[优化] go 引用调整

openflare-server/utils/render/openresty/render.go

@@ -0,0 +1,994 @@
+package openresty
+
+import (
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net/url"
+	"path"
+	"regexp"
+	"sort"
+	"strings"
+)
+
+func RenderJSON(sourceJSON string, certificateFiles []SupportFile) (*Result, error) {
+	var doc Document
+	if err := json.Unmarshal([]byte(strings.TrimSpace(sourceJSON)), &doc); err != nil {
+		return nil, fmt.Errorf("openresty source config json is invalid: %w", err)
+	}
+	return Render(doc, certificateFiles)
+}
+
+func Render(doc Document, certificateFiles []SupportFile) (*Result, error) {
+	mainConfig := RenderMainConfig(doc.OpenRestyConfig)
+	routeConfig, err := RenderRouteConfig(doc, certificateFiles)
+	if err != nil {
+		return nil, err
+	}
+	wafConfig, err := RenderWAFConfig(doc.WAF)
+	if err != nil {
+		return nil, err
+	}
+	files := append([]SupportFile(nil), certificateFiles...)
+	files = append(files, SupportFile{Path: "waf_config.json", Content: wafConfig})
+	files = DedupeSupportFiles(files)
+	return &Result{
+		MainConfig:   mainConfig,
+		RouteConfig:  routeConfig,
+		SupportFiles: files,
+		Checksum:     ChecksumBundle(mainConfig, routeConfig, files),
+	}, nil
+}
+
+func RenderMainConfig(cfg ConfigSnapshot) string {
+	templateText := cfg.MainConfigTemplate
+	if strings.TrimSpace(templateText) == "" {
+		templateText = defaultMainConfigTemplate
+	}
+	return renderMainConfigTemplate(templateText, cfg)
+}
+
+func ValidateMainConfigTemplate(templateText string) error {
+	trimmed := strings.TrimSpace(templateText)
+	if trimmed == "" {
+		return errors.New("OpenRestyMainConfigTemplate 不能为空")
+	}
+	for _, placeholder := range requiredMainConfigTemplatePlaceholders {
+		if !strings.Contains(trimmed, placeholder) {
+			return fmt.Errorf("OpenRestyMainConfigTemplate 必须保留占位符 %s", placeholder)
+		}
+	}
+	return nil
+}
+
+func RenderRouteConfig(doc Document, certificateFiles []SupportFile) (string, error) {
+	var builder strings.Builder
+	builder.WriteString("# This file is generated by OpenFlare. Do not edit manually.\n")
+	certificates := certificatesByID(certificateFiles)
+	for _, route := range doc.Routes {
+		domains := normalizedRouteDomains(route)
+		if len(domains) == 0 {
+			return "", fmt.Errorf("route %s domains are invalid", route.Domain)
+		}
+		serverNames := renderServerNames(domains)
+		displayName := strings.TrimSpace(route.SiteName)
+		if displayName == "" {
+			displayName = domains[0]
+		}
+		cacheConfig := routeCacheConfig{Enabled: route.CacheEnabled, Policy: route.CachePolicy, Rules: route.CacheRules}
+		limitConfig := routeLimitConfig{LimitConnPerServer: route.LimitConnPerServer, LimitConnPerIP: route.LimitConnPerIP, LimitRate: route.LimitRate}
+		powEnabled, _ := getPoWConfigForRoute(route.ID, doc.WAF)
+		if normalizeRouteUpstreamType(route.UpstreamType) == "pages" {
+			if route.PagesDeployment == nil {
+				return "", fmt.Errorf("route %s pages deployment is missing", route.Domain)
+			}
+			if !route.EnableHTTPS {
+				builder.WriteString(renderHTTPPagesServer(serverNames, displayName, route.PagesDeployment, limitConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword))
+				continue
+			}
+			certIDs := normalizeCertIDs(route.CertID, route.CertIDs)
+			domainCertIDs := normalizeDomainCertIDs(domains, certIDs, route.DomainCertIDs)
+			if len(certIDs) == 0 {
+				return "", fmt.Errorf("路由 %s 未配置证书", route.Domain)
+			}
+			httpOnlyDomains := make([]string, 0, len(domains))
+			domainsByCertID := make(map[uint][]string, len(certIDs))
+			for index, domain := range domains {
+				if index >= len(domainCertIDs) || domainCertIDs[index] == 0 {
+					httpOnlyDomains = append(httpOnlyDomains, domain)
+					continue
+				}
+				domainsByCertID[domainCertIDs[index]] = append(domainsByCertID[domainCertIDs[index]], domain)
+			}
+			for _, certID := range certIDs {
+				assignedDomains := domainsByCertID[certID]
+				if len(assignedDomains) == 0 {
+					continue
+				}
+				certPEM, ok := certificates[certID]
+				if !ok {
+					return "", fmt.Errorf("route %s certificate %d does not exist", route.Domain, certID)
+				}
+				if err := validateCertificateCoverage(certPEM, assignedDomains); err != nil {
+					return "", fmt.Errorf("site %s certificate validation failed: %w", displayName, err)
+				}
+			}
+			if route.RedirectHTTP {
+				if len(httpOnlyDomains) > 0 {
+					builder.WriteString(renderHTTPPagesServer(renderServerNames(httpOnlyDomains), displayName, route.PagesDeployment, limitConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword))
+				}
+				for _, certID := range certIDs {
+					if assignedDomains := domainsByCertID[certID]; len(assignedDomains) > 0 {
+						builder.WriteString(renderHTTPRedirectServer(renderServerNames(assignedDomains)))
+					}
+				}
+			} else {
+				builder.WriteString(renderHTTPPagesServer(serverNames, displayName, route.PagesDeployment, limitConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword))
+			}
+			for _, certID := range certIDs {
+				if assignedDomains := domainsByCertID[certID]; len(assignedDomains) > 0 {
+					builder.WriteString(renderHTTPSPagesServer(renderServerNames(assignedDomains), displayName, certID, route.PagesDeployment, limitConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
+				}
+			}
+			continue
+		}
+		upstreams := route.Upstreams
+		if len(upstreams) == 0 && strings.TrimSpace(route.OriginURL) != "" {
+			upstreams = []string{route.OriginURL}
+		}
+		upstreamConfig := buildRouteUpstreamConfig(route, upstreams)
+		if upstreamConfig.UsesNamedUpstream {
+			builder.WriteString(renderNamedUpstreamBlock(upstreamConfig))
+		}
+		if !route.EnableHTTPS {
+			builder.WriteString(renderHTTPProxyServer(serverNames, displayName, route.OriginURL, route.OriginHost, route.CustomHeaders, cacheConfig, limitConfig, upstreamConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
+			continue
+		}
+		certIDs := normalizeCertIDs(route.CertID, route.CertIDs)
+		domainCertIDs := normalizeDomainCertIDs(domains, certIDs, route.DomainCertIDs)
+		if len(certIDs) == 0 {
+			return "", fmt.Errorf("路由 %s 未配置证书", route.Domain)
