[优化] go 引用调整

openflare-agent/internal/config/config.go

@@ -0,0 +1,463 @@
+package config
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	pathpkg "path"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/rain-kl/openflare/openflare-server/utils"
+	"github.com/rain-kl/openflare/openflare-server/utils/geoip"
+	"github.com/rain-kl/openflare/openflare-server/utils/geoip/iputil"
+)
+
+const (
+	defaultMainConfigRelativePath          = "etc/nginx/nginx.conf"
+	defaultRouteConfigRelativePath         = "etc/nginx/conf.d/openflare_routes.conf"
+	defaultCertDirRelativePath             = "etc/nginx/certs"
+	defaultLuaDirRelativePath              = "etc/nginx/lua"
+	defaultRuntimeConfigDirRelativePath    = "etc/openflare"
+	defaultPagesDirRelativePath            = "var/lib/openflare/pages"
+	defaultMMDBRelativePath                = "etc/openflare/GeoLite2-Country.mmdb"
+	defaultAccessLogRelativePath           = "var/log/openflare/access.log"
+	defaultStateRelativePath               = "var/lib/openflare/agent-state.json"
+	defaultObservabilityBufferRelativePath = "var/lib/openflare/observability-buffer.json"
+	defaultOpenRestyObservabilityPort      = 18081
+	defaultObservabilityReplayMinutes      = 15
+	defaultMMDBUpdateInterval              = 24 * time.Hour
+	defaultMMDBDownloadURL                 = "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/GeoLite2-Country.mmdb"
+)
+
+var (
+	lookupOutboundIP = geoip.GetOutboundIP
+	lookupLocalIP    = detectLocalNodeIP
+)
+
+type Config struct {
+	ServerURL                  string              `json:"server_url"`
+	AccessToken                string              `json:"agent_token"`
+	DiscoveryToken             string              `json:"discovery_token"`
+	NodeName                   string              `json:"node_name"`
+	NodeIP                     string              `json:"node_ip"`
+	Version                    string              `json:"-"`
+	ExtVersion                 string              `json:"-"`
+	OpenrestyPath              string              `json:"openresty_path"`
+	OpenrestyResolvers         []string            `json:"openresty_resolvers,omitempty"`
+	DataDir                    string              `json:"data_dir"`
+	MainConfigPath             string              `json:"main_config_path"`
+	RouteConfigPath            string              `json:"route_config_path"`
+	AccessLogPath              string              `json:"access_log_path"`
+	CertDir                    string              `json:"cert_dir"`
+	OpenrestyCertDir           string              `json:"openresty_cert_dir"`
+	LuaDir                     string              `json:"lua_dir"`
+	OpenrestyLuaDir            string              `json:"openresty_lua_dir"`
+	RuntimeConfigDir           string              `json:"runtime_config_dir"`
+	PagesDir                   string              `json:"pages_dir"`
+	MMDBPath                   string              `json:"mmdb_path"`
+	MMDBUpdateInterval         MillisecondDuration `json:"mmdb_update_interval"`
+	MMDBDownloadURL            string              `json:"mmdb_download_url"`
+	OpenrestyObservabilityPort int                 `json:"openresty_observability_port"`
+	ObservabilityBufferPath    string              `json:"observability_buffer_path"`
+	ObservabilityReplayMinutes int                 `json:"observability_replay_minutes"`
+	StatePath                  string              `json:"state_path"`
+	HeartbeatInterval          MillisecondDuration `json:"heartbeat_interval"`
+	RequestTimeout             MillisecondDuration `json:"request_timeout"`
+	configPath                 string
+}
+
+type configFile struct {
+	ServerURL                  string              `json:"server_url"`
+	AccessToken                string              `json:"agent_token"`
+	DiscoveryToken             string              `json:"discovery_token"`
+	NodeName                   string              `json:"node_name"`
+	NodeIP                     string              `json:"node_ip"`
+	OpenrestyPath              string              `json:"openresty_path"`
