feat: enhance configuration management with main and route configs

- Added `main_config` and `route_config` fields to ActiveConfigResponse and AgentConfigResponse for better configuration handling.
- Updated NginxManager interface to accept separate main and route configurations.
- Modified sync service to apply main and route configurations correctly.
- Enhanced tests to validate new configuration fields and their application.
- Updated ConfigVersion model to include main configuration.
- Improved rendering logic for main and route configurations in the service layer.
- Added UI components to display main configuration changes and OpenResty parameter changes.

atsf_agent/cmd/agent/main.go

@@ -32,6 +32,7 @@ func main() {
 			DockerBinary:    cfg.DockerBinary,
 			ContainerName:   cfg.OpenrestyContainerName,
 			Image:           cfg.OpenrestyDockerImage,
+			MainConfigPath:  cfg.MainConfigPath,
 			RouteConfigPath: cfg.RouteConfigPath,
 			CertDir:         cfg.CertDir,
 			NginxCertDir:    cfg.OpenrestyCertDir,
@@ -42,6 +43,7 @@ func main() {
 	client := httpclient.New(cfg.ServerURL, cfg.InitialAuthToken(), cfg.RequestTimeout.Duration())
 	stateStore := state.NewStore(cfg.StatePath)
 	runtimeManager := &nginx.Manager{
+		MainConfigPath:  cfg.MainConfigPath,
 		RouteConfigPath: cfg.RouteConfigPath,
 		CertDir:         cfg.CertDir,
 		NginxCertDir:    cfg.OpenrestyCertDir,
@@ -50,6 +52,7 @@ func main() {
 			DockerBinary:    cfg.DockerBinary,
 			ContainerName:   cfg.OpenrestyContainerName,
 			Image:           cfg.OpenrestyDockerImage,
+			MainConfigPath:  cfg.MainConfigPath,
 			RouteConfigPath: cfg.RouteConfigPath,
 			CertDir:         cfg.CertDir,
 			NginxCertDir:    cfg.OpenrestyCertDir,

atsf_agent/internal/config/config.go

@@ -12,6 +12,7 @@ import (
 )
 
 const (
+	defaultDockerMainConfigRelativePath  = "etc/nginx/nginx.conf"
 	defaultDockerRouteConfigRelativePath = "etc/nginx/conf.d/atsflare_routes.conf"
 	defaultCertDirRelativePath           = "etc/nginx/certs"
 	defaultDockerStateRelativePath       = "var/lib/atsflare/agent-state.json"
@@ -19,26 +20,27 @@ const (
 )
 
 type Config struct {
-	ServerURL          string              `json:"server_url"`
-	AgentToken         string              `json:"agent_token"`
-	DiscoveryToken     string              `json:"discovery_token"`
-	NodeName           string              `json:"node_name"`
-	NodeIP             string              `json:"node_ip"`
-	AgentVersion       string              `json:"-"`
-	NginxVersion       string              `json:"-"`
-	OpenrestyPath      string              `json:"openresty_path"`
-	OpenrestyContainerName string          `json:"openresty_container_name"`
-	OpenrestyDockerImage   string          `json:"openresty_docker_image"`
-	DockerBinary       string              `json:"docker_binary"`
-	DataDir            string              `json:"data_dir"`
-	RouteConfigPath    string              `json:"route_config_path"`
-	CertDir            string              `json:"cert_dir"`
-	OpenrestyCertDir   string              `json:"openresty_cert_dir"`
-	StatePath          string              `json:"state_path"`
-	HeartbeatInterval  MillisecondDuration `json:"heartbeat_interval"`
-	SyncInterval       MillisecondDuration `json:"sync_interval"`
-	RequestTimeout     MillisecondDuration `json:"request_timeout"`
-	configPath         string
+	ServerURL              string              `json:"server_url"`
+	AgentToken             string              `json:"agent_token"`
+	DiscoveryToken         string              `json:"discovery_token"`
+	NodeName               string              `json:"node_name"`
+	NodeIP                 string              `json:"node_ip"`
+	AgentVersion           string              `json:"-"`
+	NginxVersion           string              `json:"-"`
+	OpenrestyPath          string              `json:"openresty_path"`
+	OpenrestyContainerName string              `json:"openresty_container_name"`
+	OpenrestyDockerImage   string              `json:"openresty_docker_image"`
+	DockerBinary           string              `json:"docker_binary"`
+	DataDir                string              `json:"data_dir"`
+	MainConfigPath         string              `json:"main_config_path"`
+	RouteConfigPath        string              `json:"route_config_path"`
+	CertDir                string              `json:"cert_dir"`
+	OpenrestyCertDir       string              `json:"openresty_cert_dir"`
+	StatePath              string              `json:"state_path"`
+	HeartbeatInterval      MillisecondDuration `json:"heartbeat_interval"`
+	SyncInterval           MillisecondDuration `json:"sync_interval"`
+	RequestTimeout         MillisecondDuration `json:"request_timeout"`
+	configPath             string
 }
 
