refactor(repo): consolidate openflare-server to root and move subprojects to internal/apps

- Merge all files inside openflare-server to the repository root directory.
- Relocate agent, relay, and flared subprojects from internal/ to internal/apps/.
- Combine docker-compose files and update build context paths to root.
- Update GitHub workflows and Dockerfiles to refer to new directories and package names.
- Rewrite Go package imports across all files.
- Resolve database renew test race condition and clean up docs.

internal/apps/openflare/config_version/errs.go

@@ -0,0 +1,12 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+const (
+	errNoActiveVersion       = "当前没有激活版本"
+	errNoEnabledRoutes       = "没有可发布的启用规则"
+	errNoChangesToPublish    = "当前规则没有变更，不能重复发布"
+	errVersionConflict       = "版本号生成冲突，请重试"
+	errInvalidSnapshotFormat = "历史版本快照格式不合法"
+)

internal/apps/openflare/config_version/helpers.go

@@ -0,0 +1,352 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+
+	"github.com/Rain-kl/Wavelet/internal/model"
+)
+
+type customHeaderInput struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}
+
+func isUniqueConstraintError(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(strings.ToLower(err.Error()), "unique")
+}
+
+func normalizeProxyRouteSiteName(route *model.ProxyRoute, raw, primaryDomain string) string {
+	siteName := strings.TrimSpace(raw)
+	if siteName != "" {
+		return siteName
+	}
+	if route != nil && strings.TrimSpace(route.SiteName) != "" {
+		return strings.TrimSpace(route.SiteName)
+	}
+	return primaryDomain
+}
+
+func normalizeProxyRouteDomains(rawDomains []string) ([]string, error) {
+	normalized := make([]string, 0, len(rawDomains))
+	seen := make(map[string]struct{}, len(rawDomains))
+	for _, rawDomain := range rawDomains {
+		domain := strings.ToLower(strings.TrimSpace(rawDomain))
+		if domain == "" {
+			continue
+		}
+		if strings.Contains(domain, "://") || strings.Contains(domain, "/") {
+			return nil, fmt.Errorf("domain %q is invalid", rawDomain)
+		}
+		if _, ok := seen[domain]; ok {
+			continue
+		}
+		seen[domain] = struct{}{}
+		normalized = append(normalized, domain)
+	}
+	if len(normalized) == 0 {
+		return nil, fmt.Errorf("domain is required")
+	}
+	return normalized, nil
+}
+
+func decodeStoredDomains(raw string, fallbackDomain string) ([]string, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return normalizeProxyRouteDomains([]string{fallbackDomain})
+	}
+	var domains []string
+	if err := json.Unmarshal([]byte(text), &domains); err != nil {
+		return nil, fmt.Errorf("domains payload is invalid")
+	}
+	return normalizeProxyRouteDomains(domains)
+}
+
+func decodeStoredUpstreams(raw string, fallbackOriginURL string) ([]string, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return normalizeUpstreams(fallbackOriginURL, nil)
+	}
+	var upstreams []string
+	if err := json.Unmarshal([]byte(text), &upstreams); err != nil {
+		return nil, fmt.Errorf("upstreams payload is invalid")
+	}
+	return normalizeUpstreams(fallbackOriginURL, upstreams)
+}
+
+func normalizeUpstreams(originURL string, upstreams []string) ([]string, error) {
+	candidates := upstreams
+	if len(candidates) == 0 {
+		candidates = []string{originURL}
+	}
+	normalized := make([]string, 0, len(candidates))
+	seen := make(map[string]struct{}, len(candidates))
+	for _, item := range candidates {
+		value := strings.TrimSpace(item)
+		if value == "" {
+			continue
+		}
+		if _, ok := seen[value]; ok {
+			continue
+		}
+		seen[value] = struct{}{}
+		normalized = append(normalized, value)
+	}
+	if len(normalized) == 0 {
+		return nil, fmt.Errorf("upstream is required")
+	}
+	return normalized, nil
+}
+
+func decodeStoredCustomHeaders(raw string) ([]customHeaderInput, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return []customHeaderInput{}, nil
+	}
+	var headers []customHeaderInput
+	if err := json.Unmarshal([]byte(text), &headers); err != nil {
+		return nil, fmt.Errorf("custom_headers payload is invalid")
+	}
+	return headers, nil
+}
+
+func decodeStoredCacheRules(raw string) ([]string, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return []string{}, nil
+	}
+	var rules []string
+	if err := json.Unmarshal([]byte(text), &rules); err != nil {
+		return nil, fmt.Errorf("cache_rules payload is invalid")
+	}
+	normalized := make([]string, 0, len(rules))
+	for _, rule := range rules {
+		item := strings.TrimSpace(rule)
+		if item == "" {
+			continue
+		}
+		normalized = append(normalized, item)
+	}
+	return normalized, nil
+}
+
+func decodeStoredCertIDs(raw string, fallbackCertID *uint) ([]uint, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		if fallbackCertID == nil || *fallbackCertID == 0 {
+			return []uint{}, nil
+		}
+		return []uint{*fallbackCertID}, nil
+	}
+	var certIDs []uint
+	if err := json.Unmarshal([]byte(text), &certIDs); err != nil {
+		return nil, fmt.Errorf("cert_ids payload is invalid")
+	}
+	normalized := make([]uint, 0, len(certIDs))
+	seen := make(map[uint]struct{}, len(certIDs))
+	for _, certID := range certIDs {
+		if certID == 0 {
+			continue
+		}
+		if _, ok := seen[certID]; ok {
+			continue
+		}
+		seen[certID] = struct{}{}
+		normalized = append(normalized, certID)
+	}
+	if len(normalized) == 0 && fallbackCertID != nil && *fallbackCertID != 0 {
+		return []uint{*fallbackCertID}, nil
+	}
+	return normalized, nil
+}
+
+func resolveDomainCertIDs(domains []string, certIDs []uint, rawDomainCertIDs string) ([]uint, error) {
+	text := strings.TrimSpace(rawDomainCertIDs)
+	if text != "" {
+		var domainCertIDs []uint
+		if err := json.Unmarshal([]byte(text), &domainCertIDs); err != nil {
+			return nil, fmt.Errorf("domain_cert_ids payload is invalid")
+		}
+		if len(domains) > 0 && len(domainCertIDs) != len(domains) {
+			return nil, fmt.Errorf("domain_cert_ids length is invalid")
+		}
+		return domainCertIDs, nil
+	}
+	if len(certIDs) == 0 {
+		return []uint{}, nil
+	}
+	if len(certIDs) == 1 {
+		result := make([]uint, len(domains))
+		for index := range result {
+			result[index] = certIDs[0]
+		}
+		return result, nil
+	}
+	if len(certIDs) == len(domains) {
+		result := make([]uint, len(certIDs))
+		copy(result, certIDs)
+		return result, nil
+	}
+	return []uint{}, nil
+}
+
+func mustDecodeCertIDs(route *model.ProxyRoute) []uint {
+	if route == nil {
+		return []uint{}
+	}
+	certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
+	if err != nil {
+		return []uint{}
+	}
+	return certIDs
+}
+
+func mustDecodeDomainCertIDs(route *model.ProxyRoute, domains []string) []uint {
+	if route == nil {
+		return []uint{}
+	}
+	certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
+	if err != nil {
+		return []uint{}
+	}
+	domainCertIDs, err := resolveDomainCertIDs(domains, certIDs, route.DomainCertIDs)
+	if err != nil {
+		return []uint{}
+	}
+	return domainCertIDs
+}
+
+func normalizeUpstreamType(raw string) string {
+	value := strings.ToLower(strings.TrimSpace(raw))
+	switch value {
+	case "tunnel", "pages":
+		return value
+	default:
+		return "direct"
+	}
+}
+
+func normalizeTunnelTargetProtocol(raw string) string {
+	value := strings.ToLower(strings.TrimSpace(raw))
+	switch value {
+	case "http", "https", "tcp":
+		return value
+	default:
+		return "http"
+	}
+}
+
+func normalizePEM(content string) string {
+	return strings.TrimSpace(content) + "\n"
+}
+
+func certificateCertFileName(id uint) string {
+	return fmt.Sprintf("%d.crt", id)
+}
+
+func certificateKeyFileName(id uint) string {
+	return fmt.Sprintf("%d.key", id)
+}
+
+func dedupeSupportFiles(files []SupportFile) []SupportFile {
+	if len(files) == 0 {
+		return nil
+	}
+	unique := make(map[string]SupportFile, len(files))
+	for _, file := range files {
+		unique[file.Path] = file
+	}
+	result := make([]SupportFile, 0, len(unique))
+	for _, file := range unique {
+		result = append(result, file)
+	}
+	return result
+}
+
+func uintPtrEqual(left *uint, right *uint) bool {
+	if left == nil || right == nil {
+		return left == nil && right == nil
+	}
+	return *left == *right
+}
+
+func uintSliceEqual(left []uint, right []uint) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
+	return true
+}
+
+func relayAgentAddress(node *model.OpenFlareNode) string {
+	if node == nil {
+		return ""
+	}
+	port := node.RelayVhostHTTPPort
+	if port <= 0 {
+		port = 8080
+	}
+	addr := strings.TrimSpace(node.RelayAgentAccessAddr)
+	if addr == "" {
+		addr = strings.TrimSpace(node.RelayClientAccessAddr)
+	}
+	if addr == "" {
+		addr = strings.TrimSpace(node.IP)
+	}
+	if addr == "" {
+		return fmt.Sprintf("127.0.0.1:%d", port)
+	}
+	if _, _, err := net.SplitHostPort(addr); err == nil {
+		return addr
+	}
+	if strings.Contains(addr, ":") && strings.Count(addr, ":") > 1 {
+		return net.JoinHostPort(addr, strconv.Itoa(port))
+	}
+	return fmt.Sprintf("%s:%d", addr, port)
+}
+
+func resolveTunnelOpenRestyUpstreamURL(ctx context.Context) string {
+	nodes, err := model.ListOpenFlareNodes(ctx)
+	if err == nil {
+		for index := range nodes {
+			node := &nodes[index]
+			if node.NodeType != "tunnel_relay" {
+				continue
+			}
+			addr := relayAgentAddress(node)
+			if addr != "" {
+				return "http://" + addr
+			}
+		}
+	}
+	return "http://127.0.0.1:8080"
+}
+
+func listWAFIPGroupsByIDs(ctx context.Context, ids []uint) ([]*model.OpenFlareWAFIPGroup, error) {
+	if len(ids) == 0 {
+		return []*model.OpenFlareWAFIPGroup{}, nil
+	}
+	groups := make([]*model.OpenFlareWAFIPGroup, 0, len(ids))
+	for _, id := range ids {
+		group, err := model.GetOpenFlareWAFIPGroupByID(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		groups = append(groups, group)
+	}
+	return groups, nil
+}

