].TunnelTargetProto = ""
+			routes[index].PagesProjectID = nil
+			routes[index].PagesDeployment = nil
 		}
 	}
 	return routes
@@ -849,7 +916,7 @@ func flattenSnapshotRoutesByDomain(routes []snapshotRoute) map[string]snapshotRo
 }

 func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
-	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP || left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || left.PoWEnabled != right.PoWEnabled || left.BasicAuthEnabled != right.BasicAuthEnabled || left.BasicAuthUsername != right.BasicAuthUsername || left.BasicAuthPassword != right.BasicAuthPassword || left.UpstreamType != right.UpstreamType || !uintPtrEqual(left.TunnelNodeID, right.TunnelNodeID) || left.TunnelTargetAddr != right.TunnelTargetAddr || left.TunnelTargetProto != right.TunnelTargetProto || !uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
+	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP || left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || left.PoWEnabled != right.PoWEnabled || left.BasicAuthEnabled != right.BasicAuthEnabled || left.BasicAuthUsername != right.BasicAuthUsername || left.BasicAuthPassword != right.BasicAuthPassword || left.UpstreamType != right.UpstreamType || !uintPtrEqual(left.TunnelNodeID, right.TunnelNodeID) || left.TunnelTargetAddr != right.TunnelTargetAddr || left.TunnelTargetProto != right.TunnelTargetProto || !uintPtrEqual(left.PagesProjectID, right.PagesProjectID) || !snapshotPagesDeploymentEqual(left.PagesDeployment, right.PagesDeployment) || !uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
 		return false
 	}
 	if len(left.Domains) != len(right.Domains) {
@@ -890,6 +957,21 @@ func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
 	return true
 }