 type configFile struct {
@@ -52,6 +54,7 @@ type configFile struct {
 	OpenrestyDockerImage   string              `json:"openresty_docker_image"`
 	DockerBinary           string              `json:"docker_binary"`
 	DataDir                string              `json:"data_dir"`
+	MainConfigPath         string              `json:"main_config_path"`
 	RouteConfigPath        string              `json:"route_config_path"`
 	CertDir                string              `json:"cert_dir"`
 	OpenrestyCertDir       string              `json:"openresty_cert_dir"`
@@ -81,6 +84,7 @@ func Load(path string) (*Config, error) {
 		OpenrestyDockerImage:   file.OpenrestyDockerImage,
 		DockerBinary:           file.DockerBinary,
 		DataDir:                file.DataDir,
+		MainConfigPath:         file.MainConfigPath,
 		RouteConfigPath:        file.RouteConfigPath,
 		CertDir:                file.CertDir,
 		OpenrestyCertDir:       file.OpenrestyCertDir,
@@ -119,9 +123,13 @@ func applyDefaults(cfg *Config, baseDir string) {
 		cfg.NodeIP = detectNodeIP()
 	}
 	if cfg.OpenrestyPath == "" {
+		cfg.MainConfigPath = joinManagedPath(cfg.DataDir, defaultDockerMainConfigRelativePath)
 		cfg.RouteConfigPath = joinManagedPath(cfg.DataDir, defaultDockerRouteConfigRelativePath)
 		cfg.StatePath = joinManagedPath(cfg.DataDir, defaultDockerStateRelativePath)
 	} else {
+		if cfg.MainConfigPath == "" {
+			cfg.MainConfigPath = joinManagedPath(cfg.DataDir, defaultDockerMainConfigRelativePath)
+		}
 		if cfg.RouteConfigPath == "" {
 			cfg.RouteConfigPath = joinManagedPath(cfg.DataDir, defaultDockerRouteConfigRelativePath)
 		}
@@ -158,6 +166,9 @@ func normalizeManagedPaths(cfg *Config) {
 	if usesSlashPath(cfg.DataDir) {
 		cfg.DataDir = filepath.ToSlash(cfg.DataDir)
 	}
+	if usesSlashPath(cfg.MainConfigPath) {
+		cfg.MainConfigPath = filepath.ToSlash(cfg.MainConfigPath)
+	}
 	if usesSlashPath(cfg.RouteConfigPath) {
 		cfg.RouteConfigPath = filepath.ToSlash(cfg.RouteConfigPath)
 	}

atsf_agent/internal/config/config_test.go

@@ -33,6 +33,9 @@ func TestLoadDockerModeUsesManagedPaths(t *testing.T) {
 	if cfg.DataDir != filepath.Join(dir, "data") {
 		t.Fatalf("unexpected data dir: %s", cfg.DataDir)
 	}
+	if cfg.MainConfigPath != filepath.Join(dir, "data", defaultDockerMainConfigRelativePath) {
+		t.Fatalf("unexpected main config path: %s", cfg.MainConfigPath)
+	}
 	if cfg.RouteConfigPath != filepath.Join(dir, "data", defaultDockerRouteConfigRelativePath) {
 		t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
 	}
@@ -62,6 +65,7 @@ func TestLoadPathModeKeepsExplicitPaths(t *testing.T) {
 		"node_name":         "edge-01",
 		"node_ip":           "10.0.0.8",
 		"openresty_path":    "/usr/local/openresty/nginx/sbin/openresty",
+		"main_config_path":  "/tmp/nginx.conf",
 		"route_config_path": "/tmp/routes.conf",
 		"state_path":        "/tmp/agent-state.json",
 	}
@@ -78,6 +82,9 @@ func TestLoadPathModeKeepsExplicitPaths(t *testing.T) {
 		t.Fatalf("Load failed: %v", err)
 	}
 