+	OpenrestyResolvers         []string            `json:"openresty_resolvers"`
+	DataDir                    string              `json:"data_dir"`
+	MainConfigPath             string              `json:"main_config_path"`
+	RouteConfigPath            string              `json:"route_config_path"`
+	AccessLogPath              string              `json:"access_log_path"`
+	CertDir                    string              `json:"cert_dir"`
+	OpenrestyCertDir           string              `json:"openresty_cert_dir"`
+	LuaDir                     string              `json:"lua_dir"`
+	OpenrestyLuaDir            string              `json:"openresty_lua_dir"`
+	RuntimeConfigDir           string              `json:"runtime_config_dir"`
+	PagesDir                   string              `json:"pages_dir"`
+	MMDBPath                   string              `json:"mmdb_path"`
+	MMDBUpdateInterval         MillisecondDuration `json:"mmdb_update_interval"`
+	MMDBDownloadURL            string              `json:"mmdb_download_url"`
+	OpenrestyObservabilityPort int                 `json:"openresty_observability_port"`
+	ObservabilityBufferPath    string              `json:"observability_buffer_path"`
+	ObservabilityReplayMinutes int                 `json:"observability_replay_minutes"`
+	StatePath                  string              `json:"state_path"`
+	HeartbeatInterval          MillisecondDuration `json:"heartbeat_interval"`
+	RequestTimeout             MillisecondDuration `json:"request_timeout"`
+}
+
+func Load(path string) (*Config, error) {
+	data, err := os.ReadFile(path)
+	if err != nil && !os.IsNotExist(err) {
+		return nil, err
+	}
+	file := &configFile{}
+	if err == nil {
+		if err = json.Unmarshal(data, file); err != nil {
+			return nil, err
+		}
+	}
+	if err != nil && !hasEnvConfig() {
+		return nil, err
+	}
+	cfg := &Config{
+		ServerURL:                  file.ServerURL,
+		AccessToken:                file.AccessToken,
+		DiscoveryToken:             file.DiscoveryToken,
+		NodeName:                   file.NodeName,
+		NodeIP:                     file.NodeIP,
+		OpenrestyPath:              file.OpenrestyPath,
+		OpenrestyResolvers:         append([]string{}, file.OpenrestyResolvers...),
+		DataDir:                    file.DataDir,
+		MainConfigPath:             file.MainConfigPath,
+		RouteConfigPath:            file.RouteConfigPath,
+		AccessLogPath:              file.AccessLogPath,
+		CertDir:                    file.CertDir,
+		OpenrestyCertDir:           file.OpenrestyCertDir,
+		LuaDir:                     file.LuaDir,
+		OpenrestyLuaDir:            file.OpenrestyLuaDir,
+		RuntimeConfigDir:           file.RuntimeConfigDir,
+		PagesDir:                   file.PagesDir,
+		MMDBPath:                   file.MMDBPath,
+		MMDBUpdateInterval:         file.MMDBUpdateInterval,
+		MMDBDownloadURL:            file.MMDBDownloadURL,
+		OpenrestyObservabilityPort: file.OpenrestyObservabilityPort,
+		ObservabilityBufferPath:    file.ObservabilityBufferPath,
+		ObservabilityReplayMinutes: file.ObservabilityReplayMinutes,
+		StatePath:                  file.StatePath,
+		HeartbeatInterval:          file.HeartbeatInterval,
+		RequestTimeout:             file.RequestTimeout,
+	}
+	cfg.configPath = path
+	applyEnvOverrides(cfg)
+	applyDefaults(cfg, filepath.Dir(path))
+	if err = validate(cfg); err != nil {
+		return nil, err
+	}
+	return cfg, nil
+}
+
+func applyDefaults(cfg *Config, baseDir string) {
+	baseDir = filepath.Clean(baseDir)
+	cfg.Version = Version
+	cfg.OpenrestyResolvers = utils.UniqueAndCleanStringSlice(cfg.OpenrestyResolvers)
+	if cfg.OpenrestyPath == "" {
+		cfg.OpenrestyPath = "openresty"
+	}
+	if cfg.DataDir == "" {
+		cfg.DataDir = filepath.Join(baseDir, "data")
+	}
+	if cfg.NodeName == "" {
+		cfg.NodeName = detectHostname()
+	}
+	if cfg.NodeIP == "" {
+		cfg.NodeIP = detectNodeIP()
+	}
+	if cfg.MainConfigPath == "" {
+		cfg.MainConfigPath = joinManagedPath(cfg.DataDir, defaultMainConfigRelativePath)
+	}
+	if cfg.RouteConfigPath == "" {
+		cfg.RouteConfigPath = joinManagedPath(cfg.DataDir, defaultRouteConfigRelativePath)
+	}
+	if cfg.AccessLogPath == "" {