+func snapshotPagesDeploymentEqual(left *snapshotPagesDeployment, right *snapshotPagesDeployment) bool {
+	if left == nil || right == nil {
+		return left == nil && right == nil
+	}
+	leftJSON, err := json.Marshal(left)
+	if err != nil {
+		return false
+	}
+	rightJSON, err := json.Marshal(right)
+	if err != nil {
+		return false
+	}
+	return string(leftJSON) == string(rightJSON)
+}
+
 func snapshotWAFConfigEqual(left snapshotWAFDocument, right snapshotWAFDocument) bool {
 	leftJSON, err := json.Marshal(left)
 	if err != nil {
@@ -0,0 +1,635 @@
+package service
+
+import (
+	"archive/zip"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"openflare/common"
+	"openflare/model"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+const (
+	pagesMaxDeploymentFiles = 1000
+	pagesMaxDeploymentBytes = 25 * 1024 * 1024
+	defaultPagesEntryFile   = "index.html"
+)
+
+var pagesSlugPattern = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{0,126}[a-z0-9]$|^[a-z0-9]$`)
+
+type PagesProjectInput struct {
+	Name               string `json:"name"`
+	Slug               string `json:"slug"`
+	Description        string `json:"description"`
+	Enabled            bool   `json:"enabled"`
+	SPAFallbackEnabled bool   `json:"spa_fallback_enabled"`
+}
+
+type PagesProjectView struct {
+	ID                 uint                 `json:"id"`
+	Name               string               `json:"name"`
+	Slug               string               `json:"slug"`
+	Description        string               `json:"description"`
+	Enabled            bool                 `json:"enabled"`
+	SPAFallbackEnabled bool                 `json:"spa_fallback_enabled"`
+	ActiveDeploymentID *uint                `json:"active_deployment_id"`
+	ActiveDeployment   *PagesDeploymentView `json:"active_deployment,omitempty"`
+	DeploymentCount    int64                `json:"deployment_count"`
+	CreatedAt          time.Time            `json:"created_at"`
+	UpdatedAt          time.Time            `json:"updated_at"`
+}
+
+type PagesDeploymentView struct {
+	ID               uint       `json:"id"`
+	ProjectID        uint       `json:"project_id"`
+	DeploymentNumber int        `json:"deployment_number"`
+	Checksum         string     `json:"checksum"`
+	Status           string     `json:"status"`
+	FileCount        int        `json:"file_count"`
+	TotalSize        int64      `json:"total_size"`
+	EntryFile        string     `json:"entry_file"`
+	CreatedBy        string     `json:"created_by"`
+	CreatedAt        time.Time  `json:"created_at"`
+	ActivatedAt      *time.Time `json:"activated_at"`
+}
+
+type PagesDeploymentFileView struct {
+	ID           uint      `json:"id"`
+	DeploymentID uint      `json:"deployment_id"`
+	Path         string    `json:"path"`
+	Size         int64     `json:"size"`
+	Checksum     string    `json:"checksum"`
+	CreatedAt    time.Time `json:"created_at"`
+}
+
+type pagesDeploymentManifest struct {
+	Files     []model.PagesDeploymentFile
+	FileCount int
+	TotalSize int64
+	EntryFile string
+}
+
+func ListPagesProjects() ([]*PagesProjectView, error) {
+	projects, err := model.ListPagesProjects()
+	if err != nil {
+		return nil, err
+	}
+	views := make([]*PagesProjectView, 0, len(projects))
+	for _, project := range projects {
+		view, err := buildPagesProjectView(project)
+		if err != nil {
+			return nil, err
+		}
+		views = append(views, view)
+	}
+	return views, nil
+}
+
+func GetPagesProject(id uint) (*PagesProjectView, error) {
+	project, err := model.GetPagesProjectByID(id)
+	if err != nil {
+		return nil, err
+	}
+	return buildPagesProjectView(project)
+}
+
+func CreatePagesProject(input PagesProjectInput) (*PagesProjectView, error) {
+	project, err := buildPagesProject(nil, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = model.DB.Create(project).Error; err != nil {
+		if model.IsUniqueConstraintError(err) {
+			return nil, errors.New("Pages 项目标识已存在")
+		}
+		return nil, err
+	}
+	return buildPagesProjectView(project)
+}
+
+func UpdatePagesProject(id uint, input PagesProjectInput) (*PagesProjectView, error) {
+	project, err := model.GetPagesProjectByID(id)
+	if err != nil {
+		return nil, err
+	}
+	project, err = buildPagesProject(project, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = model.DB.Model(project).Updates(map[string]any{
+		"name":                 project.Name,
+		"slug":                 project.Slug,
+		"description":          project.Description,
+		"enabled":              project.Enabled,
+		"spa_fallback_enabled": project.SPAFallbackEnabled,
+	}).Error; err != nil {
+		if model.IsUniqueConstraintError(err) {
+			return nil, errors.New("Pages 项目标识已存在")
+		}
+		return nil, err
+	}
+	return buildPagesProjectView(project)
+}
+
+func DeletePagesProject(id uint) error {
+	project, err := model.GetPagesProjectByID(id)
+	if err != nil {
+		return err
+	}
+	var routeCount int64
+	if err = model.DB.Model(&model.ProxyRoute{}).Where("pages_project_id = ?", project.ID).Count(&routeCount).Error; err != nil {
+		return err
+	}
+	if routeCount > 0 {
+		return errors.New("Pages 项目已被规则引用，不能删除")
+	}
+	deployments, err := model.ListPagesDeployments(project.ID)
+	if err != nil {
+		return err
+	}
+	return model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("deployment_id IN (?)", tx.Model(&model.PagesDeployment{}).Select("id").Where("project_id = ?", project.ID)).Delete(&model.PagesDeploymentFile{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("project_id = ?", project.ID).Delete(&model.PagesDeployment{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Delete(project).Error; err != nil {
+			return err
+		}
+		for _, deployment := range deployments {
+			_ = os.Remove(deployment.ArtifactPath)
+		}
+		return nil
+	})
+}
+
+func ListPagesProjectDeployments(projectID uint) ([]*PagesDeploymentView, error) {
+	if _, err := model.GetPagesProjectByID(projectID); err != nil {
+		return nil, err
+	}
+	deployments, err := model.ListPagesDeployments(projectID)
+	if err != nil {
+		return nil, err
+	}
+	views := make([]*PagesDeploymentView, 0, len(deployments))
+	for _, deployment := range deployments {
+		views = append(views, buildPagesDeploymentView(deployment))
+	}
+	return views, nil
+}
+
+func ListPagesDeploymentFiles(deploymentID uint) ([]*PagesDeploymentFileView, error) {
+	if _, err := model.GetPagesDeploymentByID(deploymentID); err != nil {
+		return nil, err
+	}
+	files, err := model.ListPagesDeploymentFiles(deploymentID)
+	if err != nil {
+		return nil, err
+	}
+	views := make([]*PagesDeploymentFileView, 0, len(files))
+	for _, file := range files {
+		views = append(views, &PagesDeploymentFileView{
+			ID:           file.ID,
+			DeploymentID: file.DeploymentID,
+			Path:         file.Path,
+			Size:         file.Size,
+			Checksum:     file.Checksum,
+			CreatedAt:    file.CreatedAt,
+		})
+	}
+	return views, nil
+}
+
+func UploadPagesDeployment(projectID uint, fileHeader *multipart.FileHeader, entryFile string, createdBy string) (*PagesDeploymentView, error) {
+	project, err := model.GetPagesProjectByID(projectID)
+	if err != nil {
+		return nil, err
+	}
+	if fileHeader == nil {
+		return nil, errors.New("缺少 Pages 部署包")
+	}
+	if !strings.EqualFold(filepath.Ext(fileHeader.Filename), ".zip") {
+		return nil, errors.New("Pages 部署包必须是 .zip 文件")
+	}
+	entryFile = normalizePagesEntryFile(entryFile)
+	tempPath, checksum, err := persistPagesUploadTemp(fileHeader)
+	if err != nil {
+		return nil, err
+	}
+	defer os.Remove(tempPath)
+	manifest, err := inspectPagesZip(tempPath, entryFile)
+	if err != nil {
+		return nil, err
+	}
+	artifactPath, err := pagesArtifactPath(project.Slug, checksum)
+	if err != nil {
+		return nil, err
+	}
+	if err = os.MkdirAll(filepath.Dir(artifactPath), 0o755); err != nil {
+		return nil, fmt.Errorf("创建 Pages 存储目录失败: %w", err)
+	}
+	if err = copyFile(tempPath, artifactPath); err != nil {
+		return nil, err
+	}
+	deployment := &model.PagesDeployment{}
+	err = model.DB.Transaction(func(tx *gorm.DB) error {
+		var maxNumber int
+		if err := tx.Model(&model.PagesDeployment{}).
+			Where("project_id = ?", project.ID).
+			Select("COALESCE(MAX(deployment_number), 0)").
+			Scan(&maxNumber).Error; err != nil {
+			return err
+		}
+		deployment = &model.PagesDeployment{
+			ProjectID:        project.ID,
+			DeploymentNumber: maxNumber + 1,
+			Checksum:         checksum,
+			Status:           model.PagesDeploymentStatusUploaded,
+			ArtifactPath:     artifactPath,
+			FileCount:        manifest.FileCount,
+			TotalSize:        manifest.TotalSize,
+			EntryFile:        manifest.EntryFile,
+			CreatedBy:        strings.TrimSpace(createdBy),
+		}
+		if err := tx.Create(deployment).Error; err != nil {
+			return err
+		}
+		for index := range manifest.Files {
+			manifest.Files[index].DeploymentID = deployment.ID
+		}
+		if len(manifest.Files) > 0 {
+			if err := tx.Create(&manifest.Files).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		_ = os.Remove(artifactPath)
+		return nil, err
+	}
+	return buildPagesDeploymentView(deployment), nil
+}
+
+func ActivatePagesDeployment(projectID uint, deploymentID uint) (*PagesProjectView, error) {
+	project, err := model.GetPagesProjectByID(projectID)
+	if err != nil {
+		return nil, err
+	}
+	deployment, err := model.GetPagesDeploymentByID(deploymentID)
+	if err != nil {
+		return nil, err
+	}
+	if deployment.ProjectID != project.ID {
+		return nil, errors.New("Pages 部署不属于该项目")
+	}
+	now := time.Now()
+	if err = model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&model.PagesDeployment{}).
+			Where("project_id = ?", project.ID).
+			Update("status", model.PagesDeploymentStatusUploaded).Error; err != nil {
+			return err
+		}
+		if err := tx.Model(deployment).Updates(map[string]any{
+			"status":       model.PagesDeploymentStatusActive,
+			"activated_at": &now,
+		}).Error; err != nil {
+			return err
+		}
+		return tx.Model(project).Updates(map[string]any{
+			"active_deployment_id": deployment.ID,
+		}).Error
+	}); err != nil {
+		return nil, err
+	}
+	return GetPagesProject(project.ID)
+}
+
+func DeletePagesDeployment(projectID uint, deploymentID uint) error {
+	project, err := model.GetPagesProjectByID(projectID)
+	if err != nil {
+		return err
+	}
+	deployment, err := model.GetPagesDeploymentByID(deploymentID)
+	if err != nil {
+		return err
+	}
+	if deployment.ProjectID != project.ID {
+		return errors.New("Pages 部署不属于该项目")
+	}
+	if project.ActiveDeploymentID != nil && *project.ActiveDeploymentID == deployment.ID {
+		return errors.New("不能删除当前激活的 Pages 部署")
+	}
+	return model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("deployment_id = ?", deployment.ID).Delete(&model.PagesDeploymentFile{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Delete(deployment).Error; err != nil {
+			return err
+		}
+		_ = os.Remove(deployment.ArtifactPath)
+		return nil
+	})
+}
+
+func GetPagesDeploymentPackagePath(deploymentID uint) (string, string, error) {
+	deployment, err := model.GetPagesDeploymentByID(deploymentID)
+	if err != nil {
+		return "", "", err
+	}
+	if err = ensurePagesDeploymentInActiveSnapshot(deployment.ID); err != nil {
+		return "", "", err
+	}
+	if strings.TrimSpace(deployment.ArtifactPath) == "" {
+		return "", "", errors.New("Pages 部署包路径为空")
+	}
+	if _, err = os.Stat(deployment.ArtifactPath); err != nil {
+		return "", "", fmt.Errorf("Pages 部署包不存在: %w", err)
+	}
+	return deployment.ArtifactPath, fmt.Sprintf("pages-deployment-%d.zip", deployment.ID), nil
+}
+
+func ensurePagesDeploymentInActiveSnapshot(deploymentID uint) error {
+	version, err := model.GetActiveConfigVersion()
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return errors.New("Pages 部署尚未进入激活配置")
+		}
+		return err
+	}
+	snapshot, err := parseSnapshotDocument(version.SnapshotJSON)
+	if err != nil {
+		return err
+	}
+	for _, route := range snapshot.Routes {
+		if route.UpstreamType != "pages" || route.PagesDeployment == nil {
+			continue
+		}
+		if route.PagesDeployment.DeploymentID == deploymentID {
+			return nil
+		}
+	}
+	return errors.New("Pages 部署尚未进入激活配置")
+}
+
+func buildPagesProject(project *model.PagesProject, input PagesProjectInput) (*model.PagesProject, error) {
+	name := strings.TrimSpace(input.Name)
+	if name == "" {
+		return nil, errors.New("Pages 项目名称不能为空")
+	}
+	slug := normalizePagesSlug(input.Slug)
+	if slug == "" {
+		slug = normalizePagesSlug(name)
+	}
+	if !pagesSlugPattern.MatchString(slug) {
+		return nil, errors.New("Pages 项目标识只能包含小写字母、数字和连字符")
+	}
+	if project == nil {
+		project = &model.PagesProject{}
+	}
+	project.Name = name
+	project.Slug = slug
+	project.Description = strings.TrimSpace(input.Description)
+	project.Enabled = input.Enabled
+	project.SPAFallbackEnabled = input.SPAFallbackEnabled
+	return project, nil
+}
+
+func buildPagesProjectView(project *model.PagesProject) (*PagesProjectView, error) {
+	if project == nil {
+		return nil, errors.New("Pages 项目为空")
+	}
+	view := &PagesProjectView{
+		ID:                 project.ID,
+		Name:               project.Name,
+		Slug:               project.Slug,
+		Description:        project.Description,
+		Enabled:            project.Enabled,
+		SPAFallbackEnabled: project.SPAFallbackEnabled,
+		ActiveDeploymentID: project.ActiveDeploymentID,
+		CreatedAt:          project.CreatedAt,
+		UpdatedAt:          project.UpdatedAt,
+	}
+	if err := model.DB.Model(&model.PagesDeployment{}).Where("project_id = ?", project.ID).Count(&view.DeploymentCount).Error; err != nil {
+		return nil, err
+	}
+	if project.ActiveDeploymentID != nil && *project.ActiveDeploymentID != 0 {
+		deployment, err := model.GetPagesDeploymentByID(*project.ActiveDeploymentID)
+		if err == nil {
+			view.ActiveDeployment = buildPagesDeploymentView(deployment)
+		}
+	}
+	return view, nil
+}
+
+func buildPagesDeploymentView(deployment *model.PagesDeployment) *PagesDeploymentView {
+	if deployment == nil {
+		return nil
+	}
+	return &PagesDeploymentView{
+		ID:               deployment.ID,
+		ProjectID:        deployment.ProjectID,
+		DeploymentNumber: deployment.DeploymentNumber,
+		Checksum:         deployment.Checksum,
+		Status:           deployment.Status,
+		FileCount:        deployment.FileCount,
+		TotalSize:        deployment.TotalSize,
+		EntryFile:        deployment.EntryFile,
+		CreatedBy:        deployment.CreatedBy,
+		CreatedAt:        deployment.CreatedAt,
+		ActivatedAt:      deployment.ActivatedAt,
+	}
+}
+
+func normalizePagesSlug(raw string) string {
+	value := strings.ToLower(strings.TrimSpace(raw))
+	var builder strings.Builder
+	lastDash := false
+	for _, r := range value {
+		valid := (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9')
+		if valid {
+			builder.WriteRune(r)
+			lastDash = false
+			continue
+		}
+		if !lastDash {
+			builder.WriteByte('-')
+			lastDash = true
+		}
+	}
+	return strings.Trim(builder.String(), "-")
+}
+
+func normalizePagesEntryFile(raw string) string {
+	value := path.Clean(strings.TrimSpace(filepath.ToSlash(raw)))
+	if value == "." || value == "/" {
+		return defaultPagesEntryFile
+	}
+	return strings.TrimPrefix(value, "/")
+}
+
+func persistPagesUploadTemp(fileHeader *multipart.FileHeader) (string, string, error) {
+	file, err := fileHeader.Open()
+	if err != nil {
+		return "", "", err
+	}
+	defer file.Close()
+	temp, err := os.CreateTemp("", "openflare-pages-*.zip")
+	if err != nil {
+		return "", "", err
+	}
+	defer temp.Close()
+	hash := sha256.New()
+	limited := io.LimitReader(file, pagesMaxDeploymentBytes+1)
+	written, err := io.Copy(io.MultiWriter(temp, hash), limited)
+	if err != nil {
+		_ = os.Remove(temp.Name())
+		return "", "", err
+	}
+	if written > pagesMaxDeploymentBytes {
+		_ = os.Remove(temp.Name())
+		return "", "", fmt.Errorf("Pages 部署包不能超过 %d MiB", pagesMaxDeploymentBytes/1024/1024)
+	}
+	return temp.Name(), hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func inspectPagesZip(zipPath string, entryFile string) (*pagesDeploymentManifest, error) {
+	reader, err := zip.OpenReader(zipPath)
+	if err != nil {
+		return nil, errors.New("Pages 部署包不是有效 zip 文件")
+	}
+	defer reader.Close()
+	manifest := &pagesDeploymentManifest{
+		Files:     []model.PagesDeploymentFile{},
+		EntryFile: entryFile,
+	}
+	entrySeen := false
+	for _, item := range reader.File {
+		normalizedPath, skip, err := normalizePagesZipPath(item.Name)
+		if err != nil {
+			return nil, err
+		}
+		if skip {
+			continue
+		}
+		if item.FileInfo().Mode()&os.ModeSymlink != 0 {
+			return nil, fmt.Errorf("Pages 部署包不支持符号链接: %s", normalizedPath)
+		}
+		if item.UncompressedSize64 > pagesMaxDeploymentBytes {
+			return nil, fmt.Errorf("Pages 文件过大: %s", normalizedPath)
+		}
+		manifest.FileCount++
+		if manifest.FileCount > pagesMaxDeploymentFiles {
+			return nil, fmt.Errorf("Pages 部署文件数不能超过 %d", pagesMaxDeploymentFiles)
+		}
+		manifest.TotalSize += int64(item.UncompressedSize64)
+		if manifest.TotalSize > pagesMaxDeploymentBytes {
+			return nil, fmt.Errorf("Pages 部署展开后不能超过 %d MiB", pagesMaxDeploymentBytes/1024/1024)
+		}
+		checksum, err := checksumZipFile(item)
+		if err != nil {
+			return nil, err
+		}
+		if normalizedPath == entryFile {
+			entrySeen = true
+		}
+		manifest.Files = append(manifest.Files, model.PagesDeploymentFile{
+			Path:     normalizedPath,
+			Size:     int64(item.UncompressedSize64),
+			Checksum: checksum,
+		})
+	}
+	if manifest.FileCount == 0 {
+		return nil, errors.New("Pages 部署包不能为空")
+	}
+	if !entrySeen {
+		return nil, fmt.Errorf("Pages 部署包缺少入口文件 %s", entryFile)
+	}
+	return manifest, nil
+}
+
+func normalizePagesZipPath(raw string) (string, bool, error) {
+	name := strings.TrimSpace(filepath.ToSlash(raw))
+	if name == "" {
+		return "", true, nil
+	}
+	if strings.HasSuffix(name, "/") {
+		return "", true, nil
+	}
+	if strings.HasPrefix(name, "/") || path.IsAbs(name) {
+		return "", false, fmt.Errorf("Pages 部署包不能包含绝对路径: %s", raw)
+	}
+	cleaned := path.Clean(name)
+	if cleaned == "." {
+		return "", true, nil
+	}
+	if cleaned == ".." || strings.HasPrefix(cleaned, "../") || strings.Contains(cleaned, "/../") {
+		return "", false, fmt.Errorf("Pages 部署包路径不能逃逸目录: %s", raw)
+	}
+	return cleaned, false, nil
+}
+
+func checksumZipFile(item *zip.File) (string, error) {
+	file, err := item.Open()
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+	hash := sha256.New()
+	if _, err = io.Copy(hash, file); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func pagesArtifactPath(projectSlug string, checksum string) (string, error) {
+	root, err := pagesStorageRoot()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(root, "artifacts", projectSlug, checksum+".zip"), nil
+}
+
+func pagesStorageRoot() (string, error) {
+	if common.SQLDSN != "" {
+		return filepath.Abs(filepath.Join("data", "pages"))
+	}
+	dbPath := strings.TrimSpace(common.SQLitePath)
+	if dbPath == "" {
+		return filepath.Abs(filepath.Join("data", "pages"))
+	}
+	dir := filepath.Dir(dbPath)
+	if dir == "." || dir == "" {
+		dir = "data"
+	}
+	return filepath.Abs(filepath.Join(dir, "pages"))
+}
+
+func copyFile(src string, dst string) error {
+	input, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer input.Close()
+	output, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
+	if err != nil {
+		return err
+	}
+	defer output.Close()
+	if _, err = io.Copy(output, input); err != nil {
+		return err
+	}
+	return output.Sync()
+}
@@ -0,0 +1,226 @@
+package service
+
+import (
+	"archive/zip"
+	"bytes"
+	"mime/multipart"
+	"net/http/httptest"
+	"openflare/model"
+	"strings"
+	"testing"
+)
+
+func TestPagesUploadActivateAndPublishStaticRoute(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{
+		Name:               "Marketing Site",
+		Slug:               "marketing-site",
+		Enabled:            true,
+		SPAFallbackEnabled: true,
+	})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	uploadHeader := multipartFileHeader(t, "site.zip", testPagesZip(t, map[string]string{
+		"index.html":       "<h1>Hello Pages</h1>",
+		"assets/app.js":    "console.log('pages')",
+		"assets/style.css": "body{color:#111}",
+	}))
+	deployment, err := UploadPagesDeployment(project.ID, uploadHeader, "index.html", "root")
+	if err != nil {
+		t.Fatalf("UploadPagesDeployment failed: %v", err)
+	}
+	if deployment.FileCount != 3 || deployment.TotalSize == 0 {
+		t.Fatalf("unexpected deployment manifest: %+v", deployment)
+	}
+	project, err = ActivatePagesDeployment(project.ID, deployment.ID)
+	if err != nil {
+		t.Fatalf("ActivatePagesDeployment failed: %v", err)
+	}
+	if project.ActiveDeploymentID == nil || *project.ActiveDeploymentID != deployment.ID {
+		t.Fatalf("expected active deployment %d, got %+v", deployment.ID, project.ActiveDeploymentID)
+	}
+
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:         "pages.example.com",
+		Enabled:        true,
+		UpstreamType:   "pages",
+		PagesProjectID: &project.ID,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if route.UpstreamType != "pages" || route.PagesProjectID == nil || *route.PagesProjectID != project.ID {
+		t.Fatalf("expected route to bind Pages project, got %+v", route)
+	}
+
+	result, err := PublishConfigVersion("root", false)
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"upstream_type":"pages"`) {
+		t.Fatalf("expected snapshot to include pages route, got %s", result.Version.SnapshotJSON)
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"deployment_id":`) {
+		t.Fatalf("expected snapshot to include pages deployment, got %s", result.Version.SnapshotJSON)
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "root \"__OPENFLARE_PAGES_DIR__/deployments/") {
+		t.Fatalf("expected rendered config to use pages dir placeholder, got:\n%s", result.Version.RenderedConfig)
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "try_files $uri $uri/ /index.html;") {
+		t.Fatalf("expected SPA fallback try_files, got:\n%s", result.Version.RenderedConfig)
+	}
+	if strings.Contains(result.Version.RenderedConfig, "proxy_pass") {
+		t.Fatalf("Pages route must not render proxy_pass, got:\n%s", result.Version.RenderedConfig)
+	}
+}
+
+func TestUploadPagesDeploymentRejectsZipSlip(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{
+		Name:    "Unsafe Site",
+		Slug:    "unsafe-site",
+		Enabled: true,
+	})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	_, err = UploadPagesDeployment(project.ID, multipartFileHeader(t, "bad.zip", testPagesZip(t, map[string]string{
+		"../escape.html": "bad",
+		"index.html":     "ok",
+	})), "index.html", "root")
+	if err == nil || !strings.Contains(err.Error(), "逃逸目录") {
+		t.Fatalf("expected zip-slip rejection, got %v", err)
+	}
+}
+
+func TestPagesRouteRequiresActiveDeployment(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{
+		Name:    "Draft Site",
+		Slug:    "draft-site",
+		Enabled: true,
+	})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	if _, err = CreateProxyRoute(ProxyRouteInput{
+		Domain:         "draft.example.com",
+		Enabled:        true,
+		UpstreamType:   "pages",
+		PagesProjectID: &project.ID,
+	}); err == nil || !strings.Contains(err.Error(), "没有激活部署") {
+		t.Fatalf("expected active deployment validation, got %v", err)
+	}
+}
+
+func TestPagesDeploymentPackageRequiresActiveConfigSnapshot(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{Name: "Published Site", Slug: "published-site", Enabled: true})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	deployment, err := UploadPagesDeployment(project.ID, multipartFileHeader(t, "site.zip", testPagesZip(t, map[string]string{
+		"index.html": "ok",
+	})), "index.html", "root")
+	if err != nil {
+		t.Fatalf("UploadPagesDeployment failed: %v", err)
+	}
+	if _, err = ActivatePagesDeployment(project.ID, deployment.ID); err != nil {
+		t.Fatalf("ActivatePagesDeployment failed: %v", err)
+	}
+	if _, _, err = GetPagesDeploymentPackagePath(deployment.ID); err == nil || !strings.Contains(err.Error(), "激活配置") {
+		t.Fatalf("expected package download to require active config, got %v", err)
+	}
+	if _, err = CreateProxyRoute(ProxyRouteInput{
+		Domain:         "published.example.com",
+		Enabled:        true,
+		UpstreamType:   "pages",
+		PagesProjectID: &project.ID,
+	}); err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if _, err = PublishConfigVersion("root", false); err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	filePath, fileName, err := GetPagesDeploymentPackagePath(deployment.ID)
+	if err != nil {
+		t.Fatalf("GetPagesDeploymentPackagePath failed after publish: %v", err)
+	}
+	if filePath == "" || fileName == "" {
+		t.Fatalf("expected package path and file name, got path=%q name=%q", filePath, fileName)
+	}
+}
+
+func testPagesZip(t *testing.T, files map[string]string) []byte {
+	t.Helper()
+	var buffer bytes.Buffer
+	writer := zip.NewWriter(&buffer)
+	for name, content := range files {
+		file, err := writer.Create(name)
+		if err != nil {
+			t.Fatalf("create zip entry failed: %v", err)
+		}
+		if _, err := file.Write([]byte(content)); err != nil {
+			t.Fatalf("write zip entry failed: %v", err)
+		}
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close zip failed: %v", err)
+	}
+	return buffer.Bytes()
+}
+
+func multipartFileHeader(t *testing.T, fileName string, content []byte) *multipart.FileHeader {
+	t.Helper()
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	part, err := writer.CreateFormFile("package", fileName)
+	if err != nil {
+		t.Fatalf("CreateFormFile failed: %v", err)
+	}
+	if _, err = part.Write(content); err != nil {
+		t.Fatalf("write multipart file failed: %v", err)
+	}
+	if err = writer.Close(); err != nil {
+		t.Fatalf("close multipart writer failed: %v", err)
+	}
+	req := httptest.NewRequest("POST", "/", &body)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	if err = req.ParseMultipartForm(int64(len(content)) + 1024); err != nil {
+		t.Fatalf("ParseMultipartForm failed: %v", err)
+	}
+	file, header, err := req.FormFile("package")
+	if err != nil {
+		t.Fatalf("FormFile failed: %v", err)
+	}
+	file.Close()
+	return header
+}
+
+func TestDeletePagesDeploymentRejectsActiveDeployment(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{Name: "Active", Slug: "active", Enabled: true})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	deployment, err := UploadPagesDeployment(project.ID, multipartFileHeader(t, "site.zip", testPagesZip(t, map[string]string{"index.html": "ok"})), "index.html", "root")
+	if err != nil {
+		t.Fatalf("UploadPagesDeployment failed: %v", err)
+	}
+	if _, err = ActivatePagesDeployment(project.ID, deployment.ID); err != nil {
+		t.Fatalf("ActivatePagesDeployment failed: %v", err)
+	}
+	if err = DeletePagesDeployment(project.ID, deployment.ID); err == nil {
+		t.Fatal("expected active deployment deletion to fail")
+	}
+	var stored model.PagesDeployment
+	if err = model.DB.First(&stored, deployment.ID).Error; err != nil {
+		t.Fatalf("expected active deployment to remain: %v", err)
+	}
+}
@@ -66,6 +66,7 @@ type ProxyRouteInput struct {
 	TunnelID             *uint                         `json:"tunnel_id"`
 	TunnelTargetAddr     string                        `json:"tunnel_target_addr"`
 	TunnelTargetProtocol string                        `json:"tunnel_target_protocol"`
+	PagesProjectID       *uint                         `json:"pages_project_id"`
 }

