refactor(repo): consolidate openflare-server to root and move subprojects to internal/apps

- Merge all files inside openflare-server to the repository root directory.
- Relocate agent, relay, and flared subprojects from internal/ to internal/apps/.
- Combine docker-compose files and update build context paths to root.
- Update GitHub workflows and Dockerfiles to refer to new directories and package names.
- Rewrite Go package imports across all files.
- Resolve database renew test race condition and clean up docs.

internal/model/access_token.go

@@ -0,0 +1,60 @@
+// Copyright 2025 linux.do
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package model 定义数据模型与 GORM 实体
+package model
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"time"
+)
+
+const (
+	tokenByteLength = 24 // Token 随机字节长度
+	maskThreshold   = 8  // 脱敏显示阈值
+)
+
+// AccessToken 个人访问令牌实体
+type AccessToken struct {
+	ID          uint64    `json:"id" gorm:"primaryKey;autoIncrement"`
+	UserID      uint64    `json:"user_id" gorm:"index;not null"`
+	Name        string    `json:"name" gorm:"size:128;not null"`
+	TokenHash   string    `json:"-" gorm:"size:64;uniqueIndex;not null"`
+	MaskedToken string    `json:"masked_token" gorm:"size:64;not null"`
+	IsAdmin     bool      `json:"is_admin" gorm:"default:false"`
+	CreatedAt   time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt   time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名
+func (AccessToken) TableName() string {
+	return "w_access_tokens"
+}
+
+// GenerateTokenString 生成加密安全的随机 Token 值
+func GenerateTokenString() (string, error) {
+	bytes := make([]byte, tokenByteLength)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("at_%s", hex.EncodeToString(bytes)), nil
+}
+
+// HashToken 计算 Token 的 SHA-256 哈希值用于数据库存储与查询
+func HashToken(token string) string {
+	h := sha256.New()
+	h.Write([]byte(token))
+	return hex.EncodeToString(h.Sum(nil))
+}
+
+// MaskTokenString 生成脱敏显示的 Token，仅保留前缀和最后四位
+func MaskTokenString(token string) string {
+	if len(token) <= maskThreshold {
+		return "at_****"
+	}
+	return fmt.Sprintf("%s...%s", token[:7], token[len(token)-4:])
+}

internal/model/analytics/node_access_log.go

@@ -0,0 +1,42 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package analytics
+
+import (
+	"fmt"
+	"time"
+)
+
+const (
+	nodeAccessLogTableName     = "of_node_access_logs"
+	nodeAccessLogInsertColumns = "id, node_id, logged_at, remote_addr, region, host, path, status_code, created_at"
+)
+
+// NodeAccessLog stores OpenFlare edge node access records in ClickHouse.
+type NodeAccessLog struct {
+	ID         uint64    `gorm:"column:id"`
+	NodeID     string    `gorm:"column:node_id"`
+	LoggedAt   time.Time `gorm:"column:logged_at"`
+	RemoteAddr string    `gorm:"column:remote_addr"`
+	Region     string    `gorm:"column:region"`
+	Host       string    `gorm:"column:host"`
+	Path       string    `gorm:"column:path"`
+	StatusCode int32     `gorm:"column:status_code"`
+	CreatedAt  time.Time `gorm:"column:created_at"`
+}
+
+// TableName returns the ClickHouse table name.
+func (NodeAccessLog) TableName() string {
+	return nodeAccessLogTableName
+}
+
+// InsertColumns returns comma-separated column names for batch insert.
+func (NodeAccessLog) InsertColumns() string {
+	return nodeAccessLogInsertColumns
+}
+
+// BatchInsertSQL returns the INSERT prefix used by native batch writers.
+func (NodeAccessLog) BatchInsertSQL() string {
+	return fmt.Sprintf("INSERT INTO %s (%s)", nodeAccessLogTableName, nodeAccessLogInsertColumns)
+}

internal/model/analytics/user_access_log.go

@@ -0,0 +1,44 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package analytics defines ClickHouse analytics domain models.
+package analytics
+
+import (
+	"fmt"
+	"time"
+)
+
+const (
+	userAccessLogTableName     = "w_user_access_logs"
+	userAccessLogInsertColumns = "id, user_id, path, method, ip, user_agent, headers, status, latency, created_at"
+)
+
+// UserAccessLog stores HTTP access records in ClickHouse.
+type UserAccessLog struct {
+	ID        uint64    `gorm:"column:id"`
+	UserID    uint64    `gorm:"column:user_id"`
+	Path      string    `gorm:"column:path"`
+	Method    string    `gorm:"column:method"`
+	IP        string    `gorm:"column:ip"`
+	UserAgent string    `gorm:"column:user_agent"`
+	Headers   string    `gorm:"column:headers"`
+	Status    int32     `gorm:"column:status"`
+	Latency   int64     `gorm:"column:latency"`
+	CreatedAt time.Time `gorm:"column:created_at"`
+}
+
+// TableName returns the ClickHouse table name.
+func (UserAccessLog) TableName() string {
+	return userAccessLogTableName
+}
+
+// InsertColumns returns comma-separated column names for batch insert.
+func (UserAccessLog) InsertColumns() string {
+	return userAccessLogInsertColumns
+}
+
+// BatchInsertSQL returns the INSERT prefix used by native batch writers.
+func (UserAccessLog) BatchInsertSQL() string {
+	return fmt.Sprintf("INSERT INTO %s (%s)", userAccessLogTableName, userAccessLogInsertColumns)
+}

internal/model/auth_source.go

@@ -0,0 +1,318 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"gorm.io/gorm"
+)
+
+// 认证源类型
+const (
+	AuthSourceTypeOIDC = "oidc"
+)
+
+var authSourceNamePattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$`)
+
+// AuthSource 认证源实体
+type AuthSource struct {
+	ID                     uint64    `json:"id" gorm:"primaryKey"`
+	Name                   string    `json:"name" gorm:"uniqueIndex;size:80;not null"`
+	Type                   string    `json:"type" gorm:"size:20;not null"`
+	DisplayName            string    `json:"display_name" gorm:"size:100"`
+	IsActive               bool      `json:"is_active" gorm:"index;not null;default:false"`
+	ClientID               string    `json:"client_id" gorm:"size:255"`
+	ClientSecret           string    `json:"-" gorm:"size:1024"`
+	OpenIDDiscoveryURL     string    `json:"openid_discovery_url" gorm:"column:openid_discovery_url;size:1024"`
+	Scopes                 string    `json:"scopes" gorm:"size:255"`
+	IconURL                string    `json:"icon_url" gorm:"size:1024"`
+	CreatedAt              time.Time `json:"created_at"`
+	UpdatedAt              time.Time `json:"updated_at"`
+	ClientSecretConfigured bool      `json:"client_secret_configured" gorm:"-"`
+}
+
+// TableName 表名
+func (AuthSource) TableName() string {
+	return "w_auth_sources"
+}
+
+// ExternalAccount 外部账号绑定实体
+type ExternalAccount struct {
+	ID               uint64    `json:"id" gorm:"primaryKey"`
+	AuthSourceID     uint64    `json:"auth_source_id" gorm:"uniqueIndex:idx_external_accounts_source_external,priority:1;index"`
+	UserID           uint64    `json:"user_id" gorm:"index;not null"`
+	ExternalID       string    `json:"external_id" gorm:"uniqueIndex:idx_external_accounts_source_external,priority:2;size:255;not null"`
+	ExternalUsername string    `json:"external_username" gorm:"size:255"`
+	Email            string    `json:"email" gorm:"size:255"`
+	CreatedAt        time.Time `json:"created_at"`
+	UpdatedAt        time.Time `json:"updated_at"`
+}
+
+// TableName 表名
+func (ExternalAccount) TableName() string {
+	return "w_external_accounts"
+}
+
+// ExternalAccountView 外部帐号绑定视图（脱敏展示用）
+type ExternalAccountView struct {
+	ID               uint64    `json:"id"`
+	AuthSourceID     uint64    `json:"auth_source_id"`
+	AuthSourceName   string    `json:"auth_source_name"`
+	AuthSourceType   string    `json:"auth_source_type"`
+	AuthSourceLabel  string    `json:"auth_source_label"`
+	ExternalUsername string    `json:"external_username"`
+	Email            string    `json:"email"`
+	CreatedAt        time.Time `json:"created_at"`
+}
+
+// Normalize 对认证源字段进行标准化处理
+func (source *AuthSource) Normalize() {
+	source.Type = strings.ToLower(strings.TrimSpace(source.Type))
+	source.Name = strings.TrimSpace(source.Name)
+	source.DisplayName = strings.TrimSpace(source.DisplayName)
+	source.ClientID = strings.TrimSpace(source.ClientID)
+	source.ClientSecret = strings.TrimSpace(source.ClientSecret)
+	source.OpenIDDiscoveryURL = strings.TrimSpace(source.OpenIDDiscoveryURL)
+	source.Scopes = strings.TrimSpace(source.Scopes)
+	source.IconURL = strings.TrimSpace(source.IconURL)
+	if source.DisplayName == "" {
+		source.DisplayName = source.Name
+	}
+	if source.Type == AuthSourceTypeOIDC && source.Scopes == "" {
+		source.Scopes = "openid profile email"
+	}
+}
+
+// Validate 校验认证源字段合法性
+func (source *AuthSource) Validate() error {
+	source.Normalize()
+	if source.Name == "" {
+		return errors.New(errAuthSourceNameRequired)
+	}
+	if !authSourceNamePattern.MatchString(source.Name) {
+		return errors.New(errAuthSourceNameInvalid)
+	}
+	if source.Type != AuthSourceTypeOIDC {
+		return errors.New(errAuthSourceTypeUnsupported)
+	}
+	if source.OpenIDDiscoveryURL == "" {
+		return errors.New(errAuthSourceDiscoveryURLRequired)
+	}
+	if source.IsActive && (source.ClientID == "" || source.ClientSecret == "") {
+		return errors.New(errAuthSourceClientCredentialsRequired)
+	}
+	return nil
+}
+
+// Sanitize 脱敏处理，将 ClientSecret 清空并设置 ClientSecretConfigured 标志
+func (source *AuthSource) Sanitize() {
+	source.ClientSecretConfigured = source.ClientSecret != ""
+	source.ClientSecret = ""
+}
+
+// GetAuthSources 获取所有认证源（已脱敏）
+func GetAuthSources(ctx context.Context) ([]AuthSource, error) {
+	var sources []AuthSource
+	if err := db.DB(ctx).Order("id asc").Find(&sources).Error; err != nil {
+		return nil, err
+	}
+	for i := range sources {
+		sources[i].Sanitize()
+	}
+	return sources, nil
+}
+
+// GetActiveAuthSources 获取所有已启用的认证源（已脱敏）
+func GetActiveAuthSources(ctx context.Context) ([]AuthSource, error) {
+	var sources []AuthSource
+	if err := db.DB(ctx).Where("is_active = ?", true).Order("id asc").Find(&sources).Error; err != nil {
+		return nil, err
+	}
+	for i := range sources {
+		sources[i].Sanitize()
+	}
+	return sources, nil
+}
+
+// GetAuthSourceByID 根据 ID 获取认证源
+func GetAuthSourceByID(ctx context.Context, id uint64) (*AuthSource, error) {
+	if id == 0 {
+		return nil, errors.New(errAuthSourceIDRequired)
+	}
+	var source AuthSource
+	if err := db.DB(ctx).First(&source, "id = ?", id).Error; err != nil {
+		return nil, err
+	}
+	source.ClientSecretConfigured = source.ClientSecret != ""
+	return &source, nil
+}
+
+// GetAuthSourceByName 根据名称获取认证源（名称比较不区分大小写）
+func GetAuthSourceByName(ctx context.Context, name string) (*AuthSource, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return nil, errors.New(errAuthSourceNameRequired)
+	}
+	var source AuthSource
+	if err := db.DB(ctx).First(&source, "LOWER(name) = LOWER(?)", name).Error; err != nil {
+		return nil, err
+	}
+	source.ClientSecretConfigured = source.ClientSecret != ""
+	return &source, nil
+}
+
+// CreateAuthSource 创建认证源
+func CreateAuthSource(ctx context.Context, source *AuthSource) error {
+	if err := source.Validate(); err != nil {
+		return err
+	}
+	return db.DB(ctx).Create(source).Error
+}
+
+// UpdateAuthSource 更新认证源，keepSecret 为 true 时保留原密钥
+func UpdateAuthSource(ctx context.Context, source *AuthSource, keepSecret bool) error {
+	if source.ID == 0 {
+		return errors.New(errAuthSourceIDRequired)
+	}
+	var current AuthSource
+	if err := db.DB(ctx).First(&current, "id = ?", source.ID).Error; err != nil {
+		return err
+	}
+	if keepSecret {
+		source.ClientSecret = current.ClientSecret
+	}
+	if err := source.Validate(); err != nil {
+		return err
+	}
+	return db.DB(ctx).Model(&current).Updates(map[string]any{
+		"name":                 source.Name,
+		"type":                 source.Type,
+		"display_name":         source.DisplayName,
+		"is_active":            source.IsActive,
+		"client_id":            source.ClientID,
+		"client_secret":        source.ClientSecret,
+		"openid_discovery_url": source.OpenIDDiscoveryURL,
+		"scopes":               source.Scopes,
+		"icon_url":             source.IconURL,
+	}).Error
+}
+
+// ToggleAuthSource 切换认证源启用状态
+func ToggleAuthSource(ctx context.Context, id uint64, isActive bool) error {
+	source, err := GetAuthSourceByID(ctx, id)
+	if err != nil {
+		return err
+	}
+	source.IsActive = isActive
+	if err := source.Validate(); err != nil {
+		return err
+	}
+	return db.DB(ctx).Model(&AuthSource{}).Where("id = ?", id).Update("is_active", isActive).Error
+}
+
+// DeleteAuthSource 删除认证源及其关联的外部帐号绑定
+func DeleteAuthSource(ctx context.Context, id uint64) error {
+	if id == 0 {
+		return errors.New(errAuthSourceIDRequired)
+	}
+	return db.DB(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("auth_source_id = ?", id).Delete(&ExternalAccount{}).Error; err != nil {
+			return err
+		}
+		return tx.Delete(&AuthSource{}, "id = ?", id).Error
+	})
+}
+
+// FindExternalAccount 查找外部帐号绑定记录
+func FindExternalAccount(ctx context.Context, sourceID uint64, externalID string) (*ExternalAccount, error) {
+	var account ExternalAccount
+	if err := db.DB(ctx).Where("auth_source_id = ? AND external_id = ?", sourceID, externalID).First(&account).Error; err != nil {
+		return nil, err
+	}
+	return &account, nil
+}
+
+// BindExternalAccount 绑定外部帐号（已存在时更新用户名和邮箱）
+func BindExternalAccount(ctx context.Context, account *ExternalAccount) error {
+	if account.UserID == 0 || strings.TrimSpace(account.ExternalID) == "" {
+		return errors.New(errExternalAccountBindingIncomplete)
+	}
+	account.ExternalID = strings.TrimSpace(account.ExternalID)
+	account.ExternalUsername = strings.TrimSpace(account.ExternalUsername)
+	account.Email = strings.TrimSpace(account.Email)
+
+	return db.DB(ctx).Transaction(func(tx *gorm.DB) error {
+		var current ExternalAccount
+		err := tx.Where("auth_source_id = ? AND external_id = ?", account.AuthSourceID, account.ExternalID).First(&current).Error
+		if err == nil {
+			if current.UserID != account.UserID {
+				return errors.New(errExternalAccountAlreadyBoundToAnother)
+			}
+			return tx.Model(&current).Updates(map[string]any{
+				"external_username": account.ExternalUsername,
+				"email":             account.Email,
+			}).Error
+		}
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			return err
+		}
+		return tx.Create(account).Error
+	})
+}
+
+// ListExternalAccountsByUserID 获取指定用户的所有外部帐号绑定视图
+func ListExternalAccountsByUserID(ctx context.Context, userID uint64) ([]ExternalAccountView, error) {
+	if userID == 0 {
+		return nil, errors.New(errUserIDRequired)
+	}
+	var accounts []ExternalAccount
+	if err := db.DB(ctx).Where("user_id = ?", userID).Order("id asc").Find(&accounts).Error; err != nil {
+		return nil, err
+	}
+	views := make([]ExternalAccountView, 0, len(accounts))
+	for _, account := range accounts {
+		var name, sourceType, label string
+		if account.AuthSourceID == 0 {
+			name = "default"
+			sourceType = "oidc"
+			label = "历史认证源"
+		} else {
+			source, err := GetAuthSourceByID(ctx, account.AuthSourceID)
+			if err != nil {
+				continue
+			}
+			name = source.Name
+			sourceType = source.Type
+			label = source.DisplayName
+			if label == "" {
+				label = source.Name
+			}
+		}
+		views = append(views, ExternalAccountView{
+			ID:               account.ID,
+			AuthSourceID:     account.AuthSourceID,
+			AuthSourceName:   name,
+			AuthSourceType:   sourceType,
+			AuthSourceLabel:  label,
+			ExternalUsername: account.ExternalUsername,
+			Email:            account.Email,
+			CreatedAt:        account.CreatedAt,
+		})
+	}
+	return views, nil
+}
+
+// DeleteExternalAccountForUser 删除指定用户的外部帐号绑定
+func DeleteExternalAccountForUser(ctx context.Context, id uint64, userID uint64) error {
+	if id == 0 || userID == 0 {
+		return errors.New(errExternalAccountBindingIDRequired)
+	}
+	return db.DB(ctx).Where("id = ? AND user_id = ?", id, userID).Delete(&ExternalAccount{}).Error
+}