+		cfg.AccessLogPath = joinManagedPath(cfg.DataDir, defaultAccessLogRelativePath)
+	}
+	if cfg.StatePath == "" {
+		cfg.StatePath = joinManagedPath(cfg.DataDir, defaultStateRelativePath)
+	}
+	if cfg.CertDir == "" {
+		cfg.CertDir = joinManagedPath(cfg.DataDir, defaultCertDirRelativePath)
+	}
+	if cfg.OpenrestyCertDir == "" {
+		cfg.OpenrestyCertDir = cfg.CertDir
+	}
+	if cfg.LuaDir == "" {
+		cfg.LuaDir = joinManagedPath(cfg.DataDir, defaultLuaDirRelativePath)
+	}
+	if cfg.OpenrestyLuaDir == "" {
+		cfg.OpenrestyLuaDir = cfg.LuaDir
+	}
+	if cfg.RuntimeConfigDir == "" {
+		cfg.RuntimeConfigDir = joinManagedPath(cfg.DataDir, defaultRuntimeConfigDirRelativePath)
+	}
+	if cfg.PagesDir == "" {
+		cfg.PagesDir = joinManagedPath(cfg.DataDir, defaultPagesDirRelativePath)
+	}
+	if cfg.MMDBPath == "" {
+		cfg.MMDBPath = joinManagedPath(cfg.DataDir, defaultMMDBRelativePath)
+	}
+	if cfg.MMDBUpdateInterval <= 0 {
+		cfg.MMDBUpdateInterval = MillisecondDuration(defaultMMDBUpdateInterval)
+	}
+	if cfg.MMDBDownloadURL == "" {
+		cfg.MMDBDownloadURL = defaultMMDBDownloadURL
+	}
+	if cfg.OpenrestyObservabilityPort <= 0 {
+		cfg.OpenrestyObservabilityPort = defaultOpenRestyObservabilityPort
+	}
+	if cfg.ObservabilityBufferPath == "" {
+		cfg.ObservabilityBufferPath = joinManagedPath(cfg.DataDir, defaultObservabilityBufferRelativePath)
+	}
+	if cfg.ObservabilityReplayMinutes <= 0 {
+		cfg.ObservabilityReplayMinutes = defaultObservabilityReplayMinutes
+	}
+	if cfg.HeartbeatInterval <= 0 {
+		cfg.HeartbeatInterval = MillisecondDuration(10 * time.Second)
+	}
+	if cfg.RequestTimeout <= 0 {
+		cfg.RequestTimeout = MillisecondDuration(10 * time.Second)
+	}
+	normalizeManagedPaths(cfg)
+}
+
+func normalizeManagedPaths(cfg *Config) {
+	if cfg == nil {
+		return
+	}
+	paths := []*string{
+		&cfg.DataDir,
+		&cfg.MainConfigPath,
+		&cfg.RouteConfigPath,
+		&cfg.AccessLogPath,
+		&cfg.CertDir,
+		&cfg.OpenrestyCertDir,
+		&cfg.LuaDir,
+		&cfg.OpenrestyLuaDir,
+		&cfg.RuntimeConfigDir,
+		&cfg.PagesDir,
+		&cfg.StatePath,
+		&cfg.ObservabilityBufferPath,
+		&cfg.MMDBPath,
+	}
+	for _, p := range paths {
+		if usesSlashPath(*p) {
+			*p = filepath.ToSlash(*p)
+		}
+	}
+}
+
+func hasEnvConfig() bool {
+	for _, key := range []string{
+		"OPENFLARE_SERVER_URL",
+		"OPENFLARE_AGENT_TOKEN",
+		"OPENFLARE_DISCOVERY_TOKEN",
+		"OPENFLARE_NODE_NAME",
+		"OPENFLARE_NODE_IP",
+		"OPENFLARE_DATA_DIR",
+		"OPENFLARE_OPENRESTY_PATH",
+		"OPENFLARE_PAGES_DIR",
+		"OPENFLARE_HEARTBEAT_INTERVAL",
+		"OPENFLARE_REQUEST_TIMEOUT",
+		"OPENFLARE_OPENRESTY_OBSERVABILITY_PORT",
+		"OPENFLARE_MMDB_PATH",
+		"OPENFLARE_MMDB_UPDATE_INTERVAL",
+		"OPENFLARE_MMDB_DOWNLOAD_URL",
+	} {
+		if strings.TrimSpace(os.Getenv(key)) != "" {
+			return true
+		}
+	}
+	return false
+}
+
+func applyEnvOverrides(cfg *Config) {
+	if cfg == nil {
+		return
+	}
+	overrideString := func(key string, target *string) {
+		if value := strings.TrimSpace(os.Getenv(key)); value != "" {
+			*target = value
+		}
+	}
+	overrideString("OPENFLARE_SERVER_URL", &cfg.ServerURL)
+	overrideString("OPENFLARE_AGENT_TOKEN", &cfg.AccessToken)
+	overrideString("OPENFLARE_DISCOVERY_TOKEN", &cfg.DiscoveryToken)
+	overrideString("OPENFLARE_NODE_NAME", &cfg.NodeName)
+	overrideString("OPENFLARE_NODE_IP", &cfg.NodeIP)
+	overrideString("OPENFLARE_DATA_DIR", &cfg.DataDir)
+	overrideString("OPENFLARE_OPENRESTY_PATH", &cfg.OpenrestyPath)
+	overrideString("OPENFLARE_PAGES_DIR", &cfg.PagesDir)
+	overrideString("OPENFLARE_MMDB_PATH", &cfg.MMDBPath)
+	overrideString("OPENFLARE_MMDB_DOWNLOAD_URL", &cfg.MMDBDownloadURL)
+	if value := strings.TrimSpace(os.Getenv("OPENFLARE_HEARTBEAT_INTERVAL")); value != "" {
+		if duration, err := parseDurationValue(value); err == nil {
+			cfg.HeartbeatInterval = duration
+		}
+	}
+	if value := strings.TrimSpace(os.Getenv("OPENFLARE_REQUEST_TIMEOUT")); value != "" {
+		if duration, err := parseDurationValue(value); err == nil {
+			cfg.RequestTimeout = duration
+		}
+	}
+	if value := strings.TrimSpace(os.Getenv("OPENFLARE_MMDB_UPDATE_INTERVAL")); value != "" {