 type ProxyRouteView struct {
@@ -106,6 +107,7 @@ type ProxyRouteView struct {
 	TunnelID             *uint                         `json:"tunnel_id"`
 	TunnelTargetAddr     string                        `json:"tunnel_target_addr"`
 	TunnelTargetProtocol string                        `json:"tunnel_target_protocol"`
+	PagesProjectID       *uint                         `json:"pages_project_id"`
 	CreatedAt            time.Time                     `json:"created_at"`
 	UpdatedAt            time.Time                     `json:"updated_at"`
 }
@@ -183,6 +185,13 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 		// Tunnel type: origin URL is auto-filled during config rendering
 		originURL = "http://127.0.0.1"
 		upstreams = []string{originURL}
+	} else if upstreamType == "pages" {
+		if err := validatePagesRouteInput(input.PagesProjectID); err != nil {
+			return nil, err
+		}
+		// Keep persisted upstreams HTTP-compatible; Pages rendering uses pages_project_id.
+		originURL = "http://127.0.0.1"
+		upstreams = []string{originURL}
 	} else {
 		originURL, originID, err = resolveProxyRoutePrimaryOrigin(input)
 		if err != nil {
@@ -339,10 +348,17 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 		route.TunnelNodeID = tunnelNodeID
 		route.TunnelTargetAddr = strings.TrimSpace(input.TunnelTargetAddr)
 		route.TunnelTargetProtocol = normalizeTunnelTargetProtocol(input.TunnelTargetProtocol)
+		route.PagesProjectID = nil
+	} else if upstreamType == "pages" {
+		route.TunnelNodeID = nil
+		route.TunnelTargetAddr = ""
+		route.TunnelTargetProtocol = ""
+		route.PagesProjectID = input.PagesProjectID
 	} else {
 		route.TunnelNodeID = nil
 		route.TunnelTargetAddr = ""
 		route.TunnelTargetProtocol = ""
+		route.PagesProjectID = nil
 	}
 	return route, nil
 }
@@ -434,6 +450,7 @@ func buildProxyRouteView(route *model.ProxyRoute) (*ProxyRouteView, error) {
 		TunnelID:             route.TunnelNodeID,
 		TunnelTargetAddr:     route.TunnelTargetAddr,
 		TunnelTargetProtocol: route.TunnelTargetProtocol,
+		PagesProjectID:       route.PagesProjectID,
 		CreatedAt:            route.CreatedAt,
 		UpdatedAt:            route.UpdatedAt,
 	}, nil
@@ -474,6 +491,26 @@ func validateTunnelRouteInput(tunnelNodeID *uint, targetAddr string, targetProto
 	}
 }