internal/model/errs.go

@@ -0,0 +1,31 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+const (
+	errRegistrationDisabled                 = "注册已关闭"
+	errDatabaseNotInitialized               = "database not initialized"
+	errClickHouseNotInitialized             = "clickhouse not initialized"
+	errUsernameExists                       = "用户名已存在"
+	errEmailAlreadyBound                    = "该邮箱已被其他账号绑定"
+	errConfigIntParseFailed                 = "配置 %s 的值 '%s' 无法转换为整数: %w"
+	errConfigDecimalParseFailed             = "配置 %s 的值 '%s' 无法转换为decimal: %w"
+	errConfigBoolParseFailed                = "配置 %s 的值 '%s' 无法转换为布尔值: %w"
+	errParseMenuDisplayConfigFailed         = "解析目录显示配置失败: %w"
+	errTemplateKeyRequired                  = "模板标识符不能为空"
+	errTemplateNameRequired                 = "模板名称不能为空"
+	errTemplateContentRequired              = "模板内容不能为空"
+	errTemplateUnavailable                  = "模板 %s 不存在或不可用: %w"
+	errTemplateRenderFailed                 = "模板 %s 渲染失败: %w"
+	errAuthSourceNameRequired               = "认证源名称不能为空"
+	errAuthSourceNameInvalid                = "认证源名称只能包含字母、数字、短横线或下划线，且必须以字母或数字开头"
+	errAuthSourceTypeUnsupported            = "认证源类型仅支持 oidc"
+	errAuthSourceDiscoveryURLRequired       = "OIDC 认证源必须配置 Discovery URL"
+	errAuthSourceClientCredentialsRequired  = "启用认证源前必须配置 Client ID 和 Client Secret" //nolint:gosec // false positive: this is an error message, not hardcoded credentials
+	errAuthSourceIDRequired                 = "认证源 ID 不能为空"
+	errExternalAccountBindingIncomplete     = "外部账号绑定信息不完整"
+	errExternalAccountAlreadyBoundToAnother = "该外部账号已绑定到其他用户"
+	errUserIDRequired                       = "用户 ID 不能为空"
+	errExternalAccountBindingIDRequired     = "绑定记录 ID 不能为空"
+)

internal/model/openflare_access_log.go

@@ -0,0 +1,470 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"sort"
+	"strings"
+	"time"
+)
+
+type openFlareAccessLogBucketAggregateRow struct {
+	BucketEpoch      int64 `gorm:"column:bucket_epoch"`
+	RequestCount     int64 `gorm:"column:request_count"`
+	SuccessCount     int64 `gorm:"column:success_count"`
+	ClientErrorCount int64 `gorm:"column:client_error_count"`
+	ServerErrorCount int64 `gorm:"column:server_error_count"`
+}
+
+type openFlareAccessLogBucketDimensionRow struct {
+	BucketEpoch int64  `gorm:"column:bucket_epoch"`
+	Value       string `gorm:"column:value"`
+}
+
+type openFlareAccessLogIPAggregateRow struct {
+	RemoteAddr       string `gorm:"column:remote_addr"`
+	RequestCount     int64  `gorm:"column:request_count"`
+	SuccessCount     int64  `gorm:"column:success_count"`
+	ClientErrorCount int64  `gorm:"column:client_error_count"`
+	ServerErrorCount int64  `gorm:"column:server_error_count"`
+	LastSeenEpoch    int64  `gorm:"column:last_seen_epoch"`
+}
+
+type openFlareAccessLogIPSummaryRow struct {
+	RemoteAddr     string `gorm:"column:remote_addr"`
+	TotalRequests  int64  `gorm:"column:total_requests"`
+	RecentRequests int64  `gorm:"column:recent_requests"`
+	LastSeenEpoch  int64  `gorm:"column:last_seen_epoch"`
+}
+
+type openFlareAccessLogIPTrendRow struct {
+	BucketEpoch  int64 `gorm:"column:bucket_epoch"`
+	RequestCount int64 `gorm:"column:request_count"`
+}
+
+// ListOpenFlareAccessLogsForWAFIPGroup lists access logs in a time window for automatic IP group rules.
+func ListOpenFlareAccessLogsForWAFIPGroup(ctx context.Context, query OpenFlareAccessLogQuery) ([]*OpenFlareAccessLog, error) {
+	return ListOpenFlareAccessLogs(ctx, query)
+}
+
+// InsertOpenFlareAccessLogsBatch inserts access log rows into ClickHouse.
+func InsertOpenFlareAccessLogsBatch(ctx context.Context, records []*OpenFlareAccessLog) error {
+	return currentAccessLogStore().InsertBatch(ctx, records)
+}
+
+// ListOpenFlareAccessLogs lists access logs matching the query.
+func ListOpenFlareAccessLogs(ctx context.Context, query OpenFlareAccessLogQuery) ([]*OpenFlareAccessLog, error) {
+	return currentAccessLogStore().List(ctx, query)
+}
+
+// CountOpenFlareAccessLogs counts access logs and distinct IPs matching the query.
+func CountOpenFlareAccessLogs(ctx context.Context, query OpenFlareAccessLogQuery) (int64, int64, error) {
+	return currentAccessLogStore().Count(ctx, query)
+}
+
+// ListOpenFlareAccessLogRegionCounts returns region counts for access logs.
+func ListOpenFlareAccessLogRegionCounts(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareAccessLogRegionCount, error) {
+	return currentAccessLogStore().RegionCounts(ctx, nodeID, since, limit)
+}
+
+// ListOpenFlareAccessLogBuckets lists folded access log buckets.
+func ListOpenFlareAccessLogBuckets(ctx context.Context, query OpenFlareAccessLogBucketQuery) ([]*OpenFlareAccessLogBucketRow, error) {
+	rows, err := buildOpenFlareAccessLogBucketRows(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+	start, end := openFlareAccessLogPaginateBounds(len(rows), query.Page, query.PageSize)
+	if start >= len(rows) {
+		return []*OpenFlareAccessLogBucketRow{}, nil
+	}
+	return rows[start:end], nil
+}
+
+// CountOpenFlareAccessLogBuckets counts folded access log buckets.
+func CountOpenFlareAccessLogBuckets(ctx context.Context, query OpenFlareAccessLogBucketQuery) (int64, error) {
+	rows, err := buildOpenFlareAccessLogBucketRows(ctx, query)
+	if err != nil {
+		return 0, err
+	}
+	return int64(len(rows)), nil
+}
+
+// ListOpenFlareAccessLogBucketIPs lists folded IP rows for a bucket window.
+func ListOpenFlareAccessLogBucketIPs(ctx context.Context, query OpenFlareAccessLogBucketIPQuery) ([]*OpenFlareAccessLogBucketIPRow, error) {
+	rows, err := buildOpenFlareAccessLogBucketIPRows(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+	start, end := openFlareAccessLogPaginateBounds(len(rows), query.Page, query.PageSize)
+	if start >= len(rows) {
+		return []*OpenFlareAccessLogBucketIPRow{}, nil
+	}
+	return rows[start:end], nil
+}
+
+// CountOpenFlareAccessLogBucketIPs counts folded IP rows for a bucket window.
+func CountOpenFlareAccessLogBucketIPs(ctx context.Context, query OpenFlareAccessLogBucketIPQuery) (int64, error) {
+	rows, err := buildOpenFlareAccessLogBucketIPRows(ctx, query)
+	if err != nil {
+		return 0, err
+	}
+	return int64(len(rows)), nil
+}
+
+// ListOpenFlareAccessLogIPSummaries lists IP summaries.
+func ListOpenFlareAccessLogIPSummaries(ctx context.Context, query OpenFlareAccessLogIPSummaryQuery, recentSince time.Time) ([]*OpenFlareAccessLogIPSummaryRow, error) {
+	rows, err := buildOpenFlareAccessLogIPSummaryRows(ctx, query, recentSince)
+	if err != nil {
+		return nil, err
+	}
+	start, end := openFlareAccessLogPaginateBounds(len(rows), query.Page, query.PageSize)
+	if start >= len(rows) {
+		return []*OpenFlareAccessLogIPSummaryRow{}, nil
+	}
+	return rows[start:end], nil
+}
+
+// CountOpenFlareAccessLogIPSummaries counts IP summaries.
+func CountOpenFlareAccessLogIPSummaries(ctx context.Context, query OpenFlareAccessLogIPSummaryQuery) (int64, error) {
+	rows, err := buildOpenFlareAccessLogIPSummaryRows(ctx, query, time.Time{})
+	if err != nil {
+		return 0, err
+	}
+	return int64(len(rows)), nil
+}
+
+// ListOpenFlareAccessLogIPTrend lists IP trend points.
+func ListOpenFlareAccessLogIPTrend(ctx context.Context, query OpenFlareAccessLogIPTrendQuery) ([]*OpenFlareAccessLogIPTrendRow, error) {
+	remoteAddr := strings.TrimSpace(query.RemoteAddr)
+	if remoteAddr == "" {
+		return []*OpenFlareAccessLogIPTrendRow{}, nil
+	}
+	filter := OpenFlareAccessLogQuery{
+		NodeID:     query.NodeID,
+		RemoteAddr: remoteAddr,
+		Host:       query.Host,
+		Since:      query.Since,
+	}
+	bucketSeconds := int64(query.BucketMinutes * 60)
+	if bucketSeconds <= 0 {
+		bucketSeconds = 1800
+	}
+	rows, err := currentAccessLogStore().IPTrend(ctx, filter, bucketSeconds)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]*OpenFlareAccessLogIPTrendRow, len(rows))
+	for index, row := range rows {
+		result[index] = &OpenFlareAccessLogIPTrendRow{
+			BucketEpoch:  row.BucketEpoch,
+			RequestCount: row.RequestCount,
+		}
+	}
+	return result, nil
+}
+
+// DeleteAllOpenFlareAccessLogs deletes all access logs.
+func DeleteAllOpenFlareAccessLogs(ctx context.Context) (int64, error) {
+	return currentAccessLogStore().DeleteAll(ctx)
+}
+
+// DeleteOpenFlareAccessLogsBefore deletes access logs older than cutoff.
+func DeleteOpenFlareAccessLogsBefore(ctx context.Context, cutoff time.Time) (int64, error) {
+	return currentAccessLogStore().DeleteBefore(ctx, cutoff)
+}
+
+// DeleteOpenFlareAccessLogsByNodeBefore deletes access logs for a node older than cutoff.
+func DeleteOpenFlareAccessLogsByNodeBefore(ctx context.Context, nodeID string, cutoff time.Time) (int64, error) {
+	return currentAccessLogStore().DeleteByNodeBefore(ctx, nodeID, cutoff)
+}
+
+func buildOpenFlareAccessLogBucketRows(ctx context.Context, query OpenFlareAccessLogBucketQuery) ([]*OpenFlareAccessLogBucketRow, error) {
+	filter := openFlareAccessLogQueryFromBucket(query)
+	bucketSeconds := int64(query.FoldMinutes * 60)
+	if bucketSeconds <= 0 {
+		bucketSeconds = 180
+	}
+
+	type bucketAccumulator struct {
+		requestCount     int64
+		uniqueIPs        map[string]struct{}
+		uniqueHosts      map[string]struct{}
+		successCount     int64
+		clientErrorCount int64
+		serverErrorCount int64
+	}
+	accumulators := make(map[int64]*bucketAccumulator)
+
+	partials, err := currentAccessLogStore().BucketAggregates(ctx, filter, bucketSeconds)
+	if err != nil {
+		return nil, err
+	}
+	for _, partial := range partials {
+		accumulator := accumulators[partial.BucketEpoch]
+		if accumulator == nil {
+			accumulator = &bucketAccumulator{
+				uniqueIPs:   make(map[string]struct{}),
+				uniqueHosts: make(map[string]struct{}),
+			}
+			accumulators[partial.BucketEpoch] = accumulator
+		}
+		accumulator.requestCount += partial.RequestCount
+		accumulator.successCount += partial.SuccessCount
+		accumulator.clientErrorCount += partial.ClientErrorCount
+		accumulator.serverErrorCount += partial.ServerErrorCount
+	}
+
+	for _, column := range []string{"remote_addr", "host"} {
+		dimensions, err := currentAccessLogStore().BucketDimensions(ctx, filter, column, bucketSeconds)
+		if err != nil {
+			return nil, err
+		}
+		for _, item := range dimensions {
+			accumulator := accumulators[item.BucketEpoch]
+			if accumulator == nil {
+				accumulator = &bucketAccumulator{
+					uniqueIPs:   make(map[string]struct{}),
+					uniqueHosts: make(map[string]struct{}),
+				}
+				accumulators[item.BucketEpoch] = accumulator
+			}
+			trimmed := strings.TrimSpace(item.Value)
+			if trimmed == "" {
+				continue
+			}
+			switch column {
+			case "remote_addr":
+				accumulator.uniqueIPs[trimmed] = struct{}{}
+			case "host":
+				accumulator.uniqueHosts[trimmed] = struct{}{}
+			}
+		}
+	}
+
+	rows := make([]*OpenFlareAccessLogBucketRow, 0, len(accumulators))
+	for bucketEpoch, accumulator := range accumulators {
+		rows = append(rows, &OpenFlareAccessLogBucketRow{
+			BucketEpoch:      bucketEpoch,
+			RequestCount:     accumulator.requestCount,
+			UniqueIPCount:    int64(len(accumulator.uniqueIPs)),
+			UniqueHostCount:  int64(len(accumulator.uniqueHosts)),
+			SuccessCount:     accumulator.successCount,
+			ClientErrorCount: accumulator.clientErrorCount,
+			ServerErrorCount: accumulator.serverErrorCount,
+		})
+	}
+	sortOpenFlareAccessLogBucketRows(rows, query.SortBy, query.SortOrder)
+	return rows, nil
+}
+
+func buildOpenFlareAccessLogBucketIPRows(ctx context.Context, query OpenFlareAccessLogBucketIPQuery) ([]*OpenFlareAccessLogBucketIPRow, error) {
+	if query.BucketStartedAt.IsZero() {
+		return []*OpenFlareAccessLogBucketIPRow{}, nil
+	}
+	foldMinutes := query.FoldMinutes
+	if foldMinutes <= 0 {
+		foldMinutes = 3
+	}
+	bucketStartedAt := query.BucketStartedAt.UTC()
+	filter := OpenFlareAccessLogQuery{
+		NodeID:     query.NodeID,
+		RemoteAddr: query.RemoteAddr,
+		Host:       query.Host,
+		Path:       query.Path,
+		Since:      bucketStartedAt,
+		Until:      bucketStartedAt.Add(time.Duration(foldMinutes) * time.Minute),
+	}
+	rows, err := queryOpenFlareAccessLogIPAggregateRows(ctx, filter, false)
+	if err != nil {
+		return nil, err
+	}
+	sortOpenFlareAccessLogBucketIPRows(rows, query.SortBy, query.SortOrder)
+	return rows, nil
+}
+
+func buildOpenFlareAccessLogIPSummaryRows(ctx context.Context, query OpenFlareAccessLogIPSummaryQuery, recentSince time.Time) ([]*OpenFlareAccessLogIPSummaryRow, error) {
+	filter := OpenFlareAccessLogQuery{
+		NodeID:     query.NodeID,
+		RemoteAddr: query.RemoteAddr,
+		Host:       query.Host,
+		Since:      query.Since,
+	}
+	partials, err := currentAccessLogStore().IPSummaries(ctx, filter, recentSince)
+	if err != nil {
+		return nil, err
+	}
+	rows := make([]*OpenFlareAccessLogIPSummaryRow, 0, len(partials))
+	for _, partial := range partials {
+		remoteAddr := strings.TrimSpace(partial.RemoteAddr)
+		if remoteAddr == "" {
+			continue
+		}
+		rows = append(rows, &OpenFlareAccessLogIPSummaryRow{
+			RemoteAddr:     remoteAddr,
+			TotalRequests:  partial.TotalRequests,
+			RecentRequests: partial.RecentRequests,
+			LastSeenEpoch:  partial.LastSeenEpoch,
+		})
+	}
+	sortOpenFlareAccessLogIPSummaryRows(rows, query.SortBy, query.SortOrder)
+	return rows, nil
+}
+
+func queryOpenFlareAccessLogIPAggregateRows(ctx context.Context, filter OpenFlareAccessLogQuery, exactRemoteAddr bool) ([]*OpenFlareAccessLogBucketIPRow, error) {
+	partials, err := currentAccessLogStore().IPAggregates(ctx, filter, exactRemoteAddr)
+	if err != nil {
+		return nil, err
+	}
+	rows := make([]*OpenFlareAccessLogBucketIPRow, 0, len(partials))
+	for _, partial := range partials {
+		remoteAddr := strings.TrimSpace(partial.RemoteAddr)
+		if remoteAddr == "" {
+			continue
+		}
+		rows = append(rows, &OpenFlareAccessLogBucketIPRow{
+			RemoteAddr:       remoteAddr,
+			RequestCount:     partial.RequestCount,
+			SuccessCount:     partial.SuccessCount,
+			ClientErrorCount: partial.ClientErrorCount,
+			ServerErrorCount: partial.ServerErrorCount,
+			LastSeenEpoch:    partial.LastSeenEpoch,
+		})
+	}
+	return rows, nil
+}
+
+func openFlareAccessLogQueryFromBucket(query OpenFlareAccessLogBucketQuery) OpenFlareAccessLogQuery {
+	return OpenFlareAccessLogQuery{
+		NodeID:     query.NodeID,
+		RemoteAddr: query.RemoteAddr,
+		Host:       query.Host,
+		Path:       query.Path,
+		Since:      query.Since,
+	}
+}
+
+func sortOpenFlareAccessLogBucketIPRows(items []*OpenFlareAccessLogBucketIPRow, sortBy string, sortOrder string) {
+	desc := openFlareAccessLogNormalizeSortOrder(sortOrder) != "asc"
+	sort.Slice(items, func(i, j int) bool {
+		left := items[i]
+		right := items[j]
+		if left == nil || right == nil {
+			return left != nil
+		}
+		var compare int
+		switch strings.TrimSpace(sortBy) {
+		case "last_seen_at":
+			compare = openFlareAccessLogCompareInt64(left.LastSeenEpoch, right.LastSeenEpoch)
+		case "remote_addr":
+			compare = strings.Compare(left.RemoteAddr, right.RemoteAddr)
+		default:
+			compare = openFlareAccessLogCompareInt64(left.RequestCount, right.RequestCount)
+		}
+		if compare == 0 {
+			compare = openFlareAccessLogCompareInt64(left.LastSeenEpoch, right.LastSeenEpoch)
+		}
+		if compare == 0 {
+			compare = strings.Compare(left.RemoteAddr, right.RemoteAddr)
+		}
+		if desc {
+			return compare > 0
+		}
+		return compare < 0
+	})
+}
+
+func sortOpenFlareAccessLogBucketRows(items []*OpenFlareAccessLogBucketRow, sortBy string, sortOrder string) {
+	desc := openFlareAccessLogNormalizeSortOrder(sortOrder) != "asc"
+	sort.Slice(items, func(i, j int) bool {
+		left := items[i]
+		right := items[j]
+		if left == nil || right == nil {
+			return left != nil
+		}
+		var compare int
+		switch strings.TrimSpace(sortBy) {
+		case "request_count":
+			compare = openFlareAccessLogCompareInt64(left.RequestCount, right.RequestCount)
+		default:
+			compare = openFlareAccessLogCompareInt64(left.BucketEpoch, right.BucketEpoch)
+		}
+		if compare == 0 {
+			compare = openFlareAccessLogCompareInt64(left.BucketEpoch, right.BucketEpoch)
+		}
+		if desc {
+			return compare > 0
+		}
+		return compare < 0
+	})
+}
+
+func sortOpenFlareAccessLogIPSummaryRows(items []*OpenFlareAccessLogIPSummaryRow, sortBy string, sortOrder string) {
+	desc := openFlareAccessLogNormalizeSortOrder(sortOrder) != "asc"
+	sort.Slice(items, func(i, j int) bool {
+		left := items[i]
+		right := items[j]
+		if left == nil || right == nil {
+			return left != nil
+		}
+		var compare int
+		switch strings.TrimSpace(sortBy) {
+		case "recent_requests":
+			compare = openFlareAccessLogCompareInt64(left.RecentRequests, right.RecentRequests)
+		case "last_seen_at":
+			compare = openFlareAccessLogCompareInt64(left.LastSeenEpoch, right.LastSeenEpoch)
+		case "remote_addr":
+			compare = strings.Compare(left.RemoteAddr, right.RemoteAddr)
+		default:
+			compare = openFlareAccessLogCompareInt64(left.TotalRequests, right.TotalRequests)
+		}
+		if compare == 0 {
+			compare = openFlareAccessLogCompareInt64(left.LastSeenEpoch, right.LastSeenEpoch)
+		}
+		if compare == 0 {
+			compare = strings.Compare(left.RemoteAddr, right.RemoteAddr)
+		}
+		if desc {
+			return compare > 0
+		}
+		return compare < 0
+	})
+}
+
+func openFlareAccessLogPaginateBounds(total int, page int, pageSize int) (int, int) {
+	if page < 0 {
+		page = 0
+	}
+	if pageSize <= 0 {
+		return 0, total
+	}
+	start := page * pageSize
+	if start > total {
+		start = total
+	}
+	end := start + pageSize
+	if end > total {
+		end = total
+	}
+	return start, end
+}
+
+func openFlareAccessLogNormalizeSortOrder(sortOrder string) string {
+	if strings.EqualFold(strings.TrimSpace(sortOrder), "asc") {
+		return "asc"
+	}
+	return "desc"
+}
+
+func openFlareAccessLogCompareInt64(left int64, right int64) int {
+	switch {
+	case left > right:
+		return 1
+	case left < right:
+		return -1
+	default:
+		return 0
+	}
+}
+