+	if cfg.MainConfigPath != "/tmp/nginx.conf" {
+		t.Fatalf("unexpected main config path: %s", cfg.MainConfigPath)
+	}
 	if cfg.RouteConfigPath != "/tmp/routes.conf" {
 		t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
 	}
@@ -115,6 +122,9 @@ func TestLoadUsesCustomDataDirForGeneratedFiles(t *testing.T) {
 	if cfg.RouteConfigPath != "/srv/atsflare/"+defaultDockerRouteConfigRelativePath {
 		t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
 	}
+	if cfg.MainConfigPath != "/srv/atsflare/"+defaultDockerMainConfigRelativePath {
+		t.Fatalf("unexpected main config path: %s", cfg.MainConfigPath)
+	}
 	if cfg.StatePath != "/srv/atsflare/"+defaultDockerStateRelativePath {
 		t.Fatalf("unexpected state path: %s", cfg.StatePath)
 	}

atsf_agent/internal/nginx/manager.go

@@ -18,6 +18,8 @@ import (
 )
 
 const CertDirPlaceholder = "__ATSF_CERT_DIR__"
+const RouteConfigPlaceholder = "__ATSF_ROUTE_CONFIG__"
+const DockerMainConfigPath = "/usr/local/openresty/nginx/conf/nginx.conf"
 
 const dockerRuntimeCommand = "openresty"
 
@@ -95,6 +97,7 @@ type DockerExecutor struct {
 	DockerBinary   string
 	ContainerName  string
 	Image          string
+	MainConfigPath string
 	RouteConfigDir string
 	CertDir        string
 	NginxCertDir   string
@@ -174,6 +177,7 @@ func (e *DockerExecutor) runContainer(ctx context.Context) error {
 		"--name", e.ContainerName,
 		"-p", "80:80",
 		"-p", "443:443",
+		"-v", fmt.Sprintf("%s:%s", e.MainConfigPath, DockerMainConfigPath),
 		"-v", fmt.Sprintf("%s:/etc/nginx/conf.d", e.RouteConfigDir),
 		"-v", fmt.Sprintf("%s:%s", e.CertDir, e.NginxCertDir),
 		e.Image,
@@ -187,14 +191,15 @@ func (e *DockerExecutor) runContainer(ctx context.Context) error {
 }
 
 type Manager struct {
+	MainConfigPath  string
 	RouteConfigPath string
 	CertDir         string
 	NginxCertDir    string
 	Executor        Executor
 }
 
-func (m *Manager) Apply(ctx context.Context, content string, supportFiles []protocol.SupportFile) error {
-	log.Printf("openresty apply started: route_config=%s support_files=%d", m.RouteConfigPath, len(supportFiles))
+func (m *Manager) Apply(ctx context.Context, mainConfig string, routeConfig string, supportFiles []protocol.SupportFile) error {
+	log.Printf("openresty apply started: main_config=%s route_config=%s support_files=%d", m.MainConfigPath, m.RouteConfigPath, len(supportFiles))
 	backup, err := m.backup()
 	if err != nil {
 		return err
@@ -204,8 +209,14 @@ func (m *Manager) Apply(ctx context.Context, content string, supportFiles []prot
 		_ = m.restore(backup)
 		return err
 	}
-	renderedContent := m.renderConfig(content)
-	if err = os.WriteFile(m.RouteConfigPath, []byte(renderedContent), 0o644); err != nil {
+	renderedMainConfig := m.renderMainConfig(mainConfig)
+	if err = os.WriteFile(m.MainConfigPath, []byte(renderedMainConfig), 0o644); err != nil {
+		log.Printf("writing openresty main config failed, restoring backup: error=%v", err)
+		_ = m.restore(backup)
+		return err
+	}
+	renderedRouteConfig := m.renderRouteConfig(routeConfig)
+	if err = os.WriteFile(m.RouteConfigPath, []byte(renderedRouteConfig), 0o644); err != nil {
 		log.Printf("writing openresty route config failed, restoring backup: error=%v", err)
 		_ = m.restore(backup)
 		return err
@@ -220,7 +231,7 @@ func (m *Manager) Apply(ctx context.Context, content string, supportFiles []prot
 		_ = m.restore(backup)
 		return err
 	}
-	log.Printf("openresty apply completed successfully: route_config=%s", m.RouteConfigPath)
+	log.Printf("openresty apply completed successfully: main_config=%s route_config=%s", m.MainConfigPath, m.RouteConfigPath)
 	return nil
 }
 
