[优化] go 引用调整

2026-10-04 15:06:37 +08:00 · 2026-06-06 10:26:20 +08:00
parent ee1110b752
commit 3cfefb4367
552 changed files with 1642 additions and 2185 deletions
@@ -0,0 +1,968 @@
+package nginx
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/rain-kl/openflare/openflare-agent/internal/protocol"
+)
+
+type runCall struct {
+	name string
+	args []string
+}
+
+type fakeRunner struct {
+	calls []runCall
+	runFn func(name string, args ...string) ([]byte, error)
+}
+
+type fakeExecutor struct {
+	testErr   error
+	reloadErr error
+}
+
+type scriptedExecutor struct {
+	testErrors   []error
+	testCalls    int
+	reloadErrors []error
+	reloadCalls  int
+}
+
+func (r *fakeRunner) Run(ctx context.Context, name string, args ...string) ([]byte, error) {
+	r.calls = append(r.calls, runCall{name: name, args: append([]string{}, args...)})
+	if r.runFn != nil {
+		return r.runFn(name, args...)
+	}
+	return nil, nil
+}
+
+func (e *fakeExecutor) Test(ctx context.Context) error {
+	return e.testErr
+}
+
+func (e *fakeExecutor) Reload(ctx context.Context) error {
+	return e.reloadErr
+}
+
+func (e *fakeExecutor) EnsureRuntime(ctx context.Context, recreate bool) error {
+	return nil
+}
+
+func (e *fakeExecutor) CheckHealth(ctx context.Context) error {
+	return e.testErr
+}
+
+func (e *fakeExecutor) Restart(ctx context.Context) error {
+	return e.reloadErr
+}
+
+func (e *scriptedExecutor) Test(ctx context.Context) error {
+	index := e.testCalls
+	e.testCalls++
+	if index >= len(e.testErrors) {
+		return nil
+	}
+	return e.testErrors[index]
+}
+
+func (e *scriptedExecutor) Reload(ctx context.Context) error {
+	index := e.reloadCalls
+	e.reloadCalls++
+	if index >= len(e.reloadErrors) {
+		return nil
+	}
+	return e.reloadErrors[index]
+}
+
+func (e *scriptedExecutor) EnsureRuntime(ctx context.Context, recreate bool) error {
+	return nil
+}
+
+func (e *scriptedExecutor) CheckHealth(ctx context.Context) error {
+	return nil
+}
+
+func (e *scriptedExecutor) Restart(ctx context.Context) error {
+	return nil
+}
+
+func TestPathExecutorCommands(t *testing.T) {
+	runner := &fakeRunner{}
+	executor := &PathExecutor{
+		Path:       "/usr/local/openresty/nginx/sbin/openresty",
+		ConfigPath: "/data/etc/nginx/nginx.conf",
+		Runner:     runner,
+	}
+
+	if err := executor.Test(context.Background()); err != nil {
+		t.Fatalf("Test failed: %v", err)
+	}
+	if err := executor.Reload(context.Background()); err != nil {
+		t.Fatalf("Reload failed: %v", err)
+	}
+
+	expected := []runCall{
+		{name: "/usr/local/openresty/nginx/sbin/openresty", args: []string{"-t", "-c", "/data/etc/nginx/nginx.conf"}},
+		{name: "/usr/local/openresty/nginx/sbin/openresty", args: []string{"-s", "reload", "-c", "/data/etc/nginx/nginx.conf"}},
+	}
+	if !reflect.DeepEqual(runner.calls, expected) {
+		t.Fatalf("unexpected calls: %#v", runner.calls)
+	}
+}
+
+func TestPathExecutorEnsureRuntimeNoop(t *testing.T) {
+	runner := &fakeRunner{}
+	executor := &PathExecutor{
+		Path:       "/usr/local/openresty/nginx/sbin/openresty",
+		ConfigPath: "/data/etc/nginx/nginx.conf",
+		Runner:     runner,
+	}
+	if err := executor.EnsureRuntime(context.Background(), true); err != nil {
+		t.Fatalf("EnsureRuntime failed: %v", err)
+	}
+	if len(runner.calls) != 2 {
+		t.Fatalf("expected test and reload calls, got %d", len(runner.calls))
+	}
+}
+
+func TestPathExecutorRestartIgnoresMissingPID(t *testing.T) {
+	runner := &fakeRunner{
+		runFn: func(name string, args ...string) ([]byte, error) {
+			if len(args) == 2 && args[0] == "-s" && args[1] == "quit" {
+				return []byte("openresty: [error] invalid PID number \"\" in \"/usr/local/openresty/nginx/logs/nginx.pid\""), errors.New("exit status 1")
+			}
+			return []byte(""), nil
+		},
+	}
+	executor := &PathExecutor{
+		Path:       "/usr/local/openresty/nginx/sbin/openresty",
+		ConfigPath: "/data/etc/nginx/nginx.conf",
+		Runner:     runner,
+	}
+	if err := executor.Restart(context.Background()); err != nil {
+		t.Fatalf("Restart failed: %v", err)
+	}
+	if len(runner.calls) != 2 {
+		t.Fatalf("expected 2 restart calls, got %d", len(runner.calls))
+	}
+}
+
+func TestPathExecutorReloadStartsWhenRuntimeIsNotRunning(t *testing.T) {
+	runner := &fakeRunner{
+		runFn: func(name string, args ...string) ([]byte, error) {
+			if len(args) >= 2 && args[0] == "-s" && args[1] == "reload" {
+				return []byte("openresty: [error] invalid PID number \"\" in \"/usr/local/openresty/nginx/logs/nginx.pid\""), errors.New("exit status 1")
+			}
+			return []byte(""), nil
+		},
+	}
+	executor := &PathExecutor{
+		Path:       "/usr/local/openresty/nginx/sbin/openresty",
+		ConfigPath: "/data/etc/nginx/nginx.conf",
+		Runner:     runner,
+	}
+	if err := executor.Reload(context.Background()); err != nil {
+		t.Fatalf("Reload failed: %v", err)
+	}
+	expected := []runCall{
+		{name: "/usr/local/openresty/nginx/sbin/openresty", args: []string{"-s", "reload", "-c", "/data/etc/nginx/nginx.conf"}},
+		{name: "/usr/local/openresty/nginx/sbin/openresty", args: []string{"-c", "/data/etc/nginx/nginx.conf"}},
+	}
+	if !reflect.DeepEqual(runner.calls, expected) {
+		t.Fatalf("unexpected calls: %#v", runner.calls)
+	}
+}
+
+func TestDetectVersionFromBinary(t *testing.T) {
+	version, err := detectVersion(context.Background(), ExecutorOptions{
+		NginxPath: "/usr/local/openresty/nginx/sbin/openresty",
+	}, &fakeRunner{
+		runFn: func(name string, args ...string) ([]byte, error) {
+			return []byte("nginx version: openresty/1.27.1.2\n"), nil
+		},
+	})
+	if err != nil {
+		t.Fatalf("detectVersion failed: %v", err)
+	}
+	if version != "1.27.1.2" {
+		t.Fatalf("unexpected version: %s", version)
+	}
+}
+
+func TestManagerApplyAndChecksumIncludeMainConfig(t *testing.T) {
+	tempDir := t.TempDir()
+	mainPath := filepath.Join(tempDir, "nginx.conf")
+	routePath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
+	certDir := filepath.Join(tempDir, "certs")
+	accessLogPath := filepath.Join(tempDir, "var", "log", "openflare", "access.log")
+	manager := &Manager{
+		MainConfigPath:  mainPath,
+		RouteConfigPath: routePath,
+		AccessLogPath:   accessLogPath,
+		CertDir:         certDir,
+		NginxCertDir:    "/etc/nginx/openflare-certs",
+		LuaDir:          filepath.Join(tempDir, "lua"),
+		NginxLuaDir:     "/etc/nginx/openflare-lua",
+		Executor:        &fakeExecutor{},
+	}
+
+	outcome := manager.Apply(
+		context.Background(),
+		"include __OPENFLARE_ROUTE_CONFIG__;\naccess_log __OPENFLARE_ACCESS_LOG__ openflare_json;\n",
+		"ssl_certificate __OPENFLARE_CERT_DIR__/1.crt;\n",
+		[]protocol.SupportFile{{Path: "1.crt", Content: "cert"}},
+	)
+	if outcome.Status != ApplyStatusSuccess {
+		t.Fatalf("Apply failed: %#v", outcome)
+	}
+
+	mainData, err := os.ReadFile(mainPath)
+	if err != nil {
+		t.Fatalf("failed to read main config: %v", err)
+	}
+	expectedMain := "include " + routePath + ";\naccess_log " + filepath.ToSlash(accessLogPath) + " openflare_json;\n"
+	if string(mainData) != expectedMain {
+		t.Fatalf("unexpected main config: %s", string(mainData))
+	}
+
+	routeData, err := os.ReadFile(routePath)
+	if err != nil {
+		t.Fatalf("failed to read route config: %v", err)
+	}
+	if string(routeData) != "ssl_certificate /etc/nginx/openflare-certs/1.crt;\n" {
+		t.Fatalf("unexpected route config: %s", string(routeData))
+	}
+
+	value, err := manager.CurrentChecksum()
+	if err != nil {
+		t.Fatalf("CurrentChecksum failed: %v", err)
+	}
+	expected := bundleChecksum(
+		"include __OPENFLARE_ROUTE_CONFIG__;\naccess_log __OPENFLARE_ACCESS_LOG__ openflare_json;\n",
+		"ssl_certificate __OPENFLARE_CERT_DIR__/1.crt;\n",
+		[]protocol.SupportFile{{Path: "1.crt", Content: "cert"}},
+	)
+	if value != expected {
+		t.Fatalf("unexpected checksum: got %s want %s", value, expected)
+	}
+}
+
+func TestParseExtVersionIgnoresDockerEntrypointPaths(t *testing.T) {
+	output := strings.Join([]string{
+		"/docker-entrypoint.sh: /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh: info: can not modify /etc/nginx/conf.d/default.conf (read-only file system?)",
+		"nginx version: openresty/1.27.1.2",
+	}, "\n")
+
+	version := parseExtVersion(output)
+	if version != "1.27.1.2" {
+		t.Fatalf("unexpected version: %s", version)
+	}
+}
+
+func TestManagerApplyWritesSupportFilesAndReplacesPlaceholder(t *testing.T) {
+	tempDir := t.TempDir()
+	manager := &Manager{
+		MainConfigPath:               filepath.Join(tempDir, "nginx.conf"),
+		RouteConfigPath:              filepath.Join(tempDir, "routes.conf"),
+		CertDir:                      filepath.Join(tempDir, "certs"),
+		NginxCertDir:                 "/etc/nginx/openflare-certs",
+		LuaDir:                       filepath.Join(tempDir, "lua"),
+		NginxLuaDir:                  "/etc/nginx/openflare-lua",
+		OpenrestyObservabilityListen: "18081",
+		OpenrestyResolverDirective:   "    resolver 127.0.0.11 valid=30s ipv6=off;\n    resolver_timeout 5s;\n",
+		Executor:                     &fakeExecutor{},
+	}
+
+	outcome := manager.Apply(context.Background(), "include __OPENFLARE_ROUTE_CONFIG__;\n__OPENFLARE_RESOLVER_DIRECTIVE__server { listen __OPENFLARE_OBSERVABILITY_LISTEN__; }", "ssl_certificate __OPENFLARE_CERT_DIR__/1.crt;", []protocol.SupportFile{
+		{Path: "1.crt", Content: "cert-data"},
+		{Path: "1.key", Content: "key-data"},
+	})
+	if outcome.Status != ApplyStatusSuccess {
+		t.Fatalf("Apply failed: %#v", outcome)
+	}
+
+	routeData, err := os.ReadFile(manager.RouteConfigPath)
+	if err != nil {
+		t.Fatalf("failed to read route config: %v", err)
+	}
+	if !strings.Contains(string(routeData), "/etc/nginx/openflare-certs/1.crt") {
+		t.Fatalf("expected placeholder replacement in route config, got %s", string(routeData))
+	}
+	renderedRoute := manager.renderRouteConfig("access_by_lua_file __OPENFLARE_LUA_DIR__/pow/check.lua;\nlocation /.within.website/x/cmd/anubis/static/ { alias __OPENFLARE_POW_STATIC_DIR__/; }\n")
+	if !strings.Contains(renderedRoute, "access_by_lua_file /etc/nginx/openflare-lua/pow/check.lua;") {
+		t.Fatalf("expected lua dir placeholder replacement in route config, got %s", renderedRoute)
+	}
+	if !strings.Contains(renderedRoute, "alias /etc/nginx/openflare-lua/pow/static/;") {
+		t.Fatalf("expected pow static dir placeholder replacement in route config, got %s", renderedRoute)
+	}
+	mainData, err := os.ReadFile(manager.MainConfigPath)
+	if err != nil {
+		t.Fatalf("failed to read main config: %v", err)
+	}
+	if !strings.Contains(string(mainData), "listen 18081;") {
+		t.Fatalf("expected observability listen placeholder replacement in main config, got %s", string(mainData))
+	}
+	if !strings.Contains(string(mainData), "resolver 127.0.0.11 valid=30s ipv6=off;") {
+		t.Fatalf("expected resolver directive placeholder replacement in main config, got %s", string(mainData))
+	}
+	certData, err := os.ReadFile(filepath.Join(manager.CertDir, "1.crt"))
+	if err != nil {
+		t.Fatalf("failed to read cert file: %v", err)
+	}
+	if string(certData) != "cert-data" {
+		t.Fatalf("unexpected cert file content: %s", string(certData))
+	}
+	luaInfo, err := os.Stat(filepath.Join(manager.LuaDir, "log.lua"))
+	if err != nil {
+		t.Fatalf("expected managed lua file to exist, stat err = %v", err)
+	}
+	if runtime.GOOS != "windows" && luaInfo.Mode().Perm() != 0o644 {
+		t.Fatalf("unexpected lua mode: %o", luaInfo.Mode().Perm())
+	}
+}
+
+func TestManagerCheckHealthUsesStubStatusInsteadOfConfigTest(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("Listen failed: %v", err)
+	}
+	port := listener.Addr().(*net.TCPAddr).Port
+	server := &http.Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path != "/openflare/stub_status" {
+				http.NotFound(w, r)
+				return
+			}
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte("Active connections: 1\n"))
+		}),
+	}
+	go func() {
+		_ = server.Serve(listener)
+	}()
+	defer server.Shutdown(context.Background())
+
+	mainPath := filepath.Join(t.TempDir(), "nginx.conf")
+	if err := os.WriteFile(mainPath, []byte("main"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	manager := &Manager{
+		MainConfigPath:             mainPath,
+		OpenrestyObservabilityPort: port,
+		Executor: &fakeExecutor{
+			testErr: errors.New("openresty -t should not be called"),
+		},
+	}
+	if err := manager.CheckHealth(context.Background()); err != nil {
+		t.Fatalf("CheckHealth failed: %v", err)
+	}
+}
+
+func TestManagerCheckHealthFailsWhenStubStatusUnavailable(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("Listen failed: %v", err)
+	}
+	port := listener.Addr().(*net.TCPAddr).Port
+	if err := listener.Close(); err != nil {
+		t.Fatalf("listener close failed: %v", err)
+	}
+
+	mainPath := filepath.Join(t.TempDir(), "nginx.conf")
+	if err := os.WriteFile(mainPath, []byte("main"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	manager := &Manager{
+		MainConfigPath:             mainPath,
+		OpenrestyObservabilityPort: port,