internal/apps/openflare/config_version/logics.go

@@ -0,0 +1,559 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/model"
+	"gorm.io/gorm"
+)
+
+// ConfigPreviewResult is the preview response payload.
+type ConfigPreviewResult struct {
+	SnapshotJSON   string        `json:"snapshot_json"`
+	MainConfig     string        `json:"main_config"`
+	RouteConfig    string        `json:"route_config"`
+	RenderedConfig string        `json:"rendered_config"`
+	SupportFiles   []SupportFile `json:"support_files"`
+	Checksum       string        `json:"checksum"`
+	RouteCount     int           `json:"route_count"`
+	WebsiteCount   int           `json:"website_count"`
+}
+
+// ConfigDiffResult is the diff response payload.
+type ConfigDiffResult struct {
+	ActiveVersion        string                 `json:"active_version,omitempty"`
+	AddedSites           []string               `json:"added_sites"`
+	RemovedSites         []string               `json:"removed_sites"`
+	ModifiedSites        []string               `json:"modified_sites"`
+	AddedDomains         []string               `json:"added_domains"`
+	RemovedDomains       []string               `json:"removed_domains"`
+	ModifiedDomains      []string               `json:"modified_domains"`
+	MainConfigChanged    bool                   `json:"main_config_changed"`
+	WAFConfigChanged     bool                   `json:"waf_config_changed"`
+	ChangedOptionKeys    []string               `json:"changed_option_keys"`
+	ChangedOptionDetails []ConfigOptionDiffItem `json:"changed_option_details"`
+	CurrentWebsiteCount  int                    `json:"current_website_count"`
+	ActiveWebsiteCount   int                    `json:"active_website_count"`
+}
+
+// ConfigOptionDiffItem describes a changed OpenResty option.
+type ConfigOptionDiffItem struct {
+	Key           string `json:"key"`
+	PreviousValue string `json:"previous_value"`
+	CurrentValue  string `json:"current_value"`
+}
+
+// CleanupInput is the cleanup request payload.
+type CleanupInput struct {
+	KeepCount int `json:"keep_count"`
+}
+
+// CleanupResult is the cleanup response payload.
+type CleanupResult struct {
+	DeletedCount int64  `json:"deleted_count"`
+	Message      string `json:"message"`
+}
+
+// ListConfigVersions returns all config version summaries.
+func ListConfigVersions(ctx context.Context) ([]*model.ConfigVersionSummary, error) {
+	return model.ListConfigVersionSummaries(ctx)
+}
+
+// GetConfigVersionDetail returns a config version by id.
+func GetConfigVersionDetail(ctx context.Context, id uint) (*model.ConfigVersion, error) {
+	return model.GetConfigVersionByID(ctx, id)
+}
+
+// GetActiveConfigVersion returns the active config version.
+func GetActiveConfigVersion(ctx context.Context) (*model.ConfigVersion, error) {
+	return model.GetActiveConfigVersion(ctx)
+}
+
+// PreviewConfigVersion renders the current draft configuration.
+func PreviewConfigVersion(ctx context.Context) (*ConfigPreviewResult, error) {
+	bundle, err := buildCurrentConfigBundle(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+	return &ConfigPreviewResult{
+		SnapshotJSON:   bundle.SnapshotJSON,
+		MainConfig:     bundle.MainConfig,
+		RouteConfig:    bundle.RouteConfig,
+		RenderedConfig: bundle.RouteConfig,
+		SupportFiles:   bundle.SupportFiles,
+		Checksum:       bundle.Checksum,
+		RouteCount:     len(bundle.Routes),
+		WebsiteCount:   len(bundle.SnapshotRoutes),
+	}, nil
+}
+
+// DiffConfigVersion compares the current draft against the active version.
+func DiffConfigVersion(ctx context.Context) (*ConfigDiffResult, error) {
+	bundle, err := buildCurrentConfigBundle(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+	result := &ConfigDiffResult{
+		AddedSites:           []string{},
+		RemovedSites:         []string{},
+		ModifiedSites:        []string{},
+		AddedDomains:         []string{},
+		RemovedDomains:       []string{},
+		ModifiedDomains:      []string{},
+		ChangedOptionKeys:    []string{},
+		ChangedOptionDetails: []ConfigOptionDiffItem{},
+		CurrentWebsiteCount:  len(bundle.SnapshotRoutes),
+	}
+	activeVersion, err := model.GetActiveConfigVersion(ctx)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			for _, route := range bundle.SnapshotRoutes {
+				result.AddedSites = append(result.AddedSites, route.SiteName)
+				result.AddedDomains = append(result.AddedDomains, route.Domains...)
+			}
+			result.MainConfigChanged = true
+			result.ChangedOptionKeys = openRestyOptionKeys()
+			result.ChangedOptionDetails = buildInitialOpenRestyOptionDiffs(bundle.OpenRestyConfig)
+			sort.Strings(result.AddedSites)
+			sort.Strings(result.AddedDomains)
+			sort.Strings(result.ChangedOptionKeys)
+			return result, nil
+		}
+		return nil, err
+	}
+	result.ActiveVersion = activeVersion.Version
+	activeSnapshot, err := parseSnapshotDocument(activeVersion.SnapshotJSON)
+	if err != nil {
+		return nil, err
+	}
+	result.ActiveWebsiteCount = len(activeSnapshot.Routes)
+	currentSiteMap := flattenSnapshotRoutesBySite(bundle.SnapshotRoutes)
+	activeSiteMap := flattenSnapshotRoutesBySite(activeSnapshot.Routes)
+	for siteName, currentRoute := range currentSiteMap {
+		activeRoute, ok := activeSiteMap[siteName]
+		if !ok {
+			result.AddedSites = append(result.AddedSites, siteName)
+			continue
+		}
+		if !snapshotRouteConfigEqual(activeRoute, currentRoute) {
+			result.ModifiedSites = append(result.ModifiedSites, siteName)
+		}
+	}
+	for siteName := range activeSiteMap {
+		if _, ok := currentSiteMap[siteName]; !ok {
+			result.RemovedSites = append(result.RemovedSites, siteName)
+		}
+	}
+	currentMap := flattenSnapshotRoutesByDomain(bundle.SnapshotRoutes)
+	activeMap := flattenSnapshotRoutesByDomain(activeSnapshot.Routes)
+	for domain, currentRoute := range currentMap {
+		activeRoute, ok := activeMap[domain]
+		if !ok {
+			result.AddedDomains = append(result.AddedDomains, domain)
+			continue
+		}
+		if !snapshotRouteConfigEqual(activeRoute, currentRoute) {
+			result.ModifiedDomains = append(result.ModifiedDomains, domain)
+		}
+	}
+	for domain := range activeMap {
+		if _, ok := currentMap[domain]; !ok {
+			result.RemovedDomains = append(result.RemovedDomains, domain)
+		}
+	}
+	result.MainConfigChanged = activeVersion.MainConfig != bundle.MainConfig
+	result.WAFConfigChanged = !snapshotWAFConfigEqual(activeSnapshot.WAF, bundle.WAFSnapshot)
+	result.ChangedOptionDetails = diffOpenRestyOptionDetails(activeSnapshot.OpenRestyConfig, bundle.OpenRestyConfig)
+	result.ChangedOptionKeys = extractOptionDiffKeys(result.ChangedOptionDetails)
+	sort.Strings(result.AddedSites)
+	sort.Strings(result.RemovedSites)
+	sort.Strings(result.ModifiedSites)
+	sort.Strings(result.AddedDomains)
+	sort.Strings(result.RemovedDomains)
+	sort.Strings(result.ModifiedDomains)
+	sort.Strings(result.ChangedOptionKeys)
+	return result, nil
+}
+
+// PublishConfigVersion publishes the current draft as a new active version.
+func PublishConfigVersion(ctx context.Context, createdBy string, force bool) (*model.ConfigVersion, error) {
+	bundle, err := buildCurrentConfigBundle(ctx, true)
+	if err != nil {
+		return nil, err
+	}
+	if len(bundle.Routes) == 0 {
+		return nil, errors.New(errNoEnabledRoutes)
+	}
+	activeVersion, err := model.GetActiveConfigVersion(ctx)