internal/model/openflare_access_log_store.go

@@ -0,0 +1,245 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	analyticsmodel "github.com/Rain-kl/Wavelet/internal/model/analytics"
+	analyticsrepo "github.com/Rain-kl/Wavelet/internal/repository/analytics"
+)
+
+type accessLogStore interface {
+	InsertBatch(ctx context.Context, records []*OpenFlareAccessLog) error
+	List(ctx context.Context, query OpenFlareAccessLogQuery) ([]*OpenFlareAccessLog, error)
+	Count(ctx context.Context, query OpenFlareAccessLogQuery) (int64, int64, error)
+	RegionCounts(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareAccessLogRegionCount, error)
+	BucketAggregates(ctx context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogBucketAggregateRow, error)
+	BucketDimensions(ctx context.Context, filter OpenFlareAccessLogQuery, column string, bucketSeconds int64) ([]openFlareAccessLogBucketDimensionRow, error)
+	IPAggregates(ctx context.Context, filter OpenFlareAccessLogQuery, exactRemoteAddr bool) ([]openFlareAccessLogIPAggregateRow, error)
+	IPSummaries(ctx context.Context, filter OpenFlareAccessLogQuery, recentSince time.Time) ([]openFlareAccessLogIPSummaryRow, error)
+	IPTrend(ctx context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogIPTrendRow, error)
+	DeleteAll(ctx context.Context) (int64, error)
+	DeleteBefore(ctx context.Context, cutoff time.Time) (int64, error)
+	DeleteByNodeBefore(ctx context.Context, nodeID string, before time.Time) (int64, error)
+}
+
+var (
+	accessLogStoreMu     sync.RWMutex
+	accessLogStoreHolder accessLogStore
+)
+
+func currentAccessLogStore() accessLogStore {
+	accessLogStoreMu.RLock()
+	defer accessLogStoreMu.RUnlock()
+	if accessLogStoreHolder != nil {
+		return accessLogStoreHolder
+	}
+	return clickhouseAccessLogStore{}
+}
+
+// SetAccessLogStoreForTest swaps the access log store implementation for unit tests.
+func SetAccessLogStoreForTest(store accessLogStore) func() {
+	accessLogStoreMu.Lock()
+	previous := accessLogStoreHolder
+	accessLogStoreHolder = store
+	accessLogStoreMu.Unlock()
+	return func() {
+		accessLogStoreMu.Lock()
+		accessLogStoreHolder = previous
+		accessLogStoreMu.Unlock()
+	}
+}
+
+// NewMemoryAccessLogStore returns an in-memory access log store for unit tests.
+func NewMemoryAccessLogStore() accessLogStore {
+	return &memoryAccessLogStore{
+		records: make([]*OpenFlareAccessLog, 0),
+	}
+}
+
+type clickhouseAccessLogStore struct{}
+
+func (clickhouseAccessLogStore) InsertBatch(ctx context.Context, records []*OpenFlareAccessLog) error {
+	logs := make([]analyticsmodel.NodeAccessLog, 0, len(records))
+	for _, record := range records {
+		if record == nil {
+			continue
+		}
+		logs = append(logs, toAnalyticsNodeAccessLog(record))
+	}
+	return analyticsrepo.BatchInsertNodeAccessLogs(ctx, logs)
+}
+
+func (clickhouseAccessLogStore) List(ctx context.Context, query OpenFlareAccessLogQuery) ([]*OpenFlareAccessLog, error) {
+	rows, err := analyticsrepo.ListNodeAccessLogs(ctx, toNodeAccessLogFilter(query))
+	if err != nil {
+		return nil, err
+	}
+	return fromAnalyticsNodeAccessLogs(rows), nil
+}
+
+func (clickhouseAccessLogStore) Count(ctx context.Context, query OpenFlareAccessLogQuery) (int64, int64, error) {
+	return analyticsrepo.CountNodeAccessLogs(ctx, toNodeAccessLogFilter(query))
+}
+
+func (clickhouseAccessLogStore) RegionCounts(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareAccessLogRegionCount, error) {
+	rows, err := analyticsrepo.RegionCountsNodeAccessLogs(ctx, nodeID, since, limit)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]*OpenFlareAccessLogRegionCount, len(rows))
+	for index, row := range rows {
+		result[index] = &OpenFlareAccessLogRegionCount{
+			Region: row.Region,
+			Count:  row.Count,
+		}
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) BucketAggregates(ctx context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogBucketAggregateRow, error) {
+	rows, err := analyticsrepo.BucketAggregatesNodeAccessLogs(ctx, toNodeAccessLogFilter(filter), bucketSeconds)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]openFlareAccessLogBucketAggregateRow, len(rows))
+	for index, row := range rows {
+		result[index] = openFlareAccessLogBucketAggregateRow{
+			BucketEpoch:      row.BucketEpoch,
+			RequestCount:     row.RequestCount,
+			SuccessCount:     row.SuccessCount,
+			ClientErrorCount: row.ClientErrorCount,
+			ServerErrorCount: row.ServerErrorCount,
+		}
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) BucketDimensions(ctx context.Context, filter OpenFlareAccessLogQuery, column string, bucketSeconds int64) ([]openFlareAccessLogBucketDimensionRow, error) {
+	rows, err := analyticsrepo.BucketDimensionsNodeAccessLogs(ctx, toNodeAccessLogFilter(filter), column, bucketSeconds)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]openFlareAccessLogBucketDimensionRow, len(rows))
+	for index, row := range rows {
+		result[index] = openFlareAccessLogBucketDimensionRow{
+			BucketEpoch: row.BucketEpoch,
+			Value:       row.Value,
+		}
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) IPAggregates(ctx context.Context, filter OpenFlareAccessLogQuery, exactRemoteAddr bool) ([]openFlareAccessLogIPAggregateRow, error) {
+	rows, err := analyticsrepo.IPAggregatesNodeAccessLogs(ctx, toNodeAccessLogFilter(filter), exactRemoteAddr)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]openFlareAccessLogIPAggregateRow, len(rows))
+	for index, row := range rows {
+		result[index] = openFlareAccessLogIPAggregateRow{
+			RemoteAddr:       row.RemoteAddr,
+			RequestCount:     row.RequestCount,
+			SuccessCount:     row.SuccessCount,
+			ClientErrorCount: row.ClientErrorCount,
+			ServerErrorCount: row.ServerErrorCount,
+			LastSeenEpoch:    row.LastSeenEpoch,
+		}
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) IPSummaries(ctx context.Context, filter OpenFlareAccessLogQuery, recentSince time.Time) ([]openFlareAccessLogIPSummaryRow, error) {
+	rows, err := analyticsrepo.IPSummariesNodeAccessLogs(ctx, toNodeAccessLogFilter(filter), recentSince)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]openFlareAccessLogIPSummaryRow, len(rows))
+	for index, row := range rows {
+		result[index] = openFlareAccessLogIPSummaryRow{
+			RemoteAddr:     row.RemoteAddr,
+			TotalRequests:  row.TotalRequests,
+			RecentRequests: row.RecentRequests,
+			LastSeenEpoch:  row.LastSeenEpoch,
+		}
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) IPTrend(ctx context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogIPTrendRow, error) {
+	rows, err := analyticsrepo.IPTrendNodeAccessLogs(ctx, toNodeAccessLogFilter(filter), bucketSeconds)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]openFlareAccessLogIPTrendRow, len(rows))
+	for index, row := range rows {
+		result[index] = openFlareAccessLogIPTrendRow{
+			BucketEpoch:  row.BucketEpoch,
+			RequestCount: row.RequestCount,
+		}
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) DeleteAll(ctx context.Context) (int64, error) {
+	return analyticsrepo.DeleteAllNodeAccessLogs(ctx)
+}
+
+func (clickhouseAccessLogStore) DeleteBefore(ctx context.Context, cutoff time.Time) (int64, error) {
+	return analyticsrepo.DeleteNodeAccessLogsBefore(ctx, cutoff)
+}
+
+func (clickhouseAccessLogStore) DeleteByNodeBefore(ctx context.Context, nodeID string, before time.Time) (int64, error) {
+	return analyticsrepo.DeleteNodeAccessLogsByNodeBefore(ctx, nodeID, before)
+}
+
+func toNodeAccessLogFilter(query OpenFlareAccessLogQuery) analyticsrepo.NodeAccessLogFilter {
+	return analyticsrepo.NodeAccessLogFilter{
+		NodeID:     query.NodeID,
+		RemoteAddr: query.RemoteAddr,
+		Host:       query.Host,
+		Path:       query.Path,
+		Since:      query.Since,
+		Until:      query.Until,
+		Page:       query.Page,
+		PageSize:   query.PageSize,
+		SortBy:     query.SortBy,
+		SortOrder:  query.SortOrder,
+	}
+}
+
+func toAnalyticsNodeAccessLog(record *OpenFlareAccessLog) analyticsmodel.NodeAccessLog {
+	return analyticsmodel.NodeAccessLog{
+		ID:         uint64(record.ID),
+		NodeID:     record.NodeID,
+		LoggedAt:   record.LoggedAt,
+		RemoteAddr: record.RemoteAddr,
+		Region:     record.Region,
+		Host:       record.Host,
+		Path:       record.Path,
+		StatusCode: int32(record.StatusCode),
+		CreatedAt:  record.CreatedAt,
+	}
+}
+
+func fromAnalyticsNodeAccessLogs(rows []analyticsmodel.NodeAccessLog) []*OpenFlareAccessLog {
+	result := make([]*OpenFlareAccessLog, len(rows))
+	for index, row := range rows {
+		result[index] = &OpenFlareAccessLog{
+			ID:         uint(row.ID),
+			NodeID:     row.NodeID,
+			LoggedAt:   row.LoggedAt,
+			RemoteAddr: row.RemoteAddr,
+			Region:     row.Region,
+			Host:       row.Host,
+			Path:       row.Path,
+			StatusCode: int(row.StatusCode),
+			CreatedAt:  row.CreatedAt,
+		}
+	}
+	return result
+}