+		Executor:                   &fakeExecutor{},
+	}
+	if err := manager.CheckHealth(context.Background()); err == nil {
+		t.Fatal("expected CheckHealth to fail when stub_status is unavailable")
+	}
+}
+
+func TestResolverDirectiveUsesExplicitResolvers(t *testing.T) {
+	got := ResolverDirective([]string{"10.0.0.2", "1.1.1.1"})
+	if !strings.Contains(got, "resolver 10.0.0.2 1.1.1.1") {
+		t.Fatalf("expected explicit resolver directive, got %q", got)
+	}
+}
+
+func TestParseResolverAddressesFiltersLoopbackForDocker(t *testing.T) {
+	content := strings.Join([]string{
+		"nameserver 127.0.0.53",
+		"nameserver 10.0.0.2",
+		"nameserver ::1",
+		"nameserver 1.1.1.1",
+	}, "\n")
+	got := parseResolverAddresses(content, true)
+	expected := []string{"10.0.0.2", "1.1.1.1"}
+	if !reflect.DeepEqual(got, expected) {
+		t.Fatalf("unexpected docker resolvers: got %#v want %#v", got, expected)
+	}
+}
+
+func TestParseResolverAddressesKeepsLoopbackForLocalBinary(t *testing.T) {
+	content := strings.Join([]string{
+		"nameserver 127.0.0.53",
+		"nameserver 10.0.0.2",
+	}, "\n")
+	got := parseResolverAddresses(content, false)
+	expected := []string{"127.0.0.53", "10.0.0.2"}
+	if !reflect.DeepEqual(got, expected) {
+		t.Fatalf("unexpected local resolvers: got %#v want %#v", got, expected)
+	}
+}
+
+func TestRequiresRuntimeResolver(t *testing.T) {
+	testCases := []struct {
+		name      string
+		originURL string
+		want      bool
+	}{
+		{name: "hostname", originURL: "https://origin.internal", want: true},
+		{name: "ipv4", originURL: "https://10.0.0.8", want: false},
+		{name: "ipv6", originURL: "https://[2001:db8::1]", want: false},
+		{name: "invalid", originURL: "://bad", want: false},
+	}
+
+	for _, testCase := range testCases {
+		if got := RequiresRuntimeResolver(testCase.originURL); got != testCase.want {
+			t.Fatalf("%s: got %v want %v", testCase.name, got, testCase.want)
+		}
+	}
+}
+
+func TestWriteCertFilesKeepsBaseDirAndRemovesStaleFiles(t *testing.T) {
+	tempDir := t.TempDir()
+	certDir := filepath.Join(tempDir, "certs")
+	if err := os.MkdirAll(filepath.Join(certDir, "stale"), 0o755); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(certDir, "stale", "old.crt"), []byte("old"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	manager := &Manager{CertDir: certDir}
+
+	if err := manager.writeCertFiles([]protocol.SupportFile{
+		{Path: "1.crt", Content: "cert"},
+		{Path: "1.key", Content: "key"},
+	}); err != nil {
+		t.Fatalf("writeCertFiles failed: %v", err)
+	}
+
+	if _, err := os.Stat(certDir); err != nil {
+		t.Fatalf("expected cert dir to persist, stat err = %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(certDir, "stale", "old.crt")); !os.IsNotExist(err) {
+		t.Fatalf("expected stale cert file to be removed, stat err = %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(certDir, "1.crt")); err != nil {
+		t.Fatalf("expected new cert file to exist, stat err = %v", err)
+	}
+}
+
+func TestEnsureLuaAssetsKeepsBaseDirAndRemovesStaleFiles(t *testing.T) {
+	tempDir := t.TempDir()
+	luaDir := filepath.Join(tempDir, "lua")
+	if err := os.MkdirAll(filepath.Join(luaDir, "stale"), 0o755); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(luaDir, "stale", "old.lua"), []byte("old"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	manager := &Manager{LuaDir: luaDir}
+
+	if err := manager.EnsureLuaAssets(); err != nil {
+		t.Fatalf("EnsureLuaAssets failed: %v", err)
+	}
+
+	if _, err := os.Stat(luaDir); err != nil {
+		t.Fatalf("expected lua dir to persist, stat err = %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(luaDir, "stale", "old.lua")); !os.IsNotExist(err) {
+		t.Fatalf("expected stale lua file to be removed, stat err = %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(luaDir, "log.lua")); err != nil {
+		t.Fatalf("expected managed lua file to exist, stat err = %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(luaDir, "pow", "check.lua")); err != nil {
+		t.Fatalf("expected managed pow lua file to exist, stat err = %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(luaDir, "pow", "static", "js", "main.mjs")); err != nil {
+		t.Fatalf("expected managed pow static asset to exist, stat err = %v", err)
+	}
+}
+
+func TestCertFileMode(t *testing.T) {
+	testCases := []struct {
+		path string
+		want os.FileMode
+	}{
+		{path: "1.crt", want: 0o644},
+		{path: "1.pem", want: 0o644},
+		{path: "1.key", want: 0o600},
+		{path: "misc.txt", want: 0o644},
+	}
+
+	for _, testCase := range testCases {
+		if got := certFileMode(testCase.path); got != testCase.want {
+			t.Fatalf("unexpected mode for %s: got %o want %o", testCase.path, got, testCase.want)
+		}
+	}
+}
+
+func TestManagerEnsureLuaAssetsWritesReadableFiles(t *testing.T) {
+	tempDir := t.TempDir()
+	manager := &Manager{
+		LuaDir:           filepath.Join(tempDir, "lua"),
+		NginxLuaDir:      "/etc/nginx/openflare-lua",
+		RuntimeConfigDir: filepath.Join(tempDir, "runtime"),
+	}
+
+	err := manager.EnsureLuaAssets()
+	if err != nil {
+		t.Fatalf("EnsureLuaAssets failed: %v", err)
+	}
+
+	luaInfo, err := os.Stat(filepath.Join(manager.LuaDir, "log.lua"))
+	if err != nil {
+		t.Fatalf("failed to stat lua file: %v", err)
+	}
+	if luaInfo.Mode().Perm() != 0o644 {
+		t.Fatalf("unexpected lua mode: %o", luaInfo.Mode().Perm())
+	}
+	if _, err := os.Stat(filepath.Join(manager.LuaDir, "pow", "check.lua")); err != nil {
+		t.Fatalf("failed to stat pow lua file: %v", err)
+	}
+	data, err := os.ReadFile(filepath.Join(manager.LuaDir, "pow", "runtime.lua"))
+	if err != nil {
+		t.Fatalf("failed to read pow lua file: %v", err)
+	}
+	if !strings.Contains(string(data), filepath.ToSlash(manager.RuntimeConfigDir)+"/waf_config.json") {
+		t.Fatalf("expected pow lua to read runtime config dir, got %s", string(data))
+	}
+}
+
+func TestEnsureLuaAssetsLeavesRuntimePowConfigOutsideLuaDir(t *testing.T) {
+	tempDir := t.TempDir()
+	luaDir := filepath.Join(tempDir, "lua")
+	runtimeConfigDir := filepath.Join(tempDir, "runtime")
+	if err := os.MkdirAll(runtimeConfigDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	powConfigPath := filepath.Join(runtimeConfigDir, "pow_config.json")
+	want := `[{"domains":["pow.example.com"],"enabled":true}]`
+	if err := os.WriteFile(powConfigPath, []byte(want), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	manager := &Manager{LuaDir: luaDir, RuntimeConfigDir: runtimeConfigDir}
+
+	if err := manager.EnsureLuaAssets(); err != nil {
+		t.Fatalf("EnsureLuaAssets failed: %v", err)
+	}
+
+	got, err := os.ReadFile(powConfigPath)
+	if err != nil {
+		t.Fatalf("expected pow_config.json to remain after EnsureLuaAssets: %v", err)
+	}
+	if string(got) != want {
+		t.Fatalf("unexpected pow_config.json content: got %s want %s", string(got), want)
+	}
+	if _, err := os.Stat(filepath.Join(luaDir, "pow_config.json")); !os.IsNotExist(err) {
+		t.Fatalf("expected lua pow_config.json to stay absent, stat err = %v", err)
+	}
+}
+
+func TestManagerApplyWritesPowConfigToRuntimeDirAndCleansLegacyCopies(t *testing.T) {
+	tempDir := t.TempDir()
+	certDir := filepath.Join(tempDir, "certs")
+	luaDir := filepath.Join(tempDir, "lua")
+	runtimeConfigDir := filepath.Join(tempDir, "runtime")
+	for _, dir := range []string{certDir, luaDir, runtimeConfigDir} {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatalf("MkdirAll failed: %v", err)
+		}
+	}
+	for _, path := range []string{filepath.Join(certDir, "pow_config.json"), filepath.Join(luaDir, "pow_config.json")} {
+		if err := os.WriteFile(path, []byte("stale"), 0o644); err != nil {
+			t.Fatalf("WriteFile failed: %v", err)
+		}
+	}
+	manager := &Manager{
+		MainConfigPath:   filepath.Join(tempDir, "nginx.conf"),
+		RouteConfigPath:  filepath.Join(tempDir, "routes.conf"),
+		CertDir:          certDir,
+		LuaDir:           luaDir,
+		RuntimeConfigDir: runtimeConfigDir,
+		Executor:         &fakeExecutor{},
+	}
+	outcome := manager.Apply(context.Background(), "main", "route", []protocol.SupportFile{
+		{Path: "pow_config.json", Content: "runtime"},
+	})
+	if outcome.Status != ApplyStatusSuccess {
+		t.Fatalf("Apply failed: %#v", outcome)
+	}
+	data, err := os.ReadFile(filepath.Join(runtimeConfigDir, "pow_config.json"))
+	if err != nil {
+		t.Fatalf("failed to read runtime pow config: %v", err)
+	}
+	if string(data) != "runtime" {
+		t.Fatalf("unexpected runtime pow config: %s", string(data))
+	}
+	for _, path := range []string{filepath.Join(certDir, "pow_config.json"), filepath.Join(luaDir, "pow_config.json")} {
+		if _, err := os.Stat(path); !os.IsNotExist(err) {
+			t.Fatalf("expected legacy pow config to be removed from %s, stat err = %v", path, err)
+		}
+	}
+}
+
+func TestManagerCurrentChecksumIncludesPowConfig(t *testing.T) {
+	tempDir := t.TempDir()
+	mainPath := filepath.Join(tempDir, "nginx.conf")
+	routePath := filepath.Join(tempDir, "routes.conf")
+	luaDir := filepath.Join(tempDir, "lua")
+	runtimeConfigDir := filepath.Join(tempDir, "runtime")
+	manager := &Manager{
+		MainConfigPath:   mainPath,
+		RouteConfigPath:  routePath,
+		LuaDir:           luaDir,
+		NginxLuaDir:      "/etc/nginx/openflare-lua",
+		RuntimeConfigDir: runtimeConfigDir,
+		Executor:         &fakeExecutor{},
+	}
+
+	outcome := manager.Apply(
+		context.Background(),
+		"access_log __OPENFLARE_ACCESS_LOG__ openflare_json;\n",
+		"location /.within.website/x/cmd/anubis/static/ { alias __OPENFLARE_POW_STATIC_DIR__/; }\n",
+		[]protocol.SupportFile{{Path: "pow_config.json", Content: `[{"domains":["pow.example.com"],"enabled":true}]`}},
+	)
+	if outcome.Status != ApplyStatusSuccess {
+		t.Fatalf("Apply failed: %#v", outcome)
+	}
+
+	value, err := manager.CurrentChecksum()
+	if err != nil {
+		t.Fatalf("CurrentChecksum failed: %v", err)
+	}
+	expected := bundleChecksum(
+		"access_log __OPENFLARE_ACCESS_LOG__ openflare_json;\n",
+		"location /.within.website/x/cmd/anubis/static/ { alias __OPENFLARE_POW_STATIC_DIR__/; }\n",
+		[]protocol.SupportFile{{Path: "pow_config.json", Content: `[{"domains":["pow.example.com"],"enabled":true}]`}},
+	)
+	if value != expected {
+		t.Fatalf("unexpected checksum with pow config: got %s want %s", value, expected)
+	}
+}
+
+func TestManagedPowLuaFilesUseInternalChallengeFlow(t *testing.T) {
+	if !strings.Contains(openRestyPowRuntimeLua, `return ngx.exec("/.within.website/x/cmd/anubis/api/make-challenge")`) {
+		t.Fatal("expected pow runtime lua to internally execute make-challenge instead of issuing a 302 redirect")
+	}
+	if strings.Contains(openRestyPowRuntimeLua, "ngx.redirect(") {
+		t.Fatal("expected pow runtime lua to avoid external redirects for challenge rendering")
+	}
+	if !strings.Contains(openRestyPowChallengeLua, `<h1 id="title" class="centered-div">`) {
+		t.Fatal("expected challenge html to include Anubis-compatible title node")
+	}
+	if !strings.Contains(openRestyPowChallengeLua, `<div id="progress" role="progressbar" aria-labelledby="status"><div class="bar-inner"></div></div>`) {
+		t.Fatal("expected challenge html to include Anubis-compatible progress markup")
+	}
+	if !strings.Contains(openRestyPowChallengeLua, `<script id="anubis_public_url" type="application/json">"__openflare_internal__"</script>`) {
+		t.Fatal("expected challenge html to force Anubis frontend to reuse the current URL as redir target")
+	}
+	if !strings.Contains(openRestyPowRuntimeLua, `pow_sessions:set(session_key, "1", session_ttl)`) {
+		t.Fatal("expected pow runtime lua to refresh the PoW session TTL on each valid request")
+	}
+	if !strings.Contains(openRestyPowRuntimeLua, `ngx.header["Set-Cookie"] = session_cookie(cookie_val, session_ttl)`) {
+		t.Fatal("expected pow runtime lua to refresh the browser session cookie on each valid request")
+	}
+	if !strings.Contains(openRestyPowChallengeLua, `local session_ttl = config.session_ttl or 600`) {
+		t.Fatal("expected challenge.lua to default session TTL to 10 minutes")
+	}
+	if !strings.Contains(openRestyPowVerifyLua, `local session_ttl = challenge_info.session_ttl or 600`) {
+		t.Fatal("expected verify.lua to default session TTL to 10 minutes")
+	}
+	if !strings.Contains(openRestyPowVerifyLua, `if ngx.var.scheme == "https" then`) {
+		t.Fatal("expected verify.lua to only mark the session cookie as Secure for HTTPS requests")
+	}
+}
+
+func TestManagedWAFLuaTreatsWhitelistAsAllowlist(t *testing.T) {
+	if !strings.Contains(openRestyWAFRuntimeLua, "local function first_allowlist_group(groups)") {
+		t.Fatal("expected waf runtime to detect allowlist rule groups")
+	}
+	if !strings.Contains(openRestyWAFRuntimeLua, "local allowlist_group = first_allowlist_group(groups)") {
+		t.Fatal("expected waf runtime to enter allowlist mode when whitelist rules exist")
+	}
+	if !strings.Contains(openRestyWAFRuntimeLua, "return exit_with_group(allowlist_group)") {
+		t.Fatal("expected waf runtime to block requests that miss configured whitelists")
+	}
+}