+	if !force && err == nil && activeVersion.Checksum == bundle.Checksum {
+		return nil, errors.New(errNoChangesToPublish)
+	}
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+	supportFilesJSON, err := json.Marshal(bundle.SupportFiles)
+	if err != nil {
+		return nil, err
+	}
+	version, err := nextVersionNumber(ctx, time.Now())
+	if err != nil {
+		return nil, err
+	}
+	record := &model.ConfigVersion{
+		Version:          version,
+		SnapshotJSON:     bundle.SnapshotJSON,
+		MainConfig:       bundle.MainConfig,
+		RenderedConfig:   bundle.RouteConfig,
+		SupportFilesJSON: string(supportFilesJSON),
+		Checksum:         bundle.Checksum,
+		IsActive:         true,
+		CreatedBy:        createdBy,
+	}
+	if err = model.PublishConfigVersionTx(ctx, record); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New(errVersionConflict)
+		}
+		return nil, err
+	}
+	return record, nil
+}
+
+// ActivateConfigVersion activates an existing config version.
+func ActivateConfigVersion(ctx context.Context, id uint) (*model.ConfigVersion, error) {
+	version, err := model.GetConfigVersionByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	if err = model.ActivateConfigVersionTx(ctx, id); err != nil {
+		return nil, err
+	}
+	version.IsActive = true
+	return version, nil
+}
+
+// CleanupConfigVersions removes old inactive config versions.
+func CleanupConfigVersions(ctx context.Context, keepCount int) (*CleanupResult, error) {
+	if keepCount < 3 {
+		keepCount = 3
+	}
+	versions, err := model.ListConfigVersionSummaries(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if len(versions) <= keepCount {
+		return &CleanupResult{DeletedCount: 0, Message: "清理成功"}, nil
+	}
+	var deleteIDs []uint
+	for index, version := range versions {
+		if index < keepCount {
+			continue
+		}
+		if version.IsActive {
+			continue
+		}
+		deleteIDs = append(deleteIDs, version.ID)
+	}
+	if len(deleteIDs) == 0 {
+		return &CleanupResult{DeletedCount: 0, Message: "清理成功"}, nil
+	}
+	deletedCount, err := model.DeleteConfigVersionsByIDs(ctx, deleteIDs)
+	if err != nil {
+		return nil, err
+	}
+	return &CleanupResult{DeletedCount: deletedCount, Message: "清理成功"}, nil
+}
+
+func nextVersionNumber(ctx context.Context, now time.Time) (string, error) {
+	prefix := now.Format("20060102")
+	latest, err := model.GetLatestConfigVersionByPrefix(ctx, prefix)
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return fmt.Sprintf("%s-%03d", prefix, 1), nil
+	}
+	if err != nil {
+		return "", err
+	}
+	suffix := strings.TrimPrefix(latest, prefix+"-")
+	sequence, err := strconv.Atoi(suffix)
+	if err != nil {
+		return "", fmt.Errorf("invalid config version sequence %q: %w", latest, err)
+	}
+	return fmt.Sprintf("%s-%03d", prefix, sequence+1), nil
+}
+
+func parseSnapshotDocument(snapshotJSON string) (*snapshotDocument, error) {
+	text := strings.TrimSpace(snapshotJSON)
+	if text == "" {
+		return &snapshotDocument{Routes: []snapshotRoute{}}, nil
+	}
+	if strings.HasPrefix(text, "[") {
+		var routes []snapshotRoute
+		if err := json.Unmarshal([]byte(text), &routes); err != nil {
+			return nil, errors.New(errInvalidSnapshotFormat)
+		}
+		return &snapshotDocument{Routes: normalizeSnapshotRoutes(routes)}, nil
+	}
+	var snapshot snapshotDocument
+	if err := json.Unmarshal([]byte(text), &snapshot); err != nil {
+		return nil, errors.New(errInvalidSnapshotFormat)
+	}
+	snapshot.Routes = normalizeSnapshotRoutes(snapshot.Routes)
+	return &snapshot, nil
+}
+
+func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
+	if len(routes) == 0 {
+		return []snapshotRoute{}
+	}
+	for index := range routes {
+		normalizedDomains, err := decodeStoredDomains("", routes[index].Domain)
+		if len(routes[index].Domains) > 0 {
+			normalizedDomains, err = normalizeProxyRouteDomains(routes[index].Domains)
+		}
+		if err == nil && len(normalizedDomains) > 0 {
+			routes[index].Domains = normalizedDomains
+			routes[index].Domain = normalizedDomains[0]
+			routes[index].SiteName = normalizeProxyRouteSiteName(nil, routes[index].SiteName, normalizedDomains[0])
+		}
+		normalizedCertIDs, primaryCertID, certErr := normalizeSnapshotCertificateIDs(routes[index].CertID, routes[index].CertIDs)
+		if certErr == nil {
+			routes[index].CertID = primaryCertID
+			routes[index].CertIDs = normalizedCertIDs
+		}
+		normalizedDomainCertIDs, domainCertErr := resolveDomainCertIDs(routes[index].Domains, routes[index].CertIDs, "")
+		if domainCertErr == nil && len(routes[index].DomainCertIDs) == 0 {
+			routes[index].DomainCertIDs = normalizedDomainCertIDs
+		}
+		normalizedUpstreams, upstreamErr := normalizeUpstreams(routes[index].OriginURL, routes[index].Upstreams)
+		if upstreamErr == nil {
+			routes[index].OriginURL = normalizedUpstreams[0]
+			routes[index].Upstreams = normalizedUpstreams
+		}
+		if !routes[index].BasicAuthEnabled {
+			routes[index].BasicAuthUsername = ""
+			routes[index].BasicAuthPassword = ""
+		}
+		routes[index].UpstreamType = normalizeUpstreamType(routes[index].UpstreamType)
+	}
+	return routes
+}
+
+func flattenSnapshotRoutesBySite(routes []snapshotRoute) map[string]snapshotRoute {
+	siteMap := make(map[string]snapshotRoute)
+	for _, route := range normalizeSnapshotRoutes(routes) {
+		siteMap[route.SiteName] = route
+	}
+	return siteMap
+}
+
+func flattenSnapshotRoutesByDomain(routes []snapshotRoute) map[string]snapshotRoute {
+	domainMap := make(map[string]snapshotRoute)
+	for _, route := range normalizeSnapshotRoutes(routes) {
+		for _, domain := range route.Domains {
+			item := route
+			item.Domain = domain
+			domainMap[domain] = item
+		}
+	}
+	return domainMap
+}
+
+func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
+	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL ||
+		left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP ||
+		left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP ||
+		left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy ||
+		left.BasicAuthEnabled != right.BasicAuthEnabled || left.BasicAuthUsername != right.BasicAuthUsername ||
+		left.BasicAuthPassword != right.BasicAuthPassword || left.UpstreamType != right.UpstreamType ||
+		!uintPtrEqual(left.TunnelNodeID, right.TunnelNodeID) || left.TunnelTargetAddr != right.TunnelTargetAddr ||
+		left.TunnelTargetProto != right.TunnelTargetProto || !uintPtrEqual(left.PagesProjectID, right.PagesProjectID) ||
+		!uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
+		return false
+	}
+	if len(left.Domains) != len(right.Domains) {
+		return false
+	}
+	for index := range left.Domains {
+		if left.Domains[index] != right.Domains[index] {
+			return false
+		}
+	}
+	if len(left.Upstreams) != len(right.Upstreams) {
+		return false
+	}
+	for index := range left.Upstreams {
+		if left.Upstreams[index] != right.Upstreams[index] {
+			return false
+		}
+	}
+	if len(left.CacheRules) != len(right.CacheRules) {
+		return false
+	}
+	for index := range left.CacheRules {
+		if left.CacheRules[index] != right.CacheRules[index] {
+			return false
+		}
+	}
+	if len(left.CustomHeaders) != len(right.CustomHeaders) {
+		return false
+	}
+	for index := range left.CustomHeaders {
+		if left.CustomHeaders[index] != right.CustomHeaders[index] {
+			return false
+		}
+	}
+	return true
+}
+