internal/model/openflare_access_log_store_memory.go

@@ -0,0 +1,379 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db/idgen"
+)
+
+type memoryAccessLogStore struct {
+	mu      sync.RWMutex
+	records []*OpenFlareAccessLog
+}
+
+func (s *memoryAccessLogStore) InsertBatch(_ context.Context, records []*OpenFlareAccessLog) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	now := time.Now().UTC()
+	for _, record := range records {
+		if record == nil {
+			continue
+		}
+		copyRecord := *record
+		if copyRecord.ID == 0 {
+			copyRecord.ID = uint(idgen.NextUint64ID())
+		}
+		if copyRecord.CreatedAt.IsZero() {
+			copyRecord.CreatedAt = now
+		}
+		copyRecord.LoggedAt = copyRecord.LoggedAt.UTC()
+		copyRecord.CreatedAt = copyRecord.CreatedAt.UTC()
+		s.records = append(s.records, &copyRecord)
+	}
+	return nil
+}
+
+func (s *memoryAccessLogStore) List(_ context.Context, query OpenFlareAccessLogQuery) ([]*OpenFlareAccessLog, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(query)
+	sortOpenFlareAccessLogRows(rows, query.SortBy, query.SortOrder)
+	if query.PageSize > 0 {
+		start, end := openFlareAccessLogPaginateBounds(len(rows), query.Page, query.PageSize)
+		return cloneAccessLogSlice(rows[start:end]), nil
+	}
+	return cloneAccessLogSlice(rows), nil
+}
+
+func (s *memoryAccessLogStore) Count(_ context.Context, query OpenFlareAccessLogQuery) (int64, int64, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(query)
+	ips := make(map[string]struct{})
+	for _, row := range rows {
+		remoteAddr := strings.TrimSpace(row.RemoteAddr)
+		if remoteAddr == "" {
+			continue
+		}
+		ips[remoteAddr] = struct{}{}
+	}
+	return int64(len(rows)), int64(len(ips)), nil
+}
+
+func (s *memoryAccessLogStore) RegionCounts(_ context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareAccessLogRegionCount, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(OpenFlareAccessLogQuery{NodeID: nodeID, Since: since})
+	counts := make(map[string]int64)
+	for _, row := range rows {
+		region := strings.TrimSpace(row.Region)
+		if region == "" {
+			continue
+		}
+		counts[region]++
+	}
+	result := make([]*OpenFlareAccessLogRegionCount, 0, len(counts))
+	for region, count := range counts {
+		result = append(result, &OpenFlareAccessLogRegionCount{Region: region, Count: count})
+	}
+	sort.Slice(result, func(i, j int) bool {
+		if result[i].Count == result[j].Count {
+			return result[i].Region < result[j].Region
+		}
+		return result[i].Count > result[j].Count
+	})
+	if limit > 0 && len(result) > limit {
+		result = result[:limit]
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) BucketAggregates(_ context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogBucketAggregateRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(filter)
+	aggregates := make(map[int64]*openFlareAccessLogBucketAggregateRow)
+	for _, row := range rows {
+		bucketEpoch := memoryAccessLogBucketEpoch(row.LoggedAt, bucketSeconds)
+		item := aggregates[bucketEpoch]
+		if item == nil {
+			item = &openFlareAccessLogBucketAggregateRow{BucketEpoch: bucketEpoch}
+			aggregates[bucketEpoch] = item
+		}
+		item.RequestCount++
+		switch {
+		case row.StatusCode < 400:
+			item.SuccessCount++
+		case row.StatusCode < 500:
+			item.ClientErrorCount++
+		default:
+			item.ServerErrorCount++
+		}
+	}
+	result := make([]openFlareAccessLogBucketAggregateRow, 0, len(aggregates))
+	for _, item := range aggregates {
+		result = append(result, *item)
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) BucketDimensions(_ context.Context, filter OpenFlareAccessLogQuery, column string, bucketSeconds int64) ([]openFlareAccessLogBucketDimensionRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(filter)
+	seen := make(map[int64]map[string]struct{})
+	var result []openFlareAccessLogBucketDimensionRow
+	for _, row := range rows {
+		var value string
+		switch column {
+		case "remote_addr":
+			value = strings.TrimSpace(row.RemoteAddr)
+		case "host":
+			value = strings.TrimSpace(row.Host)
+		default:
+			continue
+		}
+		if value == "" {
+			continue
+		}
+		bucketEpoch := memoryAccessLogBucketEpoch(row.LoggedAt, bucketSeconds)
+		if seen[bucketEpoch] == nil {
+			seen[bucketEpoch] = make(map[string]struct{})
+		}
+		if _, ok := seen[bucketEpoch][value]; ok {
+			continue
+		}
+		seen[bucketEpoch][value] = struct{}{}
+		result = append(result, openFlareAccessLogBucketDimensionRow{BucketEpoch: bucketEpoch, Value: value})
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) IPAggregates(_ context.Context, filter OpenFlareAccessLogQuery, exactRemoteAddr bool) ([]openFlareAccessLogIPAggregateRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if exactRemoteAddr && strings.TrimSpace(filter.RemoteAddr) == "" {
+		return []openFlareAccessLogIPAggregateRow{}, nil
+	}
+	rows := s.filterRecords(filter)
+	aggregates := make(map[string]*openFlareAccessLogIPAggregateRow)
+	for _, row := range rows {
+		remoteAddr := strings.TrimSpace(row.RemoteAddr)
+		if remoteAddr == "" {
+			continue
+		}
+		if exactRemoteAddr && remoteAddr != strings.TrimSpace(filter.RemoteAddr) {
+			continue
+		}
+		item := aggregates[remoteAddr]
+		if item == nil {
+			item = &openFlareAccessLogIPAggregateRow{RemoteAddr: remoteAddr}
+			aggregates[remoteAddr] = item
+		}
+		item.RequestCount++
+		epoch := row.LoggedAt.UTC().Unix()
+		if epoch > item.LastSeenEpoch {
+			item.LastSeenEpoch = epoch
+		}
+		switch {
+		case row.StatusCode < 400:
+			item.SuccessCount++
+		case row.StatusCode < 500:
+			item.ClientErrorCount++
+		default:
+			item.ServerErrorCount++
+		}
+	}
+	result := make([]openFlareAccessLogIPAggregateRow, 0, len(aggregates))
+	for _, item := range aggregates {
+		result = append(result, *item)
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) IPSummaries(_ context.Context, filter OpenFlareAccessLogQuery, recentSince time.Time) ([]openFlareAccessLogIPSummaryRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(filter)
+	aggregates := make(map[string]*openFlareAccessLogIPSummaryRow)
+	for _, row := range rows {
+		remoteAddr := strings.TrimSpace(row.RemoteAddr)
+		if remoteAddr == "" {
+			continue
+		}
+		item := aggregates[remoteAddr]
+		if item == nil {
+			item = &openFlareAccessLogIPSummaryRow{RemoteAddr: remoteAddr}
+			aggregates[remoteAddr] = item
+		}
+		item.TotalRequests++
+		if !recentSince.IsZero() && !row.LoggedAt.Before(recentSince) {
+			item.RecentRequests++
+		}
+		epoch := row.LoggedAt.UTC().Unix()
+		if epoch > item.LastSeenEpoch {
+			item.LastSeenEpoch = epoch
+		}
+	}
+	result := make([]openFlareAccessLogIPSummaryRow, 0, len(aggregates))
+	for _, item := range aggregates {
+		result = append(result, *item)
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) IPTrend(_ context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogIPTrendRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(filter)
+	aggregates := make(map[int64]int64)
+	for _, row := range rows {
+		bucketEpoch := memoryAccessLogBucketEpoch(row.LoggedAt, bucketSeconds)
+		aggregates[bucketEpoch]++
+	}
+	result := make([]openFlareAccessLogIPTrendRow, 0, len(aggregates))
+	for bucketEpoch, count := range aggregates {
+		result = append(result, openFlareAccessLogIPTrendRow{BucketEpoch: bucketEpoch, RequestCount: count})
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i].BucketEpoch < result[j].BucketEpoch })
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) DeleteAll(_ context.Context) (int64, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	count := int64(len(s.records))
+	s.records = nil
+	return count, nil
+}
+
+func (s *memoryAccessLogStore) DeleteBefore(_ context.Context, cutoff time.Time) (int64, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	cutoff = cutoff.UTC()
+	remaining := make([]*OpenFlareAccessLog, 0, len(s.records))
+	var deleted int64
+	for _, row := range s.records {
+		if row.LoggedAt.Before(cutoff) {
+			deleted++
+			continue
+		}
+		remaining = append(remaining, row)
+	}
+	s.records = remaining
+	return deleted, nil
+}
+
+func (s *memoryAccessLogStore) DeleteByNodeBefore(_ context.Context, nodeID string, before time.Time) (int64, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	before = before.UTC()
+	remaining := make([]*OpenFlareAccessLog, 0, len(s.records))
+	var deleted int64
+	for _, row := range s.records {
+		if row.NodeID == nodeID && row.LoggedAt.Before(before) {
+			deleted++
+			continue
+		}
+		remaining = append(remaining, row)
+	}
+	s.records = remaining
+	return deleted, nil
+}
+
+func (s *memoryAccessLogStore) filterRecords(query OpenFlareAccessLogQuery) []*OpenFlareAccessLog {
+	result := make([]*OpenFlareAccessLog, 0, len(s.records))
+	for _, row := range s.records {
+		if !memoryAccessLogMatches(row, query) {
+			continue
+		}
+		result = append(result, row)
+	}
+	return result
+}
+
+func memoryAccessLogMatches(row *OpenFlareAccessLog, query OpenFlareAccessLogQuery) bool {
+	if row == nil {
+		return false
+	}
+	if trimmed := strings.TrimSpace(query.NodeID); trimmed != "" && row.NodeID != trimmed {
+		return false
+	}
+	if trimmed := strings.TrimSpace(query.RemoteAddr); trimmed != "" && !strings.HasPrefix(strings.TrimSpace(row.RemoteAddr), trimmed) {
+		return false
+	}
+	if trimmed := strings.TrimSpace(query.Host); trimmed != "" && !strings.HasPrefix(strings.TrimSpace(row.Host), trimmed) {
+		return false
+	}
+	if trimmed := strings.TrimSpace(query.Path); trimmed != "" && !strings.HasPrefix(strings.TrimSpace(row.Path), trimmed) {
+		return false
+	}
+	if !query.Since.IsZero() && row.LoggedAt.Before(query.Since) {
+		return false
+	}
+	if !query.Until.IsZero() && !row.LoggedAt.Before(query.Until) {
+		return false
+	}
+	return true
+}
+
+func memoryAccessLogBucketEpoch(loggedAt time.Time, bucketSeconds int64) int64 {
+	if bucketSeconds <= 0 {
+		bucketSeconds = 180
+	}
+	epoch := loggedAt.UTC().Unix()
+	return (epoch / bucketSeconds) * bucketSeconds
+}
+
+func cloneAccessLogSlice(rows []*OpenFlareAccessLog) []*OpenFlareAccessLog {
+	result := make([]*OpenFlareAccessLog, len(rows))
+	for index, row := range rows {
+		if row == nil {
+			continue
+		}
+		copyRecord := *row
+		result[index] = &copyRecord
+	}
+	return result
+}
+
+func sortOpenFlareAccessLogRows(items []*OpenFlareAccessLog, sortBy string, sortOrder string) {
+	desc := openFlareAccessLogNormalizeSortOrder(sortOrder) != "asc"
+	sort.Slice(items, func(i, j int) bool {
+		left := items[i]
+		right := items[j]
+		if left == nil || right == nil {
+			return left != nil
+		}
+		var compare int
+		switch strings.TrimSpace(sortBy) {
+		case "status_code":
+			compare = left.StatusCode - right.StatusCode
+		case "remote_addr":
+			compare = strings.Compare(left.RemoteAddr, right.RemoteAddr)
+		case "host":
+			compare = strings.Compare(left.Host, right.Host)
+		case "path":
+			compare = strings.Compare(left.Path, right.Path)
+		default:
+			compare = openFlareAccessLogCompareInt64(left.LoggedAt.Unix(), right.LoggedAt.Unix())
+		}
+		if compare == 0 {
+			compare = openFlareAccessLogCompareInt64(left.LoggedAt.Unix(), right.LoggedAt.Unix())
+		}
+		if compare == 0 {
+			compare = openFlareAccessLogCompareInt64(int64(left.ID), int64(right.ID))
+		}
+		if desc {
+			return compare > 0
+		}
+		return compare < 0
+	})
+}

internal/model/openflare_access_log_test.go

@@ -0,0 +1,119 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupOpenFlareAccessLogTestEnvironment(t *testing.T) (context.Context, func()) {
+	t.Helper()
+	store := NewMemoryAccessLogStore()
+	reset := SetAccessLogStoreForTest(store)
+	return context.Background(), func() {
+		reset()
+	}
+}
+
+func seedOpenFlareAccessLogs(t *testing.T, ctx context.Context, now time.Time) {
+	t.Helper()
+	records := []*OpenFlareAccessLog{
+		{NodeID: "node-a", LoggedAt: now.Add(-5 * time.Minute), RemoteAddr: "1.1.1.1", Region: "US", Host: "a.example.com", Path: "/alpha", StatusCode: 200},
+		{NodeID: "node-a", LoggedAt: now.Add(-4 * time.Minute), RemoteAddr: "2.2.2.2", Region: "US", Host: "a.example.com", Path: "/beta", StatusCode: 404},
+		{NodeID: "node-b", LoggedAt: now.Add(-3 * time.Minute), RemoteAddr: "1.1.1.1", Region: "EU", Host: "b.example.com", Path: "/gamma", StatusCode: 502},
+		{NodeID: "node-b", LoggedAt: now.Add(-2 * time.Minute), RemoteAddr: "3.3.3.3", Region: "EU", Host: "b.example.com", Path: "/delta", StatusCode: 200},
+		{NodeID: "node-b", LoggedAt: now.Add(-1 * time.Minute), RemoteAddr: "", Region: "", Host: "b.example.com", Path: "/empty-ip", StatusCode: 200},
+	}
+	require.NoError(t, InsertOpenFlareAccessLogsBatch(ctx, records))
+}
+
+func TestListOpenFlareAccessLogsPaginated(t *testing.T) {
+	ctx, cleanup := setupOpenFlareAccessLogTestEnvironment(t)
+	defer cleanup()
+
+	now := time.Now().UTC()
+	for index := range 15 {
+		record := &OpenFlareAccessLog{
+			NodeID:     "node-page",
+			LoggedAt:   now.Add(-time.Duration(index) * time.Minute),
+			RemoteAddr: fmt.Sprintf("203.0.113.%d", (index%5)+1),
+			Host:       "example.com",
+			Path:       fmt.Sprintf("/path-%02d", index),
+			StatusCode: 200,
+		}
+		require.NoError(t, InsertOpenFlareAccessLogsBatch(ctx, []*OpenFlareAccessLog{record}))
+	}
+
+	query := OpenFlareAccessLogQuery{
+		NodeID:    "node-page",
+		Since:     now.Add(-24 * time.Hour),
+		Page:      1,
+		PageSize:  5,
+		SortBy:    "logged_at",
+		SortOrder: "desc",
+	}
+	page, err := ListOpenFlareAccessLogs(ctx, query)
+	require.NoError(t, err)
+	require.Len(t, page, 5)
+	assert.Equal(t, "/path-05", page[0].Path)
+	assert.Equal(t, "/path-09", page[4].Path)
+}
+
+func TestCountOpenFlareAccessLogs(t *testing.T) {
+	ctx, cleanup := setupOpenFlareAccessLogTestEnvironment(t)
+	defer cleanup()
+
+	now := time.Now().UTC()
+	seedOpenFlareAccessLogs(t, ctx, now)
+
+	query := OpenFlareAccessLogQuery{
+		Since: now.Add(-10 * time.Minute),
+	}
+	totalRecords, totalIPs, err := CountOpenFlareAccessLogs(ctx, query)
+	require.NoError(t, err)
+	assert.Equal(t, int64(5), totalRecords)
+	assert.Equal(t, int64(3), totalIPs)
+}
+
+func TestListOpenFlareAccessLogsFiltersAndSort(t *testing.T) {
+	ctx, cleanup := setupOpenFlareAccessLogTestEnvironment(t)
+	defer cleanup()
+
+	now := time.Now().UTC()
+	seedOpenFlareAccessLogs(t, ctx, now)
+
+	query := OpenFlareAccessLogQuery{
+		NodeID:    "node-a",
+		Since:     now.Add(-10 * time.Minute),
+		SortBy:    "status_code",
+		SortOrder: "desc",
+	}
+	rows, err := ListOpenFlareAccessLogs(ctx, query)
+	require.NoError(t, err)
+	require.Len(t, rows, 2)
+	assert.Equal(t, 404, rows[0].StatusCode)
+	assert.Equal(t, 200, rows[1].StatusCode)
+}
+
+func TestDeleteOpenFlareAccessLogsBefore(t *testing.T) {
+	ctx, cleanup := setupOpenFlareAccessLogTestEnvironment(t)
+	defer cleanup()
+
+	now := time.Now().UTC()
+	seedOpenFlareAccessLogs(t, ctx, now)
+
+	deleted, err := DeleteOpenFlareAccessLogsBefore(ctx, now.Add(-2*time.Minute))
+	require.NoError(t, err)
+	assert.Equal(t, int64(3), deleted)
+
+	totalRecords, _, err := CountOpenFlareAccessLogs(ctx, OpenFlareAccessLogQuery{Since: now.Add(-10 * time.Minute)})
+	require.NoError(t, err)
+	assert.Equal(t, int64(2), totalRecords)
+}

internal/model/openflare_acme_account.go

@@ -0,0 +1,82 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"gorm.io/gorm"
+)
+
+// AcmeAccount OpenFlare ACME 账号实体。
+type AcmeAccount struct {
+	ID         uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	Email      string    `json:"email" gorm:"size:255"`
+	URL        string    `json:"url" gorm:"size:255"`
+	PrivateKey string    `json:"-" gorm:"type:text;not null"`
+	CreatedAt  time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt  time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名。
+func (AcmeAccount) TableName() string {
+	return "of_acme_accounts"
+}
+
+// GetAcmeAccountByID 按 ID 查询 ACME 账号。
+func GetAcmeAccountByID(ctx context.Context, id uint) (*AcmeAccount, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var account AcmeAccount
+	if err := conn.First(&account, id).Error; err != nil {
+		return nil, err
+	}
+	return &account, nil
+}
+
+// CreateAcmeAccountRecord 创建 ACME 账号。
+func CreateAcmeAccountRecord(ctx context.Context, account *AcmeAccount) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Create(account).Error
+}
+
+// SaveAcmeAccount 保存 ACME 账号。
+func SaveAcmeAccount(ctx context.Context, account *AcmeAccount) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Save(account).Error
+}
+
+// GetDefaultAcmeAccount 获取默认 ACME 账号，不存在时创建占位记录。
+func GetDefaultAcmeAccount(ctx context.Context) (*AcmeAccount, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var account AcmeAccount
+	err := conn.Order("id asc").First(&account).Error
+	if err == nil {
+		return &account, nil
+	}
+	if !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+	account = AcmeAccount{
+		Email: "admin@openflare.dev",
+	}
+	if err = conn.Create(&account).Error; err != nil {
+		return nil, err
+	}
+	return &account, nil
+}