+func validatePagesRouteInput(projectID *uint) error {
+	if projectID == nil || *projectID == 0 {
+		return errors.New("pages_project_id is required for Pages upstream")
+	}
+	project, err := model.GetPagesProjectByID(*projectID)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return errors.New("Pages 项目不存在")
+		}
+		return err
+	}
+	if !project.Enabled {
+		return errors.New("Pages 项目未启用")
+	}
+	if project.ActiveDeploymentID == nil || *project.ActiveDeploymentID == 0 {
+		return errors.New("Pages 项目没有激活部署")
+	}
+	return nil
+}
+
 func normalizeProxyRouteSiteNameInput(route *model.ProxyRoute, raw string, primaryDomain string) string {
 	siteName := strings.TrimSpace(raw)
 	if siteName != "" {
@@ -1291,6 +1328,8 @@ func normalizeUpstreamType(raw string) string {
 	switch strings.ToLower(strings.TrimSpace(raw)) {
 	case "tunnel":
 		return "tunnel"
+	case "pages":
+		return "pages"
 	default:
 		return "direct"
 	}
@@ -84,6 +84,66 @@ func RenderRouteConfig(doc Document, certificateFiles []SupportFile) (string, er
 		if displayName == "" {
 			displayName = domains[0]
 		}
+		cacheConfig := routeCacheConfig{Enabled: route.CacheEnabled, Policy: route.CachePolicy, Rules: route.CacheRules}
+		limitConfig := routeLimitConfig{LimitConnPerServer: route.LimitConnPerServer, LimitConnPerIP: route.LimitConnPerIP, LimitRate: route.LimitRate}
+		powEnabled, _ := getPoWConfigForRoute(route.ID, doc.WAF)
+		if route.PoWEnabled {
+			powEnabled = true
+		}
+		if normalizeRouteUpstreamType(route.UpstreamType) == "pages" {
+			if route.PagesDeployment == nil {
+				return "", fmt.Errorf("route %s pages deployment is missing", route.Domain)
+			}
+			if !route.EnableHTTPS {
+				builder.WriteString(renderHTTPPagesServer(serverNames, displayName, route.PagesDeployment, limitConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword))
+				continue
+			}
+			certIDs := normalizeCertIDs(route.CertID, route.CertIDs)
+			domainCertIDs := normalizeDomainCertIDs(domains, certIDs, route.DomainCertIDs)
+			if len(certIDs) == 0 {
+				return "", fmt.Errorf("路由 %s 未配置证书", route.Domain)
+			}
+			httpOnlyDomains := make([]string, 0, len(domains))
+			domainsByCertID := make(map[uint][]string, len(certIDs))
+			for index, domain := range domains {
+				if index >= len(domainCertIDs) || domainCertIDs[index] == 0 {
+					httpOnlyDomains = append(httpOnlyDomains, domain)
+					continue
+				}
+				domainsByCertID[domainCertIDs[index]] = append(domainsByCertID[domainCertIDs[index]], domain)
+			}
+			for _, certID := range certIDs {
+				assignedDomains := domainsByCertID[certID]
+				if len(assignedDomains) == 0 {
+					continue
+				}
+				certPEM, ok := certificates[certID]
+				if !ok {
+					return "", fmt.Errorf("route %s certificate %d does not exist", route.Domain, certID)
+				}
+				if err := validateCertificateCoverage(certPEM, assignedDomains); err != nil {
+					return "", fmt.Errorf("site %s certificate validation failed: %w", displayName, err)
+				}
+			}
+			if route.RedirectHTTP {
+				if len(httpOnlyDomains) > 0 {
+					builder.WriteString(renderHTTPPagesServer(renderServerNames(httpOnlyDomains), displayName, route.PagesDeployment, limitConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword))
+				}
+				for _, certID := range certIDs {
+					if assignedDomains := domainsByCertID[certID]; len(assignedDomains) > 0 {
+						builder.WriteString(renderHTTPRedirectServer(renderServerNames(assignedDomains)))
+					}
+				}
+			} else {
+				builder.WriteString(renderHTTPPagesServer(serverNames, displayName, route.PagesDeployment, limitConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword))
+			}
+			for _, certID := range certIDs {
+				if assignedDomains := domainsByCertID[certID]; len(assignedDomains) > 0 {
+					builder.WriteString(renderHTTPSPagesServer(renderServerNames(assignedDomains), displayName, certID, route.PagesDeployment, limitConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
+				}
+			}
+			continue
+		}
 		upstreams := route.Upstreams
 		if len(upstreams) == 0 && strings.TrimSpace(route.OriginURL) != "" {
 			upstreams = []string{route.OriginURL}
@@ -92,12 +152,6 @@ func RenderRouteConfig(doc Document, certificateFiles []SupportFile) (string, er
 		if upstreamConfig.UsesNamedUpstream {
 			builder.WriteString(renderNamedUpstreamBlock(upstreamConfig))
 		}
-		cacheConfig := routeCacheConfig{Enabled: route.CacheEnabled, Policy: route.CachePolicy, Rules: route.CacheRules}
-		limitConfig := routeLimitConfig{LimitConnPerServer: route.LimitConnPerServer, LimitConnPerIP: route.LimitConnPerIP, LimitRate: route.LimitRate}
-		powEnabled, _ := getPoWConfigForRoute(route.ID, doc.WAF)
-		if route.PoWEnabled {
-			powEnabled = true
-		}
 		if !route.EnableHTTPS {
 			builder.WriteString(renderHTTPProxyServer(serverNames, displayName, route.OriginURL, route.OriginHost, route.CustomHeaders, cacheConfig, limitConfig, upstreamConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
 			continue
@@ -372,6 +426,10 @@ func renderHTTPProxyServer(serverNames string, siteName string, originURL string
 	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig, cfg), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
 }

+func renderHTTPPagesServer(serverNames string, siteName string, deployment *PagesDeployment, limitConfig routeLimitConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s%s    root %s;\n    index %s;\n\n    location / {\n%s%s    }\n%s}\n\n", serverNames, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), quoteNginxStringLiteral(pagesDeploymentRoot(deployment)), quoteNginxStringLiteral(pagesEntryFile(deployment)), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderPagesLocationBlock(deployment, limitConfig), renderPowStaticLocationBlock(powEnabled))
+}
+
 func renderHTTPRedirectServer(serverNames string) string {
 	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    return 301 https://$host$request_uri;\n}\n\n", serverNames)
 }
@@ -388,6 +446,43 @@ func renderHTTPSServer(serverNames string, siteName string, originURL string, or
 	return fmt.Sprintf("server {\n    listen 443 ssl;\n%s    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", h3Listen, serverNames, certPath, keyPath, h3Header, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig, cfg), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
 }