+		}
+		httpOnlyDomains := make([]string, 0, len(domains))
+		domainsByCertID := make(map[uint][]string, len(certIDs))
+		for index, domain := range domains {
+			if index >= len(domainCertIDs) || domainCertIDs[index] == 0 {
+				httpOnlyDomains = append(httpOnlyDomains, domain)
+				continue
+			}
+			domainsByCertID[domainCertIDs[index]] = append(domainsByCertID[domainCertIDs[index]], domain)
+		}
+		for _, certID := range certIDs {
+			assignedDomains := domainsByCertID[certID]
+			if len(assignedDomains) == 0 {
+				continue
+			}
+			certPEM, ok := certificates[certID]
+			if !ok {
+				return "", fmt.Errorf("route %s certificate %d does not exist", route.Domain, certID)
+			}
+			if err := validateCertificateCoverage(certPEM, assignedDomains); err != nil {
+				return "", fmt.Errorf("site %s certificate validation failed: %w", displayName, err)
+			}
+		}
+		if route.RedirectHTTP {
+			if len(httpOnlyDomains) > 0 {
+				builder.WriteString(renderHTTPProxyServer(renderServerNames(httpOnlyDomains), displayName, route.OriginURL, route.OriginHost, route.CustomHeaders, cacheConfig, limitConfig, upstreamConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
+			}
+			for _, certID := range certIDs {
+				if assignedDomains := domainsByCertID[certID]; len(assignedDomains) > 0 {
+					builder.WriteString(renderHTTPRedirectServer(renderServerNames(assignedDomains)))
+				}
+			}
+		} else {
+			builder.WriteString(renderHTTPProxyServer(serverNames, displayName, route.OriginURL, route.OriginHost, route.CustomHeaders, cacheConfig, limitConfig, upstreamConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
+		}
+		for _, certID := range certIDs {
+			if assignedDomains := domainsByCertID[certID]; len(assignedDomains) > 0 {
+				builder.WriteString(renderHTTPSServer(renderServerNames(assignedDomains), displayName, route.OriginURL, route.OriginHost, certID, route.CustomHeaders, cacheConfig, limitConfig, upstreamConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
+			}
+		}
+	}
+	return builder.String(), nil
+}
+
+func RenderPoWConfig(doc Document) (string, error) {
+	type domainEntry struct {
+		Domains []string   `json:"domains"`
+		Enabled bool       `json:"enabled"`
+		Config  *PoWConfig `json:"config"`
+	}
+	entries := make([]domainEntry, 0)
+	for _, route := range doc.Routes {
+		powEnabled, powConfig := getPoWConfigForRoute(route.ID, doc.WAF)
+		if !powEnabled {
+			continue
+		}
+		entries = append(entries, domainEntry{Domains: normalizedRouteDomains(route), Enabled: true, Config: powConfig})
+	}
+	if len(entries) == 0 {
+		return "{}", nil
+	}
+	data, err := json.Marshal(entries)
+	return string(data), err
+}
+
+func RenderWAFConfig(snapshot WAFDocument) (string, error) {
+	type wafRuntimeRuleGroup struct {
+		ID                uint       `json:"id"`
+		Name              string     `json:"name"`
+		IsGlobal          bool       `json:"is_global"`
+		BlockStatusCode   int        `json:"block_status_code"`
+		BlockResponseBody string     `json:"block_response_body"`
+		IPWhitelist       []string   `json:"ip_whitelist"`
+		IPBlacklist       []string   `json:"ip_blacklist"`
+		IPWhitelistGroups []uint     `json:"ip_whitelist_group_ids,omitempty"`
+		IPBlacklistGroups []uint     `json:"ip_blacklist_group_ids,omitempty"`
+		CountryWhitelist  []string   `json:"country_whitelist"`
+		CountryBlacklist  []string   `json:"country_blacklist"`
+		RegionWhitelist   []string   `json:"region_whitelist"`
+		RegionBlacklist   []string   `json:"region_blacklist"`
+		PoWEnabled        bool       `json:"pow_enabled"`
+		PoWConfig         *PoWConfig `json:"pow_config,omitempty"`
+	}
+	type wafRuntimeConfig struct {
+		DefaultBlockStatusCode int                   `json:"default_block_status_code"`
+		RuleGroups             []wafRuntimeRuleGroup `json:"rule_groups"`
+		SiteRuleGroups         map[string][]uint     `json:"site_rule_groups"`
+	}
+	groups := make([]wafRuntimeRuleGroup, 0, len(snapshot.RuleGroups))
+	globalGroupIDs := make([]uint, 0)
+	enabledGroupIDs := make(map[uint]struct{}, len(snapshot.RuleGroups))
+	for _, group := range snapshot.RuleGroups {
+		if !group.Enabled {
+			continue
+		}
+		statusCode := group.BlockStatusCode
+		if statusCode == 0 {
+			statusCode = defaultWAFBlockStatus
+		}
+		if group.IsGlobal {
+			globalGroupIDs = append(globalGroupIDs, group.ID)
+		}
+		enabledGroupIDs[group.ID] = struct{}{}
+		powConfig := group.PoWConfig
+		if !group.PoWEnabled {
+			powConfig = nil
+		}
+		groups = append(groups, wafRuntimeRuleGroup{
+			ID:                group.ID,
+			Name:              group.Name,
+			IsGlobal:          group.IsGlobal,
+			BlockStatusCode:   statusCode,
+			BlockResponseBody: group.BlockResponseBody,
+			IPWhitelist:       sortedUniqueStrings(group.IPWhitelist),
+			IPBlacklist:       sortedUniqueStrings(group.IPBlacklist),
+			IPWhitelistGroups: sortedUniqueUintIDs(group.IPWhitelistGroups),
+			IPBlacklistGroups: sortedUniqueUintIDs(group.IPBlacklistGroups),
+			CountryWhitelist:  group.CountryWhitelist,
+			CountryBlacklist:  group.CountryBlacklist,
+			RegionWhitelist:   group.RegionWhitelist,
+			RegionBlacklist:   group.RegionBlacklist,
+			PoWEnabled:        group.PoWEnabled,
+			PoWConfig:         powConfig,
+		})
+	}
+	sort.Slice(groups, func(i, j int) bool {
+		if groups[i].IsGlobal != groups[j].IsGlobal {
+			return groups[i].IsGlobal
+		}
+		return groups[i].ID < groups[j].ID
+	})
+	sort.Slice(globalGroupIDs, func(i, j int) bool { return globalGroupIDs[i] < globalGroupIDs[j] })
+	siteRuleGroups := make(map[string][]uint, len(snapshot.Bindings))
+	for _, binding := range snapshot.Bindings {
+		ids := append([]uint{}, globalGroupIDs...)
+		for _, id := range binding.RuleGroupIDs {
+			if _, ok := enabledGroupIDs[id]; ok {
+				ids = append(ids, id)
+			}
+		}
+		siteRuleGroups[binding.SiteName] = uniqueUintIDs(ids)
+	}
+	data, err := json.Marshal(wafRuntimeConfig{DefaultBlockStatusCode: defaultWAFBlockStatus, RuleGroups: groups, SiteRuleGroups: siteRuleGroups})
+	return string(data), err
+}
+
+func sortedUniqueStrings(values []string) []string {
+	items := append([]string{}, values...)