+func snapshotWAFConfigEqual(left snapshotWAFDocument, right snapshotWAFDocument) bool {
+	leftJSON, err := json.Marshal(left)
+	if err != nil {
+		return false
+	}
+	rightJSON, err := json.Marshal(right)
+	if err != nil {
+		return false
+	}
+	return string(leftJSON) == string(rightJSON)
+}
+
+func normalizeSnapshotCertificateIDs(primaryCertID *uint, certIDs []uint) ([]uint, *uint, error) {
+	candidates := make([]uint, 0, len(certIDs)+1)
+	if primaryCertID != nil && *primaryCertID != 0 {
+		candidates = append(candidates, *primaryCertID)
+	}
+	candidates = append(candidates, certIDs...)
+	normalized := make([]uint, 0, len(candidates))
+	seen := make(map[uint]struct{}, len(candidates))
+	for _, certID := range candidates {
+		if certID == 0 {
+			continue
+		}
+		if _, ok := seen[certID]; ok {
+			continue
+		}
+		seen[certID] = struct{}{}
+		normalized = append(normalized, certID)
+	}
+	var normalizedPrimary *uint
+	if len(normalized) > 0 {
+		normalizedPrimary = &normalized[0]
+	}
+	return normalized, normalizedPrimary, nil
+}
+
+func buildInitialOpenRestyOptionDiffs(current openRestyConfigSnapshot) []ConfigOptionDiffItem {
+	details := diffOpenRestyOptionDetails(openRestyConfigSnapshot{}, current)
+	for index := range details {
+		details[index].PreviousValue = ""
+	}
+	return details
+}
+
+func diffOpenRestyOptionDetails(left openRestyConfigSnapshot, right openRestyConfigSnapshot) []ConfigOptionDiffItem {
+	changes := make([]ConfigOptionDiffItem, 0)
+	appendIfChanged := func(key string, previous string, current string) {
+		if previous == current {
+			return
+		}
+		changes = append(changes, ConfigOptionDiffItem{
+			Key:           key,
+			PreviousValue: previous,
+			CurrentValue:  current,
+		})
+	}
+	appendIfChanged("OpenRestyDefaultServerReturnStatus", fmt.Sprintf("%d", left.DefaultServerReturnStatus), fmt.Sprintf("%d", right.DefaultServerReturnStatus))
+	appendIfChanged("OpenRestyWorkerProcesses", left.WorkerProcesses, right.WorkerProcesses)
+	appendIfChanged("OpenRestyWorkerConnections", fmt.Sprintf("%d", left.WorkerConnections), fmt.Sprintf("%d", right.WorkerConnections))
+	appendIfChanged("OpenRestyWorkerRlimitNofile", fmt.Sprintf("%d", left.WorkerRlimitNofile), fmt.Sprintf("%d", right.WorkerRlimitNofile))
+	appendIfChanged("OpenRestyEventsUse", left.EventsUse, right.EventsUse)
+	appendIfChanged("OpenRestyEventsMultiAcceptEnabled", fmt.Sprintf("%t", left.EventsMultiAcceptEnabled), fmt.Sprintf("%t", right.EventsMultiAcceptEnabled))
+	appendIfChanged("OpenRestyKeepaliveTimeout", fmt.Sprintf("%d", left.KeepaliveTimeout), fmt.Sprintf("%d", right.KeepaliveTimeout))
+	appendIfChanged("OpenRestyKeepaliveRequests", fmt.Sprintf("%d", left.KeepaliveRequests), fmt.Sprintf("%d", right.KeepaliveRequests))
+	appendIfChanged("OpenRestyClientHeaderTimeout", fmt.Sprintf("%d", left.ClientHeaderTimeout), fmt.Sprintf("%d", right.ClientHeaderTimeout))
+	appendIfChanged("OpenRestyClientBodyTimeout", fmt.Sprintf("%d", left.ClientBodyTimeout), fmt.Sprintf("%d", right.ClientBodyTimeout))
+	appendIfChanged("OpenRestyClientMaxBodySize", left.ClientMaxBodySize, right.ClientMaxBodySize)
+	appendIfChanged("OpenRestyLargeClientHeaderBuffers", left.LargeClientHeaderBuffers, right.LargeClientHeaderBuffers)
+	appendIfChanged("OpenRestySendTimeout", fmt.Sprintf("%d", left.SendTimeout), fmt.Sprintf("%d", right.SendTimeout))
+	appendIfChanged("OpenRestyProxyConnectTimeout", fmt.Sprintf("%d", left.ProxyConnectTimeout), fmt.Sprintf("%d", right.ProxyConnectTimeout))
+	appendIfChanged("OpenRestyProxySendTimeout", fmt.Sprintf("%d", left.ProxySendTimeout), fmt.Sprintf("%d", right.ProxySendTimeout))
+	appendIfChanged("OpenRestyProxyReadTimeout", fmt.Sprintf("%d", left.ProxyReadTimeout), fmt.Sprintf("%d", right.ProxyReadTimeout))
+	appendIfChanged("OpenRestyWebsocketEnabled", fmt.Sprintf("%t", left.WebsocketEnabled), fmt.Sprintf("%t", right.WebsocketEnabled))
+	appendIfChanged("OpenRestyHTTP3Enabled", fmt.Sprintf("%t", left.HTTP3Enabled), fmt.Sprintf("%t", right.HTTP3Enabled))
+	appendIfChanged("OpenRestyProxyRequestBufferingEnabled", fmt.Sprintf("%t", left.ProxyRequestBuffering), fmt.Sprintf("%t", right.ProxyRequestBuffering))
+	appendIfChanged("OpenRestyProxyBufferingEnabled", fmt.Sprintf("%t", left.ProxyBufferingEnabled), fmt.Sprintf("%t", right.ProxyBufferingEnabled))
+	appendIfChanged("OpenRestyProxyBuffers", left.ProxyBuffers, right.ProxyBuffers)
+	appendIfChanged("OpenRestyProxyBufferSize", left.ProxyBufferSize, right.ProxyBufferSize)
+	appendIfChanged("OpenRestyProxyBusyBuffersSize", left.ProxyBusyBuffersSize, right.ProxyBusyBuffersSize)
+	appendIfChanged("OpenRestyGzipEnabled", fmt.Sprintf("%t", left.GzipEnabled), fmt.Sprintf("%t", right.GzipEnabled))
+	appendIfChanged("OpenRestyGzipMinLength", fmt.Sprintf("%d", left.GzipMinLength), fmt.Sprintf("%d", right.GzipMinLength))
+	appendIfChanged("OpenRestyGzipCompLevel", fmt.Sprintf("%d", left.GzipCompLevel), fmt.Sprintf("%d", right.GzipCompLevel))
+	appendIfChanged("OpenRestyResolvers", left.Resolvers, right.Resolvers)
+	appendIfChanged("OpenRestyCacheEnabled", fmt.Sprintf("%t", left.CacheEnabled), fmt.Sprintf("%t", right.CacheEnabled))
+	appendIfChanged("OpenRestyCachePath", left.CachePath, right.CachePath)
+	appendIfChanged("OpenRestyCacheLevels", left.CacheLevels, right.CacheLevels)
+	appendIfChanged("OpenRestyCacheInactive", left.CacheInactive, right.CacheInactive)
+	appendIfChanged("OpenRestyCacheMaxSize", left.CacheMaxSize, right.CacheMaxSize)
+	appendIfChanged("OpenRestyCacheKeyTemplate", left.CacheKeyTemplate, right.CacheKeyTemplate)
+	appendIfChanged("OpenRestyCacheLockEnabled", fmt.Sprintf("%t", left.CacheLockEnabled), fmt.Sprintf("%t", right.CacheLockEnabled))
+	appendIfChanged("OpenRestyCacheLockTimeout", left.CacheLockTimeout, right.CacheLockTimeout)
+	appendIfChanged("OpenRestyCacheUseStale", left.CacheUseStale, right.CacheUseStale)
+	return changes
+}
+
+func extractOptionDiffKeys(details []ConfigOptionDiffItem) []string {
+	keys := make([]string, 0, len(details))
+	for _, item := range details {
+		keys = append(keys, item.Key)
+	}
+	return keys
+}
+
+func openRestyOptionKeys() []string {
+	return []string{
+		"OpenRestyDefaultServerReturnStatus",
+		"OpenRestyWorkerProcesses",
+		"OpenRestyWorkerConnections",
+		"OpenRestyWorkerRlimitNofile",
+		"OpenRestyEventsUse",
+		"OpenRestyEventsMultiAcceptEnabled",
+		"OpenRestyKeepaliveTimeout",
+		"OpenRestyKeepaliveRequests",
+		"OpenRestyClientHeaderTimeout",
+		"OpenRestyClientBodyTimeout",
+		"OpenRestyClientMaxBodySize",
+		"OpenRestyLargeClientHeaderBuffers",
+		"OpenRestySendTimeout",
+		"OpenRestyProxyConnectTimeout",
+		"OpenRestyProxySendTimeout",
+		"OpenRestyProxyReadTimeout",
+		"OpenRestyWebsocketEnabled",
+		"OpenRestyHTTP3Enabled",
+		"OpenRestyProxyRequestBufferingEnabled",
+		"OpenRestyProxyBufferingEnabled",
+		"OpenRestyProxyBuffers",
+		"OpenRestyProxyBufferSize",
+		"OpenRestyProxyBusyBuffersSize",
+		"OpenRestyGzipEnabled",
+		"OpenRestyGzipMinLength",
+		"OpenRestyGzipCompLevel",
+		"OpenRestyCacheEnabled",
+		"OpenRestyCachePath",
+		"OpenRestyCacheLevels",
+		"OpenRestyCacheInactive",
+		"OpenRestyCacheMaxSize",
+		"OpenRestyCacheKeyTemplate",
+		"OpenRestyCacheLockEnabled",
+		"OpenRestyCacheLockTimeout",
+		"OpenRestyCacheUseStale",
+	}
+}