+func renderHTTPSPagesServer(serverNames string, siteName string, certificateID uint, deployment *PagesDeployment, limitConfig routeLimitConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg ConfigSnapshot) string {
+	certPath := fmt.Sprintf("%s/%d.crt", CertDirPlaceholder, certificateID)
+	keyPath := fmt.Sprintf("%s/%d.key", CertDirPlaceholder, certificateID)
+	var h3Listen string
+	var h3Header string
+	if cfg.HTTP3Enabled {
+		h3Listen = "    listen 443 quic;\n"
+		h3Header = "    add_header Alt-Svc 'h3=\":443\"; ma=86400';\n"
+	}
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n%s    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s%s%s    root %s;\n    index %s;\n\n    location / {\n%s%s    }\n%s}\n\n", h3Listen, serverNames, certPath, keyPath, h3Header, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), quoteNginxStringLiteral(pagesDeploymentRoot(deployment)), quoteNginxStringLiteral(pagesEntryFile(deployment)), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderPagesLocationBlock(deployment, limitConfig), renderPowStaticLocationBlock(powEnabled))
+}
+
+func renderPagesLocationBlock(deployment *PagesDeployment, limitConfig routeLimitConfig) string {
+	var builder strings.Builder
+	builder.WriteString(renderRouteLimitBlock(limitConfig))
+	if deployment != nil && deployment.SPAFallbackEnabled {
+		builder.WriteString("        try_files $uri $uri/ /index.html;\n")
+	} else {
+		builder.WriteString("        try_files $uri $uri/ =404;\n")
+	}
+	return builder.String()
+}
+
+func pagesDeploymentRoot(deployment *PagesDeployment) string {
+	if deployment == nil || strings.TrimSpace(deployment.LocalRoot) == "" {
+		return PagesDirPlaceholder
+	}
+	return filepathToNginxPath(deployment.LocalRoot)
+}
+
+func pagesEntryFile(deployment *PagesDeployment) string {
+	if deployment == nil || strings.TrimSpace(deployment.EntryFile) == "" {
+		return "index.html"
+	}
+	return strings.TrimPrefix(filepathToNginxPath(deployment.EntryFile), "/")
+}
+
 func renderProxyHeaderBlock(originURL string, originHost string, customHeaders []CustomHeader, upstreamConfig routeUpstreamConfig, cfg ConfigSnapshot) string {
 	var builder strings.Builder
 	if strings.TrimSpace(originHost) != "" {
@@ -543,6 +638,15 @@ func buildRouteUpstreamConfig(route Route, upstreams []string) routeUpstreamConf
 	return routeUpstreamConfig{Name: buildRouteUpstreamName(route), Scheme: scheme, Servers: servers, UsesNamedUpstream: true}
 }

+func normalizeRouteUpstreamType(raw string) string {
+	switch strings.ToLower(strings.TrimSpace(raw)) {
+	case "pages":
+		return "pages"
+	default:
+		return "direct"
+	}
+}
+
 func renderNamedUpstreamBlock(upstreamConfig routeUpstreamConfig) string {
 	var builder strings.Builder
 	builder.WriteString(fmt.Sprintf("upstream %s {\n", upstreamConfig.Name))
@@ -787,6 +891,10 @@ func quoteNginxStringLiteral(value string) string {
 	return fmt.Sprintf(`"%s"`, escaped)
 }

+func filepathToNginxPath(value string) string {
+	return strings.ReplaceAll(strings.TrimSpace(value), `\`, `/`)
+}
+
 func escapeNginxString(value string) string {
 	escaped := strings.ReplaceAll(value, `\`, `\\`)
 	escaped = strings.ReplaceAll(escaped, `"`, `\"`)
@@ -9,6 +9,7 @@ const (
 	ObservabilityListenPlaceholder = "__OPENFLARE_OBSERVABILITY_LISTEN__"
 	ObservabilityPortPlaceholder   = "__OPENFLARE_OBSERVABILITY_PORT__"
 	PowStaticDirPlaceholder        = "__OPENFLARE_POW_STATIC_DIR__"
+	PagesDirPlaceholder            = "__OPENFLARE_PAGES_DIR__"

 	SourceConfigFileName = "openresty_config.json"
 )
@@ -90,32 +91,45 @@ type PoWConfig struct {
 }

 type Route struct {
-	ID                 uint           `json:"id,omitempty"`
-	SiteName           string         `json:"site_name,omitempty"`
-	Domain             string         `json:"domain"`
-	Domains            []string       `json:"domains,omitempty"`
-	OriginURL          string         `json:"origin_url"`
-	OriginHost         string         `json:"origin_host,omitempty"`
-	Upstreams          []string       `json:"upstreams,omitempty"`
-	Enabled            bool           `json:"enabled"`
-	EnableHTTPS        bool           `json:"enable_https"`
-	CertID             *uint          `json:"cert_id,omitempty"`
-	CertIDs            []uint         `json:"cert_ids,omitempty"`
-	DomainCertIDs      []uint         `json:"domain_cert_ids,omitempty"`
-	RedirectHTTP       bool           `json:"redirect_http"`
-	LimitConnPerServer int            `json:"limit_conn_per_server,omitempty"`
-	LimitConnPerIP     int            `json:"limit_conn_per_ip,omitempty"`
-	LimitRate          string         `json:"limit_rate,omitempty"`
-	CacheEnabled       bool           `json:"cache_enabled"`
-	CachePolicy        string         `json:"cache_policy,omitempty"`
-	CacheRules         []string       `json:"cache_rules,omitempty"`
-	CustomHeaders      []CustomHeader `json:"custom_headers,omitempty"`
-	PoWEnabled         bool           `json:"pow_enabled,omitempty"`
-	PoWConfig          *PoWConfig     `json:"pow_config,omitempty"`
-	BasicAuthEnabled   bool           `json:"basic_auth_enabled,omitempty"`
-	BasicAuthUsername  string         `json:"basic_auth_username,omitempty"`
-	BasicAuthPassword  string         `json:"basic_auth_password,omitempty"`
-	Remark             string         `json:"remark,omitempty"`
+	ID                 uint             `json:"id,omitempty"`
+	SiteName           string           `json:"site_name,omitempty"`
+	Domain             string           `json:"domain"`
+	Domains            []string         `json:"domains,omitempty"`
+	OriginURL          string           `json:"origin_url"`
+	OriginHost         string           `json:"origin_host,omitempty"`
+	Upstreams          []string         `json:"upstreams,omitempty"`
+	Enabled            bool             `json:"enabled"`
+	EnableHTTPS        bool             `json:"enable_https"`
+	CertID             *uint            `json:"cert_id,omitempty"`
+	CertIDs            []uint           `json:"cert_ids,omitempty"`
+	DomainCertIDs      []uint           `json:"domain_cert_ids,omitempty"`
+	RedirectHTTP       bool             `json:"redirect_http"`
+	LimitConnPerServer int              `json:"limit_conn_per_server,omitempty"`
+	LimitConnPerIP     int              `json:"limit_conn_per_ip,omitempty"`
+	LimitRate          string           `json:"limit_rate,omitempty"`
+	CacheEnabled       bool             `json:"cache_enabled"`
+	CachePolicy        string           `json:"cache_policy,omitempty"`
+	CacheRules         []string         `json:"cache_rules,omitempty"`
+	CustomHeaders      []CustomHeader   `json:"custom_headers,omitempty"`
+	PoWEnabled         bool             `json:"pow_enabled,omitempty"`
+	PoWConfig          *PoWConfig       `json:"pow_config,omitempty"`
+	BasicAuthEnabled   bool             `json:"basic_auth_enabled,omitempty"`
+	BasicAuthUsername  string           `json:"basic_auth_username,omitempty"`
+	BasicAuthPassword  string           `json:"basic_auth_password,omitempty"`
+	Remark             string           `json:"remark,omitempty"`
+	UpstreamType       string           `json:"upstream_type,omitempty"`
+	PagesDeployment    *PagesDeployment `json:"pages_deployment,omitempty"`
+}
+
+type PagesDeployment struct {
+	ProjectID          uint   `json:"project_id"`
+	ProjectSlug        string `json:"project_slug"`
+	DeploymentID       uint   `json:"deployment_id"`
+	DeploymentNumber   int    `json:"deployment_number"`
+	Checksum           string `json:"checksum"`
+	EntryFile          string `json:"entry_file"`
+	SPAFallbackEnabled bool   `json:"spa_fallback_enabled"`
+	LocalRoot          string `json:"local_root"`
 }