+
+func TestManagerRollbackRestoresCertFiles(t *testing.T) {
+	tempDir := t.TempDir()
+	routePath := filepath.Join(tempDir, "routes.conf")
+	mainPath := filepath.Join(tempDir, "nginx.conf")
+	certDir := filepath.Join(tempDir, "certs")
+	if err := os.MkdirAll(certDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	if err := os.WriteFile(mainPath, []byte("old-main"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	if err := os.WriteFile(routePath, []byte("old-route"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(certDir, "1.crt"), []byte("old-cert"), 0o600); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	manager := &Manager{
+		MainConfigPath:  mainPath,
+		RouteConfigPath: routePath,
+		CertDir:         certDir,
+		NginxCertDir:    "/etc/nginx/openflare-certs",
+		LuaDir:          filepath.Join(tempDir, "lua"),
+		NginxLuaDir:     "/etc/nginx/openflare-lua",
+		Executor: &fakeExecutor{
+			reloadErr: errors.New("openresty reload failed"),
+		},
+	}
+
+	outcome := manager.Apply(context.Background(), "new-main", "new-route", []protocol.SupportFile{
+		{Path: "1.crt", Content: "new-cert"},
+	})
+	if outcome.Status != ApplyStatusFatal {
+		t.Fatalf("expected fatal apply outcome, got %#v", outcome)
+	}
+
+	mainData, err := os.ReadFile(mainPath)
+	if err != nil {
+		t.Fatalf("failed to read main config: %v", err)
+	}
+	if string(mainData) != "old-main" {
+		t.Fatalf("expected main rollback, got %s", string(mainData))
+	}
+	routeData, err := os.ReadFile(routePath)
+	if err != nil {
+		t.Fatalf("failed to read route config: %v", err)
+	}
+	if string(routeData) != "old-route" {
+		t.Fatalf("expected route rollback, got %s", string(routeData))
+	}
+	certData, err := os.ReadFile(filepath.Join(certDir, "1.crt"))
+	if err != nil {
+		t.Fatalf("failed to read cert file: %v", err)
+	}
+	if string(certData) != "old-cert" {
+		t.Fatalf("expected cert rollback, got %s", string(certData))
+	}
+}
+
+func TestManagerApplyReturnsWarningWhenRollbackRecoversRuntime(t *testing.T) {
+	tempDir := t.TempDir()
+	routePath := filepath.Join(tempDir, "routes.conf")
+	mainPath := filepath.Join(tempDir, "nginx.conf")
+	certDir := filepath.Join(tempDir, "certs")
+	if err := os.MkdirAll(certDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	if err := os.WriteFile(mainPath, []byte("old-main"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	if err := os.WriteFile(routePath, []byte("old-route"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(certDir, "1.crt"), []byte("old-cert"), 0o600); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	manager := &Manager{
+		MainConfigPath:  mainPath,
+		RouteConfigPath: routePath,
+		CertDir:         certDir,
+		NginxCertDir:    "/etc/nginx/openflare-certs",
+		LuaDir:          filepath.Join(tempDir, "lua"),
+		NginxLuaDir:     "/etc/nginx/openflare-lua",
+		Executor: &scriptedExecutor{
+			reloadErrors: []error{errors.New("target config failed"), nil},
+		},
+	}
+
+	outcome := manager.Apply(context.Background(), "new-main", "new-route", []protocol.SupportFile{
+		{Path: "1.crt", Content: "new-cert"},
+	})
+	if outcome.Status != ApplyStatusWarning {
+		t.Fatalf("expected warning apply outcome, got %#v", outcome)
+	}
+
+	mainData, err := os.ReadFile(mainPath)
+	if err != nil {
+		t.Fatalf("failed to read main config: %v", err)
+	}
+	if string(mainData) != "old-main" {
+		t.Fatalf("expected main rollback, got %s", string(mainData))
+	}
+}
+
+func TestManagerApplyStartsSafeFallbackWhenNoRollbackConfigExists(t *testing.T) {
+	tempDir := t.TempDir()
+	routePath := filepath.Join(tempDir, "routes.conf")
+	mainPath := filepath.Join(tempDir, "nginx.conf")
+	executor := &scriptedExecutor{
+		testErrors: []error{errors.New("target config failed"), errors.New("rollback config missing"), nil},
+	}
+	manager := &Manager{
+		MainConfigPath:               mainPath,
+		RouteConfigPath:              routePath,
+		OpenrestyObservabilityListen: "127.0.0.1:18081",
+		Executor:                     executor,
+	}
+
+	outcome := manager.Apply(context.Background(), "bad-main", "bad-route", nil)
+	if outcome.Status != ApplyStatusWarning {
+		t.Fatalf("expected warning apply outcome, got %#v", outcome)
+	}
+	if !strings.Contains(outcome.Message, "fallback runtime started") {
+		t.Fatalf("expected fallback message, got %q", outcome.Message)
+	}
+	if executor.testCalls != 3 {
+		t.Fatalf("expected target, rollback, and fallback tests, got %d", executor.testCalls)
+	}
+	mainData, err := os.ReadFile(mainPath)
+	if err != nil {
+		t.Fatalf("failed to read main config: %v", err)
+	}
+	if !strings.Contains(string(mainData), "OpenFlare: No Valid Configuration") {
+		t.Fatalf("expected safe fallback main config, got %s", string(mainData))
+	}
+	if !strings.Contains(string(mainData), "listen 80 default_server") {
+		t.Fatalf("expected fallback to listen on port 80, got %s", string(mainData))
+	}
+	if !strings.Contains(string(mainData), "listen 127.0.0.1:18081") {
+		t.Fatalf("expected fallback to expose local stub_status port, got %s", string(mainData))
+	}
+	if !strings.Contains(string(mainData), "stub_status;") {
+		t.Fatalf("expected fallback to expose stub_status, got %s", string(mainData))
+	}
+	routeData, err := os.ReadFile(routePath)
+	if err != nil {
+		t.Fatalf("failed to read route config: %v", err)
+	}
+	if len(routeData) != 0 {
+		t.Fatalf("expected fallback route config to be empty, got %q", string(routeData))
+	}
+}
+
+func TestManagerCertFileTargetPathRejectsEscapes(t *testing.T) {
+	manager := &Manager{CertDir: filepath.Join(t.TempDir(), "certs")}
+	if err := os.MkdirAll(manager.CertDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+
+	absolutePath := "/tmp/evil.crt"
+	if runtime.GOOS == "windows" {
+		absolutePath = `C:/tmp/evil.crt`
+	}
+
+	testCases := []struct {
+		path      string
+		shouldErr bool
+	}{
+		{path: "nested/1.crt", shouldErr: false},
+		{path: "../escape.crt", shouldErr: true},
+		{path: "..\\escape.crt", shouldErr: true},
+		{path: absolutePath, shouldErr: true},
+		{path: "", shouldErr: true},
+	}
+
+	for _, testCase := range testCases {
+		targetPath, err := manager.certFileTargetPath(testCase.path)
+		if testCase.shouldErr {
+			if err == nil {
+				t.Fatalf("expected path %q to be rejected, got target %q", testCase.path, targetPath)
+			}
+			continue
+		}
+		if err != nil {
+			t.Fatalf("expected path %q to be accepted: %v", testCase.path, err)
+		}
+		if !strings.HasPrefix(targetPath, manager.CertDir) {
+			t.Fatalf("expected target path %q to stay under %q", targetPath, manager.CertDir)
+		}
+	}
+}
+
+func TestManagerApplyRejectsCertFilePathTraversal(t *testing.T) {
+	tempDir := t.TempDir()
+	manager := &Manager{
+		MainConfigPath:  filepath.Join(tempDir, "nginx.conf"),
+		RouteConfigPath: filepath.Join(tempDir, "routes.conf"),
+		CertDir:         filepath.Join(tempDir, "certs"),
+		NginxCertDir:    "/etc/nginx/openflare-certs",
+		LuaDir:          filepath.Join(tempDir, "lua"),
+		NginxLuaDir:     "/etc/nginx/openflare-lua",
+		Executor:        &fakeExecutor{},
+	}
+
+	outcome := manager.Apply(context.Background(), "main", "route", []protocol.SupportFile{
+		{Path: "../escape.crt", Content: "bad"},
+	})
+	if outcome.Status != ApplyStatusWarning {
+		t.Fatalf("expected warning apply outcome, got %#v", outcome)
+	}
+
+	if _, statErr := os.Stat(filepath.Join(tempDir, "escape.crt")); !os.IsNotExist(statErr) {
+		t.Fatalf("expected escaped file to not exist, stat err = %v", statErr)
+	}
+}
+
+func TestManagerSyncWAFIPGroupsWritesDeltaRuntimeFile(t *testing.T) {
+	manager := &Manager{RuntimeConfigDir: t.TempDir()}
+
+	if err := manager.SyncWAFIPGroups([]protocol.WAFIPGroup{
+		{ID: 1, Enabled: true, IPList: []string{"203.0.113.10"}, Checksum: "sum-1"},
+	}); err != nil {
+		t.Fatalf("SyncWAFIPGroups failed: %v", err)
+	}
+	if err := manager.SyncWAFIPGroups([]protocol.WAFIPGroup{
+		{ID: 2, Enabled: true, IPList: []string{"198.51.100.10"}, Checksum: "sum-2"},
+	}); err != nil {
+		t.Fatalf("SyncWAFIPGroups second delta failed: %v", err)
+	}
+
+	checksums, err := manager.WAFIPGroupChecksums()
+	if err != nil {
+		t.Fatalf("WAFIPGroupChecksums failed: %v", err)
+	}
+	if checksums["1"] != "sum-1" || checksums["2"] != "sum-2" {
+		t.Fatalf("expected merged checksums, got %#v", checksums)
+	}
+	data, err := os.ReadFile(filepath.Join(manager.RuntimeConfigDir, WAFIPGroupsConfigFileName))
+	if err != nil {
+		t.Fatalf("failed to read runtime ip group file: %v", err)
+	}
+	text := string(data)
+	if !strings.Contains(text, "203.0.113.10") || !strings.Contains(text, "198.51.100.10") {
+		t.Fatalf("expected runtime file to keep both groups, got %s", text)
+	}
+}
+
+func TestObservabilityListenAddress(t *testing.T) {
+	if got := ObservabilityListenAddress(18081); got != "127.0.0.1:18081" {
+		t.Fatalf("unexpected default observability listen address: %s", got)
+	}
+	if got := ObservabilityListenAddress(18081); got != "127.0.0.1:18081" {
+		t.Fatalf("unexpected path observability listen address: %s", got)
+	}
+}
@@ -0,0 +1,98 @@
+package nginx
+
+const DefaultMimeTypes = `
+types {
+    text/html                                        html htm shtml;
+    text/css                                         css;
+    text/xml                                         xml;
+    image/gif                                        gif;
+    image/jpeg                                       jpeg jpg;
+    application/javascript                           js;
+    application/atom+xml                             atom;
+    application/rss+xml                              rss;
+
+    text/mathml                                      mml;
+    text/plain                                       txt;
+    text/vnd.sun.j2me.app-descriptor                 jad;
+    text/vnd.wap.wml                                 wml;
+    text/x-component                                 htc;
+
+    image/png                                        png;
+    image/svg+xml                                    svg svgz;
+    image/tiff                                       tif tiff;
+    image/vnd.wap.wbmp                               wbmp;
+    image/webp                                       webp;
+    image/x-icon                                     ico;
+    image/x-jng                                      jng;
+    image/x-ms-bmp                                   bmp;
+
+    application/font-woff                            woff;
+    application/java-archive                         jar war ear;
+    application/json                                 json;
+    application/mac-binhex40                         hqx;
+    application/msword                               doc;
+    application/pdf                                  pdf;
+    application/postscript                           ps eps ai;
+    application/rtf                                  rtf;
+    application/vnd.apple.mpegurl                    m3u8;
+    application/vnd.google-earth.kml+xml             kml;
+    application/vnd.google-earth.kmz                 kmz;
+    application/vnd.ms-excel                         xls;
+    application/vnd.ms-fontobject                    eot;
+    application/vnd.ms-powerpoint                    ppt;
+    application/vnd.oasis.opendocument.graphics      odg;
+    application/vnd.oasis.opendocument.presentation  odp;
+    application/vnd.oasis.opendocument.spreadsheet   ods;
+    application/vnd.oasis.opendocument.text          odt;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation
+                                                     pptx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                                                     xlsx;
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                                                     docx;
+    application/vnd.wap.wmlc                         wmlc;
+    application/x-7z-compressed                      7z;
+    application/x-cocoa                              cco;
+    application/x-java-archive-diff                  jardiff;
+    application/x-java-jnlp-file                     jnlp;
+    application/x-makeself                           run;
+    application/x-perl                               pl pm;
+    application/x-pilot                              prc pdb;
+    application/x-rar-compressed                     rar;
+    application/x-redhat-package-manager             rpm;
+    application/x-sea                                sea;
+    application/x-shockwave-flash                    swf;
+    application/x-stuffit                            sit;
+    application/x-tcl                                tcl tk;
+    application/x-x509-ca-cert                       der pem crt;
+    application/x-xpinstall                          xpi;
+    application/xhtml+xml                            xhtml;
+    application/xspf+xml                             xspf;
