[优化] 改名

openflare_server/.gitignore

@@ -0,0 +1 @@
+data

openflare_server/Dockerfile

@@ -0,0 +1,38 @@
+ARG VERSION=dev
+
+FROM node:20 AS builder
+
+ARG VERSION
+
+WORKDIR /build
+COPY ./web/package.json ./
+COPY ./web/pnpm-lock.yaml ./
+RUN corepack enable && pnpm install --frozen-lockfile
+COPY ./web ./
+RUN NEXT_PUBLIC_APP_VERSION="$VERSION" pnpm build
+
+FROM golang:1.24 AS builder2
+
+ARG VERSION
+
+ENV GO111MODULE=on \
+    CGO_ENABLED=0 \
+    GOOS=linux
+
+WORKDIR /build
+COPY . .
+COPY --from=builder /build/build ./web/build
+RUN go mod download
+RUN go build -trimpath -ldflags "-s -w -X 'openflare/common.Version=$VERSION'" -o openflare
+
+FROM alpine
+
+RUN apk update \
+    && apk upgrade \
+    && apk add --no-cache ca-certificates tzdata \
+    && update-ca-certificates 2>/dev/null || true
+ENV PORT=3000
+COPY --from=builder2 /build/openflare /
+EXPOSE 3000
+WORKDIR /data
+ENTRYPOINT ["/openflare"]

openflare_server/common/constants.go

@@ -0,0 +1,169 @@
+package common
+
+import (
+	"sync"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+var StartTime = time.Now().Unix() // unit: second
+var Version = "dev"               // release builds inject the tag version via ldflags
+var SystemName = "OpenFlare"
+var ServerAddress = "http://localhost:3000"
+var Footer = ""
+var HomePageLink = ""
+
+// Any options with "Secret", "Token" in its key won't be return by GetOptions
+
+var SessionSecret = uuid.New().String()
+var SQLitePath = "openflare.db"
+
+var OptionMap map[string]string
+var OptionMapRWMutex sync.RWMutex
+
+var ItemsPerPage = 10
+
+var PasswordLoginEnabled = true
+var PasswordRegisterEnabled = true
+var EmailVerificationEnabled = false
+var GitHubOAuthEnabled = false
+var WeChatAuthEnabled = false
+var TurnstileCheckEnabled = false
+var RegisterEnabled = true
+
+var SMTPServer = ""
+var SMTPPort = 587
+var SMTPAccount = ""
+var SMTPToken = ""
+
+var GitHubClientId = ""
+var GitHubClientSecret = ""
+
+var WeChatServerAddress = ""
+var WeChatServerToken = ""
+var WeChatAccountQRCodeImageURL = ""
+
+var TurnstileSiteKey = ""
+var TurnstileSecretKey = ""
+var AgentToken = ""
+var AgentDiscoveryToken = ""
+var NodeOfflineThreshold = 2 * time.Minute
+
+// V3 operational settings (hot-reloadable via Option table)
+var AgentHeartbeatInterval = 10000 // milliseconds
+var AgentUpdateRepo = "Rain-kl/OpenFlare"
+var GeoIPProvider = "ipinfo"
+
+// V5 OpenResty performance settings (hot-reloadable via Option table)
+var OpenRestyWorkerProcesses = "auto"
+var OpenRestyWorkerConnections = 4096
+var OpenRestyWorkerRlimitNofile = 65535
+var OpenRestyEventsUse = ""
+var OpenRestyEventsMultiAcceptEnabled = false
+var OpenRestyKeepaliveTimeout = 65
+var OpenRestyKeepaliveRequests = 1000
+var OpenRestyClientHeaderTimeout = 15
+var OpenRestyClientBodyTimeout = 15
+var OpenRestyClientMaxBodySize = "64m"
+var OpenRestyLargeClientHeaderBuffers = "4 16k"
+var OpenRestySendTimeout = 30
+var OpenRestyProxyConnectTimeout = 5
+var OpenRestyProxySendTimeout = 60
+var OpenRestyProxyReadTimeout = 60
+var OpenRestyWebsocketEnabled = true
+var OpenRestyProxyRequestBufferingEnabled = false
+var OpenRestyProxyBufferingEnabled = true
+var OpenRestyProxyBuffers = "16 16k"
+var OpenRestyProxyBufferSize = "8k"
+var OpenRestyProxyBusyBuffersSize = "64k"
+var OpenRestyGzipEnabled = true
+var OpenRestyGzipMinLength = 1024
+var OpenRestyGzipCompLevel = 5
+var OpenRestyCacheEnabled = false
+var OpenRestyCachePath = ""
+var OpenRestyCacheLevels = "1:2"
+var OpenRestyCacheInactive = "30m"
+var OpenRestyCacheMaxSize = "1g"
+var OpenRestyCacheKeyTemplate = "$scheme$proxy_host$request_uri"
+var OpenRestyCacheLockEnabled = true
+var OpenRestyCacheLockTimeout = "5s"
+var OpenRestyCacheUseStale = "error timeout updating http_500 http_502 http_503 http_504"
+var OpenRestyMainConfigTemplate = `# This file is generated by OpenFlare. Do not edit manually.
+worker_processes {{OpenRestyWorkerProcesses}};
+worker_rlimit_nofile {{OpenRestyWorkerRlimitNofile}};
+pid logs/nginx.pid;
+
+events {
+    worker_connections {{OpenRestyWorkerConnections}};
+{{OpenRestyEventsUseDirective}}{{OpenRestyEventsMultiAcceptDirective}}}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+    log_format openflare_json escape=json '{"ts":"$time_iso8601","host":"$host","path":"$request_uri","remote_addr":"$remote_addr","status":$status,"request_time":$request_time,"bytes_sent":$body_bytes_sent,"request_length":$request_length}';
+    access_log {{OpenRestyAccessLogPath}} openflare_json;
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout {{OpenRestyKeepaliveTimeout}};
+    keepalive_requests {{OpenRestyKeepaliveRequests}};
+    client_header_timeout {{OpenRestyClientHeaderTimeout}};
+    client_body_timeout {{OpenRestyClientBodyTimeout}};
+    client_max_body_size {{OpenRestyClientMaxBodySize}};
+    large_client_header_buffers {{OpenRestyLargeClientHeaderBuffers}};
+    send_timeout {{OpenRestySendTimeout}};
+    proxy_connect_timeout {{OpenRestyProxyConnectTimeout}};
+    proxy_send_timeout {{OpenRestyProxySendTimeout}};
+    proxy_read_timeout {{OpenRestyProxyReadTimeout}};
+    proxy_request_buffering {{OpenRestyProxyRequestBuffering}};
+    proxy_buffering {{OpenRestyProxyBuffering}};
+    proxy_buffers {{OpenRestyProxyBuffers}};
+    proxy_buffer_size {{OpenRestyProxyBufferSize}};
+    proxy_busy_buffers_size {{OpenRestyProxyBusyBuffersSize}};
+    gzip {{OpenRestyGzip}};
+    gzip_min_length {{OpenRestyGzipMinLength}};
+    gzip_comp_level {{OpenRestyGzipCompLevel}};
+{{OpenRestyCacheBlock}}    include {{OpenRestyRouteConfigInclude}};
+}
+`
+
+const (
+	RoleGuestUser  = 0
+	RoleCommonUser = 1
+	RoleAdminUser  = 10
+	RoleRootUser   = 100
+)
+
+var (
+	FileUploadPermission    = RoleGuestUser
+	FileDownloadPermission  = RoleGuestUser
+	ImageUploadPermission   = RoleGuestUser
+	ImageDownloadPermission = RoleGuestUser
+)
+
+// All duration's unit is seconds
+// Shouldn't larger then RateLimitKeyExpirationDuration
+var (
+	GlobalApiRateLimitNum            = 300
+	GlobalApiRateLimitDuration int64 = 3 * 60
+
+	GlobalWebRateLimitNum            = 300
+	GlobalWebRateLimitDuration int64 = 3 * 60
+
+	UploadRateLimitNum            = 50
+	UploadRateLimitDuration int64 = 60
+
+	DownloadRateLimitNum            = 50
+	DownloadRateLimitDuration int64 = 60
+
+	CriticalRateLimitNum            = 100
+	CriticalRateLimitDuration int64 = 20 * 60
+)
+
+var RateLimitKeyExpirationDuration = 20 * time.Minute
+
+const (
+	UserStatusEnabled  = 1 // don't use 0, 0 is the default value!
+	UserStatusDisabled = 2 // also don't use 0
+)

openflare_server/common/init.go

@@ -0,0 +1,76 @@
+package common
+
+import (
+	"flag"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+var (
+	Port         = flag.Int("port", 3000, "the listening port")
+	PrintVersion = flag.Bool("version", false, "print version and exit")
+	PrintHelp    = flag.Bool("help", false, "print help and exit")
+	LogDir       = flag.String("log-dir", "", "specify the log directory")
+)
+
+// UploadPath Maybe override by ENV_VAR
+var UploadPath = "upload"
+
+func printHelp() {
+	fmt.Println("OpenFlare " + Version + " - Internal OpenResty Control Plane.")
+	fmt.Println("Copyright (C) 2023 JustSong. All rights reserved.")
+	fmt.Println("GitHub: https://github.com/Rain-kl/OpenFlare")
+	fmt.Println("Usage: openflare [--port <port>] [--log-dir <log directory>] [--version] [--help]")
+}
+
+func init() {
+	executableName := strings.ToLower(filepath.Base(os.Args[0]))
+	if !strings.Contains(executableName, ".test") {
+		flag.Parse()
+	}
+
+	if *PrintVersion {
+		fmt.Println(Version)
+		os.Exit(0)
+	}
+
+	if *PrintHelp {
+		printHelp()
+		os.Exit(0)
+	}
+
+	if os.Getenv("SESSION_SECRET") != "" {
+		SessionSecret = os.Getenv("SESSION_SECRET")
+	}
+	if os.Getenv("SQLITE_PATH") != "" {
+		SQLitePath = os.Getenv("SQLITE_PATH")
+	}
+	if os.Getenv("UPLOAD_PATH") != "" {
+		UploadPath = os.Getenv("UPLOAD_PATH")
+	}
+	if os.Getenv("AGENT_TOKEN") != "" {
+		AgentToken = os.Getenv("AGENT_TOKEN")
+	}
+	SetLogLevel(os.Getenv("LOG_LEVEL"))
+	if *LogDir != "" {
+		var err error
+		*LogDir, err = filepath.Abs(*LogDir)
+		if err != nil {
+			slog.Error("resolve log directory failed", "error", err)
+			os.Exit(1)
+		}
+		if _, err := os.Stat(*LogDir); os.IsNotExist(err) {
+			err = os.Mkdir(*LogDir, 0777)
+			if err != nil {
+				slog.Error("create log directory failed", "error", err)
+				os.Exit(1)
+			}
+		}
+	}
+	if _, err := os.Stat(UploadPath); os.IsNotExist(err) {
+		_ = os.Mkdir(UploadPath, 0777)
+	}
+}

openflare_server/common/logger.go

@@ -0,0 +1,241 @@
+package common
+
+import (
+	"context"
+	"fmt"
+	"github.com/gin-gonic/gin"
+	"io"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+)
+
+type logLevel int
+
+const (
+	logLevelDebug logLevel = iota
+	logLevelInfo
+	logLevelWarn
+	logLevelError
+)
+
+var currentLogLevel = logLevelInfo
+var currentLogLevelName = "info"
+var commonLogWriter io.Writer = os.Stdout
+var errorLogWriter io.Writer = os.Stderr
+var defaultLogger *slog.Logger
+
+type customTextHandler struct {
+	writer io.Writer
+	level  slog.Level
+	attrs  []slog.Attr
+	groups []string
+}
+
+type levelRouterHandler struct {
+	commonHandler slog.Handler
+	errorHandler  slog.Handler
+}
+
+func (h *customTextHandler) Enabled(_ context.Context, level slog.Level) bool {
+	return level >= h.level
+}
+
+func (h *customTextHandler) Handle(_ context.Context, record slog.Record) error {
+	var builder strings.Builder
+	builder.WriteString(record.Time.Format("2006-01-02 15:04:05.000"))
+	builder.WriteString(" | ")
+	builder.WriteString(fmt.Sprintf("%-8s", levelLabel(record.Level)))
+	builder.WriteString(" | ")
+	builder.WriteString(sourceLocation(record.PC))
+	builder.WriteString(" - ")
+	builder.WriteString(record.Message)
+
+	attrs := make([]slog.Attr, 0, len(h.attrs)+record.NumAttrs())
+	attrs = append(attrs, h.attrs...)
+	record.Attrs(func(attr slog.Attr) bool {
+		attrs = append(attrs, attr)
+		return true
+	})
+	if len(attrs) > 0 {
+		builder.WriteString(" | ")
+		builder.WriteString(formatAttrs(h.groups, attrs))
+	}
+	builder.WriteByte('\n')
+	_, err := io.WriteString(h.writer, builder.String())
+	return err
+}
+
+func (h *customTextHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
+	cloned := *h
+	cloned.attrs = append(slices.Clone(h.attrs), attrs...)
+	return &cloned
+}
+
+func (h *customTextHandler) WithGroup(name string) slog.Handler {
+	if strings.TrimSpace(name) == "" {
+		return h
+	}
+	cloned := *h
+	cloned.groups = append(slices.Clone(h.groups), name)
+	return &cloned
+}
+
+func (h *levelRouterHandler) Enabled(ctx context.Context, level slog.Level) bool {
+	return h.commonHandler.Enabled(ctx, level) || h.errorHandler.Enabled(ctx, level)
+}
+
+func (h *levelRouterHandler) Handle(ctx context.Context, record slog.Record) error {
+	if record.Level >= slog.LevelError {
+		return h.errorHandler.Handle(ctx, record)
+	}
+	return h.commonHandler.Handle(ctx, record)
+}
+
+func (h *levelRouterHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
+	return &levelRouterHandler{
+		commonHandler: h.commonHandler.WithAttrs(attrs),
+		errorHandler:  h.errorHandler.WithAttrs(attrs),
+	}
+}
+
+func (h *levelRouterHandler) WithGroup(name string) slog.Handler {
+	return &levelRouterHandler{
+		commonHandler: h.commonHandler.WithGroup(name),
+		errorHandler:  h.errorHandler.WithGroup(name),
+	}
+}
+
+func configureGinWriters() {
+	if shouldLog(logLevelDebug) {
+		gin.DefaultWriter = commonLogWriter
+	} else {
+		gin.DefaultWriter = io.Discard
+	}
+	gin.DefaultErrorWriter = errorLogWriter
+}
+
+func slogLevel() slog.Level {
+	switch currentLogLevel {
+	case logLevelDebug:
+		return slog.LevelDebug
+	case logLevelWarn:
+		return slog.LevelWarn
+	case logLevelError:
+		return slog.LevelError
+	default:
+		return slog.LevelInfo
+	}
+}
+
+func ensureLogger() *slog.Logger {
+	if defaultLogger != nil {
+		return defaultLogger
+	}
+	defaultLogger = slog.New(&levelRouterHandler{
+		commonHandler: &customTextHandler{writer: commonLogWriter, level: slogLevel()},
+		errorHandler:  &customTextHandler{writer: errorLogWriter, level: slogLevel()},
+	})
+	slog.SetDefault(defaultLogger)
+	return defaultLogger
+}
+
+func SetLogLevel(level string) {
+	normalized := strings.TrimSpace(strings.ToLower(level))
+	switch normalized {
+	case "debug":
+		currentLogLevel = logLevelDebug
+		currentLogLevelName = "debug"
+	case "warn", "warning":
+		currentLogLevel = logLevelWarn
+		currentLogLevelName = "warn"
+	case "error":
+		currentLogLevel = logLevelError
+		currentLogLevelName = "error"
+	default:
+		currentLogLevel = logLevelInfo
+		currentLogLevelName = "info"
+	}
+	configureGinWriters()
+}
+
+func GetLogLevel() string {
+	return currentLogLevelName
+}
+
+func shouldLog(level logLevel) bool {
+	return level >= currentLogLevel
+}
+
+func SetupGinLog() {
+	if *LogDir != "" {
+		commonLogPath := filepath.Join(*LogDir, "common.log")
+		errorLogPath := filepath.Join(*LogDir, "error.log")
+		commonFd, err := os.OpenFile(commonLogPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+		if err != nil {
+			_, _ = io.WriteString(os.Stderr, "failed to open common log file\n")
+			os.Exit(1)
+		}
+		errorFd, err := os.OpenFile(errorLogPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+		if err != nil {
+			_, _ = io.WriteString(os.Stderr, "failed to open error log file\n")
+			os.Exit(1)
+		}
+		commonLogWriter = io.MultiWriter(os.Stdout, commonFd)
+		errorLogWriter = io.MultiWriter(os.Stderr, errorFd)
+	}
+	configureGinWriters()
+	defaultLogger = nil
+	ensureLogger()
+}
+
+func levelLabel(level slog.Level) string {
+	switch {
+	case level <= slog.LevelDebug:
+		return "DEBUG"
+	case level < slog.LevelWarn:
+		return "INFO"
+	case level < slog.LevelError:
+		return "WARNING"
+	default:
+		return "ERROR"
+	}
+}
+
+func sourceLocation(pc uintptr) string {
+	if pc == 0 {
+		return "unknown:unknown:0"
+	}
+	frame, _ := runtime.CallersFrames([]uintptr{pc}).Next()
+	fileName := strings.TrimSuffix(filepath.Base(frame.File), filepath.Ext(frame.File))
+	if fileName == "" {
+		fileName = "unknown"
+	}
+	functionName := "unknown"
+	if frame.Function != "" {
+		parts := strings.Split(frame.Function, "/")
+		functionName = parts[len(parts)-1]
+		if dot := strings.LastIndex(functionName, "."); dot >= 0 && dot < len(functionName)-1 {
+			functionName = functionName[dot+1:]
+		}
+	}
+	return fmt.Sprintf("%s:%s:%d", fileName, functionName, frame.Line)
+}
+
+func formatAttrs(groups []string, attrs []slog.Attr) string {
+	parts := make([]string, 0, len(attrs))
+	for _, attr := range attrs {
+		key := attr.Key
+		if key == "" {
+			continue
+		}
+		if len(groups) > 0 {
+			key = strings.Join(append(slices.Clone(groups), key), ".")
+		}
+		parts = append(parts, fmt.Sprintf("%s=%v", key, attr.Value.Any()))
+	}
+	return strings.Join(parts, " ")
+}

openflare_server/common/redis.go

@@ -0,0 +1,40 @@
+package common
+
+import (
+	"context"
+	"github.com/go-redis/redis/v8"
+	"log/slog"
+	"os"
+	"time"
+)
+
+var RDB *redis.Client
+var RedisEnabled = true
+
+// InitRedisClient This function is called after init()
+func InitRedisClient() (err error) {
+	if os.Getenv("REDIS_CONN_STRING") == "" {
+		RedisEnabled = false
+		slog.Info("redis disabled because REDIS_CONN_STRING is not set")
+		return nil
+	}
+	opt, err := redis.ParseURL(os.Getenv("REDIS_CONN_STRING"))
+	if err != nil {
+		panic(err)
+	}
+	RDB = redis.NewClient(opt)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_, err = RDB.Ping(ctx).Result()
+	return err
+}
+
+func ParseRedisOption() *redis.Options {
+	opt, err := redis.ParseURL(os.Getenv("REDIS_CONN_STRING"))
+	if err != nil {
+		panic(err)
+	}
+	return opt
+}

openflare_server/controller/access_log.go

@@ -0,0 +1,29 @@
+package controller
+
+import (
+	"openflare/service"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+)
+
+// GetAccessLogs godoc
+// @Summary List access logs
+// @Tags AccessLogs
+// @Produce json
+// @Security BearerAuth
+// @Param node_id query string false "Node ID"
+// @Param p query int false "Page index"
+// @Param page_size query int false "Page size"
+// @Success 200 {object} map[string]interface{}
+// @Router /api/access-logs/ [get]
+func GetAccessLogs(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("p", "0"))
+	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "0"))
+	logs, err := service.ListAccessLogs(c.Query("node_id"), page, pageSize)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, logs)
+}

openflare_server/controller/agent.go

@@ -0,0 +1,153 @@
+package controller
+
+import (
+	"openflare/model"
+	"openflare/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+// AgentRegister godoc
+// @Summary Register or discover agent node
+// @Tags Agent
+// @Accept json
+// @Produce json
+// @Security AgentTokenAuth
+// @Param payload body service.AgentNodePayload true "Agent node payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/agent/nodes/register [post]
+func AgentRegister(c *gin.Context) {
+	var payload service.AgentNodePayload
+	if err := decodeJSONBody(c.Request.Body, &payload); err != nil {
+		respondBadRequest(c, "")
+		return
+	}
+
+	var (
+		result *service.AgentRegistrationResponse
+		err    error
+	)
+	if authNode, ok := c.Get("agent_node"); ok {
+		result, err = service.RegisterNodeWithAgentToken(authNode.(*model.Node), payload)
+	} else {
+		result, err = service.RegisterNodeWithDiscovery(payload)
+	}
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, result)
+}
+
+// AgentHeartbeat godoc
+// @Summary Report agent heartbeat
+// @Tags Agent
+// @Accept json
+// @Produce json
+// @Security AgentTokenAuth
+// @Param payload body service.AgentNodePayload true "Agent heartbeat payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/agent/nodes/heartbeat [post]
+func AgentHeartbeat(c *gin.Context) {
+	var payload service.AgentNodePayload
+	if err := decodeJSONBody(c.Request.Body, &payload); err != nil {
+		respondBadRequest(c, "")
+		return
+	}
+
+	authNode, ok := c.Get("agent_node")
+	if !ok {
+		respondUnauthorized(c, "鏃犳潈杩涜姝ゆ搷浣滐紝Agent Token 鏃犳晥")
+		return
+	}
+
+	node, err := service.HeartbeatNode(authNode.(*model.Node), payload)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccessWithExtras(c, node.Node, gin.H{
+		"agent_settings": node.AgentSettings,
+		"active_config":  node.ActiveConfig,
+	})
+}
+
+// AgentGetActiveConfig godoc
+// @Summary Get active config for agent
+// @Tags Agent
+// @Produce json
+// @Security AgentTokenAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/agent/config-versions/active [get]
+func AgentGetActiveConfig(c *gin.Context) {
+	config, err := service.GetActiveConfigForAgent()
+	if err != nil {
+		respondFailure(c, "当前没有激活版本")
+		return
+	}
+	respondSuccess(c, config)
+}
+
+// AgentReportApplyLog godoc
+// @Summary Report agent apply result
+// @Tags Agent
+// @Accept json
+// @Produce json
+// @Security AgentTokenAuth
+// @Param payload body service.ApplyLogPayload true "Apply log payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/agent/apply-logs [post]
+func AgentReportApplyLog(c *gin.Context) {
+	var payload service.ApplyLogPayload
+	if err := decodeJSONBody(c.Request.Body, &payload); err != nil {
+		respondBadRequest(c, "")
+		return
+	}
+
+	if authNode, ok := c.Get("agent_node"); ok {
+		payload.NodeID = authNode.(*model.Node).NodeID
+	}
+
+	log, err := service.ReportApplyLog(payload)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, log)
+}
+
+// GetNodes godoc
+// @Summary List nodes
+// @Tags Nodes
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/nodes/ [get]
+func GetNodes(c *gin.Context) {
+	nodes, err := service.ListNodeViews()
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, nodes)
+}
+
+// GetApplyLogs godoc
+// @Summary List apply logs
+// @Tags ApplyLogs
+// @Produce json
+// @Security BearerAuth
+// @Param node_id query string false "Node ID"
+// @Success 200 {object} map[string]interface{}
+// @Router /api/apply-logs/ [get]
+func GetApplyLogs(c *gin.Context) {
+	logs, err := service.ListApplyLogs(c.Query("node_id"))
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, logs)
+}

openflare_server/controller/config_version.go

@@ -0,0 +1,157 @@
+package controller
+
+import (
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/service"
+	"strconv"
+)
+
+// GetConfigVersions godoc
+// @Summary List config versions
+// @Tags ConfigVersions
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/config-versions/ [get]
+func GetConfigVersions(c *gin.Context) {
+	versions, err := service.ListConfigVersions()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    versions,
+	})
+}
+
+// GetActiveConfigVersion godoc
+// @Summary Get active config version
+// @Tags ConfigVersions
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/config-versions/active [get]
+func GetActiveConfigVersion(c *gin.Context) {
+	version, err := service.GetActiveConfigVersion()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "当前没有激活版本",
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    version,
+	})
+}
+
+// PreviewConfigVersion godoc
+// @Summary Preview config rendering
+// @Tags ConfigVersions
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/config-versions/preview [get]
+func PreviewConfigVersion(c *gin.Context) {
+	preview, err := service.PreviewConfigVersion()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    preview,
+	})
+}
+
+// DiffConfigVersion godoc
+// @Summary Diff current draft against active version
+// @Tags ConfigVersions
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/config-versions/diff [get]
+func DiffConfigVersion(c *gin.Context) {
+	diff, err := service.DiffConfigVersion()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    diff,
+	})
+}
+
+// PublishConfigVersion godoc
+// @Summary Publish a new config version
+// @Tags ConfigVersions
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/config-versions/publish [post]
+func PublishConfigVersion(c *gin.Context) {
+	username := c.GetString("username")
+	result, err := service.PublishConfigVersion(username)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    result.Version,
+	})
+}
+
+// ActivateConfigVersion godoc
+// @Summary Activate an existing config version
+// @Tags ConfigVersions
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Version ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/config-versions/{id}/activate [put]
+func ActivateConfigVersion(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	version, err := service.ActivateConfigVersion(uint(id))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    version,
+	})
+}

openflare_server/controller/dashboard.go

@@ -0,0 +1,24 @@
+package controller
+
+import (
+	"openflare/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+// GetDashboardOverview godoc
+// @Summary Get dashboard overview
+// @Tags Dashboard
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/dashboard/overview [get]
+func GetDashboardOverview(c *gin.Context) {
+	view, err := service.GetDashboardOverview()
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, view)
+}

openflare_server/controller/file.go

@@ -0,0 +1,160 @@
+package controller
+
+import (
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/common"
+	"openflare/model"
+	"openflare/utils"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+)
+
+func GetAllFiles(c *gin.Context) {
+	p, _ := strconv.Atoi(c.Query("p"))
+	if p < 0 {
+		p = 0
+	}
+	files, err := model.GetAllFiles(p*common.ItemsPerPage, common.ItemsPerPage)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    files,
+	})
+	return
+}
+
+func SearchFiles(c *gin.Context) {
+	keyword := c.Query("keyword")
+	files, err := model.SearchFiles(keyword)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    files,
+	})
+	return
+}
+
+func UploadFile(c *gin.Context) {
+	form, err := c.MultipartForm()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	uploadPath := common.UploadPath
+	description := c.PostForm("description")
+	if description == "" {
+		description = "无描述信息"
+	}
+	uploader := c.GetString("username")
+	if uploader == "" {
+		uploader = "访客用户"
+	}
+	uploaderId := c.GetInt("id")
+	currentTime := time.Now().Format("2006-01-02 15:04:05")
+	files := form.File["file"]
+	for _, file := range files {
+		filename := filepath.Base(file.Filename)
+		ext := filepath.Ext(filename)
+		link := utils.GetUUID() + ext
+		savePath := filepath.Join(uploadPath, link) // both parts are checked, so this path should be safe to use
+		if err := c.SaveUploadedFile(file, savePath); err != nil {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": err.Error(),
+			})
+			return
+		}
+		// save to database
+		fileObj := &model.File{
+			Description: description,
+			Uploader:    uploader,
+			UploadTime:  currentTime,
+			UploaderId:  uploaderId,
+			Link:        link,
+			Filename:    filename,
+		}
+		err = fileObj.Insert()
+		if err != nil {
+			_ = err
+		}
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}
+
+func DeleteFile(c *gin.Context) {
+	fileIdStr := c.Param("id")
+	fileId, err := strconv.Atoi(fileIdStr)
+	if err != nil || fileId == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+
+	fileObj := &model.File{
+		Id: fileId,
+	}
+	model.DB.Where("id = ?", fileId).First(&fileObj)
+	if fileObj.Link == "" {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "文件不存在！",
+		})
+		return
+	}
+	err = fileObj.Delete()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": true,
+			"message": err.Error(),
+		})
+		return
+	} else {
+		message := "文件删除成功"
+		c.JSON(http.StatusOK, gin.H{
+			"success": true,
+			"message": message,
+		})
+	}
+
+}
+
+func DownloadFile(c *gin.Context) {
+	path := c.Param("file")
+	fullPath := filepath.Join(common.UploadPath, path)
+	if !strings.HasPrefix(fullPath, common.UploadPath) {
+		// We may being attacked!
+		c.Status(403)
+		return
+	}
+	c.File(fullPath)
+	// Update download counter
+	go func() {
+		model.UpdateDownloadCounter(path)
+	}()
+}

openflare_server/controller/geoip.go

@@ -0,0 +1,36 @@
+package controller
+
+import (
+	"openflare/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+type geoIPLookupRequest struct {
+	Provider string `json:"provider"`
+	IP       string `json:"ip"`
+}
+
+// LookupGeoIP godoc
+// @Summary Test GeoIP lookup
+// @Tags Options
+// @Accept json
+// @Produce json
+// @Param payload body geoIPLookupRequest true "GeoIP lookup payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/option/geoip/lookup [post]
+func LookupGeoIP(c *gin.Context) {
+	var request geoIPLookupRequest
+	if err := decodeJSONBody(c.Request.Body, &request); err != nil {
+		respondBadRequest(c, "")
+		return
+	}
+
+	view, err := service.LookupGeoIP(request.Provider, request.IP)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, view)
+}

openflare_server/controller/github.go

@@ -0,0 +1,208 @@
+package controller
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-gonic/gin"
+	"log/slog"
+	"net/http"
+	"openflare/common"
+	"openflare/model"
+	"strconv"
+	"time"
+)
+
+type GitHubOAuthResponse struct {
+	AccessToken string `json:"access_token"`
+	Scope       string `json:"scope"`
+	TokenType   string `json:"token_type"`
+}
+
+type GitHubUser struct {
+	Login string `json:"login"`
+	Name  string `json:"name"`
+	Email string `json:"email"`
+}
+
+func getGitHubUserInfoByCode(code string) (*GitHubUser, error) {
+	if code == "" {
+		return nil, errors.New("无效的参数")
+	}
+	values := map[string]string{"client_id": common.GitHubClientId, "client_secret": common.GitHubClientSecret, "code": code}
+	jsonData, err := json.Marshal(values)
+	if err != nil {
+		return nil, err
+	}
+	req, err := http.NewRequest("POST", "https://github.com/login/oauth/access_token", bytes.NewBuffer(jsonData))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json")
+	client := http.Client{
+		Timeout: 5 * time.Second,
+	}
+	res, err := client.Do(req)
+	if err != nil {
+		slog.Error("github oauth access token request failed", "error", err)
+		return nil, errors.New("无法连接至 GitHub 服务器，请稍后重试！")
+	}
+	defer res.Body.Close()
+	var oAuthResponse GitHubOAuthResponse
+	err = json.NewDecoder(res.Body).Decode(&oAuthResponse)
+	if err != nil {
+		return nil, err
+	}
+	req, err = http.NewRequest("GET", "https://api.github.com/user", nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", oAuthResponse.AccessToken))
+	res2, err := client.Do(req)
+	if err != nil {
+		slog.Error("github user info request failed", "error", err)
+		return nil, errors.New("无法连接至 GitHub 服务器，请稍后重试！")
+	}
+	defer res2.Body.Close()
+	var githubUser GitHubUser
+	err = json.NewDecoder(res2.Body).Decode(&githubUser)
+	if err != nil {
+		return nil, err
+	}
+	if githubUser.Login == "" {
+		return nil, errors.New("返回值非法，用户字段为空，请稍后重试！")
+	}
+	return &githubUser, nil
+}
+
+func GitHubOAuth(c *gin.Context) {
+	session := sessions.Default(c)
+	username := session.Get("username")
+	if username != nil {
+		GitHubBind(c)
+		return
+	}
+
+	if !common.GitHubOAuthEnabled {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "管理员未开启通过 GitHub 登录以及注册",
+		})
+		return
+	}
+	code := c.Query("code")
+	githubUser, err := getGitHubUserInfoByCode(code)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	user := model.User{
+		GitHubId: githubUser.Login,
+	}
+	if model.IsGitHubIdAlreadyTaken(user.GitHubId) {
+		err := user.FillUserByGitHubId()
+		if err != nil {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": err.Error(),
+			})
+			return
+		}
+	} else {
+		if common.RegisterEnabled {
+			user.Username = "github_" + strconv.Itoa(model.GetMaxUserId()+1)
+			if githubUser.Name != "" {
+				user.DisplayName = githubUser.Name
+			} else {
+				user.DisplayName = "GitHub User"
+			}
+			user.Email = githubUser.Email
+			user.Role = common.RoleCommonUser
+			user.Status = common.UserStatusEnabled
+
+			if err := user.Insert(); err != nil {
+				c.JSON(http.StatusOK, gin.H{
+					"success": false,
+					"message": err.Error(),
+				})
+				return
+			}
+		} else {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "管理员关闭了新用户注册",
+			})
+			return
+		}
+	}
+
+	if user.Status != common.UserStatusEnabled {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "用户已被封禁",
+			"success": false,
+		})
+		return
+	}
+	setupLogin(&user, c)
+}
+
+func GitHubBind(c *gin.Context) {
+	if !common.GitHubOAuthEnabled {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "管理员未开启通过 GitHub 登录以及注册",
+		})
+		return
+	}
+	code := c.Query("code")
+	githubUser, err := getGitHubUserInfoByCode(code)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	user := model.User{
+		GitHubId: githubUser.Login,
+	}
+	if model.IsGitHubIdAlreadyTaken(user.GitHubId) {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "该 GitHub 账户已被绑定",
+		})
+		return
+	}
+	session := sessions.Default(c)
+	id := session.Get("id")
+	// id := c.GetInt("id")  // critical bug!
+	user.Id = id.(int)
+	err = user.FillUserById()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	user.GitHubId = githubUser.Login
+	err = user.Update(false)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "bind",
+	})
+	return
+}

openflare_server/controller/managed_domain.go

@@ -0,0 +1,166 @@
+package controller
+
+import (
+	"encoding/json"
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/service"
+	"strconv"
+	"strings"
+)
+
+// GetManagedDomains godoc
+// @Summary List managed domains
+// @Tags ManagedDomains
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/managed-domains/ [get]
+func GetManagedDomains(c *gin.Context) {
+	domains, err := service.ListManagedDomains()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    domains,
+	})
+}
+
+// CreateManagedDomain godoc
+// @Summary Create managed domain
+// @Tags ManagedDomains
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param payload body service.ManagedDomainInput true "Managed domain payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/managed-domains/ [post]
+func CreateManagedDomain(c *gin.Context) {
+	var input service.ManagedDomainInput
+	if err := json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	domain, err := service.CreateManagedDomain(input)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    domain,
+	})
+}
+
+// UpdateManagedDomain godoc
+// @Summary Update managed domain
+// @Tags ManagedDomains
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Managed domain ID"
+// @Param payload body service.ManagedDomainInput true "Managed domain payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/managed-domains/{id} [put]
+func UpdateManagedDomain(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	var input service.ManagedDomainInput
+	if err = json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	domain, err := service.UpdateManagedDomain(uint(id), input)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    domain,
+	})
+}
+
+// DeleteManagedDomain godoc
+// @Summary Delete managed domain
+// @Tags ManagedDomains
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Managed domain ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/managed-domains/{id} [delete]
+func DeleteManagedDomain(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if err = service.DeleteManagedDomain(uint(id)); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+}
+
+// MatchManagedDomainCertificate godoc
+// @Summary Match certificate for domain
+// @Tags ManagedDomains
+// @Produce json
+// @Security BearerAuth
+// @Param domain query string true "Domain"
+// @Success 200 {object} map[string]interface{}
+// @Router /api/managed-domains/match [get]
+func MatchManagedDomainCertificate(c *gin.Context) {
+	domain := strings.TrimSpace(c.Query("domain"))
+	result, err := service.MatchManagedDomainCertificate(domain)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    result,
+	})
+}

openflare_server/controller/misc.go

@@ -0,0 +1,179 @@
+package controller
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/common"
+	"openflare/model"
+	"openflare/utils/mail"
+	"openflare/utils/security"
+	"openflare/utils/validation"
+)
+
+// GetStatus godoc
+// @Summary Get server status
+// @Tags Public
+// @Produce json
+// @Success 200 {object} map[string]interface{}
+// @Router /api/status [get]
+func GetStatus(c *gin.Context) {
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data": gin.H{
+			"version":            common.Version,
+			"start_time":         common.StartTime,
+			"email_verification": common.EmailVerificationEnabled,
+			"github_oauth":       common.GitHubOAuthEnabled,
+			"github_client_id":   common.GitHubClientId,
+			"system_name":        common.SystemName,
+			"home_page_link":     common.HomePageLink,
+			"footer_html":        common.Footer,
+			"wechat_qrcode":      common.WeChatAccountQRCodeImageURL,
+			"wechat_login":       common.WeChatAuthEnabled,
+			"server_address":     common.ServerAddress,
+			"turnstile_check":    common.TurnstileCheckEnabled,
+			"turnstile_site_key": common.TurnstileSiteKey,
+		},
+	})
+	return
+}
+
+func GetNotice(c *gin.Context) {
+	common.OptionMapRWMutex.RLock()
+	defer common.OptionMapRWMutex.RUnlock()
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    common.OptionMap["Notice"],
+	})
+	return
+}
+
+func GetAbout(c *gin.Context) {
+	common.OptionMapRWMutex.RLock()
+	defer common.OptionMapRWMutex.RUnlock()
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    common.OptionMap["About"],
+	})
+	return
+}
+
+func SendEmailVerification(c *gin.Context) {
+	email := c.Query("email")
+	if err := validation.Validate.Var(email, "required,email"); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if model.IsEmailAlreadyTaken(email) {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "邮箱地址已被占用",
+		})
+		return
+	}
+	code := security.GenerateVerificationCode(6)
+	security.RegisterVerificationCodeWithKey(email, code, security.EmailVerificationPurpose)
+	subject := fmt.Sprintf("%s邮箱验证邮件", common.SystemName)
+	content := fmt.Sprintf("<p>您好，你正在进行%s邮箱验证。</p>"+
+		"<p>您的验证码为: <strong>%s</strong></p>"+
+		"<p>验证码 %d 分钟内有效，如果不是本人操作，请忽略。</p>", common.SystemName, code, security.VerificationValidMinutes)
+	err := mail.SendEmail(subject, email, content)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}
+
+func SendPasswordResetEmail(c *gin.Context) {
+	email := c.Query("email")
+	if err := validation.Validate.Var(email, "required,email"); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if !model.IsEmailAlreadyTaken(email) {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "该邮箱地址未注册",
+		})
+		return
+	}
+	code := security.GenerateVerificationCode(0)
+	security.RegisterVerificationCodeWithKey(email, code, security.PasswordResetPurpose)
+	link := fmt.Sprintf("%s/user/reset?email=%s&token=%s", common.ServerAddress, email, code)
+	subject := fmt.Sprintf("%s密码重置", common.SystemName)
+	content := fmt.Sprintf("<p>您好，你正在进行%s密码重置。</p>"+
+		"<p>点击<a href='%s'>此处</a>进行密码重置。</p>"+
+		"<p>重置链接 %d 分钟内有效，如果不是本人操作，请忽略。</p>", common.SystemName, link, security.VerificationValidMinutes)
+	err := mail.SendEmail(subject, email, content)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}
+
+type PasswordResetRequest struct {
+	Email string `json:"email"`
+	Token string `json:"token"`
+}
+
+func ResetPassword(c *gin.Context) {
+	var req PasswordResetRequest
+	err := json.NewDecoder(c.Request.Body).Decode(&req)
+	if req.Email == "" || req.Token == "" {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if !security.VerifyCodeWithKey(req.Email, req.Token, security.PasswordResetPurpose) {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "重置链接非法或已过期",
+		})
+		return
+	}
+	password := security.GenerateVerificationCode(12)
+	err = model.ResetUserPasswordByEmail(req.Email, password)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	security.DeleteKey(req.Email, security.PasswordResetPurpose)
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    password,
+	})
+	return
+}

openflare_server/controller/node.go

@@ -0,0 +1,249 @@
+package controller
+
+import (
+	"openflare/service"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+)
+
+type nodeAgentUpdateRequest struct {
+	Channel string `json:"channel"`
+	TagName string `json:"tag_name"`
+}
+
+type nodeObservabilityQuery struct {
+	Hours int `form:"hours"`
+	Limit int `form:"limit"`
+}
+
+// CreateNode godoc
+// @Summary Create node
+// @Tags Nodes
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param payload body service.NodeInput true "Node payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/nodes/ [post]
+func CreateNode(c *gin.Context) {
+	var input service.NodeInput
+	if err := decodeJSONBody(c.Request.Body, &input); err != nil {
+		respondBadRequest(c, "")
+		return
+	}
+
+	node, err := service.CreateNode(input)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, node)
+}
+
+// GetNodeBootstrapToken godoc
+// @Summary Get global discovery token
+// @Tags Nodes
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/nodes/bootstrap-token [get]
+func GetNodeBootstrapToken(c *gin.Context) {
+	bootstrap, err := service.GetNodeBootstrapView()
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, bootstrap)
+}
+
+// RotateNodeBootstrapToken godoc
+// @Summary Rotate global discovery token
+// @Tags Nodes
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/nodes/bootstrap-token/rotate [post]
+func RotateNodeBootstrapToken(c *gin.Context) {
+	bootstrap, err := service.RotateGlobalDiscoveryToken()
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, bootstrap)
+}
+
+// UpdateNode godoc
+// @Summary Update node
+// @Tags Nodes
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Node ID"
+// @Param payload body service.NodeInput true "Node payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/nodes/{id} [put]
+func UpdateNode(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		respondBadRequest(c, "")
+		return
+	}
+
+	var input service.NodeInput
+	if err = decodeJSONBody(c.Request.Body, &input); err != nil {
+		respondBadRequest(c, "")
+		return
+	}
+
+	node, err := service.UpdateNode(uint(id), input)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, node)
+}
+
+// DeleteNode godoc
+// @Summary Delete node
+// @Tags Nodes
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Node ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/nodes/{id} [delete]
+func DeleteNode(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		respondBadRequest(c, "")
+		return
+	}
+
+	if err = service.DeleteNode(uint(id)); err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccessMessage(c, "")
+}
+
+// RequestNodeAgentUpdate godoc
+// @Summary Request agent self-update on node
+// @Tags Nodes
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Node ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/nodes/{id}/agent-update [post]
+func RequestNodeAgentUpdate(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		respondBadRequest(c, "")
+		return
+	}
+
+	var request nodeAgentUpdateRequest
+	if c.Request.ContentLength > 0 {
+		if err = decodeOptionalJSONBody(c.Request.Body, &request); err != nil {
+			respondBadRequest(c, "")
+			return
+		}
+	}
+
+	node, err := service.RequestNodeAgentUpdate(uint(id), service.NodeAgentUpdateInput{
+		Channel: request.Channel,
+		TagName: request.TagName,
+	})
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, node)
+}
+
+// RequestNodeOpenrestyRestart godoc
+// @Summary Request openresty restart on node
+// @Tags Nodes
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Node ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/nodes/{id}/openresty-restart [post]
+func RequestNodeOpenrestyRestart(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		respondBadRequest(c, "")
+		return
+	}
+
+	node, err := service.RequestNodeOpenrestyRestart(uint(id))
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, node)
+}
+
+// GetNodeAgentRelease godoc
+// @Summary Check latest agent release for node
+// @Tags Nodes
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Node ID"
+// @Param channel query string false "stable or preview"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/nodes/{id}/agent-release [get]
+func GetNodeAgentRelease(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		respondBadRequest(c, "")
+		return
+	}
+
+	release, err := service.GetNodeAgentRelease(c.Request.Context(), uint(id), c.Query("channel"))
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, release)
+}
+
+// GetNodeObservability godoc
+// @Summary Get node observability details
+// @Tags Nodes
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Node ID"
+// @Param hours query int false "Lookback window in hours"
+// @Param limit query int false "Max records per section"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/nodes/{id}/observability [get]
+func GetNodeObservability(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		respondBadRequest(c, "")
+		return
+	}
+
+	var query nodeObservabilityQuery
+	if err = c.ShouldBindQuery(&query); err != nil {
+		respondBadRequest(c, "")
+		return
+	}
+
+	view, err := service.GetNodeObservability(uint(id), service.NodeObservabilityQuery{
+		Hours: query.Hours,
+		Limit: query.Limit,
+	})
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, view)
+}

openflare_server/controller/option.go

@@ -0,0 +1,285 @@
+package controller
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/common"
+	"openflare/model"
+	"openflare/service"
+	"openflare/utils"
+	"openflare/utils/geoip"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+var (
+	openRestySizePattern          = regexp.MustCompile(`^\d+[kKmMgG]?$`)
+	openRestyProxyBuffersPattern  = regexp.MustCompile(`^\d+\s+\d+[kKmMgG]?$`)
+	openRestyCacheLevelsPattern   = regexp.MustCompile(`^\d{1,2}(?::\d{1,2}){0,2}$`)
+	openRestyDurationTokenPattern = regexp.MustCompile(`^\d+[smhdwSMHDW]$`)
+)
+
+func validateRateLimitOption(key string, value string) error {
+	maxDurationSeconds := int(common.RateLimitKeyExpirationDuration.Seconds())
+
+	switch key {
+	case "GlobalApiRateLimitNum", "GlobalWebRateLimitNum", "UploadRateLimitNum", "DownloadRateLimitNum", "CriticalRateLimitNum":
+		intValue, err := strconv.Atoi(value)
+		if err != nil || intValue <= 0 {
+			return fmt.Errorf("%s 必须为大于 0 的整数", key)
+		}
+		return nil
+	case "GlobalApiRateLimitDuration", "GlobalWebRateLimitDuration", "UploadRateLimitDuration", "DownloadRateLimitDuration", "CriticalRateLimitDuration":
+		intValue, err := strconv.Atoi(value)
+		if err != nil || intValue <= 0 {
+			return fmt.Errorf("%s 必须为大于 0 的整数秒", key)
+		}
+		if intValue > maxDurationSeconds {
+			return fmt.Errorf("%s 不能大于 %d 秒", key, maxDurationSeconds)
+		}
+		return nil
+	default:
+		return nil
+	}
+}
+
+func validatePositiveIntegerOption(key string, value string) error {
+	intValue, err := strconv.Atoi(value)
+	if err != nil || intValue <= 0 {
+		return fmt.Errorf("%s 必须为大于 0 的整数", key)
+	}
+	return nil
+}
+
+func validateBooleanOption(key string, value string) error {
+	switch value {
+	case "true", "false":
+		return nil
+	default:
+		return fmt.Errorf("%s 必须为 true 或 false", key)
+	}
+}
+
+func validateGeoIPOption(key string, value string) error {
+	if key != "GeoIPProvider" {
+		return nil
+	}
+	if !geoip.IsValidProvider(value) {
+		return fmt.Errorf("%s 仅支持 disabled、mmdb、ip-api、geojs、ipinfo", key)
+	}
+	return nil
+}
+
+func validateOpenRestyOption(key string, value string) error {
+	trimmed := strings.TrimSpace(value)
+
+	switch key {
+	case "OpenRestyWorkerProcesses":
+		if trimmed == "auto" {
+			return nil
+		}
+		return validatePositiveIntegerOption(key, trimmed)
+	case "OpenRestyWorkerConnections",
+		"OpenRestyWorkerRlimitNofile",
+		"OpenRestyKeepaliveTimeout",
+		"OpenRestyKeepaliveRequests",
+		"OpenRestyClientHeaderTimeout",
+		"OpenRestyClientBodyTimeout",
+		"OpenRestySendTimeout",
+		"OpenRestyProxyConnectTimeout",
+		"OpenRestyProxySendTimeout",
+		"OpenRestyProxyReadTimeout",
+		"OpenRestyGzipMinLength":
+		return validatePositiveIntegerOption(key, trimmed)
+	case "OpenRestyGzipCompLevel":
+		if err := validatePositiveIntegerOption(key, trimmed); err != nil {
+			return err
+		}
+		level, _ := strconv.Atoi(trimmed)
+		if level > 9 {
+			return fmt.Errorf("%s 不能大于 9", key)
+		}
+		return nil
+	case "OpenRestyEventsUse":
+		if trimmed == "" {
+			return nil
+		}
+		switch trimmed {
+		case "epoll", "kqueue", "poll", "select", "rtsig", "/dev/poll", "eventport":
+			return nil
+		default:
+			return fmt.Errorf("%s 仅支持 epoll、kqueue、poll、select、rtsig、/dev/poll、eventport 或留空", key)
+		}
+	case "OpenRestyEventsMultiAcceptEnabled",
+		"OpenRestyWebsocketEnabled",
+		"OpenRestyProxyRequestBufferingEnabled",
+		"OpenRestyProxyBufferingEnabled",
+		"OpenRestyGzipEnabled",
+		"OpenRestyCacheEnabled",
+		"OpenRestyCacheLockEnabled":
+		return validateBooleanOption(key, trimmed)
+	case "OpenRestyProxyBuffers", "OpenRestyLargeClientHeaderBuffers":
+		if openRestyProxyBuffersPattern.MatchString(trimmed) {
+			return nil
+		}
+		return fmt.Errorf("%s 格式必须类似 \"16 16k\"", key)
+	case "OpenRestyProxyBufferSize", "OpenRestyProxyBusyBuffersSize", "OpenRestyCacheMaxSize", "OpenRestyClientMaxBodySize":
+		if openRestySizePattern.MatchString(trimmed) {
+			return nil
+		}
+		return fmt.Errorf("%s 格式必须为整数或带 k/m/g 单位的大小值", key)
+	case "OpenRestyCachePath":
+		if strings.ContainsAny(trimmed, "\r\n\t") {
+			return fmt.Errorf("%s 不能包含换行或制表符", key)
+		}
+		return nil
+	case "OpenRestyCacheLevels":
+		if openRestyCacheLevelsPattern.MatchString(trimmed) {
+			return nil
+		}
+		return fmt.Errorf("%s 格式必须类似 \"1:2\" 或 \"1:2:2\"", key)
+	case "OpenRestyCacheInactive", "OpenRestyCacheLockTimeout":
+		if openRestyDurationTokenPattern.MatchString(trimmed) {
+			return nil
+		}
+		return fmt.Errorf("%s 格式必须为带单位的时长，例如 30m 或 5s", key)
+	case "OpenRestyCacheKeyTemplate":
+		if trimmed == "" {
+			return fmt.Errorf("%s 不能为空", key)
+		}
+		if strings.ContainsAny(trimmed, "\r\n") {
+			return fmt.Errorf("%s 不能包含换行", key)
+		}
+		return nil
+	case "OpenRestyCacheUseStale":
+		if trimmed == "" {
+			return fmt.Errorf("%s 不能为空", key)
+		}
+		allowedTokens := map[string]struct{}{
+			"error": {}, "timeout": {}, "invalid_header": {}, "updating": {},
+			"http_500": {}, "http_502": {}, "http_503": {}, "http_504": {},
+			"http_403": {}, "http_404": {}, "http_429": {}, "off": {},
+		}
+		for _, token := range strings.Fields(trimmed) {
+			if _, ok := allowedTokens[token]; !ok {
+				return fmt.Errorf("%s 包含不支持的值 %q", key, token)
+			}
+		}
+		return nil
+	case "OpenRestyMainConfigTemplate":
+		return service.ValidateOpenRestyMainConfigTemplate(value)
+	default:
+		return nil
+	}
+}
+
+// GetOptions godoc
+// @Summary List editable options
+// @Tags Options
+// @Produce json
+// @Success 200 {object} map[string]interface{}
+// @Router /api/option/ [get]
+func GetOptions(c *gin.Context) {
+	var options []*model.Option
+	common.OptionMapRWMutex.Lock()
+	for k, v := range common.OptionMap {
+		if strings.Contains(k, "Token") || strings.Contains(k, "Secret") {
+			continue
+		}
+		options = append(options, &model.Option{
+			Key:   k,
+			Value: utils.Interface2String(v),
+		})
+	}
+	common.OptionMapRWMutex.Unlock()
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    options,
+	})
+	return
+}
+
+// UpdateOption godoc
+// @Summary Update option
+// @Tags Options
+// @Accept json
+// @Produce json
+// @Param payload body model.Option true "Option payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/option/ [put]
+func UpdateOption(c *gin.Context) {
+	var option model.Option
+	err := json.NewDecoder(c.Request.Body).Decode(&option)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	switch option.Key {
+	case "GitHubOAuthEnabled":
+		if option.Value == "true" && common.GitHubClientId == "" {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无法启用 GitHub OAuth，请先填入 GitHub Client ID 以及 GitHub Client Secret！",
+			})
+			return
+		}
+	case "WeChatAuthEnabled":
+		if option.Value == "true" && common.WeChatServerAddress == "" {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无法启用微信登录，请先填入微信登录相关配置信息！",
+			})
+			return
+		}
+	case "TurnstileCheckEnabled":
+		if option.Value == "true" && common.TurnstileSiteKey == "" {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无法启用 Turnstile 校验，请先填入 Turnstile 校验相关配置信息！",
+			})
+			return
+		}
+	}
+	if err = validateRateLimitOption(option.Key, option.Value); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	if err = validateOpenRestyOption(option.Key, option.Value); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	if err = validateGeoIPOption(option.Key, option.Value); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	err = model.UpdateOption(option.Key, option.Value)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}

openflare_server/controller/option_test.go

@@ -0,0 +1,46 @@
+package controller
+
+import "testing"
+
+func TestValidateOpenRestyOption(t *testing.T) {
+	testCases := []struct {
+		name    string
+		key     string
+		value   string
+		wantErr bool
+	}{
+		{name: "worker processes auto", key: "OpenRestyWorkerProcesses", value: "auto"},
+		{name: "worker processes number", key: "OpenRestyWorkerProcesses", value: "8"},
+		{name: "worker processes invalid", key: "OpenRestyWorkerProcesses", value: "0", wantErr: true},
+		{name: "events use empty", key: "OpenRestyEventsUse", value: ""},
+		{name: "events use invalid", key: "OpenRestyEventsUse", value: "io_uring", wantErr: true},
+		{name: "proxy buffers valid", key: "OpenRestyProxyBuffers", value: "16 16k"},
+		{name: "proxy buffers invalid", key: "OpenRestyProxyBuffers", value: "16x16k", wantErr: true},
+		{name: "cache max size valid", key: "OpenRestyCacheMaxSize", value: "2g"},
+		{name: "cache max size invalid", key: "OpenRestyCacheMaxSize", value: "2gb", wantErr: true},
+		{name: "client max body size valid", key: "OpenRestyClientMaxBodySize", value: "64m"},
+		{name: "client max body size invalid", key: "OpenRestyClientMaxBodySize", value: "64mb", wantErr: true},
+		{name: "large client header buffers valid", key: "OpenRestyLargeClientHeaderBuffers", value: "4 16k"},
+		{name: "large client header buffers invalid", key: "OpenRestyLargeClientHeaderBuffers", value: "4x16k", wantErr: true},
+		{name: "proxy request buffering valid", key: "OpenRestyProxyRequestBufferingEnabled", value: "true"},
+		{name: "proxy request buffering invalid", key: "OpenRestyProxyRequestBufferingEnabled", value: "on", wantErr: true},
+		{name: "websocket valid", key: "OpenRestyWebsocketEnabled", value: "false"},
+		{name: "websocket invalid", key: "OpenRestyWebsocketEnabled", value: "off", wantErr: true},
+		{name: "cache inactive valid", key: "OpenRestyCacheInactive", value: "30m"},
+		{name: "cache inactive invalid", key: "OpenRestyCacheInactive", value: "30", wantErr: true},
+		{name: "cache use stale valid", key: "OpenRestyCacheUseStale", value: "error timeout http_500"},
+		{name: "cache use stale invalid", key: "OpenRestyCacheUseStale", value: "error whatever", wantErr: true},
+		{name: "gzip level valid", key: "OpenRestyGzipCompLevel", value: "9"},
+		{name: "gzip level invalid", key: "OpenRestyGzipCompLevel", value: "10", wantErr: true},
+	}
+
+	for _, testCase := range testCases {
+		err := validateOpenRestyOption(testCase.key, testCase.value)
+		if testCase.wantErr && err == nil {
+			t.Fatalf("%s: expected error", testCase.name)
+		}
+		if !testCase.wantErr && err != nil {
+			t.Fatalf("%s: unexpected error: %v", testCase.name, err)
+		}
+	}
+}

openflare_server/controller/proxy_route.go

@@ -0,0 +1,140 @@
+package controller
+
+import (
+	"encoding/json"
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/service"
+	"strconv"
+)
+
+// GetProxyRoutes godoc
+// @Summary List proxy routes
+// @Tags ProxyRoutes
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/proxy-routes/ [get]
+func GetProxyRoutes(c *gin.Context) {
+	routes, err := service.ListProxyRoutes()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    routes,
+	})
+}
+
+// CreateProxyRoute godoc
+// @Summary Create proxy route
+// @Tags ProxyRoutes
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param payload body service.ProxyRouteInput true "Proxy route payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/proxy-routes/ [post]
+func CreateProxyRoute(c *gin.Context) {
+	var input service.ProxyRouteInput
+	if err := json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	route, err := service.CreateProxyRoute(input)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    route,
+	})
+}
+
+// UpdateProxyRoute godoc
+// @Summary Update proxy route
+// @Tags ProxyRoutes
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Route ID"
+// @Param payload body service.ProxyRouteInput true "Proxy route payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/proxy-routes/{id} [put]
+func UpdateProxyRoute(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	var input service.ProxyRouteInput
+	if err = json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	route, err := service.UpdateProxyRoute(uint(id), input)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    route,
+	})
+}
+
+// DeleteProxyRoute godoc
+// @Summary Delete proxy route
+// @Tags ProxyRoutes
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Route ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/proxy-routes/{id} [delete]
+func DeleteProxyRoute(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if err = service.DeleteProxyRoute(uint(id)); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+}