+		if duration, err := parseDurationValue(value); err == nil {
+			cfg.MMDBUpdateInterval = duration
+		}
+	}
+	if value := strings.TrimSpace(os.Getenv("OPENFLARE_OPENRESTY_OBSERVABILITY_PORT")); value != "" {
+		var port int
+		if _, err := fmt.Sscanf(value, "%d", &port); err == nil {
+			cfg.OpenrestyObservabilityPort = port
+		}
+	}
+}
+
+func parseDurationValue(value string) (MillisecondDuration, error) {
+	trimmed := strings.TrimSpace(value)
+	if trimmed == "" {
+		return 0, nil
+	}
+	if parsed, err := time.ParseDuration(trimmed); err == nil {
+		return MillisecondDuration(parsed), nil
+	}
+	ms, err := strconv.ParseInt(trimmed, 10, 64)
+	if err != nil {
+		return 0, err
+	}
+	return MillisecondDuration(time.Duration(ms) * time.Millisecond), nil
+}
+
+func usesSlashPath(path string) bool {
+	return strings.HasPrefix(path, "/")
+}
+
+func joinManagedPath(base string, relative string) string {
+	if usesSlashPath(base) {
+		return pathpkg.Join(filepath.ToSlash(base), relative)
+	}
+	return filepath.Join(base, relative)
+}
+
+func validate(cfg *Config) error {
+	if cfg.ServerURL == "" {
+		return errors.New("server_url 不能为空")
+	}
+	if strings.TrimSpace(cfg.AccessToken) == "" && strings.TrimSpace(cfg.DiscoveryToken) == "" {
+		return errors.New("agent_token 和 discovery_token 不能同时为空")
+	}
+	if cfg.NodeName == "" {
+		return errors.New("node_name 不能为空")
+	}
+	if cfg.NodeIP == "" {
+		return errors.New("node_ip 不能为空")
+	}
+	if cfg.OpenrestyObservabilityPort <= 0 || cfg.OpenrestyObservabilityPort > 65535 {
+		return errors.New("openresty_observability_port 必须在 1-65535 之间")
+	}
+	if cfg.ObservabilityReplayMinutes <= 0 {
+		return errors.New("observability_replay_minutes 必须大于 0")
+	}
+	if cfg.MMDBUpdateInterval <= 0 {
+		return errors.New("mmdb_update_interval 必须大于 0")
+	}
+	return nil
+}
+
+func (cfg *Config) InitialAuthToken() string {
+	if cfg == nil {
+		return ""
+	}
+	if token := strings.TrimSpace(cfg.AccessToken); token != "" {
+		return token
+	}
+	return strings.TrimSpace(cfg.DiscoveryToken)
+}
+
+func (cfg *Config) Save() error {
+	if cfg == nil {
+		return errors.New("config 不能为空")
+	}
+	if cfg.configPath == "" {
+		return errors.New("config path 未初始化")
+	}
+	data, err := json.MarshalIndent(cfg, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(cfg.configPath, data, 0o644)
+}
+
+func detectHostname() string {
+	host, err := os.Hostname()
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(host)
+}
+
+func detectNodeIP() string {
+	if ip := detectOutboundNodeIP(); ip != "" {
+		return ip
+	}
+	return lookupLocalIP()
+}
+
+func detectOutboundNodeIP() string {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ip, err := lookupOutboundIP(ctx)
+	if err != nil || ip == nil {
+		return ""
+	}
+	return ip.String()
+}
+
+func detectLocalNodeIP() string {
+	interfaces, err := net.Interfaces()
+	if err != nil {
+		return ""
+	}
+	bestIP := ""
+	bestPriority := -1
+	for _, iface := range interfaces {
+		if iface.Flags&net.FlagUp == 0 || iface.Flags&net.FlagLoopback != 0 {
+			continue
+		}
+		addrs, err := iface.Addrs()
+		if err != nil {
+			continue
+		}
+		for _, addr := range addrs {
+			ipNet, ok := addr.(*net.IPNet)
+			if !ok || ipNet.IP == nil || ipNet.IP.IsLoopback() {
+				continue
+			}
+			ipv4 := normalizeIPv4(ipNet.IP)
+			priority := nodeIPPriority(ipv4)
+			if priority > bestPriority {
+				bestIP = ipv4.String()
+				bestPriority = priority
+			}
+			if bestPriority == 2 {
+				return bestIP
+			}
+		}
+	}
+	return bestIP
+}
+
+func normalizeIPv4(ip net.IP) net.IP {
+	if ip == nil {
+		return nil
+	}
+	return ip.To4()
+}
+
+func nodeIPPriority(ip net.IP) int {
+	return iputil.Score(ip)
+}

openflare-agent/internal/config/config_test.go

@@ -0,0 +1,520 @@
+package config
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/rain-kl/openflare/openflare-server/utils/geoip"
+)
+
+func TestLoadDefaultsToManagedBinaryPaths(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	payload := map[string]any{
+		"server_url":  "http://127.0.0.1:3000",
+		"agent_token": "token",
+		"node_name":   "edge-01",