@@ -251,6 +262,16 @@ func (m *Manager) CurrentChecksum() (string, error) {
 	if m.RouteConfigPath == "" {
 		return "", errors.New("route config path 不能为空")
 	}
+	if m.MainConfigPath == "" {
+		return "", errors.New("main config path 不能为空")
+	}
+	mainData, err := os.ReadFile(m.MainConfigPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return "", nil
+		}
+		return "", err
+	}
 	data, err := os.ReadFile(m.RouteConfigPath)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -258,16 +279,20 @@ func (m *Manager) CurrentChecksum() (string, error) {
 		}
 		return "", err
 	}
-	normalized := string(data)
+	normalizedMain := string(mainData)
+	if m.RouteConfigPath != "" {
+		normalizedMain = strings.ReplaceAll(normalizedMain, m.RouteConfigPath, RouteConfigPlaceholder)
+	}
+	normalizedRoute := string(data)
 	if m.NginxCertDir != "" {
-		normalized = strings.ReplaceAll(normalized, m.NginxCertDir, CertDirPlaceholder)
+		normalizedRoute = strings.ReplaceAll(normalizedRoute, m.NginxCertDir, CertDirPlaceholder)
 	}
 	files, err := m.readSupportFiles()
 	if err != nil {
 		return "", err
 	}
-	result := bundleChecksum(normalized, files)
-	log.Printf("openresty current checksum calculated: route_config=%s checksum=%s support_files=%d", m.RouteConfigPath, result, len(files))
+	result := bundleChecksum(normalizedMain, normalizedRoute, files)
+	log.Printf("openresty current checksum calculated: main_config=%s route_config=%s checksum=%s support_files=%d", m.MainConfigPath, m.RouteConfigPath, result, len(files))
 	return result, nil
 }
 
@@ -276,6 +301,7 @@ type ExecutorOptions struct {
 	DockerBinary    string
 	ContainerName   string
 	Image           string
+	MainConfigPath  string
 	RouteConfigPath string
 	CertDir         string
 	NginxCertDir    string
@@ -301,6 +327,7 @@ func NewExecutor(options ExecutorOptions) Executor {
 		DockerBinary:   options.DockerBinary,
 		ContainerName:  options.ContainerName,
 		Image:          options.Image,
+		MainConfigPath: options.MainConfigPath,
 		RouteConfigDir: routeConfigDir,
 		CertDir:        certDir,
 		NginxCertDir:   options.NginxCertDir,
@@ -371,6 +398,8 @@ func (e *DockerExecutor) runEphemeralRuntimeCommandWithBinary(ctx context.Contex
 		"run",
 		"--rm",
 		"-v",
+		fmt.Sprintf("%s:%s", e.MainConfigPath, DockerMainConfigPath),
+		"-v",
 		fmt.Sprintf("%s:/etc/nginx/conf.d", e.RouteConfigDir),
 		"-v",
 		fmt.Sprintf("%s:%s", e.CertDir, e.NginxCertDir),
@@ -386,15 +415,23 @@ func runDockerVersionProbe(ctx context.Context, runner CommandRunner, dockerBina
 }
 
 type backupState struct {
+	MainExisted  bool
+	MainData     []byte
 	RouteExisted bool
 	RouteData    []byte
 	Files        []protocol.SupportFile
 }
 
 func (m *Manager) backup() (*backupState, error) {
+	if m.MainConfigPath == "" {
+		return nil, errors.New("main config path 不能为空")
+	}
 	if m.RouteConfigPath == "" {
 		return nil, errors.New("route config path 不能为空")
 	}
+	if err := os.MkdirAll(filepath.Dir(m.MainConfigPath), 0o755); err != nil {
+		return nil, err
+	}
 	if err := os.MkdirAll(filepath.Dir(m.RouteConfigPath), 0o755); err != nil {
 		return nil, err
 	}
@@ -404,6 +441,13 @@ func (m *Manager) backup() (*backupState, error) {
 		}
 	}
 	state := &backupState{}
+	mainData, err := os.ReadFile(m.MainConfigPath)
+	if err == nil {
+		state.MainExisted = true
+		state.MainData = mainData
+	} else if !os.IsNotExist(err) {
+		return nil, err
+	}
 	data, err := os.ReadFile(m.RouteConfigPath)
 	if err == nil {
 		state.RouteExisted = true
@@ -416,7 +460,7 @@ func (m *Manager) backup() (*backupState, error) {
 		return nil, err
 	}
 	state.Files = files
-	log.Printf("backup captured: route_exists=%t support_files=%d", state.RouteExisted, len(state.Files))
+	log.Printf("backup captured: main_exists=%t route_exists=%t support_files=%d", state.MainExisted, state.RouteExisted, len(state.Files))
 	return state, nil
 }
 
@@ -424,7 +468,14 @@ func (m *Manager) restore(state *backupState) error {
 	if state == nil {
 		return nil
 	}
-	log.Printf("restoring nginx backup: route_existed=%t support_files=%d", state.RouteExisted, len(state.Files))
+	log.Printf("restoring nginx backup: main_existed=%t route_existed=%t support_files=%d", state.MainExisted, state.RouteExisted, len(state.Files))
+	if state.MainExisted {
+		if err := os.WriteFile(m.MainConfigPath, state.MainData, 0o644); err != nil {
+			return err
+		}
+	} else if err := os.Remove(m.MainConfigPath); err != nil && !os.IsNotExist(err) {
+		return err
+	}
 	if state.RouteExisted {
 		if err := os.WriteFile(m.RouteConfigPath, state.RouteData, 0o644); err != nil {
 			return err
@@ -516,25 +567,34 @@ func (m *Manager) readSupportFiles() ([]protocol.SupportFile, error) {
 	return files, nil
 }
 