openflare_server/controller/response.go

@@ -0,0 +1,74 @@
+package controller
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+const invalidParamsMessage = "鏃犳晥鐨勫弬鏁?"
+
+func respondSuccess(c *gin.Context, data any) {
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    data,
+	})
+}
+
+func respondSuccessWithExtras(c *gin.Context, data any, extras gin.H) {
+	payload := gin.H{
+		"success": true,
+		"message": "",
+		"data":    data,
+	}
+	for key, value := range extras {
+		payload[key] = value
+	}
+	c.JSON(http.StatusOK, payload)
+}
+
+func respondSuccessMessage(c *gin.Context, message string) {
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": message,
+	})
+}
+
+func respondFailure(c *gin.Context, message string) {
+	c.JSON(http.StatusOK, gin.H{
+		"success": false,
+		"message": message,
+	})
+}
+
+func respondBadRequest(c *gin.Context, message string) {
+	if message == "" {
+		message = invalidParamsMessage
+	}
+	c.JSON(http.StatusBadRequest, gin.H{
+		"success": false,
+		"message": message,
+	})
+}
+
+func respondUnauthorized(c *gin.Context, message string) {
+	c.JSON(http.StatusUnauthorized, gin.H{
+		"success": false,
+		"message": message,
+	})
+}
+
+func decodeJSONBody(body io.Reader, target any) error {
+	return json.NewDecoder(body).Decode(target)
+}
+
+func decodeOptionalJSONBody(body io.Reader, target any) error {
+	if err := json.NewDecoder(body).Decode(target); err != nil && !errors.Is(err, io.EOF) {
+		return err
+	}
+	return nil
+}

openflare_server/controller/tls_certificate.go

@@ -0,0 +1,257 @@
+package controller
+
+import (
+	"encoding/json"
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/service"
+	"strconv"
+)
+
+// GetTLSCertificates godoc
+// @Summary List TLS certificates
+// @Tags TLSCertificates
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/tls-certificates/ [get]
+func GetTLSCertificates(c *gin.Context) {
+	certificates, err := service.ListTLSCertificates()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    certificates,
+	})
+}
+
+// GetTLSCertificate godoc
+// @Summary Get TLS certificate detail
+// @Tags TLSCertificates
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Certificate ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/tls-certificates/{id} [get]
+func GetTLSCertificate(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "invalid request",
+		})
+		return
+	}
+
+	certificate, err := service.GetTLSCertificate(uint(id))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    certificate,
+	})
+}
+
+// GetTLSCertificateContent godoc
+// @Summary Get TLS certificate PEM content
+// @Tags TLSCertificates
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Certificate ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/tls-certificates/{id}/content [get]
+func GetTLSCertificateContent(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "invalid request",
+		})
+		return
+	}
+
+	content, err := service.GetTLSCertificateContent(uint(id))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    content,
+	})
+}
+
+// CreateTLSCertificate godoc
+// @Summary Create TLS certificate from PEM
+// @Tags TLSCertificates
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param payload body service.TLSCertificateInput true "TLS certificate payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/tls-certificates/ [post]
+func CreateTLSCertificate(c *gin.Context) {
+	var input service.TLSCertificateInput
+	if err := json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	certificate, err := service.CreateTLSCertificate(input)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    certificate,
+	})
+}
+
+// UpdateTLSCertificate godoc
+// @Summary Update TLS certificate from PEM
+// @Tags TLSCertificates
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Certificate ID"
+// @Param payload body service.TLSCertificateInput true "TLS certificate payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/tls-certificates/{id} [put]
+func UpdateTLSCertificate(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "invalid request",
+		})
+		return
+	}
+
+	var input service.TLSCertificateInput
+	if err = json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "invalid request",
+		})
+		return
+	}
+
+	certificate, err := service.UpdateTLSCertificate(uint(id), input)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    certificate,
+	})
+}
+
+// ImportTLSCertificateFile godoc
+// @Summary Import TLS certificate from files
+// @Tags TLSCertificates
+// @Accept multipart/form-data
+// @Produce json
+// @Security BearerAuth
+// @Param name formData string true "Certificate name"
+// @Param remark formData string false "Remark"
+// @Param cert_file formData file true "Certificate file"
+// @Param key_file formData file true "Private key file"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/tls-certificates/import-file [post]
+func ImportTLSCertificateFile(c *gin.Context) {
+	name := c.PostForm("name")
+	remark := c.PostForm("remark")
+	certFile, err := c.FormFile("cert_file")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "缺少证书文件",
+		})
+		return
+	}
+	keyFile, err := c.FormFile("key_file")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "缺少私钥文件",
+		})
+		return
+	}
+	certificate, err := service.CreateTLSCertificateFromFiles(name, certFile, keyFile, remark)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    certificate,
+	})
+}
+
+// DeleteTLSCertificate godoc
+// @Summary Delete TLS certificate
+// @Tags TLSCertificates
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Certificate ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/tls-certificates/{id} [delete]
+func DeleteTLSCertificate(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if err = service.DeleteTLSCertificate(uint(id)); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+}

openflare_server/controller/update.go

@@ -0,0 +1,196 @@
+package controller
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"openflare/service"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/net/websocket"
+)
+
+type confirmManualUpgradeRequest struct {
+	UploadToken string `json:"upload_token"`
+}
+
+type serverUpgradeRequest struct {
+	Channel string `json:"channel"`
+}
+
+// GetLatestRelease godoc
+// @Summary Get latest GitHub release
+// @Tags Update
+// @Produce json
+// @Success 200 {object} map[string]interface{}
+// @Router /api/update/latest-release [get]
+func GetLatestRelease(c *gin.Context) {
+	release, err := service.GetLatestServerRelease(c.Request.Context(), c.Query("channel"))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    release,
+	})
+}
+
+// UpgradeServer godoc
+// @Summary Upgrade server binary from latest GitHub release
+// @Tags Update
+// @Produce json
+// @Success 200 {object} map[string]interface{}
+// @Router /api/update/upgrade [post]
+func UpgradeServer(c *gin.Context) {
+	var request serverUpgradeRequest
+	if c.Request.ContentLength > 0 {
+		if err := c.ShouldBindJSON(&request); err != nil && !errors.Is(err, io.EOF) {
+			c.JSON(http.StatusBadRequest, gin.H{
+				"success": false,
+				"message": "无效的参数",
+			})
+			return
+		}
+	}
+	release, err := service.ScheduleServerUpgrade(request.Channel)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "服务升级任务已启动，下载完成后将自动重启。",
+		"data":    release,
+	})
+}
+
+// StreamServerUpgradeLogs godoc
+// @Summary Stream server upgrade logs over websocket
+// @Tags Update
+// @Router /api/update/logs/ws [get]
+func StreamServerUpgradeLogs(c *gin.Context) {
+	websocket.Handler(func(conn *websocket.Conn) {
+		defer func() {
+			_ = conn.Close()
+		}()
+
+		updates, unsubscribe := service.SubscribeServerUpgradeStream()
+		defer unsubscribe()
+
+		heartbeatTicker := time.NewTicker(15 * time.Second)
+		defer heartbeatTicker.Stop()
+
+		for {
+			select {
+			case snapshot, ok := <-updates:
+				if !ok {
+					return
+				}
+				if err := websocket.JSON.Send(conn, snapshot); err != nil {
+					return
+				}
+			case <-heartbeatTicker.C:
+				if err := websocket.JSON.Send(conn, service.ServerUpgradeStreamSnapshot{}); err != nil {
+					return
+				}
+			case <-c.Request.Context().Done():
+				return
+			}
+		}
+	}).ServeHTTP(c.Writer, c.Request)
+}
+
+// UploadManualServerBinary godoc
+// @Summary Upload server binary and inspect version before upgrade
+// @Tags Update
+// @Accept mpfd
+// @Produce json
+// @Success 200 {object} map[string]interface{}
+// @Router /api/update/manual-upload [post]
+func UploadManualServerBinary(c *gin.Context) {
+	fileHeader, err := c.FormFile("binary")
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "请先选择要上传的服务端二进制文件。",
+		})
+		return
+	}
+
+	file, err := fileHeader.Open()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "读取上传文件失败。",
+		})
+		return
+	}
+	defer func() {
+		_ = file.Close()
+	}()
+
+	info, err := service.UploadManualServerBinary(c.Request.Context(), fileHeader.Filename, file)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+
+	message := strings.TrimSpace(info.ComparisonMessage)
+	if message == "" {
+		message = "已完成上传并检查升级包版本。"
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": message,
+		"data":    info,
+	})
+}
+
+// ConfirmManualServerUpgrade godoc
+// @Summary Confirm upgrade with previously uploaded server binary
+// @Tags Update
+// @Accept json
+// @Produce json
+// @Success 200 {object} map[string]interface{}
+// @Router /api/update/manual-upgrade [post]
+func ConfirmManualServerUpgrade(c *gin.Context) {
+	var request confirmManualUpgradeRequest
+	if err := c.ShouldBindJSON(&request); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "升级确认参数无效。",
+		})
+		return
+	}
+
+	info, err := service.ConfirmManualServerUpgrade(request.UploadToken)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "服务升级任务已启动，确认无误后将自动重启。",
+		"data":    info,
+	})
+}

openflare_server/controller/user.go

@@ -0,0 +1,661 @@
+package controller
+
+import (
+	"encoding/json"
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"net/http"
+	"openflare/common"
+	"openflare/model"
+	"openflare/utils/security"
+	"openflare/utils/validation"
+	"strconv"
+	"strings"
+)
+
+type LoginRequest struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
+func Login(c *gin.Context) {
+	if !common.PasswordLoginEnabled {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "管理员关闭了密码登录",
+			"success": false,
+		})
+		return
+	}
+	var loginRequest LoginRequest
+	err := json.NewDecoder(c.Request.Body).Decode(&loginRequest)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "无效的参数",
+			"success": false,
+		})
+		return
+	}
+	username := loginRequest.Username
+	password := loginRequest.Password
+	if username == "" || password == "" {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "无效的参数",
+			"success": false,
+		})
+		return
+	}
+	user := model.User{
+		Username: username,
+		Password: password,
+	}
+	err = user.ValidateAndFill()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"message": err.Error(),
+			"success": false,
+		})
+		return
+	}
+	setupLogin(&user, c)
+}
+
+// setup session & cookies and then return user info
+func setupLogin(user *model.User, c *gin.Context) {
+	session := sessions.Default(c)
+	session.Set("id", user.Id)
+	session.Set("username", user.Username)
+	session.Set("role", user.Role)
+	session.Set("status", user.Status)
+	err := session.Save()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "无法保存会话信息，请重试",
+			"success": false,
+		})
+		return
+	}
+	cleanUser := model.User{
+		Id:          user.Id,
+		Username:    user.Username,
+		DisplayName: user.DisplayName,
+		Role:        user.Role,
+		Status:      user.Status,
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"message": "",
+		"success": true,
+		"data":    cleanUser,
+	})
+}
+
+func Logout(c *gin.Context) {
+	session := sessions.Default(c)
+	session.Clear()
+	err := session.Save()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"message": err.Error(),
+			"success": false,
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"message": "",
+		"success": true,
+	})
+}
+
+func Register(c *gin.Context) {
+	if !common.RegisterEnabled {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "管理员关闭了新用户注册",
+			"success": false,
+		})
+		return
+	}
+	if !common.PasswordRegisterEnabled {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "管理员关闭了通过密码进行注册，请使用第三方账户验证的形式进行注册",
+			"success": false,
+		})
+		return
+	}
+	var user model.User
+	err := json.NewDecoder(c.Request.Body).Decode(&user)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if err := validation.Validate.Struct(&user); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "输入不合法 " + err.Error(),
+		})
+		return
+	}
+	if common.EmailVerificationEnabled {
+		if user.Email == "" || user.VerificationCode == "" {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "管理员开启了邮箱验证，请输入邮箱地址和验证码",
+			})
+			return
+		}
+		if !security.VerifyCodeWithKey(user.Email, user.VerificationCode, security.EmailVerificationPurpose) {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "验证码错误或已过期",
+			})
+			return
+		}
+	}
+	cleanUser := model.User{
+		Username:    user.Username,
+		Password:    user.Password,
+		DisplayName: user.Username,
+	}
+	if common.EmailVerificationEnabled {
+		cleanUser.Email = user.Email
+	}
+	if err := cleanUser.Insert(); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}
+
+func GetAllUsers(c *gin.Context) {
+	p, _ := strconv.Atoi(c.Query("p"))
+	if p < 0 {
+		p = 0
+	}
+	users, err := model.GetAllUsers(p*common.ItemsPerPage, common.ItemsPerPage)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    users,
+	})
+	return
+}
+
+func SearchUsers(c *gin.Context) {
+	keyword := c.Query("keyword")
+	users, err := model.SearchUsers(keyword)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    users,
+	})
+	return
+}
+
+func GetUser(c *gin.Context) {
+	id, err := strconv.Atoi(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	user, err := model.GetUserById(id, false)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	myRole := c.GetInt("role")
+	if myRole <= user.Role {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无权获取同级或更高等级用户的信息",
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    user,
+	})
+	return
+}
+
+func GenerateToken(c *gin.Context) {
+	id := c.GetInt("id")
+	user, err := model.GetUserById(id, true)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	user.Token = uuid.New().String()
+	user.Token = strings.Replace(user.Token, "-", "", -1)
+
+	if model.DB.Where("token = ?", user.Token).First(user).RowsAffected != 0 {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "请重试，系统生成的 UUID 竟然重复了！",
+		})
+		return
+	}
+
+	if err := user.Update(false); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    user.Token,
+	})
+	return
+}
+
+func GetSelf(c *gin.Context) {
+	id := c.GetInt("id")
+	user, err := model.GetUserById(id, false)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    user,
+	})
+	return
+}
+
+func UpdateUser(c *gin.Context) {
+	var updatedUser model.User
+	err := json.NewDecoder(c.Request.Body).Decode(&updatedUser)
+	if err != nil || updatedUser.Id == 0 {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if updatedUser.Password == "" {
+		updatedUser.Password = "$I_LOVE_U" // make Validator happy :)
+	}
+	if err := validation.Validate.Struct(&updatedUser); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "输入不合法 " + err.Error(),
+		})
+		return
+	}
+	originUser, err := model.GetUserById(updatedUser.Id, false)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	myRole := c.GetInt("role")
+	if myRole <= originUser.Role {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无权更新同权限等级或更高权限等级的用户信息",
+		})
+		return
+	}
+	if myRole <= updatedUser.Role {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无权将其他用户权限等级提升到大于等于自己的权限等级",
+		})
+		return
+	}
+	if updatedUser.Password == "$I_LOVE_U" {
+		updatedUser.Password = "" // rollback to what it should be
+	}
+	updatePassword := updatedUser.Password != ""
+	if err := updatedUser.Update(updatePassword); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}
+
+func UpdateSelf(c *gin.Context) {
+	var user model.User
+	err := json.NewDecoder(c.Request.Body).Decode(&user)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if user.Password == "" {
+		user.Password = "$I_LOVE_U" // make Validator happy :)
+	}
+	if err := validation.Validate.Struct(&user); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "输入不合法 " + err.Error(),
+		})
+		return
+	}
+
+	cleanUser := model.User{
+		Id:          c.GetInt("id"),
+		Username:    user.Username,
+		Password:    user.Password,
+		DisplayName: user.DisplayName,
+	}
+	if user.Password == "$I_LOVE_U" {
+		user.Password = "" // rollback to what it should be
+		cleanUser.Password = ""
+	}
+	updatePassword := user.Password != ""
+	if err := cleanUser.Update(updatePassword); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}
+
+func DeleteUser(c *gin.Context) {
+	id, err := strconv.Atoi(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	originUser, err := model.GetUserById(id, false)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	myRole := c.GetInt("role")
+	if myRole <= originUser.Role {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无权删除同权限等级或更高权限等级的用户",
+		})
+		return
+	}
+	err = model.DeleteUserById(id)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": true,
+			"message": "",
+		})
+		return
+	}
+}
+
+func DeleteSelf(c *gin.Context) {
+	id := c.GetInt("id")
+	err := model.DeleteUserById(id)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}
+
+func CreateUser(c *gin.Context) {
+	var user model.User
+	err := json.NewDecoder(c.Request.Body).Decode(&user)
+	if err != nil || user.Username == "" || user.Password == "" {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if user.DisplayName == "" {
+		user.DisplayName = user.Username
+	}
+	myRole := c.GetInt("role")
+	if user.Role >= myRole {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无法创建权限大于等于自己的用户",
+		})
+		return
+	}
+	// Even for admin users, we cannot fully trust them!
+	cleanUser := model.User{
+		Username:    user.Username,
+		Password:    user.Password,
+		DisplayName: user.DisplayName,
+	}
+	if err := cleanUser.Insert(); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}
+
+type ManageRequest struct {
+	Username string `json:"username"`
+	Action   string `json:"action"`
+}
+
+// ManageUser Only admin user can do this
+func ManageUser(c *gin.Context) {
+	var req ManageRequest
+	err := json.NewDecoder(c.Request.Body).Decode(&req)
+
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	user := model.User{
+		Username: req.Username,
+	}
+	// Fill attributes
+	model.DB.Where(&user).First(&user)
+	if user.Id == 0 {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "用户不存在",
+		})
+		return
+	}
+	myRole := c.GetInt("role")
+	if myRole <= user.Role && myRole != common.RoleRootUser {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无权更新同权限等级或更高权限等级的用户信息",
+		})
+		return
+	}
+	switch req.Action {
+	case "disable":
+		user.Status = common.UserStatusDisabled
+		if user.Role == common.RoleRootUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无法禁用超级管理员用户",
+			})
+			return
+		}
+	case "enable":
+		user.Status = common.UserStatusEnabled
+	case "delete":
+		if user.Role == common.RoleRootUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无法删除超级管理员用户",
+			})
+			return
+		}
+		if err := user.Delete(); err != nil {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": err.Error(),
+			})
+			return
+		}
+	case "promote":
+		if myRole != common.RoleRootUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "普通管理员用户无法提升其他用户为管理员",
+			})
+			return
+		}
+		if user.Role >= common.RoleAdminUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "该用户已经是管理员",
+			})
+			return
+		}
+		user.Role = common.RoleAdminUser
+	case "demote":
+		if user.Role == common.RoleRootUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无法降级超级管理员用户",
+			})
+			return
+		}
+		if user.Role == common.RoleCommonUser {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "该用户已经是普通用户",
+			})
+			return
+		}
+		user.Role = common.RoleCommonUser
+	}
+
+	if err := user.Update(false); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	clearUser := model.User{
+		Role:   user.Role,
+		Status: user.Status,
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    clearUser,
+	})
+	return
+}
+
+func EmailBind(c *gin.Context) {
+	email := c.Query("email")
+	code := c.Query("code")
+	if !security.VerifyCodeWithKey(email, code, security.EmailVerificationPurpose) {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "验证码错误或已过期",
+		})
+		return
+	}
+	id := c.GetInt("id")
+	user := model.User{
+		Id: id,
+	}
+	err := user.FillUserById()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	user.Email = email
+	// no need to check if this email already taken, because we have used verification code to check it
+	err = user.Update(false)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}

openflare_server/controller/wechat.go

@@ -0,0 +1,164 @@
+package controller
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/common"
+	"openflare/model"
+	"strconv"
+	"time"
+)
+
+type wechatLoginResponse struct {
+	Success bool   `json:"success"`
+	Message string `json:"message"`
+	Data    string `json:"data"`
+}
+
+func getWeChatIdByCode(code string) (string, error) {
+	if code == "" {
+		return "", errors.New("无效的参数")
+	}
+	req, err := http.NewRequest("GET", fmt.Sprintf("%s/api/wechat/user?code=%s", common.WeChatServerAddress, code), nil)
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Authorization", common.WeChatServerToken)
+	client := http.Client{
+		Timeout: 5 * time.Second,
+	}
+	httpResponse, err := client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer httpResponse.Body.Close()
+	var res wechatLoginResponse
+	err = json.NewDecoder(httpResponse.Body).Decode(&res)
+	if err != nil {
+		return "", err
+	}
+	if !res.Success {
+		return "", errors.New(res.Message)
+	}
+	if res.Data == "" {
+		return "", errors.New("验证码错误或已过期")
+	}
+	return res.Data, nil
+}
+
+func WeChatAuth(c *gin.Context) {
+	if !common.WeChatAuthEnabled {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "管理员未开启通过微信登录以及注册",
+			"success": false,
+		})
+		return
+	}
+	code := c.Query("code")
+	wechatId, err := getWeChatIdByCode(code)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"message": err.Error(),
+			"success": false,
+		})
+		return
+	}
+	user := model.User{
+		WeChatId: wechatId,
+	}
+	if model.IsWeChatIdAlreadyTaken(wechatId) {
+		err := user.FillUserByWeChatId()
+		if err != nil {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": err.Error(),
+			})
+			return
+		}
+	} else {
+		if common.RegisterEnabled {
+			user.Username = "wechat_" + strconv.Itoa(model.GetMaxUserId()+1)
+			user.DisplayName = "WeChat User"
+			user.Role = common.RoleCommonUser
+			user.Status = common.UserStatusEnabled
+
+			if err := user.Insert(); err != nil {
+				c.JSON(http.StatusOK, gin.H{
+					"success": false,
+					"message": err.Error(),
+				})
+				return
+			}
+		} else {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "管理员关闭了新用户注册",
+			})
+			return
+		}
+	}
+
+	if user.Status != common.UserStatusEnabled {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "用户已被封禁",
+			"success": false,
+		})
+		return
+	}
+	setupLogin(&user, c)
+}
+
+func WeChatBind(c *gin.Context) {
+	if !common.WeChatAuthEnabled {
+		c.JSON(http.StatusOK, gin.H{
+			"message": "管理员未开启通过微信登录以及注册",
+			"success": false,
+		})
+		return
+	}
+	code := c.Query("code")
+	wechatId, err := getWeChatIdByCode(code)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"message": err.Error(),
+			"success": false,
+		})
+		return
+	}
+	if model.IsWeChatIdAlreadyTaken(wechatId) {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "该微信账号已被绑定",
+		})
+		return
+	}
+	id := c.GetInt("id")
+	user := model.User{
+		Id: id,
+	}
+	err = user.FillUserById()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	user.WeChatId = wechatId
+	err = user.Update(false)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+	return
+}

openflare_server/go.mod

@@ -0,0 +1,77 @@
+module openflare
+
+// +heroku goVersion go1.18
+go 1.24.0
+
+require (
+	github.com/dgraph-io/ristretto/v2 v2.2.0
+	github.com/gin-contrib/cors v1.6.0
+	github.com/gin-contrib/sessions v0.0.5
+	github.com/gin-contrib/static v0.0.1
+	github.com/gin-gonic/gin v1.9.1
+	github.com/glebarez/sqlite v1.11.0
+	github.com/go-playground/validator/v10 v10.19.0
+	github.com/go-redis/redis/v8 v8.11.5
+	github.com/google/uuid v1.3.0
+	github.com/swaggo/files v1.0.1
+	github.com/swaggo/gin-swagger v1.6.1
+	github.com/swaggo/swag v1.8.12
+	golang.org/x/crypto v0.45.0
+	gorm.io/driver/mysql v1.4.3
+	gorm.io/gorm v1.25.7
+)
+
+require (
+	github.com/KyleBanks/depth v1.2.1 // indirect
+	github.com/PuerkitoBio/purell v1.1.1 // indirect
+	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
+	github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff // indirect
+	github.com/bytedance/sonic v1.11.2 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/chenzhuoyu/base64x v0.0.0-20230717121745-296ad89f973d // indirect
+	github.com/chenzhuoyu/iasm v0.9.1 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
+	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/glebarez/go-sqlite v1.21.2 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.19.6 // indirect
+	github.com/go-openapi/spec v0.20.4 // indirect
+	github.com/go-openapi/swag v0.19.15 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-sql-driver/mysql v1.6.0 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/gomodule/redigo v2.0.0+incompatible // indirect
+	github.com/gorilla/context v1.1.1 // indirect
+	github.com/gorilla/securecookie v1.1.1 // indirect
+	github.com/gorilla/sessions v1.2.1 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mailru/easyjson v0.7.6 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/oschwald/maxminddb-golang v1.13.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.1 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.2.12 // indirect
+	golang.org/x/arch v0.7.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	modernc.org/libc v1.22.5 // indirect
+	modernc.org/mathutil v1.5.0 // indirect
+	modernc.org/memory v1.5.0 // indirect
+	modernc.org/sqlite v1.23.1 // indirect
+)

openflare_server/go.sum

@@ -0,0 +1,320 @@
+github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
+github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff h1:RmdPFa+slIr4SCBg4st/l/vZWVe9QJKMXGO60Bxbe04=
+github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff/go.mod h1:+RTT1BOk5P97fT2CiHkbFQwkK3mjsFAP6zCYV2aXtjw=
+github.com/bytedance/sonic v1.5.0/go.mod h1:ED5hyg4y6t3/9Ku1R6dU/4KyJ48DZ4jPhfY1O2AihPM=
+github.com/bytedance/sonic v1.9.1 h1:6iJ6NqdoxCDr6mbY8h18oSO+cShGSMRGCEo7F2h0x8s=
+github.com/bytedance/sonic v1.9.1/go.mod h1:i736AoUSYt75HyZLoJW9ERYxcy6eaN6h4BZXU064P/U=
+github.com/bytedance/sonic v1.10.0-rc/go.mod h1:ElCzW+ufi8qKqNW0FY314xriJhyJhuoJ3gFZdAHF7NM=
+github.com/bytedance/sonic v1.11.2 h1:ywfwo0a/3j9HR8wsYGWsIWl2mvRsI950HyoxiBERw5A=
+github.com/bytedance/sonic v1.11.2/go.mod h1:iZcSUejdk5aukTND/Eu/ivjQuEL0Cu9/rf50Hi0u/g4=
+github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
+github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chenzhuoyu/base64x v0.0.0-20211019084208-fb5309c8db06/go.mod h1:DH46F32mSOjUmXrMHnKwZdA8wcEefY7UVqBKYGjpdQY=
+github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 h1:qSGYFH7+jGhDF8vLC+iwCD4WpbV1EBDSzWkJODFLams=
+github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311/go.mod h1:b583jCggY9gE99b6G5LEC39OIiVsWj+R97kbl5odCEk=
+github.com/chenzhuoyu/base64x v0.0.0-20230717121745-296ad89f973d h1:77cEq6EriyTZ0g/qfRdp61a3Uu/AWrgIq2s0ClJV1g0=
+github.com/chenzhuoyu/base64x v0.0.0-20230717121745-296ad89f973d/go.mod h1:8EPpVsBuRksnlj1mLy4AWzRNQYxauNi62uWcE3to6eA=
+github.com/chenzhuoyu/iasm v0.9.0/go.mod h1:Xjy2NpN3h7aUqeqM+woSuuvxmIe6+DDsiNLIrkAmYog=
+github.com/chenzhuoyu/iasm v0.9.1 h1:tUHQJXo3NhBqw6s33wkGn9SP3bvrWLdlVIJ3hQBL7P0=
+github.com/chenzhuoyu/iasm v0.9.1/go.mod h1:Xjy2NpN3h7aUqeqM+woSuuvxmIe6+DDsiNLIrkAmYog=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgraph-io/ristretto/v2 v2.2.0 h1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=
+github.com/dgraph-io/ristretto/v2 v2.2.0/go.mod h1:RZrm63UmcBAaYWC1DotLYBmTvgkrs0+XhBd7Npn7/zI=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
+github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
+github.com/gin-contrib/cors v1.4.0 h1:oJ6gwtUl3lqV0WEIwM/LxPF1QZ5qe2lGWdY2+bz7y0g=
+github.com/gin-contrib/cors v1.4.0/go.mod h1:bs9pNM0x/UsmHPBWT2xZz9ROh8xYjYkiURUfmBoMlcs=
+github.com/gin-contrib/cors v1.6.0 h1:0Z7D/bVhE6ja07lI8CTjTonp6SB07o8bNuFyRbsBUQg=
+github.com/gin-contrib/cors v1.6.0/go.mod h1:cI+h6iOAyxKRtUtC6iF/Si1KSFvGm/gK+kshxlCi8ro=
+github.com/gin-contrib/gzip v0.0.6 h1:NjcunTcGAj5CO1gn4N8jHOSIeRFHIbn51z6K+xaN4d4=
+github.com/gin-contrib/gzip v0.0.6/go.mod h1:QOJlmV2xmayAjkNS2Y8NQsMneuRShOU/kjovCXNuzzk=
+github.com/gin-contrib/sessions v0.0.5 h1:CATtfHmLMQrMNpJRgzjWXD7worTh7g7ritsQfmF+0jE=
+github.com/gin-contrib/sessions v0.0.5/go.mod h1:vYAuaUPqie3WUSsft6HUlCjlwwoJQs97miaG2+7neKY=
+github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
+github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
+github.com/gin-contrib/static v0.0.1 h1:JVxuvHPuUfkoul12N7dtQw7KRn/pSMq7Ue1Va9Swm1U=
+github.com/gin-contrib/static v0.0.1/go.mod h1:CSxeF+wep05e0kCOsqWdAWbSszmc31zTIbD8TvWl7Hs=
+github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
+github.com/gin-gonic/gin v1.8.1/go.mod h1:ji8BvRH1azfM+SYow9zQ6SZMvR8qOMZHmsCuWR9tTTk=
+github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
+github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL7YrpYKXt5YId3A/Tnip5kqbEAP+KLuI3SUcPTeU=
+github.com/glebarez/go-sqlite v1.21.2 h1:3a6LFC4sKahUunAmynQKLZceZCOzUthkRkEAl9gAXWo=
+github.com/glebarez/go-sqlite v1.21.2/go.mod h1:sfxdZyhQjTM2Wry3gVYWaW072Ri1WMdWJi0k6+3382k=
+github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GMw=
+github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
+github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonreference v0.19.6 h1:UBIxjkht+AWIgYzCDSv2GN+E/togfwXUJFRTWhl2Jjs=
+github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
+github.com/go-openapi/spec v0.20.4 h1:O8hJrt0UMnhHcluhIdUgCLRWyM2x7QkBXRvOs7m+O1M=
+github.com/go-openapi/spec v0.20.4/go.mod h1:faYFR1CvsJZ0mNsmsphTMSoRrNV3TEDoAM7FOEWeq8I=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.15 h1:D2NRCBzS9/pEY3gP9Nl8aDqGUcPFrwG2p+CNFrLyrCM=
+github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
+github.com/go-playground/locales v0.14.0/go.mod h1:sawfccIbzZTqEDETgFXqTho0QybSa7l++s0DH+LDiLs=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
+github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
+github.com/go-playground/validator/v10 v10.10.0/go.mod h1:74x4gJWsvQexRdW8Pn3dXSGrTK4nAUsbPlLADvpJkos=
+github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg/+t63MyGU2n5js=
+github.com/go-playground/validator/v10 v10.14.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
+github.com/go-playground/validator/v10 v10.19.0 h1:ol+5Fu+cSq9JD7SoSqe04GMI92cbn0+wvQ3bZ8b/AU4=
+github.com/go-playground/validator/v10 v10.19.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
+github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
+github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
+github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/goccy/go-json v0.9.7/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/gomodule/redigo v2.0.0+incompatible h1:K/R+8tc58AaqLkqG2Ol3Qk+DR/TlNuhuh457pBFPtt0=
+github.com/gomodule/redigo v2.0.0+incompatible/go.mod h1:B4C85qUVwatsJoIUNIfCRsp7qO0iAmpGFZ4EELWSbC4=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
+github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
+github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.1.1/go.mod h1:8KCfur6+4Mqcc6S0FEfKuN15Vl5MgXW92AE8ovaJD0w=
+github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.4/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
+github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.4 h1:acbojRNwl3o09bUq+yDCtZFc1aiwaAAxtcn8YkZXnvk=
+github.com/klauspost/cpuid/v2 v2.2.4/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
+github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
+github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
+github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
+github.com/leodido/go-urn v1.2.4 h1:XlAE/cm/ms7TE/VMVoduSpNBoyc2dOxHs5MZSwAN63Q=
+github.com/leodido/go-urn v1.2.4/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA=
+github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
+github.com/onsi/gomega v1.18.1 h1:M1GfJqGRrBrrGGsbxzV5dqM2U2ApXefZCQpkukxYRLE=
+github.com/onsi/gomega v1.18.1/go.mod h1:0q+aL8jAiMXy9hbwj2mr5GziHiwhAIQpFmmtT5hitRs=
+github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5MbwsmL4MRQE=
+github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
+github.com/pelletier/go-toml/v2 v2.0.1/go.mod h1:r9LEWfGN8R5k0VXJ+0BkIe7MYkRdwZOjgMj2KwnJFUo=
+github.com/pelletier/go-toml/v2 v2.0.8 h1:0ctb6s9mE31h0/lhu+J6OPmVeDxJn+kYnJc2jZR9tGQ=
+github.com/pelletier/go-toml/v2 v2.0.8/go.mod h1:vuYfssBdrU2XDZ9bYydBu6t+6a6PYNcZljzZR9VXg+4=
+github.com/pelletier/go-toml/v2 v2.1.1 h1:LWAJwfNvjQZCFIDKWYQaM62NcYeYViCmWIwmOStowAI=
+github.com/pelletier/go-toml/v2 v2.1.1/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
+github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/swaggo/files v1.0.1 h1:J1bVJ4XHZNq0I46UU90611i9/YzdrF7x92oX1ig5IdE=
+github.com/swaggo/files v1.0.1/go.mod h1:0qXmMNH6sXNf+73t65aKeB+ApmgxdnkQzVTAj2uaMUg=
+github.com/swaggo/gin-swagger v1.6.1 h1:Ri06G4gc9N4t4k8hekMigJ9zKTFSlqj/9paAQCQs7cY=
+github.com/swaggo/gin-swagger v1.6.1/go.mod h1:LQ+hJStHakCWRiK/YNYtJOu4mR2FP+pxLnILT/qNiTw=
+github.com/swaggo/swag v1.8.12 h1:pctzkNPu0AlQP2royqX3apjKCQonAnf7KGoxeO4y64w=
+github.com/swaggo/swag v1.8.12/go.mod h1:lNfm6Gg+oAq3zRJQNEMBE66LIJKM44mxFqhEEgy2its=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
+github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
+github.com/ugorji/go v1.2.7/go.mod h1:nF9osbDWLy6bDVv/Rtoh6QgnvNDpmCalQV5urGCCS6M=
+github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
+github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95kRgeqEY=
+github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
+github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
+github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
+golang.org/x/arch v0.3.0 h1:02VY4/ZcO/gBOH6PUaoiptASxtXU10jazRCP865E97k=
+golang.org/x/arch v0.3.0/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
+golang.org/x/arch v0.7.0 h1:pskyeJh/3AmoQ8CPE95vxHLqp1G1GfGNXTmcl9NEKTc=
+golang.org/x/arch v0.7.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210420072515-93ed5bcd2bfe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/driver/mysql v1.4.3 h1:/JhWJhO2v17d8hjApTltKNADm7K7YI2ogkR7avJUL3k=
+gorm.io/driver/mysql v1.4.3/go.mod h1:sSIebwZAVPiT+27jK9HIwvsqOGKx3YMPmrA3mBJR10c=
+gorm.io/gorm v1.23.8/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
+gorm.io/gorm v1.25.7 h1:VsD6acwRjz2zFxGO50gPO6AkNs7KKnvfzUjHQhZDz/A=
+gorm.io/gorm v1.25.7/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
+modernc.org/libc v1.22.5 h1:91BNch/e5B0uPbJFgqbxXuOnxBQjlS//icfQEGmvyjE=
+modernc.org/libc v1.22.5/go.mod h1:jj+Z7dTNX8fBScMVNRAYZ/jF91K8fdT2hYMThc3YjBY=
+modernc.org/mathutil v1.5.0 h1:rV0Ko/6SfM+8G+yKiyI830l3Wuz1zRutdslNoQ0kfiQ=
+modernc.org/mathutil v1.5.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
+modernc.org/memory v1.5.0 h1:N+/8c5rE6EqugZwHii4IFsaJ7MUhoWX07J5tC/iI5Ds=
+modernc.org/memory v1.5.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
+modernc.org/sqlite v1.23.1 h1:nrSBg4aRQQwq59JpvGEQ15tNxoO5pX/kUjcRNwSAGQM=
+modernc.org/sqlite v1.23.1/go.mod h1:OrDj17Mggn6MhE+iPbBNf7RGKODDE9NFT0f3EwDzJqk=
+nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
+rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=

openflare_server/main.go

@@ -0,0 +1,104 @@
+package main
+
+import (
+	"embed"
+	"fmt"
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-contrib/sessions/cookie"
+	"github.com/gin-contrib/sessions/redis"
+	"github.com/gin-gonic/gin"
+	"log/slog"
+	"openflare/common"
+	_ "openflare/docs"
+	"openflare/middleware"
+	"openflare/model"
+	"openflare/router"
+	"openflare/utils/geoip"
+	"os"
+	"strconv"
+)
+
+//go:embed all:web/build
+var buildFS embed.FS
+
+//go:embed web/build/index.html
+var indexPage []byte
+
+// @title OpenFlare Server API
+// @version 3.0
+// @description OpenFlare Server 管理端与 Agent API 文档。
+// @BasePath /
+// @schemes http https
+// @securityDefinitions.apikey BearerAuth
+// @in header
+// @name Authorization
+// @description 管理端可使用 Bearer Token，例如：Bearer <token>
+// @securityDefinitions.apikey AgentTokenAuth
+// @in header
+// @name X-Agent-Token
+// @description Agent API 使用节点专属 Agent Token 或全局 Discovery Token
+func main() {
+	common.SetupGinLog()
+	slog.Info("OpenFlare started", "version", common.Version)
+	if os.Getenv("GIN_MODE") != "debug" {
+		gin.SetMode(gin.ReleaseMode)
+	}
+	// Initialize SQL Database
+	err := model.InitDB()
+	if err != nil {
+		slog.Error("initialize database failed", "error", err)
+		os.Exit(1)
+	}
+	defer func() {
+		err := model.CloseDB()
+		if err != nil {
+			slog.Error("close database failed", "error", err)
+			os.Exit(1)
+		}
+	}()
+
+	// Initialize Redis
+	err = common.InitRedisClient()
+	if err != nil {
+		slog.Error("initialize redis failed", "error", err)
+		os.Exit(1)
+	}
+
+	// Initialize options
+	model.InitOptionMap()
+	geoip.InitGeoIP()
+
+	// Initialize HTTP server
+	server := gin.Default()
+	//server.Use(gzip.Gzip(gzip.DefaultCompression))
+	server.Use(middleware.CORS())
+
+	// Initialize session store
+	if common.RedisEnabled {
+		opt := common.ParseRedisOption()
+		store, _ := redis.NewStore(opt.MinIdleConns, opt.Network, opt.Addr, opt.Password, []byte(common.SessionSecret))
+		server.Use(sessions.Sessions("session", store))
+	} else {
+		store := cookie.NewStore([]byte(common.SessionSecret))
+		server.Use(sessions.Sessions("session", store))
+	}
+
+	router.SetRouter(server, buildFS, indexPage)
+	var port = os.Getenv("PORT")
+	if port == "" {
+		port = strconv.Itoa(*common.Port)
+	}
+	slog.Info("server config", "port", port, "gin_mode", gin.Mode(), "log_level", common.GetLogLevel(), "sqlite_path", common.SQLitePath, "redis_enabled", common.RedisEnabled, "upload_path", common.UploadPath, "log_dir", valueOrDefault(*common.LogDir, "stdout"), "agent_token_configured", common.AgentToken != "", "node_offline_threshold", common.NodeOfflineThreshold)
+	slog.Info("server listening", "address", fmt.Sprintf(":%s", port))
+	err = server.Run(":" + port)
+	if err != nil {
+		slog.Error("server run failed", "error", err)
+	}
+}
+
+func valueOrDefault(value string, fallback string) string {
+	if value == "" {
+		return fallback
+	}
+	return value
+}

openflare_server/middleware/agent-auth.go

@@ -0,0 +1,45 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/service"
+)
+
+func AgentAuth() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		token := c.GetHeader("X-Agent-Token")
+		node, err := service.AuthenticateAgentToken(token)
+		if err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{
+				"success": false,
+				"message": "无权进行此操作，Agent Token 无效",
+			})
+			c.Abort()
+			return
+		}
+		c.Set("agent_node", node)
+		c.Next()
+	}
+}
+
+func AgentRegisterAuth() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		token := c.GetHeader("X-Agent-Token")
+		if node, err := service.AuthenticateAgentToken(token); err == nil {
+			c.Set("agent_node", node)
+			c.Next()
+			return
+		}
+		if err := service.ValidateDiscoveryToken(token); err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{
+				"success": false,
+				"message": "无权进行此操作，注册 Token 无效",
+			})
+			c.Abort()
+			return
+		}
+		c.Set("discovery_enabled", true)
+		c.Next()
+	}
+}

openflare_server/middleware/auth.go

@@ -0,0 +1,117 @@
+package middleware
+
+import (
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/common"
+	"openflare/model"
+)
+
+func authHelper(c *gin.Context, minRole int) {
+	session := sessions.Default(c)
+	username := session.Get("username")
+	role := session.Get("role")
+	id := session.Get("id")
+	status := session.Get("status")
+	authByToken := false
+	if username == nil {
+		// Check token
+		token := c.Request.Header.Get("Authorization")
+		if token == "" {
+			c.JSON(http.StatusUnauthorized, gin.H{
+				"success": false,
+				"message": "无权进行此操作，未登录或 token 无效",
+			})
+			c.Abort()
+			return
+		}
+		user := model.ValidateUserToken(token)
+		if user != nil && user.Username != "" {
+			// Token is valid
+			username = user.Username
+			role = user.Role
+			id = user.Id
+			status = user.Status
+		} else {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "无权进行此操作，token 无效",
+			})
+			c.Abort()
+			return
+		}
+		authByToken = true
+	}
+	if status.(int) == common.UserStatusDisabled {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "用户已被封禁",
+		})
+		c.Abort()
+		return
+	}
+	if role.(int) < minRole {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": "无权进行此操作，权限不足",
+		})
+		c.Abort()
+		return
+	}
+	c.Set("username", username)
+	c.Set("role", role)
+	c.Set("id", id)
+	c.Set("authByToken", authByToken)
+	c.Next()
+}
+
+func UserAuth() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		authHelper(c, common.RoleCommonUser)
+	}
+}
+
+func AdminAuth() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		authHelper(c, common.RoleAdminUser)
+	}
+}
+
+func RootAuth() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		authHelper(c, common.RoleRootUser)
+	}
+}
+
+// NoTokenAuth You should always use this after normal auth middlewares.
+func NoTokenAuth() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		authByToken := c.GetBool("authByToken")
+		if authByToken {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "本接口不支持使用 token 进行验证",
+			})
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
+// TokenOnlyAuth You should always use this after normal auth middlewares.
+func TokenOnlyAuth() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		authByToken := c.GetBool("authByToken")
+		if !authByToken {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": "本接口仅支持使用 token 进行验证",
+			})
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}

openflare_server/middleware/cache.go

@@ -0,0 +1,37 @@
+package middleware
+
+import (
+	"path"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+func Cache() func(c *gin.Context) {
+	return func(c *gin.Context) {
+		requestPath := c.Request.URL.Path
+
+		switch {
+		case strings.HasPrefix(requestPath, "/_next/static/"):
+			c.Header("Cache-Control", "public, max-age=31536000, immutable")
+		case isStaticPublicAsset(requestPath):
+			c.Header("Cache-Control", "public, max-age=86400")
+		default:
+			c.Header("Cache-Control", "no-store, no-cache, must-revalidate")
+			c.Header("Pragma", "no-cache")
+			c.Header("Expires", "0")
+		}
+
+		c.Next()
+	}
+}
+
+func isStaticPublicAsset(requestPath string) bool {
+	ext := strings.ToLower(path.Ext(requestPath))
+	switch ext {
+	case ".ico", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".css", ".js":
+		return true
+	default:
+		return false
+	}
+}

openflare_server/middleware/cors.go

@@ -0,0 +1,12 @@
+package middleware
+
+import (
+	"github.com/gin-contrib/cors"
+	"github.com/gin-gonic/gin"
+)
+
+func CORS() gin.HandlerFunc {
+	config := cors.DefaultConfig()
+	config.AllowOrigins = []string{"https://openflare.vercel.app", "http://localhost:3000"}
+	return cors.New(config)
+}

openflare_server/middleware/rate-limit.go

@@ -0,0 +1,104 @@
+package middleware
+
+import (
+	"context"
+	"github.com/gin-gonic/gin"
+	"log/slog"
+	"net/http"
+	"openflare/common"
+	"openflare/utils/ratelimit"
+	"time"
+)
+
+var timeFormat = "2006-01-02T15:04:05.000Z"
+
+var inMemoryRateLimiter ratelimit.InMemoryRateLimiter
+
+func redisRateLimiter(c *gin.Context, maxRequestNum int, duration int64, mark string) {
+	ctx := context.Background()
+	rdb := common.RDB
+	key := "rateLimit:" + mark + c.ClientIP()
+	listLength, err := rdb.LLen(ctx, key).Result()
+	if err != nil {
+		slog.Error("redis rate limiter llen failed", "error", err)
+		c.Status(http.StatusInternalServerError)
+		c.Abort()
+		return
+	}
+	if listLength < int64(maxRequestNum) {
+		rdb.LPush(ctx, key, time.Now().Format(timeFormat))
+		rdb.Expire(ctx, key, common.RateLimitKeyExpirationDuration)
+	} else {
+		oldTimeStr, _ := rdb.LIndex(ctx, key, -1).Result()
+		oldTime, err := time.Parse(timeFormat, oldTimeStr)
+		if err != nil {
+			slog.Error("parse redis rate limiter old timestamp failed", "error", err)
+			c.Status(http.StatusInternalServerError)
+			c.Abort()
+			return
+		}
+		nowTimeStr := time.Now().Format(timeFormat)
+		nowTime, err := time.Parse(timeFormat, nowTimeStr)
+		if err != nil {
+			slog.Error("parse redis rate limiter current timestamp failed", "error", err)
+			c.Status(http.StatusInternalServerError)
+			c.Abort()
+			return
+		}
+		// time.Since will return negative number!
+		// See: https://stackoverflow.com/questions/50970900/why-is-time-since-returning-negative-durations-on-windows
+		if int64(nowTime.Sub(oldTime).Seconds()) < duration {
+			rdb.Expire(ctx, key, common.RateLimitKeyExpirationDuration)
+			c.Status(http.StatusTooManyRequests)
+			c.Abort()
+			return
+		} else {
+			rdb.LPush(ctx, key, time.Now().Format(timeFormat))
+			rdb.LTrim(ctx, key, 0, int64(maxRequestNum-1))
+			rdb.Expire(ctx, key, common.RateLimitKeyExpirationDuration)
+		}
+	}
+}
+
+func memoryRateLimiter(c *gin.Context, maxRequestNum int, duration int64, mark string) {
+	key := mark + c.ClientIP()
+	if !inMemoryRateLimiter.Request(key, maxRequestNum, duration) {
+		c.Status(http.StatusTooManyRequests)
+		c.Abort()
+		return
+	}
+}
+
+func rateLimitFactory(maxRequestNum int, duration int64, mark string) func(c *gin.Context) {
+	if common.RedisEnabled {
+		return func(c *gin.Context) {
+			redisRateLimiter(c, maxRequestNum, duration, mark)
+		}
+	} else {
+		// It's safe to call multi times.
+		inMemoryRateLimiter.Init(common.RateLimitKeyExpirationDuration)
+		return func(c *gin.Context) {
+			memoryRateLimiter(c, maxRequestNum, duration, mark)
+		}
+	}
+}
+
+func GlobalWebRateLimit() func(c *gin.Context) {
+	return rateLimitFactory(common.GlobalWebRateLimitNum, common.GlobalWebRateLimitDuration, "GW")
+}
+
+func GlobalAPIRateLimit() func(c *gin.Context) {
+	return rateLimitFactory(common.GlobalApiRateLimitNum, common.GlobalApiRateLimitDuration, "GA")
+}
+
+func CriticalRateLimit() func(c *gin.Context) {
+	return rateLimitFactory(common.CriticalRateLimitNum, common.CriticalRateLimitDuration, "CT")
+}
+
+func DownloadRateLimit() func(c *gin.Context) {
+	return rateLimitFactory(common.DownloadRateLimitNum, common.DownloadRateLimitDuration, "DW")
+}
+
+func UploadRateLimit() func(c *gin.Context) {
+	return rateLimitFactory(common.UploadRateLimitNum, common.UploadRateLimitDuration, "UP")
+}

openflare_server/middleware/turnstile-check.go

@@ -0,0 +1,81 @@
+package middleware
+
+import (
+	"encoding/json"
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-gonic/gin"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"openflare/common"
+)
+
+type turnstileCheckResponse struct {
+	Success bool `json:"success"`
+}
+
+func TurnstileCheck() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if common.TurnstileCheckEnabled {
+			session := sessions.Default(c)
+			turnstileChecked := session.Get("turnstile")
+			if turnstileChecked != nil {
+				c.Next()
+				return
+			}
+			response := c.Query("turnstile")
+			if response == "" {
+				c.JSON(http.StatusOK, gin.H{
+					"success": false,
+					"message": "Turnstile token 为空",
+				})
+				c.Abort()
+				return
+			}
+			rawRes, err := http.PostForm("https://challenges.cloudflare.com/turnstile/v0/siteverify", url.Values{
+				"secret":   {common.TurnstileSecretKey},
+				"response": {response},
+				"remoteip": {c.ClientIP()},
+			})
+			if err != nil {
+				slog.Error("turnstile verification request failed", "error", err)
+				c.JSON(http.StatusOK, gin.H{
+					"success": false,
+					"message": err.Error(),
+				})
+				c.Abort()
+				return
+			}
+			defer rawRes.Body.Close()
+			var res turnstileCheckResponse
+			err = json.NewDecoder(rawRes.Body).Decode(&res)
+			if err != nil {
+				slog.Error("decode turnstile verification response failed", "error", err)
+				c.JSON(http.StatusOK, gin.H{
+					"success": false,
+					"message": err.Error(),
+				})
+				c.Abort()
+				return
+			}
+			if !res.Success {
+				c.JSON(http.StatusOK, gin.H{
+					"success": false,
+					"message": "Turnstile 校验失败，请刷新重试！",
+				})
+				c.Abort()
+				return
+			}
+			session.Set("turnstile", true)
+			err = session.Save()
+			if err != nil {
+				c.JSON(http.StatusOK, gin.H{
+					"message": "无法保存会话信息，请重试",
+					"success": false,
+				})
+				return
+			}
+		}
+		c.Next()
+	}
+}

openflare_server/model/apply_log.go

@@ -0,0 +1,51 @@
+package model
+
+import "time"
+
+type ApplyLog struct {
+	ID                  uint      `json:"id" gorm:"primaryKey"`
+	NodeID              string    `json:"node_id" gorm:"index;size:64;not null"`
+	Version             string    `json:"version" gorm:"size:32;not null"`
+	Result              string    `json:"result" gorm:"size:32;not null"`
+	Message             string    `json:"message" gorm:"size:1024"`
+	Checksum            string    `json:"checksum" gorm:"size:64;not null;default:''"`
+	MainConfigChecksum  string    `json:"main_config_checksum" gorm:"size:64;not null;default:''"`
+	RouteConfigChecksum string    `json:"route_config_checksum" gorm:"size:64;not null;default:''"`
+	SupportFileCount    int       `json:"support_file_count" gorm:"not null;default:0"`
+	CreatedAt           time.Time `json:"created_at"`
+}
+
+func ListApplyLogs(nodeID string) (logs []*ApplyLog, err error) {
+	query := DB.Order("id desc")
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+	err = query.Find(&logs).Error
+	return logs, err
+}
+
+func GetLatestApplyLog(nodeID string) (*ApplyLog, error) {
+	log := &ApplyLog{}
+	err := DB.Where("node_id = ?", nodeID).Order("id desc").First(log).Error
+	return log, err
+}
+
+func GetLatestApplyLogsByNodeIDs(nodeIDs []string) (map[string]*ApplyLog, error) {
+	result := make(map[string]*ApplyLog)
+	if len(nodeIDs) == 0 {
+		return result, nil
+	}
+
+	var logs []*ApplyLog
+	subQuery := DB.Model(&ApplyLog{}).
+		Select("MAX(id) AS id").
+		Where("node_id IN ?", nodeIDs).
+		Group("node_id")
+	if err := DB.Where("id IN (?)", subQuery).Find(&logs).Error; err != nil {
+		return nil, err
+	}
+	for _, log := range logs {
+		result[log.NodeID] = log
+	}
+	return result, nil
+}

openflare_server/model/config_version.go

@@ -0,0 +1,33 @@
+package model
+
+import "time"
+
+type ConfigVersion struct {
+	ID               uint      `json:"id" gorm:"primaryKey"`
+	Version          string    `json:"version" gorm:"uniqueIndex;size:32;not null"`
+	SnapshotJSON     string    `json:"snapshot_json" gorm:"type:text;not null"`
+	MainConfig       string    `json:"main_config" gorm:"type:text;not null;default:''"`
+	RenderedConfig   string    `json:"rendered_config" gorm:"type:text;not null"`
+	SupportFilesJSON string    `json:"support_files_json" gorm:"type:text;not null;default:'[]'"`
+	Checksum         string    `json:"checksum" gorm:"size:64;not null"`
+	IsActive         bool      `json:"is_active" gorm:"not null;default:false;index"`
+	CreatedBy        string    `json:"created_by" gorm:"size:64;not null"`
+	CreatedAt        time.Time `json:"created_at"`
+}
+
+func ListConfigVersions() (versions []*ConfigVersion, err error) {
+	err = DB.Order("id desc").Find(&versions).Error
+	return versions, err
+}
+
+func GetConfigVersionByID(id uint) (*ConfigVersion, error) {
+	version := &ConfigVersion{}
+	err := DB.First(version, id).Error
+	return version, err
+}
+
+func GetActiveConfigVersion() (*ConfigVersion, error) {
+	version := &ConfigVersion{}
+	err := DB.Where("is_active = ?", true).Order("id desc").First(version).Error
+	return version, err
+}

openflare_server/model/file.go

@@ -0,0 +1,50 @@
+package model
+
+import (
+	"gorm.io/gorm"
+	"openflare/common"
+	"os"
+	"path"
+)
+
+type File struct {
+	Id              int    `json:"id"`
+	Filename        string `json:"filename" gorm:"index"`
+	Description     string `json:"description"`
+	Uploader        string `json:"uploader"  gorm:"index"`
+	UploaderId      int    `json:"uploader_id"  gorm:"index"`
+	Link            string `json:"link" gorm:"unique;index"`
+	UploadTime      string `json:"upload_time"`
+	DownloadCounter int    `json:"download_counter"`
+}
+
+func GetAllFiles(startIdx int, num int) ([]*File, error) {
+	var files []*File
+	var err error
+	err = DB.Order("id desc").Limit(num).Offset(startIdx).Find(&files).Error
+	return files, err
+}
+
+func SearchFiles(keyword string) (files []*File, err error) {
+	err = DB.Select([]string{"id", "filename", "description", "uploader", "uploader_id", "link", "upload_time", "download_counter"}).Where(
+		"filename LIKE ? or uploader LIKE ? or uploader_id = ?", keyword+"%", keyword+"%", keyword).Find(&files).Error
+	return files, err
+}
+
+func (file *File) Insert() error {
+	var err error
+	err = DB.Create(file).Error
+	return err
+}
+
+// Delete Make sure link is valid! Because we will use os.Remove to delete it!
+func (file *File) Delete() error {
+	var err error
+	err = DB.Delete(file).Error
+	err = os.Remove(path.Join(common.UploadPath, file.Link))
+	return err
+}
+
+func UpdateDownloadCounter(link string) {
+	DB.Model(&File{}).Where("link = ?", link).UpdateColumn("download_counter", gorm.Expr("download_counter + 1"))
+}