+		"node_ip":     "10.0.0.8",
+	}
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+	if err = os.WriteFile(configPath, data, 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+
+	if cfg.DataDir != filepath.Join(dir, "data") {
+		t.Fatalf("unexpected data dir: %s", cfg.DataDir)
+	}
+	if cfg.OpenrestyPath != "openresty" {
+		t.Fatalf("unexpected openresty path: %s", cfg.OpenrestyPath)
+	}
+	if cfg.MainConfigPath != filepath.Join(dir, "data", defaultMainConfigRelativePath) {
+		t.Fatalf("unexpected main config path: %s", cfg.MainConfigPath)
+	}
+	if cfg.RouteConfigPath != filepath.Join(dir, "data", defaultRouteConfigRelativePath) {
+		t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
+	}
+	if cfg.AccessLogPath != filepath.Join(dir, "data", defaultAccessLogRelativePath) {
+		t.Fatalf("unexpected access log path: %s", cfg.AccessLogPath)
+	}
+	if cfg.CertDir != filepath.Join(dir, "data", defaultCertDirRelativePath) {
+		t.Fatalf("unexpected cert dir: %s", cfg.CertDir)
+	}
+	if cfg.LuaDir != filepath.Join(dir, "data", defaultLuaDirRelativePath) {
+		t.Fatalf("unexpected lua dir: %s", cfg.LuaDir)
+	}
+	if cfg.RuntimeConfigDir != filepath.Join(dir, "data", defaultRuntimeConfigDirRelativePath) {
+		t.Fatalf("unexpected runtime config dir: %s", cfg.RuntimeConfigDir)
+	}
+	if cfg.OpenrestyCertDir != cfg.CertDir {
+		t.Fatalf("unexpected openresty cert dir: %s", cfg.OpenrestyCertDir)
+	}
+	if cfg.OpenrestyLuaDir != cfg.LuaDir {
+		t.Fatalf("unexpected openresty lua dir: %s", cfg.OpenrestyLuaDir)
+	}
+	if cfg.StatePath != filepath.Join(dir, "data", defaultStateRelativePath) {
+		t.Fatalf("unexpected state path: %s", cfg.StatePath)
+	}
+	if cfg.ObservabilityBufferPath != filepath.Join(dir, "data", defaultObservabilityBufferRelativePath) {
+		t.Fatalf("unexpected observability buffer path: %s", cfg.ObservabilityBufferPath)
+	}
+	if cfg.OpenrestyObservabilityPort != defaultOpenRestyObservabilityPort {
+		t.Fatalf("unexpected openresty observability port: %d", cfg.OpenrestyObservabilityPort)
+	}
+	if cfg.ObservabilityReplayMinutes != defaultObservabilityReplayMinutes {
+		t.Fatalf("unexpected observability replay minutes: %d", cfg.ObservabilityReplayMinutes)
+	}
+}
+
+func TestLoadPathModeKeepsExplicitPaths(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	payload := map[string]any{
+		"server_url":        "http://127.0.0.1:3000",
+		"agent_token":       "token",
+		"node_name":         "edge-01",
+		"node_ip":           "10.0.0.8",
+		"openresty_path":    "/usr/local/openresty/nginx/sbin/openresty",
+		"main_config_path":  "/tmp/nginx.conf",
+		"route_config_path": "/tmp/routes.conf",
+		"state_path":        "/tmp/agent-state.json",
+	}
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+	if err = os.WriteFile(configPath, data, 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+
+	if cfg.MainConfigPath != "/tmp/nginx.conf" {
+		t.Fatalf("unexpected main config path: %s", cfg.MainConfigPath)
+	}
+	if cfg.RouteConfigPath != "/tmp/routes.conf" {
+		t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
+	}
+	if cfg.StatePath != "/tmp/agent-state.json" {
+		t.Fatalf("unexpected state path: %s", cfg.StatePath)
+	}
+	if cfg.ObservabilityBufferPath != filepath.Join(dir, "data", defaultObservabilityBufferRelativePath) {
+		t.Fatalf("unexpected observability buffer path: %s", cfg.ObservabilityBufferPath)
+	}
+	if cfg.OpenrestyCertDir != cfg.CertDir {
+		t.Fatalf("expected path mode openresty cert dir to equal cert dir, got %s / %s", cfg.OpenrestyCertDir, cfg.CertDir)
+	}
+	if cfg.OpenrestyLuaDir != cfg.LuaDir {
+		t.Fatalf("expected path mode openresty lua dir to equal lua dir, got %s / %s", cfg.OpenrestyLuaDir, cfg.LuaDir)
+	}
+	if cfg.OpenrestyObservabilityPort != defaultOpenRestyObservabilityPort {
+		t.Fatalf("unexpected path mode openresty observability port: %d", cfg.OpenrestyObservabilityPort)
+	}
+}
+
+func TestLoadNormalizesExplicitResolvers(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	payload := map[string]any{
+		"server_url":          "http://127.0.0.1:3000",
+		"agent_token":         "token",