internal/apps/openflare/config_version/logics_test.go

@@ -0,0 +1,83 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/glebarez/sqlite"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func setupConfigVersionTestDB(t *testing.T) func() {
+	t.Helper()
+
+	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		DisableForeignKeyConstraintWhenMigrating: true,
+	})
+	require.NoError(t, err)
+	require.NoError(t, sqliteDB.AutoMigrate(
+		&model.ProxyRoute{},
+		&model.ConfigVersion{},
+		&model.OpenFlareWAFRuleGroup{},
+		&model.OpenFlareWAFRuleGroupBinding{},
+		&model.OpenFlareWAFIPGroup{},
+	))
+
+	db.SetDB(sqliteDB)
+	return func() {
+		db.SetDB(nil)
+	}
+}
+
+func TestPublishConfigVersionCreatesVersion(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	route := &model.ProxyRoute{
+		SiteName:  "publish-site",
+		Domain:    "publish.example.com",
+		Domains:   `["publish.example.com"]`,
+		OriginURL: "http://origin.publish.example.com:8080",
+		Upstreams: `["http://origin.publish.example.com:8080"]`,
+		Enabled:   true,
+	}
+	require.NoError(t, model.CreateProxyRouteRecord(ctx, route))
+
+	version, err := PublishConfigVersion(ctx, "tester", false)
+	require.NoError(t, err)
+	require.NotNil(t, version)
+	assert.NotZero(t, version.ID)
+	assert.True(t, version.IsActive)
+	assert.Equal(t, "tester", version.CreatedBy)
+	assert.NotEmpty(t, version.Version)
+	assert.NotEmpty(t, version.Checksum)
+	assert.NotEmpty(t, version.SnapshotJSON)
+	assert.NotEmpty(t, version.RenderedConfig)
+
+	var snapshot snapshotDocument
+	require.NoError(t, json.Unmarshal([]byte(version.SnapshotJSON), &snapshot))
+	require.Len(t, snapshot.Routes, 1)
+	assert.Equal(t, "publish-site", snapshot.Routes[0].SiteName)
+	assert.Equal(t, "publish.example.com", snapshot.Routes[0].Domain)
+
+	active, err := GetActiveConfigVersion(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, version.ID, active.ID)
+
+	_, err = PublishConfigVersion(ctx, "tester", false)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), errNoChangesToPublish)
+
+	forced, err := PublishConfigVersion(ctx, "tester", true)
+	require.NoError(t, err)
+	assert.NotEqual(t, version.ID, forced.ID)
+}

internal/apps/openflare/config_version/renderer.go

@@ -0,0 +1,53 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	openrestyrender "github.com/Rain-kl/Wavelet/pkg/render/openresty"
+)
+
+// SupportFile is a rendered configuration support artifact.
+type SupportFile struct {
+	Path    string `json:"path"`
+	Content string `json:"content"`
+}
+
+func renderSnapshotConfig(sourceJSON string, certificateFiles []SupportFile) (*openrestyrender.Result, error) {
+	return openrestyrender.RenderJSON(sourceJSON, toOpenRestySupportFiles(certificateFiles))
+}
+
+func toOpenRestySupportFiles(files []SupportFile) []openrestyrender.SupportFile {
+	if len(files) == 0 {
+		return nil
+	}
+	result := make([]openrestyrender.SupportFile, 0, len(files))
+	for _, file := range files {
+		result = append(result, openrestyrender.SupportFile{
+			Path:    file.Path,
+			Content: file.Content,
+		})
+	}
+	return result
+}
+
+func fromOpenRestySupportFiles(files []openrestyrender.SupportFile) []SupportFile {
+	if len(files) == 0 {
+		return nil
+	}
+	result := make([]SupportFile, 0, len(files))
+	for _, file := range files {
+		result = append(result, SupportFile{
+			Path:    file.Path,
+			Content: file.Content,
+		})
+	}
+	return result
+}
+
+func renderPlaceholderConfig(snapshotJSON string) (mainConfig, routeConfig, checksum string) {
+	mainConfig = `{"placeholder":"main_config"}`
+	routeConfig = snapshotJSON
+	checksum = openrestyrender.ChecksumBundle(mainConfig, routeConfig, nil)
+	return mainConfig, routeConfig, checksum
+}

internal/apps/openflare/config_version/routers.go

@@ -0,0 +1,190 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"net/http"
+
+	"github.com/Rain-kl/Wavelet/internal/apps/openflare/apiutil"
+	"github.com/Rain-kl/Wavelet/internal/common/response"
+	"github.com/gin-gonic/gin"
+)
+
+
+func handleLogicError(c *gin.Context, err error) bool {
+	if err == nil {
+		return false
+	}
+	return apiutil.AbortNotFoundIfMissing(c, err, "记录不存在")
+}
+
+// ListConfigVersionsHandler lists config versions.
+// @Summary 获取配置版本列表
+// @Description 返回所有已发布的 OpenResty 配置版本摘要，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=[]model.ConfigVersionSummary} "配置版本列表"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions [get]
+func ListConfigVersionsHandler(c *gin.Context) {
+	versions, err := ListConfigVersions(c.Request.Context())
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(versions))
+}
+
+// GetConfigVersionHandler returns a config version by id.
+// @Summary 获取配置版本详情
+// @Description 返回指定配置版本的完整快照与渲染内容，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "配置版本 ID"
+// @Success 200 {object} response.Any{data=model.ConfigVersion} "配置版本详情"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或版本不存在"
+// @Router /api/v1/d/config-versions/{id} [get]
+func GetConfigVersionHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	version, err := GetConfigVersionDetail(c.Request.Context(), id)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(version))
+}
+
+// GetActiveConfigVersionHandler returns the active config version.
+// @Summary 获取当前活跃配置版本
+// @Description 返回当前正在使用的配置版本，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=model.ConfigVersion} "活跃配置版本"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限、不存在或无活跃版本"
+// @Router /api/v1/d/config-versions/active [get]
+func GetActiveConfigVersionHandler(c *gin.Context) {
+	version, err := GetActiveConfigVersion(c.Request.Context())
+	if apiutil.AbortNotFoundIfMissing(c, err, errNoActiveVersion) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(version))
+}
+
+// PreviewConfigVersionHandler previews the current draft configuration.
+// @Summary 预览当前草稿配置
+// @Description 渲染并返回当前草稿配置的预览结果，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=config_version.ConfigPreviewResult} "配置预览"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions/preview [get]
+func PreviewConfigVersionHandler(c *gin.Context) {
+	preview, err := PreviewConfigVersion(c.Request.Context())
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(preview))
+}
+
+// DiffConfigVersionHandler diffs the current draft against the active version.
+// @Summary 对比草稿与活跃配置
+// @Description 对比当前草稿配置与活跃版本之间的差异，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=config_version.ConfigDiffResult} "配置差异"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions/diff [get]
+func DiffConfigVersionHandler(c *gin.Context) {
+	diff, err := DiffConfigVersion(c.Request.Context())
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(diff))
+}
+
+// PublishConfigVersionHandler publishes a new config version.
+// @Summary 发布配置版本
+// @Description 将当前草稿配置发布为新版本，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Param force query bool false "是否强制发布"
+// @Success 200 {object} response.Any{data=model.ConfigVersion} "发布成功"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions/publish [post]
+func PublishConfigVersionHandler(c *gin.Context) {
+	username := c.GetString("username")
+	force := c.Query("force") == "true"
+	version, err := PublishConfigVersion(c.Request.Context(), username, force)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(version))
+}
+
+// ActivateConfigVersionHandler activates an existing config version.
+// @Summary 激活配置版本
+// @Description 将指定历史版本设为当前活跃配置，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "配置版本 ID"
+// @Success 200 {object} response.Any{data=model.ConfigVersion} "激活成功"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或版本不存在"
+// @Router /api/v1/d/config-versions/{id}/activate [post]
+func ActivateConfigVersionHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	version, err := ActivateConfigVersion(c.Request.Context(), id)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(version))
+}
+
+// CleanupConfigVersionsHandler removes old inactive config versions.
+// @Summary 清理历史配置版本
+// @Description 删除超出保留数量的非活跃配置版本，需要管理员权限
+// @Tags openflare-config-version
+// @Accept json
+// @Produce json
+// @Security SessionCookie
+// @Param body body config_version.CleanupInput true "清理参数"
+// @Success 200 {object} response.Any{data=config_version.CleanupResult} "清理结果"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions/cleanup [post]
+func CleanupConfigVersionsHandler(c *gin.Context) {
+	var input CleanupInput
+	if !apiutil.BindJSON(c, &input) {
+		return
+	}
+	result, err := CleanupConfigVersions(c.Request.Context(), input.KeepCount)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(result))
+}