openflare_server/model/main.go

@@ -0,0 +1,142 @@
+package model
+
+import (
+	"github.com/glebarez/sqlite"
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+	"log/slog"
+	"openflare/common"
+	"openflare/utils/security"
+	"os"
+)
+
+var DB *gorm.DB
+
+func migrateProxyRouteEnableHTTPSColumn(db *gorm.DB) error {
+	if !db.Migrator().HasTable(&ProxyRoute{}) {
+		return nil
+	}
+	if db.Migrator().HasColumn(&ProxyRoute{}, "enable_https") || !db.Migrator().HasColumn(&ProxyRoute{}, "enable_http_s") {
+		return nil
+	}
+	return db.Migrator().RenameColumn(&ProxyRoute{}, "enable_http_s", "enable_https")
+}
+
+func createRootAccountIfNeed() error {
+	var user User
+	//if user.Status != common.UserStatusEnabled {
+	if err := DB.First(&user).Error; err != nil {
+		slog.Info("no user exists, create a root user", "username", "root")
+		hashedPassword, err := security.Password2Hash("123456")
+		if err != nil {
+			return err
+		}
+		rootUser := User{
+			Username:    "root",
+			Password:    hashedPassword,
+			Role:        common.RoleRootUser,
+			Status:      common.UserStatusEnabled,
+			DisplayName: "Root User",
+		}
+		DB.Create(&rootUser)
+	}
+	return nil
+}
+
+func CountTable(tableName string) (num int64) {
+	DB.Table(tableName).Count(&num)
+	return
+}
+
+func InitDB() (err error) {
+	var db *gorm.DB
+	if os.Getenv("SQL_DSN") != "" {
+		// Use MySQL
+		db, err = gorm.Open(mysql.Open(os.Getenv("SQL_DSN")), &gorm.Config{
+			PrepareStmt: true, // precompile SQL
+		})
+	} else {
+		// Use SQLite
+		db, err = gorm.Open(sqlite.Open(common.SQLitePath), &gorm.Config{
+			PrepareStmt: true, // precompile SQL
+		})
+		slog.Info("SQL_DSN not set, using SQLite as database")
+	}
+	if err == nil {
+		DB = db
+		if err = migrateProxyRouteEnableHTTPSColumn(db); err != nil {
+			return err
+		}
+		err := db.AutoMigrate(&File{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&User{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&Option{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&ProxyRoute{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&ConfigVersion{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&Node{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&NodeSystemProfile{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&ApplyLog{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&NodeMetricSnapshot{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&NodeRequestReport{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&NodeAccessLog{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&NodeHealthEvent{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&TLSCertificate{})
+		if err != nil {
+			return err
+		}
+		err = db.AutoMigrate(&ManagedDomain{})
+		if err != nil {
+			return err
+		}
+		err = createRootAccountIfNeed()
+		return err
+	} else {
+		slog.Error("open database failed", "error", err)
+		os.Exit(1)
+	}
+	return err
+}
+
+func CloseDB() error {
+	sqlDB, err := DB.DB()
+	if err != nil {
+		return err
+	}
+	err = sqlDB.Close()
+	return err
+}

openflare_server/model/managed_domain.go

@@ -0,0 +1,41 @@
+package model
+
+import "time"
+
+type ManagedDomain struct {
+	ID        uint      `json:"id" gorm:"primaryKey"`
+	Domain    string    `json:"domain" gorm:"uniqueIndex;size:255;not null"`
+	CertID    *uint     `json:"cert_id"`
+	Enabled   bool      `json:"enabled" gorm:"not null;default:true"`
+	Remark    string    `json:"remark" gorm:"size:255"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+func ListManagedDomains() (domains []*ManagedDomain, err error) {
+	err = DB.Order("id desc").Find(&domains).Error
+	return domains, err
+}
+
+func ListEnabledManagedDomainsWithCertificate() (domains []*ManagedDomain, err error) {
+	err = DB.Where("enabled = ? AND cert_id IS NOT NULL", true).Order("id desc").Find(&domains).Error
+	return domains, err
+}
+
+func GetManagedDomainByID(id uint) (*ManagedDomain, error) {
+	domain := &ManagedDomain{}
+	err := DB.First(domain, id).Error
+	return domain, err
+}
+
+func (domain *ManagedDomain) Insert() error {
+	return DB.Create(domain).Error
+}
+
+func (domain *ManagedDomain) Update() error {
+	return DB.Save(domain).Error
+}
+
+func (domain *ManagedDomain) Delete() error {
+	return DB.Delete(domain).Error
+}

openflare_server/model/node.go

@@ -0,0 +1,65 @@
+package model
+
+import "time"
+
+type Node struct {
+	ID                        uint      `json:"id" gorm:"primaryKey"`
+	NodeID                    string    `json:"node_id" gorm:"uniqueIndex;size:64;not null"`
+	Name                      string    `json:"name" gorm:"size:128;not null"`
+	IP                        string    `json:"ip" gorm:"size:64;not null"`
+	GeoName                   string    `json:"geo_name" gorm:"size:128"`
+	GeoLatitude               *float64  `json:"geo_latitude"`
+	GeoLongitude              *float64  `json:"geo_longitude"`
+	GeoManualOverride         bool      `json:"geo_manual_override" gorm:"not null;default:false"`
+	AgentToken                string    `json:"-" gorm:"size:128;index"`
+	AutoUpdateEnabled         bool      `json:"auto_update_enabled" gorm:"not null;default:false"`
+	UpdateRequested           bool      `json:"update_requested" gorm:"not null;default:false"`
+	UpdateChannel             string    `json:"update_channel" gorm:"size:16;not null;default:'stable'"`
+	UpdateTag                 string    `json:"update_tag" gorm:"size:64"`
+	RestartOpenrestyRequested bool      `json:"restart_openresty_requested" gorm:"not null;default:false"`
+	AgentVersion              string    `json:"agent_version" gorm:"size:64;not null"`
+	NginxVersion              string    `json:"nginx_version" gorm:"size:64"`
+	OpenrestyStatus           string    `json:"openresty_status" gorm:"size:16;not null;default:'unknown'"`
+	OpenrestyMessage          string    `json:"openresty_message" gorm:"size:2048"`
+	Status                    string    `json:"status" gorm:"size:16;not null;default:'offline'"`
+	CurrentVersion            string    `json:"current_version" gorm:"size:32"`
+	LastSeenAt                time.Time `json:"last_seen_at"`
+	LastError                 string    `json:"last_error" gorm:"size:1024"`
+	CreatedAt                 time.Time `json:"created_at"`
+	UpdatedAt                 time.Time `json:"updated_at"`
+}
+
+func ListNodes() (nodes []*Node, err error) {
+	err = DB.Order("id desc").Find(&nodes).Error
+	return nodes, err
+}
+
+func GetNodeByNodeID(nodeID string) (*Node, error) {
+	node := &Node{}
+	err := DB.Where("node_id = ?", nodeID).First(node).Error
+	return node, err
+}
+
+func GetNodeByID(id uint) (*Node, error) {
+	node := &Node{}
+	err := DB.First(node, id).Error
+	return node, err
+}
+
+func GetNodeByAgentToken(token string) (*Node, error) {
+	node := &Node{}
+	err := DB.Where("agent_token = ?", token).First(node).Error
+	return node, err
+}
+
+func (node *Node) Insert() error {
+	return DB.Create(node).Error
+}
+
+func (node *Node) Update() error {
+	return DB.Save(node).Error
+}
+
+func (node *Node) Delete() error {
+	return DB.Delete(node).Error
+}

openflare_server/model/node_access_log.go

@@ -0,0 +1,77 @@
+package model
+
+import "time"
+
+type NodeAccessLog struct {
+	ID         uint      `json:"id" gorm:"primaryKey"`
+	NodeID     string    `json:"node_id" gorm:"index;size:64;not null"`
+	LoggedAt   time.Time `json:"logged_at" gorm:"index"`
+	RemoteAddr string    `json:"remote_addr" gorm:"size:128"`
+	Region     string    `json:"region" gorm:"size:128"`
+	Host       string    `json:"host" gorm:"size:255"`
+	Path       string    `json:"path" gorm:"size:2048"`
+	StatusCode int       `json:"status_code"`
+	RawJSON    string    `json:"raw_json" gorm:"type:text"`
+	CreatedAt  time.Time `json:"created_at"`
+}
+
+type NodeAccessLogRegionCount struct {
+	Region string `json:"region"`
+	Count  int64  `json:"count"`
+}
+
+func ListNodeAccessLogs(nodeID string, since time.Time, offset int, limit int) (logs []*NodeAccessLog, err error) {
+	query := DB.Order("logged_at desc, id desc")
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+	if !since.IsZero() {
+		query = query.Where("logged_at >= ?", since)
+	}
+	if offset > 0 {
+		query = query.Offset(offset)
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	err = query.Find(&logs).Error
+	return logs, err
+}
+
+func CountNodeAccessLogs(nodeID string, since time.Time) (totalRecords int64, totalIPs int64, err error) {
+	query := DB.Model(&NodeAccessLog{})
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+	if !since.IsZero() {
+		query = query.Where("logged_at >= ?", since)
+	}
+	if err = query.Count(&totalRecords).Error; err != nil {
+		return 0, 0, err
+	}
+	if err = query.
+		Where("remote_addr <> ''").
+		Distinct("remote_addr").
+		Count(&totalIPs).Error; err != nil {
+		return 0, 0, err
+	}
+	return totalRecords, totalIPs, nil
+}
+
+func ListNodeAccessLogRegionCounts(nodeID string, since time.Time, limit int) (items []*NodeAccessLogRegionCount, err error) {
+	query := DB.Model(&NodeAccessLog{}).
+		Select("region as region, count(*) as count").
+		Where("region <> ''")
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+	if !since.IsZero() {
+		query = query.Where("logged_at >= ?", since)
+	}
+	query = query.Group("region").Order("count desc, region asc")
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	err = query.Scan(&items).Error
+	return items, err
+}

openflare_server/model/node_health_event.go

@@ -0,0 +1,42 @@
+package model
+
+import "time"
+
+type NodeHealthEvent struct {
+	ID               uint       `json:"id" gorm:"primaryKey"`
+	NodeID           string     `json:"node_id" gorm:"index;size:64;not null"`
+	EventType        string     `json:"event_type" gorm:"index;size:64;not null"`
+	Severity         string     `json:"severity" gorm:"size:16;not null"`
+	Status           string     `json:"status" gorm:"index;size:16;not null"`
+	Message          string     `json:"message" gorm:"size:2048"`
+	FirstTriggeredAt time.Time  `json:"first_triggered_at" gorm:"index"`
+	LastTriggeredAt  time.Time  `json:"last_triggered_at" gorm:"index"`
+	ReportedAt       time.Time  `json:"reported_at" gorm:"index"`
+	ResolvedAt       *time.Time `json:"resolved_at" gorm:"index"`
+	RawJSON          string     `json:"raw_json" gorm:"type:text"`
+	CreatedAt        time.Time  `json:"created_at"`
+	UpdatedAt        time.Time  `json:"updated_at"`
+}
+
+func GetActiveNodeHealthEvent(nodeID string, eventType string) (*NodeHealthEvent, error) {
+	event := &NodeHealthEvent{}
+	err := DB.Where("node_id = ? AND event_type = ? AND status = ?", nodeID, eventType, "active").First(event).Error
+	return event, err
+}
+
+func ListNodeHealthEvents(nodeID string, activeOnly bool, limit int) (events []*NodeHealthEvent, err error) {
+	query := DB.Where("node_id = ?", nodeID).Order("last_triggered_at desc")
+	if activeOnly {
+		query = query.Where("status = ?", "active")
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	err = query.Find(&events).Error
+	return events, err
+}
+
+func ListActiveNodeHealthEvents() (events []*NodeHealthEvent, err error) {
+	err = DB.Where("status = ?", "active").Order("last_triggered_at desc").Find(&events).Error
+	return events, err
+}

openflare_server/model/node_metric_snapshot.go

@@ -0,0 +1,48 @@
+package model
+
+import "time"
+
+type NodeMetricSnapshot struct {
+	ID                   uint      `json:"id" gorm:"primaryKey"`
+	NodeID               string    `json:"node_id" gorm:"index;size:64;not null"`
+	CapturedAt           time.Time `json:"captured_at" gorm:"index"`
+	CPUUsagePercent      float64   `json:"cpu_usage_percent"`
+	MemoryUsedBytes      int64     `json:"memory_used_bytes"`
+	MemoryTotalBytes     int64     `json:"memory_total_bytes"`
+	StorageUsedBytes     int64     `json:"storage_used_bytes"`
+	StorageTotalBytes    int64     `json:"storage_total_bytes"`
+	DiskReadBytes        int64     `json:"disk_read_bytes"`
+	DiskWriteBytes       int64     `json:"disk_write_bytes"`
+	NetworkRxBytes       int64     `json:"network_rx_bytes"`
+	NetworkTxBytes       int64     `json:"network_tx_bytes"`
+	OpenrestyRxBytes     int64     `json:"openresty_rx_bytes"`
+	OpenrestyTxBytes     int64     `json:"openresty_tx_bytes"`
+	OpenrestyConnections int64     `json:"openresty_connections"`
+	RawJSON              string    `json:"raw_json" gorm:"type:text"`
+	CreatedAt            time.Time `json:"created_at"`
+}
+
+func (snapshot *NodeMetricSnapshot) Insert() error {
+	return DB.Create(snapshot).Error
+}
+
+func ListNodeMetricSnapshots(nodeID string, since time.Time, limit int) (snapshots []*NodeMetricSnapshot, err error) {
+	query := DB.Where("node_id = ?", nodeID).Order("captured_at desc")
+	if !since.IsZero() {
+		query = query.Where("captured_at >= ?", since)
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	err = query.Find(&snapshots).Error
+	return snapshots, err
+}
+
+func ListMetricSnapshotsSince(since time.Time) (snapshots []*NodeMetricSnapshot, err error) {
+	query := DB.Order("captured_at desc")
+	if !since.IsZero() {
+		query = query.Where("captured_at >= ?", since)
+	}
+	err = query.Find(&snapshots).Error
+	return snapshots, err
+}

openflare_server/model/node_request_report.go

@@ -0,0 +1,43 @@
+package model
+
+import "time"
+
+type NodeRequestReport struct {
+	ID                  uint      `json:"id" gorm:"primaryKey"`
+	NodeID              string    `json:"node_id" gorm:"index;size:64;not null"`
+	WindowStartedAt     time.Time `json:"window_started_at" gorm:"index"`
+	WindowEndedAt       time.Time `json:"window_ended_at" gorm:"index"`
+	RequestCount        int64     `json:"request_count"`
+	ErrorCount          int64     `json:"error_count"`
+	UniqueVisitorCount  int64     `json:"unique_visitor_count"`
+	StatusCodesJSON     string    `json:"status_codes_json" gorm:"type:text"`
+	TopDomainsJSON      string    `json:"top_domains_json" gorm:"type:text"`
+	SourceCountriesJSON string    `json:"source_countries_json" gorm:"type:text"`
+	RawJSON             string    `json:"raw_json" gorm:"type:text"`
+	CreatedAt           time.Time `json:"created_at"`
+}
+
+func (report *NodeRequestReport) Insert() error {
+	return DB.Create(report).Error
+}
+
+func ListNodeRequestReports(nodeID string, since time.Time, limit int) (reports []*NodeRequestReport, err error) {
+	query := DB.Where("node_id = ?", nodeID).Order("window_ended_at desc")
+	if !since.IsZero() {
+		query = query.Where("window_ended_at >= ?", since)
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	err = query.Find(&reports).Error
+	return reports, err
+}
+
+func ListRequestReportsSince(since time.Time) (reports []*NodeRequestReport, err error) {
+	query := DB.Order("window_ended_at desc")
+	if !since.IsZero() {
+		query = query.Where("window_ended_at >= ?", since)
+	}
+	err = query.Find(&reports).Error
+	return reports, err
+}

openflare_server/model/node_system_profile.go

@@ -0,0 +1,56 @@
+package model
+
+import (
+	"time"
+
+	"gorm.io/gorm/clause"
+)
+
+type NodeSystemProfile struct {
+	ID               uint      `json:"id" gorm:"primaryKey"`
+	NodeID           string    `json:"node_id" gorm:"uniqueIndex;size:64;not null"`
+	Hostname         string    `json:"hostname" gorm:"size:255"`
+	OSName           string    `json:"os_name" gorm:"size:128"`
+	OSVersion        string    `json:"os_version" gorm:"size:128"`
+	KernelVersion    string    `json:"kernel_version" gorm:"size:128"`
+	Architecture     string    `json:"architecture" gorm:"size:64"`
+	CPUModel         string    `json:"cpu_model" gorm:"size:255"`
+	CPUCores         int       `json:"cpu_cores"`
+	TotalMemoryBytes int64     `json:"total_memory_bytes"`
+	TotalDiskBytes   int64     `json:"total_disk_bytes"`
+	UptimeSeconds    int64     `json:"uptime_seconds"`
+	ReportedAt       time.Time `json:"reported_at" gorm:"index"`
+	RawJSON          string    `json:"raw_json" gorm:"type:text"`
+	CreatedAt        time.Time `json:"created_at"`
+	UpdatedAt        time.Time `json:"updated_at"`
+}
+
+func GetNodeSystemProfile(nodeID string) (*NodeSystemProfile, error) {
+	profile := &NodeSystemProfile{}
+	err := DB.Where("node_id = ?", nodeID).First(profile).Error
+	return profile, err
+}
+
+func UpsertNodeSystemProfile(profile *NodeSystemProfile) error {
+	if profile == nil {
+		return nil
+	}
+	return DB.Clauses(clause.OnConflict{
+		Columns: []clause.Column{{Name: "node_id"}},
+		DoUpdates: clause.AssignmentColumns([]string{
+			"hostname",
+			"os_name",
+			"os_version",
+			"kernel_version",
+			"architecture",
+			"cpu_model",
+			"cpu_cores",
+			"total_memory_bytes",
+			"total_disk_bytes",
+			"uptime_seconds",
+			"reported_at",
+			"raw_json",
+			"updated_at",
+		}),
+	}).Create(profile).Error
+}

openflare_server/model/option.go

@@ -0,0 +1,380 @@
+package model
+
+import (
+	"openflare/common"
+	"openflare/utils/geoip"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type Option struct {
+	Key   string `json:"key" gorm:"primaryKey"`
+	Value string `json:"value"`
+}
+
+func AllOption() ([]*Option, error) {
+	var options []*Option
+	var err error
+	err = DB.Find(&options).Error
+	return options, err
+}
+
+func InitOptionMap() {
+	common.OptionMapRWMutex.Lock()
+	common.OptionMap = make(map[string]string)
+	common.OptionMap["FileUploadPermission"] = strconv.Itoa(common.FileUploadPermission)
+	common.OptionMap["FileDownloadPermission"] = strconv.Itoa(common.FileDownloadPermission)
+	common.OptionMap["ImageUploadPermission"] = strconv.Itoa(common.ImageUploadPermission)
+	common.OptionMap["ImageDownloadPermission"] = strconv.Itoa(common.ImageDownloadPermission)
+	common.OptionMap["PasswordLoginEnabled"] = strconv.FormatBool(common.PasswordLoginEnabled)
+	common.OptionMap["PasswordRegisterEnabled"] = strconv.FormatBool(common.PasswordRegisterEnabled)
+	common.OptionMap["EmailVerificationEnabled"] = strconv.FormatBool(common.EmailVerificationEnabled)
+	common.OptionMap["GitHubOAuthEnabled"] = strconv.FormatBool(common.GitHubOAuthEnabled)
+	common.OptionMap["WeChatAuthEnabled"] = strconv.FormatBool(common.WeChatAuthEnabled)
+	common.OptionMap["TurnstileCheckEnabled"] = strconv.FormatBool(common.TurnstileCheckEnabled)
+	common.OptionMap["RegisterEnabled"] = strconv.FormatBool(common.RegisterEnabled)
+	common.OptionMap["SMTPServer"] = ""
+	common.OptionMap["SMTPPort"] = strconv.Itoa(common.SMTPPort)
+	common.OptionMap["SMTPAccount"] = ""
+	common.OptionMap["SMTPToken"] = ""
+	common.OptionMap["Notice"] = ""
+	common.OptionMap["About"] = ""
+	common.OptionMap["Footer"] = common.Footer
+	common.OptionMap["HomePageLink"] = common.HomePageLink
+	common.OptionMap["SystemName"] = common.SystemName
+	common.OptionMap["ServerAddress"] = ""
+	common.OptionMap["GitHubClientId"] = ""
+	common.OptionMap["GitHubClientSecret"] = ""
+	common.OptionMap["WeChatServerAddress"] = ""
+	common.OptionMap["WeChatServerToken"] = ""
+	common.OptionMap["WeChatAccountQRCodeImageURL"] = ""
+	common.OptionMap["TurnstileSiteKey"] = ""
+	common.OptionMap["TurnstileSecretKey"] = ""
+	common.OptionMap["AgentDiscoveryToken"] = ""
+	common.OptionMap["AgentHeartbeatInterval"] = strconv.Itoa(common.AgentHeartbeatInterval)
+	common.OptionMap["NodeOfflineThreshold"] = strconv.Itoa(int(common.NodeOfflineThreshold.Milliseconds()))
+	common.OptionMap["AgentUpdateRepo"] = common.AgentUpdateRepo
+	common.OptionMap["GeoIPProvider"] = common.GeoIPProvider
+	common.OptionMap["OpenRestyWorkerProcesses"] = common.OpenRestyWorkerProcesses
+	common.OptionMap["OpenRestyWorkerConnections"] = strconv.Itoa(common.OpenRestyWorkerConnections)
+	common.OptionMap["OpenRestyWorkerRlimitNofile"] = strconv.Itoa(common.OpenRestyWorkerRlimitNofile)
+	common.OptionMap["OpenRestyEventsUse"] = common.OpenRestyEventsUse
+	common.OptionMap["OpenRestyEventsMultiAcceptEnabled"] = strconv.FormatBool(common.OpenRestyEventsMultiAcceptEnabled)
+	common.OptionMap["OpenRestyKeepaliveTimeout"] = strconv.Itoa(common.OpenRestyKeepaliveTimeout)
+	common.OptionMap["OpenRestyKeepaliveRequests"] = strconv.Itoa(common.OpenRestyKeepaliveRequests)
+	common.OptionMap["OpenRestyClientHeaderTimeout"] = strconv.Itoa(common.OpenRestyClientHeaderTimeout)
+	common.OptionMap["OpenRestyClientBodyTimeout"] = strconv.Itoa(common.OpenRestyClientBodyTimeout)
+	common.OptionMap["OpenRestyClientMaxBodySize"] = common.OpenRestyClientMaxBodySize
+	common.OptionMap["OpenRestyLargeClientHeaderBuffers"] = common.OpenRestyLargeClientHeaderBuffers
+	common.OptionMap["OpenRestySendTimeout"] = strconv.Itoa(common.OpenRestySendTimeout)
+	common.OptionMap["OpenRestyProxyConnectTimeout"] = strconv.Itoa(common.OpenRestyProxyConnectTimeout)
+	common.OptionMap["OpenRestyProxySendTimeout"] = strconv.Itoa(common.OpenRestyProxySendTimeout)
+	common.OptionMap["OpenRestyProxyReadTimeout"] = strconv.Itoa(common.OpenRestyProxyReadTimeout)
+	common.OptionMap["OpenRestyWebsocketEnabled"] = strconv.FormatBool(common.OpenRestyWebsocketEnabled)
+	common.OptionMap["OpenRestyProxyRequestBufferingEnabled"] = strconv.FormatBool(common.OpenRestyProxyRequestBufferingEnabled)
+	common.OptionMap["OpenRestyProxyBufferingEnabled"] = strconv.FormatBool(common.OpenRestyProxyBufferingEnabled)
+	common.OptionMap["OpenRestyProxyBuffers"] = common.OpenRestyProxyBuffers
+	common.OptionMap["OpenRestyProxyBufferSize"] = common.OpenRestyProxyBufferSize
+	common.OptionMap["OpenRestyProxyBusyBuffersSize"] = common.OpenRestyProxyBusyBuffersSize
+	common.OptionMap["OpenRestyGzipEnabled"] = strconv.FormatBool(common.OpenRestyGzipEnabled)
+	common.OptionMap["OpenRestyGzipMinLength"] = strconv.Itoa(common.OpenRestyGzipMinLength)
+	common.OptionMap["OpenRestyGzipCompLevel"] = strconv.Itoa(common.OpenRestyGzipCompLevel)
+	common.OptionMap["OpenRestyCacheEnabled"] = strconv.FormatBool(common.OpenRestyCacheEnabled)
+	common.OptionMap["OpenRestyCachePath"] = common.OpenRestyCachePath
+	common.OptionMap["OpenRestyCacheLevels"] = common.OpenRestyCacheLevels
+	common.OptionMap["OpenRestyCacheInactive"] = common.OpenRestyCacheInactive
+	common.OptionMap["OpenRestyCacheMaxSize"] = common.OpenRestyCacheMaxSize
+	common.OptionMap["OpenRestyCacheKeyTemplate"] = common.OpenRestyCacheKeyTemplate
+	common.OptionMap["OpenRestyCacheLockEnabled"] = strconv.FormatBool(common.OpenRestyCacheLockEnabled)
+	common.OptionMap["OpenRestyCacheLockTimeout"] = common.OpenRestyCacheLockTimeout
+	common.OptionMap["OpenRestyCacheUseStale"] = common.OpenRestyCacheUseStale
+	common.OptionMap["OpenRestyMainConfigTemplate"] = common.OpenRestyMainConfigTemplate
+	common.OptionMap["GlobalApiRateLimitNum"] = strconv.Itoa(common.GlobalApiRateLimitNum)
+	common.OptionMap["GlobalApiRateLimitDuration"] = strconv.FormatInt(common.GlobalApiRateLimitDuration, 10)
+	common.OptionMap["GlobalWebRateLimitNum"] = strconv.Itoa(common.GlobalWebRateLimitNum)
+	common.OptionMap["GlobalWebRateLimitDuration"] = strconv.FormatInt(common.GlobalWebRateLimitDuration, 10)
+	common.OptionMap["UploadRateLimitNum"] = strconv.Itoa(common.UploadRateLimitNum)
+	common.OptionMap["UploadRateLimitDuration"] = strconv.FormatInt(common.UploadRateLimitDuration, 10)
+	common.OptionMap["DownloadRateLimitNum"] = strconv.Itoa(common.DownloadRateLimitNum)
+	common.OptionMap["DownloadRateLimitDuration"] = strconv.FormatInt(common.DownloadRateLimitDuration, 10)
+	common.OptionMap["CriticalRateLimitNum"] = strconv.Itoa(common.CriticalRateLimitNum)
+	common.OptionMap["CriticalRateLimitDuration"] = strconv.FormatInt(common.CriticalRateLimitDuration, 10)
+	common.OptionMapRWMutex.Unlock()
+	options, _ := AllOption()
+	for _, option := range options {
+		updateOptionMap(option.Key, option.Value)
+	}
+}
+
+func UpdateOption(key string, value string) error {
+	// Save to database first
+	option := Option{
+		Key: key,
+	}
+	// https://gorm.io/docs/update.html#Save-All-Fields
+	DB.FirstOrCreate(&option, Option{Key: key})
+	option.Value = value
+	// Save is a combination function.
+	// If save value does not contain primary key, it will execute Create,
+	// otherwise it will execute Update (with all fields).
+	DB.Save(&option)
+	// Update OptionMap
+	updateOptionMap(key, value)
+	return nil
+}
+
+func updateOptionMap(key string, value string) {
+	shouldRefreshGeoIP := false
+	common.OptionMapRWMutex.Lock()
+	if common.OptionMap == nil {
+		common.OptionMap = make(map[string]string)
+	}
+	common.OptionMap[key] = value
+	if strings.HasSuffix(key, "Permission") {
+		intValue, _ := strconv.Atoi(value)
+		switch key {
+		case "FileUploadPermission":
+			common.FileUploadPermission = intValue
+		case "FileDownloadPermission":
+			common.FileDownloadPermission = intValue
+		case "ImageUploadPermission":
+			common.ImageUploadPermission = intValue
+		case "ImageDownloadPermission":
+			common.ImageDownloadPermission = intValue
+		}
+	}
+	if strings.HasSuffix(key, "Enabled") {
+		boolValue := value == "true"
+		switch key {
+		case "PasswordRegisterEnabled":
+			common.PasswordRegisterEnabled = boolValue
+		case "PasswordLoginEnabled":
+			common.PasswordLoginEnabled = boolValue
+		case "EmailVerificationEnabled":
+			common.EmailVerificationEnabled = boolValue
+		case "GitHubOAuthEnabled":
+			common.GitHubOAuthEnabled = boolValue
+		case "WeChatAuthEnabled":
+			common.WeChatAuthEnabled = boolValue
+		case "TurnstileCheckEnabled":
+			common.TurnstileCheckEnabled = boolValue
+		case "RegisterEnabled":
+			common.RegisterEnabled = boolValue
+		}
+	}
+	switch key {
+	case "SMTPServer":
+		common.SMTPServer = value
+	case "SMTPPort":
+		intValue, _ := strconv.Atoi(value)
+		common.SMTPPort = intValue
+	case "SMTPAccount":
+		common.SMTPAccount = value
+	case "SMTPToken":
+		common.SMTPToken = value
+	case "ServerAddress":
+		common.ServerAddress = value
+	case "GitHubClientId":
+		common.GitHubClientId = value
+	case "GitHubClientSecret":
+		common.GitHubClientSecret = value
+	case "Footer":
+		common.Footer = value
+	case "HomePageLink":
+		common.HomePageLink = value
+	case "SystemName":
+		common.SystemName = value
+	case "WeChatServerAddress":
+		common.WeChatServerAddress = value
+	case "WeChatServerToken":
+		common.WeChatServerToken = value
+	case "WeChatAccountQRCodeImageURL":
+		common.WeChatAccountQRCodeImageURL = value
+	case "TurnstileSiteKey":
+		common.TurnstileSiteKey = value
+	case "TurnstileSecretKey":
+		common.TurnstileSecretKey = value
+	case "AgentDiscoveryToken":
+		common.AgentDiscoveryToken = value
+	case "AgentHeartbeatInterval":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.AgentHeartbeatInterval = v
+		}
+	case "NodeOfflineThreshold":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.NodeOfflineThreshold = time.Duration(v) * time.Millisecond
+		}
+	case "AgentUpdateRepo":
+		if value != "" {
+			common.AgentUpdateRepo = value
+		}
+	case "GeoIPProvider":
+		if geoip.IsValidProvider(value) {
+			common.GeoIPProvider = value
+			shouldRefreshGeoIP = true
+		}
+	case "OpenRestyWorkerProcesses":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyWorkerProcesses = value
+		}
+	case "OpenRestyWorkerConnections":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyWorkerConnections = v
+		}
+	case "OpenRestyWorkerRlimitNofile":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyWorkerRlimitNofile = v
+		}
+	case "OpenRestyEventsUse":
+		common.OpenRestyEventsUse = value
+	case "OpenRestyEventsMultiAcceptEnabled":
+		common.OpenRestyEventsMultiAcceptEnabled = value == "true"
+	case "OpenRestyKeepaliveTimeout":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyKeepaliveTimeout = v
+		}
+	case "OpenRestyKeepaliveRequests":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyKeepaliveRequests = v
+		}
+	case "OpenRestyClientHeaderTimeout":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyClientHeaderTimeout = v
+		}
+	case "OpenRestyClientBodyTimeout":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyClientBodyTimeout = v
+		}
+	case "OpenRestyClientMaxBodySize":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyClientMaxBodySize = value
+		}
+	case "OpenRestyLargeClientHeaderBuffers":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyLargeClientHeaderBuffers = value
+		}
+	case "OpenRestySendTimeout":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestySendTimeout = v
+		}
+	case "OpenRestyProxyConnectTimeout":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyProxyConnectTimeout = v
+		}
+	case "OpenRestyProxySendTimeout":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyProxySendTimeout = v
+		}
+	case "OpenRestyProxyReadTimeout":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyProxyReadTimeout = v
+		}
+	case "OpenRestyWebsocketEnabled":
+		common.OpenRestyWebsocketEnabled = value == "true"
+	case "OpenRestyProxyRequestBufferingEnabled":
+		common.OpenRestyProxyRequestBufferingEnabled = value == "true"
+	case "OpenRestyProxyBufferingEnabled":
+		common.OpenRestyProxyBufferingEnabled = value == "true"
+	case "OpenRestyProxyBuffers":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyProxyBuffers = value
+		}
+	case "OpenRestyProxyBufferSize":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyProxyBufferSize = value
+		}
+	case "OpenRestyProxyBusyBuffersSize":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyProxyBusyBuffersSize = value
+		}
+	case "OpenRestyGzipEnabled":
+		common.OpenRestyGzipEnabled = value == "true"
+	case "OpenRestyGzipMinLength":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyGzipMinLength = v
+		}
+	case "OpenRestyGzipCompLevel":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.OpenRestyGzipCompLevel = v
+		}
+	case "OpenRestyCacheEnabled":
+		common.OpenRestyCacheEnabled = value == "true"
+	case "OpenRestyCachePath":
+		common.OpenRestyCachePath = value
+	case "OpenRestyCacheLevels":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyCacheLevels = value
+		}
+	case "OpenRestyCacheInactive":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyCacheInactive = value
+		}
+	case "OpenRestyCacheMaxSize":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyCacheMaxSize = value
+		}
+	case "OpenRestyCacheKeyTemplate":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyCacheKeyTemplate = value
+		}
+	case "OpenRestyCacheLockEnabled":
+		common.OpenRestyCacheLockEnabled = value == "true"
+	case "OpenRestyCacheLockTimeout":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyCacheLockTimeout = value
+		}
+	case "OpenRestyCacheUseStale":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyCacheUseStale = value
+		}
+	case "OpenRestyMainConfigTemplate":
+		if strings.TrimSpace(value) != "" {
+			common.OpenRestyMainConfigTemplate = value
+		}
+	case "GlobalApiRateLimitNum":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.GlobalApiRateLimitNum = v
+		}
+	case "GlobalApiRateLimitDuration":
+		if v, err := strconv.ParseInt(value, 10, 64); err == nil && v > 0 {
+			common.GlobalApiRateLimitDuration = v
+		}
+	case "GlobalWebRateLimitNum":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.GlobalWebRateLimitNum = v
+		}
+	case "GlobalWebRateLimitDuration":
+		if v, err := strconv.ParseInt(value, 10, 64); err == nil && v > 0 {
+			common.GlobalWebRateLimitDuration = v
+		}
+	case "UploadRateLimitNum":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.UploadRateLimitNum = v
+		}
+	case "UploadRateLimitDuration":
+		if v, err := strconv.ParseInt(value, 10, 64); err == nil && v > 0 {
+			common.UploadRateLimitDuration = v
+		}
+	case "DownloadRateLimitNum":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.DownloadRateLimitNum = v
+		}
+	case "DownloadRateLimitDuration":
+		if v, err := strconv.ParseInt(value, 10, 64); err == nil && v > 0 {
+			common.DownloadRateLimitDuration = v
+		}
+	case "CriticalRateLimitNum":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			common.CriticalRateLimitNum = v
+		}
+	case "CriticalRateLimitDuration":
+		if v, err := strconv.ParseInt(value, 10, 64); err == nil && v > 0 {
+			common.CriticalRateLimitDuration = v
+		}
+	}
+	common.OptionMapRWMutex.Unlock()
+	if shouldRefreshGeoIP {
+		geoip.InitGeoIP()
+	}
+}

openflare_server/model/proxy_route.go

@@ -0,0 +1,54 @@
+package model
+
+import "time"
+
+type ProxyRoute struct {
+	ID            uint      `json:"id" gorm:"primaryKey"`
+	Domain        string    `json:"domain" gorm:"uniqueIndex;size:255;not null"`
+	OriginURL     string    `json:"origin_url" gorm:"size:2048;not null"`
+	Enabled       bool      `json:"enabled" gorm:"not null;default:true"`
+	EnableHTTPS   bool      `json:"enable_https" gorm:"column:enable_https;not null;default:false"`
+	CertID        *uint     `json:"cert_id"`
+	RedirectHTTP  bool      `json:"redirect_http" gorm:"not null;default:false"`
+	CustomHeaders string    `json:"custom_headers" gorm:"type:text;not null;default:'[]'"`
+	Remark        string    `json:"remark" gorm:"size:255"`
+	CreatedAt     time.Time `json:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
+}
+
+func ListProxyRoutes() (routes []*ProxyRoute, err error) {
+	err = DB.Order("id desc").Find(&routes).Error
+	return routes, err
+}
+
+func GetEnabledProxyRoutes() (routes []*ProxyRoute, err error) {
+	err = DB.Where("enabled = ?", true).Order("domain asc").Find(&routes).Error
+	return routes, err
+}
+
+func GetProxyRouteByID(id uint) (*ProxyRoute, error) {
+	route := &ProxyRoute{}
+	err := DB.First(route, id).Error
+	return route, err
+}
+
+func (route *ProxyRoute) Insert() error {
+	return DB.Create(route).Error
+}
+
+func (route *ProxyRoute) Update() error {
+	return DB.Model(&ProxyRoute{}).Where("id = ?", route.ID).Updates(map[string]any{
+		"domain":         route.Domain,
+		"origin_url":     route.OriginURL,
+		"enabled":        route.Enabled,
+		"enable_https":   route.EnableHTTPS,
+		"cert_id":        route.CertID,
+		"redirect_http":  route.RedirectHTTP,
+		"custom_headers": route.CustomHeaders,
+		"remark":         route.Remark,
+	}).Error
+}
+
+func (route *ProxyRoute) Delete() error {
+	return DB.Delete(route).Error
+}

openflare_server/model/tls_certificate.go

@@ -0,0 +1,38 @@
+package model
+
+import "time"
+
+type TLSCertificate struct {
+	ID        uint      `json:"id" gorm:"primaryKey"`
+	Name      string    `json:"name" gorm:"uniqueIndex;size:255;not null"`
+	CertPEM   string    `json:"-" gorm:"type:text;not null"`
+	KeyPEM    string    `json:"-" gorm:"type:text;not null"`
+	NotBefore time.Time `json:"not_before"`
+	NotAfter  time.Time `json:"not_after"`
+	Remark    string    `json:"remark" gorm:"size:255"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+func ListTLSCertificates() (certificates []*TLSCertificate, err error) {
+	err = DB.Order("id desc").Find(&certificates).Error
+	return certificates, err
+}
+
+func GetTLSCertificateByID(id uint) (*TLSCertificate, error) {
+	certificate := &TLSCertificate{}
+	err := DB.First(certificate, id).Error
+	return certificate, err
+}
+
+func (certificate *TLSCertificate) Insert() error {
+	return DB.Create(certificate).Error
+}
+
+func (certificate *TLSCertificate) Update() error {
+	return DB.Save(certificate).Error
+}
+
+func (certificate *TLSCertificate) Delete() error {
+	return DB.Delete(certificate).Error
+}

openflare_server/model/user.go

@@ -0,0 +1,191 @@
+package model
+
+import (
+	"errors"
+	"openflare/common"
+	"openflare/utils/security"
+	"strings"
+)
+
+// User if you add sensitive fields, don't forget to clean them in setupLogin function.
+// Otherwise, the sensitive information will be saved on local storage in plain text!
+type User struct {
+	Id               int    `json:"id"`
+	Username         string `json:"username" gorm:"unique;index" validate:"max=12"`
+	Password         string `json:"password" gorm:"not null;" validate:"min=8,max=20"`
+	DisplayName      string `json:"display_name" gorm:"index" validate:"max=20"`
+	Role             int    `json:"role" gorm:"type:int;default:1"`   // admin, common
+	Status           int    `json:"status" gorm:"type:int;default:1"` // enabled, disabled
+	Token            string `json:"token" gorm:"index"`
+	Email            string `json:"email" gorm:"index" validate:"max=50"`
+	GitHubId         string `json:"github_id" gorm:"column:github_id;index"`
+	WeChatId         string `json:"wechat_id" gorm:"column:wechat_id;index"`
+	VerificationCode string `json:"verification_code" gorm:"-:all"` // this field is only for Email verification, don't save it to database!
+}
+
+func GetMaxUserId() int {
+	var user User
+	DB.Last(&user)
+	return user.Id
+}
+
+func GetAllUsers(startIdx int, num int) (users []*User, err error) {
+	err = DB.Order("id desc").Limit(num).Offset(startIdx).Select([]string{"id", "username", "display_name", "role", "status", "email"}).Find(&users).Error
+	return users, err
+}
+
+func SearchUsers(keyword string) (users []*User, err error) {
+	err = DB.Select([]string{"id", "username", "display_name", "role", "status", "email"}).Where("id = ? or username LIKE ? or email LIKE ? or display_name LIKE ?", keyword, keyword+"%", keyword+"%", keyword+"%").Find(&users).Error
+	return users, err
+}
+
+func GetUserById(id int, selectAll bool) (*User, error) {
+	if id == 0 {
+		return nil, errors.New("id 为空！")
+	}
+	user := User{Id: id}
+	var err error = nil
+	if selectAll {
+		err = DB.First(&user, "id = ?", id).Error
+	} else {
+		err = DB.Select([]string{"id", "username", "display_name", "role", "status", "email", "wechat_id", "github_id"}).First(&user, "id = ?", id).Error
+	}
+	return &user, err
+}
+
+func DeleteUserById(id int) (err error) {
+	if id == 0 {
+		return errors.New("id 为空！")
+	}
+	user := User{Id: id}
+	return user.Delete()
+}
+
+func (user *User) Insert() error {
+	var err error
+	if user.Password != "" {
+		user.Password, err = security.Password2Hash(user.Password)
+		if err != nil {
+			return err
+		}
+	}
+	err = DB.Create(user).Error
+	return err
+}
+
+func (user *User) Update(updatePassword bool) error {
+	var err error
+	if updatePassword {
+		user.Password, err = security.Password2Hash(user.Password)
+		if err != nil {
+			return err
+		}
+	}
+	err = DB.Model(user).Updates(user).Error
+	return err
+}
+
+func (user *User) Delete() error {
+	if user.Id == 0 {
+		return errors.New("id 为空！")
+	}
+	err := DB.Delete(user).Error
+	return err
+}
+
+// ValidateAndFill check password & user status
+func (user *User) ValidateAndFill() (err error) {
+	// When querying with struct, GORM will only query with non-zero fields,
+	// that means if your field’s value is 0, '', false or other zero values,
+	// it won’t be used to build query conditions
+	password := user.Password
+	if user.Username == "" || password == "" {
+		return errors.New("用户名或密码为空")
+	}
+	DB.Where(User{Username: user.Username}).First(user)
+	okay := security.ValidatePasswordAndHash(password, user.Password)
+	if !okay || user.Status != common.UserStatusEnabled {
+		return errors.New("用户名或密码错误，或用户已被封禁")
+	}
+	return nil
+}
+
+func (user *User) FillUserById() error {
+	if user.Id == 0 {
+		return errors.New("id 为空！")
+	}
+	DB.Where(User{Id: user.Id}).First(user)
+	return nil
+}
+
+func (user *User) FillUserByEmail() error {
+	if user.Email == "" {
+		return errors.New("email 为空！")
+	}
+	DB.Where(User{Email: user.Email}).First(user)
+	return nil
+}
+
+func (user *User) FillUserByGitHubId() error {
+	if user.GitHubId == "" {
+		return errors.New("GitHub id 为空！")
+	}
+	DB.Where(User{GitHubId: user.GitHubId}).First(user)
+	return nil
+}
+
+func (user *User) FillUserByWeChatId() error {
+	if user.WeChatId == "" {
+		return errors.New("WeChat id 为空！")
+	}
+	DB.Where(User{WeChatId: user.WeChatId}).First(user)
+	return nil
+}
+
+func (user *User) FillUserByUsername() error {
+	if user.Username == "" {
+		return errors.New("username 为空！")
+	}
+	DB.Where(User{Username: user.Username}).First(user)
+	return nil
+}
+
+func ValidateUserToken(token string) (user *User) {
+	if token == "" {
+		return nil
+	}
+	token = strings.Replace(token, "Bearer ", "", 1)
+	user = &User{}
+	if DB.Where("token = ?", token).First(user).RowsAffected == 1 {
+		return user
+	}
+	return nil
+}
+
+func IsEmailAlreadyTaken(email string) bool {
+	return DB.Where("email = ?", email).Find(&User{}).RowsAffected == 1
+}
+
+func IsWeChatIdAlreadyTaken(wechatId string) bool {
+	return DB.Where("wechat_id = ?", wechatId).Find(&User{}).RowsAffected == 1
+}
+
+func IsGitHubIdAlreadyTaken(githubId string) bool {
+	return DB.Where("github_id = ?", githubId).Find(&User{}).RowsAffected == 1
+}
+
+func IsUsernameAlreadyTaken(username string) bool {
+	return DB.Where("username = ?", username).Find(&User{}).RowsAffected == 1
+}
+
+func ResetUserPasswordByEmail(email string, password string) error {
+	if email == "" || password == "" {
+		return errors.New("邮箱地址或密码为空！")
+	}
+	hashedPassword, err := security.Password2Hash(password)
+	if err != nil {
+		return err
+	}
+	err = DB.Model(&User{}).Where("email = ?", email).Update("password", hashedPassword).Error
+	return err
+}

openflare_server/router/api-router.go

@@ -0,0 +1,159 @@
+package router
+
+import (
+	"openflare/controller"
+	"openflare/middleware"
+
+	"github.com/gin-gonic/gin"
+)
+
+func SetApiRouter(router *gin.Engine) {
+	apiRouter := router.Group("/api")
+	apiRouter.Use(middleware.GlobalAPIRateLimit())
+	{
+		apiRouter.GET("/status", controller.GetStatus)
+		apiRouter.GET("/notice", controller.GetNotice)
+		apiRouter.GET("/about", controller.GetAbout)
+		apiRouter.GET("/verification", middleware.CriticalRateLimit(), middleware.TurnstileCheck(), controller.SendEmailVerification)
+		apiRouter.GET("/reset_password", middleware.CriticalRateLimit(), middleware.TurnstileCheck(), controller.SendPasswordResetEmail)
+		apiRouter.POST("/user/reset", middleware.CriticalRateLimit(), controller.ResetPassword)
+		apiRouter.GET("/oauth/github", middleware.CriticalRateLimit(), controller.GitHubOAuth)
+		apiRouter.GET("/oauth/wechat", middleware.CriticalRateLimit(), controller.WeChatAuth)
+		apiRouter.GET("/oauth/wechat/bind", middleware.CriticalRateLimit(), middleware.UserAuth(), controller.WeChatBind)
+		apiRouter.GET("/oauth/email/bind", middleware.CriticalRateLimit(), middleware.UserAuth(), controller.EmailBind)
+
+		userRoute := apiRouter.Group("/user")
+		{
+			userRoute.POST("/register", middleware.CriticalRateLimit(), middleware.TurnstileCheck(), controller.Register)
+			userRoute.POST("/login", middleware.CriticalRateLimit(), controller.Login)
+			userRoute.GET("/logout", controller.Logout)
+
+			selfRoute := userRoute.Group("/")
+			selfRoute.Use(middleware.UserAuth(), middleware.NoTokenAuth())
+			{
+				selfRoute.GET("/self", controller.GetSelf)
+				selfRoute.PUT("/self", controller.UpdateSelf)
+				selfRoute.DELETE("/self", controller.DeleteSelf)
+				selfRoute.GET("/token", controller.GenerateToken)
+			}
+
+			adminRoute := userRoute.Group("/")
+			adminRoute.Use(middleware.AdminAuth(), middleware.NoTokenAuth())
+			{
+				adminRoute.GET("/", controller.GetAllUsers)
+				adminRoute.GET("/search", controller.SearchUsers)
+				adminRoute.GET("/:id", controller.GetUser)
+				adminRoute.POST("/", controller.CreateUser)
+				adminRoute.POST("/manage", controller.ManageUser)
+				adminRoute.PUT("/", controller.UpdateUser)
+				adminRoute.DELETE("/:id", controller.DeleteUser)
+			}
+		}
+		optionRoute := apiRouter.Group("/option")
+		optionRoute.Use(middleware.RootAuth(), middleware.NoTokenAuth())
+		{
+			optionRoute.GET("/", controller.GetOptions)
+			optionRoute.PUT("/", controller.UpdateOption)
+			optionRoute.POST("/geoip/lookup", controller.LookupGeoIP)
+		}
+		updateRoute := apiRouter.Group("/update")
+		updateRoute.Use(middleware.RootAuth(), middleware.NoTokenAuth())
+		{
+			updateRoute.GET("/latest-release", controller.GetLatestRelease)
+			updateRoute.GET("/logs/ws", controller.StreamServerUpgradeLogs)
+			updateRoute.POST("/manual-upload", controller.UploadManualServerBinary)
+			updateRoute.POST("/manual-upgrade", controller.ConfirmManualServerUpgrade)
+			updateRoute.POST("/upgrade", controller.UpgradeServer)
+		}
+		fileRoute := apiRouter.Group("/file")
+		fileRoute.Use(middleware.AdminAuth())
+		{
+			fileRoute.GET("/", controller.GetAllFiles)
+			fileRoute.GET("/search", controller.SearchFiles)
+			fileRoute.POST("/", middleware.UploadRateLimit(), controller.UploadFile)
+			fileRoute.DELETE("/:id", controller.DeleteFile)
+		}
+		proxyRoute := apiRouter.Group("/proxy-routes")
+		proxyRoute.Use(middleware.AdminAuth())
+		{
+			proxyRoute.GET("/", controller.GetProxyRoutes)
+			proxyRoute.POST("/", controller.CreateProxyRoute)
+			proxyRoute.PUT("/:id", controller.UpdateProxyRoute)
+			proxyRoute.DELETE("/:id", controller.DeleteProxyRoute)
+		}
+		managedDomainRoute := apiRouter.Group("/managed-domains")
+		managedDomainRoute.Use(middleware.AdminAuth())
+		{
+			managedDomainRoute.GET("/", controller.GetManagedDomains)
+			managedDomainRoute.GET("/match", controller.MatchManagedDomainCertificate)
+			managedDomainRoute.POST("/", controller.CreateManagedDomain)
+			managedDomainRoute.PUT("/:id", controller.UpdateManagedDomain)
+			managedDomainRoute.DELETE("/:id", controller.DeleteManagedDomain)
+		}
+		tlsCertificateRoute := apiRouter.Group("/tls-certificates")
+		tlsCertificateRoute.Use(middleware.AdminAuth())
+		{
+			tlsCertificateRoute.GET("/", controller.GetTLSCertificates)
+			tlsCertificateRoute.GET("/:id", controller.GetTLSCertificate)
+			tlsCertificateRoute.GET("/:id/content", controller.GetTLSCertificateContent)
+			tlsCertificateRoute.POST("/", controller.CreateTLSCertificate)
+			tlsCertificateRoute.PUT("/:id", controller.UpdateTLSCertificate)
+			tlsCertificateRoute.POST("/import-file", controller.ImportTLSCertificateFile)
+			tlsCertificateRoute.DELETE("/:id", controller.DeleteTLSCertificate)
+		}
+		configVersionRoute := apiRouter.Group("/config-versions")
+		configVersionRoute.Use(middleware.AdminAuth())
+		{
+			configVersionRoute.GET("/", controller.GetConfigVersions)
+			configVersionRoute.GET("/active", controller.GetActiveConfigVersion)
+			configVersionRoute.GET("/preview", controller.PreviewConfigVersion)
+			configVersionRoute.GET("/diff", controller.DiffConfigVersion)
+			configVersionRoute.POST("/publish", controller.PublishConfigVersion)
+			configVersionRoute.PUT("/:id/activate", controller.ActivateConfigVersion)
+		}
+		dashboardRoute := apiRouter.Group("/dashboard")
+		dashboardRoute.Use(middleware.AdminAuth())
+		{
+			dashboardRoute.GET("/overview", controller.GetDashboardOverview)
+		}
+		nodeRoute := apiRouter.Group("/nodes")
+		nodeRoute.Use(middleware.AdminAuth())
+		{
+			nodeRoute.GET("/bootstrap-token", controller.GetNodeBootstrapToken)
+			nodeRoute.POST("/bootstrap-token/rotate", controller.RotateNodeBootstrapToken)
+			nodeRoute.GET("/", controller.GetNodes)
+			nodeRoute.POST("/", controller.CreateNode)
+			nodeRoute.GET("/:id/agent-release", controller.GetNodeAgentRelease)
+			nodeRoute.GET("/:id/observability", controller.GetNodeObservability)
+			nodeRoute.POST("/:id/agent-update", controller.RequestNodeAgentUpdate)
+			nodeRoute.POST("/:id/openresty-restart", controller.RequestNodeOpenrestyRestart)
+			nodeRoute.PUT("/:id", controller.UpdateNode)
+			nodeRoute.DELETE("/:id", controller.DeleteNode)
+		}
+		applyLogRoute := apiRouter.Group("/apply-logs")
+		applyLogRoute.Use(middleware.AdminAuth())
+		{
+			applyLogRoute.GET("/", controller.GetApplyLogs)
+		}
+		accessLogRoute := apiRouter.Group("/access-logs")
+		accessLogRoute.Use(middleware.AdminAuth())
+		{
+			accessLogRoute.GET("/", controller.GetAccessLogs)
+		}
+		agentRoute := apiRouter.Group("/agent")
+		{
+			discoveryRoute := agentRoute.Group("/")
+			discoveryRoute.Use(middleware.AgentRegisterAuth())
+			{
+				discoveryRoute.POST("/nodes/register", controller.AgentRegister)
+			}
+			authorizedRoute := agentRoute.Group("/")
+			authorizedRoute.Use(middleware.AgentAuth())
+			{
+				authorizedRoute.POST("/nodes/heartbeat", controller.AgentHeartbeat)
+				authorizedRoute.GET("/config-versions/active", controller.AgentGetActiveConfig)
+				authorizedRoute.POST("/apply-logs", controller.AgentReportApplyLog)
+			}
+		}
+	}
+}