+		"node_name":           "edge-01",
+		"node_ip":             "10.0.0.8",
+		"openresty_resolvers": []string{" 10.0.0.2 ", "10.0.0.2", "", "1.1.1.1"},
+	}
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+	if err = os.WriteFile(configPath, data, 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+
+	expected := []string{"10.0.0.2", "1.1.1.1"}
+	if len(cfg.OpenrestyResolvers) != len(expected) {
+		t.Fatalf("unexpected resolver count: %#v", cfg.OpenrestyResolvers)
+	}
+	for index, value := range expected {
+		if cfg.OpenrestyResolvers[index] != value {
+			t.Fatalf("unexpected resolver at %d: got %q want %q", index, cfg.OpenrestyResolvers[index], value)
+		}
+	}
+}
+
+func TestLoadUsesCustomDataDirForGeneratedFiles(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	payload := map[string]any{
+		"server_url":  "http://127.0.0.1:3000",
+		"agent_token": "token",
+		"node_name":   "edge-01",
+		"node_ip":     "10.0.0.8",
+		"data_dir":    "/srv/openflare",
+	}
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+	if err = os.WriteFile(configPath, data, 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+
+	if cfg.RouteConfigPath != "/srv/openflare/"+defaultRouteConfigRelativePath {
+		t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
+	}
+	if cfg.MainConfigPath != "/srv/openflare/"+defaultMainConfigRelativePath {
+		t.Fatalf("unexpected main config path: %s", cfg.MainConfigPath)
+	}
+	if cfg.AccessLogPath != "/srv/openflare/"+defaultAccessLogRelativePath {
+		t.Fatalf("unexpected access log path: %s", cfg.AccessLogPath)
+	}
+	if cfg.StatePath != "/srv/openflare/"+defaultStateRelativePath {
+		t.Fatalf("unexpected state path: %s", cfg.StatePath)
+	}
+	if cfg.ObservabilityBufferPath != "/srv/openflare/"+defaultObservabilityBufferRelativePath {
+		t.Fatalf("unexpected observability buffer path: %s", cfg.ObservabilityBufferPath)
+	}
+	if cfg.CertDir != "/srv/openflare/"+defaultCertDirRelativePath {
+		t.Fatalf("unexpected cert dir: %s", cfg.CertDir)
+	}
+	if cfg.LuaDir != "/srv/openflare/"+defaultLuaDirRelativePath {
+		t.Fatalf("unexpected lua dir: %s", cfg.LuaDir)
+	}
+	if cfg.RuntimeConfigDir != "/srv/openflare/"+defaultRuntimeConfigDirRelativePath {
+		t.Fatalf("unexpected runtime config dir: %s", cfg.RuntimeConfigDir)
+	}
+}
+
+func TestLoadUsesEnvConfigWhenFileIsMissing(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("OPENFLARE_SERVER_URL", "http://127.0.0.1:3000")
+	t.Setenv("OPENFLARE_AGENT_TOKEN", "token")
+	t.Setenv("OPENFLARE_NODE_NAME", "edge-env")
+	t.Setenv("OPENFLARE_NODE_IP", "10.0.0.9")
+	t.Setenv("OPENFLARE_DATA_DIR", "/srv/openflare-env")
+	t.Setenv("OPENFLARE_OPENRESTY_PATH", "/usr/bin/openresty")
+	t.Setenv("OPENFLARE_HEARTBEAT_INTERVAL", "45s")
+	t.Setenv("OPENFLARE_REQUEST_TIMEOUT", "2500")
+	t.Setenv("OPENFLARE_OPENRESTY_OBSERVABILITY_PORT", "19091")
+
+	cfg, err := Load(filepath.Join(dir, "missing-agent.json"))
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+	if cfg.ServerURL != "http://127.0.0.1:3000" || cfg.AccessToken != "token" {
+		t.Fatalf("unexpected env auth config: %#v", cfg)
+	}
+	if cfg.OpenrestyPath != "/usr/bin/openresty" {
+		t.Fatalf("unexpected openresty path: %s", cfg.OpenrestyPath)
+	}
+	if cfg.DataDir != "/srv/openflare-env" {
+		t.Fatalf("unexpected data dir: %s", cfg.DataDir)
+	}
+	if cfg.HeartbeatInterval.Duration() != 45*time.Second {
+		t.Fatalf("unexpected heartbeat interval: %s", cfg.HeartbeatInterval)
+	}
+	if cfg.RequestTimeout.Duration() != 2500*time.Millisecond {
+		t.Fatalf("unexpected request timeout: %s", cfg.RequestTimeout)
+	}
+	if cfg.OpenrestyObservabilityPort != 19091 {
+		t.Fatalf("unexpected observability port: %d", cfg.OpenrestyObservabilityPort)
+	}
+}
+
+func TestLoadDetectsOutboundIPWhenNodeIPMissing(t *testing.T) {
+	previousLookup := lookupOutboundIP
+	lookupOutboundIP = func(ctx context.Context, strategies ...geoip.OutboundIPStrategy) (net.IP, error) {
+		return net.ParseIP("8.8.8.8"), nil
+	}
+	defer func() {
+		lookupOutboundIP = previousLookup
+	}()
+
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	payload := map[string]any{