internal/apps/openflare/config_version/snapshot.go

@@ -0,0 +1,510 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/Rain-kl/Wavelet/internal/apps/openflare/waf"
+	"github.com/Rain-kl/Wavelet/internal/model"
+	openrestyrender "github.com/Rain-kl/Wavelet/pkg/render/openresty"
+)
+
+type snapshotRoute struct {
+	ID                 uint                `json:"id,omitempty"`
+	SiteName           string              `json:"site_name,omitempty"`
+	Domain             string              `json:"domain"`
+	Domains            []string            `json:"domains,omitempty"`
+	OriginURL          string              `json:"origin_url"`
+	OriginHost         string              `json:"origin_host,omitempty"`
+	Upstreams          []string            `json:"upstreams,omitempty"`
+	Enabled            bool                `json:"enabled"`
+	EnableHTTPS        bool                `json:"enable_https"`
+	CertID             *uint               `json:"cert_id,omitempty"`
+	CertIDs            []uint              `json:"cert_ids,omitempty"`
+	DomainCertIDs      []uint              `json:"domain_cert_ids,omitempty"`
+	RedirectHTTP       bool                `json:"redirect_http"`
+	LimitConnPerServer int                 `json:"limit_conn_per_server,omitempty"`
+	LimitConnPerIP     int                 `json:"limit_conn_per_ip,omitempty"`
+	LimitRate          string              `json:"limit_rate,omitempty"`
+	CacheEnabled       bool                `json:"cache_enabled"`
+	CachePolicy        string              `json:"cache_policy,omitempty"`
+	CacheRules         []string            `json:"cache_rules,omitempty"`
+	CustomHeaders      []customHeaderInput `json:"custom_headers,omitempty"`
+	BasicAuthEnabled   bool                `json:"basic_auth_enabled,omitempty"`
+	BasicAuthUsername  string              `json:"basic_auth_username,omitempty"`
+	BasicAuthPassword  string              `json:"basic_auth_password,omitempty"`
+	Remark             string              `json:"remark,omitempty"`
+	UpstreamType       string              `json:"upstream_type,omitempty"`
+	TunnelNodeID       *uint               `json:"tunnel_node_id,omitempty"`
+	TunnelTargetAddr   string              `json:"tunnel_target_addr,omitempty"`
+	TunnelTargetProto  string              `json:"tunnel_target_protocol,omitempty"`
+	PagesProjectID     *uint               `json:"pages_project_id,omitempty"`
+}
+
+type snapshotWAFRuleGroup struct {
+	ID                uint                       `json:"id"`
+	Name              string                     `json:"name"`
+	Enabled           bool                       `json:"enabled"`
+	IsGlobal          bool                       `json:"is_global"`
+	BlockStatusCode   int                        `json:"block_status_code"`
+	BlockResponseBody string                     `json:"block_response_body,omitempty"`
+	IPWhitelist       []string                   `json:"ip_whitelist,omitempty"`
+	IPBlacklist       []string                   `json:"ip_blacklist,omitempty"`
+	IPWhitelistGroups []uint                     `json:"ip_whitelist_group_ids,omitempty"`
+	IPBlacklistGroups []uint                     `json:"ip_blacklist_group_ids,omitempty"`
+	CountryWhitelist  []string                   `json:"country_whitelist,omitempty"`
+	CountryBlacklist  []string                   `json:"country_blacklist,omitempty"`
+	RegionWhitelist   []string                   `json:"region_whitelist,omitempty"`
+	RegionBlacklist   []string                   `json:"region_blacklist,omitempty"`
+	PoWEnabled        bool                       `json:"pow_enabled,omitempty"`
+	PoWConfig         *openrestyrender.PoWConfig `json:"pow_config,omitempty"`
+}
+
+type snapshotWAFIPGroup struct {
+	ID      uint     `json:"id"`
+	Name    string   `json:"name"`
+	Type    string   `json:"type"`
+	Enabled bool     `json:"enabled"`
+	IPList  []string `json:"ip_list,omitempty"`
+}
+
+type snapshotWAFBinding struct {
+	RouteID      uint   `json:"route_id"`
+	SiteName     string `json:"site_name"`
+	RuleGroupIDs []uint `json:"rule_group_ids"`
+}
+
+type snapshotWAFDocument struct {
+	RuleGroups []snapshotWAFRuleGroup `json:"rule_groups"`
+	IPGroups   []snapshotWAFIPGroup   `json:"ip_groups,omitempty"`
+	Bindings   []snapshotWAFBinding   `json:"bindings"`
+}
+
+type openRestyConfigSnapshot struct {
+	DefaultServerReturnStatus int    `json:"default_server_return_status"`
+	WorkerProcesses           string `json:"worker_processes"`
+	WorkerConnections         int    `json:"worker_connections"`
+	WorkerRlimitNofile        int    `json:"worker_rlimit_nofile"`
+	EventsUse                 string `json:"events_use,omitempty"`
+	EventsMultiAcceptEnabled  bool   `json:"events_multi_accept_enabled"`
+	KeepaliveTimeout          int    `json:"keepalive_timeout"`
+	KeepaliveRequests         int    `json:"keepalive_requests"`
+	ClientHeaderTimeout       int    `json:"client_header_timeout"`
+	ClientBodyTimeout         int    `json:"client_body_timeout"`
+	ClientMaxBodySize         string `json:"client_max_body_size"`
+	LargeClientHeaderBuffers  string `json:"large_client_header_buffers"`
+	SendTimeout               int    `json:"send_timeout"`
+	ProxyConnectTimeout       int    `json:"proxy_connect_timeout"`
+	ProxySendTimeout          int    `json:"proxy_send_timeout"`
+	ProxyReadTimeout          int    `json:"proxy_read_timeout"`
+	WebsocketEnabled          bool   `json:"websocket_enabled"`
+	HTTP3Enabled              bool   `json:"http3_enabled"`
+	ProxyRequestBuffering     bool   `json:"proxy_request_buffering"`
+	ProxyBufferingEnabled     bool   `json:"proxy_buffering_enabled"`
+	ProxyBuffers              string `json:"proxy_buffers"`
+	ProxyBufferSize           string `json:"proxy_buffer_size"`
+	ProxyBusyBuffersSize      string `json:"proxy_busy_buffers_size"`
+	GzipEnabled               bool   `json:"gzip_enabled"`
+	GzipMinLength             int    `json:"gzip_min_length"`
+	GzipCompLevel             int    `json:"gzip_comp_level"`
+	Resolvers                 string `json:"resolvers,omitempty"`
+	CacheEnabled              bool   `json:"cache_enabled"`
+	CachePath                 string `json:"cache_path,omitempty"`
+	CacheLevels               string `json:"cache_levels"`
+	CacheInactive             string `json:"cache_inactive"`
+	CacheMaxSize              string `json:"cache_max_size"`
+	CacheKeyTemplate          string `json:"cache_key_template"`
+	CacheLockEnabled          bool   `json:"cache_lock_enabled"`
+	CacheLockTimeout          string `json:"cache_lock_timeout"`
+	CacheUseStale             string `json:"cache_use_stale"`
+	MainConfigTemplate        string `json:"main_config_template,omitempty"`
+}
+
+type snapshotDocument struct {
+	Routes          []snapshotRoute         `json:"routes"`
+	OpenRestyConfig openRestyConfigSnapshot `json:"openresty_config"`