openflare_server/router/api_phase1_test.go

@@ -0,0 +1,466 @@
+package router_test
+
+import (
+	"bytes"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/json"
+	"encoding/pem"
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-contrib/sessions/cookie"
+	"github.com/gin-gonic/gin"
+	"math/big"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"openflare/common"
+	"openflare/model"
+	"openflare/router"
+	"openflare/service"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+)
+
+type apiResponse struct {
+	Success bool            `json:"success"`
+	Message string          `json:"message"`
+	Data    json.RawMessage `json:"data"`
+}
+
+func TestPhase1PublishLifecycle(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	token := prepareRootToken(t)
+
+	createBody := map[string]any{
+		"domain":     "app.example.com",
+		"origin_url": "https://origin-a.internal",
+		"enabled":    true,
+		"remark":     "primary route",
+	}
+	resp := performJSONRequest(t, engine, token, http.MethodPost, "/api/proxy-routes/", createBody)
+	var createdRoute model.ProxyRoute
+	decodeResponseData(t, resp, &createdRoute)
+	if createdRoute.Domain != "app.example.com" {
+		t.Fatalf("unexpected created route domain: %s", createdRoute.Domain)
+	}
+
+	resp = performJSONRequest(t, engine, token, http.MethodGet, "/api/proxy-routes/", nil)
+	var routes []model.ProxyRoute
+	decodeResponseData(t, resp, &routes)
+	if len(routes) != 1 {
+		t.Fatalf("expected 1 route, got %d", len(routes))
+	}
+
+	resp = performJSONRequest(t, engine, token, http.MethodPost, "/api/config-versions/publish", nil)
+	var version1 model.ConfigVersion
+	decodeResponseData(t, resp, &version1)
+	if !version1.IsActive {
+		t.Fatal("expected published version to be active")
+	}
+	if version1.SnapshotJSON == "" || version1.RenderedConfig == "" || version1.Checksum == "" {
+		t.Fatal("expected published version to contain snapshot, rendered config and checksum")
+	}
+	if version1.MainConfig == "" {
+		t.Fatal("expected published version to contain main config")
+	}
+
+	repeatPublishReq := httptest.NewRequest(http.MethodPost, "/api/config-versions/publish", nil)
+	repeatPublishReq.Header.Set("Authorization", "Bearer "+token)
+	repeatPublishRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(repeatPublishRecorder, repeatPublishReq)
+	if repeatPublishRecorder.Code != http.StatusOK {
+		t.Fatalf("unexpected status %d for repeated publish: %s", repeatPublishRecorder.Code, repeatPublishRecorder.Body.String())
+	}
+	var repeatPublishResp apiResponse
+	if err := json.Unmarshal(repeatPublishRecorder.Body.Bytes(), &repeatPublishResp); err != nil {
+		t.Fatalf("failed to unmarshal repeated publish response: %v", err)
+	}
+	if repeatPublishResp.Success {
+		t.Fatal("expected repeated publish without route changes to be rejected")
+	}
+	if !strings.Contains(repeatPublishResp.Message, "当前规则没有变更") {
+		t.Fatalf("unexpected repeated publish message: %s", repeatPublishResp.Message)
+	}
+
+	initialSnapshot := version1.SnapshotJSON
+	initialMainConfig := version1.MainConfig
+	initialRendered := version1.RenderedConfig
+
+	updateBody := map[string]any{
+		"domain":     "app.example.com",
+		"origin_url": "https://origin-b.internal",
+		"enabled":    true,
+		"remark":     "updated route",
+	}
+	routePath := "/api/proxy-routes/" + toString(createdRoute.ID)
+	resp = performJSONRequest(t, engine, token, http.MethodPut, routePath, updateBody)
+	decodeResponseData(t, resp, &createdRoute)
+	if createdRoute.OriginURL != "https://origin-b.internal" {
+		t.Fatalf("unexpected updated route origin: %s", createdRoute.OriginURL)
+	}
+
+	resp = performJSONRequest(t, engine, token, http.MethodPost, "/api/config-versions/publish", nil)
+	var version2 model.ConfigVersion
+	decodeResponseData(t, resp, &version2)
+	if version2.ID == version1.ID {
+		t.Fatal("expected a new version record")
+	}
+
+	resp = performJSONRequest(t, engine, token, http.MethodGet, "/api/config-versions/", nil)
+	var versions []model.ConfigVersion
+	decodeResponseData(t, resp, &versions)
+	if len(versions) != 2 {
+		t.Fatalf("expected 2 versions, got %d", len(versions))
+	}
+
+	activeResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/config-versions/active", nil)
+	var activeVersion model.ConfigVersion
+	decodeResponseData(t, activeResp, &activeVersion)
+	if activeVersion.ID != version2.ID {
+		t.Fatalf("expected version %d active, got %d", version2.ID, activeVersion.ID)
+	}
+
+	activatePath := "/api/config-versions/" + toString(version1.ID) + "/activate"
+	resp = performJSONRequest(t, engine, token, http.MethodPut, activatePath, nil)
+	decodeResponseData(t, resp, &activeVersion)
+	if activeVersion.ID != version1.ID || !activeVersion.IsActive {
+		t.Fatal("expected version1 to become active after rollback activation")
+	}
+
+	var storedVersion1 model.ConfigVersion
+	if err := model.DB.First(&storedVersion1, version1.ID).Error; err != nil {
+		t.Fatalf("failed to query version1: %v", err)
+	}
+	if storedVersion1.SnapshotJSON != initialSnapshot {
+		t.Fatal("expected version1 snapshot to remain immutable")
+	}
+	if storedVersion1.MainConfig != initialMainConfig {
+		t.Fatal("expected version1 main config to remain immutable")
+	}
+	if storedVersion1.RenderedConfig != initialRendered {
+		t.Fatal("expected version1 rendered config to remain immutable")
+	}
+
+	deletePath := "/api/proxy-routes/" + toString(createdRoute.ID)
+	resp = performJSONRequest(t, engine, token, http.MethodDelete, deletePath, nil)
+	if !resp.Success {
+		t.Fatalf("expected delete route success, got: %s", resp.Message)
+	}
+}
+
+func TestPhase1HTTPSAndCertificateImportLifecycle(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	token := prepareRootToken(t)
+	certPEM, keyPEM := generateCertificatePairForRouterTest(t, []string{"secure.example.com"})
+
+	manualResp := performJSONRequest(t, engine, token, http.MethodPost, "/api/tls-certificates/", map[string]any{
+		"name":     "secure-example",
+		"cert_pem": certPEM,
+		"key_pem":  keyPEM,
+		"remark":   "manual import",
+	})
+	var manualCertificate model.TLSCertificate
+	decodeResponseData(t, manualResp, &manualCertificate)
+	if manualCertificate.ID == 0 {
+		t.Fatal("expected manual certificate import to persist certificate")
+	}
+
+	detailResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/tls-certificates/"+toString(manualCertificate.ID), nil)
+	var certificateDetail map[string]any
+	decodeResponseData(t, detailResp, &certificateDetail)
+	if _, exists := certificateDetail["cert_pem"]; exists {
+		t.Fatal("expected certificate detail endpoint to omit cert_pem")
+	}
+	if _, exists := certificateDetail["key_pem"]; exists {
+		t.Fatal("expected certificate detail endpoint to omit key_pem")
+	}
+
+	contentResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/tls-certificates/"+toString(manualCertificate.ID)+"/content", nil)
+	var certificateContent map[string]any
+	decodeResponseData(t, contentResp, &certificateContent)
+	if certificateContent["cert_pem"] == "" || certificateContent["key_pem"] == "" {
+		t.Fatal("expected certificate content endpoint to return pem payloads")
+	}
+
+	updatedCertPEM, updatedKeyPEM := generateCertificatePairForRouterTest(t, []string{"secure.example.com", "www.secure.example.com"})
+	updateCertificateResp := performJSONRequest(t, engine, token, http.MethodPut, "/api/tls-certificates/"+toString(manualCertificate.ID), map[string]any{
+		"name":     "secure-example-updated",
+		"cert_pem": updatedCertPEM,
+		"key_pem":  updatedKeyPEM,
+		"remark":   "updated manual import",
+	})
+	decodeResponseData(t, updateCertificateResp, &manualCertificate)
+	if manualCertificate.Name != "secure-example-updated" || manualCertificate.Remark != "updated manual import" {
+		t.Fatalf("expected certificate update to persist metadata, got %+v", manualCertificate)
+	}
+
+	fileCertPEM, fileKeyPEM := generateCertificatePairForRouterTest(t, []string{"upload.example.com"})
+	multipartResp := performMultipartRequest(t, engine, token, "/api/tls-certificates/import-file", map[string]string{
+		"name":   "upload-example",
+		"remark": "upload import",
+	}, map[string]string{
+		"cert_file": fileCertPEM,
+		"key_file":  fileKeyPEM,
+	})
+	var uploadedCertificate model.TLSCertificate
+	decodeResponseData(t, multipartResp, &uploadedCertificate)
+	if uploadedCertificate.ID == 0 {
+		t.Fatal("expected file certificate import to persist certificate")
+	}
+
+	resp := performJSONRequest(t, engine, token, http.MethodPost, "/api/proxy-routes/", map[string]any{
+		"domain":        "secure.example.com",
+		"origin_url":    "https://origin-secure.internal",
+		"enabled":       true,
+		"enable_https":  true,
+		"cert_id":       manualCertificate.ID,
+		"redirect_http": true,
+		"remark":        "https route",
+	})
+	var route model.ProxyRoute
+	decodeResponseData(t, resp, &route)
+	if !route.EnableHTTPS || route.CertID == nil || *route.CertID != manualCertificate.ID {
+		t.Fatal("expected route to persist https certificate binding")
+	}
+
+	updateResp := performJSONRequest(t, engine, token, http.MethodPut, "/api/proxy-routes/"+toString(route.ID), map[string]any{
+		"domain":        "secure.example.com",
+		"origin_url":    "http://origin-secure.internal",
+		"enabled":       true,
+		"enable_https":  false,
+		"cert_id":       nil,
+		"redirect_http": false,
+		"remark":        "downgraded route",
+	})
+	decodeResponseData(t, updateResp, &route)
+	if route.EnableHTTPS || route.CertID != nil || route.RedirectHTTP {
+		t.Fatalf("expected route to disable https flags, got %+v", route)
+	}
+
+	updateResp = performJSONRequest(t, engine, token, http.MethodPut, "/api/proxy-routes/"+toString(route.ID), map[string]any{
+		"domain":        "secure.example.com",
+		"origin_url":    "https://origin-secure.internal",
+		"enabled":       true,
+		"enable_https":  true,
+		"cert_id":       manualCertificate.ID,
+		"redirect_http": true,
+		"remark":        "re-enabled https route",
+	})
+	decodeResponseData(t, updateResp, &route)
+	if !route.EnableHTTPS || route.CertID == nil || *route.CertID != manualCertificate.ID || !route.RedirectHTTP {
+		t.Fatalf("expected route update to persist https fields, got %+v", route)
+	}
+
+	listResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/proxy-routes/", nil)
+	var routes []model.ProxyRoute
+	decodeResponseData(t, listResp, &routes)
+	if len(routes) != 1 || !routes[0].EnableHTTPS || routes[0].CertID == nil || *routes[0].CertID != manualCertificate.ID || !routes[0].RedirectHTTP {
+		t.Fatalf("expected route list to reflect https update, got %+v", routes)
+	}
+
+	certificateListResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/tls-certificates/", nil)
+	var certificateList []map[string]any
+	decodeResponseData(t, certificateListResp, &certificateList)
+	if len(certificateList) == 0 {
+		t.Fatal("expected certificate list to return records")
+	}
+	if _, exists := certificateList[0]["cert_pem"]; exists {
+		t.Fatal("expected certificate list to omit cert_pem")
+	}
+	if _, exists := certificateList[0]["key_pem"]; exists {
+		t.Fatal("expected certificate list to omit key_pem")
+	}
+
+	resp = performJSONRequest(t, engine, token, http.MethodPost, "/api/config-versions/publish", nil)
+	var version model.ConfigVersion
+	decodeResponseData(t, resp, &version)
+	if !strings.Contains(version.MainConfig, "include __OPENFLARE_ROUTE_CONFIG__;") {
+		t.Fatal("expected active config to render managed main config")
+	}
+	if !strings.Contains(version.RenderedConfig, "listen 443 ssl;") {
+		t.Fatal("expected active config to render https listener")
+	}
+	if !strings.Contains(version.RenderedConfig, "return 301 https://$host$request_uri;") {
+		t.Fatal("expected active config to render redirect server")
+	}
+	if !strings.Contains(version.SupportFilesJSON, ".crt") || !strings.Contains(version.SupportFilesJSON, ".key") {
+		t.Fatal("expected support files json to contain certificate artifacts")
+	}
+	if err := (&model.Node{
+		NodeID:       "phase1-node",
+		Name:         "phase1-node",
+		IP:           "10.0.0.8",
+		AgentToken:   common.AgentToken,
+		AgentVersion: "0.1.0",
+		NginxVersion: "1.25.5",
+		Status:       service.NodeStatusOnline,
+		LastSeenAt:   time.Now(),
+	}).Insert(); err != nil {
+		t.Fatalf("failed to seed phase1 node: %v", err)
+	}
+
+	agentResp := performAgentJSONRequestWithToken(t, engine, common.AgentToken, http.MethodGet, "/api/agent/config-versions/active", nil)
+	var activeConfig map[string]any
+	decodeResponseData(t, agentResp, &activeConfig)
+	mainConfig, ok := activeConfig["main_config"].(string)
+	if !ok || !strings.Contains(mainConfig, "include __OPENFLARE_ROUTE_CONFIG__;") {
+		t.Fatalf("expected active config to expose main_config, got %#v", activeConfig["main_config"])
+	}
+	supportFiles, ok := activeConfig["support_files"].([]any)
+	if !ok || len(supportFiles) != 2 {
+		t.Fatalf("expected active config to expose 2 support files, got %#v", activeConfig["support_files"])
+	}
+}
+
+func setupTestDB(t *testing.T) {
+	t.Helper()
+	dbPath := filepath.Join(t.TempDir(), "phase1.db")
+	common.SQLitePath = dbPath
+	common.AgentToken = "phase1-agent-token"
+	if err := model.InitDB(); err != nil {
+		t.Fatalf("failed to init db: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := model.CloseDB(); err != nil {
+			t.Fatalf("failed to close db: %v", err)
+		}
+	})
+}
+
+func prepareRootToken(t *testing.T) string {
+	t.Helper()
+	user := &model.User{Username: "root"}
+	if err := user.FillUserByUsername(); err != nil {
+		t.Fatalf("failed to load root user: %v", err)
+	}
+	user.Token = "phase1-test-token"
+	if err := model.DB.Model(user).Update("token", user.Token).Error; err != nil {
+		t.Fatalf("failed to set root token: %v", err)
+	}
+	return user.Token
+}
+
+func performJSONRequest(t *testing.T, engine http.Handler, token string, method string, path string, body any) apiResponse {
+	t.Helper()
+	var payload []byte
+	var err error
+	if body != nil {
+		payload, err = json.Marshal(body)
+		if err != nil {
+			t.Fatalf("failed to marshal request body: %v", err)
+		}
+	}
+	req := httptest.NewRequest(method, path, bytes.NewReader(payload))
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected status %d for %s %s: %s", recorder.Code, method, path, recorder.Body.String())
+	}
+	var resp apiResponse
+	if err = json.Unmarshal(recorder.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to unmarshal response: %v", err)
+	}
+	if !resp.Success {
+		t.Fatalf("request %s %s failed: %s", method, path, resp.Message)
+	}
+	return resp
+}
+
+func decodeResponseData(t *testing.T, resp apiResponse, target any) {
+	t.Helper()
+	if err := json.Unmarshal(resp.Data, target); err != nil {
+		t.Fatalf("failed to decode response data: %v", err)
+	}
+}
+
+func toString(id uint) string {
+	return strconv.FormatUint(uint64(id), 10)
+}
+
+func performMultipartRequest(t *testing.T, engine http.Handler, token string, path string, fields map[string]string, files map[string]string) apiResponse {
+	t.Helper()
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	for key, value := range fields {
+		if err := writer.WriteField(key, value); err != nil {
+			t.Fatalf("failed to write multipart field: %v", err)
+		}
+	}
+	for fieldName, content := range files {
+		part, err := writer.CreateFormFile(fieldName, fieldName+".pem")
+		if err != nil {
+			t.Fatalf("failed to create multipart file: %v", err)
+		}
+		if _, err = part.Write([]byte(content)); err != nil {
+			t.Fatalf("failed to write multipart file content: %v", err)
+		}
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("failed to close multipart writer: %v", err)
+	}
+	req := httptest.NewRequest(http.MethodPost, path, &body)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	req.Header.Set("Authorization", "Bearer "+token)
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected status %d for multipart %s: %s", recorder.Code, path, recorder.Body.String())
+	}
+	var resp apiResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to unmarshal multipart response: %v", err)
+	}
+	if !resp.Success {
+		t.Fatalf("multipart request %s failed: %s", path, resp.Message)
+	}
+	return resp
+}
+
+func generateCertificatePairForRouterTest(t *testing.T, dnsNames []string) (string, string) {
+	t.Helper()
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("GenerateKey failed: %v", err)
+	}
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(time.Now().UnixNano()),
+		Subject: pkix.Name{
+			CommonName: dnsNames[0],
+		},
+		DNSNames:    dnsNames,
+		NotBefore:   time.Now().Add(-time.Hour),
+		NotAfter:    time.Now().Add(24 * time.Hour),
+		KeyUsage:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
+	if err != nil {
+		t.Fatalf("CreateCertificate failed: %v", err)
+	}
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)})
+	return string(certPEM), string(keyPEM)
+}

openflare_server/router/api_phase2_managed_domain_test.go

@@ -0,0 +1,112 @@
+package router_test
+
+import (
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-contrib/sessions/cookie"
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"openflare/common"
+	"openflare/router"
+	"testing"
+)
+
+func TestPhase2ManagedDomainLifecycle(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	token := prepareRootToken(t)
+	wildcardCertPEM, wildcardKeyPEM := generateCertificatePairForRouterTest(t, []string{"*.example.com"})
+	exactCertPEM, exactKeyPEM := generateCertificatePairForRouterTest(t, []string{"api.example.com"})
+
+	wildcardResp := performJSONRequest(t, engine, token, http.MethodPost, "/api/tls-certificates/", map[string]any{
+		"name":     "wildcard-cert",
+		"cert_pem": wildcardCertPEM,
+		"key_pem":  wildcardKeyPEM,
+	})
+	var wildcardCertificate map[string]any
+	decodeResponseData(t, wildcardResp, &wildcardCertificate)
+
+	exactResp := performJSONRequest(t, engine, token, http.MethodPost, "/api/tls-certificates/", map[string]any{
+		"name":     "exact-cert",
+		"cert_pem": exactCertPEM,
+		"key_pem":  exactKeyPEM,
+	})
+	var exactCertificate map[string]any
+	decodeResponseData(t, exactResp, &exactCertificate)
+
+	wildcardID := uint(wildcardCertificate["id"].(float64))
+	exactID := uint(exactCertificate["id"].(float64))
+
+	createWildcard := performJSONRequest(t, engine, token, http.MethodPost, "/api/managed-domains/", map[string]any{
+		"domain":  "*.example.com",
+		"cert_id": wildcardID,
+		"enabled": true,
+		"remark":  "wildcard binding",
+	})
+	var wildcardDomain map[string]any
+	decodeResponseData(t, createWildcard, &wildcardDomain)
+
+	createExact := performJSONRequest(t, engine, token, http.MethodPost, "/api/managed-domains/", map[string]any{
+		"domain":  "api.example.com",
+		"cert_id": exactID,
+		"enabled": true,
+		"remark":  "exact binding",
+	})
+	var exactDomain map[string]any
+	decodeResponseData(t, createExact, &exactDomain)
+
+	listResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/managed-domains/", nil)
+	var domains []map[string]any
+	decodeResponseData(t, listResp, &domains)
+	if len(domains) != 2 {
+		t.Fatalf("expected 2 managed domains, got %d", len(domains))
+	}
+
+	matchResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/managed-domains/match?domain=api.example.com", nil)
+	var matchResult map[string]any
+	decodeResponseData(t, matchResp, &matchResult)
+	if matched, ok := matchResult["matched"].(bool); !ok || !matched {
+		t.Fatalf("expected exact domain to be matched, got %#v", matchResult)
+	}
+	candidate, ok := matchResult["candidate"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected candidate payload, got %#v", matchResult["candidate"])
+	}
+	if candidate["match_type"] != "exact" {
+		t.Fatalf("expected exact match type, got %#v", candidate["match_type"])
+	}
+	if uint(candidate["certificate_id"].(float64)) != exactID {
+		t.Fatalf("expected exact certificate id %d, got %#v", exactID, candidate["certificate_id"])
+	}
+
+	updateResp := performJSONRequest(t, engine, token, http.MethodPut, "/api/managed-domains/"+toString(uint(exactDomain["id"].(float64))), map[string]any{
+		"domain":  "api.example.com",
+		"cert_id": exactID,
+		"enabled": false,
+		"remark":  "disabled exact binding",
+	})
+	decodeResponseData(t, updateResp, &exactDomain)
+
+	matchResp = performJSONRequest(t, engine, token, http.MethodGet, "/api/managed-domains/match?domain=api.example.com", nil)
+	decodeResponseData(t, matchResp, &matchResult)
+	candidate, ok = matchResult["candidate"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected wildcard fallback candidate, got %#v", matchResult["candidate"])
+	}
+	if candidate["match_type"] != "wildcard" {
+		t.Fatalf("expected wildcard fallback, got %#v", candidate["match_type"])
+	}
+	if uint(candidate["certificate_id"].(float64)) != wildcardID {
+		t.Fatalf("expected wildcard certificate id %d, got %#v", wildcardID, candidate["certificate_id"])
+	}
+
+	deleteResp := performJSONRequest(t, engine, token, http.MethodDelete, "/api/managed-domains/"+toString(uint(wildcardDomain["id"].(float64))), nil)
+	if !deleteResp.Success {
+		t.Fatalf("expected delete success, got %s", deleteResp.Message)
+	}
+}

openflare_server/router/api_phase2_test.go

@@ -0,0 +1,519 @@
+package router_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"openflare/common"
+	"openflare/model"
+	"openflare/router"
+	"openflare/service"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-contrib/sessions/cookie"
+	"github.com/gin-gonic/gin"
+)
+
+func TestPhase2RateLimitOptionsHotReload(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+	model.InitOptionMap()
+
+	oldGlobalApiRateLimitNum := common.GlobalApiRateLimitNum
+	oldGlobalApiRateLimitDuration := common.GlobalApiRateLimitDuration
+	oldCriticalRateLimitNum := common.CriticalRateLimitNum
+	oldCriticalRateLimitDuration := common.CriticalRateLimitDuration
+	t.Cleanup(func() {
+		common.GlobalApiRateLimitNum = oldGlobalApiRateLimitNum
+		common.GlobalApiRateLimitDuration = oldGlobalApiRateLimitDuration
+		common.CriticalRateLimitNum = oldCriticalRateLimitNum
+		common.CriticalRateLimitDuration = oldCriticalRateLimitDuration
+	})
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	loginCookie := loginAsRoot(t, engine)
+
+	performSessionJSONRequest(t, engine, loginCookie, http.MethodPut, "/api/option/", map[string]any{
+		"key":   "GlobalApiRateLimitNum",
+		"value": "450",
+	})
+	performSessionJSONRequest(t, engine, loginCookie, http.MethodPut, "/api/option/", map[string]any{
+		"key":   "GlobalApiRateLimitDuration",
+		"value": "240",
+	})
+	performSessionJSONRequest(t, engine, loginCookie, http.MethodPut, "/api/option/", map[string]any{
+		"key":   "CriticalRateLimitNum",
+		"value": "150",
+	})
+	performSessionJSONRequest(t, engine, loginCookie, http.MethodPut, "/api/option/", map[string]any{
+		"key":   "CriticalRateLimitDuration",
+		"value": "900",
+	})
+
+	if common.GlobalApiRateLimitNum != 450 {
+		t.Fatalf("expected GlobalApiRateLimitNum to be hot reloaded, got %d", common.GlobalApiRateLimitNum)
+	}
+	if common.GlobalApiRateLimitDuration != 240 {
+		t.Fatalf("expected GlobalApiRateLimitDuration to be hot reloaded, got %d", common.GlobalApiRateLimitDuration)
+	}
+	if common.CriticalRateLimitNum != 150 {
+		t.Fatalf("expected CriticalRateLimitNum to be hot reloaded, got %d", common.CriticalRateLimitNum)
+	}
+	if common.CriticalRateLimitDuration != 900 {
+		t.Fatalf("expected CriticalRateLimitDuration to be hot reloaded, got %d", common.CriticalRateLimitDuration)
+	}
+
+	resp := performSessionJSONRequest(t, engine, loginCookie, http.MethodGet, "/api/option/", nil)
+	var options []model.Option
+	decodeResponseData(t, resp, &options)
+
+	optionMap := make(map[string]string, len(options))
+	for _, option := range options {
+		optionMap[option.Key] = option.Value
+	}
+
+	if optionMap["GlobalApiRateLimitNum"] != "450" {
+		t.Fatalf("expected option payload to include GlobalApiRateLimitNum=450, got %q", optionMap["GlobalApiRateLimitNum"])
+	}
+	if optionMap["CriticalRateLimitDuration"] != "900" {
+		t.Fatalf("expected option payload to include CriticalRateLimitDuration=900, got %q", optionMap["CriticalRateLimitDuration"])
+	}
+}
+
+func loginAsRoot(t *testing.T, engine http.Handler) *http.Cookie {
+	t.Helper()
+	payload, err := json.Marshal(map[string]any{
+		"username": "root",
+		"password": "123456",
+	})
+	if err != nil {
+		t.Fatalf("failed to marshal login payload: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/user/login", bytes.NewReader(payload))
+	req.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected login status %d: %s", recorder.Code, recorder.Body.String())
+	}
+
+	var resp apiResponse
+	if err = json.Unmarshal(recorder.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to decode login response: %v", err)
+	}
+	if !resp.Success {
+		t.Fatalf("root login failed: %s", resp.Message)
+	}
+
+	for _, cookie := range recorder.Result().Cookies() {
+		if cookie.Name == "session" {
+			return cookie
+		}
+	}
+	t.Fatal("expected session cookie after root login")
+	return nil
+}
+
+func performSessionJSONRequest(t *testing.T, engine http.Handler, sessionCookie *http.Cookie, method string, path string, body any) apiResponse {
+	t.Helper()
+	var payload []byte
+	var err error
+	if body != nil {
+		payload, err = json.Marshal(body)
+		if err != nil {
+			t.Fatalf("failed to marshal request body: %v", err)
+		}
+	}
+
+	req := httptest.NewRequest(method, path, bytes.NewReader(payload))
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.AddCookie(sessionCookie)
+
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected status %d for %s %s: %s", recorder.Code, method, path, recorder.Body.String())
+	}
+
+	var resp apiResponse
+	if err = json.Unmarshal(recorder.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to unmarshal response: %v", err)
+	}
+	if !resp.Success {
+		t.Fatalf("request %s %s failed: %s", method, path, resp.Message)
+	}
+	return resp
+}
+
+func TestPhase2AgentLifecycle(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	adminToken := prepareRootToken(t)
+
+	createRouteAndPublishVersion(t, engine, adminToken)
+
+	dashboardResp := performJSONRequest(t, engine, adminToken, http.MethodGet, "/api/dashboard/overview", nil)
+	var dashboard service.DashboardOverviewView
+	decodeResponseData(t, dashboardResp, &dashboard)
+	if dashboard.Summary.TotalNodes != 0 {
+		t.Fatalf("expected empty dashboard node summary before node registration, got %+v", dashboard.Summary)
+	}
+
+	unauthorizedRequest := httptest.NewRequest(http.MethodPost, "/api/agent/nodes/register", bytes.NewReader([]byte(`{}`)))
+	unauthorizedRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(unauthorizedRecorder, unauthorizedRequest)
+	if unauthorizedRecorder.Code != http.StatusUnauthorized {
+		t.Fatalf("expected unauthorized status for missing discovery token, got %d", unauthorizedRecorder.Code)
+	}
+
+	createdNodeResp := performJSONRequest(t, engine, adminToken, http.MethodPost, "/api/nodes/", map[string]any{
+		"name":                "shanghai-edge-1",
+		"geo_manual_override": true,
+		"geo_name":            "Shanghai",
+		"geo_latitude":        31.2304,
+		"geo_longitude":       121.4737,
+	})
+	var createdNode service.NodeView
+	decodeResponseData(t, createdNodeResp, &createdNode)
+	if createdNode.AgentToken == "" || createdNode.Status != service.NodeStatusPending {
+		t.Fatal("expected created node to expose agent token with pending status")
+	}
+	if createdNode.GeoName != "Shanghai" || createdNode.GeoLatitude == nil || createdNode.GeoLongitude == nil {
+		t.Fatalf("expected created node to expose geo metadata, got %+v", createdNode)
+	}
+
+	heartbeatPayload := map[string]any{
+		"node_id":           "spoofed-node-id",
+		"name":              "shanghai-edge-1",
+		"ip":                "10.0.0.9",
+		"agent_version":     "0.1.1",
+		"nginx_version":     "1.27.1.2",
+		"openresty_status":  service.OpenrestyStatusUnhealthy,
+		"openresty_message": "docker run openresty failed: bind 80 already allocated",
+		"current_version":   "",
+		"last_error":        "",
+	}
+	resp := performAgentJSONRequestWithToken(t, engine, createdNode.AgentToken, http.MethodPost, "/api/agent/nodes/heartbeat", heartbeatPayload)
+	var registeredNode model.Node
+	decodeResponseData(t, resp, &registeredNode)
+	if registeredNode.IP != "10.0.0.9" || registeredNode.AgentVersion != "0.1.1" || registeredNode.NodeID != createdNode.NodeID {
+		t.Fatal("expected heartbeat to update node metadata")
+	}
+	if registeredNode.OpenrestyStatus != service.OpenrestyStatusUnhealthy {
+		t.Fatal("expected heartbeat to update openresty status")
+	}
+
+	activeConfigResp := performAgentJSONRequestWithToken(t, engine, createdNode.AgentToken, http.MethodGet, "/api/agent/config-versions/active", nil)
+	var activeConfig service.AgentConfigResponse
+	decodeResponseData(t, activeConfigResp, &activeConfig)
+	if activeConfig.Version == "" || activeConfig.RenderedConfig == "" || activeConfig.Checksum == "" {
+		t.Fatal("expected active config response to contain version payload")
+	}
+
+	successApplyResp := performAgentJSONRequestWithToken(t, engine, createdNode.AgentToken, http.MethodPost, "/api/agent/apply-logs", map[string]any{
+		"node_id": "spoofed-node-id",
+		"version": activeConfig.Version,
+		"result":  service.ApplyResultOK,
+		"message": "apply ok",
+	})
+	var successApplyLog model.ApplyLog
+	decodeResponseData(t, successApplyResp, &successApplyLog)
+	if successApplyLog.Result != service.ApplyResultOK {
+		t.Fatal("expected apply log success to be recorded")
+	}
+
+	failedApplyResp := performAgentJSONRequestWithToken(t, engine, createdNode.AgentToken, http.MethodPost, "/api/agent/apply-logs", map[string]any{
+		"node_id": "spoofed-node-id",
+		"version": activeConfig.Version,
+		"result":  service.ApplyResultFailed,
+		"message": "openresty reload failed",
+	})
+	var failedApplyLog model.ApplyLog
+	decodeResponseData(t, failedApplyResp, &failedApplyLog)
+	if failedApplyLog.Result != service.ApplyResultFailed {
+		t.Fatal("expected failed apply log to be recorded")
+	}
+
+	nodesResp := performJSONRequest(t, engine, adminToken, http.MethodGet, "/api/nodes/", nil)
+	var nodes []service.NodeView
+	decodeResponseData(t, nodesResp, &nodes)
+	if len(nodes) != 1 {
+		t.Fatalf("expected 1 node, got %d", len(nodes))
+	}
+	if nodes[0].Status != service.NodeStatusOnline {
+		t.Fatal("expected registered node to become online")
+	}
+	if nodes[0].AgentToken != createdNode.AgentToken {
+		t.Fatal("expected node auth token to remain stable after occupancy")
+	}
+	if nodes[0].LatestApplyResult != service.ApplyResultFailed || nodes[0].LatestApplyMessage != "openresty reload failed" {
+		t.Fatal("expected node list to expose latest apply status")
+	}
+	if nodes[0].CurrentVersion != activeConfig.Version {
+		t.Fatal("expected node current_version to remain at last successful version")
+	}
+	if nodes[0].LastError != "openresty reload failed" {
+		t.Fatal("expected node last_error to reflect failed apply")
+	}
+	if nodes[0].OpenrestyStatus != service.OpenrestyStatusUnhealthy {
+		t.Fatal("expected node list to expose openresty status")
+	}
+	if nodes[0].OpenrestyMessage != "docker run openresty failed: bind 80 already allocated" {
+		t.Fatal("expected node list to expose openresty message")
+	}
+
+	observabilityResp := performJSONRequest(t, engine, adminToken, http.MethodGet, "/api/nodes/"+toString(createdNode.ID)+"/observability?hours=24&limit=20", nil)
+	var observability service.NodeObservabilityView
+	decodeResponseData(t, observabilityResp, &observability)
+	if observability.NodeID != createdNode.NodeID {
+		t.Fatalf("expected observability response for node %s, got %s", createdNode.NodeID, observability.NodeID)
+	}
+
+	restartResp := performJSONRequest(t, engine, adminToken, http.MethodPost, "/api/nodes/"+toString(createdNode.ID)+"/openresty-restart", nil)
+	decodeResponseData(t, restartResp, &createdNode)
+	if !createdNode.RestartOpenrestyRequested {
+		t.Fatal("expected openresty restart request flag to be set")
+	}
+
+	rawHeartbeatPayload, err := json.Marshal(heartbeatPayload)
+	if err != nil {
+		t.Fatalf("failed to marshal heartbeat payload: %v", err)
+	}
+	restartHeartbeatReq := httptest.NewRequest(http.MethodPost, "/api/agent/nodes/heartbeat", bytes.NewReader(rawHeartbeatPayload))
+	restartHeartbeatReq.Header.Set("Content-Type", "application/json")
+	restartHeartbeatReq.Header.Set("X-Agent-Token", createdNode.AgentToken)
+	restartHeartbeatRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(restartHeartbeatRecorder, restartHeartbeatReq)
+	if restartHeartbeatRecorder.Code != http.StatusOK {
+		t.Fatalf("unexpected heartbeat status %d: %s", restartHeartbeatRecorder.Code, restartHeartbeatRecorder.Body.String())
+	}
+	var restartHeartbeatBody struct {
+		Success       bool                      `json:"success"`
+		Message       string                    `json:"message"`
+		AgentSettings service.AgentSettings     `json:"agent_settings"`
+		ActiveConfig  *service.ActiveConfigMeta `json:"active_config"`
+	}
+	if err = json.Unmarshal(restartHeartbeatRecorder.Body.Bytes(), &restartHeartbeatBody); err != nil {
+		t.Fatalf("failed to decode heartbeat response: %v", err)
+	}
+	if !restartHeartbeatBody.Success {
+		t.Fatalf("expected heartbeat request success, got %s", restartHeartbeatBody.Message)
+	}
+	if !restartHeartbeatBody.AgentSettings.RestartOpenrestyNow {
+		t.Fatal("expected heartbeat response to instruct openresty restart")
+	}
+	if restartHeartbeatBody.ActiveConfig == nil || restartHeartbeatBody.ActiveConfig.Version == "" || restartHeartbeatBody.ActiveConfig.Checksum == "" {
+		t.Fatal("expected heartbeat response to include active config summary")
+	}
+
+	logsResp := performJSONRequest(t, engine, adminToken, http.MethodGet, "/api/apply-logs/?node_id="+createdNode.NodeID, nil)
+	var logs []model.ApplyLog
+	decodeResponseData(t, logsResp, &logs)
+	if len(logs) != 2 {
+		t.Fatalf("expected 2 apply logs, got %d", len(logs))
+	}
+
+	updatedNodeResp := performJSONRequest(t, engine, adminToken, http.MethodPut, "/api/nodes/"+toString(createdNode.ID), map[string]any{
+		"name":                "shanghai-edge-1-renamed",
+		"geo_manual_override": true,
+		"geo_name":            "Tokyo",
+		"geo_latitude":        35.6762,
+		"geo_longitude":       139.6503,
+	})
+	decodeResponseData(t, updatedNodeResp, &createdNode)
+	if createdNode.Name != "shanghai-edge-1-renamed" {
+		t.Fatal("expected node name to be editable")
+	}
+	if createdNode.GeoName != "Tokyo" || createdNode.GeoLatitude == nil || createdNode.GeoLongitude == nil {
+		t.Fatalf("expected node geo metadata to be editable, got %+v", createdNode)
+	}
+
+	oldTime := time.Now().Add(-common.NodeOfflineThreshold - time.Minute)
+	if err := model.DB.Model(&model.Node{}).Where("node_id = ?", createdNode.NodeID).Update("last_seen_at", oldTime).Error; err != nil {
+		t.Fatalf("failed to update node last_seen_at: %v", err)
+	}
+	nodesResp = performJSONRequest(t, engine, adminToken, http.MethodGet, "/api/nodes/", nil)
+	decodeResponseData(t, nodesResp, &nodes)
+	if nodes[0].Status != service.NodeStatusOffline {
+		t.Fatal("expected node to be shown as offline after timeout")
+	}
+
+	deleteResp := performJSONRequest(t, engine, adminToken, http.MethodDelete, "/api/nodes/"+toString(createdNode.ID), nil)
+	if !deleteResp.Success {
+		t.Fatalf("expected delete node success, got %s", deleteResp.Message)
+	}
+
+	deniedReq := httptest.NewRequest(http.MethodPost, "/api/agent/nodes/heartbeat", bytes.NewReader([]byte(`{"ip":"10.0.0.9","agent_version":"0.1.1"}`)))
+	deniedReq.Header.Set("Content-Type", "application/json")
+	deniedReq.Header.Set("X-Agent-Token", createdNode.AgentToken)
+	deniedRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(deniedRecorder, deniedReq)
+	if deniedRecorder.Code != http.StatusUnauthorized {
+		t.Fatalf("expected deleted node token to be rejected, got %d", deniedRecorder.Code)
+	}
+}
+
+func TestPhase2CustomHeadersPreviewAndDiffLifecycle(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	token := prepareRootToken(t)
+
+	createResp := performJSONRequest(t, engine, token, http.MethodPost, "/api/proxy-routes/", map[string]any{
+		"domain":     "preview.example.com",
+		"origin_url": "https://origin-a.internal",
+		"enabled":    true,
+		"custom_headers": []map[string]any{
+			{"key": "X-Trace-Id", "value": "$request_id"},
+		},
+	})
+	var createdRoute model.ProxyRoute
+	decodeResponseData(t, createResp, &createdRoute)
+	if !strings.Contains(createdRoute.CustomHeaders, "X-Trace-Id") {
+		t.Fatalf("expected custom headers to be stored as json, got %s", createdRoute.CustomHeaders)
+	}
+
+	performJSONRequest(t, engine, token, http.MethodPost, "/api/config-versions/publish", nil)
+
+	performJSONRequest(t, engine, token, http.MethodPut, "/api/proxy-routes/"+toString(createdRoute.ID), map[string]any{
+		"domain":     "preview.example.com",
+		"origin_url": "https://origin-b.internal",
+		"enabled":    true,
+		"custom_headers": []map[string]any{
+			{"key": "X-Trace-Id", "value": "$request_id"},
+			{"key": "X-Release", "value": "candidate"},
+		},
+	})
+	performJSONRequest(t, engine, token, http.MethodPost, "/api/proxy-routes/", map[string]any{
+		"domain":     "new-preview.example.com",
+		"origin_url": "https://origin-new.internal",
+		"enabled":    true,
+	})
+
+	previewResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/config-versions/preview", nil)
+	var preview map[string]any
+	decodeResponseData(t, previewResp, &preview)
+	renderedConfig, _ := preview["rendered_config"].(string)
+	if !strings.Contains(renderedConfig, `proxy_set_header X-Release "candidate";`) {
+		t.Fatalf("expected preview endpoint to return custom header, got %s", renderedConfig)
+	}
+
+	diffResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/config-versions/diff", nil)
+	var diff map[string]any
+	decodeResponseData(t, diffResp, &diff)
+	modifiedDomains, ok := diff["modified_domains"].([]any)
+	if !ok || len(modifiedDomains) != 1 || modifiedDomains[0].(string) != "preview.example.com" {
+		t.Fatalf("unexpected modified domains: %#v", diff["modified_domains"])
+	}
+	addedDomains, ok := diff["added_domains"].([]any)
+	if !ok || len(addedDomains) != 1 || addedDomains[0].(string) != "new-preview.example.com" {
+		t.Fatalf("unexpected added domains: %#v", diff["added_domains"])
+	}
+}
+
+func TestPhase2GlobalDiscoveryRegistration(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	adminToken := prepareRootToken(t)
+	bootstrapResp := performJSONRequest(t, engine, adminToken, http.MethodGet, "/api/nodes/bootstrap-token", nil)
+	var bootstrap service.NodeBootstrapView
+	decodeResponseData(t, bootstrapResp, &bootstrap)
+	if bootstrap.DiscoveryToken == "" {
+		t.Fatal("expected global discovery token to be available")
+	}
+
+	resp := performAgentJSONRequestWithToken(t, engine, bootstrap.DiscoveryToken, http.MethodPost, "/api/agent/nodes/register", map[string]any{
+		"node_id":         "local-node-id",
+		"name":            "bulk-edge-1",
+		"ip":              "10.0.0.18",
+		"agent_version":   "0.2.0",
+		"nginx_version":   "1.25.5",
+		"current_version": "",
+		"last_error":      "",
+	})
+	var registration service.AgentRegistrationResponse
+	decodeResponseData(t, resp, &registration)
+	if registration.AgentToken == "" || registration.NodeID == "" {
+		t.Fatal("expected discovery registration to issue node-specific agent token")
+	}
+
+	nodesResp := performJSONRequest(t, engine, adminToken, http.MethodGet, "/api/nodes/", nil)
+	var nodes []service.NodeView
+	decodeResponseData(t, nodesResp, &nodes)
+	if len(nodes) != 1 {
+		t.Fatalf("expected 1 discovered node, got %d", len(nodes))
+	}
+	if nodes[0].Name != "bulk-edge-1" || nodes[0].AgentToken != registration.AgentToken || nodes[0].Status != service.NodeStatusOnline {
+		t.Fatal("expected discovered node to be created online with issued agent token")
+	}
+}
+
+func performAgentJSONRequestWithToken(t *testing.T, engine http.Handler, token string, method string, path string, body any) apiResponse {
+	t.Helper()
+	var payload []byte
+	var err error
+	if body != nil {
+		payload, err = json.Marshal(body)
+		if err != nil {
+			t.Fatalf("failed to marshal request body: %v", err)
+		}
+	}
+	req := httptest.NewRequest(method, path, bytes.NewReader(payload))
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("X-Agent-Token", token)
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected status %d for %s %s: %s", recorder.Code, method, path, recorder.Body.String())
+	}
+	var resp apiResponse
+	if err = json.Unmarshal(recorder.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to unmarshal response: %v", err)
+	}
+	if !resp.Success {
+		t.Fatalf("request %s %s failed: %s", method, path, resp.Message)
+	}
+	return resp
+}
+
+func createRouteAndPublishVersion(t *testing.T, engine http.Handler, adminToken string) {
+	t.Helper()
+	createBody := map[string]any{
+		"domain":     "agent.example.com",
+		"origin_url": "https://agent-origin.internal",
+		"enabled":    true,
+		"remark":     "agent route",
+	}
+	performJSONRequest(t, engine, adminToken, http.MethodPost, "/api/proxy-routes/", createBody)
+	performJSONRequest(t, engine, adminToken, http.MethodPost, "/api/config-versions/publish", nil)
+}

openflare_server/router/main.go

@@ -0,0 +1,24 @@
+package router
+
+import (
+	"embed"
+	"openflare/middleware"
+
+	"github.com/gin-gonic/gin"
+	swaggerFiles "github.com/swaggo/files"
+	ginSwagger "github.com/swaggo/gin-swagger"
+)
+
+func SetRouter(router *gin.Engine, buildFS embed.FS, indexPage []byte) {
+	SetApiRouter(router)
+	swaggerRoute := router.Group("/swagger")
+	swaggerRoute.Use(middleware.AdminAuth())
+	swaggerRoute.GET("/*any", ginSwagger.WrapHandler(
+		swaggerFiles.Handler,
+		ginSwagger.URL("/swagger/doc.json"),
+		ginSwagger.DocExpansion("list"),
+		ginSwagger.PersistAuthorization(true),
+		ginSwagger.DefaultModelsExpandDepth(1),
+	))
+	setWebRouter(router, buildFS, indexPage)
+}

openflare_server/router/swagger_test.go

@@ -0,0 +1,21 @@
+package router_test
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestGeneratedSwaggerSpecExists(t *testing.T) {
+	data, err := os.ReadFile("../docs/swagger.json")
+	if err != nil {
+		t.Fatalf("failed to read generated swagger spec: %v", err)
+	}
+	content := string(data)
+	if !strings.Contains(content, "\"title\": \"OpenFlare Server API\"") {
+		t.Fatal("expected swagger spec title to exist")
+	}
+	if !strings.Contains(content, "\"/api/proxy-routes/\"") {
+		t.Fatal("expected swagger spec to contain proxy route endpoint")
+	}
+}

openflare_server/router/update_test.go

@@ -0,0 +1,305 @@
+package router_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"openflare/common"
+	"openflare/router"
+	"openflare/service"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-contrib/sessions/cookie"
+	"github.com/gin-gonic/gin"
+)
+
+type roundTripFunc func(req *http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func TestLatestReleaseProxy(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+
+	originalClient := service.UpdateHTTPClientForTest()
+	service.SetUpdateHTTPClientForTest(&http.Client{
+		Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.String() != "https://api.github.com/repos/Rain-kl/OpenFlare/releases/latest" {
+				t.Fatalf("unexpected request url: %s", req.URL.String())
+			}
+			if req.Header.Get("Accept") != "application/vnd.github+json" {
+				t.Fatalf("unexpected accept header: %s", req.Header.Get("Accept"))
+			}
+			if req.Header.Get("User-Agent") != "OpenFlare-Server" {
+				t.Fatalf("unexpected user-agent header: %s", req.Header.Get("User-Agent"))
+			}
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Header:     make(http.Header),
+				Body: io.NopCloser(strings.NewReader(`{
+					"tag_name":"v1.2.3",
+					"body":"release notes",
+					"html_url":"https://github.com/Rain-kl/OpenFlare/releases/tag/v1.2.3",
+					"published_at":"2026-03-11T00:00:00Z"
+				}`)),
+			}, nil
+		}),
+	})
+	t.Cleanup(func() {
+		service.SetUpdateHTTPClientForTest(originalClient)
+	})
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	loginBody, err := json.Marshal(map[string]string{
+		"username": "root",
+		"password": "123456",
+	})
+	if err != nil {
+		t.Fatalf("failed to marshal login body: %v", err)
+	}
+	loginReq := httptest.NewRequest(http.MethodPost, "/api/user/login", bytes.NewReader(loginBody))
+	loginReq.Header.Set("Content-Type", "application/json")
+	loginRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(loginRecorder, loginReq)
+	if loginRecorder.Code != http.StatusOK {
+		t.Fatalf("unexpected login status code: %d", loginRecorder.Code)
+	}
+	loginResult := loginRecorder.Result()
+	defer loginResult.Body.Close()
+
+	req := httptest.NewRequest(http.MethodGet, "/api/update/latest-release", nil)
+	for _, cookieValue := range loginResult.Cookies() {
+		req.AddCookie(cookieValue)
+	}
+
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected status code: %d", recorder.Code)
+	}
+
+	var resp apiResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if !resp.Success {
+		t.Fatalf("expected success response, got message: %s", resp.Message)
+	}
+
+	var data map[string]any
+	if err := json.Unmarshal(resp.Data, &data); err != nil {
+		t.Fatalf("failed to decode response data: %v", err)
+	}
+	if data["tag_name"] != "v1.2.3" {
+		t.Fatalf("unexpected tag_name: %#v", data["tag_name"])
+	}
+	if data["current_version"] != common.Version {
+		t.Fatalf("unexpected current_version: %#v", data["current_version"])
+	}
+}
+
+func loginRootAndBuildEngine(t *testing.T) (*gin.Engine, []*http.Cookie) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	loginBody, err := json.Marshal(map[string]string{
+		"username": "root",
+		"password": "123456",
+	})
+	if err != nil {
+		t.Fatalf("failed to marshal login body: %v", err)
+	}
+	loginReq := httptest.NewRequest(http.MethodPost, "/api/user/login", bytes.NewReader(loginBody))
+	loginReq.Header.Set("Content-Type", "application/json")
+	loginRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(loginRecorder, loginReq)
+	if loginRecorder.Code != http.StatusOK {
+		t.Fatalf("unexpected login status code: %d", loginRecorder.Code)
+	}
+	loginResult := loginRecorder.Result()
+	defer loginResult.Body.Close()
+
+	return engine, loginResult.Cookies()
+}
+
+func fakeManualServerBinary(version string) (string, []byte) {
+	if runtime.GOOS == "windows" {
+		return "openflare-server-test.cmd", []byte("@echo off\r\necho " + version + "\r\n")
+	}
+	return "openflare-server-test.sh", []byte("#!/bin/sh\necho " + version + "\n")
+}
+
+func TestManualUploadRoute(t *testing.T) {
+	originalVersion := common.Version
+	common.Version = "v0.4.0"
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		service.SetServerBinaryUpgradeExecutorForTest(nil)
+		service.SetServerUpgradeDispatchDelayForTest(500 * time.Millisecond)
+	})
+
+	engine, cookies := loginRootAndBuildEngine(t)
+	fileName, content := fakeManualServerBinary("v0.5.0")
+
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	part, err := writer.CreateFormFile("binary", fileName)
+	if err != nil {
+		t.Fatalf("failed to create form file: %v", err)
+	}
+	if _, err = part.Write(content); err != nil {
+		t.Fatalf("failed to write upload content: %v", err)
+	}
+	if err = writer.Close(); err != nil {
+		t.Fatalf("failed to close multipart writer: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/update/manual-upload", body)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	for _, cookieValue := range cookies {
+		req.AddCookie(cookieValue)
+	}
+
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected status code: %d", recorder.Code)
+	}
+
+	var resp apiResponse
+	if err = json.Unmarshal(recorder.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if !resp.Success {
+		t.Fatalf("expected success response, got message: %s", resp.Message)
+	}
+
+	var data map[string]any
+	if err = json.Unmarshal(resp.Data, &data); err != nil {
+		t.Fatalf("failed to decode response data: %v", err)
+	}
+	if data["detected_version"] != "v0.5.0" {
+		t.Fatalf("unexpected detected_version: %#v", data["detected_version"])
+	}
+	if data["ready_to_upgrade"] != true {
+		t.Fatalf("expected ready_to_upgrade to be true: %#v", data["ready_to_upgrade"])
+	}
+	if data["upload_token"] == "" {
+		t.Fatal("expected upload_token to be returned")
+	}
+}
+
+func TestManualUpgradeConfirmRoute(t *testing.T) {
+	originalVersion := common.Version
+	originalExecutor := service.ServerBinaryUpgradeExecutorForTest()
+	originalDelay := service.ServerUpgradeDispatchDelayForTest()
+	common.Version = "v0.4.0"
+	called := make(chan string, 1)
+	service.SetServerBinaryUpgradeExecutorForTest(func(execPath string, tempPath string) error {
+		called <- tempPath
+		return nil
+	})
+	service.SetServerUpgradeDispatchDelayForTest(0)
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		service.SetServerBinaryUpgradeExecutorForTest(originalExecutor)
+		service.SetServerUpgradeDispatchDelayForTest(originalDelay)
+	})
+
+	engine, cookies := loginRootAndBuildEngine(t)
+	fileName, content := fakeManualServerBinary("v0.5.0")
+
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	part, err := writer.CreateFormFile("binary", fileName)
+	if err != nil {
+		t.Fatalf("failed to create form file: %v", err)
+	}
+	if _, err = part.Write(content); err != nil {
+		t.Fatalf("failed to write upload content: %v", err)
+	}
+	if err = writer.Close(); err != nil {
+		t.Fatalf("failed to close multipart writer: %v", err)
+	}
+
+	uploadReq := httptest.NewRequest(http.MethodPost, "/api/update/manual-upload", body)
+	uploadReq.Header.Set("Content-Type", writer.FormDataContentType())
+	for _, cookieValue := range cookies {
+		uploadReq.AddCookie(cookieValue)
+	}
+
+	uploadRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(uploadRecorder, uploadReq)
+	if uploadRecorder.Code != http.StatusOK {
+		t.Fatalf("unexpected upload status code: %d", uploadRecorder.Code)
+	}
+
+	var uploadResp apiResponse
+	if err = json.Unmarshal(uploadRecorder.Body.Bytes(), &uploadResp); err != nil {
+		t.Fatalf("failed to decode upload response: %v", err)
+	}
+	if !uploadResp.Success {
+		t.Fatalf("expected upload success, got message: %s", uploadResp.Message)
+	}
+
+	var uploadData map[string]any
+	if err = json.Unmarshal(uploadResp.Data, &uploadData); err != nil {
+		t.Fatalf("failed to decode upload response data: %v", err)
+	}
+	uploadToken, _ := uploadData["upload_token"].(string)
+	if uploadToken == "" {
+		t.Fatal("expected upload token in upload response")
+	}
+
+	confirmBody, err := json.Marshal(map[string]string{"upload_token": uploadToken})
+	if err != nil {
+		t.Fatalf("failed to marshal confirm body: %v", err)
+	}
+	confirmReq := httptest.NewRequest(http.MethodPost, "/api/update/manual-upgrade", bytes.NewReader(confirmBody))
+	confirmReq.Header.Set("Content-Type", "application/json")
+	for _, cookieValue := range cookies {
+		confirmReq.AddCookie(cookieValue)
+	}
+
+	confirmRecorder := httptest.NewRecorder()
+	engine.ServeHTTP(confirmRecorder, confirmReq)
+	if confirmRecorder.Code != http.StatusOK {
+		t.Fatalf("unexpected confirm status code: %d", confirmRecorder.Code)
+	}
+
+	var confirmResp apiResponse
+	if err = json.Unmarshal(confirmRecorder.Body.Bytes(), &confirmResp); err != nil {
+		t.Fatalf("failed to decode confirm response: %v", err)
+	}
+	if !confirmResp.Success {
+		t.Fatalf("expected confirm success, got message: %s", confirmResp.Message)
+	}
+
+	select {
+	case tempPath := <-called:
+		if tempPath == "" {
+			t.Fatal("expected manual upgrade executor to receive temp path")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("expected manual upgrade executor to be called")
+	}
+}

openflare_server/router/web-router.go

@@ -0,0 +1,89 @@
+package router
+
+import (
+	"embed"
+	"github.com/gin-contrib/static"
+	"github.com/gin-gonic/gin"
+	"io/fs"
+	"net/http"
+	"openflare/controller"
+	"openflare/middleware"
+	"openflare/utils/embedfs"
+	pathpkg "path"
+	"strings"
+)
+
+func setWebRouter(router *gin.Engine, buildFS embed.FS, indexPage []byte) {
+	exportedBuildFS, err := fs.Sub(buildFS, "web/build")
+	if err != nil {
+		panic(err)
+	}
+
+	router.Use(middleware.GlobalWebRateLimit())
+	fileDownloadRoute := router.Group("/")
+	fileDownloadRoute.GET("/upload/:file", middleware.DownloadRateLimit(), controller.DownloadFile)
+	router.Use(normalizeStaticExportDataNavigation())
+	router.Use(middleware.Cache())
+	router.Use(static.Serve("/", embedfs.EmbedFolder(buildFS, "web/build")))
+	router.NoRoute(func(c *gin.Context) {
+		if serveExportedPage(c, exportedBuildFS) {
+			return
+		}
+
+		if isStaticAssetRequest(c.Request.URL.Path) {
+			c.Status(http.StatusNotFound)
+			return
+		}
+
+		c.Data(http.StatusOK, "text/html; charset=utf-8", indexPage)
+	})
+}
+
+func serveExportedPage(c *gin.Context, buildFS fs.FS) bool {
+	requestPath := strings.Trim(c.Request.URL.Path, "/")
+
+	candidates := []string{"index.html"}
+	if requestPath != "" {
+		candidates = []string{
+			requestPath + ".html",
+			pathpkg.Join(requestPath, "index.html"),
+		}
+	}
+
+	for _, candidate := range candidates {
+		content, err := fs.ReadFile(buildFS, candidate)
+		if err == nil {
+			c.Data(http.StatusOK, "text/html; charset=utf-8", content)
+			return true
+		}
+	}
+
+	return false
+}
+
+func normalizeStaticExportDataNavigation() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		requestPath := c.Request.URL.Path
+		if strings.HasSuffix(requestPath, ".txt") && isDocumentNavigationRequest(c.Request) {
+			normalizedPath := strings.TrimSuffix(requestPath, ".txt")
+			if normalizedPath == "" {
+				normalizedPath = "/"
+			}
+			c.Request.URL.Path = normalizedPath
+		}
+
+		c.Next()
+	}
+}
+
+func isDocumentNavigationRequest(request *http.Request) bool {
+	if request.Header.Get("Sec-Fetch-Mode") == "navigate" || request.Header.Get("Sec-Fetch-Dest") == "document" {
+		return true
+	}
+
+	return strings.Contains(request.Header.Get("Accept"), "text/html")
+}
+
+func isStaticAssetRequest(requestPath string) bool {
+	return strings.HasPrefix(requestPath, "/_next/") || pathpkg.Ext(requestPath) != ""
+}

openflare_server/router/web-router_test.go

@@ -0,0 +1,95 @@
+package router
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"openflare/middleware"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestNormalizeStaticExportDataNavigationRewritesDocumentRequests(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	engine := gin.New()
+	engine.Use(normalizeStaticExportDataNavigation())
+	engine.GET("/*any", func(c *gin.Context) {
+		c.String(http.StatusOK, c.Request.URL.Path)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/website.txt", nil)
+	req.Header.Set("Accept", "text/html,application/xhtml+xml")
+	req.Header.Set("Sec-Fetch-Mode", "navigate")
+	req.Header.Set("Sec-Fetch-Dest", "document")
+
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", recorder.Code)
+	}
+
+	if body := recorder.Body.String(); body != "/website" {
+		t.Fatalf("expected document request to be rewritten to /website, got %q", body)
+	}
+}
+
+func TestNormalizeStaticExportDataNavigationKeepsDataRequests(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	engine := gin.New()
+	engine.Use(normalizeStaticExportDataNavigation())
+	engine.GET("/*any", func(c *gin.Context) {
+		c.String(http.StatusOK, c.Request.URL.Path)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/website.txt", nil)
+	req.Header.Set("Accept", "*/*")
+	req.Header.Set("Sec-Fetch-Mode", "cors")
+	req.Header.Set("Sec-Fetch-Dest", "empty")
+
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", recorder.Code)
+	}
+
+	if body := recorder.Body.String(); body != "/website.txt" {
+		t.Fatalf("expected data request to keep txt path, got %q", body)
+	}
+}
+
+func TestCacheHeadersDisableExportedPageCaching(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	engine := gin.New()
+	engine.Use(middleware.Cache())
+	engine.GET("/website", func(c *gin.Context) {
+		c.String(http.StatusOK, "ok")
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/website", nil)
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+
+	if got := recorder.Header().Get("Cache-Control"); got != "no-store, no-cache, must-revalidate" {
+		t.Fatalf("unexpected cache-control for page: %q", got)
+	}
+}
+
+func TestCacheHeadersKeepImmutableStaticAssets(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	engine := gin.New()
+	engine.Use(middleware.Cache())
+	engine.GET("/_next/static/app.js", func(c *gin.Context) {
+		c.String(http.StatusOK, "ok")
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/_next/static/app.js", nil)
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+
+	if got := recorder.Header().Get("Cache-Control"); got != "public, max-age=31536000, immutable" {
+		t.Fatalf("unexpected cache-control for static asset: %q", got)
+	}
+}