+		"server_url":  "http://127.0.0.1:3000",
+		"agent_token": "token",
+		"node_name":   "edge-01",
+	}
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+	if err = os.WriteFile(configPath, data, 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+	if cfg.NodeIP != "8.8.8.8" {
+		t.Fatalf("expected outbound IP, got %s", cfg.NodeIP)
+	}
+}
+
+func TestLoadFallsBackToLocalIPWhenOutboundLookupFails(t *testing.T) {
+	previousOutboundLookup := lookupOutboundIP
+	previousLocalLookup := lookupLocalIP
+	lookupOutboundIP = func(ctx context.Context, strategies ...geoip.OutboundIPStrategy) (net.IP, error) {
+		return nil, errors.New("realip.cc unavailable")
+	}
+	lookupLocalIP = func() string {
+		return "9.9.9.9"
+	}
+	defer func() {
+		lookupOutboundIP = previousOutboundLookup
+		lookupLocalIP = previousLocalLookup
+	}()
+
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	payload := map[string]any{
+		"server_url":  "http://127.0.0.1:3000",
+		"agent_token": "token",
+		"node_name":   "edge-01",
+	}
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+	if err = os.WriteFile(configPath, data, 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+	if cfg.NodeIP != "9.9.9.9" {
+		t.Fatalf("expected local fallback IP, got %s", cfg.NodeIP)
+	}
+}
+
+func TestLoadEnvOverridesConfigFile(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	if err := os.WriteFile(configPath, []byte(`{"server_url":"http://old:3000","agent_token":"old","node_name":"edge-01","node_ip":"10.0.0.8","openresty_path":"/old/openresty"}`), 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+	t.Setenv("OPENFLARE_SERVER_URL", "http://new:3000")
+	t.Setenv("OPENFLARE_AGENT_TOKEN", "new-token")
+	t.Setenv("OPENFLARE_OPENRESTY_PATH", "/new/openresty")
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+	if cfg.ServerURL != "http://new:3000" {
+		t.Fatalf("expected server url from env, got %s", cfg.ServerURL)
+	}
+	if cfg.AccessToken != "new-token" {
+		t.Fatalf("expected token from env, got %s", cfg.AccessToken)
+	}
+	if cfg.OpenrestyPath != "/new/openresty" {
+		t.Fatalf("expected openresty path from env, got %s", cfg.OpenrestyPath)
+	}
+}
+
+func TestLoadUsesMillisecondsForIntervals(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	payload := map[string]any{
+		"server_url":         "http://127.0.0.1:3000",
+		"agent_token":        "token",
+		"node_name":          "edge-01",
+		"node_ip":            "10.0.0.8",
+		"heartbeat_interval": 30000,
+		"request_timeout":    1500,
+	}
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+	if err = os.WriteFile(configPath, data, 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+
+	if cfg.HeartbeatInterval.Duration() != 30*time.Second {
+		t.Fatalf("unexpected heartbeat interval: %s", cfg.HeartbeatInterval)
+	}
+	if cfg.RequestTimeout.Duration() != 1500*time.Millisecond {
+		t.Fatalf("unexpected request timeout: %s", cfg.RequestTimeout)
+	}
+}
+
+func TestSavePersistsMillisecondsAndOmitsRuntimeVersions(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	if err := os.WriteFile(configPath, []byte(`{"server_url":"http://127.0.0.1:3000","agent_token":"token","node_name":"edge-01","node_ip":"10.0.0.8"}`), 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+	cfg.ExtVersion = "1.27.1.2"
+	cfg.HeartbeatInterval = MillisecondDuration(5 * time.Second)
+	cfg.RequestTimeout = MillisecondDuration(7 * time.Second)
+	cfg.OpenrestyResolvers = []string{"10.0.0.2", "1.1.1.1"}
+
+	if err = cfg.Save(); err != nil {
+		t.Fatalf("Save failed: %v", err)
+	}
+
+	data, err := os.ReadFile(configPath)
+	if err != nil {
+		t.Fatalf("failed to read saved config: %v", err)
+	}
+	var decoded map[string]any
+	if err = json.Unmarshal(data, &decoded); err != nil {
+		t.Fatalf("failed to decode saved config: %v", err)
+	}
+	if _, ok := decoded["agent_version"]; ok {
+		t.Fatal("agent_version should not be persisted")
+	}
+	if _, ok := decoded["nginx_version"]; ok {
+		t.Fatal("nginx_version should not be persisted")
+	}
+	if decoded["heartbeat_interval"] != float64(5000) {
+		t.Fatalf("unexpected heartbeat interval: %#v", decoded["heartbeat_interval"])