+	WAF             snapshotWAFDocument     `json:"waf"`
+}
+
+type configBundle struct {
+	Routes            []*model.ProxyRoute
+	SnapshotRoutes    []snapshotRoute
+	WAFSnapshot       snapshotWAFDocument
+	OpenRestyConfig   openRestyConfigSnapshot
+	SnapshotJSON      string
+	MainConfig        string
+	RouteConfig       string
+	SupportFiles      []SupportFile
+	Checksum          string
+	ChangedOptionKeys []string
+}
+
+func buildCurrentConfigBundle(ctx context.Context, requireRoutes bool) (*configBundle, error) {
+	routes, err := model.ListEnabledProxyRoutes(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if requireRoutes && len(routes) == 0 {
+		return nil, errors.New(errNoEnabledRoutes)
+	}
+	snapshotRoutes, err := buildSnapshotRoutes(ctx, routes)
+	if err != nil {
+		return nil, err
+	}
+	wafSnapshot, err := buildSnapshotWAFDocument(ctx, routes)
+	if err != nil {
+		return nil, err
+	}
+	openRestyConfig := buildOpenRestyConfigSnapshot()
+	snapshotDoc := snapshotDocument{
+		Routes:          snapshotRoutes,
+		OpenRestyConfig: openRestyConfig,
+		WAF:             wafSnapshot,
+	}
+	snapshotJSON, err := json.Marshal(snapshotDoc)
+	if err != nil {
+		return nil, err
+	}
+	certificateFiles, err := buildCertificateSupportFiles(ctx, snapshotRoutes)
+	if err != nil {
+		return nil, err
+	}
+
+	mainConfig := ""
+	routeConfig := ""
+	checksum := ""
+	supportFiles := []SupportFile(nil)
+
+	rendered, renderErr := renderSnapshotConfig(string(snapshotJSON), certificateFiles)
+	if renderErr == nil {
+		mainConfig = rendered.MainConfig
+		routeConfig = rendered.RouteConfig
+		checksum = rendered.Checksum
+		supportFiles = fromOpenRestySupportFiles(rendered.SupportFiles)
+	} else {
+		mainConfig, routeConfig, checksum = renderPlaceholderConfig(string(snapshotJSON))
+	}
+
+	return &configBundle{
+		Routes:            routes,
+		SnapshotRoutes:    snapshotRoutes,
+		WAFSnapshot:       wafSnapshot,
+		OpenRestyConfig:   openRestyConfig,
+		SnapshotJSON:      string(snapshotJSON),
+		MainConfig:        mainConfig,
+		RouteConfig:       routeConfig,
+		SupportFiles:      supportFiles,
+		Checksum:          checksum,
+		ChangedOptionKeys: openRestyOptionKeys(),
+	}, nil
+}
+
+func buildSnapshotRoutes(ctx context.Context, routes []*model.ProxyRoute) ([]snapshotRoute, error) {
+	items := make([]snapshotRoute, 0, len(routes))
+	for _, route := range routes {
+		domains, err := decodeStoredDomains(route.Domains, route.Domain)
+		if err != nil {
+			return nil, fmt.Errorf("route %s domains are invalid", route.Domain)
+		}
+		customHeaders, err := decodeStoredCustomHeaders(route.CustomHeaders)
+		if err != nil {
+			return nil, fmt.Errorf("路由 %s 自定义请求头无效", route.Domain)
+		}
+		upstreamType := normalizeUpstreamType(route.UpstreamType)
+		originURL := route.OriginURL
+		upstreams, err := decodeStoredUpstreams(route.Upstreams, route.OriginURL)
+		if err != nil {
+			return nil, fmt.Errorf("路由 %s 上游配置无效", route.Domain)
+		}
+		var tunnelNodeID *uint
+		var tunnelTargetAddr string
+		var tunnelTargetProtocol string
+		var pagesProjectID *uint
+		if upstreamType == "tunnel" {
+			originURL = resolveTunnelOpenRestyUpstreamURL(ctx)
+			upstreams = []string{originURL}
+			tunnelNodeID = route.TunnelNodeID
+			tunnelTargetAddr = strings.TrimSpace(route.TunnelTargetAddr)
+			tunnelTargetProtocol = normalizeTunnelTargetProtocol(route.TunnelTargetProtocol)
+		} else if upstreamType == "pages" {
+			return nil, fmt.Errorf("路由 %s Pages 配置无效: pages module is not available", route.Domain)
+		}
+		cacheRules, err := decodeStoredCacheRules(route.CacheRules)
+		if err != nil {
+			return nil, fmt.Errorf("路由 %s 缓存规则无效", route.Domain)
+		}
+		items = append(items, snapshotRoute{
+			ID:                 route.ID,
+			SiteName:           normalizeProxyRouteSiteName(route, route.SiteName, domains[0]),
+			Domain:             domains[0],
+			Domains:            domains,
+			OriginURL:          originURL,
+			OriginHost:         route.OriginHost,
+			Upstreams:          upstreams,
+			Enabled:            route.Enabled,
+			EnableHTTPS:        route.EnableHTTPS,
+			CertID:             route.CertID,
+			CertIDs:            mustDecodeCertIDs(route),
+			DomainCertIDs:      mustDecodeDomainCertIDs(route, domains),
+			RedirectHTTP:       route.RedirectHTTP,
+			LimitConnPerServer: route.LimitConnPerServer,
+			LimitConnPerIP:     route.LimitConnPerIP,
+			LimitRate:          route.LimitRate,
+			CacheEnabled:       route.CacheEnabled,
+			CachePolicy:        route.CachePolicy,
+			CacheRules:         cacheRules,
+			CustomHeaders:      customHeaders,
+			BasicAuthEnabled:   route.BasicAuthEnabled,
+			BasicAuthUsername:  route.BasicAuthUsername,
+			BasicAuthPassword:  route.BasicAuthPassword,
+			Remark:             route.Remark,
+			UpstreamType:       upstreamType,
+			TunnelNodeID:       tunnelNodeID,
+			TunnelTargetAddr:   tunnelTargetAddr,
+			TunnelTargetProto:  tunnelTargetProtocol,
+			PagesProjectID:     pagesProjectID,
+		})
+	}
+	return items, nil
+}
+
+func buildSnapshotWAFDocument(ctx context.Context, routes []*model.ProxyRoute) (snapshotWAFDocument, error) {
+	if err := waf.EnsureDefaultRuleGroup(ctx); err != nil {
+		return snapshotWAFDocument{}, err
+	}
+	views, err := waf.ListRuleGroups(ctx)
+	if err != nil {
+		return snapshotWAFDocument{}, err
+	}
+	ruleGroups := make([]snapshotWAFRuleGroup, 0, len(views))
+	for _, view := range views {
+		if !view.Enabled {
+			continue
+		}
+		ruleGroups = append(ruleGroups, snapshotWAFRuleGroup{
+			ID:                view.ID,
+			Name:              view.Name,
+			Enabled:           view.Enabled,
+			IsGlobal:          view.IsGlobal,
+			BlockStatusCode:   view.BlockStatusCode,
+			BlockResponseBody: view.BlockResponseBody,
+			IPWhitelist:       view.IPWhitelist,
+			IPBlacklist:       view.IPBlacklist,
+			IPWhitelistGroups: view.IPWhitelistGroups,
+			IPBlacklistGroups: view.IPBlacklistGroups,
+			CountryWhitelist:  view.CountryWhitelist,
+			CountryBlacklist:  view.CountryBlacklist,
+			RegionWhitelist:   view.RegionWhitelist,
+			RegionBlacklist:   view.RegionBlacklist,
+			PoWEnabled:        view.PoWEnabled,
+			PoWConfig:         convertPoWConfig(view.PoWConfig),
+		})
+	}
+	ipGroups, err := buildSnapshotWAFIPGroups(ctx, ruleGroups)
+	if err != nil {
+		return snapshotWAFDocument{}, err
+	}
+	enabledRouteIDs := make(map[uint]string, len(routes))
+	for _, route := range routes {
+		if route == nil {
+			continue
+		}
+		siteName := strings.TrimSpace(route.SiteName)
+		if siteName == "" {
+			siteName = route.Domain
+		}
+		enabledRouteIDs[route.ID] = siteName
+	}
+	rawBindings, err := model.ListOpenFlareWAFRuleGroupBindings(ctx)
+	if err != nil {
+		return snapshotWAFDocument{}, err
+	}
+	groupIDsByRoute := make(map[uint][]uint, len(rawBindings))