openflare_server/service/access_log.go

@@ -0,0 +1,111 @@
+package service
+
+import (
+	"openflare/model"
+	"strings"
+	"time"
+)
+
+const (
+	defaultAccessLogPageSize = 50
+	maxAccessLogPageSize     = 200
+)
+
+type AccessLogView struct {
+	ID         uint      `json:"id"`
+	NodeID     string    `json:"node_id"`
+	NodeName   string    `json:"node_name"`
+	LoggedAt   time.Time `json:"logged_at"`
+	RemoteAddr string    `json:"remote_addr"`
+	Region     string    `json:"region"`
+	Host       string    `json:"host"`
+	Path       string    `json:"path"`
+	StatusCode int       `json:"status_code"`
+}
+
+type AccessLogList struct {
+	Items       []AccessLogView `json:"items"`
+	Page        int             `json:"page"`
+	PageSize    int             `json:"page_size"`
+	HasMore     bool            `json:"has_more"`
+	TotalRecord int64           `json:"total_record"`
+	TotalIP     int64           `json:"total_ip"`
+}
+
+func ListAccessLogs(nodeID string, page int, pageSize int) (*AccessLogList, error) {
+	normalizedPage := normalizeAccessLogPage(page)
+	normalizedPageSize := normalizeAccessLogPageSize(pageSize)
+	offset := normalizedPage * normalizedPageSize
+	trimmedNodeID := strings.TrimSpace(nodeID)
+	since := time.Now().Add(-nodeAccessLogRetentionWindow)
+	logs, err := model.ListNodeAccessLogs(
+		trimmedNodeID,
+		since,
+		offset,
+		normalizedPageSize+1,
+	)
+	if err != nil {
+		return nil, err
+	}
+	totalRecords, totalIPs, err := model.CountNodeAccessLogs(trimmedNodeID, since)
+	if err != nil {
+		return nil, err
+	}
+	nodes, err := model.ListNodes()
+	if err != nil {
+		return nil, err
+	}
+	nodeNames := make(map[string]string, len(nodes))
+	for _, node := range nodes {
+		if node == nil {
+			continue
+		}
+		nodeNames[node.NodeID] = node.Name
+	}
+	hasMore := len(logs) > normalizedPageSize
+	if hasMore {
+		logs = logs[:normalizedPageSize]
+	}
+	views := make([]AccessLogView, 0, len(logs))
+	for _, item := range logs {
+		if item == nil {
+			continue
+		}
+		views = append(views, AccessLogView{
+			ID:         item.ID,
+			NodeID:     item.NodeID,
+			NodeName:   nodeNames[item.NodeID],
+			LoggedAt:   item.LoggedAt,
+			RemoteAddr: item.RemoteAddr,
+			Region:     item.Region,
+			Host:       item.Host,
+			Path:       item.Path,
+			StatusCode: item.StatusCode,
+		})
+	}
+	return &AccessLogList{
+		Items:       views,
+		Page:        normalizedPage,
+		PageSize:    normalizedPageSize,
+		HasMore:     hasMore,
+		TotalRecord: totalRecords,
+		TotalIP:     totalIPs,
+	}, nil
+}
+
+func normalizeAccessLogPage(page int) int {
+	if page < 0 {
+		return 0
+	}
+	return page
+}
+
+func normalizeAccessLogPageSize(pageSize int) int {
+	if pageSize <= 0 {
+		return defaultAccessLogPageSize
+	}
+	if pageSize > maxAccessLogPageSize {
+		return maxAccessLogPageSize
+	}
+	return pageSize
+}

openflare_server/service/access_log_region.go

@@ -0,0 +1,91 @@
+package service
+
+import (
+	"log/slog"
+	"net"
+	"openflare/utils/geoip"
+	"strings"
+)
+
+var accessLogGeoProviderFactory = func() (geoip.GeoIPService, error) {
+	return geoip.NewMaxMindGeoIPService()
+}
+
+type accessLogRegionResolver struct {
+	provider geoip.GeoIPService
+	cache    map[string]string
+}
+
+func newAccessLogRegionResolver() (*accessLogRegionResolver, error) {
+	provider, err := accessLogGeoProviderFactory()
+	if err != nil {
+		return nil, err
+	}
+	return &accessLogRegionResolver{
+		provider: provider,
+		cache:    make(map[string]string),
+	}, nil
+}
+
+func (r *accessLogRegionResolver) Close() {
+	if r == nil || r.provider == nil {
+		return
+	}
+	if err := r.provider.Close(); err != nil {
+		slog.Warn("close access log geo provider failed", "error", err)
+	}
+}
+
+func (r *accessLogRegionResolver) Resolve(rawIP string) string {
+	if r == nil || r.provider == nil {
+		return ""
+	}
+	normalizedIP := normalizeAccessLogIP(rawIP)
+	if normalizedIP == "" {
+		return ""
+	}
+	if cached, ok := r.cache[normalizedIP]; ok {
+		return cached
+	}
+
+	info, err := r.provider.GetGeoInfo(net.ParseIP(normalizedIP))
+	if err != nil || info == nil {
+		r.cache[normalizedIP] = ""
+		return ""
+	}
+
+	region := strings.TrimSpace(info.Name)
+	if region == "" {
+		region = strings.TrimSpace(info.ISOCode)
+	}
+	r.cache[normalizedIP] = region
+	return region
+}
+
+func normalizeAccessLogIP(raw string) string {
+	trimmed := strings.TrimSpace(raw)
+	if trimmed == "" {
+		return ""
+	}
+
+	if ip := net.ParseIP(trimmed); ip != nil {
+		return ip.String()
+	}
+
+	trimmed = strings.TrimPrefix(trimmed, "[")
+	trimmed = strings.TrimSuffix(trimmed, "]")
+	if ip := net.ParseIP(trimmed); ip != nil {
+		return ip.String()
+	}
+
+	host, _, err := net.SplitHostPort(strings.TrimSpace(raw))
+	if err != nil {
+		return ""
+	}
+	host = strings.TrimPrefix(host, "[")
+	host = strings.TrimSuffix(host, "]")
+	if ip := net.ParseIP(host); ip != nil {
+		return ip.String()
+	}
+	return ""
+}

openflare_server/service/access_log_test.go

@@ -0,0 +1,100 @@
+package service
+
+import (
+	"openflare/model"
+	"testing"
+	"time"
+)
+
+func TestListAccessLogsIncludesSummaryTotals(t *testing.T) {
+	setupServiceTestDB(t)
+
+	now := time.Now()
+	if err := model.DB.Create(&model.Node{
+		NodeID: "node-a",
+		Name:   "edge-a",
+	}).Error; err != nil {
+		t.Fatalf("failed to seed node-a: %v", err)
+	}
+	if err := model.DB.Create(&model.Node{
+		NodeID: "node-b",
+		Name:   "edge-b",
+	}).Error; err != nil {
+		t.Fatalf("failed to seed node-b: %v", err)
+	}
+
+	logs := []*model.NodeAccessLog{
+		{
+			NodeID:     "node-a",
+			LoggedAt:   now.Add(-5 * time.Minute),
+			RemoteAddr: "1.1.1.1",
+			Region:     "United States",
+			Host:       "a.example.com",
+			Path:       "/alpha",
+			StatusCode: 200,
+		},
+		{
+			NodeID:     "node-a",
+			LoggedAt:   now.Add(-4 * time.Minute),
+			RemoteAddr: "2.2.2.2",
+			Region:     "China",
+			Host:       "a.example.com",
+			Path:       "/beta",
+			StatusCode: 404,
+		},
+		{
+			NodeID:     "node-b",
+			LoggedAt:   now.Add(-3 * time.Minute),
+			RemoteAddr: "1.1.1.1",
+			Region:     "United States",
+			Host:       "b.example.com",
+			Path:       "/gamma",
+			StatusCode: 502,
+		},
+		{
+			NodeID:     "node-b",
+			LoggedAt:   now.Add(-2 * time.Minute),
+			RemoteAddr: "",
+			Host:       "b.example.com",
+			Path:       "/delta",
+			StatusCode: 200,
+		},
+	}
+	if err := model.DB.Create(&logs).Error; err != nil {
+		t.Fatalf("failed to seed access logs: %v", err)
+	}
+
+	result, err := ListAccessLogs("", 0, 2)
+	if err != nil {
+		t.Fatalf("ListAccessLogs failed: %v", err)
+	}
+	if result.TotalRecord != 4 {
+		t.Fatalf("expected total_record=4, got %d", result.TotalRecord)
+	}
+	if result.TotalIP != 2 {
+		t.Fatalf("expected total_ip=2, got %d", result.TotalIP)
+	}
+	if len(result.Items) != 2 {
+		t.Fatalf("expected current page items=2, got %d", len(result.Items))
+	}
+	if result.Items[1].Region == "" {
+		t.Fatalf("expected region to be returned, got %+v", result.Items[1])
+	}
+	if !result.HasMore {
+		t.Fatal("expected has_more to be true")
+	}
+
+	filtered, err := ListAccessLogs("node-a", 0, 50)
+	if err != nil {
+		t.Fatalf("ListAccessLogs filtered failed: %v", err)
+	}
+	if filtered.TotalRecord != 2 {
+		t.Fatalf("expected filtered total_record=2, got %d", filtered.TotalRecord)
+	}
+	if filtered.TotalIP != 2 {
+		t.Fatalf("expected filtered total_ip=2, got %d", filtered.TotalIP)
+	}
+	if len(filtered.Items) != 2 {
+		t.Fatalf("expected filtered items=2, got %d", len(filtered.Items))
+	}
+}

openflare_server/service/agent.go

@@ -0,0 +1,376 @@
+package service
+
+import (
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"openflare/common"
+	"openflare/model"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+const (
+	NodeStatusOnline         = "online"
+	NodeStatusOffline        = "offline"
+	NodeStatusPending        = "pending"
+	ApplyResultOK            = "success"
+	ApplyResultFailed        = "failed"
+	OpenrestyStatusHealthy   = "healthy"
+	OpenrestyStatusUnhealthy = "unhealthy"
+	OpenrestyStatusUnknown   = "unknown"
+)
+
+type AgentNodePayload struct {
+	NodeID                string                             `json:"node_id"`
+	Name                  string                             `json:"name"`
+	IP                    string                             `json:"ip"`
+	AgentVersion          string                             `json:"agent_version"`
+	NginxVersion          string                             `json:"nginx_version"`
+	CurrentVersion        string                             `json:"current_version"`
+	LastError             string                             `json:"last_error"`
+	OpenrestyStatus       string                             `json:"openresty_status"`
+	OpenrestyMessage      string                             `json:"openresty_message"`
+	Profile               *AgentNodeSystemProfile            `json:"profile,omitempty"`
+	Snapshot              *AgentNodeMetricSnapshot           `json:"snapshot,omitempty"`
+	TrafficReport         *AgentNodeTrafficReport            `json:"traffic_report,omitempty"`
+	AccessLogs            []AgentNodeAccessLog               `json:"access_logs,omitempty"`
+	BufferedObservability []AgentBufferedObservabilityRecord `json:"buffered_observability,omitempty"`
+	HealthEvents          []AgentNodeHealthEvent             `json:"health_events"`
+}
+
+type ApplyLogPayload struct {
+	NodeID              string `json:"node_id"`
+	Version             string `json:"version"`
+	Result              string `json:"result"`
+	Message             string `json:"message"`
+	Checksum            string `json:"checksum"`
+	MainConfigChecksum  string `json:"main_config_checksum"`
+	RouteConfigChecksum string `json:"route_config_checksum"`
+	SupportFileCount    int    `json:"support_file_count"`
+}
+
+type AgentConfigResponse struct {
+	Version        string        `json:"version"`
+	Checksum       string        `json:"checksum"`
+	MainConfig     string        `json:"main_config"`
+	RouteConfig    string        `json:"route_config"`
+	RenderedConfig string        `json:"rendered_config"`
+	SupportFiles   []SupportFile `json:"support_files"`
+	CreatedAt      time.Time     `json:"created_at"`
+}
+
+type AgentSettings struct {
+	HeartbeatInterval   int    `json:"heartbeat_interval"`
+	AutoUpdate          bool   `json:"auto_update"`
+	UpdateRepo          string `json:"update_repo"`
+	UpdateNow           bool   `json:"update_now"`
+	UpdateChannel       string `json:"update_channel"`
+	UpdateTag           string `json:"update_tag"`
+	RestartOpenrestyNow bool   `json:"restart_openresty_now"`
+}
+
+type ActiveConfigMeta struct {
+	Version  string `json:"version"`
+	Checksum string `json:"checksum"`
+}
+
+type HeartbeatResponse struct {
+	Node          *model.Node       `json:"node"`
+	AgentSettings *AgentSettings    `json:"agent_settings"`
+	ActiveConfig  *ActiveConfigMeta `json:"active_config"`
+}
+
+type NodeView struct {
+	ID                        uint       `json:"id"`
+	NodeID                    string     `json:"node_id"`
+	Name                      string     `json:"name"`
+	IP                        string     `json:"ip"`
+	GeoName                   string     `json:"geo_name"`
+	GeoLatitude               *float64   `json:"geo_latitude"`
+	GeoLongitude              *float64   `json:"geo_longitude"`
+	GeoManualOverride         bool       `json:"geo_manual_override"`
+	AgentToken                string     `json:"agent_token"`
+	AutoUpdateEnabled         bool       `json:"auto_update_enabled"`
+	UpdateRequested           bool       `json:"update_requested"`
+	UpdateChannel             string     `json:"update_channel"`
+	UpdateTag                 string     `json:"update_tag"`
+	RestartOpenrestyRequested bool       `json:"restart_openresty_requested"`
+	AgentVersion              string     `json:"agent_version"`
+	NginxVersion              string     `json:"nginx_version"`
+	OpenrestyStatus           string     `json:"openresty_status"`
+	OpenrestyMessage          string     `json:"openresty_message"`
+	Status                    string     `json:"status"`
+	CurrentVersion            string     `json:"current_version"`
+	LastSeenAt                time.Time  `json:"last_seen_at"`
+	LastError                 string     `json:"last_error"`
+	LatestApplyResult         string     `json:"latest_apply_result"`
+	LatestApplyMessage        string     `json:"latest_apply_message"`
+	LatestApplyChecksum       string     `json:"latest_apply_checksum"`
+	LatestMainConfigChecksum  string     `json:"latest_main_config_checksum"`
+	LatestRouteConfigChecksum string     `json:"latest_route_config_checksum"`
+	LatestSupportFileCount    int        `json:"latest_support_file_count"`
+	LatestApplyAt             *time.Time `json:"latest_apply_at"`
+	CreatedAt                 time.Time  `json:"created_at"`
+	UpdatedAt                 time.Time  `json:"updated_at"`
+}
+
+func RegisterNode(node *model.Node, payload AgentNodePayload) (*AgentRegistrationResponse, error) {
+	return RegisterNodeWithAgentToken(node, payload)
+}
+
+func HeartbeatNode(node *model.Node, payload AgentNodePayload) (*HeartbeatResponse, error) {
+	slog.Debug("agent heartbeat received", "node_id", node.NodeID, "current_version", strings.TrimSpace(payload.CurrentVersion))
+	payload.NodeID = node.NodeID
+	payload = normalizeAgentNodePayload(payload)
+	if err := validateAgentNodePayload(payload); err != nil {
+		return nil, err
+	}
+	previous := *node
+	updateNow := node.UpdateRequested
+	restartOpenrestyNow := node.RestartOpenrestyRequested
+	updateChannel := normalizeReleaseChannel(node.UpdateChannel)
+	updateTag := strings.TrimSpace(node.UpdateTag)
+	applyNodeRuntime(node, payload, true)
+	node.UpdateRequested = false
+	node.UpdateChannel = ReleaseChannelStable.String()
+	node.UpdateTag = ""
+	node.RestartOpenrestyRequested = false
+	changes := collectNodeHeartbeatChanges(&previous, node)
+	if len(changes) > 0 {
+		if err := model.DB.Model(node).Updates(changes).Error; err != nil {
+			return nil, err
+		}
+	}
+	refreshAgentTokenCache(node)
+	persistHeartbeatObservability(node.NodeID, payload, node.LastSeenAt)
+	activeConfig, err := GetActiveConfigMetaForAgent()
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+	return &HeartbeatResponse{
+		Node: node,
+		AgentSettings: &AgentSettings{
+			HeartbeatInterval:   common.AgentHeartbeatInterval,
+			AutoUpdate:          node.AutoUpdateEnabled,
+			UpdateRepo:          common.AgentUpdateRepo,
+			UpdateNow:           updateNow,
+			UpdateChannel:       updateChannel.String(),
+			UpdateTag:           updateTag,
+			RestartOpenrestyNow: restartOpenrestyNow,
+		},
+		ActiveConfig: activeConfig,
+	}, nil
+}
+
+func GetActiveConfigMetaForAgent() (*ActiveConfigMeta, error) {
+	version, err := model.GetActiveConfigVersion()
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, err
+		}
+		return nil, err
+	}
+	return &ActiveConfigMeta{
+		Version:  version.Version,
+		Checksum: version.Checksum,
+	}, nil
+}
+
+func GetActiveConfigForAgent() (*AgentConfigResponse, error) {
+	version, err := model.GetActiveConfigVersion()
+	if err != nil {
+		slog.Error("agent requested active config but no active version is available")
+		return nil, err
+	}
+	var supportFiles []SupportFile
+	if version.SupportFilesJSON != "" {
+		if err = json.Unmarshal([]byte(version.SupportFilesJSON), &supportFiles); err != nil {
+			return nil, err
+		}
+	}
+	supportFiles = filterCertificateSupportFiles(supportFiles)
+	slog.Debug("agent fetched active config", "version", version.Version, "checksum", version.Checksum)
+	return &AgentConfigResponse{
+		Version:        version.Version,
+		Checksum:       version.Checksum,
+		MainConfig:     version.MainConfig,
+		RouteConfig:    version.RenderedConfig,
+		RenderedConfig: version.RenderedConfig,
+		SupportFiles:   supportFiles,
+		CreatedAt:      version.CreatedAt,
+	}, nil
+}
+
+func filterCertificateSupportFiles(files []SupportFile) []SupportFile {
+	if len(files) == 0 {
+		return nil
+	}
+	filtered := make([]SupportFile, 0, len(files))
+	for _, file := range files {
+		path := strings.ToLower(strings.TrimSpace(file.Path))
+		switch {
+		case strings.HasSuffix(path, ".crt"), strings.HasSuffix(path, ".key"), strings.HasSuffix(path, ".pem"):
+			filtered = append(filtered, file)
+		}
+	}
+	return filtered
+}
+
+func ReportApplyLog(payload ApplyLogPayload) (*model.ApplyLog, error) {
+	now := time.Now()
+	payload.NodeID = strings.TrimSpace(payload.NodeID)
+	payload.Version = strings.TrimSpace(payload.Version)
+	payload.Result = strings.TrimSpace(strings.ToLower(payload.Result))
+	payload.Message = strings.TrimSpace(payload.Message)
+	payload.Checksum = strings.TrimSpace(payload.Checksum)
+	payload.MainConfigChecksum = strings.TrimSpace(payload.MainConfigChecksum)
+	payload.RouteConfigChecksum = strings.TrimSpace(payload.RouteConfigChecksum)
+	if payload.NodeID == "" {
+		return nil, errors.New("node_id 不能为空")
+	}
+	if payload.Version == "" {
+		return nil, errors.New("version 不能为空")
+	}
+	if payload.Result != ApplyResultOK && payload.Result != ApplyResultFailed {
+		return nil, errors.New("result 仅支持 success 或 failed")
+	}
+	slog.Debug("agent apply log received", "node_id", payload.NodeID, "version", payload.Version, "result", payload.Result)
+
+	log := &model.ApplyLog{
+		NodeID:              payload.NodeID,
+		Version:             payload.Version,
+		Result:              payload.Result,
+		Message:             payload.Message,
+		Checksum:            payload.Checksum,
+		MainConfigChecksum:  payload.MainConfigChecksum,
+		RouteConfigChecksum: payload.RouteConfigChecksum,
+		SupportFileCount:    payload.SupportFileCount,
+		CreatedAt:           now,
+	}
+	err := model.DB.Transaction(func(tx *gorm.DB) error {
+		node := &model.Node{}
+		if err := tx.Where("node_id = ?", payload.NodeID).First(node).Error; err != nil {
+			return err
+		}
+		node.Status = NodeStatusOnline
+		node.LastSeenAt = now
+		if payload.Result == ApplyResultOK {
+			node.CurrentVersion = payload.Version
+			node.LastError = ""
+		} else {
+			node.LastError = payload.Message
+		}
+		if err := tx.Create(log).Error; err != nil {
+			return err
+		}
+		return tx.Model(node).Select("status", "last_seen_at", "current_version", "last_error").Updates(node).Error
+	})
+	if err != nil {
+		return nil, err
+	}
+	if payload.Result == ApplyResultOK {
+		slog.Debug("agent apply reported success", "node_id", payload.NodeID, "version", payload.Version)
+	} else {
+		slog.Error("agent apply reported failure", "node_id", payload.NodeID, "version", payload.Version, "message", payload.Message)
+	}
+	return log, nil
+}
+
+func ListNodeViews() ([]*NodeView, error) {
+	nodes, err := model.ListNodes()
+	if err != nil {
+		return nil, err
+	}
+	nodeIDs := make([]string, 0, len(nodes))
+	for _, node := range nodes {
+		nodeIDs = append(nodeIDs, node.NodeID)
+	}
+	latestLogs, err := model.GetLatestApplyLogsByNodeIDs(nodeIDs)
+	if err != nil {
+		return nil, err
+	}
+	views := make([]*NodeView, 0, len(nodes))
+	for _, node := range nodes {
+		computedStatus := computeNodeStatus(node)
+		view := buildNodeView(node)
+		view.Status = computedStatus
+		if log, ok := latestLogs[node.NodeID]; ok {
+			view.LatestApplyResult = log.Result
+			view.LatestApplyMessage = log.Message
+			view.LatestApplyChecksum = log.Checksum
+			view.LatestMainConfigChecksum = log.MainConfigChecksum
+			view.LatestRouteConfigChecksum = log.RouteConfigChecksum
+			view.LatestSupportFileCount = log.SupportFileCount
+			view.LatestApplyAt = &log.CreatedAt
+		}
+		views = append(views, view)
+	}
+	return views, nil
+}
+
+func ListApplyLogs(nodeID string) ([]*model.ApplyLog, error) {
+	return model.ListApplyLogs(strings.TrimSpace(nodeID))
+}
+
+func upsertNode(payload AgentNodePayload) (*model.Node, error) {
+	return nil, errors.New("不再支持匿名自动注册")
+}
+
+func computeNodeStatus(node *model.Node) string {
+	if node == nil {
+		return NodeStatusOffline
+	}
+	if node.LastSeenAt.IsZero() {
+		return NodeStatusPending
+	}
+	if time.Since(node.LastSeenAt) > common.NodeOfflineThreshold {
+		return NodeStatusOffline
+	}
+	return NodeStatusOnline
+}
+
+func collectNodeHeartbeatChanges(previous *model.Node, current *model.Node) map[string]any {
+	if previous == nil || current == nil {
+		return map[string]any{}
+	}
+	changes := make(map[string]any)
+	appendIfChanged := func(key string, before any, after any) {
+		if before != after {
+			changes[key] = after
+		}
+	}
+	appendIfChanged("name", previous.Name, current.Name)
+	appendIfChanged("ip", previous.IP, current.IP)
+	appendIfChanged("geo_name", previous.GeoName, current.GeoName)
+	appendIfChanged("agent_version", previous.AgentVersion, current.AgentVersion)
+	appendIfChanged("nginx_version", previous.NginxVersion, current.NginxVersion)
+	appendIfChanged("openresty_status", previous.OpenrestyStatus, current.OpenrestyStatus)
+	appendIfChanged("openresty_message", previous.OpenrestyMessage, current.OpenrestyMessage)
+	appendIfChanged("status", previous.Status, current.Status)
+	appendIfChanged("current_version", previous.CurrentVersion, current.CurrentVersion)
+	appendIfChanged("last_error", previous.LastError, current.LastError)
+	appendIfChanged("update_requested", previous.UpdateRequested, current.UpdateRequested)
+	appendIfChanged("update_channel", previous.UpdateChannel, current.UpdateChannel)
+	appendIfChanged("update_tag", previous.UpdateTag, current.UpdateTag)
+	appendIfChanged("restart_openresty_requested", previous.RestartOpenrestyRequested, current.RestartOpenrestyRequested)
+	if !coordinatesEqual(previous.GeoLatitude, current.GeoLatitude) {
+		changes["geo_latitude"] = current.GeoLatitude
+	}
+	if !coordinatesEqual(previous.GeoLongitude, current.GeoLongitude) {
+		changes["geo_longitude"] = current.GeoLongitude
+	}
+	if !previous.LastSeenAt.Equal(current.LastSeenAt) {
+		changes["last_seen_at"] = current.LastSeenAt
+	}
+	return changes
+}
+
+func coordinatesEqual(before *float64, after *float64) bool {
+	if before == nil || after == nil {
+		return before == after
+	}
+	return *before == *after
+}

openflare_server/service/config_version.go

@@ -0,0 +1,814 @@
+package service
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"openflare/common"
+	"openflare/model"
+	"sort"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+type ReleaseResult struct {
+	Version *model.ConfigVersion `json:"version"`
+	Routes  []*model.ProxyRoute  `json:"routes"`
+}
+
+type SupportFile struct {
+	Path    string `json:"path"`
+	Content string `json:"content"`
+}
+
+type ConfigPreviewResult struct {
+	SnapshotJSON   string        `json:"snapshot_json"`
+	MainConfig     string        `json:"main_config"`
+	RouteConfig    string        `json:"route_config"`
+	RenderedConfig string        `json:"rendered_config"`
+	SupportFiles   []SupportFile `json:"support_files"`
+	Checksum       string        `json:"checksum"`
+	RouteCount     int           `json:"route_count"`
+}
+
+type ConfigDiffResult struct {
+	ActiveVersion        string                 `json:"active_version,omitempty"`
+	AddedDomains         []string               `json:"added_domains"`
+	RemovedDomains       []string               `json:"removed_domains"`
+	ModifiedDomains      []string               `json:"modified_domains"`
+	MainConfigChanged    bool                   `json:"main_config_changed"`
+	ChangedOptionKeys    []string               `json:"changed_option_keys"`
+	ChangedOptionDetails []ConfigOptionDiffItem `json:"changed_option_details"`
+}
+
+type ConfigOptionDiffItem struct {
+	Key           string `json:"key"`
+	PreviousValue string `json:"previous_value"`
+	CurrentValue  string `json:"current_value"`
+}
+
+type snapshotRoute struct {
+	Domain        string                        `json:"domain"`
+	OriginURL     string                        `json:"origin_url"`
+	Enabled       bool                          `json:"enabled"`
+	EnableHTTPS   bool                          `json:"enable_https"`
+	CertID        *uint                         `json:"cert_id,omitempty"`
+	RedirectHTTP  bool                          `json:"redirect_http"`
+	CustomHeaders []ProxyRouteCustomHeaderInput `json:"custom_headers,omitempty"`
+	Remark        string                        `json:"remark,omitempty"`
+}
+
+type openRestyConfigSnapshot struct {
+	WorkerProcesses          string `json:"worker_processes"`
+	WorkerConnections        int    `json:"worker_connections"`
+	WorkerRlimitNofile       int    `json:"worker_rlimit_nofile"`
+	EventsUse                string `json:"events_use,omitempty"`
+	EventsMultiAcceptEnabled bool   `json:"events_multi_accept_enabled"`
+	KeepaliveTimeout         int    `json:"keepalive_timeout"`
+	KeepaliveRequests        int    `json:"keepalive_requests"`
+	ClientHeaderTimeout      int    `json:"client_header_timeout"`
+	ClientBodyTimeout        int    `json:"client_body_timeout"`
+	ClientMaxBodySize        string `json:"client_max_body_size"`
+	LargeClientHeaderBuffers string `json:"large_client_header_buffers"`
+	SendTimeout              int    `json:"send_timeout"`
+	ProxyConnectTimeout      int    `json:"proxy_connect_timeout"`
+	ProxySendTimeout         int    `json:"proxy_send_timeout"`
+	ProxyReadTimeout         int    `json:"proxy_read_timeout"`
+	WebsocketEnabled         bool   `json:"websocket_enabled"`
+	ProxyRequestBuffering    bool   `json:"proxy_request_buffering"`
+	ProxyBufferingEnabled    bool   `json:"proxy_buffering_enabled"`
+	ProxyBuffers             string `json:"proxy_buffers"`
+	ProxyBufferSize          string `json:"proxy_buffer_size"`
+	ProxyBusyBuffersSize     string `json:"proxy_busy_buffers_size"`
+	GzipEnabled              bool   `json:"gzip_enabled"`
+	GzipMinLength            int    `json:"gzip_min_length"`
+	GzipCompLevel            int    `json:"gzip_comp_level"`
+	CacheEnabled             bool   `json:"cache_enabled"`
+	CachePath                string `json:"cache_path,omitempty"`
+	CacheLevels              string `json:"cache_levels"`
+	CacheInactive            string `json:"cache_inactive"`
+	CacheMaxSize             string `json:"cache_max_size"`
+	CacheKeyTemplate         string `json:"cache_key_template"`
+	CacheLockEnabled         bool   `json:"cache_lock_enabled"`
+	CacheLockTimeout         string `json:"cache_lock_timeout"`
+	CacheUseStale            string `json:"cache_use_stale"`
+}
+
+type snapshotDocument struct {
+	Routes          []snapshotRoute         `json:"routes"`
+	OpenRestyConfig openRestyConfigSnapshot `json:"openresty_config"`
+}
+
+type configBundle struct {
+	Routes            []*model.ProxyRoute
+	SnapshotRoutes    []snapshotRoute
+	OpenRestyConfig   openRestyConfigSnapshot
+	SnapshotJSON      string
+	MainConfig        string
+	RouteConfig       string
+	SupportFiles      []SupportFile
+	Checksum          string
+	ChangedOptionKeys []string
+}
+
+const (
+	nginxCertDirPlaceholder             = "__OPENFLARE_CERT_DIR__"
+	nginxRouteConfigPlaceholder         = "__OPENFLARE_ROUTE_CONFIG__"
+	nginxAccessLogPlaceholder           = "__OPENFLARE_ACCESS_LOG__"
+	nginxLuaDirPlaceholder              = "__OPENFLARE_LUA_DIR__"
+	nginxObservabilityListenPlaceholder = "__OPENFLARE_OBSERVABILITY_LISTEN__"
+	nginxObservabilityPortPlaceholder   = "__OPENFLARE_OBSERVABILITY_PORT__"
+)
+
+var requiredMainConfigTemplatePlaceholders = []string{
+	"{{OpenRestyWorkerProcesses}}",
+	"{{OpenRestyWorkerConnections}}",
+	"{{OpenRestyWorkerRlimitNofile}}",
+	"{{OpenRestyAccessLogPath}}",
+	"{{OpenRestyEventsUseDirective}}",
+	"{{OpenRestyEventsMultiAcceptDirective}}",
+	"{{OpenRestyKeepaliveTimeout}}",
+	"{{OpenRestyKeepaliveRequests}}",
+	"{{OpenRestyClientHeaderTimeout}}",
+	"{{OpenRestyClientBodyTimeout}}",
+	"{{OpenRestyClientMaxBodySize}}",
+	"{{OpenRestyLargeClientHeaderBuffers}}",
+	"{{OpenRestySendTimeout}}",
+	"{{OpenRestyProxyConnectTimeout}}",
+	"{{OpenRestyProxySendTimeout}}",
+	"{{OpenRestyProxyReadTimeout}}",
+	"{{OpenRestyProxyRequestBuffering}}",
+	"{{OpenRestyProxyBuffering}}",
+	"{{OpenRestyProxyBuffers}}",
+	"{{OpenRestyProxyBufferSize}}",
+	"{{OpenRestyProxyBusyBuffersSize}}",
+	"{{OpenRestyGzip}}",
+	"{{OpenRestyGzipMinLength}}",
+	"{{OpenRestyGzipCompLevel}}",
+	"{{OpenRestyCacheBlock}}",
+	"{{OpenRestyRouteConfigInclude}}",
+}
+
+func ListConfigVersions() ([]*model.ConfigVersion, error) {
+	return model.ListConfigVersions()
+}
+
+func GetActiveConfigVersion() (*model.ConfigVersion, error) {
+	return model.GetActiveConfigVersion()
+}
+
+func PreviewConfigVersion() (*ConfigPreviewResult, error) {
+	bundle, err := buildCurrentConfigBundle(false)
+	if err != nil {
+		return nil, err
+	}
+	return &ConfigPreviewResult{
+		SnapshotJSON:   bundle.SnapshotJSON,
+		MainConfig:     bundle.MainConfig,
+		RouteConfig:    bundle.RouteConfig,
+		RenderedConfig: bundle.RouteConfig,
+		SupportFiles:   bundle.SupportFiles,
+		Checksum:       bundle.Checksum,
+		RouteCount:     len(bundle.Routes),
+	}, nil
+}
+
+func DiffConfigVersion() (*ConfigDiffResult, error) {
+	bundle, err := buildCurrentConfigBundle(false)
+	if err != nil {
+		return nil, err
+	}
+	result := &ConfigDiffResult{
+		AddedDomains:         []string{},
+		RemovedDomains:       []string{},
+		ModifiedDomains:      []string{},
+		ChangedOptionKeys:    []string{},
+		ChangedOptionDetails: []ConfigOptionDiffItem{},
+	}
+	activeVersion, err := model.GetActiveConfigVersion()
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			for _, route := range bundle.SnapshotRoutes {
+				result.AddedDomains = append(result.AddedDomains, route.Domain)
+			}
+			result.MainConfigChanged = true
+			result.ChangedOptionKeys = openRestyOptionKeys()
+			result.ChangedOptionDetails = buildInitialOpenRestyOptionDiffs(bundle.OpenRestyConfig)
+			return result, nil
+		}
+		return nil, err
+	}
+	result.ActiveVersion = activeVersion.Version
+	activeSnapshot, err := parseSnapshotDocument(activeVersion.SnapshotJSON)
+	if err != nil {
+		return nil, err
+	}
+	currentMap := make(map[string]snapshotRoute, len(bundle.SnapshotRoutes))
+	for _, route := range bundle.SnapshotRoutes {
+		currentMap[route.Domain] = route
+	}
+	activeMap := make(map[string]snapshotRoute, len(activeSnapshot.Routes))
+	for _, route := range activeSnapshot.Routes {
+		activeMap[route.Domain] = route
+	}
+	for domain, currentRoute := range currentMap {
+		activeRoute, ok := activeMap[domain]
+		if !ok {
+			result.AddedDomains = append(result.AddedDomains, domain)
+			continue
+		}
+		if !snapshotRouteConfigEqual(activeRoute, currentRoute) {
+			result.ModifiedDomains = append(result.ModifiedDomains, domain)
+		}
+	}
+	for domain := range activeMap {
+		if _, ok := currentMap[domain]; !ok {
+			result.RemovedDomains = append(result.RemovedDomains, domain)
+		}
+	}
+	result.MainConfigChanged = activeVersion.MainConfig != bundle.MainConfig
+	result.ChangedOptionDetails = diffOpenRestyOptionDetails(activeSnapshot.OpenRestyConfig, bundle.OpenRestyConfig)
+	result.ChangedOptionKeys = extractOptionDiffKeys(result.ChangedOptionDetails)
+	sort.Strings(result.AddedDomains)
+	sort.Strings(result.RemovedDomains)
+	sort.Strings(result.ModifiedDomains)
+	sort.Strings(result.ChangedOptionKeys)
+	return result, nil
+}
+
+func HasConfigChanges() (bool, error) {
+	bundle, err := buildCurrentConfigBundle(false)
+	if err != nil {
+		return false, err
+	}
+	activeVersion, err := model.GetActiveConfigVersion()
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return len(bundle.Routes) > 0, nil
+		}
+		return false, err
+	}
+	return activeVersion.Checksum != bundle.Checksum, nil
+}
+
+func PublishConfigVersion(createdBy string) (*ReleaseResult, error) {
+	bundle, err := buildCurrentConfigBundle(true)
+	if err != nil {
+		return nil, err
+	}
+	if len(bundle.Routes) == 0 {
+		return nil, errors.New("没有可发布的启用规则")
+	}
+	activeVersion, err := model.GetActiveConfigVersion()
+	if err == nil && activeVersion.Checksum == bundle.Checksum {
+		return nil, errors.New("当前规则没有变更，不能重复发布")
+	}
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+	supportFilesJSON, err := json.Marshal(bundle.SupportFiles)
+	if err != nil {
+		return nil, err
+	}
+	version, err := nextVersionNumber(time.Now())
+	if err != nil {
+		return nil, err
+	}
+	record := &model.ConfigVersion{
+		Version:          version,
+		SnapshotJSON:     bundle.SnapshotJSON,
+		MainConfig:       bundle.MainConfig,
+		RenderedConfig:   bundle.RouteConfig,
+		SupportFilesJSON: string(supportFilesJSON),
+		Checksum:         bundle.Checksum,
+		IsActive:         true,
+		CreatedBy:        createdBy,
+	}
+	err = model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&model.ConfigVersion{}).Where("is_active = ?", true).Update("is_active", false).Error; err != nil {
+			return err
+		}
+		if err := tx.Create(record).Error; err != nil {
+			return err
+		}
+		return nil
+	})
+	if err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("版本号生成冲突，请重试")
+		}
+		return nil, err
+	}
+	return &ReleaseResult{
+		Version: record,
+		Routes:  bundle.Routes,
+	}, nil
+}
+
+func ActivateConfigVersion(id uint) (*model.ConfigVersion, error) {
+	version, err := model.GetConfigVersionByID(id)
+	if err != nil {
+		return nil, err
+	}
+	err = model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&model.ConfigVersion{}).Where("is_active = ?", true).Update("is_active", false).Error; err != nil {
+			return err
+		}
+		if err := tx.Model(version).Update("is_active", true).Error; err != nil {
+			return err
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	version.IsActive = true
+	return version, nil
+}
+
+func buildCurrentConfigBundle(requireRoutes bool) (*configBundle, error) {
+	routes, err := model.GetEnabledProxyRoutes()
+	if err != nil {
+		return nil, err
+	}
+	if requireRoutes && len(routes) == 0 {
+		return nil, errors.New("没有可发布的启用规则")
+	}
+	snapshotRoutes, err := buildSnapshotRoutes(routes)
+	if err != nil {
+		return nil, err
+	}
+	openRestyConfig := buildOpenRestyConfigSnapshot()
+	snapshotDoc := snapshotDocument{
+		Routes:          snapshotRoutes,
+		OpenRestyConfig: openRestyConfig,
+	}
+	snapshotJSON, err := json.Marshal(snapshotDoc)
+	if err != nil {
+		return nil, err
+	}
+	routeConfig, supportFiles, err := renderRouteConfig(routes)
+	if err != nil {
+		return nil, err
+	}
+	mainConfig := renderMainConfig(openRestyConfig)
+	return &configBundle{
+		Routes:            routes,
+		SnapshotRoutes:    snapshotRoutes,
+		OpenRestyConfig:   openRestyConfig,
+		SnapshotJSON:      string(snapshotJSON),
+		MainConfig:        mainConfig,
+		RouteConfig:       routeConfig,
+		SupportFiles:      supportFiles,
+		Checksum:          checksumBundle(mainConfig, routeConfig, supportFiles),
+		ChangedOptionKeys: openRestyOptionKeys(),
+	}, nil
+}
+
+func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
+	items := make([]snapshotRoute, 0, len(routes))
+	for _, route := range routes {
+		customHeaders, err := decodeStoredCustomHeaders(route.CustomHeaders)
+		if err != nil {
+			return nil, fmt.Errorf("路由 %s 自定义请求头无效", route.Domain)
+		}
+		items = append(items, snapshotRoute{
+			Domain:        route.Domain,
+			OriginURL:     route.OriginURL,
+			Enabled:       route.Enabled,
+			EnableHTTPS:   route.EnableHTTPS,
+			CertID:        route.CertID,
+			RedirectHTTP:  route.RedirectHTTP,
+			CustomHeaders: customHeaders,
+			Remark:        route.Remark,
+		})
+	}
+	return items, nil
+}
+
+func parseSnapshotDocument(snapshotJSON string) (*snapshotDocument, error) {
+	text := strings.TrimSpace(snapshotJSON)
+	if text == "" {
+		return &snapshotDocument{Routes: []snapshotRoute{}}, nil
+	}
+	if strings.HasPrefix(text, "[") {
+		var routes []snapshotRoute
+		if err := json.Unmarshal([]byte(text), &routes); err != nil {
+			return nil, errors.New("历史版本快照格式不合法")
+		}
+		return &snapshotDocument{Routes: normalizeSnapshotRoutes(routes)}, nil
+	}
+	var snapshot snapshotDocument
+	if err := json.Unmarshal([]byte(text), &snapshot); err != nil {
+		return nil, errors.New("历史版本快照格式不合法")
+	}
+	snapshot.Routes = normalizeSnapshotRoutes(snapshot.Routes)
+	return &snapshot, nil
+}
+
+func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
+	if len(routes) == 0 {
+		return []snapshotRoute{}
+	}
+	for index := range routes {
+		normalizedHeaders, err := normalizeCustomHeaders(routes[index].CustomHeaders)
+		if err == nil {
+			routes[index].CustomHeaders = normalizedHeaders
+		}
+	}
+	return routes
+}
+
+func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
+	if left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || !uintPointerEqual(left.CertID, right.CertID) {
+		return false
+	}
+	if len(left.CustomHeaders) != len(right.CustomHeaders) {
+		return false
+	}
+	for index := range left.CustomHeaders {
+		if left.CustomHeaders[index] != right.CustomHeaders[index] {
+			return false
+		}
+	}
+	return true
+}
+
+func buildOpenRestyConfigSnapshot() openRestyConfigSnapshot {
+	return openRestyConfigSnapshot{
+		WorkerProcesses:          common.OpenRestyWorkerProcesses,
+		WorkerConnections:        common.OpenRestyWorkerConnections,
+		WorkerRlimitNofile:       common.OpenRestyWorkerRlimitNofile,
+		EventsUse:                common.OpenRestyEventsUse,
+		EventsMultiAcceptEnabled: common.OpenRestyEventsMultiAcceptEnabled,
+		KeepaliveTimeout:         common.OpenRestyKeepaliveTimeout,
+		KeepaliveRequests:        common.OpenRestyKeepaliveRequests,
+		ClientHeaderTimeout:      common.OpenRestyClientHeaderTimeout,
+		ClientBodyTimeout:        common.OpenRestyClientBodyTimeout,
+		ClientMaxBodySize:        common.OpenRestyClientMaxBodySize,
+		LargeClientHeaderBuffers: common.OpenRestyLargeClientHeaderBuffers,
+		SendTimeout:              common.OpenRestySendTimeout,
+		ProxyConnectTimeout:      common.OpenRestyProxyConnectTimeout,
+		ProxySendTimeout:         common.OpenRestyProxySendTimeout,
+		ProxyReadTimeout:         common.OpenRestyProxyReadTimeout,
+		WebsocketEnabled:         common.OpenRestyWebsocketEnabled,
+		ProxyRequestBuffering:    common.OpenRestyProxyRequestBufferingEnabled,
+		ProxyBufferingEnabled:    common.OpenRestyProxyBufferingEnabled,
+		ProxyBuffers:             common.OpenRestyProxyBuffers,
+		ProxyBufferSize:          common.OpenRestyProxyBufferSize,
+		ProxyBusyBuffersSize:     common.OpenRestyProxyBusyBuffersSize,
+		GzipEnabled:              common.OpenRestyGzipEnabled,
+		GzipMinLength:            common.OpenRestyGzipMinLength,
+		GzipCompLevel:            common.OpenRestyGzipCompLevel,
+		CacheEnabled:             common.OpenRestyCacheEnabled,
+		CachePath:                common.OpenRestyCachePath,
+		CacheLevels:              common.OpenRestyCacheLevels,
+		CacheInactive:            common.OpenRestyCacheInactive,
+		CacheMaxSize:             common.OpenRestyCacheMaxSize,
+		CacheKeyTemplate:         common.OpenRestyCacheKeyTemplate,
+		CacheLockEnabled:         common.OpenRestyCacheLockEnabled,
+		CacheLockTimeout:         common.OpenRestyCacheLockTimeout,
+		CacheUseStale:            common.OpenRestyCacheUseStale,
+	}
+}
+
+func diffOpenRestyOptionKeys(left openRestyConfigSnapshot, right openRestyConfigSnapshot) []string {
+	details := diffOpenRestyOptionDetails(left, right)
+	return extractOptionDiffKeys(details)
+}
+
+func buildInitialOpenRestyOptionDiffs(current openRestyConfigSnapshot) []ConfigOptionDiffItem {
+	details := diffOpenRestyOptionDetails(openRestyConfigSnapshot{}, current)
+	for index := range details {
+		details[index].PreviousValue = ""
+	}
+	return details
+}
+
+func diffOpenRestyOptionDetails(left openRestyConfigSnapshot, right openRestyConfigSnapshot) []ConfigOptionDiffItem {
+	changes := make([]ConfigOptionDiffItem, 0)
+	appendIfChanged := func(key string, previous string, current string) {
+		if previous == current {
+			return
+		}
+		changes = append(changes, ConfigOptionDiffItem{
+			Key:           key,
+			PreviousValue: previous,
+			CurrentValue:  current,
+		})
+	}
+	appendIfChanged("OpenRestyWorkerProcesses", left.WorkerProcesses, right.WorkerProcesses)
+	appendIfChanged("OpenRestyWorkerConnections", fmt.Sprintf("%d", left.WorkerConnections), fmt.Sprintf("%d", right.WorkerConnections))
+	appendIfChanged("OpenRestyWorkerRlimitNofile", fmt.Sprintf("%d", left.WorkerRlimitNofile), fmt.Sprintf("%d", right.WorkerRlimitNofile))
+	appendIfChanged("OpenRestyEventsUse", left.EventsUse, right.EventsUse)
+	appendIfChanged("OpenRestyEventsMultiAcceptEnabled", fmt.Sprintf("%t", left.EventsMultiAcceptEnabled), fmt.Sprintf("%t", right.EventsMultiAcceptEnabled))
+	appendIfChanged("OpenRestyKeepaliveTimeout", fmt.Sprintf("%d", left.KeepaliveTimeout), fmt.Sprintf("%d", right.KeepaliveTimeout))
+	appendIfChanged("OpenRestyKeepaliveRequests", fmt.Sprintf("%d", left.KeepaliveRequests), fmt.Sprintf("%d", right.KeepaliveRequests))
+	appendIfChanged("OpenRestyClientHeaderTimeout", fmt.Sprintf("%d", left.ClientHeaderTimeout), fmt.Sprintf("%d", right.ClientHeaderTimeout))
+	appendIfChanged("OpenRestyClientBodyTimeout", fmt.Sprintf("%d", left.ClientBodyTimeout), fmt.Sprintf("%d", right.ClientBodyTimeout))
+	appendIfChanged("OpenRestyClientMaxBodySize", left.ClientMaxBodySize, right.ClientMaxBodySize)
+	appendIfChanged("OpenRestyLargeClientHeaderBuffers", left.LargeClientHeaderBuffers, right.LargeClientHeaderBuffers)
+	appendIfChanged("OpenRestySendTimeout", fmt.Sprintf("%d", left.SendTimeout), fmt.Sprintf("%d", right.SendTimeout))
+	appendIfChanged("OpenRestyProxyConnectTimeout", fmt.Sprintf("%d", left.ProxyConnectTimeout), fmt.Sprintf("%d", right.ProxyConnectTimeout))
+	appendIfChanged("OpenRestyProxySendTimeout", fmt.Sprintf("%d", left.ProxySendTimeout), fmt.Sprintf("%d", right.ProxySendTimeout))
+	appendIfChanged("OpenRestyProxyReadTimeout", fmt.Sprintf("%d", left.ProxyReadTimeout), fmt.Sprintf("%d", right.ProxyReadTimeout))
+	appendIfChanged("OpenRestyWebsocketEnabled", fmt.Sprintf("%t", left.WebsocketEnabled), fmt.Sprintf("%t", right.WebsocketEnabled))
+	appendIfChanged("OpenRestyProxyRequestBufferingEnabled", fmt.Sprintf("%t", left.ProxyRequestBuffering), fmt.Sprintf("%t", right.ProxyRequestBuffering))
+	appendIfChanged("OpenRestyProxyBufferingEnabled", fmt.Sprintf("%t", left.ProxyBufferingEnabled), fmt.Sprintf("%t", right.ProxyBufferingEnabled))
+	appendIfChanged("OpenRestyProxyBuffers", left.ProxyBuffers, right.ProxyBuffers)
+	appendIfChanged("OpenRestyProxyBufferSize", left.ProxyBufferSize, right.ProxyBufferSize)
+	appendIfChanged("OpenRestyProxyBusyBuffersSize", left.ProxyBusyBuffersSize, right.ProxyBusyBuffersSize)
+	appendIfChanged("OpenRestyGzipEnabled", fmt.Sprintf("%t", left.GzipEnabled), fmt.Sprintf("%t", right.GzipEnabled))
+	appendIfChanged("OpenRestyGzipMinLength", fmt.Sprintf("%d", left.GzipMinLength), fmt.Sprintf("%d", right.GzipMinLength))
+	appendIfChanged("OpenRestyGzipCompLevel", fmt.Sprintf("%d", left.GzipCompLevel), fmt.Sprintf("%d", right.GzipCompLevel))
+	appendIfChanged("OpenRestyCacheEnabled", fmt.Sprintf("%t", left.CacheEnabled), fmt.Sprintf("%t", right.CacheEnabled))
+	appendIfChanged("OpenRestyCachePath", left.CachePath, right.CachePath)
+	appendIfChanged("OpenRestyCacheLevels", left.CacheLevels, right.CacheLevels)
+	appendIfChanged("OpenRestyCacheInactive", left.CacheInactive, right.CacheInactive)
+	appendIfChanged("OpenRestyCacheMaxSize", left.CacheMaxSize, right.CacheMaxSize)
+	appendIfChanged("OpenRestyCacheKeyTemplate", left.CacheKeyTemplate, right.CacheKeyTemplate)
+	appendIfChanged("OpenRestyCacheLockEnabled", fmt.Sprintf("%t", left.CacheLockEnabled), fmt.Sprintf("%t", right.CacheLockEnabled))
+	appendIfChanged("OpenRestyCacheLockTimeout", left.CacheLockTimeout, right.CacheLockTimeout)
+	appendIfChanged("OpenRestyCacheUseStale", left.CacheUseStale, right.CacheUseStale)
+	return changes
+}
+
+func extractOptionDiffKeys(details []ConfigOptionDiffItem) []string {
+	keys := make([]string, 0, len(details))
+	for _, item := range details {
+		keys = append(keys, item.Key)
+	}
+	return keys
+}
+
+func openRestyOptionKeys() []string {
+	return []string{
+		"OpenRestyWorkerProcesses",
+		"OpenRestyWorkerConnections",
+		"OpenRestyWorkerRlimitNofile",
+		"OpenRestyEventsUse",
+		"OpenRestyEventsMultiAcceptEnabled",
+		"OpenRestyKeepaliveTimeout",
+		"OpenRestyKeepaliveRequests",
+		"OpenRestyClientHeaderTimeout",
+		"OpenRestyClientBodyTimeout",
+		"OpenRestyClientMaxBodySize",
+		"OpenRestyLargeClientHeaderBuffers",
+		"OpenRestySendTimeout",
+		"OpenRestyProxyConnectTimeout",
+		"OpenRestyProxySendTimeout",
+		"OpenRestyProxyReadTimeout",
+		"OpenRestyWebsocketEnabled",
+		"OpenRestyProxyRequestBufferingEnabled",
+		"OpenRestyProxyBufferingEnabled",
+		"OpenRestyProxyBuffers",
+		"OpenRestyProxyBufferSize",
+		"OpenRestyProxyBusyBuffersSize",
+		"OpenRestyGzipEnabled",
+		"OpenRestyGzipMinLength",
+		"OpenRestyGzipCompLevel",
+		"OpenRestyCacheEnabled",
+		"OpenRestyCachePath",
+		"OpenRestyCacheLevels",
+		"OpenRestyCacheInactive",
+		"OpenRestyCacheMaxSize",
+		"OpenRestyCacheKeyTemplate",
+		"OpenRestyCacheLockEnabled",
+		"OpenRestyCacheLockTimeout",
+		"OpenRestyCacheUseStale",
+	}
+}
+
+func renderRouteConfig(routes []*model.ProxyRoute) (string, []SupportFile, error) {
+	var builder strings.Builder
+	builder.WriteString("# This file is generated by OpenFlare. Do not edit manually.\n")
+	supportFiles := make([]SupportFile, 0)
+	for _, route := range routes {
+		customHeaders, err := decodeStoredCustomHeaders(route.CustomHeaders)
+		if err != nil {
+			return "", nil, fmt.Errorf("路由 %s 自定义请求头无效", route.Domain)
+		}
+		if !route.EnableHTTPS {
+			builder.WriteString(renderHTTPProxyServer(route.Domain, route.OriginURL, customHeaders))
+			continue
+		}
+		if route.CertID == nil || *route.CertID == 0 {
+			return "", nil, fmt.Errorf("路由 %s 未配置证书", route.Domain)
+		}
+		certificate, err := model.GetTLSCertificateByID(*route.CertID)
+		if err != nil {
+			return "", nil, fmt.Errorf("路由 %s 关联证书不存在", route.Domain)
+		}
+		supportFiles = append(supportFiles,
+			SupportFile{Path: certificateCertFileName(certificate.ID), Content: normalizePEM(certificate.CertPEM)},
+			SupportFile{Path: certificateKeyFileName(certificate.ID), Content: normalizePEM(certificate.KeyPEM)},
+		)
+		if route.RedirectHTTP {
+			builder.WriteString(renderHTTPRedirectServer(route.Domain))
+		} else {
+			builder.WriteString(renderHTTPProxyServer(route.Domain, route.OriginURL, customHeaders))
+		}
+		builder.WriteString(renderHTTPSServer(route.Domain, route.OriginURL, certificate.ID, customHeaders))
+	}
+	return builder.String(), dedupeSupportFiles(supportFiles), nil
+}
+
+func renderMainConfig(cfg openRestyConfigSnapshot) string {
+	templateText := common.OpenRestyMainConfigTemplate
+	if strings.TrimSpace(templateText) == "" {
+		templateText = defaultOpenRestyMainConfigTemplate()
+	}
+	return renderMainConfigTemplate(templateText, cfg)
+}
+
+func ValidateOpenRestyMainConfigTemplate(templateText string) error {
+	trimmed := strings.TrimSpace(templateText)
+	if trimmed == "" {
+		return errors.New("OpenRestyMainConfigTemplate 不能为空")
+	}
+	for _, placeholder := range requiredMainConfigTemplatePlaceholders {
+		if !strings.Contains(trimmed, placeholder) {
+			return fmt.Errorf("OpenRestyMainConfigTemplate 必须保留占位符 %s", placeholder)
+		}
+	}
+	return nil
+}
+
+func defaultOpenRestyMainConfigTemplate() string {
+	return common.OpenRestyMainConfigTemplate
+}
+
+func renderMainConfigTemplate(templateText string, cfg openRestyConfigSnapshot) string {
+	replacer := strings.NewReplacer(
+		"{{OpenRestyWorkerProcesses}}", cfg.WorkerProcesses,
+		"{{OpenRestyWorkerConnections}}", fmt.Sprintf("%d", cfg.WorkerConnections),
+		"{{OpenRestyWorkerRlimitNofile}}", fmt.Sprintf("%d", cfg.WorkerRlimitNofile),
+		"{{OpenRestyAccessLogPath}}", nginxAccessLogPlaceholder,
+		"{{OpenRestyEventsUseDirective}}", renderTemplateDirective(cfg.EventsUse != "", fmt.Sprintf("use %s;", cfg.EventsUse)),
+		"{{OpenRestyEventsMultiAcceptDirective}}", renderTemplateDirective(cfg.EventsMultiAcceptEnabled, "multi_accept on;"),
+		"{{OpenRestyKeepaliveTimeout}}", fmt.Sprintf("%d", cfg.KeepaliveTimeout),
+		"{{OpenRestyKeepaliveRequests}}", fmt.Sprintf("%d", cfg.KeepaliveRequests),
+		"{{OpenRestyClientHeaderTimeout}}", fmt.Sprintf("%d", cfg.ClientHeaderTimeout),
+		"{{OpenRestyClientBodyTimeout}}", fmt.Sprintf("%d", cfg.ClientBodyTimeout),
+		"{{OpenRestyClientMaxBodySize}}", cfg.ClientMaxBodySize,
+		"{{OpenRestyLargeClientHeaderBuffers}}", cfg.LargeClientHeaderBuffers,
+		"{{OpenRestySendTimeout}}", fmt.Sprintf("%d", cfg.SendTimeout),
+		"{{OpenRestyProxyConnectTimeout}}", fmt.Sprintf("%d", cfg.ProxyConnectTimeout),
+		"{{OpenRestyProxySendTimeout}}", fmt.Sprintf("%d", cfg.ProxySendTimeout),
+		"{{OpenRestyProxyReadTimeout}}", fmt.Sprintf("%d", cfg.ProxyReadTimeout),
+		"{{OpenRestyProxyRequestBuffering}}", onOff(cfg.ProxyRequestBuffering),
+		"{{OpenRestyProxyBuffering}}", onOff(cfg.ProxyBufferingEnabled),
+		"{{OpenRestyProxyBuffers}}", cfg.ProxyBuffers,
+		"{{OpenRestyProxyBufferSize}}", cfg.ProxyBufferSize,
+		"{{OpenRestyProxyBusyBuffersSize}}", cfg.ProxyBusyBuffersSize,
+		"{{OpenRestyGzip}}", onOff(cfg.GzipEnabled),
+		"{{OpenRestyGzipMinLength}}", fmt.Sprintf("%d", cfg.GzipMinLength),
+		"{{OpenRestyGzipCompLevel}}", fmt.Sprintf("%d", cfg.GzipCompLevel),
+		"{{OpenRestyCacheBlock}}", renderOpenRestyCacheTemplateBlock(cfg),
+		"{{OpenRestyRouteConfigInclude}}", nginxRouteConfigPlaceholder,
+	)
+	return replacer.Replace(templateText)
+}
+
+func renderTemplateDirective(enabled bool, statement string) string {
+	if !enabled {
+		return ""
+	}
+	return fmt.Sprintf("    %s\n", statement)
+}
+
+func renderOpenRestyCacheTemplateBlock(cfg openRestyConfigSnapshot) string {
+	lines := make([]string, 0, 8)
+	if !cfg.CacheEnabled {
+		lines = append(lines, renderOpenRestyObservabilityTemplateBlock())
+		return strings.Join(lines, "")
+	}
+	lines = append(lines, strings.Join([]string{
+		fmt.Sprintf("    proxy_cache_path %s levels=%s keys_zone=openflare_cache:10m inactive=%s max_size=%s;", cfg.CachePath, cfg.CacheLevels, cfg.CacheInactive, cfg.CacheMaxSize),
+		fmt.Sprintf("    proxy_cache_key \"%s\";", cfg.CacheKeyTemplate),
+		fmt.Sprintf("    proxy_cache_lock %s;", onOff(cfg.CacheLockEnabled)),
+		fmt.Sprintf("    proxy_cache_lock_timeout %s;", cfg.CacheLockTimeout),
+		fmt.Sprintf("    proxy_cache_use_stale %s;", cfg.CacheUseStale),
+		"",
+	}, "\n"))
+	lines = append(lines, renderOpenRestyObservabilityTemplateBlock())
+	return strings.Join(lines, "")
+}
+
+func onOff(value bool) string {
+	if value {
+		return "on"
+	}
+	return "off"
+}
+
+func uintPointerEqual(left *uint, right *uint) bool {
+	if left == nil || right == nil {
+		return left == nil && right == nil
+	}
+	return *left == *right
+}
+
+func checksum(content string) string {
+	sum := sha256.Sum256([]byte(content))
+	return hex.EncodeToString(sum[:])
+}
+
+func checksumBundle(mainConfig string, routeConfig string, supportFiles []SupportFile) string {
+	var builder strings.Builder
+	builder.WriteString(mainConfig)
+	builder.WriteString("\n--route-config--\n")
+	builder.WriteString(routeConfig)
+	builder.WriteString("\n--support-files--\n")
+	files := dedupeSupportFiles(supportFiles)
+	sort.Slice(files, func(i int, j int) bool {
+		return files[i].Path < files[j].Path
+	})
+	for _, file := range files {
+		builder.WriteString(file.Path)
+		builder.WriteString("\n")
+		builder.WriteString(file.Content)
+		builder.WriteString("\n")
+	}
+	return checksum(builder.String())
+}
+
+func nextVersionNumber(now time.Time) (string, error) {
+	prefix := now.Format("20060102")
+	var count int64
+	if err := model.DB.Model(&model.ConfigVersion{}).Where("version LIKE ?", prefix+"-%").Count(&count).Error; err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%s-%03d", prefix, count+1), nil
+}
+
+func renderHTTPProxyServer(domain string, originURL string, customHeaders []ProxyRouteCustomHeaderInput) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, renderProxyHeaderBlock(customHeaders), originURL)
+}
+
+func renderHTTPRedirectServer(domain string) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    return 301 https://$host$request_uri;\n}\n\n", domain)
+}
+
+func renderHTTPSServer(domain string, originURL string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput) string {
+	certPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateCertFileName(certificateID))
+	keyPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateKeyFileName(certificateID))
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, certPath, keyPath, renderProxyHeaderBlock(customHeaders), originURL)
+}
+
+func renderProxyHeaderBlock(customHeaders []ProxyRouteCustomHeaderInput) string {
+	var builder strings.Builder
+	builder.WriteString("        proxy_set_header Host $host;\n")
+	builder.WriteString("        proxy_set_header X-Real-IP $remote_addr;\n")
+	builder.WriteString("        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n")
+	builder.WriteString("        proxy_set_header X-Forwarded-Proto $scheme;\n")
+	if common.OpenRestyWebsocketEnabled {
+		builder.WriteString("        proxy_http_version 1.1;\n")
+		builder.WriteString("        proxy_set_header Upgrade $http_upgrade;\n")
+		builder.WriteString("        proxy_set_header Connection $http_connection;\n")
+	}
+	for _, header := range customHeaders {
+		builder.WriteString(fmt.Sprintf("        proxy_set_header %s %s;\n", header.Key, quoteNginxHeaderValue(header.Value)))
+	}
+	if common.OpenRestyCacheEnabled {
+		builder.WriteString("        proxy_cache openflare_cache;\n")
+	}
+	return builder.String()
+}
+
+func quoteNginxHeaderValue(value string) string {
+	escaped := strings.ReplaceAll(value, `\`, `\\`)
+	escaped = strings.ReplaceAll(escaped, `"`, `\"`)
+	return fmt.Sprintf(`"%s"`, escaped)
+}
+
+func certificateCertFileName(id uint) string {
+	return fmt.Sprintf("%d.crt", id)
+}
+
+func certificateKeyFileName(id uint) string {
+	return fmt.Sprintf("%d.key", id)
+}
+
+func normalizePEM(content string) string {
+	return strings.TrimSpace(content) + "\n"
+}
+
+func dedupeSupportFiles(files []SupportFile) []SupportFile {
+	if len(files) == 0 {
+		return nil
+	}
+	unique := make(map[string]SupportFile, len(files))
+	for _, file := range files {
+		unique[file.Path] = file
+	}
+	result := make([]SupportFile, 0, len(unique))
+	for _, file := range unique {
+		result = append(result, file)
+	}
+	return result
+}