+    application/zip                                  zip;
+
+    application/octet-stream                         bin exe dll;
+    application/octet-stream                         deb;
+    application/octet-stream                         dmg;
+    application/octet-stream                         iso img;
+    application/octet-stream                         msi msp msm;
+
+    audio/midi                                       mid midi kar;
+    audio/mpeg                                       mp3;
+    audio/ogg                                        ogg;
+    audio/x-m4a                                      m4a;
+    audio/x-realaudio                                ra;
+
+    video/3gpp                                       3gpp 3gp;
+    video/mp2t                                       ts;
+    video/mp4                                        mp4;
+    video/mpeg                                       mpeg mpg;
+    video/quicktime                                  mov;
+    video/webm                                       webm;
+    video/x-flv                                      flv;
+    video/x-m4v                                      m4v;
+    video/x-mng                                      mng;
+    video/x-ms-asf                                   asx asf;
+    video/x-ms-wmv                                   wmv;
+    video/x-msvideo                                  avi;
+}
+`
@@ -0,0 +1,158 @@
+package nginx
+
+import "github.com/rain-kl/openflare/openflare-agent/internal/protocol"
+
+const (
+	openRestyObservabilityWindowTTL  = "7200"
+	openRestyObservabilityWindowSize = "60"
+)
+
+const openRestyObservabilityInitLua = `local dict = ngx.shared.openflare_observability
+if not dict then
+    return
+end
+
+return
+`
+
+const openRestyObservabilityLogLua = `local dict = ngx.shared.openflare_observability
+if not dict then
+    return
+end
+
+local request_uri = tostring(ngx.var.uri or "")
+if request_uri == "/openflare/observability" or request_uri == "/openflare/stub_status" then
+    return
+end
+
+local ttl = ` + openRestyObservabilityWindowTTL + `
+local now = ngx.time()
+local window_size = ` + openRestyObservabilityWindowSize + `
+local window_start = now - (now % window_size)
+
+local function ensure_counter(key)
+    dict:add(key, 0, ttl)
+end
+
+local function incr(key, delta)
+    ensure_counter(key)
+    local value, err = dict:incr(key, delta)
+    if not value and err == "not found" then
+        dict:set(key, delta, ttl)
+    end
+end
+
+local function remember_value(list_key, marker_key, value)
+    if value == "" then
+        return
+    end
+    if not dict:add(marker_key, 1, ttl) then
+        return
+    end
+    local existing = dict:get(list_key)
+    if not existing or existing == "" then
+        dict:set(list_key, value, ttl)
+        return
+    end
+    dict:set(list_key, existing .. "\n" .. value, ttl)
+end
+
+local window_prefix = tostring(window_start)
+incr("request_count:" .. window_prefix, 1)
+
+local status = tostring(ngx.status or 0)
+if status ~= "0" then
+    incr("status:" .. window_prefix .. ":" .. status, 1)
+    remember_value(
+        "status_keys:" .. window_prefix,
+        "status_marker:" .. window_prefix .. ":" .. status,
+        status
+    )
+    if tonumber(status) and tonumber(status) >= 500 then
+        incr("error_count:" .. window_prefix, 1)
+    end
+end
+
+local host = tostring(ngx.var.host or "")
+if host ~= "" then
+    incr("domain:" .. window_prefix .. ":" .. host, 1)
+    remember_value(
+        "domain_keys:" .. window_prefix,
+        "domain_marker:" .. window_prefix .. ":" .. host,
+        host
+    )
+end
+
+local remote_addr = tostring(ngx.var.binary_remote_addr or ngx.var.remote_addr or "")
+if remote_addr ~= "" and dict:add("visitor:" .. window_prefix .. ":" .. remote_addr, 1, ttl) then
+    incr("unique_visitor_count:" .. window_prefix, 1)
+end
+
+local request_length = tonumber(ngx.var.request_length) or 0
+if request_length > 0 then
+    incr("openresty_rx_bytes:" .. window_prefix, request_length)
+end
+
+local bytes_sent = tonumber(ngx.var.bytes_sent) or tonumber(ngx.var.body_bytes_sent) or 0
+if bytes_sent > 0 then
+    incr("openresty_tx_bytes:" .. window_prefix, bytes_sent)
+end
+`
+
+const openRestyObservabilityReadLua = `local cjson = require "cjson.safe"
+
+local dict = ngx.shared.openflare_observability
+if not dict then
+    ngx.status = ngx.HTTP_SERVICE_UNAVAILABLE
+    ngx.say(cjson.encode({ message = "shared dict unavailable" }))
+    return
+end
+
+local now = ngx.time()
+local window_size = ` + openRestyObservabilityWindowSize + `
+local window_start = now - (now % window_size)
+local current_window = tostring(window_start)
+
+local function read_counter(key)
+    return tonumber(dict:get(key) or 0) or 0
+end
+
+local function read_map(window_id, prefix, list_key)
+    local result = {}
+    local raw = dict:get(list_key .. ":" .. window_id)
+    if not raw or raw == "" then
+        return result
+    end
+    for value in string.gmatch(raw, "[^\n]+") do
+        result[value] = read_counter(prefix .. ":" .. window_id .. ":" .. value)
+    end
+    return result
+end
+
+local payload = {
+    window_started_at_unix = window_start,
+    window_ended_at_unix = now,
+    request_count = read_counter("request_count:" .. current_window),
+    error_count = read_counter("error_count:" .. current_window),
+    unique_visitor_count = read_counter("unique_visitor_count:" .. current_window),
+    status_codes = read_map(current_window, "status", "status_keys"),
+    top_domains = read_map(current_window, "domain", "domain_keys"),
+    source_countries = {},
+    openresty_rx_bytes = read_counter("openresty_rx_bytes:" .. current_window),
+    openresty_tx_bytes = read_counter("openresty_tx_bytes:" .. current_window)
+}
+
+ngx.header.content_type = "application/json"
+ngx.say(cjson.encode(payload))
+`
+
+func ManagedObservabilityLuaFiles() []protocol.SupportFile {
+	return []protocol.SupportFile{
+		{Path: "init.lua", Content: openRestyObservabilityInitLua},
+		{Path: "log.lua", Content: openRestyObservabilityLogLua},
+		{Path: "read.lua", Content: openRestyObservabilityReadLua},
+		{Path: "observability/init.lua", Content: openRestyObservabilityInitLua},
+		{Path: "observability/log.lua", Content: openRestyObservabilityLogLua},
+		{Path: "observability/read.lua", Content: openRestyObservabilityReadLua},
+	}
+}
@@ -0,0 +1,607 @@
+package nginx
+
+import (
+	"embed"
+	"path/filepath"
+	"strings"
+
+	"github.com/rain-kl/openflare/openflare-agent/internal/protocol"
+)
+
+//go:embed pow_static
+var powStaticFS embed.FS
+
+const openRestyPowRuntimeLua = `local _M = {}
+
+function _M.check()
+local source = debug.getinfo(1, "S").source or ""
+if string.sub(source, 1, 1) == "@" then
+    local script_path = string.sub(source, 2)
+    local base_dir = string.match(script_path, "^(.*)/pow/[^/]+%.lua$")
+    if base_dir and base_dir ~= "" and not string.find(package.path, base_dir, 1, true) then
+        package.path = base_dir .. "/?.lua;" .. base_dir .. "/?/init.lua;" .. package.path
+    end
+end
+
+local cjson = require "cjson.safe"
+local policy = require "pow.policy"
+
+local pow_config_dict = ngx.shared.openflare_pow_config
+local pow_sessions = ngx.shared.openflare_pow_sessions
+
+local function session_cookie(value, ttl)
+    local cookie = "__openflare_pow=" .. value .. "; Path=/; HttpOnly; SameSite=Lax; Max-Age=" .. tostring(ttl)
+    if ngx.var.scheme == "https" then
+        cookie = cookie .. "; Secure"
+    end
+    return cookie
+end
+
+-- Lazy-load pow_config from file; reload when content changes
+local function load_pow_config()
+    local config_paths = {
+        "__OPENFLARE_RUNTIME_CONFIG_DIR__/waf_config.json",
+        "/etc/nginx/openflare-lua/waf_config.json",
+        "/usr/local/openresty/nginx/conf/waf_config.json"
+    }
+    for _, config_path in ipairs(config_paths) do
+        local f = io.open(config_path, "r")
+        if f then
+            local content = f:read("*a")
+            f:close()
+            local current_hash = ngx.md5(content or "")
+
+            if current_hash == pow_config_dict:get("_config_hash") then
+                return
+            end
+
+            -- Clear old domain/site entries
+            local old_keys = pow_config_dict:get("_domain_keys")
+            if old_keys then
+                for domain in string.gmatch(old_keys, "[^\n]+") do
+                    pow_config_dict:delete(domain)
+                end
+            end
+
+            local domain_keys = {}
+            if content and content ~= "" and content ~= "{}" then
+                local ok, decoded = pcall(cjson.decode, content)
+                if ok and decoded and decoded.rule_groups and decoded.site_rule_groups then
+                    -- Build rule groups map (group ID -> PoWConfig)
+                    local groups = {}
+                    for _, group in ipairs(decoded.rule_groups) do
+                        if group.pow_enabled then
+                            groups[tostring(group.id)] = group.pow_config
+                        end
+                    end
+                    -- Build site name to pow_config map
+                    for site, group_ids in pairs(decoded.site_rule_groups) do
+                        local pow_config = nil
+                        -- Check custom group IDs first
+                        for _, id in ipairs(group_ids) do
+                            pow_config = groups[tostring(id)]
+                            if pow_config then
+                                break
+                            end
+                        end
+                        -- If not found, check global group IDs
+                        if not pow_config then
+                            for _, group in ipairs(decoded.rule_groups) do
+                                if group.is_global and group.pow_enabled then
+                                    pow_config = group.pow_config
+                                    break
+                                end
+                            end
+                        end
+                        if pow_config then
+                            pow_config_dict:set(site, cjson.encode({enabled = true, config = pow_config}), 0)
+                            domain_keys[#domain_keys+1] = site
+                        end
+                    end
+                end
+            end
+
+            pow_config_dict:set("_domain_keys", table.concat(domain_keys, "\n"), 0)
+            pow_config_dict:set("_config_hash", current_hash, 0)
+            return
+        end
+    end
+end
+
+load_pow_config()
+
+local host = ngx.var.host
+if not host or host == "" then
+    return
+end
+
+local site = ngx.var.openflare_waf_site or ""
+if site == "" then
+    site = host
+end
+
+local config_raw = pow_config_dict:get(site)
+if not config_raw then
+    return
+end
+
+local ok, route_config = pcall(cjson.decode, config_raw)
+if not ok or not route_config then
+    return
+end
+
+if not route_config.enabled then
+    return
+end
+
+local config = route_config.config or {}
+local session_ttl = config.session_ttl or 600
+local uri = ngx.var.uri or ""
+local ua = ngx.var.http_user_agent or ""
+local remote_ip = ngx.var.remote_addr or ""
+
+-- Check whitelist: if matched, skip PoW
+local whitelist = config.whitelist or {}
+if policy.match_any(remote_ip, ua, uri, whitelist) then
+    return
+end
+
+-- Check blacklist: if matched, require PoW
+local blacklist = config.blacklist or {}
+local has_blacklist = policy.has_entries(blacklist)
+local need_pow = false
+if has_blacklist then
+    need_pow = policy.match_any(remote_ip, ua, uri, blacklist)
+else
+    -- No blacklist means all non-whitelisted need PoW
+    need_pow = true
+end
+
+if not need_pow then
+    return
+end
+
+-- Check valid session cookie
+local cookie_val = ngx.var["cookie___openflare_pow"]
+if cookie_val and cookie_val ~= "" then
+    local session_key = host .. ":" .. cookie_val
+    local session_data = pow_sessions:get(session_key)
+    if session_data then
+        pow_sessions:set(session_key, "1", session_ttl)
+        ngx.header["Set-Cookie"] = session_cookie(cookie_val, session_ttl)
+        return
+    end
+end
+
+-- If requesting the challenge API endpoints, let them through (handled by content_by_lua)
+local anubis_api_prefix = "/.within.website/x/cmd/anubis/api/"
+local anubis_static_prefix = "/.within.website/x/cmd/anubis/static/"
+if string.sub(uri, 1, #anubis_api_prefix) == anubis_api_prefix then
+    return
+end
+if string.sub(uri, 1, #anubis_static_prefix) == anubis_static_prefix then
+    return
+end
+
+-- Render the challenge page through an internal redirect so the browser stays
+-- on the originally requested URL instead of seeing a 302 hop.