-func (m *Manager) renderConfig(content string) string {
+func (m *Manager) renderRouteConfig(content string) string {
 	if m.NginxCertDir == "" {
 		return content
 	}
 	return strings.ReplaceAll(content, CertDirPlaceholder, m.NginxCertDir)
 }
 
+func (m *Manager) renderMainConfig(content string) string {
+	if m.RouteConfigPath == "" {
+		return content
+	}
+	return strings.ReplaceAll(content, RouteConfigPlaceholder, m.RouteConfigPath)
+}
+
 func checksum(content string) string {
 	sum := sha256.Sum256([]byte(content))
 	return hex.EncodeToString(sum[:])
 }
 
-func bundleChecksum(renderedConfig string, supportFiles []protocol.SupportFile) string {
+func bundleChecksum(mainConfig string, routeConfig string, supportFiles []protocol.SupportFile) string {
 	files := append([]protocol.SupportFile(nil), supportFiles...)
 	sort.Slice(files, func(i int, j int) bool {
 		return files[i].Path < files[j].Path
 	})
 	var builder strings.Builder
-	builder.WriteString(renderedConfig)
+	builder.WriteString(mainConfig)
+	builder.WriteString("\n--route-config--\n")
+	builder.WriteString(routeConfig)
 	builder.WriteString("\n--support-files--\n")
 	for _, file := range files {
 		builder.WriteString(file.Path)

atsf_agent/internal/nginx/manager_test.go

@@ -119,6 +119,7 @@ func TestDockerExecutorCheckHealthFailsWhenContainerStopped(t *testing.T) {
 		DockerBinary:   "docker",
 		ContainerName:  "atsflare-openresty",
 		Image:          "openresty/openresty:alpine",
+		MainConfigPath: filepath.Clean("/tmp/nginx.conf"),
 		RouteConfigDir: filepath.Clean("/tmp/routes"),
 		CertDir:        filepath.Clean("/tmp/certs"),
 		NginxCertDir:   "/etc/nginx/atsflare-certs",
@@ -142,6 +143,7 @@ func TestDockerExecutorStartsContainerWhenMissing(t *testing.T) {
 		DockerBinary:   "docker",
 		ContainerName:  "atsflare-openresty",
 		Image:          "openresty/openresty:alpine",
+		MainConfigPath: filepath.Clean("/tmp/nginx.conf"),
 		RouteConfigDir: filepath.Clean("/tmp/routes"),
 		CertDir:        filepath.Clean("/tmp/certs"),
 		NginxCertDir:   "/etc/nginx/atsflare-certs",
@@ -176,6 +178,7 @@ func TestDockerExecutorStartsStoppedContainer(t *testing.T) {
 		DockerBinary:   "docker",
 		ContainerName:  "atsflare-openresty",
 		Image:          "openresty/openresty:alpine",
+		MainConfigPath: filepath.Clean("/tmp/nginx.conf"),
 		RouteConfigDir: filepath.Clean("/tmp/routes"),
 		CertDir:        filepath.Clean("/tmp/certs"),
 		NginxCertDir:   "/etc/nginx/atsflare-certs",
@@ -213,6 +216,7 @@ func TestDockerExecutorRecreatesContainerOnStartup(t *testing.T) {
 		DockerBinary:   "docker",
 		ContainerName:  "atsflare-openresty",
 		Image:          "openresty/openresty:alpine",
+		MainConfigPath: filepath.Clean("/tmp/nginx.conf"),
 		RouteConfigDir: filepath.Clean("/tmp/routes"),
 		CertDir:        filepath.Clean("/tmp/certs"),
 		NginxCertDir:   "/etc/nginx/atsflare-certs",
@@ -238,6 +242,7 @@ func TestNewExecutorUsesAbsoluteDockerMountPath(t *testing.T) {
 		DockerBinary:    "docker",
 		ContainerName:   "atsflare-openresty",
 		Image:           "openresty/openresty:alpine",
+		MainConfigPath:  "./data/etc/nginx/nginx.conf",
 		RouteConfigPath: "./data/etc/nginx/conf.d/atsflare_routes.conf",
 		CertDir:         "./data/etc/nginx/certs",
 		NginxCertDir:    "/etc/nginx/atsflare-certs",
@@ -271,6 +276,59 @@ func TestDetectVersionFromBinary(t *testing.T) {
 	}
 }
 