+	items = uniqueStrings(items)
+	sort.Strings(items)
+	return items
+}
+
+func sortedUniqueUintIDs(values []uint) []uint {
+	items := uniqueUintIDs(values)
+	sort.Slice(items, func(i, j int) bool { return items[i] < items[j] })
+	return items
+}
+
+func ChecksumBundle(mainConfig string, routeConfig string, supportFiles []SupportFile) string {
+	var builder strings.Builder
+	builder.WriteString(mainConfig)
+	builder.WriteString("\n--route-config--\n")
+	builder.WriteString(routeConfig)
+	builder.WriteString("\n--support-files--\n")
+	files := DedupeSupportFiles(supportFiles)
+	sort.Slice(files, func(i int, j int) bool { return files[i].Path < files[j].Path })
+	for _, file := range files {
+		if file.Path == SourceConfigFileName {
+			continue
+		}
+		builder.WriteString(file.Path)
+		builder.WriteString("\n")
+		builder.WriteString(file.Content)
+		builder.WriteString("\n")
+	}
+	sum := sha256.Sum256([]byte(builder.String()))
+	return hex.EncodeToString(sum[:])
+}
+
+func DedupeSupportFiles(files []SupportFile) []SupportFile {
+	if len(files) == 0 {
+		return nil
+	}
+	unique := make(map[string]SupportFile, len(files))
+	for _, file := range files {
+		unique[file.Path] = file
+	}
+	result := make([]SupportFile, 0, len(unique))
+	for _, file := range unique {
+		result = append(result, file)
+	}
+	return result
+}
+
+func renderMainConfigTemplate(templateText string, cfg ConfigSnapshot) string {
+	replacer := strings.NewReplacer(
+		"{{OpenRestyWorkerProcesses}}", cfg.WorkerProcesses,
+		"{{OpenRestyWorkerConnections}}", fmt.Sprintf("%d", cfg.WorkerConnections),
+		"{{OpenRestyWorkerRlimitNofile}}", fmt.Sprintf("%d", cfg.WorkerRlimitNofile),
+		"{{OpenRestyConnectionUpgradeMap}}", renderConnectionUpgradeMap(),
+		"{{OpenRestyDefaultServerBlock}}", renderDefaultServerBlock(cfg.DefaultServerReturnStatus, cfg.HTTP3Enabled),
+		"{{OpenRestyAccessLogPath}}", AccessLogPlaceholder,
+		"{{OpenRestyErrorLogPath}}", ErrorLogPlaceholder,
+		"{{OpenRestyEventsUseDirective}}", renderTemplateDirective(cfg.EventsUse != "", fmt.Sprintf("use %s;", cfg.EventsUse)),
+		"{{OpenRestyEventsMultiAcceptDirective}}", renderTemplateDirective(cfg.EventsMultiAcceptEnabled, "multi_accept on;"),
+		"{{OpenRestyKeepaliveTimeout}}", fmt.Sprintf("%d", cfg.KeepaliveTimeout),
+		"{{OpenRestyKeepaliveRequests}}", fmt.Sprintf("%d", cfg.KeepaliveRequests),
+		"{{OpenRestyClientHeaderTimeout}}", fmt.Sprintf("%d", cfg.ClientHeaderTimeout),
+		"{{OpenRestyClientBodyTimeout}}", fmt.Sprintf("%d", cfg.ClientBodyTimeout),
+		"{{OpenRestyClientMaxBodySize}}", cfg.ClientMaxBodySize,
+		"{{OpenRestyLargeClientHeaderBuffers}}", cfg.LargeClientHeaderBuffers,
+		"{{OpenRestySendTimeout}}", fmt.Sprintf("%d", cfg.SendTimeout),
+		"{{OpenRestyProxyConnectTimeout}}", fmt.Sprintf("%d", cfg.ProxyConnectTimeout),
+		"{{OpenRestyProxySendTimeout}}", fmt.Sprintf("%d", cfg.ProxySendTimeout),
+		"{{OpenRestyProxyReadTimeout}}", fmt.Sprintf("%d", cfg.ProxyReadTimeout),
+		"{{OpenRestyProxyRequestBuffering}}", onOff(cfg.ProxyRequestBuffering),
+		"{{OpenRestyProxyBuffering}}", onOff(cfg.ProxyBufferingEnabled),
+		"{{OpenRestyProxyBuffers}}", cfg.ProxyBuffers,
+		"{{OpenRestyProxyBufferSize}}", cfg.ProxyBufferSize,
+		"{{OpenRestyProxyBusyBuffersSize}}", cfg.ProxyBusyBuffersSize,
+		"{{OpenRestyGzip}}", onOff(cfg.GzipEnabled),
+		"{{OpenRestyGzipMinLength}}", fmt.Sprintf("%d", cfg.GzipMinLength),
+		"{{OpenRestyGzipCompLevel}}", fmt.Sprintf("%d", cfg.GzipCompLevel),
+		"{{OpenRestyResolverDirective}}", renderTemplateDirective(cfg.Resolvers != "", fmt.Sprintf("resolver %s;", cfg.Resolvers)),
+		"{{OpenRestyCacheBlock}}", renderOpenRestyCacheTemplateBlock(cfg),
+		"{{OpenRestyRouteConfigInclude}}", RouteConfigPlaceholder,
+	)
+	return replacer.Replace(templateText)
+}
+
+func renderTemplateDirective(enabled bool, statement string) string {
+	if !enabled {
+		return ""
+	}
+	return fmt.Sprintf("    %s\n", statement)
+}
+
+func renderOpenRestyCacheTemplateBlock(cfg ConfigSnapshot) string {
+	lines := []string{renderOpenRestyLimitZoneBlock()}
+	if !cfg.CacheEnabled {
+		lines = append(lines, renderOpenRestyObservabilityTemplateBlock())
+		return strings.Join(lines, "")
+	}
+	lines = append(lines, strings.Join([]string{
+		fmt.Sprintf("    proxy_cache_path %s levels=%s keys_zone=openflare_cache:10m inactive=%s max_size=%s;", cfg.CachePath, cfg.CacheLevels, cfg.CacheInactive, cfg.CacheMaxSize),
+		fmt.Sprintf("    proxy_cache_key \"%s\";", cfg.CacheKeyTemplate),
+		fmt.Sprintf("    proxy_cache_lock %s;", onOff(cfg.CacheLockEnabled)),
+		fmt.Sprintf("    proxy_cache_lock_timeout %s;", cfg.CacheLockTimeout),
+		fmt.Sprintf("    proxy_cache_use_stale %s;", cfg.CacheUseStale),
+		"",
+	}, "\n"))
+	lines = append(lines, renderOpenRestyObservabilityTemplateBlock())
+	return strings.Join(lines, "")
+}
+
+func renderOpenRestyLimitZoneBlock() string {
+	return "    limit_conn_zone $server_name zone=openflare_conn_per_server:10m;\n    limit_conn_zone $binary_remote_addr zone=openflare_conn_per_ip:10m;\n"
+}
+
+func renderOpenRestyObservabilityTemplateBlock() string {
+	return fmt.Sprintf("    lua_shared_dict openflare_observability 10m;\n    lua_shared_dict openflare_pow_challenges 10m;\n    lua_shared_dict openflare_pow_sessions 10m;\n    lua_shared_dict openflare_pow_config 1m;\n    lua_shared_dict openflare_waf_config 1m;\n    init_worker_by_lua_file %s/observability/init.lua;\n    log_by_lua_file %s/observability/log.lua;\n\n    server {\n        listen %s;\n        server_name openflare-observability;\n        access_log off;\n\n        location = /openflare/stub_status {\n            stub_status;\n        }\n\n        location = /openflare/observability {\n            default_type application/json;\n            content_by_lua_file %s/observability/read.lua;\n        }\n    }\n\n", LuaDirPlaceholder, LuaDirPlaceholder, ObservabilityListenPlaceholder, LuaDirPlaceholder)
+}
+
+func renderHTTPProxyServer(serverNames string, siteName string, originURL string, originHost string, customHeaders []CustomHeader, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg ConfigSnapshot) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig, cfg), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
+}
+
+func renderPagesAPIProxyLocationBlock(deployment *PagesDeployment) string {
+	if deployment == nil || !deployment.APIProxyEnabled {
+		return ""
+	}
+	path := strings.TrimSpace(deployment.APIProxyPath)
+	pass := strings.TrimSpace(deployment.APIProxyPass)
+	rewrite := strings.TrimSpace(deployment.APIProxyRewrite)
+	if path == "" || pass == "" {
+		return ""
+	}
+	if !strings.HasPrefix(path, "/") {
+		path = "/" + path
+	}
+	cleanPath := strings.TrimSuffix(path, "/")
+
+	var builder strings.Builder
+	builder.WriteString(fmt.Sprintf("\n    location %s {\n", cleanPath))
+	if rewrite != "" {
+		if !strings.HasPrefix(rewrite, "/") {
+			rewrite = "/" + rewrite
+		}
+		cleanRewrite := strings.TrimSuffix(rewrite, "/")
+		if cleanRewrite == "" {
+			builder.WriteString(fmt.Sprintf("        rewrite ^%s/(.*)$ /$1 break;\n", regexp.QuoteMeta(cleanPath)))
+			builder.WriteString(fmt.Sprintf("        rewrite ^%s$ / break;\n", regexp.QuoteMeta(cleanPath)))
+		} else {
+			builder.WriteString(fmt.Sprintf("        rewrite ^%s/(.*)$ %s/$1 break;\n", regexp.QuoteMeta(cleanPath), cleanRewrite))
+			builder.WriteString(fmt.Sprintf("        rewrite ^%s$ %s break;\n", regexp.QuoteMeta(cleanPath), cleanRewrite))
+		}
+	}
+	builder.WriteString(fmt.Sprintf("        proxy_pass %s;\n", pass))
+	builder.WriteString("        proxy_http_version 1.1;\n")
+	builder.WriteString("        proxy_set_header Host $http_host;\n")
+	builder.WriteString("        proxy_set_header X-Real-IP $remote_addr;\n")