internal/model/openflare_apply_log.go

@@ -0,0 +1,132 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"gorm.io/gorm"
+)
+
+// OpenFlareApplyLogQuery filters apply logs for list queries.
+type OpenFlareApplyLogQuery struct {
+	NodeID   string
+	PageNo   int
+	PageSize int
+}
+
+// OpenFlareApplyLog stores node configuration apply results.
+type OpenFlareApplyLog struct {
+	ID                  uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID              string    `json:"node_id" gorm:"index;size:64;not null"`
+	Version             string    `json:"version" gorm:"size:32;not null"`
+	Result              string    `json:"result" gorm:"size:32;not null"`
+	Message             string    `json:"message" gorm:"type:text"`
+	Checksum            string    `json:"checksum" gorm:"size:64;not null;default:''"`
+	MainConfigChecksum  string    `json:"main_config_checksum" gorm:"size:64;not null;default:''"`
+	RouteConfigChecksum string    `json:"route_config_checksum" gorm:"size:64;not null;default:''"`
+	SupportFileCount    int       `json:"support_file_count" gorm:"not null;default:0"`
+	CreatedAt           time.Time `json:"created_at" gorm:"autoCreateTime;index"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareApplyLog) TableName() string {
+	return "of_apply_logs"
+}
+
+// ListOpenFlareApplyLogs returns apply logs ordered by id desc with optional pagination.
+func ListOpenFlareApplyLogs(ctx context.Context, query OpenFlareApplyLogQuery) ([]*OpenFlareApplyLog, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+
+	dbQuery := conn.Model(&OpenFlareApplyLog{}).Order("id desc")
+	if query.NodeID != "" {
+		dbQuery = dbQuery.Where("node_id = ?", query.NodeID)
+	}
+	if query.PageSize > 0 {
+		offset := 0
+		if query.PageNo > 1 {
+			offset = (query.PageNo - 1) * query.PageSize
+		}
+		dbQuery = dbQuery.Limit(query.PageSize).Offset(offset)
+	}
+
+	var logs []*OpenFlareApplyLog
+	if err := dbQuery.Find(&logs).Error; err != nil {
+		return nil, err
+	}
+	return logs, nil
+}
+
+// CountOpenFlareApplyLogs returns total apply logs, optionally filtered by node_id.
+func CountOpenFlareApplyLogs(ctx context.Context, nodeID string) (int64, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+
+	query := conn.Model(&OpenFlareApplyLog{})
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+
+	var total int64
+	if err := query.Count(&total).Error; err != nil {
+		return 0, err
+	}
+	return total, nil
+}
+
+// GetLatestOpenFlareApplyLogsByNodeIDs returns the latest apply log per node id.
+func GetLatestOpenFlareApplyLogsByNodeIDs(ctx context.Context, nodeIDs []string) (map[string]*OpenFlareApplyLog, error) {
+	result := make(map[string]*OpenFlareApplyLog)
+	if len(nodeIDs) == 0 {
+		return result, nil
+	}
+
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+
+	var logs []*OpenFlareApplyLog
+	subQuery := conn.Model(&OpenFlareApplyLog{}).
+		Select("MAX(id) AS id").
+		Where("node_id IN ?", nodeIDs).
+		Group("node_id")
+	if err := conn.Where("id IN (?)", subQuery).Find(&logs).Error; err != nil {
+		return nil, err
+	}
+	for _, log := range logs {
+		result[log.NodeID] = log
+	}
+	return result, nil
+}
+
+// DeleteAllOpenFlareApplyLogs removes every apply log record.
+func DeleteAllOpenFlareApplyLogs(ctx context.Context) (int64, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+
+	result := conn.Session(&gorm.Session{AllowGlobalUpdate: true}).Delete(&OpenFlareApplyLog{})
+	return result.RowsAffected, result.Error
+}
+
+// DeleteOpenFlareApplyLogsBefore removes apply logs created before the cutoff time.
+func DeleteOpenFlareApplyLogsBefore(ctx context.Context, before time.Time) (int64, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+
+	result := conn.Where("created_at < ?", before).Delete(&OpenFlareApplyLog{})
+	return result.RowsAffected, result.Error
+}

internal/model/openflare_config_version.go

@@ -0,0 +1,163 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"gorm.io/gorm"
+)
+
+// ConfigVersionSummary is the list view for config versions.
+type ConfigVersionSummary struct {
+	ID        uint      `json:"id"`
+	Version   string    `json:"version"`
+	Checksum  string    `json:"checksum"`
+	IsActive  bool      `json:"is_active"`
+	CreatedBy string    `json:"created_by"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// ConfigVersion stores a published OpenResty configuration snapshot.
+type ConfigVersion struct {
+	ID               uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	Version          string    `json:"version" gorm:"uniqueIndex;size:32;not null"`
+	SnapshotJSON     string    `json:"snapshot_json" gorm:"type:text;not null"`
+	MainConfig       string    `json:"main_config" gorm:"type:text;not null;default:''"`
+	RenderedConfig   string    `json:"rendered_config" gorm:"type:text;not null"`
+	SupportFilesJSON string    `json:"support_files_json" gorm:"type:text;not null;default:'[]'"`
+	Checksum         string    `json:"checksum" gorm:"size:64;not null"`
+	IsActive         bool      `json:"is_active" gorm:"not null;default:false;index"`
+	CreatedBy        string    `json:"created_by" gorm:"size:64;not null"`
+	CreatedAt        time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName returns the GORM table name.
+func (ConfigVersion) TableName() string {
+	return "of_config_versions"
+}
+
+// ListConfigVersionSummaries returns config version summaries ordered by id desc.
+func ListConfigVersionSummaries(ctx context.Context) ([]*ConfigVersionSummary, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var versions []*ConfigVersionSummary
+	err := conn.Model(&ConfigVersion{}).
+		Select("id", "version", "checksum", "is_active", "created_by", "created_at").
+		Order("id desc").
+		Find(&versions).Error
+	return versions, err
+}
+
+// GetConfigVersionByID returns a config version by primary key.
+func GetConfigVersionByID(ctx context.Context, id uint) (*ConfigVersion, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var version ConfigVersion
+	if err := conn.First(&version, id).Error; err != nil {
+		return nil, err
+	}
+	return &version, nil
+}
+
+// GetActiveConfigVersion returns the currently active config version.
+func GetActiveConfigVersion(ctx context.Context) (*ConfigVersion, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var version ConfigVersion
+	if err := conn.Where("is_active = ?", true).Order("id desc").First(&version).Error; err != nil {
+		return nil, err
+	}
+	return &version, nil
+}
+
+// GetLatestConfigVersionByPrefix returns the latest version string matching a date prefix.
+func GetLatestConfigVersionByPrefix(ctx context.Context, prefix string) (string, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return "", errors.New(errDatabaseNotInitialized)
+	}
+	var version ConfigVersion
+	err := conn.Model(&ConfigVersion{}).
+		Select("version").
+		Where("version LIKE ?", prefix+"-%").
+		Order("version desc").
+		First(&version).Error
+	if err != nil {
+		return "", err
+	}
+	return version.Version, nil
+}
+
+// CreateConfigVersion inserts a new config version record.
+func CreateConfigVersion(ctx context.Context, version *ConfigVersion) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Create(version).Error
+}
+
+// PublishConfigVersionTx deactivates all versions and creates a new active version.
+func PublishConfigVersionTx(ctx context.Context, version *ConfigVersion) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&ConfigVersion{}).Where("is_active = ?", true).Update("is_active", false).Error; err != nil {
+			return err
+		}
+		return tx.Create(version).Error
+	})
+}
+
+// ActivateConfigVersionTx marks the given version active and deactivates others.
+func ActivateConfigVersionTx(ctx context.Context, id uint) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&ConfigVersion{}).Where("is_active = ?", true).Update("is_active", false).Error; err != nil {
+			return err
+		}
+		return tx.Model(&ConfigVersion{}).Where("id = ?", id).Update("is_active", true).Error
+	})
+}
+
+// DeleteConfigVersionsByIDs removes config versions by ids.
+func DeleteConfigVersionsByIDs(ctx context.Context, ids []uint) (int64, error) {
+	if len(ids) == 0 {
+		return 0, nil
+	}
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+	result := conn.Where("id IN ?", ids).Delete(&ConfigVersion{})
+	return result.RowsAffected, result.Error
+}
+
+// ListEnabledProxyRoutes returns enabled proxy routes ordered by id asc.
+func ListEnabledProxyRoutes(ctx context.Context) ([]*ProxyRoute, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var routes []*ProxyRoute
+	if err := conn.Where("enabled = ?", true).Order("id asc").Find(&routes).Error; err != nil {
+		return nil, err
+	}
+	return routes, nil
+}

internal/model/openflare_dns_account.go

@@ -0,0 +1,80 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+)
+
+// DNSAccount OpenFlare DNS 账号实体。
+type DNSAccount struct {
+	ID            uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	Name          string    `json:"name" gorm:"size:255;not null"`
+	Type          string    `json:"type" gorm:"size:64;not null"`
+	Authorization string    `json:"-" gorm:"type:text;not null"`
+	CreatedAt     time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt     time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名。
+func (DNSAccount) TableName() string {
+	return "of_dns_accounts"
+}
+
+// ListDNSAccounts 列出全部 DNS 账号（授权信息不通过 JSON 暴露）。
+func ListDNSAccounts(ctx context.Context) ([]DNSAccount, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var accounts []DNSAccount
+	if err := conn.Order("id desc").Find(&accounts).Error; err != nil {
+		return nil, err
+	}
+	return accounts, nil
+}
+
+// GetDNSAccountByID 按 ID 查询 DNS 账号。
+func GetDNSAccountByID(ctx context.Context, id uint) (*DNSAccount, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var account DNSAccount
+	if err := conn.First(&account, id).Error; err != nil {
+		return nil, err
+	}
+	return &account, nil
+}
+
+// CreateDNSAccountRecord 创建 DNS 账号。
+func CreateDNSAccountRecord(ctx context.Context, account *DNSAccount) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Create(account).Error
+}
+
+// SaveDNSAccount 保存 DNS 账号。
+func SaveDNSAccount(ctx context.Context, account *DNSAccount) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Save(account).Error
+}
+
+// DeleteDNSAccountRecord 删除 DNS 账号。
+func DeleteDNSAccountRecord(ctx context.Context, id uint) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Delete(&DNSAccount{}, id).Error
+}

internal/model/openflare_managed_domain.go

@@ -0,0 +1,94 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+)
+
+// ManagedDomain OpenFlare 托管域名实体。
+type ManagedDomain struct {
+	ID        uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	Domain    string    `json:"domain" gorm:"uniqueIndex;size:255;not null"`
+	CertID    *uint     `json:"cert_id"`
+	Enabled   bool      `json:"enabled" gorm:"not null;default:true"`
+	Remark    string    `json:"remark" gorm:"size:255"`
+	CreatedAt time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名。
+func (ManagedDomain) TableName() string {
+	return "of_managed_domains"
+}
+
+// ListManagedDomains 列出全部托管域名。
+func ListManagedDomains(ctx context.Context) ([]ManagedDomain, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var domains []ManagedDomain
+	if err := conn.Order("id desc").Find(&domains).Error; err != nil {
+		return nil, err
+	}
+	return domains, nil
+}
+
+// ListEnabledManagedDomainsWithCertificate 列出已启用且绑定证书的托管域名。
+func ListEnabledManagedDomainsWithCertificate(ctx context.Context) ([]ManagedDomain, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var domains []ManagedDomain
+	if err := conn.Where("enabled = ? AND cert_id IS NOT NULL", true).Order("id desc").Find(&domains).Error; err != nil {
+		return nil, err
+	}
+	return domains, nil
+}
+
+// GetManagedDomainByID 按 ID 查询托管域名。
+func GetManagedDomainByID(ctx context.Context, id uint) (*ManagedDomain, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var domain ManagedDomain
+	if err := conn.First(&domain, id).Error; err != nil {
+		return nil, err
+	}
+	return &domain, nil
+}
+
+// CreateManagedDomainRecord 创建托管域名。
+func CreateManagedDomainRecord(ctx context.Context, domain *ManagedDomain) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Create(domain).Error
+}
+
+// SaveManagedDomain 保存托管域名。
+func SaveManagedDomain(ctx context.Context, domain *ManagedDomain) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Save(domain).Error
+}
+
+// DeleteManagedDomainRecord 删除托管域名。
+func DeleteManagedDomainRecord(ctx context.Context, id uint) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Delete(&ManagedDomain{}, id).Error
+}

internal/model/openflare_node.go

@@ -0,0 +1,163 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+)
+
+// OpenFlareNode stores an edge, relay, or tunnel client node.
+type OpenFlareNode struct {
+	ID                        uint       `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID                    string     `json:"node_id" gorm:"uniqueIndex;size:64;not null"`
+	Name                      string     `json:"name" gorm:"size:128;not null"`
+	IP                        string     `json:"ip" gorm:"size:64;not null;default:''"`
+	IPManualOverride          bool       `json:"ip_manual_override" gorm:"not null;default:false"`
+	GeoName                   string     `json:"geo_name" gorm:"size:128;not null;default:''"`
+	GeoLatitude               *float64   `json:"geo_latitude"`
+	GeoLongitude              *float64   `json:"geo_longitude"`
+	GeoManualOverride         bool       `json:"geo_manual_override" gorm:"not null;default:false"`
+	AccessToken               string     `json:"-" gorm:"column:access_token;size:128;index"`
+	AutoUpdateEnabled         bool       `json:"auto_update_enabled" gorm:"not null;default:false"`
+	UpdateRequested           bool       `json:"update_requested" gorm:"not null;default:false"`
+	UpdateChannel             string     `json:"update_channel" gorm:"size:16;not null;default:'stable'"`
+	UpdateTag                 string     `json:"update_tag" gorm:"size:64;not null;default:''"`
+	RestartOpenrestyRequested bool       `json:"restart_openresty_requested" gorm:"not null;default:false"`
+	Version                   string     `json:"version" gorm:"size:64;not null;default:''"`
+	ExtVersion                string     `json:"ext_version" gorm:"size:64;not null;default:''"`
+	OpenrestyStatus           string     `json:"openresty_status" gorm:"size:16;not null;default:'unknown'"`
+	OpenrestyMessage          string     `json:"openresty_message" gorm:"type:text"`
+	Status                    string     `json:"status" gorm:"size:16;not null;default:'offline'"`
+	CurrentVersion            string     `json:"current_version" gorm:"size:32;not null;default:''"`
+	LastSeenAt                *time.Time `json:"last_seen_at"`
+	LastError                 string     `json:"last_error" gorm:"type:text"`
+	CreatedAt                 time.Time  `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt                 time.Time  `json:"updated_at" gorm:"autoUpdateTime"`
+	NodeType                  string     `json:"node_type" gorm:"size:32;not null;default:'edge_node'"`
+	RelayBindPort             int        `json:"relay_bind_port" gorm:"not null;default:0"`
+	RelayVhostHTTPPort        int        `json:"relay_vhost_http_port" gorm:"not null;default:0"`
+	RelayAuthToken            string     `json:"-" gorm:"size:128;not null;default:''"`
+	RelayAgentAccessAddr      string     `json:"relay_agent_access_addr" gorm:"size:255;not null;default:''"`
+	RelayClientAccessAddr     string     `json:"relay_client_access_addr" gorm:"size:255;not null;default:''"`
+	RelayClientProxyURL       string     `json:"relay_client_proxy_url" gorm:"size:512;not null;default:''"`
+	CapabilitiesJSON          string     `json:"capabilities_json" gorm:"type:text;not null;default:'[]'"`
+	RelayStatus               string     `json:"relay_status" gorm:"size:16;not null;default:'unknown'"`
+	RelayWebServerEnabled     bool       `json:"relay_web_server_enabled" gorm:"not null;default:false"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareNode) TableName() string {
+	return "of_nodes"
+}
+
+// ListOpenFlareNodes returns all nodes ordered by id desc.
+func ListOpenFlareNodes(ctx context.Context) ([]OpenFlareNode, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var nodes []OpenFlareNode
+	if err := conn.Order("id desc").Find(&nodes).Error; err != nil {
+		return nil, err
+	}
+	return nodes, nil
+}
+
+// ListOpenFlareNodesByNodeIDs returns nodes matching the given node ids.
+func ListOpenFlareNodesByNodeIDs(ctx context.Context, nodeIDs []string) ([]OpenFlareNode, error) {
+	if len(nodeIDs) == 0 {
+		return []OpenFlareNode{}, nil
+	}
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var nodes []OpenFlareNode
+	if err := conn.Where("node_id IN ?", nodeIDs).Find(&nodes).Error; err != nil {
+		return nil, err
+	}
+	return nodes, nil
+}
+
+// GetOpenFlareNodeByID returns a node by primary key.
+func GetOpenFlareNodeByID(ctx context.Context, id uint) (*OpenFlareNode, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var node OpenFlareNode
+	if err := conn.First(&node, id).Error; err != nil {
+		return nil, err
+	}
+	return &node, nil
+}
+
+// GetOpenFlareNodeByNodeID returns a node by node_id.
+func GetOpenFlareNodeByNodeID(ctx context.Context, nodeID string) (*OpenFlareNode, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var node OpenFlareNode
+	if err := conn.Where("node_id = ?", nodeID).First(&node).Error; err != nil {
+		return nil, err
+	}
+	return &node, nil
+}
+
+// GetOpenFlareNodeByAccessToken returns a node by access token.
+func GetOpenFlareNodeByAccessToken(ctx context.Context, token string) (*OpenFlareNode, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var node OpenFlareNode
+	if err := conn.Where("access_token = ?", token).First(&node).Error; err != nil {
+		return nil, err
+	}
+	return &node, nil
+}
+
+// CreateOpenFlareNode inserts a new node.
+func CreateOpenFlareNode(ctx context.Context, node *OpenFlareNode) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Create(node).Error
+}
+
+// SaveOpenFlareNode persists node changes.
+func SaveOpenFlareNode(ctx context.Context, node *OpenFlareNode) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Save(node).Error
+}
+
+// UpdateOpenFlareNodeFields updates selected columns for a node.
+func UpdateOpenFlareNodeFields(ctx context.Context, node *OpenFlareNode, fields ...string) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	if len(fields) == 0 {
+		return conn.Save(node).Error
+	}
+	return conn.Model(node).Select(fields).Updates(node).Error
+}
+
+// DeleteOpenFlareNode removes a node by primary key.
+func DeleteOpenFlareNode(ctx context.Context, id uint) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Delete(&OpenFlareNode{}, id).Error
+}