+func TestManagerApplyAndChecksumIncludeMainConfig(t *testing.T) {
+	tempDir := t.TempDir()
+	mainPath := filepath.Join(tempDir, "nginx.conf")
+	routePath := filepath.Join(tempDir, "conf.d", "atsflare_routes.conf")
+	certDir := filepath.Join(tempDir, "certs")
+	manager := &Manager{
+		MainConfigPath:  mainPath,
+		RouteConfigPath: routePath,
+		CertDir:         certDir,
+		NginxCertDir:    "/etc/nginx/atsflare-certs",
+		Executor:        &fakeExecutor{},
+	}
+
+	err := manager.Apply(
+		context.Background(),
+		"include __ATSF_ROUTE_CONFIG__;\n",
+		"ssl_certificate __ATSF_CERT_DIR__/1.crt;\n",
+		[]protocol.SupportFile{{Path: "1.crt", Content: "cert"}},
+	)
+	if err != nil {
+		t.Fatalf("Apply failed: %v", err)
+	}
+
+	mainData, err := os.ReadFile(mainPath)
+	if err != nil {
+		t.Fatalf("failed to read main config: %v", err)
+	}
+	if string(mainData) != "include "+routePath+";\n" {
+		t.Fatalf("unexpected main config: %s", string(mainData))
+	}
+
+	routeData, err := os.ReadFile(routePath)
+	if err != nil {
+		t.Fatalf("failed to read route config: %v", err)
+	}
+	if string(routeData) != "ssl_certificate /etc/nginx/atsflare-certs/1.crt;\n" {
+		t.Fatalf("unexpected route config: %s", string(routeData))
+	}
+
+	value, err := manager.CurrentChecksum()
+	if err != nil {
+		t.Fatalf("CurrentChecksum failed: %v", err)
+	}
+	expected := bundleChecksum(
+		"include __ATSF_ROUTE_CONFIG__;\n",
+		"ssl_certificate __ATSF_CERT_DIR__/1.crt;\n",
+		[]protocol.SupportFile{{Path: "1.crt", Content: "cert"}},
+	)
+	if value != expected {
+		t.Fatalf("unexpected checksum: got %s want %s", value, expected)
+	}
+}
+
 func TestDetectVersionFromDockerImage(t *testing.T) {
 	runner := &fakeRunner{
 		runFn: func(name string, args ...string) ([]byte, error) {
@@ -311,13 +369,14 @@ func TestParseNginxVersionIgnoresDockerEntrypointPaths(t *testing.T) {
 func TestManagerApplyWritesSupportFilesAndReplacesPlaceholder(t *testing.T) {
 	tempDir := t.TempDir()
 	manager := &Manager{
+		MainConfigPath:  filepath.Join(tempDir, "nginx.conf"),
 		RouteConfigPath: filepath.Join(tempDir, "routes.conf"),
 		CertDir:         filepath.Join(tempDir, "certs"),
 		NginxCertDir:    "/etc/nginx/atsflare-certs",
 		Executor:        &fakeExecutor{},
 	}
 
-	err := manager.Apply(context.Background(), "ssl_certificate __ATSF_CERT_DIR__/1.crt;", []protocol.SupportFile{
+	err := manager.Apply(context.Background(), "include __ATSF_ROUTE_CONFIG__;", "ssl_certificate __ATSF_CERT_DIR__/1.crt;", []protocol.SupportFile{
 		{Path: "1.crt", Content: "cert-data"},
 		{Path: "1.key", Content: "key-data"},
 	})
@@ -344,10 +403,14 @@ func TestManagerApplyWritesSupportFilesAndReplacesPlaceholder(t *testing.T) {
 func TestManagerRollbackRestoresSupportFiles(t *testing.T) {
 	tempDir := t.TempDir()
 	routePath := filepath.Join(tempDir, "routes.conf")
+	mainPath := filepath.Join(tempDir, "nginx.conf")
 	certDir := filepath.Join(tempDir, "certs")
 	if err := os.MkdirAll(certDir, 0o755); err != nil {
 		t.Fatalf("MkdirAll failed: %v", err)
 	}
+	if err := os.WriteFile(mainPath, []byte("old-main"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
 	if err := os.WriteFile(routePath, []byte("old-route"), 0o644); err != nil {
 		t.Fatalf("WriteFile failed: %v", err)
 	}
@@ -355,6 +418,7 @@ func TestManagerRollbackRestoresSupportFiles(t *testing.T) {
 		t.Fatalf("WriteFile failed: %v", err)
 	}
 	manager := &Manager{
+		MainConfigPath:  mainPath,
 		RouteConfigPath: routePath,
 		CertDir:         certDir,
 		NginxCertDir:    "/etc/nginx/atsflare-certs",
@@ -363,13 +427,20 @@ func TestManagerRollbackRestoresSupportFiles(t *testing.T) {
 		},
 	}
 