+	builder.WriteString("        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n")
+	builder.WriteString("        proxy_set_header X-Forwarded-Proto $scheme;\n")
+	builder.WriteString("        proxy_set_header Upgrade $http_upgrade;\n")
+	builder.WriteString("        proxy_set_header Connection $connection_upgrade;\n")
+	builder.WriteString("    }\n")
+	return builder.String()
+}
+
+func renderHTTPPagesServer(serverNames string, siteName string, deployment *PagesDeployment, limitConfig routeLimitConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s%s    root %s;\n    index %s;%s\n\n    location / {\n%s%s    }\n%s}\n\n", serverNames, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), quoteNginxStringLiteral(pagesDeploymentRoot(deployment)), quoteNginxStringLiteral(pagesEntryFile(deployment)), renderPagesAPIProxyLocationBlock(deployment), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderPagesLocationBlock(deployment, limitConfig), renderPowStaticLocationBlock(powEnabled))
+}
+
+func renderHTTPRedirectServer(serverNames string) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    return 301 https://$host$request_uri;\n}\n\n", serverNames)
+}
+
+func renderHTTPSServer(serverNames string, siteName string, originURL string, originHost string, certificateID uint, customHeaders []CustomHeader, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg ConfigSnapshot) string {
+	certPath := fmt.Sprintf("%s/%d.crt", CertDirPlaceholder, certificateID)
+	keyPath := fmt.Sprintf("%s/%d.key", CertDirPlaceholder, certificateID)
+	var h3Listen string
+	var h3Header string
+	if cfg.HTTP3Enabled {
+		h3Listen = "    listen 443 quic;\n"
+		h3Header = "    add_header Alt-Svc 'h3=\":443\"; ma=86400';\n"
+	}
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n%s    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", h3Listen, serverNames, certPath, keyPath, h3Header, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig, cfg), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
+}
+
+func renderHTTPSPagesServer(serverNames string, siteName string, certificateID uint, deployment *PagesDeployment, limitConfig routeLimitConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg ConfigSnapshot) string {
+	certPath := fmt.Sprintf("%s/%d.crt", CertDirPlaceholder, certificateID)
+	keyPath := fmt.Sprintf("%s/%d.key", CertDirPlaceholder, certificateID)
+	var h3Listen string
+	var h3Header string
+	if cfg.HTTP3Enabled {
+		h3Listen = "    listen 443 quic;\n"
+		h3Header = "    add_header Alt-Svc 'h3=\":443\"; ma=86400';\n"
+	}
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n%s    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s%s%s    root %s;\n    index %s;%s\n\n    location / {\n%s%s    }\n%s}\n\n", h3Listen, serverNames, certPath, keyPath, h3Header, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), quoteNginxStringLiteral(pagesDeploymentRoot(deployment)), quoteNginxStringLiteral(pagesEntryFile(deployment)), renderPagesAPIProxyLocationBlock(deployment), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderPagesLocationBlock(deployment, limitConfig), renderPowStaticLocationBlock(powEnabled))
+}
+
+func renderPagesLocationBlock(deployment *PagesDeployment, limitConfig routeLimitConfig) string {
+	var builder strings.Builder
+	builder.WriteString(renderRouteLimitBlock(limitConfig))
+	if deployment != nil && deployment.SPAFallbackEnabled {
+		builder.WriteString(fmt.Sprintf("        try_files $uri $uri/ %s;\n", pagesFallbackPath(deployment)))
+	} else {
+		builder.WriteString("        try_files $uri $uri/ =404;\n")
+	}
+	return builder.String()
+}
+
+func pagesDeploymentRoot(deployment *PagesDeployment) string {
+	if deployment == nil || strings.TrimSpace(deployment.LocalRoot) == "" {
+		return PagesDirPlaceholder
+	}
+	return filepathToNginxPath(deployment.LocalRoot)
+}
+
+func pagesEntryFile(deployment *PagesDeployment) string {
+	if deployment == nil || strings.TrimSpace(deployment.EntryFile) == "" {
+		return "index.html"
+	}
+	return strings.TrimPrefix(filepathToNginxPath(deployment.EntryFile), "/")
+}
+
+func pagesFallbackPath(deployment *PagesDeployment) string {
+	if deployment == nil || strings.TrimSpace(deployment.SPAFallbackPath) == "" {
+		return "/index.html"
+	}
+	value := filepathToNginxPath(strings.TrimSpace(deployment.SPAFallbackPath))
+	if !strings.HasPrefix(value, "/") {
+		value = "/" + value
+	}
+	if value == "/" || strings.HasSuffix(value, "/") || strings.Contains(value, "\\") || strings.ContainsAny(value, "\"';") || strings.ContainsAny(value, " \t\r\n") {
+		return "/index.html"
+	}
+	for _, segment := range strings.Split(value, "/") {
+		if segment == "." || segment == ".." {
+			return "/index.html"
+		}
+	}
+	cleaned := path.Clean(value)
+	if cleaned == "/" || strings.HasSuffix(cleaned, "/") {
+		return "/index.html"
+	}
+	return cleaned
+}
+
+func renderProxyHeaderBlock(originURL string, originHost string, customHeaders []CustomHeader, upstreamConfig routeUpstreamConfig, cfg ConfigSnapshot) string {
+	var builder strings.Builder
+	if strings.TrimSpace(originHost) != "" {
+		builder.WriteString(fmt.Sprintf("        proxy_set_header Host %s;\n", quoteNginxStringLiteral(originHost)))
+	} else {
+		builder.WriteString("        proxy_set_header Host $host;\n")
+	}
+	if upstreamServerName := resolveUpstreamServerName(originURL, originHost); upstreamServerName != "" {
+		builder.WriteString("        proxy_ssl_server_name on;\n")
+		builder.WriteString(fmt.Sprintf("        proxy_ssl_name %s;\n", quoteNginxStringLiteral(upstreamServerName)))
+	}
+	builder.WriteString("        proxy_set_header X-Real-IP $remote_addr;\n")
+	builder.WriteString("        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n")
+	builder.WriteString("        proxy_set_header X-Forwarded-Proto $scheme;\n")
+	if cfg.WebsocketEnabled {
+		builder.WriteString("        proxy_http_version 1.1;\n")
+		builder.WriteString("        proxy_set_header Connection $connection_upgrade;\n")
+		builder.WriteString("        proxy_set_header Upgrade $http_upgrade;\n")
+	} else if upstreamConfig.UsesNamedUpstream {
+		builder.WriteString("        proxy_http_version 1.1;\n")
+		builder.WriteString("        proxy_set_header Connection \"\";\n")
+	}
+	for _, header := range customHeaders {
+		builder.WriteString(fmt.Sprintf("        proxy_set_header %s %s;\n", header.Key, quoteNginxStringLiteral(header.Value)))
+	}
+	return builder.String()
+}
+
+func renderAccessBlock(siteName string, powEnabled bool) string {
+	escapedSiteName := escapeNginxString(siteName)
+	if !powEnabled {
+		return fmt.Sprintf("    set $openflare_waf_site \"%s\";\n    access_by_lua_file %s/waf/check.lua;\n", escapedSiteName, LuaDirPlaceholder)
+	}
+	return fmt.Sprintf(`    set $openflare_waf_site "%s";
+    access_by_lua_block {
+        if not string.find(package.path, "%s/?.lua", 1, true) then
+            package.path = "%s/?.lua;%s/?/init.lua;" .. package.path
+        end
+        require("waf.runtime").check()
+        if ngx.ctx.openflare_waf_blocked then
+            return
+        end
+        require("pow.runtime").check()
+    }
+`, escapedSiteName, LuaDirPlaceholder, LuaDirPlaceholder, LuaDirPlaceholder)
+}
+
+func renderBasicAuthBlock(enabled bool, username, password string) string {
+	if !enabled || username == "" || password == "" {
+		return ""
+	}
+	encoded := base64.StdEncoding.EncodeToString([]byte(username + ":" + password))
+	return fmt.Sprintf("        rewrite_by_lua_block {\n            local auth = ngx.var.http_authorization\n            if auth ~= \"Basic %s\" then\n                ngx.header[\"WWW-Authenticate\"] = 'Basic realm=\"Restricted\"'\n                return ngx.exit(401)\n            end\n        }\n", encoded)
+}
+
+func renderPowLocationBlocks(powEnabled bool) string {