 type WAFRuleGroup struct {
@@ -0,0 +1,5 @@
+import { PagesPage } from '@/features/pages/components/pages-page';
+
+export default function Page() {
+  return <PagesPage />;
+}
@@ -80,6 +80,15 @@ function SidebarIcon({ icon }: { icon: NavigationIconKey }) {
          <path d="m14 15 3 2-3 2" />
        </svg>
      );
+    case 'pages':
+      return (
+        <svg {...commonProps}>
+          <path d="M5 5.5h14v13H5z" />
+          <path d="M8 9h8" />
+          <path d="M8 12h5" />
+          <path d="M8 15h7" />
+        </svg>
+      );
    case 'waf':
      return <ShieldCheck className="h-[18px] w-[18px]" strokeWidth={1.8} />;
    case 'release':
@@ -0,0 +1,66 @@
+import { apiRequest } from '@/lib/api/client';
+
+import type {
+  PagesDeployment,
+  PagesProject,
+  PagesProjectPayload,
+} from '@/features/pages/types';
+
+export function getPagesProjects() {
+  return apiRequest<PagesProject[]>('/pages/');
+}
+
+export function createPagesProject(payload: PagesProjectPayload) {
+  return apiRequest<PagesProject>('/pages/', {
+    method: 'POST',
+    body: JSON.stringify(payload),
+  });
+}
+
+export function updatePagesProject(id: number, payload: PagesProjectPayload) {
+  return apiRequest<PagesProject>(`/pages/${id}/update`, {
+    method: 'POST',
+    body: JSON.stringify(payload),
+  });
+}
+
+export function deletePagesProject(id: number) {
+  return apiRequest<void>(`/pages/${id}/delete`, {
+    method: 'POST',
+  });
+}
+
+export function getPagesDeployments(projectId: number) {
+  return apiRequest<PagesDeployment[]>(`/pages/${projectId}/deployments`);
+}
+
+export function uploadPagesDeployment(
+  projectId: number,
+  file: File,
+  entryFile = 'index.html',
+) {
+  const formData = new FormData();
+  formData.append('package', file);
+  formData.append('entry_file', entryFile);
+  return apiRequest<PagesDeployment>(`/pages/${projectId}/deployments/upload`, {
+    method: 'POST',
+    body: formData,
+  });
+}
+
+export function activatePagesDeployment(
+  projectId: number,
+  deploymentId: number,
+) {
+  return apiRequest<PagesProject>(
+    `/pages/${projectId}/deployments/${deploymentId}/activate`,
+    { method: 'POST' },
+  );
+}
+
+export function deletePagesDeployment(projectId: number, deploymentId: number) {
+  return apiRequest<void>(
+    `/pages/${projectId}/deployments/${deploymentId}/delete`,
+    { method: 'POST' },
+  );
+}
@@ -0,0 +1,364 @@
+'use client';
+
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useState, type FormEvent } from 'react';
+
+import { AppCard } from '@/components/ui/app-card';
+import {
+  activatePagesDeployment,
+  createPagesProject,
+  deletePagesDeployment,
+  deletePagesProject,
+  getPagesDeployments,
+  getPagesProjects,
+  uploadPagesDeployment,
+} from '@/features/pages/api/pages';
+import type { PagesProject } from '@/features/pages/types';
+import {
+  DangerButton,
+  PrimaryButton,
+  ResourceField,
+  ResourceInput,
+  SecondaryButton,
+  ToggleField,
+} from '@/features/shared/components/resource-primitives';
+
+const projectsQueryKey = ['pages-projects'];
+
+function formatBytes(value: number) {
+  if (value < 1024) {
+    return `${value} B`;
+  }
+  if (value < 1024 * 1024) {
+    return `${(value / 1024).toFixed(1)} KiB`;
+  }
+  return `${(value / 1024 / 1024).toFixed(1)} MiB`;
+}
+
+function formatDate(value?: string | null) {
+  if (!value) {
+    return '未激活';
+  }
+  return new Date(value).toLocaleString();
+}
+
+export function PagesPage() {
+  const queryClient = useQueryClient();
+  const [name, setName] = useState('');
+  const [slug, setSlug] = useState('');
+  const [description, setDescription] = useState('');
+  const [spaFallbackEnabled, setSpaFallbackEnabled] = useState(false);
+
+  const projectsQuery = useQuery({
+    queryKey: projectsQueryKey,
+    queryFn: getPagesProjects,
+  });
+
+  const createMutation = useMutation({
+    mutationFn: () =>
+      createPagesProject({
+        name,
+        slug,
+        description,
+        enabled: true,
+        spa_fallback_enabled: spaFallbackEnabled,
+      }),
+    onSuccess: () => {
+      setName('');
+      setSlug('');
+      setDescription('');
+      setSpaFallbackEnabled(false);
+      queryClient.invalidateQueries({ queryKey: projectsQueryKey });
+    },
+  });
+
+  function handleCreate(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    createMutation.mutate();
+  }
+
+  return (
+    <div className="space-y-6">
+      <div className="space-y-2">
+        <p className="text-sm font-medium text-[var(--foreground-secondary)]">
+          OpenFlare Pages
+        </p>
+        <h1 className="text-2xl font-semibold text-[var(--foreground-primary)]">
+          边缘静态站点托管
+        </h1>
+        <p className="max-w-3xl text-sm leading-6 text-[var(--foreground-secondary)]">
+          创建 Pages 项目，上传已构建的 zip 静态资源包，然后在规则中选择 Pages
+          项目作为上游。发布后 Agent 会拉取部署包并在边缘节点本地服务静态文件。
+        </p>
+      </div>
+
+      <AppCard
+        title="新建 Pages 项目"
+        description="V1 仅支持 Direct Upload，不执行 Git 构建或边缘函数运行时。"
+      >
+        <form className="grid gap-4 md:grid-cols-2" onSubmit={handleCreate}>
+          <ResourceField label="项目名称">
+            <ResourceInput
+              value={name}
+              placeholder="Marketing Site"
+              onChange={(event) => setName(event.target.value)}
+              required
+            />
+          </ResourceField>
+          <ResourceField label="项目标识" hint="留空时会按名称自动生成。">
+            <ResourceInput
+              value={slug}
+              placeholder="marketing-site"
+              onChange={(event) => setSlug(event.target.value)}
+            />
+          </ResourceField>
+          <ResourceField label="描述" className="md:col-span-2">
+            <ResourceInput
+              value={description}
+              placeholder="这个项目托管的静态站点用途"
+              onChange={(event) => setDescription(event.target.value)}
+            />
+          </ResourceField>
+          <ToggleField
+            label="启用 SPA fallback"
+            description="开启后未命中的路径会回退到 /index.html，适合 React/Vue history 路由。"
+            checked={spaFallbackEnabled}
+            onChange={setSpaFallbackEnabled}
+          />
+          <div className="flex items-end justify-end">
+            <PrimaryButton
+              type="submit"
+              disabled={createMutation.isPending || name.trim() === ''}
+            >
+              {createMutation.isPending ? '创建中...' : '创建项目'}
+            </PrimaryButton>
+          </div>
+          {createMutation.error ? (
+            <p className="text-sm text-[var(--status-danger-foreground)] md:col-span-2">
+              {createMutation.error.message}
+            </p>
+          ) : null}
+        </form>
+      </AppCard>
+
+      <div className="space-y-4">
+        {projectsQuery.isLoading ? (
+          <AppCard>正在加载 Pages 项目...</AppCard>
+        ) : projectsQuery.error ? (
+          <AppCard>
+            <p className="text-sm text-[var(--status-danger-foreground)]">
+              {projectsQuery.error.message}
+            </p>
+          </AppCard>
+        ) : (projectsQuery.data ?? []).length === 0 ? (
+          <AppCard>
+            <p className="text-sm text-[var(--foreground-secondary)]">
+              还没有 Pages 项目。先创建一个项目，再上传静态资源包。
+            </p>
+          </AppCard>
+        ) : (
+          (projectsQuery.data ?? []).map((project) => (
+            <PagesProjectCard key={project.id} project={project} />
+          ))
+        )}
+      </div>
+    </div>
+  );
+}
+
+function PagesProjectCard({ project }: { project: PagesProject }) {
+  const queryClient = useQueryClient();
+  const [file, setFile] = useState<File | null>(null);
+  const [entryFile, setEntryFile] = useState('index.html');
+  const deploymentsQuery = useQuery({
+    queryKey: ['pages-deployments', project.id],
+    queryFn: () => getPagesDeployments(project.id),
+  });
+
+  const uploadMutation = useMutation({
+    mutationFn: () => {
+      if (!file) {
+        throw new Error('请选择 zip 文件');
+      }
+      return uploadPagesDeployment(project.id, file, entryFile);
+    },
+    onSuccess: () => {
+      setFile(null);
+      queryClient.invalidateQueries({
+        queryKey: ['pages-deployments', project.id],
+      });
+      queryClient.invalidateQueries({ queryKey: projectsQueryKey });
+    },
+  });
+  const activateMutation = useMutation({
+    mutationFn: (deploymentId: number) =>
+      activatePagesDeployment(project.id, deploymentId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: ['pages-deployments', project.id],
+      });
+      queryClient.invalidateQueries({ queryKey: projectsQueryKey });
+    },
+  });
+  const deleteDeploymentMutation = useMutation({
+    mutationFn: (deploymentId: number) =>
+      deletePagesDeployment(project.id, deploymentId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: ['pages-deployments', project.id],
+      });
+      queryClient.invalidateQueries({ queryKey: projectsQueryKey });
+    },
+  });
+  const deleteProjectMutation = useMutation({
+    mutationFn: () => deletePagesProject(project.id),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: projectsQueryKey });
+    },
+  });
+
+  return (
+    <AppCard
+      title={project.name}
+      description={`${project.slug} · ${
+        project.spa_fallback_enabled ? 'SPA fallback 已启用' : '严格 404'
+      }`}
+      action={
+        <DangerButton
+          type="button"
+          disabled={deleteProjectMutation.isPending}
+          onClick={() => {
+            if (window.confirm(`确认删除 Pages 项目 ${project.name} 吗？`)) {
+              deleteProjectMutation.mutate();
+            }
+          }}
+        >
+          删除项目
+        </DangerButton>
+      }
+    >
+      <div className="grid gap-6 lg:grid-cols-[minmax(0,0.8fr)_minmax(0,1.2fr)]">
+        <div className="space-y-4">
+          <div className="rounded-2xl border border-[var(--border-default)] bg-[var(--surface-muted)] p-4">
+            <p className="text-xs text-[var(--foreground-secondary)]">
+              当前激活部署
+            </p>
+            <p className="mt-2 text-sm font-medium text-[var(--foreground-primary)]">
+              {project.active_deployment
+                ? `#${project.active_deployment.deployment_number} · ${project.active_deployment.checksum.slice(0, 12)}`
+                : '暂无激活部署'}
+            </p>
+            <p className="mt-1 text-xs text-[var(--foreground-secondary)]">
+              激活时间：{formatDate(project.active_deployment?.activated_at)}
+            </p>
+          </div>
+
+          <div className="space-y-3">
+            <ResourceField
+              label="上传部署包"
+              hint="仅支持 zip，默认入口 index.html。"
+            >
+              <ResourceInput
+                type="file"
+                accept=".zip,application/zip"
+                onChange={(event) => setFile(event.target.files?.[0] ?? null)}
+              />
+            </ResourceField>
+            <ResourceField label="入口文件">
+              <ResourceInput
+                value={entryFile}
+                onChange={(event) => setEntryFile(event.target.value)}
+              />
+            </ResourceField>
+            <PrimaryButton
+              type="button"
+              disabled={!file || uploadMutation.isPending}
+              onClick={() => uploadMutation.mutate()}
+            >
+              {uploadMutation.isPending ? '上传中...' : '上传部署'}
+            </PrimaryButton>
+            {uploadMutation.error ? (
+              <p className="text-sm text-[var(--status-danger-foreground)]">
+                {uploadMutation.error.message}
+              </p>
+            ) : null}
+          </div>
+        </div>
+
+        <div className="space-y-3">
+          <h3 className="text-sm font-medium text-[var(--foreground-primary)]">
+            部署历史
+          </h3>
+          {deploymentsQuery.isLoading ? (
+            <p className="text-sm text-[var(--foreground-secondary)]">
+              加载中...
+            </p>
+          ) : (deploymentsQuery.data ?? []).length === 0 ? (
+            <p className="text-sm text-[var(--foreground-secondary)]">
+              暂无部署。上传 zip 后再激活部署。
+            </p>
+          ) : (
+            <div className="overflow-hidden rounded-2xl border border-[var(--border-default)]">
+              {(deploymentsQuery.data ?? []).map((deployment) => (
+                <div
+                  key={deployment.id}
+                  className="flex flex-col gap-3 border-b border-[var(--border-default)] p-4 last:border-b-0 md:flex-row md:items-center md:justify-between"
+                >
+                  <div>
+                    <p className="text-sm font-medium text-[var(--foreground-primary)]">
+                      #{deployment.deployment_number}{' '}
+                      {deployment.status === 'active' ? '· 已激活' : ''}
+                    </p>
+                    <p className="mt-1 text-xs text-[var(--foreground-secondary)]">
+                      {deployment.checksum.slice(0, 16)} ·{' '}
+                      {deployment.file_count} files ·{' '}
+                      {formatBytes(deployment.total_size)}
+                    </p>
+                  </div>
+                  <div className="flex gap-2">
+                    <SecondaryButton
+                      type="button"
+                      disabled={
+                        deployment.status === 'active' ||
+                        activateMutation.isPending
+                      }
+                      onClick={() => {
+                        if (
+                          window.confirm(
+                            `确认激活部署 #${deployment.deployment_number} 吗？`,
+                          )
+                        ) {
+                          activateMutation.mutate(deployment.id);
+                        }
+                      }}
+                    >
+                      激活
+                    </SecondaryButton>
+                    <DangerButton
+                      type="button"
+                      disabled={
+                        deployment.status === 'active' ||
+                        deleteDeploymentMutation.isPending
+                      }
+                      onClick={() => {
+                        if (
+                          window.confirm(
+                            `确认删除部署 #${deployment.deployment_number} 吗？`,
+                          )
+                        ) {
+                          deleteDeploymentMutation.mutate(deployment.id);
+                        }
+                      }}
+                    >
+                      删除
+                    </DangerButton>
+                  </div>
+                </div>
+              ))}
+            </div>
+          )}
+        </div>
+      </div>
+    </AppCard>
+  );
+}
@@ -0,0 +1,35 @@
+export interface PagesDeployment {
+  id: number;
+  project_id: number;
+  deployment_number: number;
+  checksum: string;
+  status: 'uploaded' | 'active';
+  file_count: number;
+  total_size: number;
+  entry_file: string;
+  created_by: string;
+  created_at: string;
+  activated_at?: string | null;
+}
+
+export interface PagesProject {
+  id: number;
+  name: string;
+  slug: string;
+  description: string;
+  enabled: boolean;
+  spa_fallback_enabled: boolean;
+  active_deployment_id?: number | null;
+  active_deployment?: PagesDeployment | null;
+  deployment_count: number;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface PagesProjectPayload {
+  name: string;
+  slug: string;
+  description: string;
+  enabled: boolean;
+  spa_fallback_enabled: boolean;
+}
@@ -15,6 +15,7 @@ import { LoadingState } from '@/components/feedback/loading-state';
 import { PageHeader } from '@/components/layout/page-header';
 import { AppCard } from '@/components/ui/app-card';
 import { getManagedDomains } from '@/features/managed-domains/api/managed-domains';
+import { getPagesProjects } from '@/features/pages/api/pages';
 import {
  getProxyRoute,
  updateProxyRoute,
@@ -157,12 +158,13 @@ const rateLimitSchema = z