openflare_server/service/dashboard.go

@@ -0,0 +1,248 @@
+package service
+
+import (
+	"openflare/model"
+	"sort"
+	"time"
+)
+
+type DashboardOverviewView struct {
+	GeneratedAt   time.Time             `json:"generated_at"`
+	Summary       DashboardSummary      `json:"summary"`
+	Traffic       DashboardTraffic      `json:"traffic"`
+	Capacity      DashboardCapacity     `json:"capacity"`
+	Distributions TrafficDistributions  `json:"distributions"`
+	Trends        DashboardTrends       `json:"trends"`
+	Nodes         []DashboardNodeHealth `json:"nodes"`
+}
+
+type DashboardSummary struct {
+	TotalNodes     int `json:"total_nodes"`
+	OnlineNodes    int `json:"online_nodes"`
+	OfflineNodes   int `json:"offline_nodes"`
+	PendingNodes   int `json:"pending_nodes"`
+	UnhealthyNodes int `json:"unhealthy_nodes"`
+}
+
+type DashboardTraffic struct {
+	RequestCount   int64   `json:"request_count"`
+	UniqueVisitors int64   `json:"unique_visitors"`
+	ErrorCount     int64   `json:"error_count"`
+	EstimatedQPS   float64 `json:"estimated_qps"`
+	ReportedNodes  int     `json:"reported_nodes"`
+}
+
+type DashboardCapacity struct {
+	AverageCPUUsagePercent    float64 `json:"average_cpu_usage_percent"`
+	AverageMemoryUsagePercent float64 `json:"average_memory_usage_percent"`
+	HighCPUNodes              int     `json:"high_cpu_nodes"`
+	HighMemoryNodes           int     `json:"high_memory_nodes"`
+	HighStorageNodes          int     `json:"high_storage_nodes"`
+}
+
+type DashboardTrends struct {
+	Traffic24h  []TrafficTrendPoint  `json:"traffic_24h"`
+	Capacity24h []CapacityTrendPoint `json:"capacity_24h"`
+	Network24h  []NetworkTrendPoint  `json:"network_24h"`
+	DiskIO24h   []DiskIOTrendPoint   `json:"disk_io_24h"`
+}
+
+type DashboardNodeHealth struct {
+	ID                  uint      `json:"id"`
+	NodeID              string    `json:"node_id"`
+	Name                string    `json:"name"`
+	GeoName             string    `json:"geo_name"`
+	GeoLatitude         *float64  `json:"geo_latitude"`
+	GeoLongitude        *float64  `json:"geo_longitude"`
+	Status              string    `json:"status"`
+	OpenrestyStatus     string    `json:"openresty_status"`
+	CurrentVersion      string    `json:"current_version"`
+	LastSeenAt          time.Time `json:"last_seen_at"`
+	ActiveEventCount    int       `json:"active_event_count"`
+	CPUUsagePercent     float64   `json:"cpu_usage_percent"`
+	MemoryUsagePercent  float64   `json:"memory_usage_percent"`
+	StorageUsagePercent float64   `json:"storage_usage_percent"`
+	RequestCount        int64     `json:"request_count"`
+	ErrorCount          int64     `json:"error_count"`
+	UniqueVisitorCount  int64     `json:"unique_visitor_count"`
+}
+
+func GetDashboardOverview() (*DashboardOverviewView, error) {
+	now := time.Now()
+	since := now.Add(-24 * time.Hour)
+
+	nodes, err := model.ListNodes()
+	if err != nil {
+		return nil, err
+	}
+
+	snapshots, err := model.ListMetricSnapshotsSince(since)
+	if err != nil {
+		return nil, err
+	}
+	reports, err := model.ListRequestReportsSince(since)
+	if err != nil {
+		return nil, err
+	}
+	accessLogRegions, err := model.ListNodeAccessLogRegionCounts("", since, 8)
+	if err != nil {
+		return nil, err
+	}
+	activeEvents, err := model.ListActiveNodeHealthEvents()
+	if err != nil {
+		return nil, err
+	}
+
+	view := &DashboardOverviewView{
+		GeneratedAt:   now,
+		Nodes:         make([]DashboardNodeHealth, 0, len(nodes)),
+		Distributions: buildTrafficDistributions(reports, accessLogRegions, 8),
+		Trends: DashboardTrends{
+			Traffic24h:  buildTrafficTrendPoints(now, reports),
+			Capacity24h: buildCapacityTrendPoints(now, snapshots),
+			Network24h:  buildNetworkTrendPoints(now, snapshots),
+			DiskIO24h:   buildDiskIOTrendPoints(now, snapshots),
+		},
+	}
+
+	var cpuNodeCount int
+	var memoryNodeCount int
+	latestSnapshots := latestMetricSnapshotsByNode(snapshots)
+	latestTrafficReports := latestTrafficReportsByNode(reports)
+	activeEventsByNode := activeHealthEventsByNode(activeEvents)
+
+	for _, node := range nodes {
+		computedStatus := computeNodeStatus(node)
+		switch computedStatus {
+		case NodeStatusOnline:
+			view.Summary.OnlineNodes++
+		case NodeStatusOffline:
+			view.Summary.OfflineNodes++
+		case NodeStatusPending:
+			view.Summary.PendingNodes++
+		}
+		if node.OpenrestyStatus == OpenrestyStatusUnhealthy {
+			view.Summary.UnhealthyNodes++
+		}
+
+		latestSnapshot := latestSnapshots[node.NodeID]
+		latestTraffic := latestTrafficReports[node.NodeID]
+		nodeActiveEvents := activeEventsByNode[node.NodeID]
+
+		nodeHealth := DashboardNodeHealth{
+			ID:               node.ID,
+			NodeID:           node.NodeID,
+			Name:             node.Name,
+			GeoName:          node.GeoName,
+			GeoLatitude:      node.GeoLatitude,
+			GeoLongitude:     node.GeoLongitude,
+			Status:           computedStatus,
+			OpenrestyStatus:  node.OpenrestyStatus,
+			CurrentVersion:   node.CurrentVersion,
+			LastSeenAt:       node.LastSeenAt,
+			ActiveEventCount: len(nodeActiveEvents),
+		}
+
+		if latestSnapshot != nil {
+			nodeHealth.CPUUsagePercent = latestSnapshot.CPUUsagePercent
+			nodeHealth.MemoryUsagePercent = percentage(latestSnapshot.MemoryUsedBytes, latestSnapshot.MemoryTotalBytes)
+			nodeHealth.StorageUsagePercent = percentage(latestSnapshot.StorageUsedBytes, latestSnapshot.StorageTotalBytes)
+			if latestSnapshot.CPUUsagePercent > 0 {
+				view.Capacity.AverageCPUUsagePercent += latestSnapshot.CPUUsagePercent
+				cpuNodeCount++
+			}
+			if nodeHealth.MemoryUsagePercent > 0 {
+				view.Capacity.AverageMemoryUsagePercent += nodeHealth.MemoryUsagePercent
+				memoryNodeCount++
+			}
+			if latestSnapshot.CPUUsagePercent >= 80 {
+				view.Capacity.HighCPUNodes++
+			}
+			if nodeHealth.MemoryUsagePercent >= 85 {
+				view.Capacity.HighMemoryNodes++
+			}
+			if nodeHealth.StorageUsagePercent >= 85 {
+				view.Capacity.HighStorageNodes++
+			}
+		}
+
+		if latestTraffic != nil {
+			nodeHealth.RequestCount = latestTraffic.RequestCount
+			nodeHealth.ErrorCount = latestTraffic.ErrorCount
+			nodeHealth.UniqueVisitorCount = latestTraffic.UniqueVisitorCount
+			view.Traffic.RequestCount += latestTraffic.RequestCount
+			view.Traffic.UniqueVisitors += latestTraffic.UniqueVisitorCount
+			view.Traffic.ErrorCount += latestTraffic.ErrorCount
+			if duration := latestTraffic.WindowEndedAt.Sub(latestTraffic.WindowStartedAt).Seconds(); duration > 0 {
+				view.Traffic.EstimatedQPS += float64(latestTraffic.RequestCount) / duration
+			}
+			view.Traffic.ReportedNodes++
+		}
+
+		view.Nodes = append(view.Nodes, nodeHealth)
+	}
+
+	view.Summary.TotalNodes = len(nodes)
+
+	if cpuNodeCount > 0 {
+		view.Capacity.AverageCPUUsagePercent /= float64(cpuNodeCount)
+	}
+	if memoryNodeCount > 0 {
+		view.Capacity.AverageMemoryUsagePercent /= float64(memoryNodeCount)
+	}
+
+	sort.Slice(view.Nodes, func(i int, j int) bool {
+		if view.Nodes[i].ActiveEventCount == view.Nodes[j].ActiveEventCount {
+			return view.Nodes[i].CPUUsagePercent > view.Nodes[j].CPUUsagePercent
+		}
+		return view.Nodes[i].ActiveEventCount > view.Nodes[j].ActiveEventCount
+	})
+
+	return view, nil
+}
+
+func percentage(used int64, total int64) float64 {
+	if used <= 0 || total <= 0 {
+		return 0
+	}
+	return (float64(used) / float64(total)) * 100
+}
+
+func latestMetricSnapshotsByNode(snapshots []*model.NodeMetricSnapshot) map[string]*model.NodeMetricSnapshot {
+	result := make(map[string]*model.NodeMetricSnapshot, len(snapshots))
+	for _, snapshot := range snapshots {
+		if snapshot == nil || snapshot.NodeID == "" {
+			continue
+		}
+		if existing, ok := result[snapshot.NodeID]; ok && !snapshot.CapturedAt.After(existing.CapturedAt) {
+			continue
+		}
+		result[snapshot.NodeID] = snapshot
+	}
+	return result
+}
+
+func latestTrafficReportsByNode(reports []*model.NodeRequestReport) map[string]*model.NodeRequestReport {
+	result := make(map[string]*model.NodeRequestReport, len(reports))
+	for _, report := range reports {
+		if report == nil || report.NodeID == "" {
+			continue
+		}
+		if existing, ok := result[report.NodeID]; ok && !report.WindowEndedAt.After(existing.WindowEndedAt) {
+			continue
+		}
+		result[report.NodeID] = report
+	}
+	return result
+}
+
+func activeHealthEventsByNode(events []*model.NodeHealthEvent) map[string][]*model.NodeHealthEvent {
+	result := make(map[string][]*model.NodeHealthEvent)
+	for _, event := range events {
+		if event == nil || event.NodeID == "" {
+			continue
+		}
+		result[event.NodeID] = append(result[event.NodeID], event)
+	}
+	return result
+}

openflare_server/service/geoip_lookup.go

@@ -0,0 +1,50 @@
+package service
+
+import (
+	"errors"
+	"net"
+	"openflare/utils/geoip"
+	"strings"
+)
+
+type GeoIPLookupView struct {
+	Provider  string   `json:"provider"`
+	IP        string   `json:"ip"`
+	ISOCode   string   `json:"iso_code"`
+	Name      string   `json:"name"`
+	Latitude  *float64 `json:"latitude,omitempty"`
+	Longitude *float64 `json:"longitude,omitempty"`
+}
+
+func LookupGeoIP(provider string, rawIP string) (*GeoIPLookupView, error) {
+	trimmedProvider := strings.TrimSpace(provider)
+	if !geoip.IsValidProvider(trimmedProvider) {
+		return nil, errors.New("归属方式仅支持 disabled、mmdb、ip-api、geojs、ipinfo")
+	}
+
+	trimmedIP := strings.TrimSpace(rawIP)
+	if trimmedIP == "" {
+		return nil, errors.New("IP 不能为空")
+	}
+	parsedIP := net.ParseIP(trimmedIP)
+	if parsedIP == nil {
+		return nil, errors.New("IP 格式无效")
+	}
+
+	info, err := geoip.LookupGeoInfoWithProvider(trimmedProvider, parsedIP)
+	if err != nil {
+		return nil, err
+	}
+	if info == nil {
+		return nil, errors.New("未获取到 IP 归属结果")
+	}
+
+	return &GeoIPLookupView{
+		Provider:  trimmedProvider,
+		IP:        parsedIP.String(),
+		ISOCode:   info.ISOCode,
+		Name:      info.Name,
+		Latitude:  info.Latitude,
+		Longitude: info.Longitude,
+	}, nil
+}

openflare_server/service/geoip_lookup_test.go

@@ -0,0 +1,64 @@
+package service
+
+import (
+	"net"
+	"openflare/utils/geoip"
+	"testing"
+)
+
+type fakeLookupProvider struct{}
+
+func (f *fakeLookupProvider) Name() string {
+	return "fake-lookup"
+}
+
+func (f *fakeLookupProvider) GetGeoInfo(ip net.IP) (*geoip.GeoInfo, error) {
+	return &geoip.GeoInfo{
+		ISOCode:   "US",
+		Name:      "United States",
+		Latitude:  geoipFloat(37.7749),
+		Longitude: geoipFloat(-122.4194),
+	}, nil
+}
+
+func (f *fakeLookupProvider) UpdateDatabase() error {
+	return nil
+}
+
+func (f *fakeLookupProvider) Close() error {
+	return nil
+}
+
+func TestLookupGeoIP(t *testing.T) {
+	previousFactory := geoip.ProviderFactoryForTest()
+	geoip.SetProviderFactoryForTest(func(provider string) (geoip.GeoIPService, error) {
+		return &fakeLookupProvider{}, nil
+	})
+	defer geoip.SetProviderFactoryForTest(previousFactory)
+
+	view, err := LookupGeoIP("ipinfo", "8.8.8.8")
+	if err != nil {
+		t.Fatalf("LookupGeoIP failed: %v", err)
+	}
+	if view.Provider != "ipinfo" {
+		t.Fatalf("expected provider ipinfo, got %s", view.Provider)
+	}
+	if view.IP != "8.8.8.8" {
+		t.Fatalf("expected IP 8.8.8.8, got %s", view.IP)
+	}
+	if view.ISOCode != "US" || view.Name != "United States" {
+		t.Fatalf("unexpected lookup view: %+v", view)
+	}
+	if view.Latitude == nil || view.Longitude == nil {
+		t.Fatalf("expected coordinates, got %+v", view)
+	}
+}
+
+func TestLookupGeoIPRejectsInvalidInput(t *testing.T) {
+	if _, err := LookupGeoIP("invalid", "8.8.8.8"); err == nil {
+		t.Fatal("expected invalid provider to fail")
+	}
+	if _, err := LookupGeoIP("ipinfo", "not-an-ip"); err == nil {
+		t.Fatal("expected invalid IP to fail")
+	}
+}

openflare_server/service/https_phase1_test.go

@@ -0,0 +1,458 @@
+package service
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"openflare/common"
+	"openflare/model"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestCreateTLSCertificateAndRenderHTTPSConfig(t *testing.T) {
+	setupServiceTestDB(t)
+
+	certPEM, keyPEM := generateCertificatePair(t, []string{"app.example.com"})
+	certificate, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "app-example",
+		CertPEM: certPEM,
+		KeyPEM:  keyPEM,
+		Remark:  "test cert",
+	})
+	if err != nil {
+		t.Fatalf("CreateTLSCertificate failed: %v", err)
+	}
+	if certificate.NotAfter.Before(certificate.NotBefore) {
+		t.Fatal("expected certificate validity period to be parsed")
+	}
+
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:       "app.example.com",
+		OriginURL:    "https://origin.internal",
+		Enabled:      true,
+		EnableHTTPS:  true,
+		CertID:       &certificate.ID,
+		RedirectHTTP: true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if !route.EnableHTTPS || route.CertID == nil {
+		t.Fatal("expected https fields to be persisted")
+	}
+
+	result, err := PublishConfigVersion("root")
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(result.Version.MainConfig, "include __OPENFLARE_ROUTE_CONFIG__;") {
+		t.Fatal("expected main config to include managed route config placeholder")
+	}
+	if !strings.Contains(result.Version.MainConfig, "access_log __OPENFLARE_ACCESS_LOG__ openflare_json;") {
+		t.Fatal("expected main config to include managed access log placeholder")
+	}
+	if !strings.Contains(result.Version.MainConfig, "log_by_lua_file __OPENFLARE_LUA_DIR__/log.lua;") {
+		t.Fatal("expected main config to include managed openresty lua log hook")
+	}
+	if !strings.Contains(result.Version.MainConfig, "listen __OPENFLARE_OBSERVABILITY_LISTEN__;") {
+		t.Fatal("expected main config to include managed openresty observability listen placeholder")
+	}
+	if strings.Contains(result.Version.MainConfig, "allow 127.0.0.1;") {
+		t.Fatal("expected main config to avoid hard-coded allow rules on observability server")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "listen 443 ssl;") {
+		t.Fatal("expected rendered config to include https server block")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "return 301 https://$host$request_uri;") {
+		t.Fatal("expected rendered config to include http redirect")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "__OPENFLARE_CERT_DIR__/") {
+		t.Fatal("expected rendered config to keep cert dir placeholder for certificates")
+	}
+	if !strings.Contains(result.Version.SupportFilesJSON, ".crt") || !strings.Contains(result.Version.SupportFilesJSON, ".key") {
+		t.Fatal("expected support files to contain certificate and key")
+	}
+}
+
+func TestCreateProxyRouteRejectsHTTPSWithoutCertificate(t *testing.T) {
+	setupServiceTestDB(t)
+
+	_, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:      "secure.example.com",
+		OriginURL:   "https://origin.internal",
+		Enabled:     true,
+		EnableHTTPS: true,
+	})
+	if err == nil || !strings.Contains(err.Error(), "必须选择证书") {
+		t.Fatalf("expected certificate validation error, got %v", err)
+	}
+}
+
+func TestPublishConfigVersionRendersCustomHeaders(t *testing.T) {
+	setupServiceTestDB(t)
+	if err := model.UpdateOption("OpenRestyWebsocketEnabled", "true"); err != nil {
+		t.Fatalf("UpdateOption OpenRestyWebsocketEnabled failed: %v", err)
+	}
+
+	_, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:    "custom.example.com",
+		OriginURL: "https://origin.internal",
+		Enabled:   true,
+		CustomHeaders: []ProxyRouteCustomHeaderInput{
+			{Key: "X-Trace-Id", Value: "$request_id"},
+			{Key: "X-Env", Value: "staging edge"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	result, err := PublishConfigVersion("root")
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(result.Version.RenderedConfig, `proxy_set_header X-Trace-Id "$request_id";`) {
+		t.Fatal("expected rendered config to include custom header")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, `proxy_set_header X-Env "staging edge";`) {
+		t.Fatal("expected rendered config to include quoted custom header value")
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, "custom_headers") {
+		t.Fatal("expected snapshot to include custom headers")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "proxy_http_version 1.1;") {
+		t.Fatal("expected rendered config to enable HTTP/1.1 proxying for websocket upgrades")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "proxy_set_header Upgrade $http_upgrade;") {
+		t.Fatal("expected rendered config to forward websocket upgrade header")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "proxy_set_header Connection $http_connection;") {
+		t.Fatal("expected rendered config to forward websocket connection header")
+	}
+}
+
+func TestPreviewConfigVersionCanDisableWebsocketHeaders(t *testing.T) {
+	setupServiceTestDB(t)
+
+	_, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:    "ws-off.example.com",
+		OriginURL: "https://origin.internal",
+		Enabled:   true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if err := model.UpdateOption("OpenRestyWebsocketEnabled", "false"); err != nil {
+		t.Fatalf("UpdateOption OpenRestyWebsocketEnabled failed: %v", err)
+	}
+
+	preview, err := PreviewConfigVersion()
+	if err != nil {
+		t.Fatalf("PreviewConfigVersion failed: %v", err)
+	}
+	if strings.Contains(preview.RenderedConfig, "proxy_http_version 1.1;") {
+		t.Fatal("expected preview config to omit websocket proxy_http_version when disabled")
+	}
+	if strings.Contains(preview.RenderedConfig, "proxy_set_header Upgrade $http_upgrade;") {
+		t.Fatal("expected preview config to omit websocket upgrade header when disabled")
+	}
+	if strings.Contains(preview.RenderedConfig, "proxy_set_header Connection $http_connection;") {
+		t.Fatal("expected preview config to omit websocket connection header when disabled")
+	}
+}
+
+func TestPreviewAndDiffConfigVersion(t *testing.T) {
+	setupServiceTestDB(t)
+	if err := model.UpdateOption("OpenRestyWebsocketEnabled", "true"); err != nil {
+		t.Fatalf("UpdateOption OpenRestyWebsocketEnabled failed: %v", err)
+	}
+
+	stableRoute, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:    "stable.example.com",
+		OriginURL: "https://origin-a.internal",
+		Enabled:   true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute stable failed: %v", err)
+	}
+	modifiedRoute, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:    "api.example.com",
+		OriginURL: "https://origin-api-a.internal",
+		Enabled:   true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute modified failed: %v", err)
+	}
+	removedRoute, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:    "old.example.com",
+		OriginURL: "https://origin-old.internal",
+		Enabled:   true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute removed failed: %v", err)
+	}
+	if _, err = PublishConfigVersion("root"); err != nil {
+		t.Fatalf("initial PublishConfigVersion failed: %v", err)
+	}
+
+	if _, err = UpdateProxyRoute(modifiedRoute.ID, ProxyRouteInput{
+		Domain:    "api.example.com",
+		OriginURL: "https://origin-api-b.internal",
+		Enabled:   true,
+		CustomHeaders: []ProxyRouteCustomHeaderInput{
+			{Key: "X-Release", Value: "candidate"},
+		},
+	}); err != nil {
+		t.Fatalf("UpdateProxyRoute failed: %v", err)
+	}
+	if _, err = UpdateProxyRoute(removedRoute.ID, ProxyRouteInput{
+		Domain:    "old.example.com",
+		OriginURL: "https://origin-old.internal",
+		Enabled:   false,
+	}); err != nil {
+		t.Fatalf("disable removed route failed: %v", err)
+	}
+	if _, err = CreateProxyRoute(ProxyRouteInput{
+		Domain:    "new.example.com",
+		OriginURL: "https://origin-new.internal",
+		Enabled:   true,
+	}); err != nil {
+		t.Fatalf("CreateProxyRoute new failed: %v", err)
+	}
+	if _, err = UpdateProxyRoute(stableRoute.ID, ProxyRouteInput{
+		Domain:    stableRoute.Domain,
+		OriginURL: stableRoute.OriginURL,
+		Enabled:   true,
+		Remark:    "remark only change",
+	}); err != nil {
+		t.Fatalf("UpdateProxyRoute stable failed: %v", err)
+	}
+
+	preview, err := PreviewConfigVersion()
+	if err != nil {
+		t.Fatalf("PreviewConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(preview.MainConfig, "include __OPENFLARE_ROUTE_CONFIG__;") {
+		t.Fatal("expected preview main config to include managed route config placeholder")
+	}
+	if !strings.Contains(preview.MainConfig, "log_by_lua_file __OPENFLARE_LUA_DIR__/log.lua;") {
+		t.Fatal("expected preview main config to include managed openresty lua log hook")
+	}
+	if !strings.Contains(preview.RenderedConfig, `proxy_set_header X-Release "candidate";`) {
+		t.Fatal("expected preview config to include modified custom header")
+	}
+	if preview.RouteCount != 3 {
+		t.Fatalf("expected 3 enabled routes in preview, got %d", preview.RouteCount)
+	}
+
+	diff, err := DiffConfigVersion()
+	if err != nil {
+		t.Fatalf("DiffConfigVersion failed: %v", err)
+	}
+	if len(diff.AddedDomains) != 1 || diff.AddedDomains[0] != "new.example.com" {
+		t.Fatalf("unexpected added domains: %#v", diff.AddedDomains)
+	}
+	if len(diff.RemovedDomains) != 1 || diff.RemovedDomains[0] != "old.example.com" {
+		t.Fatalf("unexpected removed domains: %#v", diff.RemovedDomains)
+	}
+	if len(diff.ModifiedDomains) != 1 || diff.ModifiedDomains[0] != "api.example.com" {
+		t.Fatalf("unexpected modified domains: %#v", diff.ModifiedDomains)
+	}
+	if diff.MainConfigChanged {
+		t.Fatal("expected main config to remain unchanged when only routes change")
+	}
+
+	if err = model.UpdateOption("OpenRestyProxyReadTimeout", "120"); err != nil {
+		t.Fatalf("UpdateOption failed: %v", err)
+	}
+	if err = model.UpdateOption("OpenRestyWebsocketEnabled", "false"); err != nil {
+		t.Fatalf("UpdateOption OpenRestyWebsocketEnabled failed: %v", err)
+	}
+	diff, err = DiffConfigVersion()
+	if err != nil {
+		t.Fatalf("DiffConfigVersion after option change failed: %v", err)
+	}
+	if !diff.MainConfigChanged {
+		t.Fatal("expected main config change after OpenResty option update")
+	}
+	if len(diff.ChangedOptionKeys) == 0 || diff.ChangedOptionKeys[0] == "" {
+		t.Fatal("expected changed OpenResty option keys to be reported")
+	}
+	if len(diff.ChangedOptionDetails) == 0 {
+		t.Fatal("expected changed OpenResty option details to be reported")
+	}
+	found := false
+	foundWebsocket := false
+	for _, item := range diff.ChangedOptionDetails {
+		if item.Key == "OpenRestyProxyReadTimeout" {
+			found = true
+			if item.PreviousValue != "60" || item.CurrentValue != "120" {
+				t.Fatalf("unexpected option diff values: %+v", item)
+			}
+		}
+		if item.Key == "OpenRestyWebsocketEnabled" {
+			foundWebsocket = true
+			if item.PreviousValue != "true" || item.CurrentValue != "false" {
+				t.Fatalf("unexpected websocket option diff values: %+v", item)
+			}
+		}
+	}
+	if !found {
+		t.Fatal("expected OpenRestyProxyReadTimeout diff detail")
+	}
+	if !foundWebsocket {
+		t.Fatal("expected OpenRestyWebsocketEnabled diff detail")
+	}
+}
+
+func TestCreateTLSCertificateRejectsInvalidPEM(t *testing.T) {
+	setupServiceTestDB(t)
+
+	_, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "broken-cert",
+		CertPEM: "invalid",
+		KeyPEM:  "invalid",
+	})
+	if err == nil {
+		t.Fatal("expected invalid pem to fail")
+	}
+}
+
+func TestOpenRestyMainConfigTemplateRenderAndValidate(t *testing.T) {
+	setupServiceTestDB(t)
+
+	customTemplate := strings.ReplaceAll(
+		common.OpenRestyMainConfigTemplate,
+		"pid logs/nginx.pid;",
+		"pid logs/nginx.pid;\nworker_shutdown_timeout 10s;",
+	)
+	if err := ValidateOpenRestyMainConfigTemplate(customTemplate); err != nil {
+		t.Fatalf("ValidateOpenRestyMainConfigTemplate failed: %v", err)
+	}
+	if err := model.UpdateOption("OpenRestyMainConfigTemplate", customTemplate); err != nil {
+		t.Fatalf("UpdateOption OpenRestyMainConfigTemplate failed: %v", err)
+	}
+
+	preview, err := PreviewConfigVersion()
+	if err != nil {
+		t.Fatalf("PreviewConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(preview.MainConfig, "worker_shutdown_timeout 10s;") {
+		t.Fatal("expected preview main config to include custom template content")
+	}
+	if strings.Contains(preview.MainConfig, "{{OpenRestyWorkerProcesses}}") {
+		t.Fatal("expected preview main config placeholders to be rendered")
+	}
+	if !strings.Contains(preview.MainConfig, "include __OPENFLARE_ROUTE_CONFIG__;") {
+		t.Fatal("expected preview main config to preserve managed route include")
+	}
+	if !strings.Contains(preview.MainConfig, "access_log __OPENFLARE_ACCESS_LOG__ openflare_json;") {
+		t.Fatal("expected preview main config to preserve managed access log placeholder")
+	}
+
+	invalidTemplate := strings.ReplaceAll(
+		common.OpenRestyMainConfigTemplate,
+		"{{OpenRestyRouteConfigInclude}}",
+		"",
+	)
+	if err := ValidateOpenRestyMainConfigTemplate(invalidTemplate); err == nil {
+		t.Fatal("expected template without managed route placeholder to fail validation")
+	}
+
+	invalidTemplate = strings.ReplaceAll(
+		common.OpenRestyMainConfigTemplate,
+		"{{OpenRestyAccessLogPath}}",
+		"",
+	)
+	if err := ValidateOpenRestyMainConfigTemplate(invalidTemplate); err == nil {
+		t.Fatal("expected template without managed access log placeholder to fail validation")
+	}
+}
+
+func TestOpenRestyCommonRequestOptionsRender(t *testing.T) {
+	setupServiceTestDB(t)
+
+	if err := model.UpdateOption("OpenRestyClientMaxBodySize", "128m"); err != nil {
+		t.Fatalf("UpdateOption OpenRestyClientMaxBodySize failed: %v", err)
+	}
+	if err := model.UpdateOption("OpenRestyLargeClientHeaderBuffers", "8 32k"); err != nil {
+		t.Fatalf("UpdateOption OpenRestyLargeClientHeaderBuffers failed: %v", err)
+	}
+	if err := model.UpdateOption("OpenRestyProxyRequestBufferingEnabled", "false"); err != nil {
+		t.Fatalf("UpdateOption OpenRestyProxyRequestBufferingEnabled failed: %v", err)
+	}
+
+	preview, err := PreviewConfigVersion()
+	if err != nil {
+		t.Fatalf("PreviewConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(preview.MainConfig, "client_max_body_size 128m;") {
+		t.Fatal("expected preview main config to include client_max_body_size")
+	}
+	if !strings.Contains(preview.MainConfig, "large_client_header_buffers 8 32k;") {
+		t.Fatal("expected preview main config to include large_client_header_buffers")
+	}
+	if !strings.Contains(preview.MainConfig, "proxy_request_buffering off;") {
+		t.Fatal("expected preview main config to include proxy_request_buffering off")
+	}
+}
+
+func TestOpenRestyProxyRequestBufferingDefaultsToOff(t *testing.T) {
+	setupServiceTestDB(t)
+
+	preview, err := PreviewConfigVersion()
+	if err != nil {
+		t.Fatalf("PreviewConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(preview.MainConfig, "proxy_request_buffering off;") {
+		t.Fatal("expected preview main config to default proxy_request_buffering to off")
+	}
+}
+
+func setupServiceTestDB(t *testing.T) {
+	t.Helper()
+	nodeAgentTokenCache.reset()
+	common.SQLitePath = filepath.Join(t.TempDir(), "service.db")
+	if err := model.InitDB(); err != nil {
+		t.Fatalf("failed to init db: %v", err)
+	}
+	t.Cleanup(func() {
+		nodeAgentTokenCache.reset()
+		if err := model.CloseDB(); err != nil {
+			t.Fatalf("failed to close db: %v", err)
+		}
+	})
+}
+
+func generateCertificatePair(t *testing.T, dnsNames []string) (string, string) {
+	t.Helper()
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("GenerateKey failed: %v", err)
+	}
+	template := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: dnsNames[0],
+		},
+		DNSNames:     dnsNames,
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		IsCA:         false,
+		SerialNumber: big.NewInt(time.Now().UnixNano()),
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
+	if err != nil {
+		t.Fatalf("CreateCertificate failed: %v", err)
+	}
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)})
+	return string(certPEM), string(keyPEM)
+}

openflare_server/service/managed_domain.go

@@ -0,0 +1,227 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"openflare/model"
+	"sort"
+	"strings"
+	"unicode"
+)
+
+const (
+	ManagedDomainMatchTypeExact    = "exact"
+	ManagedDomainMatchTypeWildcard = "wildcard"
+)
+
+type ManagedDomainInput struct {
+	Domain  string `json:"domain"`
+	CertID  *uint  `json:"cert_id"`
+	Enabled bool   `json:"enabled"`
+	Remark  string `json:"remark"`
+}
+
+type ManagedDomainMatchCandidate struct {
+	ManagedDomainID uint   `json:"managed_domain_id"`
+	Domain          string `json:"domain"`
+	MatchType       string `json:"match_type"`
+	CertificateID   uint   `json:"certificate_id"`
+	CertificateName string `json:"certificate_name"`
+}
+
+type ManagedDomainMatchResult struct {
+	Domain     string                        `json:"domain"`
+	Matched    bool                          `json:"matched"`
+	Candidate  *ManagedDomainMatchCandidate  `json:"candidate,omitempty"`
+	Candidates []ManagedDomainMatchCandidate `json:"candidates"`
+}
+
+func ListManagedDomains() ([]*model.ManagedDomain, error) {
+	return model.ListManagedDomains()
+}
+
+func CreateManagedDomain(input ManagedDomainInput) (*model.ManagedDomain, error) {
+	domain, err := buildManagedDomain(nil, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = domain.Insert(); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("域名已存在")
+		}
+		return nil, err
+	}
+	return domain, nil
+}
+
+func UpdateManagedDomain(id uint, input ManagedDomainInput) (*model.ManagedDomain, error) {
+	domain, err := model.GetManagedDomainByID(id)
+	if err != nil {
+		return nil, err
+	}
+	domain, err = buildManagedDomain(domain, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = domain.Update(); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("域名已存在")
+		}
+		return nil, err
+	}
+	return domain, nil
+}
+
+func DeleteManagedDomain(id uint) error {
+	domain, err := model.GetManagedDomainByID(id)
+	if err != nil {
+		return err
+	}
+	return domain.Delete()
+}
+
+func MatchManagedDomainCertificate(rawDomain string) (*ManagedDomainMatchResult, error) {
+	domain := normalizeManagedDomain(rawDomain)
+	if err := validateManagedDomainPattern(domain); err != nil {
+		return nil, err
+	}
+	managedDomains, err := model.ListEnabledManagedDomainsWithCertificate()
+	if err != nil {
+		return nil, err
+	}
+	candidates := make([]ManagedDomainMatchCandidate, 0)
+	for _, item := range managedDomains {
+		if item.CertID == nil || *item.CertID == 0 {
+			continue
+		}
+		matchType := detectManagedDomainMatchType(item.Domain, domain)
+		if matchType == "" {
+			continue
+		}
+		certificate, err := model.GetTLSCertificateByID(*item.CertID)
+		if err != nil {
+			return nil, fmt.Errorf("托管域名 %s 关联证书不存在", item.Domain)
+		}
+		candidates = append(candidates, ManagedDomainMatchCandidate{
+			ManagedDomainID: item.ID,
+			Domain:          item.Domain,
+			MatchType:       matchType,
+			CertificateID:   certificate.ID,
+			CertificateName: certificate.Name,
+		})
+	}
+	sortManagedDomainCandidates(candidates)
+	result := &ManagedDomainMatchResult{
+		Domain:     domain,
+		Matched:    len(candidates) > 0,
+		Candidates: candidates,
+	}
+	if len(candidates) > 0 {
+		candidate := candidates[0]
+		result.Candidate = &candidate
+	}
+	return result, nil
+}
+
+func buildManagedDomain(existing *model.ManagedDomain, input ManagedDomainInput) (*model.ManagedDomain, error) {
+	domain := normalizeManagedDomain(input.Domain)
+	remark := strings.TrimSpace(input.Remark)
+	if err := validateManagedDomainPattern(domain); err != nil {
+		return nil, err
+	}
+	if input.CertID != nil && *input.CertID != 0 {
+		if _, err := model.GetTLSCertificateByID(*input.CertID); err != nil {
+			return nil, errors.New("所选证书不存在")
+		}
+	} else {
+		input.CertID = nil
+	}
+	if existing == nil {
+		existing = &model.ManagedDomain{}
+	}
+	existing.Domain = domain
+	existing.CertID = input.CertID
+	existing.Enabled = input.Enabled
+	existing.Remark = remark
+	return existing, nil
+}
+
+func normalizeManagedDomain(domain string) string {
+	return strings.ToLower(strings.TrimSpace(domain))
+}
+
+func validateManagedDomainPattern(domain string) error {
+	if domain == "" {
+		return errors.New("域名不能为空")
+	}
+	if strings.Contains(domain, "://") || strings.Contains(domain, "/") {
+		return errors.New("域名格式不合法")
+	}
+	if strings.Contains(domain, "*") {
+		if !strings.HasPrefix(domain, "*.") || strings.Count(domain, "*") != 1 {
+			return errors.New("通配符域名仅支持 *.example.com 格式")
+		}
+		return validateHostname(strings.TrimPrefix(domain, "*."))
+	}
+	return validateHostname(domain)
+}
+
+func validateHostname(domain string) error {
+	if domain == "" {
+		return errors.New("域名不能为空")
+	}
+	if len(domain) > 253 {
+		return errors.New("域名格式不合法")
+	}
+	labels := strings.Split(domain, ".")
+	if len(labels) < 2 {
+		return errors.New("域名格式不合法")
+	}
+	for _, label := range labels {
+		if len(label) == 0 || len(label) > 63 {
+			return errors.New("域名格式不合法")
+		}
+		if label[0] == '-' || label[len(label)-1] == '-' {
+			return errors.New("域名格式不合法")
+		}
+		for _, r := range label {
+			if unicode.IsLetter(r) || unicode.IsDigit(r) || r == '-' {
+				continue
+			}
+			return errors.New("域名格式不合法")
+		}
+	}
+	return nil
+}
+
+func detectManagedDomainMatchType(pattern string, domain string) string {
+	if pattern == domain {
+		return ManagedDomainMatchTypeExact
+	}
+	if !strings.HasPrefix(pattern, "*.") {
+		return ""
+	}
+	suffix := strings.TrimPrefix(pattern, "*.")
+	if !strings.HasSuffix(domain, "."+suffix) {
+		return ""
+	}
+	prefix := strings.TrimSuffix(domain, "."+suffix)
+	if prefix == "" || strings.Contains(prefix, ".") {
+		return ""
+	}
+	return ManagedDomainMatchTypeWildcard
+}
+
+func sortManagedDomainCandidates(candidates []ManagedDomainMatchCandidate) {
+	sort.Slice(candidates, func(i int, j int) bool {
+		left := candidates[i]
+		right := candidates[j]
+		if left.MatchType != right.MatchType {
+			return left.MatchType == ManagedDomainMatchTypeExact
+		}
+		if len(left.Domain) != len(right.Domain) {
+			return len(left.Domain) > len(right.Domain)
+		}
+		return left.ManagedDomainID < right.ManagedDomainID
+	})
+}

openflare_server/service/managed_domain_phase2_test.go

@@ -0,0 +1,109 @@
+package service
+
+import "testing"
+
+func TestMatchManagedDomainCertificatePrefersExactMatch(t *testing.T) {
+	setupServiceTestDB(t)
+
+	wildcardCertPEM, wildcardKeyPEM := generateCertificatePair(t, []string{"*.example.com"})
+	wildcardCert, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "wildcard-cert",
+		CertPEM: wildcardCertPEM,
+		KeyPEM:  wildcardKeyPEM,
+	})
+	if err != nil {
+		t.Fatalf("failed to create wildcard certificate: %v", err)
+	}
+	exactCertPEM, exactKeyPEM := generateCertificatePair(t, []string{"api.example.com"})
+	exactCert, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "exact-cert",
+		CertPEM: exactCertPEM,
+		KeyPEM:  exactKeyPEM,
+	})
+	if err != nil {
+		t.Fatalf("failed to create exact certificate: %v", err)
+	}
+	if _, err = CreateManagedDomain(ManagedDomainInput{
+		Domain:  "*.example.com",
+		CertID:  &wildcardCert.ID,
+		Enabled: true,
+	}); err != nil {
+		t.Fatalf("failed to create wildcard managed domain: %v", err)
+	}
+	if _, err = CreateManagedDomain(ManagedDomainInput{
+		Domain:  "api.example.com",
+		CertID:  &exactCert.ID,
+		Enabled: true,
+	}); err != nil {
+		t.Fatalf("failed to create exact managed domain: %v", err)
+	}
+
+	result, err := MatchManagedDomainCertificate("api.example.com")
+	if err != nil {
+		t.Fatalf("MatchManagedDomainCertificate failed: %v", err)
+	}
+	if !result.Matched || result.Candidate == nil {
+		t.Fatal("expected exact domain to be matched")
+	}
+	if result.Candidate.MatchType != ManagedDomainMatchTypeExact {
+		t.Fatalf("expected exact match first, got %s", result.Candidate.MatchType)
+	}
+	if result.Candidate.CertificateID != exactCert.ID {
+		t.Fatalf("expected exact certificate %d, got %d", exactCert.ID, result.Candidate.CertificateID)
+	}
+	if len(result.Candidates) != 2 {
+		t.Fatalf("expected 2 match candidates, got %d", len(result.Candidates))
+	}
+}
+
+func TestMatchManagedDomainCertificateSupportsWildcard(t *testing.T) {
+	setupServiceTestDB(t)
+
+	certPEM, keyPEM := generateCertificatePair(t, []string{"*.example.com"})
+	certificate, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "wildcard-cert",
+		CertPEM: certPEM,
+		KeyPEM:  keyPEM,
+	})
+	if err != nil {
+		t.Fatalf("failed to create certificate: %v", err)
+	}
+	if _, err = CreateManagedDomain(ManagedDomainInput{
+		Domain:  "*.example.com",
+		CertID:  &certificate.ID,
+		Enabled: true,
+	}); err != nil {
+		t.Fatalf("failed to create managed domain: %v", err)
+	}
+
+	result, err := MatchManagedDomainCertificate("edge.example.com")
+	if err != nil {
+		t.Fatalf("MatchManagedDomainCertificate failed: %v", err)
+	}
+	if !result.Matched || result.Candidate == nil {
+		t.Fatal("expected wildcard domain to be matched")
+	}
+	if result.Candidate.MatchType != ManagedDomainMatchTypeWildcard {
+		t.Fatalf("expected wildcard match, got %s", result.Candidate.MatchType)
+	}
+
+	deepResult, err := MatchManagedDomainCertificate("deep.edge.example.com")
+	if err != nil {
+		t.Fatalf("MatchManagedDomainCertificate failed: %v", err)
+	}
+	if deepResult.Matched {
+		t.Fatal("expected single-level wildcard not to match deep subdomain")
+	}
+}
+
+func TestCreateManagedDomainRejectsInvalidWildcard(t *testing.T) {
+	setupServiceTestDB(t)
+
+	_, err := CreateManagedDomain(ManagedDomainInput{
+		Domain:  "*.*.example.com",
+		Enabled: true,
+	})
+	if err == nil {
+		t.Fatal("expected invalid wildcard domain to fail")
+	}
+}

openflare_server/service/node.go

@@ -0,0 +1,506 @@
+package service
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"log/slog"
+	"net"
+	"openflare/common"
+	"openflare/model"
+	"openflare/utils/geoip"
+	"strings"
+	"time"
+)
+
+type NodeInput struct {
+	Name              string   `json:"name"`
+	IP                string   `json:"ip"`
+	AutoUpdateEnabled bool     `json:"auto_update_enabled"`
+	GeoName           string   `json:"geo_name"`
+	GeoLatitude       *float64 `json:"geo_latitude"`
+	GeoLongitude      *float64 `json:"geo_longitude"`
+	GeoManualOverride bool     `json:"geo_manual_override"`
+}
+
+type NodeAgentUpdateInput struct {
+	Channel string `json:"channel"`
+	TagName string `json:"tag_name"`
+}
+
+type NodeAgentReleaseInfo struct {
+	TagName          string `json:"tag_name"`
+	Body             string `json:"body"`
+	HTMLURL          string `json:"html_url"`
+	PublishedAt      string `json:"published_at"`
+	CurrentVersion   string `json:"current_version"`
+	HasUpdate        bool   `json:"has_update"`
+	Channel          string `json:"channel"`
+	Prerelease       bool   `json:"prerelease"`
+	UpdateRequested  bool   `json:"update_requested"`
+	RequestedChannel string `json:"requested_channel"`
+	RequestedTag     string `json:"requested_tag"`
+}
+
+type NodeBootstrapView struct {
+	DiscoveryToken string `json:"discovery_token"`
+}
+
+type AgentRegistrationResponse struct {
+	NodeID     string `json:"node_id"`
+	AgentToken string `json:"agent_token"`
+	Name       string `json:"name"`
+}
+
+func CreateNode(input NodeInput) (*NodeView, error) {
+	name, ip, geoName, geoLatitude, geoLongitude, geoManualOverride, err := normalizeNodeInput(input)
+	if name == "" {
+		return nil, errors.New("节点名不能为空")
+	}
+	node := &model.Node{
+		Name:              name,
+		IP:                ip,
+		GeoName:           geoName,
+		GeoLatitude:       geoLatitude,
+		GeoLongitude:      geoLongitude,
+		GeoManualOverride: geoManualOverride,
+		AgentVersion:      "",
+		NginxVersion:      "",
+		Status:            NodeStatusPending,
+		AutoUpdateEnabled: input.AutoUpdateEnabled,
+	}
+	node.NodeID, err = newServerNodeID()
+	if err != nil {
+		return nil, err
+	}
+	node.AgentToken, err = newRandomToken()
+	if err != nil {
+		return nil, err
+	}
+	if !node.GeoManualOverride {
+		applyGeoInfoFromIP(node, node.IP)
+	}
+	if err := node.Insert(); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("节点标识生成冲突，请重试")
+		}
+		return nil, err
+	}
+	refreshAgentTokenCache(node)
+	slog.Info("node created", "name", node.Name, "node_id", node.NodeID)
+	return buildNodeView(node), nil
+}
+
+func UpdateNode(id uint, input NodeInput) (*NodeView, error) {
+	name, ip, geoName, geoLatitude, geoLongitude, geoManualOverride, err := normalizeNodeInput(input)
+	if name == "" {
+		return nil, errors.New("节点名不能为空")
+	}
+	node, err := model.GetNodeByID(id)
+	if err != nil {
+		return nil, err
+	}
+	node.Name = name
+	node.IP = ip
+	node.GeoName = geoName
+	node.GeoLatitude = geoLatitude
+	node.GeoLongitude = geoLongitude
+	node.GeoManualOverride = geoManualOverride
+	node.AutoUpdateEnabled = input.AutoUpdateEnabled
+	if !node.GeoManualOverride {
+		applyGeoInfoFromIP(node, strings.TrimSpace(node.IP))
+	}
+	if err = node.Update(); err != nil {
+		return nil, err
+	}
+	refreshAgentTokenCache(node)
+	slog.Info("node updated", "name", node.Name, "node_id", node.NodeID)
+	return buildNodeView(node), nil
+}
+
+func DeleteNode(id uint) error {
+	node, err := model.GetNodeByID(id)
+	if err != nil {
+		return err
+	}
+	slog.Info("node deleted", "name", node.Name, "node_id", node.NodeID)
+	if err := node.Delete(); err != nil {
+		return err
+	}
+	invalidateAgentTokenCache(node.AgentToken)
+	return nil
+}
+
+func GetNodeAgentRelease(ctx context.Context, id uint, channel string) (*NodeAgentReleaseInfo, error) {
+	node, err := model.GetNodeByID(id)
+	if err != nil {
+		return nil, err
+	}
+	release, err := fetchLatestGitHubRelease(ctx, common.AgentUpdateRepo, normalizeReleaseChannel(channel))
+	if err != nil {
+		return nil, err
+	}
+	return buildNodeAgentReleaseView(node, release, normalizeReleaseChannel(channel)), nil
+}
+
+func RequestNodeAgentUpdate(id uint, input NodeAgentUpdateInput) (*NodeView, error) {
+	node, err := model.GetNodeByID(id)
+	if err != nil {
+		return nil, err
+	}
+	channel := normalizeReleaseChannel(input.Channel)
+	tagName := strings.TrimSpace(input.TagName)
+	if tagName != "" {
+		release, releaseErr := fetchGitHubReleaseByTag(context.Background(), common.AgentUpdateRepo, tagName)
+		if releaseErr != nil {
+			return nil, releaseErr
+		}
+		if channel == ReleaseChannelPreview && !release.Prerelease {
+			return nil, errors.New("指定版本不是 preview 发布")
+		}
+		if channel == ReleaseChannelStable && release.Prerelease {
+			return nil, errors.New("正式版更新不能选择 preview 发布")
+		}
+	}
+	node.UpdateRequested = true
+	node.UpdateChannel = channel.String()
+	node.UpdateTag = tagName
+	if err = model.DB.Model(node).Select("update_requested", "update_channel", "update_tag").Updates(node).Error; err != nil {
+		return nil, err
+	}
+	refreshAgentTokenCache(node)
+	slog.Info("agent manual update requested", "node_id", node.NodeID, "name", node.Name, "channel", channel.String(), "tag", tagName)
+	return buildNodeView(node), nil
+}
+
+func RequestNodeOpenrestyRestart(id uint) (*NodeView, error) {
+	node, err := model.GetNodeByID(id)
+	if err != nil {
+		return nil, err
+	}
+	node.RestartOpenrestyRequested = true
+	if err = model.DB.Model(node).Select("restart_openresty_requested").Updates(node).Error; err != nil {
+		return nil, err
+	}
+	refreshAgentTokenCache(node)
+	slog.Info("openresty restart requested", "node_id", node.NodeID, "name", node.Name)
+	return buildNodeView(node), nil
+}
+
+func AuthenticateAgentToken(token string) (*model.Node, error) {
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return nil, errors.New("缺少 Agent Token")
+	}
+	return authenticateAgentTokenWithCache(token)
+}
+
+func ValidateDiscoveryToken(token string) error {
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return errors.New("缺少 Discovery Token")
+	}
+	discoveryToken, err := EnsureGlobalDiscoveryToken()
+	if err != nil {
+		return err
+	}
+	if token != discoveryToken {
+		return errors.New("Discovery Token 无效")
+	}
+	return nil
+}
+
+func EnsureGlobalDiscoveryToken() (string, error) {
+	common.OptionMapRWMutex.RLock()
+	needsInit := common.OptionMap == nil
+	common.OptionMapRWMutex.RUnlock()
+	if needsInit {
+		model.InitOptionMap()
+	}
+	common.OptionMapRWMutex.RLock()
+	token := strings.TrimSpace(common.OptionMap["AgentDiscoveryToken"])
+	common.OptionMapRWMutex.RUnlock()
+	if token != "" {
+		return token, nil
+	}
+	token, err := newRandomToken()
+	if err != nil {
+		return "", err
+	}
+	if err = model.UpdateOption("AgentDiscoveryToken", token); err != nil {
+		return "", err
+	}
+	return token, nil
+}
+
+func GetNodeBootstrapView() (*NodeBootstrapView, error) {
+	token, err := EnsureGlobalDiscoveryToken()
+	if err != nil {
+		return nil, err
+	}
+	return &NodeBootstrapView{DiscoveryToken: token}, nil
+}
+
+func RotateGlobalDiscoveryToken() (*NodeBootstrapView, error) {
+	token, err := newRandomToken()
+	if err != nil {
+		return nil, err
+	}
+	if err = model.UpdateOption("AgentDiscoveryToken", token); err != nil {
+		return nil, err
+	}
+	return &NodeBootstrapView{DiscoveryToken: token}, nil
+}
+
+func buildNodeView(node *model.Node) *NodeView {
+	status := computeNodeStatus(node)
+	view := &NodeView{
+		ID:                        node.ID,
+		NodeID:                    node.NodeID,
+		Name:                      node.Name,
+		IP:                        node.IP,
+		GeoName:                   strings.TrimSpace(node.GeoName),
+		GeoLatitude:               node.GeoLatitude,
+		GeoLongitude:              node.GeoLongitude,
+		GeoManualOverride:         node.GeoManualOverride,
+		AgentToken:                node.AgentToken,
+		UpdateChannel:             strings.TrimSpace(node.UpdateChannel),
+		UpdateTag:                 strings.TrimSpace(node.UpdateTag),
+		RestartOpenrestyRequested: node.RestartOpenrestyRequested,
+		AgentVersion:              node.AgentVersion,
+		NginxVersion:              node.NginxVersion,
+		OpenrestyStatus:           normalizeOpenrestyStatus(node.OpenrestyStatus),
+		OpenrestyMessage:          strings.TrimSpace(node.OpenrestyMessage),
+		Status:                    status,
+		CurrentVersion:            node.CurrentVersion,
+		LastSeenAt:                node.LastSeenAt,
+		LastError:                 node.LastError,
+		CreatedAt:                 node.CreatedAt,
+		UpdatedAt:                 node.UpdatedAt,
+		AutoUpdateEnabled:         node.AutoUpdateEnabled,
+		UpdateRequested:           node.UpdateRequested,
+	}
+	if view.UpdateChannel == "" {
+		view.UpdateChannel = ReleaseChannelStable.String()
+	}
+	return view
+}
+
+func normalizeNodeInput(input NodeInput) (string, string, string, *float64, *float64, bool, error) {
+	name := strings.TrimSpace(input.Name)
+	ip := strings.TrimSpace(input.IP)
+	geoName := strings.TrimSpace(input.GeoName)
+	manualOverride := input.GeoManualOverride || geoName != "" || input.GeoLatitude != nil || input.GeoLongitude != nil
+	if len(ip) > 64 {
+		return "", "", "", nil, nil, false, errors.New("节点 IP 不能超过 64 个字符")
+	}
+	if ip != "" && net.ParseIP(ip) == nil {
+		return "", "", "", nil, nil, false, errors.New("节点 IP 格式无效")
+	}
+	if len(geoName) > 128 {
+		return "", "", "", nil, nil, false, errors.New("节点位置名不能超过 128 个字符")
+	}
+
+	geoLatitude := cloneCoordinate(input.GeoLatitude)
+	geoLongitude := cloneCoordinate(input.GeoLongitude)
+	if (geoLatitude == nil) != (geoLongitude == nil) {
+		return "", "", "", nil, nil, false, errors.New("地图坐标必须同时填写纬度和经度")
+	}
+	if geoLatitude != nil && (*geoLatitude < -90 || *geoLatitude > 90) {
+		return "", "", "", nil, nil, false, errors.New("纬度必须在 -90 到 90 之间")
+	}
+	if geoLongitude != nil && (*geoLongitude < -180 || *geoLongitude > 180) {
+		return "", "", "", nil, nil, false, errors.New("经度必须在 -180 到 180 之间")
+	}
+
+	if !manualOverride {
+		return name, ip, "", nil, nil, false, nil
+	}
+	if geoLatitude == nil && geoLongitude == nil && geoName == "" {
+		return name, ip, "", nil, nil, false, nil
+	}
+
+	return name, ip, geoName, geoLatitude, geoLongitude, true, nil
+}
+
+func cloneCoordinate(value *float64) *float64 {
+	if value == nil {
+		return nil
+	}
+	cloned := *value
+	return &cloned
+}
+
+func buildNodeAgentReleaseView(node *model.Node, release *githubReleaseResponse, channel ReleaseChannel) *NodeAgentReleaseInfo {
+	currentVersion := strings.TrimSpace(node.AgentVersion)
+	view := &NodeAgentReleaseInfo{
+		CurrentVersion:   currentVersion,
+		Channel:          channel.String(),
+		UpdateRequested:  node.UpdateRequested,
+		RequestedChannel: normalizeReleaseChannel(node.UpdateChannel).String(),
+		RequestedTag:     strings.TrimSpace(node.UpdateTag),
+	}
+	if release == nil {
+		return view
+	}
+	view.TagName = release.TagName
+	view.Body = release.Body
+	view.HTMLURL = release.HTMLURL
+	view.PublishedAt = release.PublishedAt
+	view.Prerelease = release.Prerelease
+	view.HasUpdate = isVersionNewer(currentVersion, release.TagName)
+	return view
+}
+
+func RegisterNodeWithAgentToken(node *model.Node, payload AgentNodePayload) (*AgentRegistrationResponse, error) {
+	payload = normalizeAgentNodePayload(payload)
+	if node == nil {
+		return nil, errors.New("节点不存在")
+	}
+	if err := validateAgentNodePayload(payload); err != nil {
+		return nil, err
+	}
+	applyNodeRuntime(node, payload, true)
+	if err := node.Update(); err != nil {
+		return nil, err
+	}
+	refreshAgentTokenCache(node)
+	slog.Info("agent register succeeded on reserved node", "node_id", node.NodeID, "name", node.Name)
+	return &AgentRegistrationResponse{
+		NodeID:     node.NodeID,
+		AgentToken: node.AgentToken,
+		Name:       node.Name,
+	}, nil
+}
+
+func RegisterNodeWithDiscovery(payload AgentNodePayload) (*AgentRegistrationResponse, error) {
+	payload = normalizeAgentNodePayload(payload)
+	if err := validateAgentNodePayload(payload); err != nil {
+		return nil, err
+	}
+	nodeID, err := newServerNodeID()
+	if err != nil {
+		return nil, err
+	}
+	agentToken, err := newRandomToken()
+	if err != nil {
+		return nil, err
+	}
+	nodeName := payload.Name
+	if nodeName == "" {
+		nodeName = nodeID
+	}
+	node := &model.Node{
+		NodeID:     nodeID,
+		Name:       nodeName,
+		AgentToken: agentToken,
+	}
+	applyNodeRuntime(node, payload, false)
+	if err = node.Insert(); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("节点标识生成冲突，请重试")
+		}
+		return nil, err
+	}
+	refreshAgentTokenCache(node)
+	slog.Info("agent discovery register succeeded", "node_id", node.NodeID, "name", node.Name)
+	return &AgentRegistrationResponse{
+		NodeID:     node.NodeID,
+		AgentToken: node.AgentToken,
+		Name:       node.Name,
+	}, nil
+}
+
+func normalizeAgentNodePayload(payload AgentNodePayload) AgentNodePayload {
+	payload.Name = strings.TrimSpace(payload.Name)
+	payload.IP = strings.TrimSpace(payload.IP)
+	payload.AgentVersion = strings.TrimSpace(payload.AgentVersion)
+	payload.NginxVersion = strings.TrimSpace(payload.NginxVersion)
+	payload.CurrentVersion = strings.TrimSpace(payload.CurrentVersion)
+	payload.LastError = strings.TrimSpace(payload.LastError)
+	payload.OpenrestyStatus = normalizeOpenrestyStatus(payload.OpenrestyStatus)
+	payload.OpenrestyMessage = strings.TrimSpace(payload.OpenrestyMessage)
+	return payload
+}
+
+func validateAgentNodePayload(payload AgentNodePayload) error {
+	if payload.IP == "" {
+		return errors.New("ip 不能为空")
+	}
+	if payload.AgentVersion == "" {
+		return errors.New("agent_version 不能为空")
+	}
+	return nil
+}
+
+func applyNodeRuntime(node *model.Node, payload AgentNodePayload, preserveName bool) {
+	if !preserveName || strings.TrimSpace(node.Name) == "" {
+		if strings.TrimSpace(payload.Name) != "" {
+			node.Name = strings.TrimSpace(payload.Name)
+		}
+	}
+	node.IP = strings.TrimSpace(payload.IP)
+	node.AgentVersion = strings.TrimSpace(payload.AgentVersion)
+	node.NginxVersion = strings.TrimSpace(payload.NginxVersion)
+	node.OpenrestyStatus = normalizeOpenrestyStatus(payload.OpenrestyStatus)
+	node.OpenrestyMessage = strings.TrimSpace(payload.OpenrestyMessage)
+	node.Status = NodeStatusOnline
+	node.CurrentVersion = strings.TrimSpace(payload.CurrentVersion)
+	node.LastSeenAt = time.Now()
+	node.LastError = strings.TrimSpace(payload.LastError)
+	if !node.GeoManualOverride {
+		applyGeoInfoFromIP(node, node.IP)
+	}
+}
+
+func applyGeoInfoFromIP(node *model.Node, rawIP string) {
+	if node == nil {
+		return
+	}
+	node.GeoName = ""
+	node.GeoLatitude = nil
+	node.GeoLongitude = nil
+	ip := net.ParseIP(strings.TrimSpace(rawIP))
+	if ip == nil {
+		return
+	}
+	info, err := geoip.GetGeoInfo(ip)
+	if err != nil || info == nil {
+		return
+	}
+	if strings.TrimSpace(info.Name) != "" {
+		node.GeoName = strings.TrimSpace(info.Name)
+	}
+	if info.Latitude != nil && info.Longitude != nil {
+		node.GeoLatitude = cloneCoordinate(info.Latitude)
+		node.GeoLongitude = cloneCoordinate(info.Longitude)
+	}
+}
+
+func normalizeOpenrestyStatus(status string) string {
+	switch strings.ToLower(strings.TrimSpace(status)) {
+	case OpenrestyStatusHealthy:
+		return OpenrestyStatusHealthy
+	case OpenrestyStatusUnhealthy:
+		return OpenrestyStatusUnhealthy
+	default:
+		return OpenrestyStatusUnknown
+	}
+}
+
+func newRandomToken() (string, error) {
+	buf := make([]byte, 16)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(buf), nil
+}
+
+func newServerNodeID() (string, error) {
+	token, err := newRandomToken()
+	if err != nil {
+		return "", err
+	}
+	return "node-" + token, nil
+}