+	if !powEnabled {
+		return ""
+	}
+	return fmt.Sprintf("\n    location = %spass-challenge {\n        content_by_lua_file %s/pow/verify.lua;\n    }\n\n    location = %smake-challenge {\n        content_by_lua_file %s/pow/challenge.lua;\n    }\n\n", anubisAPIPrefix, LuaDirPlaceholder, anubisAPIPrefix, LuaDirPlaceholder)
+}
+
+func renderPowStaticLocationBlock(powEnabled bool) string {
+	if !powEnabled {
+		return ""
+	}
+	return fmt.Sprintf("    location %s {\n        alias %s/;\n        types {\n            text/css css;\n            application/javascript js mjs;\n            application/json json;\n            image/webp webp;\n            font/woff2 woff2;\n        }\n    }\n\n", anubisStaticPrefix, PowStaticDirPlaceholder)
+}
+
+func renderRouteCacheBlock(cacheConfig routeCacheConfig, cfg ConfigSnapshot) string {
+	if !cfg.CacheEnabled || !cacheConfig.Enabled {
+		return ""
+	}
+	var builder strings.Builder
+	builder.WriteString("        set $openflare_skip_cache 0;\n")
+	builder.WriteString("        if ($request_method != GET) {\n            set $openflare_skip_cache 1;\n        }\n")
+	builder.WriteString("        if ($http_authorization != \"\") {\n            set $openflare_skip_cache 1;\n        }\n")
+	builder.WriteString("        if ($http_cookie ~* \"(session|sess|token|auth|jwt|logged_in|remember|laravel_session|connect\\\\.sid|_session)\") {\n            set $openflare_skip_cache 1;\n        }\n")
+	builder.WriteString("        if ($http_cache_control ~* \"(no-cache|no-store|private)\") {\n            set $openflare_skip_cache 1;\n        }\n")
+	if condition := renderRouteCachePolicyCondition(cacheConfig); condition != "" {
+		builder.WriteString(condition)
+	}
+	builder.WriteString("        proxy_cache openflare_cache;\n")
+	builder.WriteString("        proxy_cache_methods GET;\n")
+	builder.WriteString("        proxy_cache_bypass $openflare_skip_cache;\n")
+	builder.WriteString("        proxy_no_cache $openflare_skip_cache;\n")
+	return builder.String()
+}
+
+func renderRouteLimitBlock(limitConfig routeLimitConfig) string {
+	var builder strings.Builder
+	if limitConfig.LimitConnPerServer > 0 {
+		builder.WriteString(fmt.Sprintf("        limit_conn openflare_conn_per_server %d;\n", limitConfig.LimitConnPerServer))
+	}
+	if limitConfig.LimitConnPerIP > 0 {
+		builder.WriteString(fmt.Sprintf("        limit_conn openflare_conn_per_ip %d;\n", limitConfig.LimitConnPerIP))
+	}
+	if strings.TrimSpace(limitConfig.LimitRate) != "" {
+		builder.WriteString(fmt.Sprintf("        limit_rate %s;\n", limitConfig.LimitRate))
+	}
+	return builder.String()
+}
+
+func renderRouteCachePolicyCondition(cacheConfig routeCacheConfig) string {
+	switch cacheConfig.Policy {
+	case cachePolicySuffix:
+		return fmt.Sprintf("        if ($uri !~* %s) {\n            set $openflare_skip_cache 1;\n        }\n", quoteNginxStringLiteral(buildSuffixMatchPattern(cacheConfig.Rules)))
+	case cachePolicyPathPrefix:
+		return fmt.Sprintf("        if ($uri !~ %s) {\n            set $openflare_skip_cache 1;\n        }\n", quoteNginxStringLiteral(buildPathPrefixMatchPattern(cacheConfig.Rules)))
+	case cachePolicyPathExact:
+		return fmt.Sprintf("        if ($uri !~ %s) {\n            set $openflare_skip_cache 1;\n        }\n", quoteNginxStringLiteral(buildPathExactMatchPattern(cacheConfig.Rules)))
+	default:
+		return ""
+	}
+}
+
+func renderProxyPassBlock(originURL string, upstreamConfig routeUpstreamConfig) string {
+	parsed, err := url.Parse(originURL)
+	if err != nil || parsed.Host == "" || parsed.Scheme == "" {
+		return fmt.Sprintf("        proxy_pass %s;\n", originURL)
+	}
+	if upstreamConfig.UsesNamedUpstream {
+		return fmt.Sprintf("        proxy_pass %s://%s%s;\n", upstreamConfig.Scheme, upstreamConfig.Name, upstreamConfig.ProxyPassURI)
+	}
+	return fmt.Sprintf("        proxy_pass %s;\n", originURL)
+}
+
+func buildRouteUpstreamConfig(route Route, upstreams []string) routeUpstreamConfig {
+	if len(upstreams) == 0 {
+		return routeUpstreamConfig{}
+	}
+	if len(upstreams) == 1 {
+		parsed, err := url.Parse(strings.TrimSpace(upstreams[0]))
+		if err != nil || parsed.Host == "" || parsed.Scheme == "" {
+			return routeUpstreamConfig{}
+		}
+		return routeUpstreamConfig{Name: buildRouteUpstreamName(route), Scheme: parsed.Scheme, ProxyPassURI: buildUpstreamProxyPassURI(parsed), Servers: []string{parsed.Host}, UsesNamedUpstream: true}
+	}
+	servers := make([]string, 0, len(upstreams))
+	var scheme string
+	for _, upstream := range upstreams {
+		parsed, err := url.Parse(strings.TrimSpace(upstream))
+		if err != nil || parsed.Host == "" || parsed.Scheme == "" || (strings.TrimSpace(parsed.EscapedPath()) != "" && strings.TrimSpace(parsed.EscapedPath()) != "/") || parsed.RawQuery != "" {
+			return routeUpstreamConfig{}
+		}
+		if scheme == "" {
+			scheme = parsed.Scheme
+		} else if scheme != parsed.Scheme {
+			return routeUpstreamConfig{}
+		}
+		servers = append(servers, parsed.Host)
+	}
+	return routeUpstreamConfig{Name: buildRouteUpstreamName(route), Scheme: scheme, Servers: servers, UsesNamedUpstream: true}
+}
+
+func normalizeRouteUpstreamType(raw string) string {
+	switch strings.ToLower(strings.TrimSpace(raw)) {
+	case "pages":
+		return "pages"
+	default:
+		return "direct"
+	}
+}
+
+func renderNamedUpstreamBlock(upstreamConfig routeUpstreamConfig) string {
+	var builder strings.Builder
+	builder.WriteString(fmt.Sprintf("upstream %s {\n", upstreamConfig.Name))
+	for _, server := range upstreamConfig.Servers {
+		builder.WriteString(fmt.Sprintf("    server %s max_fails=3 fail_timeout=10s;\n", server))
+	}
+	builder.WriteString("    keepalive 128;\n}\n\n")
+	return builder.String()
+}
+
+func buildRouteUpstreamName(route Route) string {
+	identity := strings.TrimSpace(route.SiteName)
+	if identity == "" {
+		identity = route.Domain
+	}
+	sanitized := strings.Map(func(r rune) rune {
+		switch {
+		case r >= 'a' && r <= 'z':
+			return r
+		case r >= 'A' && r <= 'Z':
+			return r + ('a' - 'A')
+		case r >= '0' && r <= '9':
+			return r
+		default:
+			return '_'
+		}
+	}, identity)
+	sanitized = strings.Trim(sanitized, "_")
+	if sanitized == "" {
+		sanitized = "backend"
+	}
+	return fmt.Sprintf("backend_%s_%d", sanitized, route.ID)
+}
+
+func buildUpstreamProxyPassURI(parsed *url.URL) string {
+	path := parsed.EscapedPath()
+	if path == "/" {
+		path = ""
+	}
+	if parsed.RawQuery == "" {
+		return path
+	}
+	return fmt.Sprintf("%s?%s", path, parsed.RawQuery)
+}
+
+func renderConnectionUpgradeMap() string {
+	return "    map $http_upgrade $connection_upgrade {\n        default upgrade;\n        ''      \"\";\n    }\n\n"
+}
+
+func renderDefaultServerBlock(statusCode int, http3Enabled bool) string {
+	if statusCode <= 0 {
+		statusCode = 421
+	}
+	var h3Default string
+	if http3Enabled {
+		h3Default = "\n        listen 443 quic reuseport default_server;"
+	}
+	return strings.Join([]string{
+		"    server {",
+		"        listen 80 default_server;",
+		"        server_name _;",
+		"",
+		fmt.Sprintf("        return %d;", statusCode),
+		"    }",
+		"",
+		"    server {",
+		fmt.Sprintf("        listen 443 ssl default_server;%s", h3Default),
+		"        server_name _;",
+		"",
+		"        ssl_reject_handshake on;",
+		"    }",
+		"",
+	}, "\n")
+}
+
+func normalizedRouteDomains(route Route) []string {
+	if len(route.Domains) > 0 {
+		return route.Domains
+	}
+	if strings.TrimSpace(route.Domain) == "" {
+		return nil
+	}
+	return []string{strings.TrimSpace(route.Domain)}
+}
+
+func normalizeCertIDs(primaryCertID *uint, certIDs []uint) []uint {
+	candidates := make([]uint, 0, len(certIDs)+1)
+	if primaryCertID != nil && *primaryCertID != 0 {
+		candidates = append(candidates, *primaryCertID)
+	}
+	candidates = append(candidates, certIDs...)