 const reverseProxySchema = z
  .object({
-    upstream_type: z.enum(['direct', 'tunnel']),
+    upstream_type: z.enum(['direct', 'tunnel', 'pages']),
    origin_urls_text: z.string().trim(),
    origin_host: z.string(),
    tunnel_id: z.string().optional(),
    tunnel_target_addr: z.string().trim().optional(),
    tunnel_target_protocol: z.enum(['http', 'https']).optional(),
+    pages_project_id: z.string().optional(),
    custom_headers_text: z.string(),
    remark: z.string().max(255, '备注不能超过 255 个字符'),
  })
@@ -184,7 +186,7 @@ const reverseProxySchema = z
          });
        }
      }
-    } else {
+    } else if (value.upstream_type === 'tunnel') {
      if (!value.tunnel_id) {
        context.addIssue({
          code: z.ZodIssueCode.custom,
@@ -199,6 +201,12 @@ const reverseProxySchema = z
          message: '请填写内网服务地址 (如 127.0.0.1:8080)',
        });
      }
+    } else if (!value.pages_project_id) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['pages_project_id'],
+        message: '请选择 Pages 项目',
+      });
    }

    const originHostError = validateOriginHost(value.origin_host);
@@ -552,8 +560,17 @@ function ReverseProxySection({
    queryKey: ['nodes'],
    queryFn: getNodes,
  });
-  
-  const tunnelClients = (tunnelsQuery.data ?? []).filter((node) => node.node_type === 'tunnel_client');
+  const pagesProjectsQuery = useQuery({
+    queryKey: ['pages-projects'],
+    queryFn: getPagesProjects,
+  });
+
+  const tunnelClients = (tunnelsQuery.data ?? []).filter(
+    (node) => node.node_type === 'tunnel_client',
+  );
+  const pagesProjects = (pagesProjectsQuery.data ?? []).filter(
+    (project) => project.enabled && project.active_deployment_id,
+  );

  const form = useForm<ReverseProxyValues>({
    resolver: zodResolver(reverseProxySchema),
@@ -564,6 +581,7 @@ function ReverseProxySection({
      tunnel_id: route.tunnel_node_id ? String(route.tunnel_node_id) : '',
      tunnel_target_addr: route.tunnel_target_addr || '',
      tunnel_target_protocol: (route.tunnel_target_protocol as 'http' | 'https') || 'http',
+      pages_project_id: route.pages_project_id ? String(route.pages_project_id) : '',
      custom_headers_text: customHeadersToText(route.custom_header_list),
      remark: route.remark || '',
    },
@@ -577,6 +595,7 @@ function ReverseProxySection({
      tunnel_id: route.tunnel_node_id ? String(route.tunnel_node_id) : '',
      tunnel_target_addr: route.tunnel_target_addr || '',
      tunnel_target_protocol: (route.tunnel_target_protocol as 'http' | 'https') || 'http',
+      pages_project_id: route.pages_project_id ? String(route.pages_project_id) : '',
      custom_headers_text: customHeadersToText(route.custom_header_list),
      remark: route.remark || '',
    });
@@ -609,12 +628,17 @@ function ReverseProxySection({
            originPort = primaryOrigin.port;
            originUri = primaryOrigin.uri;
            upstreams = urls.slice(1);
-          } else {
+          } else if (values.upstream_type === 'tunnel') {
            originUrl = `${values.tunnel_target_protocol}://${values.tunnel_target_addr}`;
            originScheme = values.tunnel_target_protocol as 'http' | 'https';
            originAddress = values.tunnel_target_addr || '';
+          } else {
+            originUrl = 'http://127.0.0.1';
+            originScheme = 'http';
+            originAddress = '127.0.0.1';
+            originPort = '80';
          }
-          
+
          const { headers } = parseCustomHeadersText(
            values.custom_headers_text,
          );
@@ -632,9 +656,22 @@ function ReverseProxySection({
              custom_headers: headers,
              remark: values.remark.trim(),
              upstream_type: values.upstream_type,
-              tunnel_node_id: values.upstream_type === 'tunnel' && values.tunnel_id ? Number(values.tunnel_id) : null,
-              tunnel_target_addr: values.upstream_type === 'tunnel' ? values.tunnel_target_addr : '',
-              tunnel_target_protocol: values.upstream_type === 'tunnel' ? values.tunnel_target_protocol : '',
+              tunnel_node_id:
+                values.upstream_type === 'tunnel' && values.tunnel_id
+                  ? Number(values.tunnel_id)
+                  : null,
+              tunnel_target_addr:
+                values.upstream_type === 'tunnel'
+                  ? values.tunnel_target_addr
+                  : '',
+              tunnel_target_protocol:
+                values.upstream_type === 'tunnel'
+                  ? values.tunnel_target_protocol
+                  : '',
+              pages_project_id:
+                values.upstream_type === 'pages' && values.pages_project_id
+                  ? Number(values.pages_project_id)
+                  : null,
            }),
            { message: '反向代理设置已保存。' },
          );
@@ -661,6 +698,15 @@ function ReverseProxySection({
              />
              内网穿透 (Tunnel)
            </label>
+            <label className="flex items-center gap-2 text-sm text-[var(--foreground-primary)] cursor-pointer">
+              <input
+                type="radio"
+                value="pages"
+                {...form.register('upstream_type')}
+                className="w-4 h-4 text-blue-600 border-gray-300 focus:ring-blue-500"
+              />
+              Pages 静态站点
+            </label>
          </div>
        </div>

@@ -679,7 +725,7 @@ function ReverseProxySection({
              {...form.register('origin_urls_text')}
            />
          </ResourceField>
-        ) : (
+        ) : form.watch('upstream_type') === 'tunnel' ? (
          <div className="p-4 rounded-xl border border-[var(--border-default)] bg-[var(--surface-muted)] space-y-4">
            <ResourceField
              label="选择内网穿透隧道"
@@ -724,6 +770,26 @@ function ReverseProxySection({
              />
            </ResourceField>
          </div>
+        ) : (
+          <div className="p-4 rounded-xl border border-[var(--border-default)] bg-[var(--surface-muted)] space-y-4">
+            <ResourceField
+              label="选择 Pages 项目"
+              hint="仅显示已启用且已有激活部署的 Pages 项目。"
+              error={form.formState.errors.pages_project_id?.message}
+            >
+              <select
+                {...form.register('pages_project_id')}
+                className="block w-full rounded-xl border border-[var(--border-default)] bg-[var(--control-background)] px-4 py-2.5 text-sm text-[var(--foreground-primary)] placeholder-[var(--foreground-muted)] outline-none transition focus:border-[var(--border-strong)] focus:ring-1 focus:ring-[var(--border-strong)]"
+              >
+                <option value="">请选择...</option>
+                {pagesProjects.map((project) => (
+                  <option key={project.id} value={project.id}>
+                    {project.name} ({project.slug})
+                  </option>
+                ))}
+              </select>
+            </ResourceField>
+          </div>
        )}