internal/model/openflare_observability.go

@@ -0,0 +1,551 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"gorm.io/gorm"
+)
+
+// OpenFlareMetricSnapshot stores a node capacity snapshot (v1 single table, no sharding).
+type OpenFlareMetricSnapshot struct {
+	ID                uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID            string    `json:"node_id" gorm:"index;size:64;not null"`
+	CapturedAt        time.Time `json:"captured_at" gorm:"index"`
+	CPUUsagePercent   float64   `json:"cpu_usage_percent"`
+	MemoryUsedBytes   int64     `json:"memory_used_bytes"`
+	MemoryTotalBytes  int64     `json:"memory_total_bytes"`
+	StorageUsedBytes  int64     `json:"storage_used_bytes"`
+	StorageTotalBytes int64     `json:"storage_total_bytes"`
+	DiskReadBytes     int64     `json:"disk_read_bytes"`
+	DiskWriteBytes    int64     `json:"disk_write_bytes"`
+	NetworkRxBytes    int64     `json:"network_rx_bytes"`
+	NetworkTxBytes    int64     `json:"network_tx_bytes"`
+	CreatedAt         time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareMetricSnapshot) TableName() string {
+	return "of_node_metric_snapshots"
+}
+
+// OpenFlareRequestReport stores aggregated traffic windows per node.
+type OpenFlareRequestReport struct {
+	ID                  uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID              string    `json:"node_id" gorm:"index;size:64;not null"`
+	WindowStartedAt     time.Time `json:"window_started_at" gorm:"index"`
+	WindowEndedAt       time.Time `json:"window_ended_at" gorm:"index"`
+	RequestCount        int64     `json:"request_count"`
+	ErrorCount          int64     `json:"error_count"`
+	UniqueVisitorCount  int64     `json:"unique_visitor_count"`
+	StatusCodesJSON     string    `json:"status_codes_json" gorm:"type:text"`
+	TopDomainsJSON      string    `json:"top_domains_json" gorm:"type:text"`
+	SourceCountriesJSON string    `json:"source_countries_json" gorm:"type:text"`
+	CreatedAt           time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareRequestReport) TableName() string {
+	return "of_node_request_reports"
+}
+
+// OpenFlareAccessLog stores a single access log row in ClickHouse (database: openflare, table: of_node_access_logs).
+// ClickHouse DDL is managed by goose; reads/writes go through internal/repository/analytics.
+type OpenFlareAccessLog struct {
+	ID         uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID     string    `json:"node_id" gorm:"index;size:64;not null"`
+	LoggedAt   time.Time `json:"logged_at" gorm:"index"`
+	RemoteAddr string    `json:"remote_addr" gorm:"index;size:128"`
+	Region     string    `json:"region" gorm:"size:128"`
+	Host       string    `json:"host" gorm:"index;size:255"`
+	Path       string    `json:"path" gorm:"size:2048"`
+	StatusCode int       `json:"status_code" gorm:"index"`
+	CreatedAt  time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareAccessLog) TableName() string {
+	return "of_node_access_logs"
+}
+
+// OpenFlareAccessLogRegionCount aggregates access log regions.
+type OpenFlareAccessLogRegionCount struct {
+	Region string `json:"region"`
+	Count  int64  `json:"count"`
+}
+
+// OpenFlareHealthEvent stores node health alert events.
+type OpenFlareHealthEvent struct {
+	ID               uint       `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID           string     `json:"node_id" gorm:"index;size:64;not null"`
+	EventType        string     `json:"event_type" gorm:"index;size:64;not null"`
+	Severity         string     `json:"severity" gorm:"size:16;not null"`
+	Status           string     `json:"status" gorm:"index;size:16;not null"`
+	Message          string     `json:"message" gorm:"type:text"`
+	FirstTriggeredAt time.Time  `json:"first_triggered_at" gorm:"index"`
+	LastTriggeredAt  time.Time  `json:"last_triggered_at" gorm:"index"`
+	ReportedAt       time.Time  `json:"reported_at" gorm:"index"`
+	ResolvedAt       *time.Time `json:"resolved_at" gorm:"index"`
+	MetadataJSON     string     `json:"metadata_json" gorm:"type:text"`
+	CreatedAt        time.Time  `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt        time.Time  `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareHealthEvent) TableName() string {
+	return "of_node_health_events"
+}
+
+// OpenFlareNodeSystemProfile stores the latest node system profile.
+type OpenFlareNodeSystemProfile struct {
+	ID               uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID           string    `json:"node_id" gorm:"uniqueIndex;size:64;not null"`
+	Hostname         string    `json:"hostname" gorm:"size:255"`
+	OSName           string    `json:"os_name" gorm:"size:128"`
+	OSVersion        string    `json:"os_version" gorm:"size:128"`
+	KernelVersion    string    `json:"kernel_version" gorm:"size:128"`
+	Architecture     string    `json:"architecture" gorm:"size:64"`
+	CPUModel         string    `json:"cpu_model" gorm:"size:255"`
+	CPUCores         int       `json:"cpu_cores"`
+	TotalMemoryBytes int64     `json:"total_memory_bytes"`
+	TotalDiskBytes   int64     `json:"total_disk_bytes"`
+	UptimeSeconds    int64     `json:"uptime_seconds"`
+	ReportedAt       time.Time `json:"reported_at" gorm:"index"`
+	CreatedAt        time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt        time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareNodeSystemProfile) TableName() string {
+	return "of_node_system_profiles"
+}
+
+// OpenFlareNodeObservationOpenresty stores openresty network observations.
+type OpenFlareNodeObservationOpenresty struct {
+	ID                   uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID               string    `json:"node_id" gorm:"index;size:64;not null"`
+	CapturedAt           time.Time `json:"captured_at" gorm:"index"`
+	OpenrestyRxBytes     int64     `json:"openresty_rx_bytes"`
+	OpenrestyTxBytes     int64     `json:"openresty_tx_bytes"`
+	OpenrestyConnections int64     `json:"openresty_connections"`
+	CreatedAt            time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareNodeObservationOpenresty) TableName() string {
+	return "of_node_obs_openresty"
+}
+
+// OpenFlareNodeObservationFrpc stores tunnel client frpc observations.
+type OpenFlareNodeObservationFrpc struct {
+	ID                   uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID               string    `json:"node_id" gorm:"index;size:64;not null"`
+	CapturedAt           time.Time `json:"captured_at" gorm:"index"`
+	TunnelStatus         string    `json:"tunnel_status" gorm:"size:16"`
+	ConnectedRelaysCount int       `json:"connected_relays_count"`
+	CreatedAt            time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareNodeObservationFrpc) TableName() string {
+	return "of_node_obs_frpc"
+}
+
+// OpenFlareNodeObservationFrps stores tunnel relay frps observations.
+type OpenFlareNodeObservationFrps struct {
+	ID              uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	NodeID          string    `json:"node_id" gorm:"index;size:64;not null"`
+	CapturedAt      time.Time `json:"captured_at" gorm:"index"`
+	FrpsConnections int       `json:"frps_connections"`
+	FrpsProxyCount  int       `json:"frps_proxy_count"`
+	FrpsClientCount int       `json:"frps_client_count"`
+	FrpsProxies     string    `json:"frps_proxies" gorm:"type:text"`
+	CreatedAt       time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareNodeObservationFrps) TableName() string {
+	return "of_node_obs_frps"
+}
+
+// OpenFlareAccessLogQuery filters access log list queries.
+type OpenFlareAccessLogQuery struct {
+	NodeID     string
+	RemoteAddr string
+	Host       string
+	Path       string
+	Since      time.Time
+	Until      time.Time
+	Page       int
+	PageSize   int
+	SortBy     string
+	SortOrder  string
+}
+
+// OpenFlareAccessLogBucketQuery filters folded access log queries (v1 stub).
+type OpenFlareAccessLogBucketQuery struct {
+	NodeID      string
+	RemoteAddr  string
+	Host        string
+	Path        string
+	Since       time.Time
+	Page        int
+	PageSize    int
+	SortBy      string
+	SortOrder   string
+	FoldMinutes int
+}
+
+// OpenFlareAccessLogBucketRow is a folded access log bucket row (v1 stub).
+type OpenFlareAccessLogBucketRow struct {
+	BucketEpoch      int64 `json:"bucket_epoch"`
+	RequestCount     int64 `json:"request_count"`
+	UniqueIPCount    int64 `json:"unique_ip_count"`
+	UniqueHostCount  int64 `json:"unique_host_count"`
+	SuccessCount     int64 `json:"success_count"`
+	ClientErrorCount int64 `json:"client_error_count"`
+	ServerErrorCount int64 `json:"server_error_count"`
+}
+
+// OpenFlareAccessLogBucketIPQuery filters folded IP summary queries (v1 stub).
+type OpenFlareAccessLogBucketIPQuery struct {
+	NodeID          string
+	RemoteAddr      string
+	Host            string
+	Path            string
+	BucketStartedAt time.Time
+	FoldMinutes     int
+	Page            int
+	PageSize        int
+	SortBy          string
+	SortOrder       string
+}
+
+// OpenFlareAccessLogBucketIPRow is a folded IP row (v1 stub).
+type OpenFlareAccessLogBucketIPRow struct {
+	RemoteAddr       string `json:"remote_addr"`
+	RequestCount     int64  `json:"request_count"`
+	SuccessCount     int64  `json:"success_count"`
+	ClientErrorCount int64  `json:"client_error_count"`
+	ServerErrorCount int64  `json:"server_error_count"`
+	LastSeenEpoch    int64  `json:"last_seen_epoch"`
+}
+
+// OpenFlareAccessLogIPSummaryQuery filters IP summary list queries (v1 stub).
+type OpenFlareAccessLogIPSummaryQuery struct {
+	NodeID     string
+	RemoteAddr string
+	Host       string
+	Since      time.Time
+	Page       int
+	PageSize   int
+	SortBy     string
+	SortOrder  string
+}
+
+// OpenFlareAccessLogIPSummaryRow is an IP summary row (v1 stub).
+type OpenFlareAccessLogIPSummaryRow struct {
+	RemoteAddr     string `json:"remote_addr"`
+	TotalRequests  int64  `json:"total_requests"`
+	RecentRequests int64  `json:"recent_requests"`
+	LastSeenEpoch  int64  `json:"last_seen_epoch"`
+}
+
+// OpenFlareAccessLogIPTrendQuery filters IP trend queries (v1 stub).
+type OpenFlareAccessLogIPTrendQuery struct {
+	NodeID        string
+	RemoteAddr    string
+	Host          string
+	Since         time.Time
+	BucketMinutes int
+}
+
+// OpenFlareAccessLogIPTrendRow is an IP trend bucket row (v1 stub).
+type OpenFlareAccessLogIPTrendRow struct {
+	BucketEpoch  int64 `json:"bucket_epoch"`
+	RequestCount int64 `json:"request_count"`
+}
+
+func isMissingTableError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return false
+	}
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "no such table") ||
+		strings.Contains(msg, "doesn't exist") ||
+		strings.Contains(msg, "does not exist")
+}
+
+// ListOpenFlareMetricSnapshotsSince returns metric snapshots since the given time.
+func ListOpenFlareMetricSnapshotsSince(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareMetricSnapshot, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	query := conn.Model(&OpenFlareMetricSnapshot{}).Order("captured_at desc, id desc")
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+	if !since.IsZero() {
+		query = query.Where("captured_at >= ?", since)
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	var rows []*OpenFlareMetricSnapshot
+	if err := query.Find(&rows).Error; err != nil {
+		if isMissingTableError(err) {
+			return []*OpenFlareMetricSnapshot{}, nil
+		}
+		return nil, err
+	}
+	return rows, nil
+}
+
+// ListOpenFlareRequestReportsSince returns request reports since the given time.
+func ListOpenFlareRequestReportsSince(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareRequestReport, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	query := conn.Model(&OpenFlareRequestReport{}).Order("window_ended_at desc, id desc")
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+	if !since.IsZero() {
+		query = query.Where("window_ended_at >= ?", since)
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	var rows []*OpenFlareRequestReport
+	if err := query.Find(&rows).Error; err != nil {
+		if isMissingTableError(err) {
+			return []*OpenFlareRequestReport{}, nil
+		}
+		return nil, err
+	}
+	return rows, nil
+}
+
+// ListOpenFlareActiveHealthEvents returns active health events across all nodes.
+func ListOpenFlareActiveHealthEvents(ctx context.Context) ([]*OpenFlareHealthEvent, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var rows []*OpenFlareHealthEvent
+	if err := conn.Where("status = ?", "active").Order("last_triggered_at desc").Find(&rows).Error; err != nil {
+		if isMissingTableError(err) {
+			return []*OpenFlareHealthEvent{}, nil
+		}
+		return nil, err
+	}
+	return rows, nil
+}
+
+// ListOpenFlareHealthEvents returns health events for a node.
+func ListOpenFlareHealthEvents(ctx context.Context, nodeID string, activeOnly bool, limit int) ([]*OpenFlareHealthEvent, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	query := conn.Model(&OpenFlareHealthEvent{}).Where("node_id = ?", nodeID).Order("last_triggered_at desc")
+	if activeOnly {
+		query = query.Where("status = ?", "active")
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	var rows []*OpenFlareHealthEvent
+	if err := query.Find(&rows).Error; err != nil {
+		if isMissingTableError(err) {
+			return []*OpenFlareHealthEvent{}, nil
+		}
+		return nil, err
+	}
+	return rows, nil
+}
+
+// DeleteOpenFlareMetricSnapshotsBefore deletes metric snapshots captured before cutoff.
+func DeleteOpenFlareMetricSnapshotsBefore(ctx context.Context, cutoff time.Time) (int64, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+	result := conn.Where("captured_at < ?", cutoff).Delete(&OpenFlareMetricSnapshot{})
+	if result.Error != nil {
+		if isMissingTableError(result.Error) {
+			return 0, nil
+		}
+		return 0, result.Error
+	}
+	return result.RowsAffected, nil
+}
+
+// DeleteAllOpenFlareMetricSnapshots deletes all metric snapshots.
+func DeleteAllOpenFlareMetricSnapshots(ctx context.Context) (int64, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+	result := conn.Where("1 = 1").Delete(&OpenFlareMetricSnapshot{})
+	if result.Error != nil {
+		if isMissingTableError(result.Error) {
+			return 0, nil
+		}
+		return 0, result.Error
+	}
+	return result.RowsAffected, nil
+}
+
+// DeleteOpenFlareRequestReportsBefore deletes request reports ending before cutoff.
+func DeleteOpenFlareRequestReportsBefore(ctx context.Context, cutoff time.Time) (int64, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+	result := conn.Where("window_ended_at < ?", cutoff).Delete(&OpenFlareRequestReport{})
+	if result.Error != nil {
+		if isMissingTableError(result.Error) {
+			return 0, nil
+		}
+		return 0, result.Error
+	}
+	return result.RowsAffected, nil
+}
+
+// DeleteAllOpenFlareRequestReports deletes all request reports.
+func DeleteAllOpenFlareRequestReports(ctx context.Context) (int64, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+	result := conn.Where("1 = 1").Delete(&OpenFlareRequestReport{})
+	if result.Error != nil {
+		if isMissingTableError(result.Error) {
+			return 0, nil
+		}
+		return 0, result.Error
+	}
+	return result.RowsAffected, nil
+}
+
+// DeleteOpenFlareHealthEventsByNodeID deletes all health events for a node.
+func DeleteOpenFlareHealthEventsByNodeID(ctx context.Context, nodeID string) (int64, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+	result := conn.Where("node_id = ?", nodeID).Delete(&OpenFlareHealthEvent{})
+	if result.Error != nil {
+		if isMissingTableError(result.Error) {
+			return 0, nil
+		}
+		return 0, result.Error
+	}
+	return result.RowsAffected, nil
+}
+
+// GetOpenFlareNodeSystemProfile returns the system profile for a node.
+func GetOpenFlareNodeSystemProfile(ctx context.Context, nodeID string) (*OpenFlareNodeSystemProfile, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var profile OpenFlareNodeSystemProfile
+	if err := conn.Where("node_id = ?", nodeID).First(&profile).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) || isMissingTableError(err) {
+			return nil, gorm.ErrRecordNotFound
+		}
+		return nil, err
+	}
+	return &profile, nil
+}
+
+// ListOpenFlareNodeObservationOpenresty returns openresty observations.
+func ListOpenFlareNodeObservationOpenresty(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareNodeObservationOpenresty, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	query := conn.Model(&OpenFlareNodeObservationOpenresty{}).Order("captured_at desc, id desc")
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+	if !since.IsZero() {
+		query = query.Where("captured_at >= ?", since)
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	var rows []*OpenFlareNodeObservationOpenresty
+	if err := query.Find(&rows).Error; err != nil {
+		if isMissingTableError(err) {
+			return []*OpenFlareNodeObservationOpenresty{}, nil
+		}
+		return nil, err
+	}
+	return rows, nil
+}
+
+// ListOpenFlareNodeObservationFrpc returns frpc observations.
+func ListOpenFlareNodeObservationFrpc(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareNodeObservationFrpc, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	query := conn.Model(&OpenFlareNodeObservationFrpc{}).Order("captured_at desc, id desc")
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+	if !since.IsZero() {
+		query = query.Where("captured_at >= ?", since)
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	var rows []*OpenFlareNodeObservationFrpc
+	if err := query.Find(&rows).Error; err != nil {
+		if isMissingTableError(err) {
+			return []*OpenFlareNodeObservationFrpc{}, nil
+		}
+		return nil, err
+	}
+	return rows, nil
+}
+
+// ListOpenFlareNodeObservationFrps returns frps observations.
+func ListOpenFlareNodeObservationFrps(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareNodeObservationFrps, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	query := conn.Model(&OpenFlareNodeObservationFrps{}).Order("captured_at desc, id desc")
+	if nodeID != "" {
+		query = query.Where("node_id = ?", nodeID)
+	}
+	if !since.IsZero() {
+		query = query.Where("captured_at >= ?", since)
+	}
+	if limit > 0 {
+		query = query.Limit(limit)
+	}
+	var rows []*OpenFlareNodeObservationFrps
+	if err := query.Find(&rows).Error; err != nil {
+		if isMissingTableError(err) {
+			return []*OpenFlareNodeObservationFrps{}, nil
+		}
+		return nil, err
+	}
+	return rows, nil
+}