+	seen := make(map[uint]struct{}, len(candidates))
+	normalized := make([]uint, 0, len(candidates))
+	for _, id := range candidates {
+		if id == 0 {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		normalized = append(normalized, id)
+	}
+	return normalized
+}
+
+func normalizeDomainCertIDs(domains []string, certIDs []uint, domainCertIDs []uint) []uint {
+	if len(domainCertIDs) > 0 {
+		normalized := make([]uint, len(domainCertIDs))
+		copy(normalized, domainCertIDs)
+		return normalized
+	}
+	if len(certIDs) == 1 {
+		normalized := make([]uint, len(domains))
+		for index := range normalized {
+			normalized[index] = certIDs[0]
+		}
+		return normalized
+	}
+	if len(certIDs) == len(domains) {
+		normalized := make([]uint, len(certIDs))
+		copy(normalized, certIDs)
+		return normalized
+	}
+	return []uint{}
+}
+
+func certificatesByID(files []SupportFile) map[uint]string {
+	result := make(map[uint]string)
+	for _, file := range files {
+		if !strings.HasSuffix(file.Path, ".crt") {
+			continue
+		}
+		idText := strings.TrimSuffix(file.Path, ".crt")
+		var id uint
+		if _, err := fmt.Sscanf(idText, "%d", &id); err == nil && id != 0 {
+			result[id] = file.Content
+		}
+	}
+	return result
+}
+
+func validateCertificateCoverage(certPEM string, domains []string) error {
+	block, _ := pem.Decode([]byte(certPEM))
+	if block == nil {
+		return errors.New("certificate PEM is invalid")
+	}
+	leaf, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return err
+	}
+	for _, domain := range domains {
+		if err := leaf.VerifyHostname(domain); err != nil {
+			return fmt.Errorf("certificate does not cover domain %s", domain)
+		}
+	}
+	return nil
+}
+
+func getPoWConfigForRoute(routeID uint, snapshot WAFDocument) (bool, *PoWConfig) {
+	for _, binding := range snapshot.Bindings {
+		if binding.RouteID != routeID {
+			continue
+		}
+		for _, groupID := range binding.RuleGroupIDs {
+			for _, group := range snapshot.RuleGroups {
+				if group.ID == groupID && group.PoWEnabled {
+					return true, group.PoWConfig
+				}
+			}
+		}
+		break
+	}
+	for _, group := range snapshot.RuleGroups {
+		if group.IsGlobal && group.PoWEnabled {
+			return true, group.PoWConfig
+		}
+	}
+	return false, nil
+}
+
+func uniqueUintIDs(values []uint) []uint {
+	seen := make(map[uint]struct{}, len(values))
+	result := make([]uint, 0, len(values))
+	for _, value := range values {
+		if value == 0 {
+			continue
+		}
+		if _, ok := seen[value]; ok {
+			continue
+		}
+		seen[value] = struct{}{}
+		result = append(result, value)
+	}
+	return result
+}
+
+func uniqueStrings(values []string) []string {
+	seen := make(map[string]struct{}, len(values))
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		item := strings.TrimSpace(value)
+		if item == "" {
+			continue
+		}
+		if _, ok := seen[item]; ok {
+			continue
+		}
+		seen[item] = struct{}{}
+		result = append(result, item)
+	}
+	return result
+}
+
+func resolveUpstreamServerName(originURL string, originHost string) string {
+	parsed, err := url.Parse(originURL)
+	if err != nil || !strings.EqualFold(parsed.Scheme, "https") {
+		return ""
+	}
+	if strings.TrimSpace(originHost) != "" {
+		parsedHost, err := url.Parse("//" + originHost)
+		if err == nil && parsedHost.Hostname() != "" {
+			return parsedHost.Hostname()
+		}
+		return originHost
+	}
+	return parsed.Hostname()
+}
+
+func renderServerNames(domains []string) string { return strings.Join(domains, " ") }
+
+func onOff(value bool) string {
+	if value {
+		return "on"
+	}
+	return "off"
+}
+
+func quoteNginxStringLiteral(value string) string {
+	escaped := strings.ReplaceAll(value, `\`, `\\`)
+	escaped = strings.ReplaceAll(escaped, `"`, `\"`)
+	return fmt.Sprintf(`"%s"`, escaped)
+}
+
+func filepathToNginxPath(value string) string {
+	return strings.ReplaceAll(strings.TrimSpace(value), `\`, `/`)
+}
+
+func escapeNginxString(value string) string {
+	escaped := strings.ReplaceAll(value, `\`, `\\`)
+	escaped = strings.ReplaceAll(escaped, `"`, `\"`)
+	return escaped
+}
+
+func buildSuffixMatchPattern(rules []string) string {
+	parts := make([]string, 0, len(rules))
+	for _, rule := range rules {
+		parts = append(parts, regexp.QuoteMeta(rule))
+	}
+	return fmt.Sprintf("\\.(?:%s)$", strings.Join(parts, "|"))
+}
+
+func buildPathPrefixMatchPattern(rules []string) string {
+	parts := make([]string, 0, len(rules))
+	for _, rule := range rules {
+		trimmed := strings.TrimRight(rule, "/")
+		if trimmed == "" {
+			trimmed = "/"
+		}
+		if trimmed == "/" {
+			parts = append(parts, "/")
+			continue
+		}
+		parts = append(parts, fmt.Sprintf("%s(?:/|$)", regexp.QuoteMeta(trimmed)))
+	}
+	return fmt.Sprintf("^(?:%s)", strings.Join(parts, "|"))
+}
+
+func buildPathExactMatchPattern(rules []string) string {
+	parts := make([]string, 0, len(rules))
+	for _, rule := range rules {
+		parts = append(parts, regexp.QuoteMeta(rule))
+	}
+	return fmt.Sprintf("^(?:%s)$", strings.Join(parts, "|"))
+}

openflare-server/utils/render/openresty/render_test.go

@@ -0,0 +1,100 @@
+package openresty
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRenderPagesAPIProxyLocationBlock(t *testing.T) {
+	tests := []struct {
+		name       string
+		deployment *PagesDeployment
+		expected   []string
+		unexpected []string
+	}{
+		{
+			name:       "nil deployment",
+			deployment: nil,
+			expected:   []string{""},
+		},
+		{
+			name: "disabled proxy",
+			deployment: &PagesDeployment{
+				APIProxyEnabled: false,
+				APIProxyPath:    "/api",
+				APIProxyPass:    "http://127.0.0.1:8080",
+			},
+			expected: []string{""},
+		},
+		{
+			name: "enabled proxy without rewrite",
+			deployment: &PagesDeployment{
+				APIProxyEnabled: true,
+				APIProxyPath:    "/api",
+				APIProxyPass:    "http://127.0.0.1:8080",
+				APIProxyRewrite: "",
+			},
+			expected: []string{
+				"location /api {",
+				"proxy_pass http://127.0.0.1:8080;",
+				"proxy_http_version 1.1;",
+				"proxy_set_header Host $http_host;",
+			},
+			unexpected: []string{
+				"rewrite",
+			},
+		},
+		{
+			name: "enabled proxy with rewrite to root",
+			deployment: &PagesDeployment{
+				APIProxyEnabled: true,
+				APIProxyPath:    "/api",
+				APIProxyPass:    "http://127.0.0.1:8080",
+				APIProxyRewrite: "/",
+			},
+			expected: []string{
+				"location /api {",
+				"rewrite ^/api/(.*)$ /$1 break;",
+				"rewrite ^/api$ / break;",
+				"proxy_pass http://127.0.0.1:8080;",
+			},
+		},
+		{
+			name: "enabled proxy with rewrite to subpath",