        <ResourceField
@@ -8,6 +8,7 @@ import { z } from 'zod';

 import { Drawer } from '@/components/ui/drawer';
 import { getManagedDomains } from '@/features/managed-domains/api/managed-domains';
+import { getPagesProjects } from '@/features/pages/api/pages';
 import { createProxyRoute } from '@/features/proxy-routes/api/proxy-routes';
 import {
  DomainListInput,
@@ -40,11 +41,12 @@ const createWebsiteSchema = z
  .object({
    site_name: z.string().trim().max(255, '站点标识不能超过 255 个字符'),
    domain_rows: z.array(domainRowSchema).min(1),
-    upstream_type: z.enum(['direct', 'tunnel']),
+    upstream_type: z.enum(['direct', 'tunnel', 'pages']),
    origin_urls_text: z.string().trim(),
    tunnel_id: z.string().optional(),
    tunnel_target_addr: z.string().trim().optional(),
    tunnel_target_protocol: z.enum(['http', 'https']).optional(),
+    pages_project_id: z.string().optional(),
    enabled: z.boolean(),
    redirect_http: z.boolean(),
    remark: z.string().max(255, '备注不能超过 255 个字符'),
@@ -79,7 +81,7 @@ const createWebsiteSchema = z
          });
        }
      }
-    } else {
+    } else if (value.upstream_type === 'tunnel') {
      if (!value.tunnel_id) {
        context.addIssue({
          code: z.ZodIssueCode.custom,
@@ -94,6 +96,12 @@ const createWebsiteSchema = z
          message: '请填写内网服务地址 (如 127.0.0.1:8080)',
        });
      }
+    } else if (!value.pages_project_id) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['pages_project_id'],
+        message: '请选择 Pages 项目',
+      });
    }

    const selectedCertificateCount = new Set(
@@ -120,6 +128,7 @@ const defaultValues: CreateWebsiteFormValues = {
  tunnel_id: '',
  tunnel_target_addr: '',
  tunnel_target_protocol: 'http',
+  pages_project_id: '',
  enabled: true,
  redirect_http: false,
  remark: '',
@@ -177,7 +186,17 @@ export function ProxyRouteCreateDrawer({
    queryFn: getNodes,
    enabled: open,
  });
-  const tunnelClients = (tunnelsQuery.data ?? []).filter((node) => node.node_type === 'tunnel_client');
+  const pagesProjectsQuery = useQuery({
+    queryKey: ['pages-projects'],
+    queryFn: getPagesProjects,
+    enabled: open,
+  });
+  const tunnelClients = (tunnelsQuery.data ?? []).filter(
+    (node) => node.node_type === 'tunnel_client',
+  );
+  const pagesProjects = (pagesProjectsQuery.data ?? []).filter(
+    (project) => project.enabled && project.active_deployment_id,
+  );

  const combinedDomainSuggestions = useMemo(
    () => [
@@ -199,11 +218,11 @@ export function ProxyRouteCreateDrawer({
      const selectedCertIDs = normalizeSelectedCertificateIDs(
        values.domain_rows,
      );
-      
+
      let originUrl = '';
      const originHost = '';
      let upstreams: string[] = [];
-      
+
      if (values.upstream_type === 'direct') {
        const { urls } = parseOriginUrls(values.origin_urls_text);
        const primaryOrigin = parseOriginUrl(urls[0]);
@@ -214,8 +233,10 @@ export function ProxyRouteCreateDrawer({
          primaryOrigin.uri,
        );
        upstreams = urls.slice(1);
-      } else {
+      } else if (values.upstream_type === 'tunnel') {
        originUrl = `${values.tunnel_target_protocol}://${values.tunnel_target_addr}`;
+      } else {
+        originUrl = 'http://127.0.0.1';
      }

      return createProxyRoute({
@@ -224,10 +245,22 @@ export function ProxyRouteCreateDrawer({
        domains,
        origin_id: null,
        origin_url: originUrl,
-        origin_scheme: values.upstream_type === 'direct' ? parseOriginUrl(originUrl).scheme : 'http',
-        origin_address: values.upstream_type === 'direct' ? parseOriginUrl(originUrl).address : values.tunnel_target_addr || '',
-        origin_port: values.upstream_type === 'direct' ? parseOriginUrl(originUrl).port : '80',
-        origin_uri: values.upstream_type === 'direct' ? parseOriginUrl(originUrl).uri : '',
+        origin_scheme:
+          values.upstream_type === 'direct'
+            ? parseOriginUrl(originUrl).scheme
+            : 'http',
+        origin_address:
+          values.upstream_type === 'direct'
+            ? parseOriginUrl(originUrl).address
+            : values.tunnel_target_addr || '127.0.0.1',
+        origin_port:
+          values.upstream_type === 'direct'
+            ? parseOriginUrl(originUrl).port
+            : '80',
+        origin_uri:
+          values.upstream_type === 'direct'
+            ? parseOriginUrl(originUrl).uri
+            : '',
        origin_host: originHost,
        upstreams,
        enabled: values.enabled,
@@ -249,9 +282,20 @@ export function ProxyRouteCreateDrawer({
        basic_auth_enabled: false,
        remark: values.remark.trim(),
        upstream_type: values.upstream_type,
-        tunnel_node_id: values.upstream_type === 'tunnel' && values.tunnel_id ? Number(values.tunnel_id) : null,
-        tunnel_target_addr: values.upstream_type === 'tunnel' ? values.tunnel_target_addr : '',
-        tunnel_target_protocol: values.upstream_type === 'tunnel' ? values.tunnel_target_protocol : '',
+        tunnel_node_id:
+          values.upstream_type === 'tunnel' && values.tunnel_id
+            ? Number(values.tunnel_id)
+            : null,
+        tunnel_target_addr:
+          values.upstream_type === 'tunnel' ? values.tunnel_target_addr : '',
+        tunnel_target_protocol:
+          values.upstream_type === 'tunnel'
+            ? values.tunnel_target_protocol
+            : '',
+        pages_project_id:
+          values.upstream_type === 'pages' && values.pages_project_id
+            ? Number(values.pages_project_id)
+            : null,
      });
    },
    onSuccess: (route) => {
@@ -359,6 +403,15 @@ export function ProxyRouteCreateDrawer({
              />
              内网穿透 (Tunnel)
            </label>
+            <label className="flex items-center gap-2 text-sm text-[var(--foreground-primary)] cursor-pointer">
+              <input
+                type="radio"
+                value="pages"
+                {...form.register('upstream_type')}
+                className="w-4 h-4 text-blue-600 border-gray-300 focus:ring-blue-500"
+              />
+              Pages 静态站点
+            </label>
          </div>
        </div>

@@ -376,7 +429,7 @@ export function ProxyRouteCreateDrawer({
              {...form.register('origin_urls_text')}
            />
          </ResourceField>
-        ) : (
+        ) : form.watch('upstream_type') === 'tunnel' ? (
          <div className="p-4 rounded-xl border border-[var(--border-default)] bg-[var(--surface-muted)] space-y-4">
            <ResourceField
              label="选择内网穿透隧道"
@@ -421,6 +474,26 @@ export function ProxyRouteCreateDrawer({
              />
            </ResourceField>
          </div>
+        ) : (
+          <div className="p-4 rounded-xl border border-[var(--border-default)] bg-[var(--surface-muted)] space-y-4">
+            <ResourceField
+              label="选择 Pages 项目"
+              hint="仅显示已启用且已有激活部署的 Pages 项目。"
+              error={form.formState.errors.pages_project_id?.message}
+            >
+              <select
+                {...form.register('pages_project_id')}
+                className="block w-full rounded-xl border border-[var(--border-default)] bg-[var(--control-background)] px-4 py-2.5 text-sm text-[var(--foreground-primary)] placeholder-[var(--foreground-muted)] outline-none transition focus:border-[var(--border-strong)] focus:ring-1 focus:ring-[var(--border-strong)]"
+              >
+                <option value="">请选择...</option>
+                {pagesProjects.map((project) => (
+                  <option key={project.id} value={project.id}>
+                    {project.name} ({project.slug})
+                  </option>
+                ))}
+              </select>
+            </ResourceField>
+          </div>
        )}

        <ToggleField
@@ -267,7 +267,10 @@ export function buildPayloadFromRoute(
  route: ProxyRouteItem,
  overrides: Partial<ProxyRouteMutationPayload>,
 ): ProxyRouteMutationPayload {
-  const primaryOrigin = parseOriginUrl(route.origin_url);
+  const primaryOrigin =
+    route.upstream_type === 'pages'
+      ? parseOriginUrl('http://127.0.0.1')
+      : parseOriginUrl(route.origin_url);

  return {
    site_name: route.site_name,
@@ -304,11 +307,17 @@ export function buildPayloadFromRoute(
    tunnel_node_id: route.tunnel_node_id ?? route.tunnel_id ?? null,
    tunnel_target_addr: route.tunnel_target_addr || '',
    tunnel_target_protocol: route.tunnel_target_protocol || '',
+    pages_project_id: route.pages_project_id ?? null,
    ...overrides,
  };
 }

 export function getUpstreamSummary(route: ProxyRouteItem) {
+  if (route.upstream_type === 'pages') {
+    return route.pages_project_id
+      ? `Pages 项目 #${route.pages_project_id}`
+      : 'Pages 项目未绑定';
+  }
  if (route.upstream_type === 'tunnel') {
    const protocol = route.tunnel_target_protocol || 'http';
    const target = route.tunnel_target_addr || '未配置目标';
@@ -53,11 +53,12 @@ export interface ProxyRouteItem {
  basic_auth_username: string;
  basic_auth_password: string;
  remark: string;
-  upstream_type: 'direct' | 'tunnel';
+  upstream_type: 'direct' | 'tunnel' | 'pages';
  tunnel_node_id?: number | null;
  tunnel_id?: number | null;
  tunnel_target_addr?: string;
  tunnel_target_protocol?: string;
+  pages_project_id?: number | null;
  created_at: string;
  updated_at: string;
 }
@@ -93,11 +94,12 @@ export interface ProxyRouteMutationPayload {
  basic_auth_username?: string;
  basic_auth_password?: string;
  remark: string;
-  upstream_type?: 'direct' | 'tunnel';
+  upstream_type?: 'direct' | 'tunnel' | 'pages';
  tunnel_node_id?: number | null;
  tunnel_id?: number | null;
  tunnel_target_addr?: string;
  tunnel_target_protocol?: string;
+  pages_project_id?: number | null;
 }

 export interface TlsCertificateItem {
@@ -16,6 +16,11 @@ export const dashboardNavigation: NavigationItem[] = [
    label: '规则',
    icon: 'proxy',
  },
+  {
+    href: '/pages',
+    label: 'Pages',
+    icon: 'pages',
+  },
  {
    href: '/website',
    label: '网站',
@@ -18,6 +18,7 @@ function buildNode(overrides: Partial<NodeItem> = {}): NodeItem {
    relay_client_proxy_url: '',
    relay_auth_token: '',
    relay_status: 'healthy',
+    relay_web_server_enabled: false,
    relay_frps_connections: 0,
    relay_frps_proxy_count: 0,
    geo_name: '',
@@ -5,6 +5,7 @@ export type NavigationIconKey =
  | 'origin'
  | 'domain'
  | 'certificate'
+  | 'pages'
  | 'proxy'
  | 'waf'
  | 'release'