+	for _, binding := range rawBindings {
+		if _, ok := enabledRouteIDs[binding.ProxyRouteID]; !ok {
+			continue
+		}
+		groupIDsByRoute[binding.ProxyRouteID] = append(groupIDsByRoute[binding.ProxyRouteID], binding.RuleGroupID)
+	}
+	bindings := make([]snapshotWAFBinding, 0, len(groupIDsByRoute))
+	for routeID, groupIDs := range groupIDsByRoute {
+		sort.Slice(groupIDs, func(i, j int) bool { return groupIDs[i] < groupIDs[j] })
+		bindings = append(bindings, snapshotWAFBinding{
+			RouteID:      routeID,
+			SiteName:     enabledRouteIDs[routeID],
+			RuleGroupIDs: groupIDs,
+		})
+	}
+	sort.Slice(bindings, func(i, j int) bool {
+		if bindings[i].SiteName == bindings[j].SiteName {
+			return bindings[i].RouteID < bindings[j].RouteID
+		}
+		return bindings[i].SiteName < bindings[j].SiteName
+	})
+	return snapshotWAFDocument{RuleGroups: ruleGroups, IPGroups: ipGroups, Bindings: bindings}, nil
+}
+
+func buildSnapshotWAFIPGroups(ctx context.Context, ruleGroups []snapshotWAFRuleGroup) ([]snapshotWAFIPGroup, error) {
+	idSet := make(map[uint]struct{})
+	for _, group := range ruleGroups {
+		for _, id := range group.IPWhitelistGroups {
+			idSet[id] = struct{}{}
+		}
+		for _, id := range group.IPBlacklistGroups {
+			idSet[id] = struct{}{}
+		}
+	}
+	if len(idSet) == 0 {
+		return []snapshotWAFIPGroup{}, nil
+	}
+	ids := make([]uint, 0, len(idSet))
+	for id := range idSet {
+		ids = append(ids, id)
+	}
+	sort.Slice(ids, func(i, j int) bool { return ids[i] < ids[j] })
+	groups, err := listWAFIPGroupsByIDs(ctx, ids)
+	if err != nil {
+		return nil, err
+	}
+	groupByID := make(map[uint]*model.OpenFlareWAFIPGroup, len(groups))
+	for _, group := range groups {
+		groupByID[group.ID] = group
+	}
+	snapshots := make([]snapshotWAFIPGroup, 0, len(ids))
+	for _, id := range ids {
+		group := groupByID[id]
+		if group == nil {
+			return nil, fmt.Errorf("IP 组 %d 不存在", id)
+		}
+		ipList, decodeErr := decodeIPList(group.IPList)
+		if decodeErr != nil {
+			return nil, decodeErr
+		}
+		snapshots = append(snapshots, snapshotWAFIPGroup{
+			ID:      group.ID,
+			Name:    group.Name,
+			Type:    group.Type,
+			Enabled: group.Enabled,
+			IPList:  ipList,
+		})
+	}
+	return snapshots, nil
+}
+
+func decodeIPList(raw string) ([]string, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return []string{}, nil
+	}
+	var items []string
+	if err := json.Unmarshal([]byte(text), &items); err != nil {
+		return nil, fmt.Errorf("ip_list payload is invalid")
+	}
+	return items, nil
+}
+
+func convertPoWConfig(config *waf.PoWConfig) *openrestyrender.PoWConfig {
+	if config == nil {
+		return nil
+	}
+	return &openrestyrender.PoWConfig{
+		Difficulty:   config.Difficulty,
+		Algorithm:    config.Algorithm,
+		SessionTTL:   config.SessionTTL,
+		ChallengeTTL: config.ChallengeTTL,
+		Whitelist: openrestyrender.PoWListConfig{
+			IPs:         config.Whitelist.IPs,
+			IPCidrs:     config.Whitelist.IPCidrs,
+			Paths:       config.Whitelist.Paths,
+			PathRegexes: config.Whitelist.PathRegexes,
+			UserAgents:  config.Whitelist.UserAgents,
+		},
+		Blacklist: openrestyrender.PoWListConfig{
+			IPs:         config.Blacklist.IPs,
+			IPCidrs:     config.Blacklist.IPCidrs,
+			Paths:       config.Blacklist.Paths,
+			PathRegexes: config.Blacklist.PathRegexes,
+			UserAgents:  config.Blacklist.UserAgents,
+		},
+	}
+}
+
+func buildOpenRestyConfigSnapshot() openRestyConfigSnapshot {
+	return openRestyConfigSnapshot{
+		DefaultServerReturnStatus: model.OpenRestyDefaultServerReturnStatus,
+		WorkerProcesses:           model.OpenRestyWorkerProcesses,
+		WorkerConnections:         model.OpenRestyWorkerConnections,
+		WorkerRlimitNofile:        model.OpenRestyWorkerRlimitNofile,
+		EventsUse:                 model.OpenRestyEventsUse,
+		EventsMultiAcceptEnabled:  model.OpenRestyEventsMultiAcceptEnabled,
+		KeepaliveTimeout:          model.OpenRestyKeepaliveTimeout,
+		KeepaliveRequests:         model.OpenRestyKeepaliveRequests,
+		ClientHeaderTimeout:       model.OpenRestyClientHeaderTimeout,
+		ClientBodyTimeout:         model.OpenRestyClientBodyTimeout,
+		ClientMaxBodySize:         model.OpenRestyClientMaxBodySize,
+		LargeClientHeaderBuffers:  model.OpenRestyLargeClientHeaderBuffers,
+		SendTimeout:               model.OpenRestySendTimeout,
+		ProxyConnectTimeout:       model.OpenRestyProxyConnectTimeout,
+		ProxySendTimeout:          model.OpenRestyProxySendTimeout,
+		ProxyReadTimeout:          model.OpenRestyProxyReadTimeout,
+		WebsocketEnabled:          model.OpenRestyWebsocketEnabled,
+		HTTP3Enabled:              model.OpenRestyHTTP3Enabled,
+		ProxyRequestBuffering:     model.OpenRestyProxyRequestBufferingEnabled,
+		ProxyBufferingEnabled:     model.OpenRestyProxyBufferingEnabled,
+		ProxyBuffers:              model.OpenRestyProxyBuffers,
+		ProxyBufferSize:           model.OpenRestyProxyBufferSize,
+		ProxyBusyBuffersSize:      model.OpenRestyProxyBusyBuffersSize,
+		GzipEnabled:               model.OpenRestyGzipEnabled,
+		GzipMinLength:             model.OpenRestyGzipMinLength,
+		GzipCompLevel:             model.OpenRestyGzipCompLevel,
+		Resolvers:                 model.OpenRestyResolvers,
+		CacheEnabled:              model.OpenRestyCacheEnabled,
+		CachePath:                 model.OpenRestyCachePath,
+		CacheLevels:               model.OpenRestyCacheLevels,
+		CacheInactive:             model.OpenRestyCacheInactive,
+		CacheMaxSize:              model.OpenRestyCacheMaxSize,
+		CacheKeyTemplate:          model.OpenRestyCacheKeyTemplate,
+		CacheLockEnabled:          model.OpenRestyCacheLockEnabled,
+		CacheLockTimeout:          model.OpenRestyCacheLockTimeout,
+		CacheUseStale:             model.OpenRestyCacheUseStale,
+		MainConfigTemplate:        model.OpenRestyMainConfigTemplate,
+	}
+}
+
+func buildCertificateSupportFiles(ctx context.Context, routes []snapshotRoute) ([]SupportFile, error) {
+	certIDSet := make(map[uint]struct{})
+	for _, route := range routes {
+		for _, certID := range route.CertIDs {
+			if certID != 0 {
+				certIDSet[certID] = struct{}{}
+			}
+		}
+	}
+	if len(certIDSet) == 0 {
+		return nil, nil
+	}
+	certIDs := make([]uint, 0, len(certIDSet))
+	for certID := range certIDSet {
+		certIDs = append(certIDs, certID)
+	}
+	sort.Slice(certIDs, func(i, j int) bool { return certIDs[i] < certIDs[j] })
+	files := make([]SupportFile, 0, len(certIDs)*2)
+	for _, certID := range certIDs {
+		certificate, err := model.GetTLSCertificateByID(ctx, certID)
+		if err != nil {
+			return nil, err
+		}
+		files = append(files,
+			SupportFile{Path: certificateCertFileName(certificate.ID), Content: normalizePEM(certificate.CertPEM)},
+			SupportFile{Path: certificateKeyFileName(certificate.ID), Content: normalizePEM(certificate.KeyPEM)},
+		)
+	}
+	return dedupeSupportFiles(files), nil
+}