+			deployment: &PagesDeployment{
+				APIProxyEnabled: true,
+				APIProxyPath:    "/api",
+				APIProxyPass:    "http://127.0.0.1:8080",
+				APIProxyRewrite: "/v2",
+			},
+			expected: []string{
+				"location /api {",
+				"rewrite ^/api/(.*)$ /v2/$1 break;",
+				"rewrite ^/api$ /v2 break;",
+				"proxy_pass http://127.0.0.1:8080;",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := renderPagesAPIProxyLocationBlock(tt.deployment)
+			if len(tt.expected) == 1 && tt.expected[0] == "" {
+				if got != "" {
+					t.Fatalf("expected empty output, got: %q", got)
+				}
+				return
+			}
+			for _, exp := range tt.expected {
+				if !strings.Contains(got, exp) {
+					t.Errorf("expected output to contain %q, but got:\n%s", exp, got)
+				}
+			}
+			for _, unexp := range tt.unexpected {
+				if strings.Contains(got, unexp) {
+					t.Errorf("expected output NOT to contain %q, but got:\n%s", unexp, got)
+				}
+			}
+		})
+	}
+}

openflare-server/utils/render/openresty/types.go

@@ -0,0 +1,282 @@
+package openresty
+
+const (
+	CertDirPlaceholder             = "__OPENFLARE_CERT_DIR__"
+	RouteConfigPlaceholder         = "__OPENFLARE_ROUTE_CONFIG__"
+	AccessLogPlaceholder           = "__OPENFLARE_ACCESS_LOG__"
+	ErrorLogPlaceholder            = "__OPENFLARE_ERROR_LOG__"
+	LuaDirPlaceholder              = "__OPENFLARE_LUA_DIR__"
+	ObservabilityListenPlaceholder = "__OPENFLARE_OBSERVABILITY_LISTEN__"
+	ObservabilityPortPlaceholder   = "__OPENFLARE_OBSERVABILITY_PORT__"
+	PowStaticDirPlaceholder        = "__OPENFLARE_POW_STATIC_DIR__"
+	PagesDirPlaceholder            = "__OPENFLARE_PAGES_DIR__"
+
+	SourceConfigFileName = "openresty_config.json"
+)
+
+const (
+	cachePolicySuffix     = "suffix"
+	cachePolicyPathPrefix = "path_prefix"
+	cachePolicyPathExact  = "path_exact"
+	defaultWAFBlockStatus = 418
+	anubisStaticPrefix    = "/.within.website/x/cmd/anubis/static/"
+	anubisAPIPrefix       = "/.within.website/x/cmd/anubis/api/"
+)
+
+const defaultMainConfigTemplate = `# This file is generated by OpenFlare. Do not edit manually.
+worker_processes {{OpenRestyWorkerProcesses}};
+worker_rlimit_nofile {{OpenRestyWorkerRlimitNofile}};
+pid logs/nginx.pid;
+error_log {{OpenRestyErrorLogPath}} warn;
+
+events {
+    worker_connections {{OpenRestyWorkerConnections}};
+{{OpenRestyEventsUseDirective}}{{OpenRestyEventsMultiAcceptDirective}}}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+{{OpenRestyConnectionUpgradeMap}}{{OpenRestyDefaultServerBlock}}    log_format openflare_json escape=json '{"ts":"$time_iso8601","host":"$host","path":"$request_uri","remote_addr":"$remote_addr","status":$status,"request_time":$request_time,"bytes_sent":$body_bytes_sent,"request_length":$request_length}';
+    access_log {{OpenRestyAccessLogPath}} openflare_json;
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout {{OpenRestyKeepaliveTimeout}};
+    keepalive_requests {{OpenRestyKeepaliveRequests}};
+    client_header_timeout {{OpenRestyClientHeaderTimeout}};
+    client_body_timeout {{OpenRestyClientBodyTimeout}};
+    client_max_body_size {{OpenRestyClientMaxBodySize}};
+    large_client_header_buffers {{OpenRestyLargeClientHeaderBuffers}};
+    send_timeout {{OpenRestySendTimeout}};
+    proxy_connect_timeout {{OpenRestyProxyConnectTimeout}};
+    proxy_send_timeout {{OpenRestyProxySendTimeout}};
+    proxy_read_timeout {{OpenRestyProxyReadTimeout}};
+    proxy_request_buffering {{OpenRestyProxyRequestBuffering}};
+    proxy_buffering {{OpenRestyProxyBuffering}};
+    proxy_buffers {{OpenRestyProxyBuffers}};
+    proxy_buffer_size {{OpenRestyProxyBufferSize}};
+    proxy_busy_buffers_size {{OpenRestyProxyBusyBuffersSize}};
+    gzip {{OpenRestyGzip}};
+    gzip_min_length {{OpenRestyGzipMinLength}};
+    gzip_comp_level {{OpenRestyGzipCompLevel}};
+{{OpenRestyResolverDirective}}{{OpenRestyCacheBlock}}    include {{OpenRestyRouteConfigInclude}};
+}
+`
+
+type SupportFile struct {
+	Path    string `json:"path"`
+	Content string `json:"content"`
+}
+
+type CustomHeader struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}
+
+type PoWListConfig struct {
+	IPs         []string `json:"ips"`
+	IPCidrs     []string `json:"ip_cidrs"`
+	Paths       []string `json:"paths"`
+	PathRegexes []string `json:"path_regexes"`
+	UserAgents  []string `json:"user_agents"`
+}
+
+type PoWConfig struct {
+	Difficulty   int           `json:"difficulty"`
+	Algorithm    string        `json:"algorithm"`
+	SessionTTL   int           `json:"session_ttl"`
+	ChallengeTTL int           `json:"challenge_ttl"`
+	Whitelist    PoWListConfig `json:"whitelist"`
+	Blacklist    PoWListConfig `json:"blacklist"`
+}
+
+type Route struct {
+	ID                 uint             `json:"id,omitempty"`
+	SiteName           string           `json:"site_name,omitempty"`
+	Domain             string           `json:"domain"`
+	Domains            []string         `json:"domains,omitempty"`
+	OriginURL          string           `json:"origin_url"`
+	OriginHost         string           `json:"origin_host,omitempty"`
+	Upstreams          []string         `json:"upstreams,omitempty"`
+	Enabled            bool             `json:"enabled"`
+	EnableHTTPS        bool             `json:"enable_https"`
+	CertID             *uint            `json:"cert_id,omitempty"`
+	CertIDs            []uint           `json:"cert_ids,omitempty"`
+	DomainCertIDs      []uint           `json:"domain_cert_ids,omitempty"`
+	RedirectHTTP       bool             `json:"redirect_http"`
+	LimitConnPerServer int              `json:"limit_conn_per_server,omitempty"`
+	LimitConnPerIP     int              `json:"limit_conn_per_ip,omitempty"`
+	LimitRate          string           `json:"limit_rate,omitempty"`
+	CacheEnabled       bool             `json:"cache_enabled"`
+	CachePolicy        string           `json:"cache_policy,omitempty"`
+	CacheRules         []string         `json:"cache_rules,omitempty"`
+	CustomHeaders      []CustomHeader   `json:"custom_headers,omitempty"`
+	PoWEnabled         bool             `json:"pow_enabled,omitempty"`
+	PoWConfig          *PoWConfig       `json:"pow_config,omitempty"`
+	BasicAuthEnabled   bool             `json:"basic_auth_enabled,omitempty"`
+	BasicAuthUsername  string           `json:"basic_auth_username,omitempty"`
+	BasicAuthPassword  string           `json:"basic_auth_password,omitempty"`
+	Remark             string           `json:"remark,omitempty"`
+	UpstreamType       string           `json:"upstream_type,omitempty"`