+ngx.req.set_uri_args({
+    redir = ngx.var.scheme .. "://" .. host .. uri .. (ngx.var.args and ("?" .. ngx.var.args) or ""),
+    host = host
+})
+return ngx.exec("/.within.website/x/cmd/anubis/api/make-challenge")
+end
+
+return _M
+`
+
+const openRestyPowCheckLua = `local source = debug.getinfo(1, "S").source or ""
+if string.sub(source, 1, 1) == "@" then
+    local script_path = string.sub(source, 2)
+    local base_dir = string.match(script_path, "^(.*)/pow/[^/]+%.lua$")
+    if base_dir and base_dir ~= "" and not string.find(package.path, base_dir, 1, true) then
+        package.path = base_dir .. "/?.lua;" .. base_dir .. "/?/init.lua;" .. package.path
+    end
+end
+
+return require("pow.runtime").check()
+`
+
+const openRestyPowChallengeLua = `local cjson = require "cjson.safe"
+
+local pow_config_dict = ngx.shared.openflare_pow_config
+local pow_challenges = ngx.shared.openflare_pow_challenges
+
+local function generate_entropy()
+    local pieces = {
+        tostring(ngx.now()),
+        tostring(ngx.worker.pid()),
+        tostring(math.random()),
+        ngx.var.remote_addr or "",
+        ngx.var.http_user_agent or "",
+        ngx.var.request_id or "",
+    }
+    return table.concat(pieces, ":")
+end
+
+local args = ngx.req.get_uri_args()
+local host = args["host"] or ngx.var.host or ""
+local redir = args["redir"] or ""
+
+local site = ngx.var.openflare_waf_site or ""
+if site == "" then
+    site = host
+end
+
+local config_raw = pow_config_dict:get(site)
+if not config_raw then
+    ngx.status = 403
+    ngx.say("PoW not configured for this site")
+    return
+end
+
+local ok, route_config = pcall(cjson.decode, config_raw)
+if not ok or not route_config or not route_config.enabled then
+    ngx.status = 403
+    ngx.say("PoW not enabled for this site")
+    return
+end
+
+local config = route_config.config or {}
+local difficulty = config.difficulty or 4
+local algorithm = config.algorithm or "fast"
+local challenge_ttl = config.challenge_ttl or 300
+local session_ttl = config.session_ttl or 600
+
+-- Generate challenge data without depending on ngx.random_bytes, which is not
+-- available in every OpenResty runtime build.
+local entropy = generate_entropy()
+local challenge_id = ngx.md5(entropy .. ":id")
+local challenge_data = ngx.md5(entropy .. ":data-a") .. ngx.md5(entropy .. ":data-b")
+
+-- Store challenge
+local challenge_info = cjson.encode({
+    data = challenge_data,
+    difficulty = difficulty,
+    host = host,
+    redir = redir,
+    session_ttl = session_ttl
+})
+pow_challenges:set(challenge_id, challenge_info, challenge_ttl)
+
+local static_prefix = "/.within.website/x/cmd/anubis/static/"
+local accept_lang = ngx.var.http_accept_language or ""
+local lang = "en"
+if string.find(accept_lang, "zh") then
+    lang = "zh-CN"
+end
+
+local t_title = "Making sure you're not a bot!"
+local t_status = "Loading..."
+local t_protected = "This site is protected by a Proof-of-Work challenge. Your browser will solve a small puzzle before the upstream response is shown."
+local t_why = "Why am I seeing this?"
+local t_why_desc = "OpenFlare is asking your browser to complete a lightweight computation to distinguish normal browser traffic from automated abuse. This should finish automatically."
+local t_noscript = "JavaScript is required to pass this verification. Please enable JavaScript and reload."
+
+if lang == "zh-CN" then
+    t_title = "正在确认你是不是机器人！"
+    t_status = "加载中..."
+    t_protected = "本网站受工作量证明（Proof-of-Work）挑战保护。在显示源站响应之前，您的浏览器将解决一个微型谜题。"
+    t_why = "为什么我会看到这个？"
+    t_why_desc = "OpenFlare 正在要求您的浏览器完成一项轻量级计算，以区分正常的浏览器流量和自动化的恶意请求。这应该会自动完成。"
+    t_noscript = "很遗憾，您必须启用 JavaScript 才能通过这项验证。请开启 JavaScript 并刷新页面。"
+end
+
+ngx.header.content_type = "text/html; charset=utf-8"
+ngx.say([[<!DOCTYPE html>
+<html lang="]] .. lang .. [[">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex,nofollow">
+<title>]] .. t_title .. [[</title>
+<link rel="stylesheet" href="]] .. static_prefix .. [[css/xess.css">
+<style>
+body,html{height:100%;display:flex;justify-content:center;align-items:center;margin-left:auto;margin-right:auto}
+.centered-div{text-align:center}
+#status{font-variant-numeric:tabular-nums}
+#progress{display:none;width:min(20rem,90%);height:2rem;border-radius:1rem;overflow:hidden;margin:1rem 0 2rem;outline-offset:2px;outline:#b16286 solid 4px}
+.bar-inner{background-color:#b16286;height:100%;width:0;transition:width .25s ease-in}
+</style>
+<script id="anubis_version" type="application/json">"openflare-pow"</script>
+<script id="anubis_challenge" type="application/json">]] .. cjson.encode({
+    challenge = {
+        id = challenge_id,
+        randomData = challenge_data,
+        method = algorithm
+    },
+    rules = {
+        difficulty = difficulty,
+        algorithm = algorithm
+    }
+}) .. [[</script>
+<script id="anubis_base_prefix" type="application/json">""</script>
+<script id="anubis_public_url" type="application/json">"__openflare_internal__"</script>
+</head>
+<body id="top">
+<main>
+<h1 id="title" class="centered-div">]] .. t_title .. [[</h1>
+<div class="centered-div">
+<img id="image" style="width:100%;max-width:256px;" src="]] .. static_prefix .. [[img/pensive.webp?cacheBuster=openflare-pow">
+<p id="status">]] .. t_status .. [[</p>
+<p>]] .. t_protected .. [[</p>
+<div id="progress" role="progressbar" aria-labelledby="status"><div class="bar-inner"></div></div>
+<details>
+<summary>]] .. t_why .. [[</summary>
+<p>]] .. t_why_desc .. [[</p>
+</details>
+<noscript><p>]] .. t_noscript .. [[</p></noscript>
+</div>
+</main>
+<script type="module" src="]] .. static_prefix .. [[js/main.mjs"></script>
+</body>
+</html>]])
+`
+
+const openRestyPowVerifyLua = `local cjson = require "cjson.safe"
+
+local pow_challenges = ngx.shared.openflare_pow_challenges
+local pow_sessions = ngx.shared.openflare_pow_sessions
+
+local args = ngx.req.get_uri_args()
+local challenge_id = args["id"] or ""
+local response = args["response"] or ""
+local nonce_str = args["nonce"] or ""
+local redir = args["redir"] or ""
+local elapsed = args["elapsedTime"] or ""
+
+if challenge_id == "" or response == "" or nonce_str == "" then
+    ngx.status = 400
+    ngx.header.content_type = "application/json"
+    ngx.say(cjson.encode({error = "missing parameters"}))
+    return
+end
+
+local nonce = tonumber(nonce_str)
+if not nonce then
+    ngx.status = 400
+    ngx.header.content_type = "application/json"
+    ngx.say(cjson.encode({error = "invalid nonce"}))
+    return
+end
+
+-- Get stored challenge
+local challenge_raw = pow_challenges:get(challenge_id)
+if not challenge_raw then
+    ngx.status = 410
+    ngx.header.content_type = "application/json"
+    ngx.say(cjson.encode({error = "challenge expired or not found"}))
+    return
+end
+
+local ok, challenge_info = pcall(cjson.decode, challenge_raw)
+if not ok or not challenge_info then
+    ngx.status = 500
+    ngx.header.content_type = "application/json"
+    ngx.say(cjson.encode({error = "invalid challenge data"}))
+    return
+end
+
+local challenge_data = challenge_info.data or ""
+local difficulty = challenge_info.difficulty or 4
+local host = challenge_info.host or ngx.var.host or ""
+local session_ttl = challenge_info.session_ttl or 600
+
+-- Compute SHA-256(challenge_data + nonce)
+local calc_string = challenge_data .. tostring(math.floor(nonce))
+local calculated = ngx.sha1_bin ~= nil and "" or ""
+
+-- Use resty.sha256 for proper SHA-256
+local sha256 = require "resty.sha256"
+local str = require "resty.string"
+local hasher = sha256:new()
+hasher:update(calc_string)
+local hash_bytes = hasher:final()
+local hash_hex = str.to_hex(hash_bytes)
+
+-- Verify hash matches response
+if hash_hex ~= string.lower(response) then
+    ngx.status = 403
+    ngx.header.content_type = "application/json"
+    ngx.say(cjson.encode({error = "hash mismatch"}))
+    return
+end
+
+-- Verify difficulty (leading zeros in hex)
+local prefix = string.rep("0", difficulty)
+if string.sub(hash_hex, 1, difficulty) ~= prefix then
+    ngx.status = 403
+    ngx.header.content_type = "application/json"
+    ngx.say(cjson.encode({error = "insufficient difficulty"}))
+    return
+end
+
+-- Invalidate challenge (prevent replay)
+pow_challenges:delete(challenge_id)
+
+-- Generate session token
+local session_token = str.to_hex(ngx.sha1_bin(challenge_id .. ngx.now() .. tostring(ngx.worker.pid())))
+
+-- Store session
+pow_sessions:set(host .. ":" .. session_token, "1", session_ttl)
+
+-- Set cookie. Secure cookies are not sent over HTTP, so only add Secure when
+-- the current request itself is HTTPS.