+	}
+	if decoded["request_timeout"] != float64(7000) {
+		t.Fatalf("unexpected request timeout: %#v", decoded["request_timeout"])
+	}
+	resolvers, ok := decoded["openresty_resolvers"].([]any)
+	if !ok || len(resolvers) != 2 || resolvers[0] != "10.0.0.2" || resolvers[1] != "1.1.1.1" {
+		t.Fatalf("unexpected resolvers: %#v", decoded["openresty_resolvers"])
+	}
+	if decoded["openresty_observability_port"] != float64(defaultOpenRestyObservabilityPort) {
+		t.Fatalf("unexpected observability port: %#v", decoded["openresty_observability_port"])
+	}
+	if decoded["observability_replay_minutes"] != float64(defaultObservabilityReplayMinutes) {
+		t.Fatalf("unexpected observability replay minutes: %#v", decoded["observability_replay_minutes"])
+	}
+	if _, ok := decoded["nginx_path"]; ok {
+		t.Fatal("legacy nginx_path should not be persisted")
+	}
+}
+
+func TestInitialAuthToken(t *testing.T) {
+	tests := []struct {
+		name           string
+		agentToken     string
+		discoveryToken string
+		expected       string
+	}{
+		{
+			name:           "prefer agent token",
+			agentToken:     "agent-token",
+			discoveryToken: "discovery-token",
+			expected:       "agent-token",
+		},
+		{
+			name:           "fallback to discovery token",
+			agentToken:     "   ",
+			discoveryToken: "discovery-token",
+			expected:       "discovery-token",
+		},
+		{
+			name:           "nil config returns empty string",
+			agentToken:     "",
+			discoveryToken: "",
+			expected:       "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var cfg *Config
+			if tt.name != "nil config returns empty string" {
+				cfg = &Config{
+					AccessToken:    tt.agentToken,
+					DiscoveryToken: tt.discoveryToken,
+				}
+			}
+			if token := cfg.InitialAuthToken(); token != tt.expected {
+				t.Fatalf("unexpected initial auth token: %q", token)
+			}
+		})
+	}
+}
+
+func TestNodeIPPriority(t *testing.T) {
+	tests := []struct {
+		name     string
+		ip       string
+		expected int
+	}{
+		{
+			name:     "public ipv4 preferred",
+			ip:       "8.8.8.8",
+			expected: 2,
+		},
+		{
+			name:     "private ipv4 fallback",
+			ip:       "10.0.0.8",
+			expected: 1,
+		},
+		{
+			name:     "link local ignored",
+			ip:       "169.254.1.10",
+			expected: -1,
+		},
+		{
+			name:     "loopback ignored",
+			ip:       "127.0.0.1",
+			expected: -1,
+		},
+		{
+			name:     "nil ignored",
+			ip:       "",
+			expected: -1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var parsed net.IP
+			if tt.ip != "" {
+				parsed = net.ParseIP(tt.ip)
+			}
+			if got := nodeIPPriority(parsed); got != tt.expected {
+				t.Fatalf("unexpected priority for %q: got %d want %d", tt.ip, got, tt.expected)
+			}
+		})
+	}
+}

openflare-agent/internal/config/duration.go

@@ -0,0 +1,54 @@
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type MillisecondDuration time.Duration
+
+func (d MillisecondDuration) Duration() time.Duration {
+	return time.Duration(d)
+}
+
+func (d MillisecondDuration) String() string {
+	return time.Duration(d).String()
+}
+
+func (d *MillisecondDuration) UnmarshalJSON(data []byte) error {
+	raw := strings.TrimSpace(string(data))
+	if raw == "" || raw == "null" {
+		*d = 0
+		return nil
+	}
+	if strings.HasPrefix(raw, "\"") {
+		var text string
+		if err := json.Unmarshal(data, &text); err != nil {
+			return err
+		}
+		text = strings.TrimSpace(text)
+		if text == "" {
+			*d = 0
+			return nil
+		}
+		parsed, err := time.ParseDuration(text)
+		if err != nil {
+			return fmt.Errorf("invalid duration string %q: %w", text, err)
+		}
+		*d = MillisecondDuration(parsed)
+		return nil
+	}
+	ms, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil {
+		return fmt.Errorf("invalid duration milliseconds %q: %w", raw, err)
+	}
+	*d = MillisecondDuration(time.Duration(ms) * time.Millisecond)
+	return nil
+}
+
+func (d MillisecondDuration) MarshalJSON() ([]byte, error) {
+	return json.Marshal(time.Duration(d).Milliseconds())
+}

openflare-agent/internal/config/version.go

@@ -0,0 +1,3 @@
+package config
+
+var Version = "dev"