+	PagesDeployment    *PagesDeployment `json:"pages_deployment,omitempty"`
+}
+
+type PagesDeployment struct {
+	ProjectID          uint   `json:"project_id"`
+	ProjectSlug        string `json:"project_slug"`
+	DeploymentID       uint   `json:"deployment_id"`
+	DeploymentNumber   int    `json:"deployment_number"`
+	Checksum           string `json:"checksum"`
+	EntryFile          string `json:"entry_file"`
+	SPAFallbackEnabled bool   `json:"spa_fallback_enabled"`
+	SPAFallbackPath    string `json:"spa_fallback_path"`
+	APIProxyEnabled    bool   `json:"api_proxy_enabled"`
+	APIProxyPath       string `json:"api_proxy_path"`
+	APIProxyPass       string `json:"api_proxy_pass"`
+	APIProxyRewrite    string `json:"api_proxy_rewrite"`
+	LocalRoot          string `json:"local_root"`
+}
+
+type WAFRuleGroup struct {
+	ID                uint       `json:"id"`
+	Name              string     `json:"name"`
+	Enabled           bool       `json:"enabled"`
+	IsGlobal          bool       `json:"is_global"`
+	BlockStatusCode   int        `json:"block_status_code"`
+	BlockResponseBody string     `json:"block_response_body,omitempty"`
+	IPWhitelist       []string   `json:"ip_whitelist,omitempty"`
+	IPBlacklist       []string   `json:"ip_blacklist,omitempty"`
+	IPWhitelistGroups []uint     `json:"ip_whitelist_group_ids,omitempty"`
+	IPBlacklistGroups []uint     `json:"ip_blacklist_group_ids,omitempty"`
+	CountryWhitelist  []string   `json:"country_whitelist,omitempty"`
+	CountryBlacklist  []string   `json:"country_blacklist,omitempty"`
+	RegionWhitelist   []string   `json:"region_whitelist,omitempty"`
+	RegionBlacklist   []string   `json:"region_blacklist,omitempty"`
+	PoWEnabled        bool       `json:"pow_enabled,omitempty"`
+	PoWConfig         *PoWConfig `json:"pow_config,omitempty"`
+}
+
+type WAFIPGroup struct {
+	ID      uint     `json:"id"`
+	Name    string   `json:"name"`
+	Type    string   `json:"type"`
+	Enabled bool     `json:"enabled"`
+	IPList  []string `json:"ip_list,omitempty"`
+}
+
+type WAFBinding struct {
+	RouteID      uint   `json:"route_id"`
+	SiteName     string `json:"site_name"`
+	RuleGroupIDs []uint `json:"rule_group_ids"`
+}
+
+type WAFDocument struct {
+	RuleGroups []WAFRuleGroup `json:"rule_groups"`
+	IPGroups   []WAFIPGroup   `json:"ip_groups,omitempty"`
+	Bindings   []WAFBinding   `json:"bindings"`
+}
+
+type ConfigSnapshot struct {
+	DefaultServerReturnStatus int    `json:"default_server_return_status"`
+	WorkerProcesses           string `json:"worker_processes"`
+	WorkerConnections         int    `json:"worker_connections"`
+	WorkerRlimitNofile        int    `json:"worker_rlimit_nofile"`
+	EventsUse                 string `json:"events_use,omitempty"`
+	EventsMultiAcceptEnabled  bool   `json:"events_multi_accept_enabled"`
+	KeepaliveTimeout          int    `json:"keepalive_timeout"`
+	KeepaliveRequests         int    `json:"keepalive_requests"`
+	ClientHeaderTimeout       int    `json:"client_header_timeout"`
+	ClientBodyTimeout         int    `json:"client_body_timeout"`
+	ClientMaxBodySize         string `json:"client_max_body_size"`
+	LargeClientHeaderBuffers  string `json:"large_client_header_buffers"`
+	SendTimeout               int    `json:"send_timeout"`
+	ProxyConnectTimeout       int    `json:"proxy_connect_timeout"`
+	ProxySendTimeout          int    `json:"proxy_send_timeout"`
+	ProxyReadTimeout          int    `json:"proxy_read_timeout"`
+	WebsocketEnabled          bool   `json:"websocket_enabled"`
+	HTTP3Enabled              bool   `json:"http3_enabled"`
+	ProxyRequestBuffering     bool   `json:"proxy_request_buffering"`
+	ProxyBufferingEnabled     bool   `json:"proxy_buffering_enabled"`
+	ProxyBuffers              string `json:"proxy_buffers"`
+	ProxyBufferSize           string `json:"proxy_buffer_size"`
+	ProxyBusyBuffersSize      string `json:"proxy_busy_buffers_size"`
+	GzipEnabled               bool   `json:"gzip_enabled"`
+	GzipMinLength             int    `json:"gzip_min_length"`
+	GzipCompLevel             int    `json:"gzip_comp_level"`
+	Resolvers                 string `json:"resolvers,omitempty"`
+	CacheEnabled              bool   `json:"cache_enabled"`
+	CachePath                 string `json:"cache_path,omitempty"`
+	CacheLevels               string `json:"cache_levels"`
+	CacheInactive             string `json:"cache_inactive"`
+	CacheMaxSize              string `json:"cache_max_size"`
+	CacheKeyTemplate          string `json:"cache_key_template"`
+	CacheLockEnabled          bool   `json:"cache_lock_enabled"`
+	CacheLockTimeout          string `json:"cache_lock_timeout"`
+	CacheUseStale             string `json:"cache_use_stale"`
+	MainConfigTemplate        string `json:"main_config_template,omitempty"`
+}
+
+type Document struct {
+	Routes          []Route        `json:"routes"`
+	OpenRestyConfig ConfigSnapshot `json:"openresty_config"`
+	WAF             WAFDocument    `json:"waf"`
+}
+
+type Result struct {
+	MainConfig   string
+	RouteConfig  string
+	SupportFiles []SupportFile
+	Checksum     string
+}
+
+type routeCacheConfig struct {
+	Enabled bool
+	Policy  string
+	Rules   []string
+}
+
+type routeLimitConfig struct {
+	LimitConnPerServer int
+	LimitConnPerIP     int
+	LimitRate          string
+}
+
+type routeUpstreamConfig struct {
+	Name              string
+	Scheme            string
+	ProxyPassURI      string
+	Servers           []string
+	UsesNamedUpstream bool
+}
+
+var requiredMainConfigTemplatePlaceholders = []string{
+	"{{OpenRestyWorkerProcesses}}",
+	"{{OpenRestyWorkerConnections}}",
+	"{{OpenRestyWorkerRlimitNofile}}",
+	"{{OpenRestyConnectionUpgradeMap}}",
+	"{{OpenRestyDefaultServerBlock}}",
+	"{{OpenRestyAccessLogPath}}",
+	"{{OpenRestyErrorLogPath}}",
+	"{{OpenRestyEventsUseDirective}}",
+	"{{OpenRestyEventsMultiAcceptDirective}}",
+	"{{OpenRestyKeepaliveTimeout}}",
+	"{{OpenRestyKeepaliveRequests}}",
+	"{{OpenRestyClientHeaderTimeout}}",
+	"{{OpenRestyClientBodyTimeout}}",
+	"{{OpenRestyClientMaxBodySize}}",
+	"{{OpenRestyLargeClientHeaderBuffers}}",
+	"{{OpenRestySendTimeout}}",
+	"{{OpenRestyProxyConnectTimeout}}",
+	"{{OpenRestyProxySendTimeout}}",
+	"{{OpenRestyProxyReadTimeout}}",
+	"{{OpenRestyProxyRequestBuffering}}",
+	"{{OpenRestyProxyBuffering}}",
+	"{{OpenRestyProxyBuffers}}",
+	"{{OpenRestyProxyBufferSize}}",
+	"{{OpenRestyProxyBusyBuffersSize}}",
+	"{{OpenRestyGzip}}",
+	"{{OpenRestyGzipMinLength}}",
+	"{{OpenRestyGzipCompLevel}}",
+	"{{OpenRestyCacheBlock}}",
+	"{{OpenRestyRouteConfigInclude}}",
+}