+local cookie = "__openflare_pow=" .. session_token .. "; Path=/; HttpOnly; SameSite=Lax; Max-Age=" .. tostring(session_ttl)
+if ngx.var.scheme == "https" then
+    cookie = cookie .. "; Secure"
+end
+ngx.header["Set-Cookie"] = cookie
+
+if redir ~= "" then
+    return ngx.redirect(redir)
+end
+
+ngx.header.content_type = "application/json"
+ngx.say(cjson.encode({ok = true}))
+`
+
+const openRestyPowPolicyLua = `local M = {}
+
+local function match_ip(remote_ip, ips)
+    if not ips or #ips == 0 then return false end
+    for _, ip in ipairs(ips) do
+        if ip == remote_ip then
+            return true
+        end
+    end
+    return false
+end
+
+local function match_cidr(remote_ip, cidrs)
+    if not cidrs or #cidrs == 0 then return false end
+    for _, cidr in ipairs(cidrs) do
+        local m, err = ngx.re.match(cidr, "^(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})/(\\\\d{1,2})$")
+        if m then
+            local mask_bits = tonumber(m[2])
+            if mask_bits and mask_bits >= 0 and mask_bits <= 32 then
+                local function ip_to_num(ip_str)
+                    local parts = {}
+                    for part in string.gmatch(ip_str, "%d+") do
+                        parts[#parts+1] = tonumber(part) or 0
+                    end
+                    if #parts ~= 4 then return 0 end
+                    return parts[1]*16777216 + parts[2]*65536 + parts[3]*256 + parts[4]
+                end
+                local remote_num = ip_to_num(remote_ip)
+                local net_num = ip_to_num(m[1])
+                if mask_bits == 0 then
+                    return true
+                end
+                local mask = math.floor(2^(32 - mask_bits))
+                mask = 4294967296 - mask
+                if bit.band(remote_num, mask) == bit.band(net_num, mask) then
+                    return true
+                end
+            end
+        end
+    end
+    return false
+end
+
+local function match_path(uri, patterns)
+    if not patterns or #patterns == 0 then return false end
+    for _, pattern in ipairs(patterns) do
+        local ok, match = pcall(ngx.re.match, uri, "^" .. ngx.re.gsub(pattern, "([%^%$%(%)%%%.%[%]%+%-%?])", function(c)
+            if c == "*" then return ".*" end
+            return "%" .. c
+        end) .. "$", "i")
+        if ok and match then
+            return true
+        end
+    end
+    return false
+end
+
+local function match_path_regex(uri, patterns)
+    if not patterns or #patterns == 0 then return false end
+    for _, pattern in ipairs(patterns) do
+        local ok, match = pcall(ngx.re.match, uri, pattern)
+        if ok and match then
+            return true
+        end
+    end
+    return false
+end
+
+local function match_ua(ua, patterns)
+    if not patterns or #patterns == 0 then return false end
+    for _, pattern in ipairs(patterns) do
+        if ua and string.find(ua, pattern, 1, true) then
+            return true
+        end
+    end
+    return false
+end
+
+function M.match_any(remote_ip, ua, uri, list)
+    if not list then return false end
+    if match_ip(remote_ip, list.ips) then return true end
+    if match_cidr(remote_ip, list.ip_cidrs) then return true end
+    if match_path(uri, list.paths) then return true end
+    if match_path_regex(uri, list.path_regexes) then return true end
+    if match_ua(ua, list.user_agents) then return true end
+    return false
+end
+
+function M.has_entries(list)
+    if not list then return false end
+    return (#(list.ips or {}) + #(list.ip_cidrs or {}) + #(list.paths or {}) + #(list.path_regexes or {}) + #(list.user_agents or {})) > 0
+end
+
+return M
+`
+
+func ManagedPowLuaFiles() []protocol.SupportFile {
+	return []protocol.SupportFile{
+		{Path: "pow/runtime.lua", Content: openRestyPowRuntimeLua},
+		{Path: "pow/check.lua", Content: openRestyPowCheckLua},
+		{Path: "pow/challenge.lua", Content: openRestyPowChallengeLua},
+		{Path: "pow/verify.lua", Content: openRestyPowVerifyLua},
+		{Path: "pow/policy.lua", Content: openRestyPowPolicyLua},
+	}
+}
+
+func ManagedPowStaticFiles() ([]protocol.SupportFile, error) {
+	var files []protocol.SupportFile
+	entries, err := powStaticFS.ReadDir("pow_static")
+	if err != nil {
+		return nil, err
+	}
+	var walk func(dir string) error
+	walk = func(dir string) error {
+		entries, err := powStaticFS.ReadDir(dir)
+		if err != nil {
+			return err
+		}
+		for _, entry := range entries {
+			fullPath := filepath.Join(dir, entry.Name())
+			if entry.IsDir() {
+				if err := walk(fullPath); err != nil {
+					return err
+				}
+				continue
+			}
+			data, err := powStaticFS.ReadFile(fullPath)
+			if err != nil {
+				return err
+			}
+			// Convert pow_static/css/xess.css -> pow/static/css/xess.css
+			relPath := strings.TrimPrefix(fullPath, "pow_static/")
+			files = append(files, protocol.SupportFile{
+				Path:    "pow/static/" + relPath,
+				Content: string(data),
+			})
+		}
+		return nil
+	}
+	for _, entry := range entries {
+		fullPath := filepath.Join("pow_static", entry.Name())
+		if entry.IsDir() {
+			if err := walk(fullPath); err != nil {
+				return nil, err
+			}
+		} else {
+			data, err := powStaticFS.ReadFile(fullPath)
+			if err != nil {
+				return nil, err
+			}
+			relPath := strings.TrimPrefix(fullPath, "pow_static/")
+			files = append(files, protocol.SupportFile{
+				Path:    "pow/static/" + relPath,
+				Content: string(data),
+			})
+		}
+	}
+	return files, nil
+}
@@ -0,0 +1,7 @@
+@font-face {
+  font-family: "Podkova";
+  font-style: normal;
+  font-weight: 400 800;
+  font-display: swap;
+  src: url("podkova.woff2") format("woff2");
+}
@@ -0,0 +1,149 @@
+:root {
+  --body-sans-font: Geist, sans-serif;
+  --body-preformatted-font: Iosevka Curly Iaso, monospace;
+  --body-title-font: Podkova, serif;
+
+  --background: #1d2021;
+  --text: #f9f5d7;
+  --text-selection: #d3869b;
+  --preformatted-background: #3c3836;
+  --link-foreground: #b16286;
+  --link-background: #282828;
+  --blockquote-border-left: 1px solid #bdae93;
+
+  --progress-bar-outline: #b16286 solid 4px;
+  --progress-bar-fill: #b16286;
+}
+@media (prefers-color-scheme: light) {
+  :root {
+    --background: #f9f5d7;
+    --text: #1d2021;
+    --text-selection: #d3869b;
+    --preformatted-background: #ebdbb2;
+    --link-foreground: #b16286;
+    --link-background: #fbf1c7;
+    --blockquote-border-left: 1px solid #655c54;
+  }
+}
+
+@font-face {
+  font-family: "Geist";
+  font-style: normal;
+  font-weight: 100 900;
+  font-display: swap;
+  src: url("./static/geist.woff2") format("woff2");
+}
+
+@font-face {
+  font-family: "Podkova";
+  font-style: normal;
+  font-weight: 400 800;
+  font-display: swap;
+  src: url("./static/podkova.woff2") format("woff2");
+}
+
+@font-face {
+  font-family: "Iosevka Curly";
+  font-style: monospace;
+  font-display: swap;
+  src: url("./static/iosevka-curly.woff2") format("woff2");
+}
+
+main {
+  font-family: var(--body-sans-font);
+  max-width: 50rem;
+  padding: 2rem;
+  margin: auto;
+}
+
+::selection {
+  background: var(--text-selection);
+}
+
+body {
+  background: var(--background);
+  color: var(--text);
+}
+
+body,
+html {
+  height: 100%;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+.centered-div {
+  text-align: center;
+}
+
+#status {
+  font-variant-numeric: tabular-nums;
+}
+
+.centered-div {
+  text-align: center;
+}
+
+#status {
+  font-variant-numeric: tabular-nums;
+}
+
+#progress {
+  display: none;
+  width: min(20rem, 90%);
+  height: 2rem;
+  border-radius: 1rem;
+  overflow: hidden;
+  margin: 1rem 0 2rem;
+  outline-offset: 2px;
+  outline: var(--progress-bar-outline);
+}
+
+.bar-inner {
+  background-color: var(--progress-bar-fill);
+  height: 100%;
+  width: 0;
+  transition: width 0.25s ease-in;
+}
+
+@media (prefers-reduced-motion: no-preference) {
+  .bar-inner {
+    transition: width 0.25s ease-in;
+  }
+}
+
+pre {
+  background-color: var(--preformatted-background);
+  padding: 1em;
+  border: 0;
+  font-family: var(--body-preformatted-font);
+}
+
+a,
+a:active,
+a:visited {
+  color: var(--link-foreground);
+  background-color: var(--link-background);
+}
+
+h1,
+h2,
+h3,
+h4,
+h5 {
+  margin-bottom: 0.1rem;
+  font-family: var(--body-title-font);
+}
+
+blockquote {
+  border-left: var(--blockquote-border-left);
+  margin: 0.5em 10px;
+  padding: 0.5em 10px;
+}
+
+footer {
+  text-align: center;
+}
@@ -0,0 +1,32 @@
+/*
+@licstart  The following is the entire license notice for the
+JavaScript code in this page.
+
+Copyright (c) 2025 Xe Iaso <xe.iaso@techaro.lol>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+Includes code from https://github.com/aws/aws-sdk-js-crypto-helpers which is
+used under the terms of the Apache 2 license.
+
+@licend  The above is the entire license notice
+for the JavaScript code in this page.
+*/
+(()=>{var k=()=>navigator.hardwareConcurrency!==void 0?navigator.hardwareConcurrency:1;function n(c,b,w=5,e=null,g,u=Math.trunc(Math.max(k()/2,1))){console.debug("fast algo");let s="purejs";return window.isSecureContext&&(s="webcrypto"),(navigator.userAgent.includes("Firefox")||navigator.userAgent.includes("Goanna"))&&(console.log("Firefox detected, using pure-JS fallback"),s="purejs"),new Promise((p,l)=>{let m=`${c.basePrefix}/.within.website/x/cmd/anubis/static/js/worker/sha256-${s}.mjs?cacheBuster=${c.version}`,f=[],d=!1,a=()=>{console.log("PoW aborted"),i(),l(new DOMException("Aborted","AbortError"))},i=()=>{d||(d=!0,f.forEach(r=>r.terminate()),e?.removeEventListener("abort",a))};if(e!=null){if(e.aborted)return a();e.addEventListener("abort",a,{once:!0})}for(let r=0;r<u;r++){let t=new Worker(m);t.onmessage=o=>{typeof o.data=="number"?g?.(o.data):(i(),p(o.data))},t.onerror=o=>{i(),l(o)},t.postMessage({data:b,difficulty:w,nonce:r,threads:u}),f.push(t)}})}var P={fast:n,slow:n};})();
+//# sourceMappingURL=index.mjs.map
@@ -0,0 +1,32 @@
+/*
+@licstart  The following is the entire license notice for the
+JavaScript code in this page.
+
+Copyright (c) 2025 Xe Iaso <xe.iaso@techaro.lol>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+Includes code from https://github.com/aws/aws-sdk-js-crypto-helpers which is
+used under the terms of the Apache 2 license.
+
+@licend  The above is the entire license notice
+for the JavaScript code in this page.