openflare_server/service/node_agent_token_cache.go

@@ -0,0 +1,177 @@
+package service
+
+import (
+	"errors"
+	"openflare/model"
+	"time"
+
+	ristretto "github.com/dgraph-io/ristretto/v2"
+	"gorm.io/gorm"
+)
+
+const (
+	agentTokenPositiveCacheTTL = 2 * time.Minute
+	agentTokenNegativeCacheTTL = 10 * time.Minute
+	agentTokenNegativeCacheCap = 10000
+)
+
+type cachedAgentNode struct {
+	node      *model.Node
+	expiresAt time.Time
+}
+
+type cachedMissingAgentToken struct {
+	expiresAt time.Time
+}
+
+type agentTokenAuthCache struct {
+	positive        *ristretto.Cache[string, cachedAgentNode]
+	negative        *ristretto.Cache[string, cachedMissingAgentToken]
+	now             func() time.Time
+	loadNodeByToken func(string) (*model.Node, error)
+}
+
+var nodeAgentTokenCache = newAgentTokenAuthCache()
+
+func newAgentTokenAuthCache() *agentTokenAuthCache {
+	return &agentTokenAuthCache{
+		positive: mustNewAgentTokenPositiveCache(),
+		negative: mustNewAgentTokenNegativeCache(),
+		now:      time.Now,
+		loadNodeByToken: func(token string) (*model.Node, error) {
+			return model.GetNodeByAgentToken(token)
+		},
+	}
+}
+
+func mustNewAgentTokenPositiveCache() *ristretto.Cache[string, cachedAgentNode] {
+	cache, err := ristretto.NewCache(&ristretto.Config[string, cachedAgentNode]{
+		NumCounters: 1e5,
+		MaxCost:     2e4,
+		BufferItems: 64,
+	})
+	if err != nil {
+		panic(err)
+	}
+	return cache
+}
+
+func mustNewAgentTokenNegativeCache() *ristretto.Cache[string, cachedMissingAgentToken] {
+	cache, err := ristretto.NewCache(&ristretto.Config[string, cachedMissingAgentToken]{
+		NumCounters: 1e5,
+		MaxCost:     agentTokenNegativeCacheCap,
+		BufferItems: 64,
+	})
+	if err != nil {
+		panic(err)
+	}
+	return cache
+}
+
+func (c *agentTokenAuthCache) authenticate(token string) (*model.Node, error) {
+	now := c.now()
+	if node, ok := c.getNode(token, now); ok {
+		return node, nil
+	}
+	if c.isMissing(token, now) {
+		return nil, gorm.ErrRecordNotFound
+	}
+
+	node, err := c.loadNodeByToken(token)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			c.storeMissing(token, now.Add(agentTokenNegativeCacheTTL))
+		}
+		return nil, err
+	}
+
+	c.storeNode(token, node, now.Add(agentTokenPositiveCacheTTL))
+	return cloneCachedNode(node), nil
+}
+
+func (c *agentTokenAuthCache) getNode(token string, now time.Time) (*model.Node, bool) {
+	entry, ok := c.positive.Get(token)
+	if !ok {
+		return nil, false
+	}
+	if now.After(entry.expiresAt) {
+		c.positive.Del(token)
+		return nil, false
+	}
+	return cloneCachedNode(entry.node), true
+}
+
+func (c *agentTokenAuthCache) isMissing(token string, now time.Time) bool {
+	entry, ok := c.negative.Get(token)
+	if !ok {
+		return false
+	}
+	if now.After(entry.expiresAt) {
+		c.negative.Del(token)
+		return false
+	}
+	return true
+}
+
+func (c *agentTokenAuthCache) storeNode(token string, node *model.Node, expiresAt time.Time) {
+	if token == "" || node == nil {
+		return
+	}
+	c.negative.Del(token)
+	c.positive.Set(token, cachedAgentNode{
+		node:      cloneCachedNode(node),
+		expiresAt: expiresAt,
+	}, 1)
+	c.positive.Wait()
+}
+
+func (c *agentTokenAuthCache) storeMissing(token string, expiresAt time.Time) {
+	if token == "" {
+		return
+	}
+	c.positive.Del(token)
+	c.negative.Set(token, cachedMissingAgentToken{
+		expiresAt: expiresAt,
+	}, 1)
+	c.negative.Wait()
+}
+
+func (c *agentTokenAuthCache) invalidate(token string) {
+	if token == "" {
+		return
+	}
+	c.positive.Del(token)
+	c.negative.Del(token)
+}
+
+func (c *agentTokenAuthCache) reset() {
+	c.positive.Clear()
+	c.negative.Clear()
+}
+
+func cloneCachedNode(node *model.Node) *model.Node {
+	if node == nil {
+		return nil
+	}
+	cloned := *node
+	return &cloned
+}
+
+func authenticateAgentTokenWithCache(token string) (*model.Node, error) {
+	return nodeAgentTokenCache.authenticate(token)
+}
+
+func refreshAgentTokenCache(node *model.Node) {
+	if node == nil {
+		return
+	}
+	nodeAgentTokenCache.storeNode(
+		node.AgentToken,
+		node,
+		nodeAgentTokenCache.now().Add(agentTokenPositiveCacheTTL),
+	)
+}
+
+func invalidateAgentTokenCache(token string) {
+	nodeAgentTokenCache.invalidate(token)
+}

openflare_server/service/node_agent_token_cache_test.go

@@ -0,0 +1,113 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"openflare/model"
+	"testing"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+func TestAgentTokenAuthCacheUsesPositiveCacheUntilLogicalExpiry(t *testing.T) {
+	cache := newAgentTokenAuthCache()
+	cache.reset()
+	baseTime := time.Date(2026, 3, 14, 16, 0, 0, 0, time.UTC)
+	currentTime := baseTime
+	cache.now = func() time.Time {
+		return currentTime
+	}
+
+	loadCount := 0
+	cache.loadNodeByToken = func(token string) (*model.Node, error) {
+		loadCount++
+		return &model.Node{
+			NodeID:     fmt.Sprintf("node-%d", loadCount),
+			Name:       "edge",
+			AgentToken: token,
+		}, nil
+	}
+
+	first, err := cache.authenticate("token-a")
+	if err != nil {
+		t.Fatalf("expected first auth to succeed: %v", err)
+	}
+	if loadCount != 1 {
+		t.Fatalf("expected one db load, got %d", loadCount)
+	}
+
+	second, err := cache.authenticate("token-a")
+	if err != nil {
+		t.Fatalf("expected cached auth to succeed: %v", err)
+	}
+	if loadCount != 1 {
+		t.Fatalf("expected cache hit without db load, got %d", loadCount)
+	}
+	if first.NodeID != second.NodeID {
+		t.Fatalf("expected cached node to match original, got %s and %s", first.NodeID, second.NodeID)
+	}
+
+	currentTime = baseTime.Add(agentTokenPositiveCacheTTL + time.Second)
+	third, err := cache.authenticate("token-a")
+	if err != nil {
+		t.Fatalf("expected auth after expiry to succeed: %v", err)
+	}
+	if loadCount != 2 {
+		t.Fatalf("expected reload after logical expiry, got %d loads", loadCount)
+	}
+	if third.NodeID == second.NodeID {
+		t.Fatalf("expected refreshed cache entry after expiry, got unchanged node id %s", third.NodeID)
+	}
+}
+
+func TestAgentTokenAuthCacheRefreshesAfterMissingEntryExpires(t *testing.T) {
+	cache := newAgentTokenAuthCache()
+	cache.reset()
+	baseTime := time.Date(2026, 3, 14, 16, 30, 0, 0, time.UTC)
+	currentTime := baseTime
+	cache.now = func() time.Time {
+		return currentTime
+	}
+
+	loadCount := 0
+	cache.loadNodeByToken = func(token string) (*model.Node, error) {
+		loadCount++
+		if loadCount == 1 {
+			return nil, gorm.ErrRecordNotFound
+		}
+		return &model.Node{
+			NodeID:     "node-recovered",
+			Name:       "edge",
+			AgentToken: token,
+		}, nil
+	}
+
+	_, err := cache.authenticate("token-missing")
+	if !errors.Is(err, gorm.ErrRecordNotFound) {
+		t.Fatalf("expected first lookup to miss, got %v", err)
+	}
+	if loadCount != 1 {
+		t.Fatalf("expected one db load for first miss, got %d", loadCount)
+	}
+
+	_, err = cache.authenticate("token-missing")
+	if !errors.Is(err, gorm.ErrRecordNotFound) {
+		t.Fatalf("expected cached missing lookup to miss, got %v", err)
+	}
+	if loadCount != 1 {
+		t.Fatalf("expected missing cache hit without db load, got %d", loadCount)
+	}
+
+	currentTime = baseTime.Add(agentTokenNegativeCacheTTL + time.Second)
+	node, err := cache.authenticate("token-missing")
+	if err != nil {
+		t.Fatalf("expected lookup after missing expiry to reload successfully: %v", err)
+	}
+	if loadCount != 2 {
+		t.Fatalf("expected db reload after missing cache expiry, got %d", loadCount)
+	}
+	if node.NodeID != "node-recovered" {
+		t.Fatalf("unexpected recovered node: %+v", node)
+	}
+}

openflare_server/service/node_observability.go

@@ -0,0 +1,141 @@
+package service
+
+import (
+	"errors"
+	"openflare/model"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+const (
+	defaultObservabilityWindow = 24 * time.Hour
+	defaultObservabilityLimit  = 120
+	maxObservabilityLimit      = 500
+)
+
+type NodeObservabilityQuery struct {
+	Hours int `json:"hours"`
+	Limit int `json:"limit"`
+}
+
+type NodeObservabilityView struct {
+	NodeID          string                      `json:"node_id"`
+	Profile         *model.NodeSystemProfile    `json:"profile"`
+	MetricSnapshots []*model.NodeMetricSnapshot `json:"metric_snapshots"`
+	TrafficReports  []*model.NodeRequestReport  `json:"traffic_reports"`
+	HealthEvents    []*model.NodeHealthEvent    `json:"health_events"`
+	Analytics       NodeObservabilityAnalytics  `json:"analytics"`
+	Trends          NodeObservabilityTrends     `json:"trends"`
+}
+
+type NodeObservabilityAnalytics struct {
+	Traffic       TrafficWindowSummary       `json:"traffic"`
+	Distributions TrafficDistributions       `json:"distributions"`
+	Health        ObservabilityHealthSummary `json:"health"`
+}
+
+type NodeObservabilityTrends struct {
+	Traffic24h  []TrafficTrendPoint  `json:"traffic_24h"`
+	Capacity24h []CapacityTrendPoint `json:"capacity_24h"`
+	Network24h  []NetworkTrendPoint  `json:"network_24h"`
+	DiskIO24h   []DiskIOTrendPoint   `json:"disk_io_24h"`
+}
+
+func GetNodeObservability(id uint, query NodeObservabilityQuery) (*NodeObservabilityView, error) {
+	now := time.Now()
+	node, err := model.GetNodeByID(id)
+	if err != nil {
+		return nil, err
+	}
+
+	limit := normalizeObservabilityLimit(query.Limit)
+	since := now.Add(-normalizeObservabilityWindow(query.Hours))
+
+	profile, err := model.GetNodeSystemProfile(node.NodeID)
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		profile = nil
+	}
+
+	snapshots, err := model.ListNodeMetricSnapshots(node.NodeID, since, limit)
+	if err != nil {
+		return nil, err
+	}
+	reports, err := model.ListNodeRequestReports(node.NodeID, since, limit)
+	if err != nil {
+		return nil, err
+	}
+	accessLogRegions, err := model.ListNodeAccessLogRegionCounts(node.NodeID, since, 8)
+	if err != nil {
+		return nil, err
+	}
+	trendSnapshots, err := model.ListNodeMetricSnapshots(node.NodeID, now.Add(-24*time.Hour), 0)
+	if err != nil {
+		return nil, err
+	}
+	trendReports, err := model.ListNodeRequestReports(node.NodeID, now.Add(-24*time.Hour), 0)
+	if err != nil {
+		return nil, err
+	}
+	events, err := model.ListNodeHealthEvents(node.NodeID, false, limit)
+	if err != nil {
+		return nil, err
+	}
+
+	return &NodeObservabilityView{
+		NodeID:          node.NodeID,
+		Profile:         profile,
+		MetricSnapshots: snapshots,
+		TrafficReports:  reports,
+		HealthEvents:    events,
+		Analytics: NodeObservabilityAnalytics{
+			Traffic:       buildTrafficWindowSummary(latestTrafficReport(reports)),
+			Distributions: buildTrafficDistributions(reports, accessLogRegions, 8),
+			Health:        buildObservabilityHealthSummary(latestMetricSnapshot(snapshots), latestTrafficReport(reports), events),
+		},
+		Trends: NodeObservabilityTrends{
+			Traffic24h:  buildTrafficTrendPoints(now, trendReports),
+			Capacity24h: buildCapacityTrendPoints(now, trendSnapshots),
+			Network24h:  buildNetworkTrendPoints(now, trendSnapshots),
+			DiskIO24h:   buildDiskIOTrendPoints(now, trendSnapshots),
+		},
+	}, nil
+}
+
+func latestMetricSnapshot(snapshots []*model.NodeMetricSnapshot) *model.NodeMetricSnapshot {
+	for _, snapshot := range snapshots {
+		if snapshot != nil {
+			return snapshot
+		}
+	}
+	return nil
+}
+
+func latestTrafficReport(reports []*model.NodeRequestReport) *model.NodeRequestReport {
+	for _, report := range reports {
+		if report != nil {
+			return report
+		}
+	}
+	return nil
+}
+
+func normalizeObservabilityLimit(limit int) int {
+	if limit <= 0 {
+		return defaultObservabilityLimit
+	}
+	if limit > maxObservabilityLimit {
+		return maxObservabilityLimit
+	}
+	return limit
+}
+
+func normalizeObservabilityWindow(hours int) time.Duration {
+	if hours <= 0 {
+		return defaultObservabilityWindow
+	}
+	return time.Duration(hours) * time.Hour
+}

openflare_server/service/observability.go

@@ -0,0 +1,349 @@
+package service
+
+import (
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"openflare/model"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+const (
+	NodeHealthEventStatusActive   = "active"
+	NodeHealthEventStatusResolved = "resolved"
+	NodeHealthSeverityInfo        = "info"
+	NodeHealthSeverityWarning     = "warning"
+	NodeHealthSeverityCritical    = "critical"
+	nodeAccessLogRetentionWindow  = 24 * time.Hour
+)
+
+type AgentNodeSystemProfile struct {
+	Hostname         string `json:"hostname"`
+	OSName           string `json:"os_name"`
+	OSVersion        string `json:"os_version"`
+	KernelVersion    string `json:"kernel_version"`
+	Architecture     string `json:"architecture"`
+	CPUModel         string `json:"cpu_model"`
+	CPUCores         int    `json:"cpu_cores"`
+	TotalMemoryBytes int64  `json:"total_memory_bytes"`
+	TotalDiskBytes   int64  `json:"total_disk_bytes"`
+	UptimeSeconds    int64  `json:"uptime_seconds"`
+	ReportedAtUnix   int64  `json:"reported_at_unix"`
+}
+
+type AgentNodeMetricSnapshot struct {
+	CapturedAtUnix       int64   `json:"captured_at_unix"`
+	CPUUsagePercent      float64 `json:"cpu_usage_percent"`
+	MemoryUsedBytes      int64   `json:"memory_used_bytes"`
+	MemoryTotalBytes     int64   `json:"memory_total_bytes"`
+	StorageUsedBytes     int64   `json:"storage_used_bytes"`
+	StorageTotalBytes    int64   `json:"storage_total_bytes"`
+	DiskReadBytes        int64   `json:"disk_read_bytes"`
+	DiskWriteBytes       int64   `json:"disk_write_bytes"`
+	NetworkRxBytes       int64   `json:"network_rx_bytes"`
+	NetworkTxBytes       int64   `json:"network_tx_bytes"`
+	OpenrestyRxBytes     int64   `json:"openresty_rx_bytes"`
+	OpenrestyTxBytes     int64   `json:"openresty_tx_bytes"`
+	OpenrestyConnections int64   `json:"openresty_connections"`
+}
+
+type AgentNodeTrafficReport struct {
+	WindowStartedAtUnix int64            `json:"window_started_at_unix"`
+	WindowEndedAtUnix   int64            `json:"window_ended_at_unix"`
+	RequestCount        int64            `json:"request_count"`
+	ErrorCount          int64            `json:"error_count"`
+	UniqueVisitorCount  int64            `json:"unique_visitor_count"`
+	StatusCodes         map[string]int64 `json:"status_codes"`
+	TopDomains          map[string]int64 `json:"top_domains"`
+	SourceCountries     map[string]int64 `json:"source_countries"`
+}
+
+type AgentNodeAccessLog struct {
+	LoggedAtUnix int64  `json:"logged_at_unix"`
+	RemoteAddr   string `json:"remote_addr"`
+	Host         string `json:"host"`
+	Path         string `json:"path"`
+	StatusCode   int    `json:"status_code"`
+}
+
+type AgentBufferedObservabilityRecord struct {
+	WindowStartedAtUnix int64                    `json:"window_started_at_unix"`
+	Snapshot            *AgentNodeMetricSnapshot `json:"snapshot,omitempty"`
+	TrafficReport       *AgentNodeTrafficReport  `json:"traffic_report,omitempty"`
+	AccessLogs          []AgentNodeAccessLog     `json:"access_logs,omitempty"`
+}
+
+type AgentNodeHealthEvent struct {
+	EventType       string            `json:"event_type"`
+	Severity        string            `json:"severity"`
+	Message         string            `json:"message"`
+	TriggeredAtUnix int64             `json:"triggered_at_unix"`
+	Metadata        map[string]string `json:"metadata"`
+}
+
+func persistHeartbeatObservability(nodeID string, payload AgentNodePayload, reportedAt time.Time) {
+	if strings.TrimSpace(nodeID) == "" {
+		return
+	}
+	if payload.Profile == nil && payload.Snapshot == nil && payload.TrafficReport == nil && len(payload.AccessLogs) == 0 && len(payload.BufferedObservability) == 0 && payload.HealthEvents == nil {
+		return
+	}
+
+	if err := model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := persistNodeSystemProfile(tx, nodeID, payload.Profile, reportedAt); err != nil {
+			return err
+		}
+		if err := persistBufferedObservability(tx, nodeID, payload.BufferedObservability, reportedAt); err != nil {
+			return err
+		}
+		if err := persistNodeMetricSnapshot(tx, nodeID, payload.Snapshot, reportedAt); err != nil {
+			return err
+		}
+		if err := persistNodeTrafficReport(tx, nodeID, payload.TrafficReport, reportedAt); err != nil {
+			return err
+		}
+		if err := persistNodeAccessLogs(tx, nodeID, payload.AccessLogs, reportedAt); err != nil {
+			return err
+		}
+		if payload.HealthEvents != nil {
+			if err := reconcileNodeHealthEvents(tx, nodeID, payload.HealthEvents, reportedAt); err != nil {
+				return err
+			}
+		}
+		return nil
+	}); err != nil {
+		slog.Error("persist heartbeat observability failed", "node_id", nodeID, "error", err)
+	}
+}
+
+func persistBufferedObservability(tx *gorm.DB, nodeID string, records []AgentBufferedObservabilityRecord, reportedAt time.Time) error {
+	for _, record := range records {
+		if err := persistNodeMetricSnapshot(tx, nodeID, record.Snapshot, reportedAt); err != nil {
+			return err
+		}
+		if err := persistNodeTrafficReport(tx, nodeID, record.TrafficReport, reportedAt); err != nil {
+			return err
+		}
+		if err := persistNodeAccessLogs(tx, nodeID, record.AccessLogs, reportedAt); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func persistNodeSystemProfile(tx *gorm.DB, nodeID string, profile *AgentNodeSystemProfile, reportedAt time.Time) error {
+	if profile == nil {
+		return nil
+	}
+	record := &model.NodeSystemProfile{
+		NodeID:           nodeID,
+		Hostname:         strings.TrimSpace(profile.Hostname),
+		OSName:           strings.TrimSpace(profile.OSName),
+		OSVersion:        strings.TrimSpace(profile.OSVersion),
+		KernelVersion:    strings.TrimSpace(profile.KernelVersion),
+		Architecture:     strings.TrimSpace(profile.Architecture),
+		CPUModel:         strings.TrimSpace(profile.CPUModel),
+		CPUCores:         profile.CPUCores,
+		TotalMemoryBytes: profile.TotalMemoryBytes,
+		TotalDiskBytes:   profile.TotalDiskBytes,
+		UptimeSeconds:    profile.UptimeSeconds,
+		ReportedAt:       timeFromUnix(profile.ReportedAtUnix, reportedAt),
+		RawJSON:          marshalJSON(profile),
+	}
+	return tx.Model(&model.NodeSystemProfile{}).Where("node_id = ?", nodeID).Assign(record).FirstOrCreate(record).Error
+}
+
+func persistNodeMetricSnapshot(tx *gorm.DB, nodeID string, snapshot *AgentNodeMetricSnapshot, reportedAt time.Time) error {
+	if snapshot == nil {
+		return nil
+	}
+	record := &model.NodeMetricSnapshot{
+		NodeID:               nodeID,
+		CapturedAt:           timeFromUnix(snapshot.CapturedAtUnix, reportedAt),
+		CPUUsagePercent:      snapshot.CPUUsagePercent,
+		MemoryUsedBytes:      snapshot.MemoryUsedBytes,
+		MemoryTotalBytes:     snapshot.MemoryTotalBytes,
+		StorageUsedBytes:     snapshot.StorageUsedBytes,
+		StorageTotalBytes:    snapshot.StorageTotalBytes,
+		DiskReadBytes:        snapshot.DiskReadBytes,
+		DiskWriteBytes:       snapshot.DiskWriteBytes,
+		NetworkRxBytes:       snapshot.NetworkRxBytes,
+		NetworkTxBytes:       snapshot.NetworkTxBytes,
+		OpenrestyRxBytes:     snapshot.OpenrestyRxBytes,
+		OpenrestyTxBytes:     snapshot.OpenrestyTxBytes,
+		OpenrestyConnections: snapshot.OpenrestyConnections,
+		RawJSON:              marshalJSON(snapshot),
+	}
+	return tx.Where("node_id = ? AND captured_at = ?", nodeID, record.CapturedAt).Assign(record).FirstOrCreate(record).Error
+}
+
+func persistNodeTrafficReport(tx *gorm.DB, nodeID string, report *AgentNodeTrafficReport, reportedAt time.Time) error {
+	if report == nil {
+		return nil
+	}
+	if report.WindowEndedAtUnix > 0 && report.WindowStartedAtUnix > report.WindowEndedAtUnix {
+		return errors.New("traffic report window_started_at_unix 不能大于 window_ended_at_unix")
+	}
+	record := &model.NodeRequestReport{
+		NodeID:              nodeID,
+		WindowStartedAt:     timeFromUnix(report.WindowStartedAtUnix, reportedAt),
+		WindowEndedAt:       timeFromUnix(report.WindowEndedAtUnix, reportedAt),
+		RequestCount:        report.RequestCount,
+		ErrorCount:          report.ErrorCount,
+		UniqueVisitorCount:  report.UniqueVisitorCount,
+		StatusCodesJSON:     marshalJSON(report.StatusCodes),
+		TopDomainsJSON:      marshalJSON(report.TopDomains),
+		SourceCountriesJSON: marshalJSON(report.SourceCountries),
+		RawJSON:             marshalJSON(report),
+	}
+	return tx.Where("node_id = ? AND window_started_at = ? AND window_ended_at = ?", nodeID, record.WindowStartedAt, record.WindowEndedAt).Assign(record).FirstOrCreate(record).Error
+}
+
+func persistNodeAccessLogs(tx *gorm.DB, nodeID string, logs []AgentNodeAccessLog, reportedAt time.Time) error {
+	if len(logs) == 0 {
+		return nil
+	}
+	resolver, err := newAccessLogRegionResolver()
+	if err != nil {
+		slog.Warn("initialize access log geo resolver failed", "node_id", nodeID, "error", err)
+	}
+	if resolver != nil {
+		defer resolver.Close()
+	}
+	for _, item := range logs {
+		record := &model.NodeAccessLog{
+			NodeID:     nodeID,
+			LoggedAt:   timeFromUnix(item.LoggedAtUnix, reportedAt),
+			RemoteAddr: strings.TrimSpace(item.RemoteAddr),
+			Region:     "",
+			Host:       strings.TrimSpace(item.Host),
+			Path:       strings.TrimSpace(item.Path),
+			StatusCode: item.StatusCode,
+			RawJSON:    marshalJSON(item),
+		}
+		if resolver != nil {
+			record.Region = resolver.Resolve(record.RemoteAddr)
+		}
+		if err := tx.Where(
+			"node_id = ? AND logged_at = ? AND remote_addr = ? AND host = ? AND path = ? AND status_code = ?",
+			nodeID,
+			record.LoggedAt,
+			record.RemoteAddr,
+			record.Host,
+			record.Path,
+			record.StatusCode,
+		).Assign(record).FirstOrCreate(record).Error; err != nil {
+			return err
+		}
+	}
+	return tx.Where("node_id = ? AND logged_at < ?", nodeID, reportedAt.Add(-nodeAccessLogRetentionWindow)).Delete(&model.NodeAccessLog{}).Error
+}
+
+func reconcileNodeHealthEvents(tx *gorm.DB, nodeID string, events []AgentNodeHealthEvent, reportedAt time.Time) error {
+	activeTypes := make(map[string]AgentNodeHealthEvent, len(events))
+	for _, event := range events {
+		eventType := normalizeHealthEventType(event.EventType)
+		if eventType == "" {
+			continue
+		}
+		event.EventType = eventType
+		event.Severity = normalizeHealthSeverity(event.Severity)
+		if event.TriggeredAtUnix <= 0 {
+			event.TriggeredAtUnix = reportedAt.Unix()
+		}
+		activeTypes[eventType] = event
+	}
+
+	var activeEvents []*model.NodeHealthEvent
+	if err := tx.Where("node_id = ? AND status = ?", nodeID, NodeHealthEventStatusActive).Find(&activeEvents).Error; err != nil {
+		return err
+	}
+
+	activeByType := make(map[string]*model.NodeHealthEvent, len(activeEvents))
+	for _, event := range activeEvents {
+		activeByType[event.EventType] = event
+	}
+
+	for eventType, event := range activeTypes {
+		triggeredAt := timeFromUnix(event.TriggeredAtUnix, reportedAt)
+		if existing, ok := activeByType[eventType]; ok {
+			existing.Severity = event.Severity
+			existing.Message = strings.TrimSpace(event.Message)
+			existing.LastTriggeredAt = triggeredAt
+			existing.ReportedAt = reportedAt
+			existing.RawJSON = marshalJSON(event)
+			existing.ResolvedAt = nil
+			if err := tx.Save(existing).Error; err != nil {
+				return err
+			}
+			continue
+		}
+		record := &model.NodeHealthEvent{
+			NodeID:           nodeID,
+			EventType:        eventType,
+			Severity:         event.Severity,
+			Status:           NodeHealthEventStatusActive,
+			Message:          strings.TrimSpace(event.Message),
+			FirstTriggeredAt: triggeredAt,
+			LastTriggeredAt:  triggeredAt,
+			ReportedAt:       reportedAt,
+			RawJSON:          marshalJSON(event),
+		}
+		if err := tx.Create(record).Error; err != nil {
+			return err
+		}
+	}
+
+	for _, existing := range activeEvents {
+		if _, ok := activeTypes[existing.EventType]; ok {
+			continue
+		}
+		resolvedAt := reportedAt
+		existing.Status = NodeHealthEventStatusResolved
+		existing.ReportedAt = reportedAt
+		existing.ResolvedAt = &resolvedAt
+		if err := tx.Save(existing).Error; err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func normalizeHealthEventType(eventType string) string {
+	eventType = strings.TrimSpace(strings.ToLower(eventType))
+	eventType = strings.ReplaceAll(eventType, " ", "_")
+	return eventType
+}
+
+func normalizeHealthSeverity(severity string) string {
+	switch strings.ToLower(strings.TrimSpace(severity)) {
+	case NodeHealthSeverityCritical:
+		return NodeHealthSeverityCritical
+	case NodeHealthSeverityInfo:
+		return NodeHealthSeverityInfo
+	default:
+		return NodeHealthSeverityWarning
+	}
+}
+
+func timeFromUnix(unixSeconds int64, fallback time.Time) time.Time {
+	if unixSeconds <= 0 {
+		return fallback
+	}
+	return time.Unix(unixSeconds, 0).UTC()
+}
+
+func marshalJSON(value any) string {
+	if value == nil {
+		return ""
+	}
+	raw, err := json.Marshal(value)
+	if err != nil {
+		return ""
+	}
+	return string(raw)
+}

openflare_server/service/observability_analytics.go

@@ -0,0 +1,172 @@
+package service
+
+import (
+	"encoding/json"
+	"openflare/model"
+	"sort"
+	"strings"
+	"time"
+)
+
+type DistributionItem struct {
+	Key   string `json:"key"`
+	Value int64  `json:"value"`
+}
+
+type TrafficDistributions struct {
+	StatusCodes     []DistributionItem `json:"status_codes"`
+	TopDomains      []DistributionItem `json:"top_domains"`
+	SourceCountries []DistributionItem `json:"source_countries"`
+}
+
+type TrafficWindowSummary struct {
+	WindowStartedAt    time.Time `json:"window_started_at"`
+	WindowEndedAt      time.Time `json:"window_ended_at"`
+	RequestCount       int64     `json:"request_count"`
+	UniqueVisitorCount int64     `json:"unique_visitor_count"`
+	ErrorCount         int64     `json:"error_count"`
+	EstimatedQPS       float64   `json:"estimated_qps"`
+	ErrorRatePercent   float64   `json:"error_rate_percent"`
+}
+
+type ObservabilityHealthSummary struct {
+	ActiveAlerts    int  `json:"active_alerts"`
+	CriticalAlerts  int  `json:"critical_alerts"`
+	WarningAlerts   int  `json:"warning_alerts"`
+	InfoAlerts      int  `json:"info_alerts"`
+	ResolvedAlerts  int  `json:"resolved_alerts"`
+	HasCapacityRisk bool `json:"has_capacity_risk"`
+	HasTrafficRisk  bool `json:"has_traffic_risk"`
+	HasRuntimeRisk  bool `json:"has_runtime_risk"`
+}
+
+type distributionAccumulator map[string]int64
+
+func buildTrafficWindowSummary(report *model.NodeRequestReport) TrafficWindowSummary {
+	if report == nil {
+		return TrafficWindowSummary{}
+	}
+	summary := TrafficWindowSummary{
+		WindowStartedAt:    report.WindowStartedAt,
+		WindowEndedAt:      report.WindowEndedAt,
+		RequestCount:       report.RequestCount,
+		UniqueVisitorCount: report.UniqueVisitorCount,
+		ErrorCount:         report.ErrorCount,
+	}
+	if duration := report.WindowEndedAt.Sub(report.WindowStartedAt).Seconds(); duration > 0 {
+		summary.EstimatedQPS = float64(report.RequestCount) / duration
+	}
+	if report.RequestCount > 0 {
+		summary.ErrorRatePercent = (float64(report.ErrorCount) / float64(report.RequestCount)) * 100
+	}
+	return summary
+}
+
+func buildTrafficDistributions(
+	reports []*model.NodeRequestReport,
+	accessLogRegions []*model.NodeAccessLogRegionCount,
+	limit int,
+) TrafficDistributions {
+	statusCodes := make(distributionAccumulator)
+	topDomains := make(distributionAccumulator)
+	reportSourceCountries := make(distributionAccumulator)
+	for _, report := range reports {
+		mergeJSONCounts(statusCodes, report.StatusCodesJSON)
+		mergeJSONCounts(topDomains, report.TopDomainsJSON)
+		mergeJSONCounts(reportSourceCountries, report.SourceCountriesJSON)
+	}
+	sourceCountries := reportSourceCountries
+	if len(accessLogRegions) > 0 {
+		sourceCountries = make(distributionAccumulator, len(accessLogRegions))
+		for _, item := range accessLogRegions {
+			if item == nil || strings.TrimSpace(item.Region) == "" || item.Count <= 0 {
+				continue
+			}
+			sourceCountries[item.Region] = item.Count
+		}
+	}
+	return TrafficDistributions{
+		StatusCodes:     toDistributionItems(statusCodes, limit),
+		TopDomains:      toDistributionItems(topDomains, limit),
+		SourceCountries: toDistributionItems(sourceCountries, limit),
+	}
+}
+
+func buildObservabilityHealthSummary(snapshot *model.NodeMetricSnapshot, report *model.NodeRequestReport, events []*model.NodeHealthEvent) ObservabilityHealthSummary {
+	summary := ObservabilityHealthSummary{}
+	for _, event := range events {
+		if event == nil {
+			continue
+		}
+		if event.Status == NodeHealthEventStatusResolved {
+			summary.ResolvedAlerts++
+			continue
+		}
+		summary.ActiveAlerts++
+		switch event.Severity {
+		case NodeHealthSeverityCritical:
+			summary.CriticalAlerts++
+		case NodeHealthSeverityWarning:
+			summary.WarningAlerts++
+		default:
+			summary.InfoAlerts++
+		}
+	}
+	if snapshot != nil {
+		memoryUsage := percentage(snapshot.MemoryUsedBytes, snapshot.MemoryTotalBytes)
+		storageUsage := percentage(snapshot.StorageUsedBytes, snapshot.StorageTotalBytes)
+		summary.HasCapacityRisk = snapshot.CPUUsagePercent >= 80 || memoryUsage >= 85 || storageUsage >= 85
+	}
+	if report != nil && report.RequestCount >= 100 {
+		summary.HasTrafficRisk = (float64(report.ErrorCount) / float64(report.RequestCount)) >= 0.05
+	}
+	summary.HasRuntimeRisk = summary.ActiveAlerts > 0 || summary.HasCapacityRisk || summary.HasTrafficRisk
+	return summary
+}
+
+func mergeJSONCounts(target distributionAccumulator, raw string) {
+	if len(target) == 0 && strings.TrimSpace(raw) == "" {
+		return
+	}
+	values := parseJSONCounts(raw)
+	for key, value := range values {
+		if strings.TrimSpace(key) == "" || value <= 0 {
+			continue
+		}
+		target[key] += value
+	}
+}
+
+func parseJSONCounts(raw string) map[string]int64 {
+	if strings.TrimSpace(raw) == "" {
+		return nil
+	}
+	values := make(map[string]int64)
+	if err := json.Unmarshal([]byte(raw), &values); err != nil {
+		return nil
+	}
+	return values
+}
+
+func toDistributionItems(values distributionAccumulator, limit int) []DistributionItem {
+	if len(values) == 0 {
+		return []DistributionItem{}
+	}
+	items := make([]DistributionItem, 0, len(values))
+	for key, value := range values {
+		if strings.TrimSpace(key) == "" || value <= 0 {
+			continue
+		}
+		items = append(items, DistributionItem{Key: key, Value: value})
+	}
+	sort.Slice(items, func(i int, j int) bool {
+		if items[i].Value == items[j].Value {
+			return items[i].Key < items[j].Key
+		}
+		return items[i].Value > items[j].Value
+	})
+	if limit > 0 && len(items) > limit {
+		items = items[:limit]
+	}
+	return items
+}

openflare_server/service/observability_trends.go

@@ -0,0 +1,225 @@
+package service
+
+import (
+	"openflare/model"
+	"sort"
+	"time"
+)
+
+const observabilityTrendBuckets = 24
+
+type TrafficTrendPoint struct {
+	BucketStartedAt    time.Time `json:"bucket_started_at"`
+	RequestCount       int64     `json:"request_count"`
+	ErrorCount         int64     `json:"error_count"`
+	UniqueVisitorCount int64     `json:"unique_visitor_count"`
+}
+
+type CapacityTrendPoint struct {
+	BucketStartedAt           time.Time `json:"bucket_started_at"`
+	AverageCPUUsagePercent    float64   `json:"average_cpu_usage_percent"`
+	AverageMemoryUsagePercent float64   `json:"average_memory_usage_percent"`
+	ReportedNodes             int       `json:"reported_nodes"`
+}
+
+type NetworkTrendPoint struct {
+	BucketStartedAt  time.Time `json:"bucket_started_at"`
+	NetworkRxBytes   int64     `json:"network_rx_bytes"`
+	NetworkTxBytes   int64     `json:"network_tx_bytes"`
+	OpenrestyRxBytes int64     `json:"openresty_rx_bytes"`
+	OpenrestyTxBytes int64     `json:"openresty_tx_bytes"`
+	ReportedNodes    int       `json:"reported_nodes"`
+}
+
+type DiskIOTrendPoint struct {
+	BucketStartedAt time.Time `json:"bucket_started_at"`
+	DiskReadBytes   int64     `json:"disk_read_bytes"`
+	DiskWriteBytes  int64     `json:"disk_write_bytes"`
+	ReportedNodes   int       `json:"reported_nodes"`
+}
+
+type capacityTrendAccumulator struct {
+	cpuSum   float64
+	cpuCount int
+	memSum   float64
+	memCount int
+	nodes    map[string]struct{}
+}
+
+type snapshotTrendAccumulator struct {
+	nodes map[string]struct{}
+}
+
+func buildTrafficTrendPoints(now time.Time, reports []*model.NodeRequestReport) []TrafficTrendPoint {
+	start := trendWindowStart(now)
+	points := make([]TrafficTrendPoint, observabilityTrendBuckets)
+	for index := range points {
+		points[index].BucketStartedAt = start.Add(time.Duration(index) * time.Hour)
+	}
+
+	for _, report := range reports {
+		index, ok := trendBucketIndex(report.WindowEndedAt, start)
+		if !ok {
+			continue
+		}
+		points[index].RequestCount += report.RequestCount
+		points[index].ErrorCount += report.ErrorCount
+		points[index].UniqueVisitorCount += report.UniqueVisitorCount
+	}
+
+	return points
+}
+
+func buildCapacityTrendPoints(now time.Time, snapshots []*model.NodeMetricSnapshot) []CapacityTrendPoint {
+	start := trendWindowStart(now)
+	points := make([]CapacityTrendPoint, observabilityTrendBuckets)
+	accumulators := make([]capacityTrendAccumulator, observabilityTrendBuckets)
+	for index := range points {
+		points[index].BucketStartedAt = start.Add(time.Duration(index) * time.Hour)
+		accumulators[index].nodes = make(map[string]struct{})
+	}
+
+	for _, snapshot := range snapshots {
+		index, ok := trendBucketIndex(snapshot.CapturedAt, start)
+		if !ok {
+			continue
+		}
+		if snapshot.CPUUsagePercent > 0 {
+			accumulators[index].cpuSum += snapshot.CPUUsagePercent
+			accumulators[index].cpuCount++
+		}
+		if memoryUsage := percentage(snapshot.MemoryUsedBytes, snapshot.MemoryTotalBytes); memoryUsage > 0 {
+			accumulators[index].memSum += memoryUsage
+			accumulators[index].memCount++
+		}
+		if snapshot.NodeID != "" {
+			accumulators[index].nodes[snapshot.NodeID] = struct{}{}
+		}
+	}
+
+	for index := range points {
+		if accumulators[index].cpuCount > 0 {
+			points[index].AverageCPUUsagePercent = accumulators[index].cpuSum / float64(accumulators[index].cpuCount)
+		}
+		if accumulators[index].memCount > 0 {
+			points[index].AverageMemoryUsagePercent = accumulators[index].memSum / float64(accumulators[index].memCount)
+		}
+		points[index].ReportedNodes = len(accumulators[index].nodes)
+	}
+
+	return points
+}
+
+func buildNetworkTrendPoints(now time.Time, snapshots []*model.NodeMetricSnapshot) []NetworkTrendPoint {
+	start := trendWindowStart(now)
+	points := make([]NetworkTrendPoint, observabilityTrendBuckets)
+	accumulators := make([]snapshotTrendAccumulator, observabilityTrendBuckets)
+	for index := range points {
+		points[index].BucketStartedAt = start.Add(time.Duration(index) * time.Hour)
+		accumulators[index].nodes = make(map[string]struct{})
+	}
+
+	for _, snapshot := range snapshots {
+		index, ok := trendBucketIndex(snapshot.CapturedAt, start)
+		if !ok {
+			continue
+		}
+		points[index].NetworkRxBytes += snapshot.NetworkRxBytes
+		points[index].NetworkTxBytes += snapshot.NetworkTxBytes
+		points[index].OpenrestyRxBytes += snapshot.OpenrestyRxBytes
+		points[index].OpenrestyTxBytes += snapshot.OpenrestyTxBytes
+		if snapshot.NodeID != "" {
+			accumulators[index].nodes[snapshot.NodeID] = struct{}{}
+		}
+	}
+
+	for index := range points {
+		points[index].ReportedNodes = len(accumulators[index].nodes)
+	}
+
+	return points
+}
+
+func buildDiskIOTrendPoints(now time.Time, snapshots []*model.NodeMetricSnapshot) []DiskIOTrendPoint {
+	start := trendWindowStart(now)
+	points := make([]DiskIOTrendPoint, observabilityTrendBuckets)
+	accumulators := make([]snapshotTrendAccumulator, observabilityTrendBuckets)
+	for index := range points {
+		points[index].BucketStartedAt = start.Add(time.Duration(index) * time.Hour)
+		accumulators[index].nodes = make(map[string]struct{})
+	}
+
+	sort.Slice(snapshots, func(i int, j int) bool {
+		if snapshots[i].CapturedAt.Equal(snapshots[j].CapturedAt) {
+			return snapshots[i].NodeID < snapshots[j].NodeID
+		}
+		return snapshots[i].CapturedAt.Before(snapshots[j].CapturedAt)
+	})
+
+	type diskCounterState struct {
+		read  int64
+		write int64
+		seen  bool
+	}
+
+	previousByNode := make(map[string]diskCounterState, len(snapshots))
+
+	for _, snapshot := range snapshots {
+		nodeKey := snapshot.NodeID
+		if nodeKey == "" {
+			nodeKey = "__unknown__"
+		}
+
+		previous := previousByNode[nodeKey]
+		previousByNode[nodeKey] = diskCounterState{
+			read:  snapshot.DiskReadBytes,
+			write: snapshot.DiskWriteBytes,
+			seen:  true,
+		}
+		if !previous.seen {
+			continue
+		}
+
+		index, ok := trendBucketIndex(snapshot.CapturedAt, start)
+		if !ok {
+			continue
+		}
+
+		readDelta := snapshot.DiskReadBytes - previous.read
+		writeDelta := snapshot.DiskWriteBytes - previous.write
+		if readDelta < 0 {
+			readDelta = 0
+		}
+		if writeDelta < 0 {
+			writeDelta = 0
+		}
+
+		points[index].DiskReadBytes += readDelta
+		points[index].DiskWriteBytes += writeDelta
+		if snapshot.NodeID != "" {
+			accumulators[index].nodes[snapshot.NodeID] = struct{}{}
+		}
+	}
+
+	for index := range points {
+		points[index].ReportedNodes = len(accumulators[index].nodes)
+	}
+
+	return points
+}
+
+func trendWindowStart(now time.Time) time.Time {
+	return now.Truncate(time.Hour).Add(-(observabilityTrendBuckets - 1) * time.Hour)
+}
+
+func trendBucketIndex(timestamp time.Time, start time.Time) (int, bool) {
+	if timestamp.Before(start) {
+		return 0, false
+	}
+	delta := timestamp.Sub(start)
+	index := int(delta / time.Hour)
+	if index < 0 || index >= observabilityTrendBuckets {
+		return 0, false
+	}
+	return index, true
+}

openflare_server/service/observability_trends_test.go

@@ -0,0 +1,32 @@
+package service
+
+import (
+	"openflare/model"
+	"testing"
+	"time"
+)
+
+func TestBuildDiskIOTrendPointsUsesCounterDelta(t *testing.T) {
+	now := time.Date(2026, 3, 14, 18, 30, 0, 0, time.UTC)
+	start := trendWindowStart(now)
+
+	points := buildDiskIOTrendPoints(now, []*model.NodeMetricSnapshot{
+		{
+			NodeID:         "node-a",
+			CapturedAt:     start.Add(22 * time.Hour),
+			DiskReadBytes:  100,
+			DiskWriteBytes: 200,
+		},
+		{
+			NodeID:         "node-a",
+			CapturedAt:     start.Add(23 * time.Hour),
+			DiskReadBytes:  250,
+			DiskWriteBytes: 260,
+		},
+	})
+
+	last := points[len(points)-1]
+	if last.DiskReadBytes != 150 || last.DiskWriteBytes != 60 {
+		t.Fatalf("expected disk io trend to use counter delta, got %+v", last)
+	}
+}

openflare_server/service/openresty_observability_assets.go

@@ -0,0 +1,47 @@
+package service
+
+import "fmt"
+
+const (
+	openRestyObservabilityInitLuaPath = "init.lua"
+	openRestyObservabilityLogLuaPath  = "log.lua"
+	openRestyObservabilityReadLuaPath = "read.lua"
+)
+
+func renderOpenRestyObservabilityTemplateBlock() string {
+	return stringsJoinLines(
+		"    lua_shared_dict openflare_observability 10m;",
+		fmt.Sprintf("    init_worker_by_lua_file %s/%s;", nginxLuaDirPlaceholder, openRestyObservabilityInitLuaPath),
+		fmt.Sprintf("    log_by_lua_file %s/%s;", nginxLuaDirPlaceholder, openRestyObservabilityLogLuaPath),
+		"",
+		fmt.Sprintf("    server {"),
+		fmt.Sprintf("        listen %s;", nginxObservabilityListenPlaceholder),
+		"        server_name openflare-observability;",
+		"        access_log off;",
+		"",
+		"        location = /openflare/observability {",
+		"            default_type application/json;",
+		fmt.Sprintf("            content_by_lua_file %s/%s;", nginxLuaDirPlaceholder, openRestyObservabilityReadLuaPath),
+		"        }",
+		"",
+		"        location = /openflare/stub_status {",
+		"            stub_status;",
+		"        }",
+		"    }",
+		"",
+	)
+}
+
+func stringsJoinLines(lines ...string) string {
+	if len(lines) == 0 {
+		return ""
+	}
+	result := ""
+	for index, line := range lines {
+		if index > 0 {
+			result += "\n"
+		}
+		result += line
+	}
+	return result + "\n"
+}

openflare_server/service/proxy_route.go

@@ -0,0 +1,183 @@
+package service
+
+import (
+	"encoding/json"
+	"errors"
+	"net/url"
+	"openflare/model"
+	"regexp"
+	"strings"
+)
+
+var proxyHeaderKeyPattern = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
+
+type ProxyRouteCustomHeaderInput struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}
+
+type ProxyRouteInput struct {
+	Domain        string                        `json:"domain"`
+	OriginURL     string                        `json:"origin_url"`
+	Enabled       bool                          `json:"enabled"`
+	EnableHTTPS   bool                          `json:"enable_https"`
+	CertID        *uint                         `json:"cert_id"`
+	RedirectHTTP  bool                          `json:"redirect_http"`
+	CustomHeaders []ProxyRouteCustomHeaderInput `json:"custom_headers"`
+	Remark        string                        `json:"remark"`
+}
+
+func ListProxyRoutes() ([]*model.ProxyRoute, error) {
+	return model.ListProxyRoutes()
+}
+
+func CreateProxyRoute(input ProxyRouteInput) (*model.ProxyRoute, error) {
+	route, err := buildProxyRoute(nil, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = route.Insert(); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("域名已存在")
+		}
+		return nil, err
+	}
+	return route, nil
+}
+
+func UpdateProxyRoute(id uint, input ProxyRouteInput) (*model.ProxyRoute, error) {
+	route, err := model.GetProxyRouteByID(id)
+	if err != nil {
+		return nil, err
+	}
+	route, err = buildProxyRoute(route, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = route.Update(); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("域名已存在")
+		}
+		return nil, err
+	}
+	return route, nil
+}
+
+func DeleteProxyRoute(id uint) error {
+	route, err := model.GetProxyRouteByID(id)
+	if err != nil {
+		return err
+	}
+	return route.Delete()
+}
+
+func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.ProxyRoute, error) {
+	domain := strings.ToLower(strings.TrimSpace(input.Domain))
+	originURL := strings.TrimSpace(input.OriginURL)
+	remark := strings.TrimSpace(input.Remark)
+	customHeaders, err := normalizeCustomHeaders(input.CustomHeaders)
+	if err != nil {
+		return nil, err
+	}
+	customHeadersJSON, err := json.Marshal(customHeaders)
+	if err != nil {
+		return nil, err
+	}
+	if domain == "" {
+		return nil, errors.New("域名不能为空")
+	}
+	if strings.Contains(domain, "://") || strings.Contains(domain, "/") {
+		return nil, errors.New("域名格式不合法")
+	}
+	if err := validateOriginURL(originURL); err != nil {
+		return nil, err
+	}
+	if !input.EnableHTTPS {
+		input.RedirectHTTP = false
+		input.CertID = nil
+	}
+	if input.EnableHTTPS {
+		if input.CertID == nil || *input.CertID == 0 {
+			return nil, errors.New("启用 HTTPS 时必须选择证书")
+		}
+		if _, err := model.GetTLSCertificateByID(*input.CertID); err != nil {
+			return nil, errors.New("所选证书不存在")
+		}
+	}
+	if input.RedirectHTTP && !input.EnableHTTPS {
+		return nil, errors.New("仅启用 HTTPS 后才能开启 HTTP 重定向")
+	}
+	if route == nil {
+		route = &model.ProxyRoute{}
+	}
+	route.Domain = domain
+	route.OriginURL = originURL
+	route.Enabled = input.Enabled
+	route.EnableHTTPS = input.EnableHTTPS
+	route.CertID = input.CertID
+	route.RedirectHTTP = input.RedirectHTTP
+	route.CustomHeaders = string(customHeadersJSON)
+	route.Remark = remark
+	return route, nil
+}
+
+func normalizeCustomHeaders(headers []ProxyRouteCustomHeaderInput) ([]ProxyRouteCustomHeaderInput, error) {
+	if len(headers) == 0 {
+		return []ProxyRouteCustomHeaderInput{}, nil
+	}
+	normalized := make([]ProxyRouteCustomHeaderInput, 0, len(headers))
+	for _, header := range headers {
+		key := strings.TrimSpace(header.Key)
+		value := strings.TrimSpace(header.Value)
+		if key == "" && value == "" {
+			continue
+		}
+		if key == "" {
+			return nil, errors.New("自定义请求头名称不能为空")
+		}
+		if !proxyHeaderKeyPattern.MatchString(key) {
+			return nil, errors.New("自定义请求头名称格式不合法")
+		}
+		if strings.ContainsAny(key, "\r\n") || strings.ContainsAny(value, "\r\n") {
+			return nil, errors.New("自定义请求头不能包含换行")
+		}
+		normalized = append(normalized, ProxyRouteCustomHeaderInput{
+			Key:   key,
+			Value: value,
+		})
+	}
+	return normalized, nil
+}
+
+func decodeStoredCustomHeaders(raw string) ([]ProxyRouteCustomHeaderInput, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return []ProxyRouteCustomHeaderInput{}, nil
+	}
+	var headers []ProxyRouteCustomHeaderInput
+	if err := json.Unmarshal([]byte(text), &headers); err != nil {
+		return nil, errors.New("自定义请求头配置格式不合法")
+	}
+	return normalizeCustomHeaders(headers)
+}
+
+func validateOriginURL(raw string) error {
+	if raw == "" {
+		return errors.New("源站地址不能为空")
+	}
+	parsed, err := url.ParseRequestURI(raw)
+	if err != nil {
+		return errors.New("源站地址格式不合法")
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return errors.New("源站地址必须以 http:// 或 https:// 开头")
+	}
+	if parsed.Host == "" {
+		return errors.New("源站地址格式不合法")
+	}
+	return nil
+}
+
+func isUniqueConstraintError(err error) bool {
+	return err != nil && strings.Contains(strings.ToLower(err.Error()), "unique")
+}