internal/model/openflare_option.go

@@ -0,0 +1,427 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"gorm.io/gorm"
+)
+
+// OpenFlareOption stores a hot-reloadable OpenFlare system option.
+type OpenFlareOption struct {
+	Key   string `json:"key" gorm:"column:key;primaryKey;size:128;not null"`
+	Value string `json:"value" gorm:"type:text;not null"`
+}
+
+// TableName returns the OpenFlare options table name.
+func (OpenFlareOption) TableName() string {
+	return "of_options"
+}
+
+// OptionMap holds the in-memory option snapshot for fast reads and hot reload.
+var (
+	OptionMap        map[string]string
+	OptionMapRWMutex sync.RWMutex
+
+	// StartTime records process start time (seconds) for legacy /api/status.
+	StartTime = time.Now().Unix()
+
+	// Hot-reload mirrors for frequently read options (legacy OpenFlare keys).
+	SystemName                                  = "OpenFlare"
+	ServerAddress                               = ""
+	Footer                                      = ""
+	HomePageLink                                = ""
+	PasswordLoginEnabled                        = true
+	CapLoginEnabled                             = true
+	PasswordRegisterEnabled                     = false
+	EmailVerificationEnabled                    = false
+	GitHubOAuthEnabled                          = false
+	WeChatAuthEnabled                           = false
+	GitHubClientId                              = ""
+	GitHubClientSecret                          = ""
+	WeChatServerAddress                         = ""
+	WeChatServerToken                           = ""
+	WeChatAccountQRCodeImageURL                 = ""
+	SMTPServer                                  = ""
+	SMTPPort                                    = 587
+	SMTPAccount                                 = ""
+	SMTPToken                                   = ""
+	AgentDiscoveryToken                         = ""
+	AgentHeartbeatInterval                      = 10000
+	AgentWebsocketUpgradeEnabled                = true
+	NodeOfflineThreshold                        = 2 * time.Minute
+	AgentUpdateRepo                             = "Rain-kl/OpenFlare"
+	GeoIPProvider                               = "ipinfo"
+	DatabaseAutoCleanupEnabled                  = false
+	DatabaseAutoCleanupRetentionDays            = 30
+	UptimeKumaEnabled                           = false
+	UptimeKumaUrl                               = ""
+	UptimeKumaUsername                          = ""
+	UptimeKumaPassword                          = ""
+	UptimeKumaMonitorScope                      = "all"
+	UptimeKumaSelectedSites                     = ""
+	UptimeKumaSyncInterval                      = 5
+	UptimeKumaInterval                          = 60
+	UptimeKumaRetry                             = 0
+	UptimeKumaRetryInterval                     = 60
+	UptimeKumaTimeout                           = 48
+	OpenRestyDefaultServerReturnStatus          = 421
+	OpenRestyWorkerProcesses                    = "auto"
+	OpenRestyWorkerConnections                  = 4096
+	OpenRestyWorkerRlimitNofile                 = 65535
+	OpenRestyEventsUse                          = "epoll"
+	OpenRestyEventsMultiAcceptEnabled           = true
+	OpenRestyKeepaliveTimeout                   = 20
+	OpenRestyKeepaliveRequests                  = 1000
+	OpenRestyClientHeaderTimeout                = 15
+	OpenRestyClientBodyTimeout                  = 15
+	OpenRestyClientMaxBodySize                  = "64m"
+	OpenRestyLargeClientHeaderBuffers           = "4 16k"
+	OpenRestySendTimeout                        = 30
+	OpenRestyResolvers                          = ""
+	OpenRestyProxyConnectTimeout                = 3
+	OpenRestyProxySendTimeout                   = 60
+	OpenRestyProxyReadTimeout                   = 60
+	OpenRestyWebsocketEnabled                   = true
+	OpenRestyHTTP3Enabled                       = true
+	OpenRestyProxyRequestBufferingEnabled       = false
+	OpenRestyProxyBufferingEnabled              = true
+	OpenRestyProxyBuffers                       = "16 16k"
+	OpenRestyProxyBufferSize                    = "8k"
+	OpenRestyProxyBusyBuffersSize               = "64k"
+	OpenRestyGzipEnabled                        = true
+	OpenRestyGzipMinLength                      = 1024
+	OpenRestyGzipCompLevel                      = 5
+	OpenRestyCacheEnabled                       = false
+	OpenRestyCachePath                          = ""
+	OpenRestyCacheLevels                        = "1:2"
+	OpenRestyCacheInactive                      = "30m"
+	OpenRestyCacheMaxSize                       = "1g"
+	OpenRestyCacheKeyTemplate                   = "$scheme$host$request_uri"
+	OpenRestyCacheLockEnabled                   = true
+	OpenRestyCacheLockTimeout                   = "5s"
+	OpenRestyCacheUseStale                      = "error timeout updating http_500 http_502 http_503 http_504"
+	OpenRestyMainConfigTemplate = defaultOpenRestyMainConfigTemplate
+)
+
+const defaultOpenRestyMainConfigTemplate = `# This file is generated by OpenFlare. Do not edit manually.
+worker_processes {{OpenRestyWorkerProcesses}};
+worker_rlimit_nofile {{OpenRestyWorkerRlimitNofile}};
+pid logs/nginx.pid;
+error_log {{OpenRestyErrorLogPath}} warn;
+
+events {
+    worker_connections {{OpenRestyWorkerConnections}};
+{{OpenRestyEventsUseDirective}}{{OpenRestyEventsMultiAcceptDirective}}}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+{{OpenRestyConnectionUpgradeMap}}{{OpenRestyDefaultServerBlock}}    log_format openflare_json escape=json '{"ts":"$time_iso8601","host":"$host","path":"$request_uri","remote_addr":"$remote_addr","status":$status,"request_time":$request_time,"bytes_sent":$body_bytes_sent,"request_length":$request_length}';
+    access_log {{OpenRestyAccessLogPath}} openflare_json;
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout {{OpenRestyKeepaliveTimeout}};
+    keepalive_requests {{OpenRestyKeepaliveRequests}};
+    client_header_timeout {{OpenRestyClientHeaderTimeout}};
+    client_body_timeout {{OpenRestyClientBodyTimeout}};
+    client_max_body_size {{OpenRestyClientMaxBodySize}};
+    large_client_header_buffers {{OpenRestyLargeClientHeaderBuffers}};
+    send_timeout {{OpenRestySendTimeout}};
+    proxy_connect_timeout {{OpenRestyProxyConnectTimeout}};
+    proxy_send_timeout {{OpenRestyProxySendTimeout}};
+    proxy_read_timeout {{OpenRestyProxyReadTimeout}};
+    proxy_request_buffering {{OpenRestyProxyRequestBuffering}};
+    proxy_buffering {{OpenRestyProxyBuffering}};
+    proxy_buffers {{OpenRestyProxyBuffers}};
+    proxy_buffer_size {{OpenRestyProxyBufferSize}};
+    proxy_busy_buffers_size {{OpenRestyProxyBusyBuffersSize}};
+    gzip {{OpenRestyGzip}};
+    gzip_min_length {{OpenRestyGzipMinLength}};
+    gzip_comp_level {{OpenRestyGzipCompLevel}};
+{{OpenRestyResolverDirective}}{{OpenRestyCacheBlock}}    include {{OpenRestyRouteConfigInclude}};
+}
+`
+
+// DefaultOpenFlareOptions returns built-in defaults keyed by legacy OpenFlare option names.
+func DefaultOpenFlareOptions() map[string]string {
+	return map[string]string{
+		"PasswordLoginEnabled":                  strconv.FormatBool(PasswordLoginEnabled),
+		"CapLoginEnabled":                       strconv.FormatBool(CapLoginEnabled),
+		"PasswordRegisterEnabled":               strconv.FormatBool(PasswordRegisterEnabled),
+		"EmailVerificationEnabled":              strconv.FormatBool(EmailVerificationEnabled),
+		"GitHubOAuthEnabled":                    strconv.FormatBool(GitHubOAuthEnabled),
+		"WeChatAuthEnabled":                     strconv.FormatBool(WeChatAuthEnabled),
+		"SMTPServer":                            "",
+		"SMTPPort":                              strconv.Itoa(SMTPPort),
+		"SMTPAccount":                           "",
+		"SMTPToken":                             "",
+		"Notice":                                "",
+		"About":                                 "",
+		"Footer":                                Footer,
+		"HomePageLink":                          HomePageLink,
+		"SystemName":                            SystemName,
+		"ServerAddress":                         "",
+		"GitHubClientId":                        "",
+		"GitHubClientSecret":                    "",
+		"WeChatServerAddress":                   "",
+		"WeChatServerToken":                     "",
+		"WeChatAccountQRCodeImageURL":           "",
+		"AgentDiscoveryToken":                   "",
+		"AgentHeartbeatInterval":                strconv.Itoa(AgentHeartbeatInterval),
+		"AgentWebsocketUpgradeEnabled":          strconv.FormatBool(AgentWebsocketUpgradeEnabled),
+		"NodeOfflineThreshold":                  strconv.Itoa(int(NodeOfflineThreshold.Milliseconds())),
+		"AgentUpdateRepo":                       AgentUpdateRepo,
+		"GeoIPProvider":                         GeoIPProvider,
+		"DatabaseAutoCleanupEnabled":            strconv.FormatBool(DatabaseAutoCleanupEnabled),
+		"UptimeKumaEnabled":                     strconv.FormatBool(UptimeKumaEnabled),
+		"UptimeKumaUrl":                         UptimeKumaUrl,
+		"UptimeKumaUsername":                    UptimeKumaUsername,
+		"UptimeKumaPassword":                    UptimeKumaPassword,
+		"UptimeKumaMonitorScope":                UptimeKumaMonitorScope,
+		"UptimeKumaSelectedSites":               UptimeKumaSelectedSites,
+		"UptimeKumaSyncInterval":                strconv.Itoa(UptimeKumaSyncInterval),
+		"UptimeKumaInterval":                    strconv.Itoa(UptimeKumaInterval),
+		"UptimeKumaRetry":                       strconv.Itoa(UptimeKumaRetry),
+		"UptimeKumaRetryInterval":               strconv.Itoa(UptimeKumaRetryInterval),
+		"UptimeKumaTimeout":                     strconv.Itoa(UptimeKumaTimeout),
+		"DatabaseAutoCleanupRetentionDays":      strconv.Itoa(DatabaseAutoCleanupRetentionDays),
+		"OpenRestyDefaultServerReturnStatus":    strconv.Itoa(OpenRestyDefaultServerReturnStatus),
+		"OpenRestyWorkerProcesses":              OpenRestyWorkerProcesses,
+		"OpenRestyWorkerConnections":            strconv.Itoa(OpenRestyWorkerConnections),
+		"OpenRestyWorkerRlimitNofile":           strconv.Itoa(OpenRestyWorkerRlimitNofile),
+		"OpenRestyEventsUse":                    OpenRestyEventsUse,
+		"OpenRestyEventsMultiAcceptEnabled":     strconv.FormatBool(OpenRestyEventsMultiAcceptEnabled),
+		"OpenRestyKeepaliveTimeout":             strconv.Itoa(OpenRestyKeepaliveTimeout),
+		"OpenRestyKeepaliveRequests":            strconv.Itoa(OpenRestyKeepaliveRequests),
+		"OpenRestyClientHeaderTimeout":          strconv.Itoa(OpenRestyClientHeaderTimeout),
+		"OpenRestyClientBodyTimeout":            strconv.Itoa(OpenRestyClientBodyTimeout),
+		"OpenRestyClientMaxBodySize":            OpenRestyClientMaxBodySize,
+		"OpenRestyLargeClientHeaderBuffers":     OpenRestyLargeClientHeaderBuffers,
+		"OpenRestySendTimeout":                  strconv.Itoa(OpenRestySendTimeout),
+		"OpenRestyProxyConnectTimeout":          strconv.Itoa(OpenRestyProxyConnectTimeout),
+		"OpenRestyProxySendTimeout":             strconv.Itoa(OpenRestyProxySendTimeout),
+		"OpenRestyProxyReadTimeout":             strconv.Itoa(OpenRestyProxyReadTimeout),
+		"OpenRestyWebsocketEnabled":             strconv.FormatBool(OpenRestyWebsocketEnabled),
+		"OpenRestyHTTP3Enabled":                 strconv.FormatBool(OpenRestyHTTP3Enabled),
+		"OpenRestyProxyRequestBufferingEnabled": strconv.FormatBool(OpenRestyProxyRequestBufferingEnabled),
+		"OpenRestyProxyBufferingEnabled":        strconv.FormatBool(OpenRestyProxyBufferingEnabled),
+		"OpenRestyProxyBuffers":                 OpenRestyProxyBuffers,
+		"OpenRestyProxyBufferSize":              OpenRestyProxyBufferSize,
+		"OpenRestyProxyBusyBuffersSize":         OpenRestyProxyBusyBuffersSize,
+		"OpenRestyGzipEnabled":                  strconv.FormatBool(OpenRestyGzipEnabled),
+		"OpenRestyGzipMinLength":                strconv.Itoa(OpenRestyGzipMinLength),
+		"OpenRestyGzipCompLevel":                strconv.Itoa(OpenRestyGzipCompLevel),
+		"OpenRestyCacheEnabled":                 strconv.FormatBool(OpenRestyCacheEnabled),
+		"OpenRestyCachePath":                    OpenRestyCachePath,
+		"OpenRestyCacheLevels":                  OpenRestyCacheLevels,
+		"OpenRestyCacheInactive":                OpenRestyCacheInactive,
+		"OpenRestyCacheMaxSize":                 OpenRestyCacheMaxSize,
+		"OpenRestyCacheKeyTemplate":             OpenRestyCacheKeyTemplate,
+		"OpenRestyCacheLockEnabled":             strconv.FormatBool(OpenRestyCacheLockEnabled),
+		"OpenRestyCacheLockTimeout":             OpenRestyCacheLockTimeout,
+		"OpenRestyCacheUseStale":                OpenRestyCacheUseStale,
+		"OpenRestyMainConfigTemplate": OpenRestyMainConfigTemplate,
+	}
+}
+
+// InitOptionMap seeds defaults and overlays persisted options from of_options.
+func InitOptionMap(ctx context.Context) error {
+	OptionMapRWMutex.Lock()
+	OptionMap = DefaultOpenFlareOptions()
+	OptionMapRWMutex.Unlock()
+
+	options, err := ListOpenFlareOptions(ctx)
+	if err != nil {
+		return err
+	}
+	for _, option := range options {
+		applyOptionMap(option.Key, option.Value)
+	}
+	return nil
+}
+
+// ListOpenFlareOptions returns all persisted options.
+func ListOpenFlareOptions(ctx context.Context) ([]OpenFlareOption, error) {
+	var options []OpenFlareOption
+	if err := db.DB(ctx).Find(&options).Error; err != nil {
+		return nil, err
+	}
+	return options, nil
+}
+
+// UpdateOpenFlareOption updates a single option in DB and memory.
+func UpdateOpenFlareOption(ctx context.Context, key, value string) error {
+	return UpdateOpenFlareOptions(ctx, []OpenFlareOption{{Key: key, Value: value}})
+}
+
+// UpdateOpenFlareOptions batch-updates options in a transaction and refreshes OptionMap.
+func UpdateOpenFlareOptions(ctx context.Context, options []OpenFlareOption) error {
+	if len(options) == 0 {
+		return nil
+	}
+
+	if err := db.DB(ctx).Transaction(func(tx *gorm.DB) error {
+		for _, item := range options {
+			if item.Key == "UptimeKumaPassword" && strings.TrimSpace(item.Value) == "" {
+				continue
+			}
+			option := OpenFlareOption{Key: item.Key}
+			if err := tx.FirstOrCreate(&option, OpenFlareOption{Key: item.Key}).Error; err != nil {
+				return err
+			}
+			option.Value = item.Value
+			if err := tx.Save(&option).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	for _, item := range options {
+		if item.Key == "UptimeKumaPassword" && strings.TrimSpace(item.Value) == "" {
+			continue
+		}
+		applyOptionMap(item.Key, item.Value)
+	}
+	return nil
+}
+
+// OptionValue returns a snapshot value from OptionMap.
+func OptionValue(key string) string {
+	OptionMapRWMutex.RLock()
+	defer OptionMapRWMutex.RUnlock()
+	if OptionMap == nil {
+		return ""
+	}
+	return OptionMap[key]
+}
+
+// ResetOptionMapForTest clears in-memory option state for unit tests.
+func ResetOptionMapForTest() {
+	OptionMapRWMutex.Lock()
+	OptionMap = nil
+	OptionMapRWMutex.Unlock()
+}
+
+func applyOptionMap(key, value string) {
+	OptionMapRWMutex.Lock()
+	if OptionMap == nil {
+		OptionMap = make(map[string]string)
+	}
+	OptionMap[key] = value
+	if strings.HasSuffix(key, "Enabled") {
+		boolValue := value == "true"
+		switch key {
+		case "PasswordRegisterEnabled":
+			PasswordRegisterEnabled = boolValue
+		case "PasswordLoginEnabled":
+			PasswordLoginEnabled = boolValue
+		case "CapLoginEnabled":
+			CapLoginEnabled = boolValue
+		case "EmailVerificationEnabled":
+			EmailVerificationEnabled = boolValue
+		case "GitHubOAuthEnabled":
+			GitHubOAuthEnabled = boolValue
+		case "WeChatAuthEnabled":
+			WeChatAuthEnabled = boolValue
+		}
+	}
+	switch key {
+	case "SMTPServer":
+		SMTPServer = value
+	case "SMTPPort":
+		if intValue, err := strconv.Atoi(value); err == nil {
+			SMTPPort = intValue
+		}
+	case "SMTPAccount":
+		SMTPAccount = value
+	case "SMTPToken":
+		SMTPToken = value
+	case "ServerAddress":
+		ServerAddress = value
+	case "GitHubClientId":
+		GitHubClientId = value
+	case "GitHubClientSecret":
+		GitHubClientSecret = value
+	case "Footer":
+		Footer = value
+	case "HomePageLink":
+		HomePageLink = value
+	case "SystemName":
+		SystemName = value
+	case "WeChatServerAddress":
+		WeChatServerAddress = value
+	case "WeChatServerToken":
+		WeChatServerToken = value
+	case "WeChatAccountQRCodeImageURL":
+		WeChatAccountQRCodeImageURL = value
+	case "AgentDiscoveryToken":
+		AgentDiscoveryToken = value
+	case "AgentHeartbeatInterval":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			AgentHeartbeatInterval = v
+		}
+	case "AgentWebsocketUpgradeEnabled":
+		AgentWebsocketUpgradeEnabled = value == "true"
+	case "NodeOfflineThreshold":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			NodeOfflineThreshold = time.Duration(v) * time.Millisecond
+		}
+	case "AgentUpdateRepo":
+		if value != "" {
+			AgentUpdateRepo = value
+		}
+	case "GeoIPProvider":
+		GeoIPProvider = value
+	case "UptimeKumaEnabled":
+		UptimeKumaEnabled = value == "true"
+	case "UptimeKumaUrl":
+		UptimeKumaUrl = value
+	case "UptimeKumaUsername":
+		UptimeKumaUsername = value
+	case "UptimeKumaPassword":
+		UptimeKumaPassword = value
+	case "UptimeKumaMonitorScope":
+		UptimeKumaMonitorScope = value
+	case "UptimeKumaSelectedSites":
+		UptimeKumaSelectedSites = value
+	case "UptimeKumaSyncInterval":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			UptimeKumaSyncInterval = v
+		}
+	case "UptimeKumaInterval":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			UptimeKumaInterval = v
+		}
+	case "UptimeKumaRetry":
+		if v, err := strconv.Atoi(value); err == nil && v >= 0 {
+			UptimeKumaRetry = v
+		}
+	case "UptimeKumaRetryInterval":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			UptimeKumaRetryInterval = v
+		}
+	case "UptimeKumaTimeout":
+		if v, err := strconv.Atoi(value); err == nil && v > 0 {
+			UptimeKumaTimeout = v
+		}
+	case "DatabaseAutoCleanupEnabled":
+		DatabaseAutoCleanupEnabled = value == "true"
+	case "DatabaseAutoCleanupRetentionDays":
+		if v, err := strconv.Atoi(value); err == nil && v >= 1 {
+			DatabaseAutoCleanupRetentionDays = v
+		}
+	}
+	OptionMapRWMutex.Unlock()
+}