+*/
+(()=>{var I=()=>navigator.hardwareConcurrency!==void 0?navigator.hardwareConcurrency:1;function _(e,n,s=5,o=null,i,u=Math.trunc(Math.max(I()/2,1))){console.debug("fast algo");let a="purejs";return window.isSecureContext&&(a="webcrypto"),(navigator.userAgent.includes("Firefox")||navigator.userAgent.includes("Goanna"))&&(console.log("Firefox detected, using pure-JS fallback"),a="purejs"),new Promise((E,x)=>{let M=`${e.basePrefix}/.within.website/x/cmd/anubis/static/js/worker/sha256-${a}.mjs?cacheBuster=${e.version}`,p=[],d=!1,b=()=>{console.log("PoW aborted"),h(),x(new DOMException("Aborted","AbortError"))},h=()=>{d||(d=!0,p.forEach(c=>c.terminate()),o?.removeEventListener("abort",b))};if(o!=null){if(o.aborted)return b();o.addEventListener("abort",b,{once:!0})}for(let c=0;c<u;c++){let g=new Worker(M);g.onmessage=m=>{typeof m.data=="number"?i?.(m.data):(h(),E(m.data))},g.onerror=m=>{h(),x(m)},g.postMessage({data:n,difficulty:s,nonce:c,threads:u}),p.push(g)}})}var j={fast:_,slow:_};var v=(e="",n={})=>{let s=new URL(e,window.location.href);return Object.entries(n).forEach(([o,i])=>s.searchParams.set(o,i)),s.toString()},L=e=>{let n=document.getElementById(e);return n===null?null:JSON.parse(n.textContent)},k=(e,n,s)=>v(`${s}/.within.website/x/cmd/anubis/static/img/${e}.webp`,{cacheBuster:n});var W=async()=>document.documentElement.lang,S=async e=>{let n=L("anubis_base_prefix");if(n!==null)try{return await(await fetch(`${n}/.within.website/x/cmd/anubis/static/locales/${e}.json`)).json()}catch(s){if(console.warn(`Failed to load translations for ${e}, falling back to English`),e!=="en")return await S("en");throw s}},C=()=>{let e=L("anubis_public_url");if(e!==null)return e&&window.location.href.startsWith(e)?new URLSearchParams(window.location.search).get("redir"):window.location.href},$={},D,A=async()=>{D=await W(),$=await S(D)},r=e=>$[`js_${e}`]||$[e]||e;(async()=>{await A();let e=[{name:"Web Workers",msg:r("web_workers_error"),value:window.Worker},{name:"Cookies",msg:r("cookies_error"),value:navigator.cookieEnabled}],n=document.getElementById("status"),s=document.getElementById("image"),o=document.getElementById("title"),i=document.getElementById("progress"),u=L("anubis_version"),a=L("anubis_base_prefix"),E=document.querySelector("details"),x=!1;E&&E.addEventListener("toggle",()=>{E.open&&(x=!0)});let M=({titleMsg:l,statusMsg:f,imageSrc:w})=>{o.innerHTML=l,n.innerHTML=f,s.src=w,i.style.display="none"};n.innerHTML=r("calculating");for(let{value:l,name:f,msg:w}of e)if(!l){M({titleMsg:`${r("missing_feature")} ${f}`,statusMsg:w,imageSrc:k("reject",u,a)});return}let{challenge:p,rules:d}=L("anubis_challenge"),b=j[d.algorithm];if(!b){M({titleMsg:r("challenge_error"),statusMsg:r("challenge_error_msg"),imageSrc:k("reject",u,a)});return}n.innerHTML=`${r("calculating_difficulty")} ${d.difficulty}, `,i.style.display="inline-block";let h=document.createTextNode(`${r("speed")} 0kH/s`);n.appendChild(h);let c=0,g=!1,m=Math.pow(16,-d.difficulty);try{let l=Date.now(),{hash:f,nonce:w}=await b({basePrefix:a,version:u},p.randomData,d.difficulty,null,t=>{let y=Date.now()-l;y-c>1e3&&(c=y,h.data=`${r("speed")} ${(t/y).toFixed(3)}kH/s`);let T=Math.pow(1-m,t),P=(1-Math.pow(T,2))*100;i["aria-valuenow"]=P,i.firstElementChild!==null&&(i.firstElementChild.style.width=`${P}%`),T<.1&&!g&&(n.append(document.createElement("br"),document.createTextNode(r("verification_longer"))),g=!0)}),H=Date.now();if(console.log({hash:f,nonce:w}),x){let y=function(){let T=C();window.location.replace(v(`${a}/.within.website/x/cmd/anubis/api/pass-challenge`,{id:p.id,response:f,nonce:w,redir:T,elapsedTime:H-l}))},t=document.getElementById("progress");t.style.display="flex",t.style.alignItems="center",t.style.justifyContent="center",t.style.height="2rem",t.style.borderRadius="1rem",t.style.cursor="pointer",t.style.background="#b16286",t.style.color="white",t.style.fontWeight="bold",t.style.outline="4px solid #b16286",t.style.outlineOffset="2px",t.style.width="min(20rem, 90%)",t.style.margin="1rem auto 2rem",t.innerHTML=r("finished_reading"),t.onclick=y,setTimeout(y,3e4)}else{let t=C();window.location.replace(v(`${a}/.within.website/x/cmd/anubis/api/pass-challenge`,{id:p.id,response:f,nonce:w,redir:t,elapsedTime:H-l}))}}catch(l){M({titleMsg:r("calculation_error"),statusMsg:`${r("calculation_error_msg")} ${l.message}`,imageSrc:k("reject",u,a)})}})();})();
+//# sourceMappingURL=main.mjs.map
@@ -0,0 +1,32 @@
+/*
+@licstart  The following is the entire license notice for the
+JavaScript code in this page.
+
+Copyright (c) 2025 Xe Iaso <xe.iaso@techaro.lol>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+Includes code from https://github.com/aws/aws-sdk-js-crypto-helpers which is
+used under the terms of the Apache 2 license.
+
+@licend  The above is the entire license notice
+for the JavaScript code in this page.
+*/
+(()=>{var h=new TextEncoder,y=async e=>{let s=h.encode(e);return await crypto.subtle.digest("SHA-256",s)},g=e=>e.reduce((s,a)=>s+a.toString(16).padStart(2,"0"),"");addEventListener("message",async({data:e})=>{let{data:s,difficulty:a,threads:d}=e,t=e.nonce,f=t===0,o=0,c=Math.floor(a/2),l=a%2!==0;for(;;){let u=await y(s+t),i=new Uint8Array(u),r=!0;for(let n=0;n<c;n++)if(i[n]!==0){r=!1;break}if(r&&l&&i[c]>>4!==0&&(r=!1),r){let n=g(i);postMessage({hash:n,data:s,difficulty:a,nonce:t});return}t+=d,o++,t%1!==0&&(t=Math.trunc(t)),f&&(o&1023)===0&&postMessage(t)}});})();
+//# sourceMappingURL=sha256-webcrypto.mjs.map
@@ -0,0 +1,66 @@
+{
+  "loading": "Loading...",
+  "why_am_i_seeing": "Why am I seeing this?",
+  "protected_by": "Protected by",
+  "protected_from": "From",
+  "made_with": "Made with ❤️ in 🇨🇦",
+  "mascot_design": "Mascot design by",
+  "ai_companies_explanation": "You are seeing this because the administrator of this website has set up Anubis to protect the server against the scourge of AI companies aggressively scraping websites. This can and does cause downtime for the websites, which makes their resources inaccessible for everyone.",
+  "anubis_compromise": "Anubis is a compromise. Anubis uses a Proof-of-Work scheme in the vein of Hashcash, a proposed proof-of-work scheme for reducing email spam. The idea is that at individual scales the additional load is ignorable, but at mass scraper levels it adds up and makes scraping much more expensive.",
+  "hack_purpose": "Ultimately, this is a placeholder solution so that more time can be spent on fingerprinting and identifying headless browsers (EG: via how they do font rendering) so that the challenge proof of work page doesn't need to be presented to users that are much more likely to be legitimate.",
+  "simplified_explanation": "This is a measure against bots and malicious requests similar to a CAPTCHA. However, instead of having to do work yourself, your browser is given a calculation task that it has to solve to ensure that it is a valid client. This concept is called <a href=\"https://en.wikipedia.org/wiki/Proof_of_work\">Proof of Work</a>. The task is calculated in a few seconds and you are granted access to the website. Thank you for your understanding and patience.",
+  "jshelter_note": "Please note that Anubis requires the use of modern JavaScript features that plugins like JShelter will disable. Please disable JShelter or other such plugins for this domain.",
+  "version_info": "This website is running Anubis version",
+  "try_again": "Try again",
+  "go_home": "Go home",
+  "contact_webmaster": "or if you believe you should not be blocked, please contact the webmaster at",
+  "connection_security": "Please wait a moment while we ensure the security of your connection.",
+  "javascript_required": "Sadly, you must enable JavaScript to get past this challenge. This is required because AI companies have changed the social contract around how website hosting works. A no-JS solution is a work-in-progress.",
+  "benchmark_requires_js": "Running the benchmark tool requires JavaScript to be enabled.",
+  "difficulty": "Difficulty:",
+  "algorithm": "Algorithm:",
+  "compare": "Compare:",
+  "time": "Time",
+  "iters": "Iters",
+  "time_a": "Time A",
+  "iters_a": "Iters A",
+  "time_b": "Time B",
+  "iters_b": "Iters B",
+  "static_check_endpoint": "This is just a check endpoint for your reverse proxy to use.",
+  "authorization_required": "Authorization required",
+  "cookies_disabled": "Your browser is configured to disable cookies. Anubis requires cookies for the legitimate interest of making sure you are a valid client. Please enable cookies for this domain",
+  "access_denied": "Access Denied: error code",
+  "dronebl_entry": "DroneBL reported an entry",
+  "see_dronebl_lookup": "see",
+  "internal_server_error": "Internal Server Error: administrator has misconfigured Anubis. Please contact the administrator and ask them to look for the logs around",
+  "invalid_redirect": "Invalid redirect",
+  "redirect_not_parseable": "Redirect URL not parseable",
+  "redirect_domain_not_allowed": "Redirect domain not allowed",
+  "missing_required_forwarded_headers": "Missing required X-Forwarded-* headers",
+  "failed_to_sign_jwt": "failed to sign JWT",
+  "invalid_invocation": "Invalid invocation of MakeChallenge",
+  "client_error_browser": "Client Error: Please ensure your browser is up to date and try again later.",
+  "oh_noes": "Oh noes!",
+  "benchmarking_anubis": "Benchmarking Anubis!",
+  "you_are_not_a_bot": "You are not a bot!",
+  "making_sure_not_bot": "Making sure you're not a bot!",
+  "celphase": "CELPHASE",
+  "js_web_crypto_error": "Your browser doesn't have a functioning web.crypto element. Are you viewing this over a secure context?",
+  "js_web_workers_error": "Your browser doesn't support web workers (Anubis uses this to avoid freezing your browser). Do you have a plugin like JShelter installed?",
+  "js_cookies_error": "Your browser doesn't store cookies. Anubis uses cookies to determine which clients have passed challenges by storing a signed token in a cookie. Please enable storing cookies for this domain. The names of the cookies Anubis stores may vary without notice. Cookie names and values are not part of the public API.",
+  "js_context_not_secure": "Your context is not secure!",
+  "js_context_not_secure_msg": "Try connecting over HTTPS or let the admin know to set up HTTPS. For more information, see <a href=\"https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure\">MDN</a>.",
+  "js_calculating": "Calculating...",
+  "js_missing_feature": "Missing feature",
+  "js_challenge_error": "Challenge error!",
+  "js_challenge_error_msg": "Failed to resolve check algorithm. You may want to reload the page.",
+  "js_calculating_difficulty": "Calculating...<br/>Difficulty:",
+  "js_speed": "Speed:",
+  "js_verification_longer": "Verification is taking longer than expected. Please do not refresh the page.",
+  "js_success": "Success!",
+  "js_done_took": "Done! Took",
+  "js_iterations": "iterations",
+  "js_finished_reading": "I've finished reading, continue →",
+  "js_calculation_error": "Calculation error!",
+  "js_calculation_error_msg": "Failed to calculate challenge:"
+}
@@ -0,0 +1,66 @@
+{
+  "loading": "加载中...",
+  "why_am_i_seeing": "为什么我会看到这个？",
+  "protected_by": "本网站由",
+  "protected_from": "保护，来自",
+  "made_with": "在 🇨🇦 用 ❤️ 制作",
+  "mascot_design": "吉祥物由",
+  "ai_companies_explanation": "您会看到这个画面，是因为网站管理员启用了 Anubis 来保护服务器，避免 AI 公司大量爬取网站内容。这类行为会导致网站崩溃，让所有用户都无法正常访问资源。",
+  "anubis_compromise": "Anubis 是一种折中做法。它采用了类似 Hashcash 的工作量证明机制（Proof-of-Work），该机制最初是为了减少垃圾邮件而提出。其核心概念是：对个别用户而言，额外的计算负担可以忽略，但对大规模爬虫来说，累积起来的成本将大幅增加，从而让爬取行为变得更困难。",
+  "hack_purpose": "最终，这是一个占位符解决方案，以便将更多时间用于指纹识别和识别无头浏览器（例如：通过它们如何进行字体渲染），从而无需向更可能是合法用户的用户呈现挑战工作量证明页面。",
+  "jshelter_note": "请注意，Anubis 需要使用现代 JavaScript 功能，而像 JShelter 这类插件可能会阻挡这些功能。请为此域名停用 JShelter 或类似的插件。",
+  "version_info": "这个网站正在运行的 Anubis 版本为",
+  "try_again": "再试一次",
+  "go_home": "返回首页",
+  "contact_webmaster": "或者您觉得您不应该被封锁，请联系网站管理员于",
+  "connection_security": "请稍等，我们需要在继续之前检查您的连接安全性。",