-	err := manager.Apply(context.Background(), "new-route", []protocol.SupportFile{
+	err := manager.Apply(context.Background(), "new-main", "new-route", []protocol.SupportFile{
 		{Path: "1.crt", Content: "new-cert"},
 	})
 	if err == nil {
 		t.Fatal("expected Apply to fail")
 	}
 
+	mainData, err := os.ReadFile(mainPath)
+	if err != nil {
+		t.Fatalf("failed to read main config: %v", err)
+	}
+	if string(mainData) != "old-main" {
+		t.Fatalf("expected main rollback, got %s", string(mainData))
+	}
 	routeData, err := os.ReadFile(routePath)
 	if err != nil {
 		t.Fatalf("failed to read route config: %v", err)

atsf_agent/internal/protocol/agent_api.go

@@ -58,6 +58,8 @@ type ApplyLogPayload struct {
 type ActiveConfigResponse struct {
 	Version        string        `json:"version"`
 	Checksum       string        `json:"checksum"`
+	MainConfig     string        `json:"main_config"`
+	RouteConfig    string        `json:"route_config"`
 	RenderedConfig string        `json:"rendered_config"`
 	SupportFiles   []SupportFile `json:"support_files"`
 	CreatedAt      string        `json:"created_at"`

atsf_agent/internal/sync/service.go

@@ -19,7 +19,7 @@ type ConfigClient interface {
 }
 
 type NginxManager interface {
-	Apply(ctx context.Context, content string, supportFiles []protocol.SupportFile) error
+	Apply(ctx context.Context, mainConfig string, routeConfig string, supportFiles []protocol.SupportFile) error
 	EnsureRuntime(ctx context.Context, recreate bool) error
 	CurrentChecksum() (string, error)
 }
@@ -88,8 +88,12 @@ func (s *Service) sync(ctx context.Context, startup bool) error {
 		log.Printf("skipping apply because state already records target version/checksum: version=%s checksum=%s", config.Version, config.Checksum)
 		return nil
 	}
+	routeConfig := config.RouteConfig
+	if routeConfig == "" {
+		routeConfig = config.RenderedConfig
+	}
 	log.Printf("applying new openresty config: mode=%s from_version=%s to_version=%s old_checksum=%s new_checksum=%s", mode, snapshot.CurrentVersion, config.Version, currentChecksum, config.Checksum)
-	if err = s.nginxManager.Apply(ctx, config.RenderedConfig, config.SupportFiles); err != nil {
+	if err = s.nginxManager.Apply(ctx, config.MainConfig, routeConfig, config.SupportFiles); err != nil {
 		log.Printf("apply openresty config failed: mode=%s version=%s error=%v", mode, config.Version, err)
 		snapshot.LastError = err.Error()
 		snapshot.OpenrestyStatus = protocol.OpenrestyStatusUnhealthy

atsf_agent/internal/sync/service_test.go

@@ -28,7 +28,8 @@ type fakeManager struct {
 	currentChecksumErr error
 	ensureErr          error
 	ensureCalls        []bool
-	applyContents      []string
+	applyMainContents  []string
+	applyRouteContents []string
 	applyFiles         [][]protocol.SupportFile
 }
 
@@ -61,8 +62,9 @@ func (f *fakeClient) ReportApplyLog(ctx context.Context, payload protocol.ApplyL
 	return nil
 }
 
-func (m *fakeManager) Apply(ctx context.Context, content string, supportFiles []protocol.SupportFile) error {
-	m.applyContents = append(m.applyContents, content)
+func (m *fakeManager) Apply(ctx context.Context, mainConfig string, routeConfig string, supportFiles []protocol.SupportFile) error {
+	m.applyMainContents = append(m.applyMainContents, mainConfig)
+	m.applyRouteContents = append(m.applyRouteContents, routeConfig)
 	m.applyFiles = append(m.applyFiles, append([]protocol.SupportFile(nil), supportFiles...))
 	return m.applyErr
 }
@@ -81,6 +83,8 @@ func TestSyncOnceSuccess(t *testing.T) {
 		config: protocol.ActiveConfigResponse{
 			Version:        "20260309-001",
 			Checksum:       "checksum-1",
+			MainConfig:     "worker_processes auto;",
+			RouteConfig:    "server { listen 80; }",
 			RenderedConfig: "server { listen 80; }",
 			SupportFiles:   []protocol.SupportFile{{Path: "1.crt", Content: "cert"}},
 			CreatedAt:      time.Now().Format(time.RFC3339),
@@ -100,6 +104,7 @@ func TestSyncOnceSuccess(t *testing.T) {
 