openflare_server/service/tls_certificate.go

@@ -0,0 +1,150 @@
+package service
+
+import (
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"mime/multipart"
+	"openflare/model"
+	"strings"
+)
+
+type TLSCertificateInput struct {
+	Name    string `json:"name"`
+	CertPEM string `json:"cert_pem"`
+	KeyPEM  string `json:"key_pem"`
+	Remark  string `json:"remark"`
+}
+
+type TLSCertificateContent struct {
+	ID      uint   `json:"id"`
+	Name    string `json:"name"`
+	CertPEM string `json:"cert_pem"`
+	KeyPEM  string `json:"key_pem"`
+	Remark  string `json:"remark"`
+}
+
+func ListTLSCertificates() ([]*model.TLSCertificate, error) {
+	return model.ListTLSCertificates()
+}
+
+func GetTLSCertificate(id uint) (*model.TLSCertificate, error) {
+	return model.GetTLSCertificateByID(id)
+}
+
+func GetTLSCertificateContent(id uint) (*TLSCertificateContent, error) {
+	certificate, err := model.GetTLSCertificateByID(id)
+	if err != nil {
+		return nil, err
+	}
+
+	return &TLSCertificateContent{
+		ID:      certificate.ID,
+		Name:    certificate.Name,
+		CertPEM: certificate.CertPEM,
+		KeyPEM:  certificate.KeyPEM,
+		Remark:  certificate.Remark,
+	}, nil
+}
+
+func CreateTLSCertificate(input TLSCertificateInput) (*model.TLSCertificate, error) {
+	certificate, err := buildTLSCertificate(nil, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = certificate.Insert(); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("证书名称已存在")
+		}
+		return nil, err
+	}
+	return certificate, nil
+}
+
+func CreateTLSCertificateFromFiles(name string, certFile *multipart.FileHeader, keyFile *multipart.FileHeader, remark string) (*model.TLSCertificate, error) {
+	if certFile == nil || keyFile == nil {
+		return nil, errors.New("证书文件和私钥文件不能为空")
+	}
+	certContent, err := readMultipartFile(certFile)
+	if err != nil {
+		return nil, err
+	}
+	keyContent, err := readMultipartFile(keyFile)
+	if err != nil {
+		return nil, err
+	}
+	return CreateTLSCertificate(TLSCertificateInput{
+		Name:    name,
+		CertPEM: certContent,
+		KeyPEM:  keyContent,
+		Remark:  remark,
+	})
+}
+
+func UpdateTLSCertificate(id uint, input TLSCertificateInput) (*model.TLSCertificate, error) {
+	existing, err := model.GetTLSCertificateByID(id)
+	if err != nil {
+		return nil, err
+	}
+
+	certificate, err := buildTLSCertificate(existing, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = certificate.Update(); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("certificate name already exists")
+		}
+		return nil, err
+	}
+	return certificate, nil
+}
+
+func DeleteTLSCertificate(id uint) error {
+	var routeCount int64
+	if err := model.DB.Model(&model.ProxyRoute{}).Where("cert_id = ?", id).Count(&routeCount).Error; err != nil {
+		return err
+	}
+	if routeCount > 0 {
+		return errors.New("证书仍被反代规则引用，无法删除")
+	}
+	certificate, err := model.GetTLSCertificateByID(id)
+	if err != nil {
+		return err
+	}
+	return certificate.Delete()
+}
+
+func buildTLSCertificate(existing *model.TLSCertificate, input TLSCertificateInput) (*model.TLSCertificate, error) {
+	name := strings.TrimSpace(input.Name)
+	certPEM := strings.TrimSpace(input.CertPEM)
+	keyPEM := strings.TrimSpace(input.KeyPEM)
+	remark := strings.TrimSpace(input.Remark)
+	if name == "" {
+		return nil, errors.New("证书名称不能为空")
+	}
+	if certPEM == "" || keyPEM == "" {
+		return nil, errors.New("证书内容和私钥内容不能为空")
+	}
+	parsed, err := tls.X509KeyPair([]byte(certPEM), []byte(keyPEM))
+	if err != nil {
+		return nil, fmt.Errorf("证书或私钥格式不合法: %w", err)
+	}
+	if len(parsed.Certificate) == 0 {
+		return nil, errors.New("证书内容不合法")
+	}
+	leaf, err := parseLeafCertificate(certPEM)
+	if err != nil {
+		return nil, err
+	}
+	if existing == nil {
+		existing = &model.TLSCertificate{}
+	}
+	existing.Name = name
+	existing.CertPEM = certPEM
+	existing.KeyPEM = keyPEM
+	existing.NotBefore = leaf.NotBefore
+	existing.NotAfter = leaf.NotAfter
+	existing.Remark = remark
+	return existing, nil
+}

openflare_server/service/tls_certificate_helpers.go

@@ -0,0 +1,34 @@
+package service
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"io"
+	"mime/multipart"
+)
+
+func parseLeafCertificate(certPEM string) (*x509.Certificate, error) {
+	certPEMBlock, _ := pem.Decode([]byte(certPEM))
+	if certPEMBlock == nil {
+		return nil, errors.New("证书 PEM 内容不合法")
+	}
+	leaf, err := x509.ParseCertificate(certPEMBlock.Bytes)
+	if err != nil {
+		return nil, err
+	}
+	return leaf, nil
+}
+
+func readMultipartFile(fileHeader *multipart.FileHeader) (string, error) {
+	file, err := fileHeader.Open()
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}

openflare_server/service/update_restart_unix.go

@@ -0,0 +1,73 @@
+//go:build !windows
+
+package service
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"syscall"
+)
+
+var unixRename = os.Rename
+
+func replaceAndRestartServer(execPath string, tmpPath string) error {
+	backupPath := execPath + ".bak"
+	_ = os.Remove(backupPath)
+	if err := unixRename(execPath, backupPath); err != nil {
+		_ = os.Remove(tmpPath)
+		return fmt.Errorf("备份当前服务端二进制失败: %w", err)
+	}
+	if err := replaceFileUnix(tmpPath, execPath); err != nil {
+		_ = unixRename(backupPath, execPath)
+		return fmt.Errorf("替换服务端二进制失败: %w", err)
+	}
+	_ = os.Remove(backupPath)
+	if err := syscall.Exec(execPath, os.Args, os.Environ()); err != nil {
+		return fmt.Errorf("重启服务失败: %w", err)
+	}
+	return fmt.Errorf("unreachable after exec")
+}
+
+func replaceFileUnix(srcPath string, dstPath string) error {
+	if err := unixRename(srcPath, dstPath); err == nil {
+		return nil
+	} else if linkErr, ok := err.(*os.LinkError); !ok || linkErr.Err != syscall.EXDEV {
+		return err
+	}
+
+	sourceFile, err := os.Open(srcPath)
+	if err != nil {
+		return err
+	}
+	defer sourceFile.Close()
+
+	info, err := sourceFile.Stat()
+	if err != nil {
+		return err
+	}
+
+	destinationFile, err := os.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode().Perm())
+	if err != nil {
+		return err
+	}
+
+	copyErr := func() error {
+		defer destinationFile.Close()
+		if _, err = io.Copy(destinationFile, sourceFile); err != nil {
+			return err
+		}
+		if err = destinationFile.Sync(); err != nil {
+			return err
+		}
+		return nil
+	}()
+	if copyErr != nil {
+		return copyErr
+	}
+
+	if err = os.Chmod(dstPath, info.Mode().Perm()); err != nil {
+		return err
+	}
+	return os.Remove(srcPath)
+}

openflare_server/service/update_restart_unix_test.go

@@ -0,0 +1,50 @@
+//go:build !windows
+
+package service
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestReplaceFileUnixFallsBackOnCrossDeviceRename(t *testing.T) {
+	tempDir := t.TempDir()
+	srcPath := filepath.Join(tempDir, "source.bin")
+	dstPath := filepath.Join(tempDir, "target.bin")
+
+	if err := os.WriteFile(srcPath, []byte("new-binary"), 0o755); err != nil {
+		t.Fatalf("failed to write source file: %v", err)
+	}
+	if err := os.WriteFile(dstPath, []byte("old-binary"), 0o755); err != nil {
+		t.Fatalf("failed to write target file: %v", err)
+	}
+
+	originalRename := unixRename
+	unixRename = func(oldPath string, newPath string) error {
+		if oldPath == srcPath && newPath == dstPath {
+			return &os.LinkError{Op: "rename", Old: oldPath, New: newPath, Err: syscall.EXDEV}
+		}
+		return os.Rename(oldPath, newPath)
+	}
+	t.Cleanup(func() {
+		unixRename = originalRename
+	})
+
+	if err := replaceFileUnix(srcPath, dstPath); err != nil {
+		t.Fatalf("expected cross-device fallback to succeed: %v", err)
+	}
+
+	content, err := os.ReadFile(dstPath)
+	if err != nil {
+		t.Fatalf("failed to read target file: %v", err)
+	}
+	if string(content) != "new-binary" {
+		t.Fatalf("unexpected target content: %s", string(content))
+	}
+	if _, err = os.Stat(srcPath); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("expected source file to be removed, got err=%v", err)
+	}
+}

openflare_server/service/update_restart_windows.go

@@ -0,0 +1,55 @@
+//go:build windows
+
+package service
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+func replaceAndRestartServer(execPath string, tmpPath string) error {
+	backupPath := execPath + ".bak"
+	scriptPath := execPath + ".update.cmd"
+	script := fmt.Sprintf(`@echo off
+setlocal
+:waitloop
+move /Y "%s" "%s" >nul 2>nul
+if errorlevel 1 (
+  ping 127.0.0.1 -n 2 >nul
+  goto waitloop
+)
+move /Y "%s" "%s" >nul 2>nul
+if errorlevel 1 exit /b 1
+start "" %s
+del /Q "%s" >nul 2>nul
+del /Q "%%~f0" >nul 2>nul
+`, execPath, backupPath, tmpPath, execPath, buildWindowsCommandLine(execPath, os.Args[1:]), backupPath)
+	if err := os.WriteFile(scriptPath, []byte(script), 0o700); err != nil {
+		_ = os.Remove(tmpPath)
+		return fmt.Errorf("写入升级重启脚本失败: %w", err)
+	}
+
+	cmd := exec.Command("cmd", "/C", "start", "", scriptPath)
+	if err := cmd.Start(); err != nil {
+		_ = os.Remove(scriptPath)
+		_ = os.Remove(tmpPath)
+		return fmt.Errorf("调度升级重启失败: %w", err)
+	}
+
+	os.Exit(0)
+	return nil
+}
+
+func buildWindowsCommandLine(execPath string, args []string) string {
+	parts := []string{quoteWindowsArg(execPath)}
+	for _, arg := range args {
+		parts = append(parts, quoteWindowsArg(arg))
+	}
+	return strings.Join(parts, " ")
+}
+
+func quoteWindowsArg(value string) string {
+	return `"` + strings.ReplaceAll(value, `"`, `""`) + `"`
+}

openflare_server/service/update_test.go

@@ -0,0 +1,414 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"openflare/common"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+)
+
+type serverUpdateRoundTripFunc func(req *http.Request) (*http.Response, error)
+
+func (f serverUpdateRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func resetServerUpgradeTestState(t *testing.T) {
+	t.Helper()
+	serverUpgradeState.Lock()
+	serverUpgradeState.inProgress = false
+	serverUpgradeState.status = ""
+	serverUpgradeState.logs = nil
+	serverUpgradeState.Unlock()
+	manualServerBinaryState.Lock()
+	cleanupManualServerBinaryCandidateLocked()
+	manualServerBinaryState.Unlock()
+}
+
+func fakeServerBinaryFixture(version string) (string, []byte) {
+	if runtime.GOOS == "windows" {
+		return "openflare-server-test.cmd", []byte("@echo off\r\necho " + version + "\r\n")
+	}
+	return "openflare-server-test.sh", []byte("#!/bin/sh\necho " + version + "\n")
+}
+
+func TestIsVersionNewer(t *testing.T) {
+	testCases := []struct {
+		name     string
+		current  string
+		latest   string
+		expected bool
+	}{
+		{name: "newer patch", current: "v1.2.3", latest: "v1.2.4", expected: true},
+		{name: "same version", current: "v1.2.3", latest: "v1.2.3", expected: false},
+		{name: "older remote", current: "v1.3.0", latest: "v1.2.9", expected: false},
+		{name: "double digit segment", current: "v1.9.9", latest: "v1.10.0", expected: true},
+		{name: "stable newer than prerelease", current: "v1.2.3-rc.1", latest: "v1.2.3", expected: true},
+		{name: "prerelease not newer than same stable", current: "v1.2.3", latest: "v1.2.3-rc.1", expected: false},
+		{name: "newer prerelease sequence", current: "v1.2.3-rc.1", latest: "v1.2.3-rc.2", expected: true},
+		{name: "git describe newer than same tag", current: "v0.6.3", latest: "v0.6.3-2-gf4d36be", expected: true},
+		{name: "git describe distance compares numerically", current: "v0.6.3-2-gf4d36be", latest: "v0.6.3-5-gabc1234", expected: true},
+		{name: "dev build", current: "dev", latest: "v0.4.0", expected: true},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			actual := isVersionNewer(testCase.current, testCase.latest)
+			if actual != testCase.expected {
+				t.Fatalf("unexpected compare result: current=%s latest=%s actual=%v expected=%v", testCase.current, testCase.latest, actual, testCase.expected)
+			}
+		})
+	}
+}
+
+func TestBuildLatestServerReleaseView(t *testing.T) {
+	originalVersion := common.Version
+	common.Version = "v0.4.0"
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		serverUpgradeState.Lock()
+		serverUpgradeState.inProgress = false
+		serverUpgradeState.Unlock()
+	})
+
+	serverUpgradeState.Lock()
+	serverUpgradeState.inProgress = true
+	serverUpgradeState.Unlock()
+
+	view := buildLatestServerReleaseView(&githubReleaseResponse{
+		TagName:     "v0.5.0",
+		Body:        "release notes",
+		HTMLURL:     "https://github.com/Rain-kl/OpenFlare/releases/tag/v0.5.0",
+		PublishedAt: "2026-03-11T00:00:00Z",
+	}, ReleaseChannelStable)
+
+	if view.CurrentVersion != "v0.4.0" {
+		t.Fatalf("unexpected current version: %s", view.CurrentVersion)
+	}
+	if !view.HasUpdate {
+		t.Fatal("expected has_update to be true")
+	}
+	if !view.InProgress {
+		t.Fatal("expected in_progress to reflect upgrade state")
+	}
+	if view.TagName != "v0.5.0" {
+		t.Fatalf("unexpected tag name: %s", view.TagName)
+	}
+	if view.Channel != ReleaseChannelStable.String() {
+		t.Fatalf("unexpected channel: %s", view.Channel)
+	}
+}
+
+func TestBuildLatestServerReleaseViewDevBuild(t *testing.T) {
+	originalVersion := common.Version
+	common.Version = "dev"
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		serverUpgradeState.Lock()
+		serverUpgradeState.inProgress = false
+		serverUpgradeState.Unlock()
+	})
+
+	view := buildLatestServerReleaseView(&githubReleaseResponse{
+		TagName: "v0.5.0",
+	}, ReleaseChannelStable)
+
+	if view.HasUpdate {
+		t.Fatal("expected dev build not to report update availability")
+	}
+	if view.UpgradeSupported {
+		t.Fatal("expected dev build not to support self-upgrade")
+	}
+}
+
+func TestBuildLatestServerReleaseViewPreview(t *testing.T) {
+	originalVersion := common.Version
+	common.Version = "v0.5.0-rc.1"
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		resetServerUpgradeTestState(t)
+	})
+
+	view := buildLatestServerReleaseView(&githubReleaseResponse{
+		TagName:     "v0.5.0-rc.2",
+		Prerelease:  true,
+		PublishedAt: "2026-03-12T00:00:00Z",
+	}, ReleaseChannelPreview)
+
+	if !view.HasUpdate {
+		t.Fatal("expected preview release to be newer")
+	}
+	if !view.Prerelease {
+		t.Fatal("expected preview flag to be true")
+	}
+	if view.Channel != ReleaseChannelPreview.String() {
+		t.Fatalf("unexpected channel: %s", view.Channel)
+	}
+}
+
+// TestBuildLatestServerReleaseViewPreviewBypassVersionCheck verifies that switching to
+// the preview channel always reports has_update=true, even when the preview tag uses a
+// "major.minor.patch-git-<commit>" scheme that would otherwise compare as equal-or-older
+// than the currently running stable version.
+func TestBuildLatestServerReleaseViewPreviewBypassVersionCheck(t *testing.T) {
+	originalVersion := common.Version
+	common.Version = "v1.0.0"
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		resetServerUpgradeTestState(t)
+	})
+
+	// A typical preview tag: same base version as stable but with a git-commit suffix.
+	// Without the bypass, isVersionNewer("v1.0.0", "v1.0.0-git-abc1234") returns false
+	// because a version without a prerelease identifier is considered higher than one
+	// with a prerelease identifier under semver rules.
+	view := buildLatestServerReleaseView(&githubReleaseResponse{
+		TagName:     "v1.0.0-git-abc1234",
+		Prerelease:  true,
+		PublishedAt: "2026-03-12T00:00:00Z",
+	}, ReleaseChannelPreview)
+
+	if !view.HasUpdate {
+		t.Fatal("expected preview channel to bypass version comparison and report has_update=true")
+	}
+	if view.Channel != ReleaseChannelPreview.String() {
+		t.Fatalf("unexpected channel: %s", view.Channel)
+	}
+}
+
+func TestUploadManualServerBinary(t *testing.T) {
+	originalVersion := common.Version
+	common.Version = "v0.4.0"
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		resetServerUpgradeTestState(t)
+	})
+
+	fileName, content := fakeServerBinaryFixture("v0.5.0")
+	info, err := UploadManualServerBinary(context.Background(), fileName, bytes.NewReader(content))
+	if err != nil {
+		t.Fatalf("expected upload to succeed: %v", err)
+	}
+	if !info.ReadyToUpgrade {
+		t.Fatal("expected uploaded binary to be ready for upgrade")
+	}
+	if info.UploadToken == "" {
+		t.Fatal("expected upload token to be returned")
+	}
+	if info.DetectedVersion != "v0.5.0" {
+		t.Fatalf("unexpected detected version: %s", info.DetectedVersion)
+	}
+
+	manualServerBinaryState.Lock()
+	candidate := manualServerBinaryState.candidate
+	manualServerBinaryState.Unlock()
+	if candidate == nil {
+		t.Fatal("expected manual upgrade candidate to be stored")
+	}
+	if _, err := os.Stat(candidate.TempPath); err != nil {
+		t.Fatalf("expected temporary binary to exist: %v", err)
+	}
+	if candidate.UploadToken != info.UploadToken {
+		t.Fatalf("unexpected stored upload token: %s", candidate.UploadToken)
+	}
+	execPath, err := os.Executable()
+	if err != nil {
+		t.Fatalf("failed to get executable path: %v", err)
+	}
+	if filepath.Dir(candidate.TempPath) != filepath.Dir(execPath) {
+		t.Fatalf("expected temporary binary in executable dir, got %s want %s", filepath.Dir(candidate.TempPath), filepath.Dir(execPath))
+	}
+}
+
+func TestBuildUploadedServerBinaryViewAcceptsGitDescribeNewerThanTag(t *testing.T) {
+	info := buildUploadedServerBinaryView("openflare-server-test", "v0.6.3", "v0.6.3-2-gf4d36be", time.Now())
+	if !info.HasUpdate || !info.ReadyToUpgrade {
+		t.Fatalf("expected git describe binary to be upgradeable: %+v", info)
+	}
+}
+
+func TestUploadManualServerBinaryRejectsSameVersion(t *testing.T) {
+	originalVersion := common.Version
+	common.Version = "v0.5.0"
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		resetServerUpgradeTestState(t)
+	})
+
+	fileName, content := fakeServerBinaryFixture("v0.5.0")
+	info, err := UploadManualServerBinary(context.Background(), fileName, bytes.NewReader(content))
+	if err != nil {
+		t.Fatalf("expected upload to succeed: %v", err)
+	}
+	if info.ReadyToUpgrade {
+		t.Fatal("expected same-version upload not to be upgradeable")
+	}
+	if info.UploadToken != "" {
+		t.Fatal("expected same-version upload not to issue a token")
+	}
+
+	manualServerBinaryState.Lock()
+	defer manualServerBinaryState.Unlock()
+	if manualServerBinaryState.candidate != nil {
+		t.Fatal("expected no pending manual upgrade candidate")
+	}
+}
+
+func TestConfirmManualServerUpgrade(t *testing.T) {
+	originalVersion := common.Version
+	originalExecutor := ServerBinaryUpgradeExecutorForTest()
+	originalDelay := ServerUpgradeDispatchDelayForTest()
+	common.Version = "v0.4.0"
+	called := make(chan string, 1)
+	SetServerBinaryUpgradeExecutorForTest(func(execPath string, tempPath string) error {
+		called <- tempPath
+		return nil
+	})
+	SetServerUpgradeDispatchDelayForTest(0)
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		SetServerBinaryUpgradeExecutorForTest(originalExecutor)
+		SetServerUpgradeDispatchDelayForTest(originalDelay)
+		resetServerUpgradeTestState(t)
+	})
+
+	fileName, content := fakeServerBinaryFixture("v0.5.0")
+	info, err := UploadManualServerBinary(context.Background(), fileName, bytes.NewReader(content))
+	if err != nil {
+		t.Fatalf("expected upload to succeed: %v", err)
+	}
+
+	confirmed, err := ConfirmManualServerUpgrade(info.UploadToken)
+	if err != nil {
+		t.Fatalf("expected confirm to succeed: %v", err)
+	}
+	if confirmed.UploadToken != info.UploadToken {
+		t.Fatalf("unexpected confirmed upload token: %s", confirmed.UploadToken)
+	}
+
+	select {
+	case tempPath := <-called:
+		if tempPath == "" {
+			t.Fatal("expected upgrade executor to receive temp path")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("expected manual upgrade executor to be called")
+	}
+}
+
+func TestBuildLatestServerReleaseViewIncludesUpgradeLogs(t *testing.T) {
+	originalVersion := common.Version
+	common.Version = "v0.4.0"
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		resetServerUpgradeTestState(t)
+	})
+
+	serverUpgradeState.Lock()
+	serverUpgradeState.inProgress = true
+	serverUpgradeState.status = "running"
+	serverUpgradeState.logs = []ServerUpgradeLogRecord{
+		{
+			Level:     "info",
+			Message:   "download started",
+			CreatedAt: time.Now(),
+		},
+	}
+	serverUpgradeState.Unlock()
+
+	view := buildLatestServerReleaseView(&githubReleaseResponse{
+		TagName: "v0.5.0",
+	}, ReleaseChannelStable)
+
+	if view.UpgradeStatus != "running" {
+		t.Fatalf("expected upgrade status to be running, got %s", view.UpgradeStatus)
+	}
+	if len(view.UpgradeLogs) != 1 {
+		t.Fatalf("expected one upgrade log, got %d", len(view.UpgradeLogs))
+	}
+	if view.UpgradeLogs[0].Message != "download started" {
+		t.Fatalf("unexpected upgrade log message: %s", view.UpgradeLogs[0].Message)
+	}
+}
+
+func TestScheduleServerUpgradeUsesDownloadedBinaryValidation(t *testing.T) {
+	originalVersion := common.Version
+	originalClient := UpdateHTTPClientForTest()
+	originalExecutor := ServerBinaryUpgradeExecutorForTest()
+	originalDelay := ServerUpgradeDispatchDelayForTest()
+	common.Version = "v0.4.0"
+	called := make(chan string, 1)
+
+	SetUpdateHTTPClientForTest(&http.Client{
+		Transport: serverUpdateRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+			switch req.URL.String() {
+			case "https://api.github.com/repos/Rain-kl/OpenFlare/releases/latest":
+				return &http.Response{
+					StatusCode: http.StatusOK,
+					Header:     make(http.Header),
+					Body: io.NopCloser(strings.NewReader(`{
+						"tag_name":"v0.5.0",
+						"body":"release notes",
+						"html_url":"https://github.com/Rain-kl/OpenFlare/releases/tag/v0.5.0",
+						"published_at":"2026-03-11T00:00:00Z",
+						"assets":[{"name":"openflare-server-` + runtime.GOOS + `-` + runtime.GOARCH + `","browser_download_url":"https://downloads.example.com/openflare-server"}]
+					}`)),
+				}, nil
+			case "https://downloads.example.com/openflare-server":
+				_, content := fakeServerBinaryFixture("v0.5.0")
+				return &http.Response{
+					StatusCode: http.StatusOK,
+					Header:     make(http.Header),
+					Body:       io.NopCloser(bytes.NewReader(content)),
+				}, nil
+			default:
+				t.Fatalf("unexpected request url: %s", req.URL.String())
+				return nil, nil
+			}
+		}),
+	})
+	SetServerBinaryUpgradeExecutorForTest(func(execPath string, tempPath string) error {
+		called <- tempPath
+		return nil
+	})
+	SetServerUpgradeDispatchDelayForTest(0)
+	t.Cleanup(func() {
+		common.Version = originalVersion
+		SetUpdateHTTPClientForTest(originalClient)
+		SetServerBinaryUpgradeExecutorForTest(originalExecutor)
+		SetServerUpgradeDispatchDelayForTest(originalDelay)
+		resetServerUpgradeTestState(t)
+	})
+
+	release, err := ScheduleServerUpgrade("stable")
+	if err != nil {
+		t.Fatalf("expected schedule to succeed: %v", err)
+	}
+	if !release.InProgress {
+		t.Fatal("expected release to report in-progress upgrade")
+	}
+
+	select {
+	case tempPath := <-called:
+		if tempPath == "" {
+			t.Fatal("expected upgrade executor to receive temp path")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("expected automatic upgrade executor to be called")
+	}
+
+	_, status, logs := snapshotServerUpgradeState()
+	if status != "succeeded" {
+		t.Fatalf("expected succeeded status after executor call, got %s", status)
+	}
+	if len(logs) == 0 {
+		t.Fatal("expected upgrade logs to be recorded")
+	}
+}

openflare_server/utils/browser.go

@@ -0,0 +1,23 @@
+package utils
+
+import (
+	"log/slog"
+	"os/exec"
+	"runtime"
+)
+
+func OpenBrowser(url string) {
+	var err error
+
+	switch runtime.GOOS {
+	case "linux":
+		err = exec.Command("xdg-open", url).Start()
+	case "windows":
+		err = exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
+	case "darwin":
+		err = exec.Command("open", url).Start()
+	}
+	if err != nil {
+		slog.Error("open browser failed", "error", err)
+	}
+}

openflare_server/utils/embedfs/static.go

@@ -0,0 +1,40 @@
+package embedfs
+
+import (
+	"embed"
+	"io/fs"
+	"net/http"
+	"strings"
+
+	"github.com/gin-contrib/static"
+)
+
+// Credit: https://github.com/gin-contrib/static/issues/19
+
+type fileSystem struct {
+	http.FileSystem
+}
+
+func (e fileSystem) Exists(prefix string, path string) bool {
+	cleanPath := strings.TrimPrefix(path, prefix)
+	cleanPath = strings.TrimPrefix(cleanPath, "/")
+	if cleanPath == "" {
+		return false
+	}
+
+	_, err := e.Open(cleanPath)
+	if err != nil {
+		return false
+	}
+	return true
+}
+
+func EmbedFolder(fsEmbed embed.FS, targetPath string) static.ServeFileSystem {
+	efs, err := fs.Sub(fsEmbed, targetPath)
+	if err != nil {
+		panic(err)
+	}
+	return fileSystem{
+		FileSystem: http.FS(efs),
+	}
+}

openflare_server/utils/format.go

@@ -0,0 +1,53 @@
+package utils
+
+import (
+	"fmt"
+	"strconv"
+)
+
+var sizeKB = 1024
+var sizeMB = sizeKB * 1024
+var sizeGB = sizeMB * 1024
+
+func Bytes2Size(num int64) string {
+	numStr := ""
+	unit := "B"
+	if num/int64(sizeGB) > 1 {
+		numStr = fmt.Sprintf("%.2f", float64(num)/float64(sizeGB))
+		unit = "GB"
+	} else if num/int64(sizeMB) > 1 {
+		numStr = fmt.Sprintf("%d", int(float64(num)/float64(sizeMB)))
+		unit = "MB"
+	} else if num/int64(sizeKB) > 1 {
+		numStr = fmt.Sprintf("%d", int(float64(num)/float64(sizeKB)))
+		unit = "KB"
+	} else {
+		numStr = fmt.Sprintf("%d", num)
+	}
+	return numStr + " " + unit
+}
+
+func Seconds2Time(num int) (time string) {
+	if num/31104000 > 0 {
+		time += strconv.Itoa(num/31104000) + " 年 "
+		num %= 31104000
+	}
+	if num/2592000 > 0 {
+		time += strconv.Itoa(num/2592000) + " 个月 "
+		num %= 2592000
+	}
+	if num/86400 > 0 {
+		time += strconv.Itoa(num/86400) + " 天 "
+		num %= 86400
+	}
+	if num/3600 > 0 {
+		time += strconv.Itoa(num/3600) + " 小时 "
+		num %= 3600
+	}
+	if num/60 > 0 {
+		time += strconv.Itoa(num/60) + " 分钟 "
+		num %= 60
+	}
+	time += strconv.Itoa(num) + " 秒"
+	return
+}

openflare_server/utils/geoip/emptyProvider.go

@@ -0,0 +1,25 @@
+package geoip
+
+import (
+	"fmt"
+	"net"
+)
+
+type EmptyProvider struct{}
+
+func (e *EmptyProvider) Name() string {
+	return "EmptyProvider"
+}
+
+func (e *EmptyProvider) Initialize() error {
+	return nil
+}
+func (e *EmptyProvider) GetGeoInfo(ip net.IP) (*GeoInfo, error) {
+	return nil, fmt.Errorf("you are using an empty GeoIP provider, please set a valid provider")
+}
+func (e *EmptyProvider) UpdateDatabase() error {
+	return fmt.Errorf("you are using an empty GeoIP provider, please set a valid provider")
+}
+func (e *EmptyProvider) Close() error {
+	return nil
+}

openflare_server/utils/geoip/geoip.go

@@ -0,0 +1,243 @@
+package geoip
+
+import (
+	"fmt"
+	"log/slog"
+	"net"
+	"openflare/common"
+	"strings"
+	"sync"
+	"time"
+	"unicode"
+
+	ristretto "github.com/dgraph-io/ristretto/v2"
+)
+
+var CurrentProvider GeoIPService
+var geoCache *providerCache
+var providerMutex sync.RWMutex
+var providerFactory = newProvider
+
+const (
+	ProviderDisabled = "disabled"
+	ProviderMaxMind  = "mmdb"
+	ProviderIPAPI    = "ip-api"
+	ProviderGeoJS    = "geojs"
+	ProviderIPInfo   = "ipinfo"
+)
+
+type GeoInfo struct {
+	ISOCode   string
+	Name      string
+	Latitude  *float64
+	Longitude *float64
+}
+
+func init() {
+	CurrentProvider = &EmptyProvider{}
+	geoCache = newProviderCache(48 * time.Hour)
+}
+
+// GeoIPService 接口定义了获取地理位置信息的核心方法。
+type GeoIPService interface {
+	Name() string
+	GetGeoInfo(ip net.IP) (*GeoInfo, error)
+	UpdateDatabase() error
+	Close() error
+}
+
+type cachedGeoInfo struct {
+	info      *GeoInfo
+	expiresAt time.Time
+}
+
+type providerCache struct {
+	items    *ristretto.Cache[string, cachedGeoInfo]
+	duration time.Duration
+}
+
+func newProviderCache(duration time.Duration) *providerCache {
+	items, err := ristretto.NewCache(&ristretto.Config[string, cachedGeoInfo]{
+		NumCounters: 1e5,
+		MaxCost:     2e4,
+		BufferItems: 64,
+	})
+	if err != nil {
+		panic(err)
+	}
+	return &providerCache{
+		items:    items,
+		duration: duration,
+	}
+}
+
+func (c *providerCache) Get(key string) (*GeoInfo, bool) {
+	entry, ok := c.items.Get(key)
+	if !ok {
+		return nil, false
+	}
+	if time.Now().After(entry.expiresAt) {
+		c.items.Del(key)
+		return nil, false
+	}
+	return entry.info, true
+}
+
+func (c *providerCache) Set(key string, info *GeoInfo) {
+	c.items.Set(key, cachedGeoInfo{
+		info:      info,
+		expiresAt: time.Now().Add(c.duration),
+	}, 1)
+	c.items.Wait()
+}
+
+func (c *providerCache) Flush() {
+	c.items.Clear()
+}
+
+func GetRegionUnicodeEmoji(isoCode string) string {
+	if len(isoCode) != 2 {
+		return ""
+	}
+	isoCode = strings.ToUpper(isoCode)
+
+	if !unicode.IsLetter(rune(isoCode[0])) || !unicode.IsLetter(rune(isoCode[1])) {
+		return ""
+	}
+
+	rune1 := rune(0x1F1E6 + (rune(isoCode[0]) - 'A'))
+	rune2 := rune(0x1F1E6 + (rune(isoCode[1]) - 'A'))
+	return string(rune1) + string(rune2)
+}
+
+func InitGeoIP() {
+	providerName := normalizeProvider(common.GeoIPProvider)
+	nextProvider, err := providerFactory(providerName)
+	if err != nil {
+		slog.Error("initialize GeoIP provider failed", "provider", providerName, "error", err)
+		nextProvider = &EmptyProvider{}
+	}
+	setProvider(nextProvider)
+	if providerName == ProviderDisabled {
+		slog.Info("GeoIP provider disabled")
+		return
+	}
+	slog.Info("GeoIP provider configured", "provider", CurrentProvider.Name())
+}
+
+func GetGeoInfo(ip net.IP) (*GeoInfo, error) {
+	if ip == nil {
+		return nil, fmt.Errorf("IP address cannot be nil")
+	}
+	provider := getProvider()
+	cacheKey := provider.Name() + ":" + ip.String()
+
+	if cachedInfo, found := geoCache.Get(cacheKey); found {
+		return cachedInfo, nil
+	}
+
+	info, err := provider.GetGeoInfo(ip)
+	if err == nil && info != nil {
+		geoCache.Set(cacheKey, info)
+	}
+	return info, err
+}
+
+func LookupGeoInfoWithProvider(providerName string, ip net.IP) (*GeoInfo, error) {
+	if ip == nil {
+		return nil, fmt.Errorf("IP address cannot be nil")
+	}
+
+	provider, err := providerFactory(normalizeProvider(providerName))
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if closeErr := provider.Close(); closeErr != nil {
+			slog.Warn("close temporary GeoIP provider failed", "provider", provider.Name(), "error", closeErr)
+		}
+	}()
+
+	return provider.GetGeoInfo(ip)
+}
+
+func UpdateDatabase() error {
+	err := getProvider().UpdateDatabase()
+	if err == nil {
+		geoCache.Flush()
+		slog.Info("GeoIP cache cleared due to database update.")
+	}
+	return err
+}
+
+func IsValidProvider(provider string) bool {
+	switch normalizeProvider(provider) {
+	case ProviderDisabled, ProviderMaxMind, ProviderIPAPI, ProviderGeoJS, ProviderIPInfo:
+		return true
+	default:
+		return false
+	}
+}
+
+func normalizeProvider(provider string) string {
+	normalized := strings.TrimSpace(strings.ToLower(provider))
+	if normalized == "" {
+		return ProviderDisabled
+	}
+	return normalized
+}
+
+func newProvider(provider string) (GeoIPService, error) {
+	switch provider {
+	case ProviderDisabled:
+		return &EmptyProvider{}, nil
+	case ProviderMaxMind:
+		return NewMaxMindGeoIPService()
+	case ProviderIPAPI:
+		return NewIPAPIService()
+	case ProviderGeoJS:
+		return NewGeoJSService()
+	case ProviderIPInfo:
+		return NewIPInfoService()
+	default:
+		return nil, fmt.Errorf("unsupported GeoIP provider %q", provider)
+	}
+}
+
+func setProvider(provider GeoIPService) {
+	providerMutex.Lock()
+	previous := CurrentProvider
+	CurrentProvider = provider
+	providerMutex.Unlock()
+	geoCache.Flush()
+	if previous != nil && previous != provider {
+		if err := previous.Close(); err != nil {
+			slog.Warn("close previous GeoIP provider failed", "error", err)
+		}
+	}
+}
+
+func getProvider() GeoIPService {
+	providerMutex.RLock()
+	defer providerMutex.RUnlock()
+	if CurrentProvider == nil {
+		return &EmptyProvider{}
+	}
+	return CurrentProvider
+}
+
+func float64Pointer(value float64) *float64 {
+	return &value
+}
+
+func ProviderFactoryForTest() func(string) (GeoIPService, error) {
+	return providerFactory
+}
+
+func SetProviderFactoryForTest(factory func(string) (GeoIPService, error)) {
+	if factory == nil {
+		providerFactory = newProvider
+		return
+	}
+	providerFactory = factory
+}

openflare_server/utils/geoip/geoip_test.go

@@ -0,0 +1,99 @@
+package geoip
+
+import (
+	"net"
+	"testing"
+)
+
+type fakeProvider struct {
+	calls int
+}
+
+func (f *fakeProvider) Name() string {
+	return "fake"
+}
+
+func (f *fakeProvider) GetGeoInfo(ip net.IP) (*GeoInfo, error) {
+	f.calls++
+	return &GeoInfo{
+		ISOCode: "CN",
+		Name:    "China",
+	}, nil
+}
+
+func (f *fakeProvider) UpdateDatabase() error {
+	return nil
+}
+
+func (f *fakeProvider) Close() error {
+	return nil
+}
+
+func TestGetGeoInfoCachesByProviderAndIP(t *testing.T) {
+	originalProvider := CurrentProvider
+	geoCache.Flush()
+	fake := &fakeProvider{}
+	CurrentProvider = fake
+	defer func() {
+		CurrentProvider = originalProvider
+	}()
+
+	ip := net.ParseIP("8.8.8.8")
+	record, err := GetGeoInfo(ip)
+	if err != nil {
+		t.Fatalf("expected nil error, got %v", err)
+	}
+	if record == nil || record.ISOCode != "CN" {
+		t.Fatalf("expected cached record, got %#v", record)
+	}
+
+	_, err = GetGeoInfo(ip)
+	if err != nil {
+		t.Fatalf("expected nil error on second call, got %v", err)
+	}
+	if fake.calls != 1 {
+		t.Fatalf("expected provider to be called once, got %d", fake.calls)
+	}
+}
+
+func TestUnicodeEmoji(t *testing.T) {
+	emoji := GetRegionUnicodeEmoji("CN")
+	if emoji != "🇨🇳" {
+		t.Errorf("expected emoji for CN, got %s", emoji)
+	}
+}
+
+func TestIsValidProvider(t *testing.T) {
+	cases := map[string]bool{
+		"disabled": true,
+		"mmdb":     true,
+		"ip-api":   true,
+		"geojs":    true,
+		"ipinfo":   true,
+		"unknown":  false,
+	}
+
+	for provider, want := range cases {
+		if got := IsValidProvider(provider); got != want {
+			t.Fatalf("provider %s validity mismatch: want %v, got %v", provider, want, got)
+		}
+	}
+}
+
+func TestLookupGeoInfoWithProviderUsesTemporaryProvider(t *testing.T) {
+	previousFactory := providerFactory
+	providerFactory = func(provider string) (GeoIPService, error) {
+		return &fakeProvider{}, nil
+	}
+	defer func() {
+		providerFactory = previousFactory
+	}()
+
+	info, err := LookupGeoInfoWithProvider("ipinfo", net.ParseIP("8.8.8.8"))
+	if err != nil {
+		t.Fatalf("expected lookup to succeed, got %v", err)
+	}
+	if info == nil || info.ISOCode != "CN" || info.Name != "China" {
+		t.Fatalf("unexpected geo info: %#v", info)
+	}
+}

openflare_server/utils/geoip/geojs.go

@@ -0,0 +1,84 @@
+package geoip
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"time"
+)
+
+// GeoJSService 使用 geojs.io 服务实现 GeoIPService 接口。
+type GeoJSService struct {
+	Client *http.Client
+}
+
+// geoJSResponse 定义了 geojs.io 服务返回的 JSON 响应的结构。
+// 我们只定义我们需要的字段。
+type geoJSResponse struct {
+	Country     string  `json:"country"`
+	CountryCode string  `json:"country_code"`
+	Latitude    float64 `json:"latitude,string"`
+	Longitude   float64 `json:"longitude,string"`
+	// 可以根据需要添加其他字段，例如:
+	// City    string `json:"city"`
+	// Region  string `json:"region"`
+}
+
+// NewGeoJSService 创建并返回一个 GeoJSService 的新实例。
+func NewGeoJSService() (*GeoJSService, error) {
+	return &GeoJSService{
+		Client: &http.Client{
+			Timeout: 5 * time.Second, // 设置一个合理的超时时间
+		},
+	}, nil
+}
+
+// Name 返回服务的名称。
+func (s *GeoJSService) Name() string {
+	return "geojs.io"
+}
+
+// GetGeoInfo 使用 geojs.io 服务检索给定 IP 地址的地理位置信息。
+func (s *GeoJSService) GetGeoInfo(ip net.IP) (*GeoInfo, error) {
+	// GeoJS 的 API 端点
+	apiURL := fmt.Sprintf("https://get.geojs.io/v1/ip/geo/%s.json", ip.String())
+
+	resp, err := s.Client.Get(apiURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get geo info from geojs.io: %w", err)
+	}
+	defer resp.Body.Close()
+
+	// 检查响应状态码
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("geojs.io returned non-200 status code: %d", resp.StatusCode)
+	}
+
+	var apiResp geoJSResponse
+	if err := json.NewDecoder(resp.Body).Decode(&apiResp); err != nil {
+		return nil, fmt.Errorf("failed to decode geojs.io response: %w", err)
+	}
+
+	// 检查国家代码是否为空，因为 geojs 对无效/私有IP可能返回200 OK但内容为空
+	if apiResp.CountryCode == "" {
+		return nil, fmt.Errorf("geojs.io returned empty geo info for ip: %s", ip.String())
+	}
+
+	return &GeoInfo{
+		ISOCode:   apiResp.CountryCode,
+		Name:      apiResp.Country,
+		Latitude:  float64Pointer(apiResp.Latitude),
+		Longitude: float64Pointer(apiResp.Longitude),
+	}, nil
+}
+
+// UpdateDatabase 对于 geojs.io 是一个空操作，因为它是一个 Web 服务。
+func (s *GeoJSService) UpdateDatabase() error {
+	return nil
+}
+
+// Close 对于 geojs.io 是一个空操作。
+func (s *GeoJSService) Close() error {
+	return nil
+}

openflare_server/utils/geoip/ipapi.go

@@ -0,0 +1,86 @@
+package geoip
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"time"
+)
+
+// IPAPIService 使用 ip-api.com 服务实现 GeoIPService 接口。
+type IPAPIService struct {
+	Client *http.Client
+}
+
+// ipAPIResponse 定义了 ip-api.com 服务返回的 JSON 响应的结构。
+type ipAPIResponse struct {
+	Status      string  `json:"status"`
+	Message     string  `json:"message"` // 当 status 为 fail 时出现
+	Country     string  `json:"country"`
+	CountryCode string  `json:"countryCode"`
+	Region      string  `json:"region"`
+	RegionName  string  `json:"regionName"`
+	City        string  `json:"city"`
+	Zip         string  `json:"zip"`
+	Lat         float64 `json:"lat"`
+	Lon         float64 `json:"lon"`
+	Timezone    string  `json:"timezone"`
+	ISP         string  `json:"isp"`
+	Org         string  `json:"org"`
+	As          string  `json:"as"`
+	Query       string  `json:"query"`
+}
+
+func (s *IPAPIService) Name() string {
+	return "ip-api.com"
+}
+
+// NewIPAPIService 创建并返回一个 IPAPIService 的新实例。
+func NewIPAPIService() (*IPAPIService, error) {
+	return &IPAPIService{
+		Client: &http.Client{
+			Timeout: 5 * time.Second, // 设置请求超时
+		},
+	}, nil
+}
+
+// GetGeoInfo 使用 ip-api.com 服务检索给定 IP 地址的地理位置信息。
+func (s *IPAPIService) GetGeoInfo(ip net.IP) (*GeoInfo, error) {
+	// API URL, 使用 fields 参数来仅请求需要的字段
+	apiURL := fmt.Sprintf("http://ip-api.com/json/%s?fields=status,message,country,countryCode", ip.String())
+
+	resp, err := s.Client.Get(apiURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get geo info from ip-api.com: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var apiResp ipAPIResponse
+	if err := json.NewDecoder(resp.Body).Decode(&apiResp); err != nil {
+		return nil, fmt.Errorf("failed to decode ip-api.com response: %w", err)
+	}
+
+	if apiResp.Status != "success" {
+		return nil, fmt.Errorf("ip-api.com returned an error: %s", apiResp.Message)
+	}
+
+	return &GeoInfo{
+		ISOCode:   apiResp.CountryCode,
+		Name:      apiResp.Country,
+		Latitude:  float64Pointer(apiResp.Lat),
+		Longitude: float64Pointer(apiResp.Lon),
+	}, nil
+}
+
+// UpdateDatabase 对于 ip-api.com 是一个空操作，因为它是一个 Web 服务。
+func (s *IPAPIService) UpdateDatabase() error {
+	// 无需执行任何操作，因为数据由外部服务提供
+	return nil
+}
+
+// Close 对于 ip-api.com 是一个空操作，因为没有需要关闭的持久连接。
+func (s *IPAPIService) Close() error {
+	// 无需执行任何操作
+	return nil
+}

openflare_server/utils/geoip/ipinfo.go

@@ -0,0 +1,112 @@
+package geoip
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// IPInfoService 使用 ipinfo.io 服务实现 GeoIPService 接口。
+type IPInfoService struct {
+	Client *http.Client
+	// 每天 1000 次请求，限制由 IP 地址的所有人共享。
+	// APIToken string
+}
+
+// ipInfoResponse 定义了 ipinfo.io 服务返回的 JSON 响应的结构，只包含免费额度可用的字段。
+type ipInfoResponse struct {
+	IP          string `json:"ip"`
+	Hostname    string `json:"hostname"`
+	City        string `json:"city"`
+	Region      string `json:"region"`
+	Country     string `json:"country"`
+	CountryCode string `json:"countryCode"` // ipinfo.io 返回 "country" 的 ISO 代码，这里为了与 GeoInfo 保持一致，额外添加一个 CountryCode
+	Loc         string `json:"loc"`         // Latitude,Longitude
+	Org         string `json:"org"`
+	Postal      string `json:"postal"`
+	Timezone    string `json:"timezone"`
+}
+
+// NewIPInfoService 创建并返回一个 IPInfoService 的新实例。
+func NewIPInfoService() (*IPInfoService, error) {
+	return &IPInfoService{
+		Client: &http.Client{
+			Timeout: 5 * time.Second,
+		},
+	}, nil
+}
+
+// Name 返回服务的名称。
+func (s *IPInfoService) Name() string {
+	return "ipinfo.io"
+}
+
+// GetGeoInfo 使用 ipinfo.io 服务检索给定 IP 地址的地理位置信息。
+// 免费额度主要提供国家信息。
+func (s *IPInfoService) GetGeoInfo(ip net.IP) (*GeoInfo, error) {
+	// IPinfo 免费额度不需要 API token 就可以查询基本的 IP 信息。
+	// API URL: https://ipinfo.io/json (查询自身IP) 或 https://ipinfo.io/YOUR_IP/json
+	apiURL := fmt.Sprintf("https://ipinfo.io/%s/json", ip.String())
+
+	resp, err := s.Client.Get(apiURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get geo info from ipinfo.io: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("ipinfo.io returned non-200 status: %d %s", resp.StatusCode, resp.Status)
+	}
+
+	var apiResp ipInfoResponse
+	if err := json.NewDecoder(resp.Body).Decode(&apiResp); err != nil {
+		return nil, fmt.Errorf("failed to decode ipinfo.io response: %w", err)
+	}
+
+	latitude, longitude := parseIPInfoCoordinates(apiResp.Loc)
+
+	// IPinfo 的 "country" 字段直接返回 ISO 2-letter code，例如 "US", "CN"
+	// 我们需要将 "country" 字段作为 ISOCode，并尝试获取其对应的国家名称。
+	// IPinfo 响应中通常不直接提供完整的国家名称，但我们可以通过 CountryCode 映射。
+	// 为了简化并符合 GeoInfo 结构，我们直接使用 Country 作为 ISOCode，并尝试从 CountryCode 获取名称。
+	// 实际上，IPinfo 的 'country' 字段就是 ISO 2-letter code。
+	// 如果需要完整的国家名称，可能需要一个本地的 ISO 代码到名称的映射。
+	// 为了与 GetRegionUnicodeEmoji 函数兼容，我们直接使用 country 作为 ISOCode。
+	return &GeoInfo{
+		ISOCode:   apiResp.Country,
+		Name:      apiResp.Country,
+		Latitude:  latitude,
+		Longitude: longitude,
+	}, nil
+}
+
+// UpdateDatabase 对于 ipinfo.io 是一个空操作，因为它是一个 Web 服务。
+func (s *IPInfoService) UpdateDatabase() error {
+	// 无需执行任何操作，因为数据由外部服务提供
+	return nil
+}
+
+// Close 对于 ipinfo.io 是一个空操作，因为没有需要关闭的持久连接。
+func (s *IPInfoService) Close() error {
+	// 无需执行任何操作
+	return nil
+}
+
+func parseIPInfoCoordinates(value string) (*float64, *float64) {
+	parts := strings.Split(strings.TrimSpace(value), ",")
+	if len(parts) != 2 {
+		return nil, nil
+	}
+
+	latitudeValue, latErr := strconv.ParseFloat(strings.TrimSpace(parts[0]), 64)
+	longitudeValue, lonErr := strconv.ParseFloat(strings.TrimSpace(parts[1]), 64)
+	if latErr != nil || lonErr != nil {
+		return nil, nil
+	}
+
+	return float64Pointer(latitudeValue), float64Pointer(longitudeValue)
+}

openflare_server/utils/geoip/mmdb.go

@@ -0,0 +1,151 @@
+package geoip
+
+import (
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/oschwald/maxminddb-golang"
+)
+
+var GeoIpUrl = "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/GeoLite2-Country.mmdb"
+var GeoIpFilePath = "./data/GeoLite2-Country.mmdb"
+
+type GeoIpRecord struct {
+	Country struct {
+		ISOCode string            `maxminddb:"iso_code"`
+		Names   map[string]string `maxminddb:"names"`
+	} `maxminddb:"country"`
+}
+
+type MaxMindGeoIPService struct {
+	maxMindDBReader *maxminddb.Reader
+	dbFilePath      string
+	mu              sync.RWMutex
+}
+
+func (s *MaxMindGeoIPService) Name() string {
+	return "MaxMind"
+}
+
+func NewMaxMindGeoIPService() (*MaxMindGeoIPService, error) {
+	service := &MaxMindGeoIPService{
+		dbFilePath: GeoIpFilePath,
+	}
+
+	if err := os.MkdirAll(filepath.Dir(service.dbFilePath), os.ModePerm); err != nil {
+		return nil, fmt.Errorf("failed to create data directory for MaxMind database: %w", err)
+	}
+
+	if _, err := os.Stat(service.dbFilePath); os.IsNotExist(err) {
+		if err := service.UpdateDatabase(); err != nil {
+			return nil, fmt.Errorf("failed to download initial MaxMind database: %w", err)
+		}
+	}
+
+	if err := service.initialize(); err != nil {
+		return nil, fmt.Errorf("failed to initialize MaxMind database: %w", err)
+	}
+
+	return service, nil
+}
+
+func (s *MaxMindGeoIPService) initialize() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.maxMindDBReader != nil {
+		_ = s.maxMindDBReader.Close()
+		s.maxMindDBReader = nil
+	}
+
+	reader, err := maxminddb.Open(s.dbFilePath)
+	if err != nil {
+		return fmt.Errorf("error opening MaxMind database at %s: %w", s.dbFilePath, err)
+	}
+	s.maxMindDBReader = reader
+	return nil
+}
+
+func (s *MaxMindGeoIPService) GetGeoInfo(ip net.IP) (*GeoInfo, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if s.maxMindDBReader == nil {
+		return nil, fmt.Errorf("MaxMind database is not initialized or failed to open")
+	}
+	if ip == nil {
+		return nil, fmt.Errorf("IP address cannot be nil")
+	}
+
+	var record GeoIpRecord
+	if err := s.maxMindDBReader.Lookup(ip, &record); err != nil {
+		return nil, fmt.Errorf("error looking up IP %s in MaxMind database: %w", ip.String(), err)
+	}
+
+	geoInfo := &GeoInfo{
+		ISOCode: record.Country.ISOCode,
+		Name:    record.Country.Names["en"],
+	}
+	if geoInfo.Name == "" && geoInfo.ISOCode != "" {
+		geoInfo.Name = geoInfo.ISOCode
+	}
+
+	return geoInfo, nil
+}
+
+func (s *MaxMindGeoIPService) UpdateDatabase() error {
+	resp, err := http.Get(GeoIpUrl)
+	if err != nil {
+		return fmt.Errorf("failed to initiate MaxMind database download: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to download MaxMind database: HTTP status %s", resp.Status)
+	}
+
+	if err := os.MkdirAll(filepath.Dir(s.dbFilePath), os.ModePerm); err != nil {
+		return fmt.Errorf("failed to create data directory for MaxMind database update: %w", err)
+	}
+
+	tempPath := s.dbFilePath + ".download"
+	out, err := os.Create(tempPath)
+	if err != nil {
+		return fmt.Errorf("failed to create MaxMind database file at %s: %w", tempPath, err)
+	}
+	defer func() {
+		_ = out.Close()
+	}()
+
+	if _, err = io.Copy(out, resp.Body); err != nil {
+		return fmt.Errorf("failed to write MaxMind database file: %w", err)
+	}
+	if err = out.Close(); err != nil {
+		return fmt.Errorf("failed to close MaxMind database file: %w", err)
+	}
+	if err = os.Rename(tempPath, s.dbFilePath); err != nil {
+		return fmt.Errorf("failed to move MaxMind database file into place: %w", err)
+	}
+
+	return s.initialize()
+}
+
+func (s *MaxMindGeoIPService) Close() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.maxMindDBReader != nil {
+		err := s.maxMindDBReader.Close()
+		s.maxMindDBReader = nil
+		if err != nil {
+			return fmt.Errorf("error closing MaxMind database: %w", err)
+		}
+	}
+	slog.Info("MaxMind GeoIP service closed.")
+	return nil
+}

openflare_server/utils/html.go

@@ -0,0 +1,7 @@
+package utils
+
+import "html/template"
+
+func UnescapeHTML(x string) interface{} {
+	return template.HTML(x)
+}