+  "javascript_required": "很遗憾，您必须启用 JavaScript 才能通过这项验证。这是因为 AI 公司已经改变了网站托管的社会契约，因此我们必须采取这样的保护机制。无需 JavaScript 的解决方案仍在开发中。",
+  "benchmark_requires_js": "运行基准测试工具需要启用 JavaScript。",
+  "difficulty": "难度：",
+  "algorithm": "算法：",
+  "compare": "比较：",
+  "time": "时间",
+  "iters": "迭代",
+  "time_a": "时间 A",
+  "iters_a": "迭代 A",
+  "time_b": "时间 B",
+  "iters_b": "迭代 B",
+  "static_check_endpoint": "这是提供给您的反向代理服务器使用的检查端点。",
+  "authorization_required": "需要认证",
+  "cookies_disabled": "您的浏览器目前已禁用 Cookie，为了确认您是合法用户，Anubis 需要启用 Cookie。 请您为此域名启用 Cookie",
+  "access_denied": "拒绝访问：错误代码",
+  "dronebl_entry": "DroneBL 报告了一条记录",
+  "see_dronebl_lookup": "见",
+  "internal_server_error": "内部服务器错误：管理员错误地配置了 Anubis。 请联系管理员要求他们检查日志",
+  "invalid_redirect": "无效的重定向",
+  "redirect_not_parseable": "重定向 URL 无法解析",
+  "redirect_domain_not_allowed": "重定向的域名并不允许",
+  "failed_to_sign_jwt": "签署 JWT 失败",
+  "invalid_invocation": "无效的 MakeChallenge 调用",
+  "client_error_browser": "客户端错误：请确保您的浏览器是最新版本并稍候再试。",
+  "oh_noes": "哎呀糟糕了！",
+  "benchmarking_anubis": "正在进行 Anubis 性能测试！",
+  "you_are_not_a_bot": "你不是机器人！",
+  "making_sure_not_bot": "正在确认你是不是机器人！",
+  "celphase": "CELPHASE 设计",
+  "js_web_crypto_error": "您的浏览器无法正常使用 web.crypto 组件。您是否通过安全连接（HTTPS）查看此网站？",
+  "js_web_workers_error": "您的浏览器并不支持 Web workers （Anubis 使用这个来避免冻结您的浏览器 ）您有安装像是 JShelter 之类的插件吗？",
+  "js_cookies_error": "您的浏览器无法存储 Cookie。 Anubis 会使用 Cookie 存储签署的凭证，以判断用户是否已通过验证。请为此域名启用 Cookie 存储功能。 请注意，Anubis 存储的 Cookie 名称可能会变动，且其名称与内容不属于公开 API 的一部分。",
+  "js_context_not_secure": "您的内容并不安全",
+  "js_context_not_secure_msg": "请尝试使用 HTTPS 连接，或联系网站管理员设置 HTTPS。更多信息请参见 <a href=\"https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure\">MDN</a>。",
+  "js_calculating": "计算中...",
+  "js_missing_feature": "缺少功能",
+  "js_challenge_error": "挑战错误！",
+  "js_challenge_error_msg": "解决检查算法失败。 您可能会想要刷新页面。",
+  "js_calculating_difficulty": "计算中...<br/>难度：",
+  "js_speed": "速度：",
+  "js_verification_longer": "验证所花的时间高于预期。 请不要刷新页面。",
+  "js_success": "成功！",
+  "js_done_took": "完成！ 花费",
+  "js_iterations": "迭代",
+  "js_finished_reading": "我读完了，继续 →",
+  "js_calculation_error": "计算错误！",
+  "js_calculation_error_msg": "计算挑战失败：",
+  "missing_required_forwarded_headers": "缺少必要的 X-Forwarded-* 头",
+  "simplified_explanation": "这是一种类似于验证码的措施，用于防止机器人和恶意请求。但是，您无需自己动手，您的浏览器会收到一个计算任务，必须解决该任务以确保它是有效的客户端。这个概念称为<a href=\"https://en.wikipedia.org/wiki/Proof_of_work\">工作量证明</a>。该任务在几秒钟内计算完毕，您将被授予访问网站的权限。感谢您的理解和耐心。"
+}
@@ -0,0 +1,310 @@
+package nginx
+
+import "github.com/rain-kl/openflare/openflare-agent/internal/protocol"
+
+const openRestyWAFRuntimeLua = `local _M = {}
+
+function _M.check()
+local cjson = require "cjson.safe"
+
+local config_dict = ngx.shared.openflare_waf_config
+
+local function read_file(path)
+    local f = io.open(path, "r")
+    if not f then
+        return nil
+    end
+    local content = f:read("*a")
+    f:close()
+    return content
+end
+
+local function load_config()
+    local paths = {
+        "__OPENFLARE_RUNTIME_CONFIG_DIR__/waf_config.json",
+        "/etc/nginx/openflare-lua/waf_config.json",
+        "/usr/local/openresty/nginx/conf/waf_config.json"
+    }
+    for _, path in ipairs(paths) do
+        local content = read_file(path)
+        if content and content ~= "" then
+            local hash = ngx.md5(content)
+            if config_dict:get("_config_hash") == hash then
+                local cached = config_dict:get("_config_json")
+                if cached then
+                    local decoded = cjson.decode(cached)
+                    if decoded then
+                        return decoded
+                    end
+                end
+            end
+            local decoded = cjson.decode(content)
+            if decoded then
+                config_dict:set("_config_hash", hash, 0)
+                config_dict:set("_config_json", content, 0)
+                return decoded
+            end
+        end
+    end
+    return nil
+end
+
+local function load_ip_groups()
+    local paths = {
+        "__OPENFLARE_RUNTIME_CONFIG_DIR__/waf_ip_groups.json",
+        "/etc/nginx/openflare-lua/waf_ip_groups.json",
+        "/usr/local/openresty/nginx/conf/waf_ip_groups.json"
+    }
+    for _, path in ipairs(paths) do
+        local content = read_file(path)
+        if content and content ~= "" then
+            local hash = ngx.md5(content)
+            if config_dict:get("_ip_groups_hash") == hash then
+                local cached = config_dict:get("_ip_groups_json")
+                if cached then
+                    local decoded = cjson.decode(cached)
+                    if decoded then
+                        return decoded
+                    end
+                end
+            end
+            local decoded = cjson.decode(content)
+            if decoded then
+                config_dict:set("_ip_groups_hash", hash, 0)
+                config_dict:set("_ip_groups_json", content, 0)
+                return decoded
+            end
+        end
+    end
+    return { groups = {} }
+end
+
+local function list_contains(items, value)
+    if not items or type(items) ~= "table" or not value or value == "" then
+        return false
+    end
+    for _, item in ipairs(items) do
+        if item == value then
+            return true
+        end
+    end
+    return false
+end
+
+local function table_has_items(items)
+    return type(items) == "table" and #items > 0
+end
+
+local function parse_ipv4(value)
+    local a, b, c, d = string.match(value or "", "^(%d+)%.(%d+)%.(%d+)%.(%d+)$")
+    if not a then
+        return nil
+    end
+    a, b, c, d = tonumber(a), tonumber(b), tonumber(c), tonumber(d)
+    if a > 255 or b > 255 or c > 255 or d > 255 then
+        return nil
+    end
+    return ((a * 256 + b) * 256 + c) * 256 + d
+end
+
+local function ipv4_in_cidr(ip, cidr)
+    local base, bits = string.match(cidr or "", "^([^/]+)/(%d+)$")
+    if not base then
+        return false
+    end
+    bits = tonumber(bits)
+    if not bits or bits < 0 or bits > 32 then
+        return false
+    end
+    local ip_num = parse_ipv4(ip)
+    local base_num = parse_ipv4(base)
+    if not ip_num or not base_num then
+        return false
+    end
+    if bits == 0 then
+        return true
+    end
+    local mask = 4294967295 - (2 ^ (32 - bits) - 1)
+    return (ip_num - (ip_num % (2 ^ (32 - bits)))) == (base_num - (base_num % (2 ^ (32 - bits))))
+end
+
+local function ip_matches(items, ip)
+    if not items or type(items) ~= "table" or not ip or ip == "" then
+        return false
+    end
+    for _, item in ipairs(items) do
+        if item == ip then
+            return true
+        end
+        if string.find(item, "/", 1, true) and ipv4_in_cidr(ip, item) then
+            return true
+        end
+    end
+    return false
+end
+
+local function ip_matches_group_ids(group_ids, ip, ip_groups_config)
+    if not group_ids or type(group_ids) ~= "table" or not ip or ip == "" then
+        return false
+    end
+    local groups = (ip_groups_config or {}).groups or {}
+    for _, id in ipairs(group_ids) do
+        local group = groups[tostring(id)]
+        if group and group.enabled and ip_matches(group.ip_list, ip) then
+            return true
+        end
+    end
+    return false
+end
+
+local function lookup_country(ip)
+    local ok, maxminddb = pcall(require, "resty.maxminddb")
+    if not ok or not maxminddb then
+        return nil
+    end
+    local paths = {
+        "__OPENFLARE_RUNTIME_CONFIG_DIR__/GeoLite2-Country.mmdb",
+        "/etc/openflare/GeoLite2-Country.mmdb",
+        "/usr/local/share/openflare/GeoLite2-Country.mmdb"
+    }
+    for _, path in ipairs(paths) do
+        local opened = pcall(maxminddb.init, path)
+        if opened then
+            local res, err = maxminddb.lookup(ip)
+            if res and res.country and res.country.iso_code then
+                return string.upper(res.country.iso_code)
+            end
+        end
+    end
+    return nil
+end
+
+local function group_by_id(config)
+    local result = {}
+    for _, group in ipairs(config.rule_groups or {}) do
+        result[tostring(group.id)] = group
+    end
+    return result
+end
+
+local function active_groups(config, groups)
+    local site = ngx.var.openflare_waf_site or ""
+    local ids = (config.site_rule_groups or {})[site]
+    local result = {}
+    for _, group in ipairs(config.rule_groups or {}) do
+        if group.is_global then
+            result[#result + 1] = group
+        end
+    end
+    if ids then
+        local by_id = group_by_id(config)
+        for _, id in ipairs(ids) do
+            local group = by_id[tostring(id)]
+            if group and not group.is_global then
+                result[#result + 1] = group
+            end
+        end
+    end
+    return result
+end
+
+local function exit_with_group(group)
+    ngx.ctx.openflare_waf_blocked = true
+    ngx.status = tonumber(group.block_status_code) or 418
+    local body = group.block_response_body or ""
+    if body ~= "" then
+        ngx.header["Content-Type"] = "text/html; charset=utf-8"
+        ngx.say(body)
+    end
+    return ngx.exit(ngx.status)
+end
+
+local function first_allowlist_group(groups)
+    for _, group in ipairs(groups) do
+        if table_has_items(group.ip_whitelist)
+            or table_has_items(group.ip_whitelist_group_ids)
+            or table_has_items(group.country_whitelist) then
+            return group
+        end
+    end
+    return nil
+end
+
+local config = load_config()
+if not config then
+    if config_dict:add("_missing_config_logged", true, 60) then
+        ngx.log(ngx.WARN, "openflare waf config is missing or invalid; requests will be allowed")
+    end
+    return
+end
+
+local ip = ngx.var.remote_addr or ""
+local groups = active_groups(config)
+local ip_groups_config = load_ip_groups()
+if #groups == 0 then
+    if config_dict:add("_empty_groups_logged", true, 60) then
+        ngx.log(ngx.WARN, "openflare waf has no active rule group for site: ", ngx.var.openflare_waf_site or "")
+    end
+    return
+end
+
+for _, group in ipairs(groups) do
+    if ip_matches(group.ip_whitelist, ip) or ip_matches_group_ids(group.ip_whitelist_group_ids, ip, ip_groups_config) then
+        return
+    end
+end
+
+local country = nil
+for _, group in ipairs(groups) do
+    if type(group.country_whitelist) == "table" and #group.country_whitelist > 0 then
+        country = country or lookup_country(ip)
+        if list_contains(group.country_whitelist, country) then
+            return
+        end
+    end
+end
+
+local allowlist_group = first_allowlist_group(groups)
+if allowlist_group then
+    return exit_with_group(allowlist_group)
+end
+
+for _, group in ipairs(groups) do
+    if ip_matches(group.ip_blacklist, ip) or ip_matches_group_ids(group.ip_blacklist_group_ids, ip, ip_groups_config) then
+        return exit_with_group(group)
+    end
+end
+
+for _, group in ipairs(groups) do
+    if type(group.country_blacklist) == "table" and #group.country_blacklist > 0 then
+        country = country or lookup_country(ip)
+        if list_contains(group.country_blacklist, country) then
+            return exit_with_group(group)
+        end
+    end
+end
+
+return "ok"
+end
+
+return _M
+`
+
+const openRestyWAFCheckLua = `local source = debug.getinfo(1, "S").source or ""
+if string.sub(source, 1, 1) == "@" then
+    local script_path = string.sub(source, 2)
+    local base_dir = string.match(script_path, "^(.*)/waf/[^/]+%.lua$")
+    if base_dir and base_dir ~= "" and not string.find(package.path, base_dir, 1, true) then
+        package.path = base_dir .. "/?.lua;" .. base_dir .. "/?/init.lua;" .. package.path
+    end
+end
+
+return require("waf.runtime").check()
+`
+
+func ManagedWAFLuaFiles() []protocol.SupportFile {
+	return []protocol.SupportFile{
+		{Path: "waf/runtime.lua", Content: openRestyWAFRuntimeLua},
+		{Path: "waf/check.lua", Content: openRestyWAFCheckLua},
+	}
+}