 	routePath := filepath.Join(t.TempDir(), "routes.conf")
 	service := New(client, &nginx.Manager{
+		MainConfigPath:  filepath.Join(filepath.Dir(routePath), "nginx.conf"),
 		RouteConfigPath: routePath,
 		Executor:        &fakeExecutor{},
 	}, stateStore)
@@ -115,6 +120,13 @@ func TestSyncOnceSuccess(t *testing.T) {
 	if string(data) != "server { listen 80; }" {
 		t.Fatal("expected rendered config to be written to route file")
 	}
+	mainData, err := os.ReadFile(filepath.Join(filepath.Dir(routePath), "nginx.conf"))
+	if err != nil {
+		t.Fatalf("failed to read main config: %v", err)
+	}
+	if string(mainData) != "worker_processes auto;" {
+		t.Fatal("expected main config to be written")
+	}
 	snapshot, err = stateStore.Load()
 	if err != nil {
 		t.Fatalf("failed to load state: %v", err)
@@ -132,6 +144,8 @@ func TestSyncOnceRollbackOnNginxFailure(t *testing.T) {
 		config: protocol.ActiveConfigResponse{
 			Version:        "20260309-002",
 			Checksum:       "checksum-2",
+			MainConfig:     "worker_processes 2;",
+			RouteConfig:    "server { listen 81; }",
 			RenderedConfig: "server { listen 81; }",
 			SupportFiles:   []protocol.SupportFile{{Path: "1.crt", Content: "cert"}},
 			CreatedAt:      time.Now().Format(time.RFC3339),
@@ -139,7 +153,11 @@ func TestSyncOnceRollbackOnNginxFailure(t *testing.T) {
 	}
 
 	tempDir := t.TempDir()
+	mainPath := filepath.Join(tempDir, "nginx.conf")
 	routePath := filepath.Join(tempDir, "routes.conf")
+	if err := os.WriteFile(mainPath, []byte("worker_processes auto;"), 0o644); err != nil {
+		t.Fatalf("failed to seed main file: %v", err)
+	}
 	if err := os.WriteFile(routePath, []byte("server { listen 80; }"), 0o644); err != nil {
 		t.Fatalf("failed to seed route file: %v", err)
 	}
@@ -158,6 +176,7 @@ func TestSyncOnceRollbackOnNginxFailure(t *testing.T) {
 	}
 
 	service := New(client, &nginx.Manager{
+		MainConfigPath:  mainPath,
 		RouteConfigPath: routePath,
 		Executor: &fakeExecutor{
 			testErr: context.DeadlineExceeded,
@@ -176,6 +195,13 @@ func TestSyncOnceRollbackOnNginxFailure(t *testing.T) {
 	if string(data) != "server { listen 80; }" {
 		t.Fatal("expected original route config to be restored after rollback")
 	}
+	mainData, readErr := os.ReadFile(mainPath)
+	if readErr != nil {
+		t.Fatalf("failed to read main file after rollback: %v", readErr)
+	}
+	if string(mainData) != "worker_processes auto;" {
+		t.Fatal("expected original main config to be restored after rollback")
+	}
 	snapshot, loadErr := stateStore.Load()
 	if loadErr != nil {
 		t.Fatalf("failed to load state: %v", loadErr)
@@ -193,6 +219,8 @@ func TestSyncOnStartupRecreatesRuntimeWhenChecksumMatches(t *testing.T) {
 		config: protocol.ActiveConfigResponse{
 			Version:        "20260309-003",
 			Checksum:       "checksum-3",
+			MainConfig:     "worker_processes auto;",
+			RouteConfig:    "server { listen 82; }",
 			RenderedConfig: "server { listen 82; }",
 			SupportFiles:   []protocol.SupportFile{{Path: "1.crt", Content: "cert"}},
 			CreatedAt:      time.Now().Format(time.RFC3339),
@@ -235,6 +263,8 @@ func TestSyncOnStartupRecordsRuntimeFailure(t *testing.T) {
 		config: protocol.ActiveConfigResponse{
 			Version:        "20260309-004",
 			Checksum:       "checksum-4",
+			MainConfig:     "worker_processes 4;",
+			RouteConfig:    "server { listen 83; }",
 			RenderedConfig: "server { listen 83; }",
 			CreatedAt:      time.Now().Format(time.RFC3339),
 		},