internal/model/openflare_origin.go

@@ -0,0 +1,133 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+)
+
+// Origin OpenFlare 源站实体。
+type Origin struct {
+	ID        uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	Name      string    `json:"name" gorm:"size:255;not null"`
+	Address   string    `json:"address" gorm:"uniqueIndex;size:255;not null"`
+	Remark    string    `json:"remark" gorm:"size:255"`
+	CreatedAt time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名。
+func (Origin) TableName() string {
+	return "of_origins"
+}
+
+// OriginRouteCount 源站关联的代理规则数量。
+type OriginRouteCount struct {
+	OriginID   uint  `json:"origin_id"`
+	RouteCount int64 `json:"route_count"`
+}
+
+// OriginProxyRoute 源站模块查询代理规则时使用的最小字段集。
+type OriginProxyRoute struct {
+	ID        uint      `gorm:"column:id;primaryKey"`
+	OriginID  *uint     `gorm:"column:origin_id"`
+	Domain    string    `gorm:"column:domain"`
+	OriginURL string    `gorm:"column:origin_url"`
+	Upstreams string    `gorm:"column:upstreams"`
+	Enabled   bool      `gorm:"column:enabled"`
+	UpdatedAt time.Time `gorm:"column:updated_at"`
+}
+
+// TableName 表名。
+func (OriginProxyRoute) TableName() string {
+	return "of_proxy_routes"
+}
+
+// HasProxyRoutesTable 判断代理规则表是否已迁移。
+func HasProxyRoutesTable(ctx context.Context) bool {
+	return db.DB(ctx).Migrator().HasTable(&OriginProxyRoute{})
+}
+
+// ListOrigins 列出全部源站。
+func ListOrigins(ctx context.Context) ([]Origin, error) {
+	var origins []Origin
+	if err := db.DB(ctx).Order("id desc").Find(&origins).Error; err != nil {
+		return nil, err
+	}
+	return origins, nil
+}
+
+// GetOriginByID 按 ID 查询源站。
+func GetOriginByID(ctx context.Context, id uint) (*Origin, error) {
+	var origin Origin
+	if err := db.DB(ctx).First(&origin, id).Error; err != nil {
+		return nil, err
+	}
+	return &origin, nil
+}
+
+// GetOriginByAddress 按地址查询源站。
+func GetOriginByAddress(ctx context.Context, address string) (*Origin, error) {
+	var origin Origin
+	if err := db.DB(ctx).Where("address = ?", address).First(&origin).Error; err != nil {
+		return nil, err
+	}
+	return &origin, nil
+}
+
+// CreateOriginRecord 创建源站。
+func CreateOriginRecord(ctx context.Context, origin *Origin) error {
+	return db.DB(ctx).Create(origin).Error
+}
+
+// SaveOrigin 保存源站。
+func SaveOrigin(ctx context.Context, origin *Origin) error {
+	return db.DB(ctx).Save(origin).Error
+}
+
+// DeleteOriginRecord 删除源站。
+func DeleteOriginRecord(ctx context.Context, id uint) error {
+	return db.DB(ctx).Delete(&Origin{}, id).Error
+}
+
+// ListOriginRouteCounts 统计各源站关联的代理规则数量。
+func ListOriginRouteCounts(ctx context.Context) ([]OriginRouteCount, error) {
+	if !HasProxyRoutesTable(ctx) {
+		return nil, nil
+	}
+	result := make([]OriginRouteCount, 0)
+	err := db.DB(ctx).Model(&OriginProxyRoute{}).
+		Select("origin_id, COUNT(*) AS route_count").
+		Where("origin_id IS NOT NULL").
+		Group("origin_id").
+		Scan(&result).Error
+	return result, err
+}
+
+// ListProxyRoutesByOriginID 列出源站关联的代理规则。
+func ListProxyRoutesByOriginID(ctx context.Context, originID uint) ([]OriginProxyRoute, error) {
+	if !HasProxyRoutesTable(ctx) {
+		return nil, nil
+	}
+	var routes []OriginProxyRoute
+	if err := db.DB(ctx).Where("origin_id = ?", originID).Order("id desc").Find(&routes).Error; err != nil {
+		return nil, err
+	}
+	return routes, nil
+}
+
+// CountProxyRoutesByOriginID 统计源站关联的代理规则数量。
+func CountProxyRoutesByOriginID(ctx context.Context, originID uint) (int64, error) {
+	if !HasProxyRoutesTable(ctx) {
+		return 0, nil
+	}
+	var count int64
+	if err := db.DB(ctx).Model(&OriginProxyRoute{}).Where("origin_id = ?", originID).Count(&count).Error; err != nil {
+		return 0, err
+	}
+	return count, nil
+}

internal/model/openflare_pages.go

@@ -0,0 +1,162 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+)
+
+const (
+	PagesDeploymentStatusUploaded = "uploaded"
+	PagesDeploymentStatusActive   = "active"
+)
+
+// PagesProject OpenFlare Pages 静态托管项目。
+type PagesProject struct {
+	ID                 uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	Name               string    `json:"name" gorm:"size:255;not null"`
+	Slug               string    `json:"slug" gorm:"uniqueIndex;size:128;not null"`
+	Description        string    `json:"description" gorm:"type:text;not null;default:''"`
+	Enabled            bool      `json:"enabled" gorm:"not null;default:true"`
+	SPAFallbackEnabled bool      `json:"spa_fallback_enabled" gorm:"not null;default:false"`
+	SPAFallbackPath    string    `json:"spa_fallback_path" gorm:"size:512;not null;default:'/index.html'"`
+	APIProxyEnabled    bool      `json:"api_proxy_enabled" gorm:"not null;default:false"`
+	APIProxyPath       string    `json:"api_proxy_path" gorm:"size:255;not null;default:''"`
+	APIProxyPass       string    `json:"api_proxy_pass" gorm:"size:2048;not null;default:''"`
+	APIProxyRewrite    string    `json:"api_proxy_rewrite" gorm:"size:255;not null;default:''"`
+	ActiveDeploymentID *uint     `json:"active_deployment_id" gorm:"index"`
+	RootDir            string    `json:"root_dir" gorm:"size:512;not null;default:''"`
+	EntryFile          string    `json:"entry_file" gorm:"size:512;not null;default:'index.html'"`
+	CreatedAt          time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt          time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名。
+func (PagesProject) TableName() string {
+	return "of_pages_projects"
+}
+
+// PagesDeployment OpenFlare Pages 不可变部署记录。
+type PagesDeployment struct {
+	ID               uint       `json:"id" gorm:"primaryKey;autoIncrement"`
+	ProjectID        uint       `json:"project_id" gorm:"not null;index"`
+	DeploymentNumber int        `json:"deployment_number" gorm:"not null"`
+	Checksum         string     `json:"checksum" gorm:"size:64;not null;index"`
+	Status           string     `json:"status" gorm:"size:32;not null;default:'uploaded';index"`
+	UploadID         uint64     `json:"upload_id,string" gorm:"not null;default:0;index"`
+	ArtifactPath     string     `json:"artifact_path,omitempty" gorm:"size:2048;not null;default:''"` // legacy only
+	FileCount        int        `json:"file_count" gorm:"not null;default:0"`
+	TotalSize        int64      `json:"total_size" gorm:"not null;default:0"`
+	CreatedBy        string     `json:"created_by" gorm:"size:64;not null;default:''"`
+	CreatedAt        time.Time  `json:"created_at" gorm:"autoCreateTime"`
+	ActivatedAt      *time.Time `json:"activated_at"`
+}
+
+// TableName 表名。
+func (PagesDeployment) TableName() string {
+	return "of_pages_deployments"
+}
+
+// PagesDeploymentFile OpenFlare Pages 部署文件清单。
+type PagesDeploymentFile struct {
+	ID           uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	DeploymentID uint      `json:"deployment_id" gorm:"not null;index"`
+	Path         string    `json:"path" gorm:"size:2048;not null"`
+	Size         int64     `json:"size" gorm:"not null;default:0"`
+	Checksum     string    `json:"checksum" gorm:"size:64;not null"`
+	CreatedAt    time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName 表名。
+func (PagesDeploymentFile) TableName() string {
+	return "of_pages_deployment_files"
+}
+
+// HasPagesProjectsTable 判断 Pages 项目表是否已迁移。
+func HasPagesProjectsTable(ctx context.Context) bool {
+	return db.DB(ctx).Migrator().HasTable(&PagesProject{})
+}
+
+// ListPagesProjects 列出全部 Pages 项目。
+func ListPagesProjects(ctx context.Context) ([]PagesProject, error) {
+	var projects []PagesProject
+	if err := db.DB(ctx).Order("id desc").Find(&projects).Error; err != nil {
+		return nil, err
+	}
+	return projects, nil
+}
+
+// GetPagesProjectByID 按 ID 查询 Pages 项目。
+func GetPagesProjectByID(ctx context.Context, id uint) (*PagesProject, error) {
+	var project PagesProject
+	if err := db.DB(ctx).First(&project, id).Error; err != nil {
+		return nil, err
+	}
+	return &project, nil
+}
+
+// GetPagesProjectBySlug 按 slug 查询 Pages 项目。
+func GetPagesProjectBySlug(ctx context.Context, slug string) (*PagesProject, error) {
+	var project PagesProject
+	if err := db.DB(ctx).Where("slug = ?", slug).First(&project).Error; err != nil {
+		return nil, err
+	}
+	return &project, nil
+}
+
+// CreatePagesProjectRecord 创建 Pages 项目。
+func CreatePagesProjectRecord(ctx context.Context, project *PagesProject) error {
+	return db.DB(ctx).Create(project).Error
+}
+
+// ListPagesDeployments 列出项目的全部部署。
+func ListPagesDeployments(ctx context.Context, projectID uint) ([]PagesDeployment, error) {
+	var deployments []PagesDeployment
+	if err := db.DB(ctx).Where("project_id = ?", projectID).Order("id desc").Find(&deployments).Error; err != nil {
+		return nil, err
+	}
+	return deployments, nil
+}
+
+// GetPagesDeploymentByID 按 ID 查询 Pages 部署。
+func GetPagesDeploymentByID(ctx context.Context, id uint) (*PagesDeployment, error) {
+	var deployment PagesDeployment
+	if err := db.DB(ctx).First(&deployment, id).Error; err != nil {
+		return nil, err
+	}
+	return &deployment, nil
+}
+
+// ListPagesDeploymentFiles 列出部署文件清单。
+func ListPagesDeploymentFiles(ctx context.Context, deploymentID uint) ([]PagesDeploymentFile, error) {
+	var files []PagesDeploymentFile
+	if err := db.DB(ctx).Where("deployment_id = ?", deploymentID).Order("path asc").Find(&files).Error; err != nil {
+		return nil, err
+	}
+	return files, nil
+}
+
+// CountPagesDeploymentsByProjectID 统计项目部署数量。
+func CountPagesDeploymentsByProjectID(ctx context.Context, projectID uint) (int64, error) {
+	var count int64
+	if err := db.DB(ctx).Model(&PagesDeployment{}).Where("project_id = ?", projectID).Count(&count).Error; err != nil {
+		return 0, err
+	}
+	return count, nil
+}
+
+// CountProxyRoutesByPagesProjectID 统计引用 Pages 项目的代理规则数量。
+func CountProxyRoutesByPagesProjectID(ctx context.Context, projectID uint) (int64, error) {
+	if !HasProxyRoutesTable(ctx) {
+		return 0, nil
+	}
+	var count int64
+	if err := db.DB(ctx).Model(&ProxyRoute{}).Where("pages_project_id = ?", projectID).Count(&count).Error; err != nil {
+		return 0, err
+	}
+	return count, nil
+}

internal/model/openflare_proxy_route.go

@@ -0,0 +1,115 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+)
+
+// ProxyRoute OpenFlare 代理规则实体。
+type ProxyRoute struct {
+	ID                   uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	SiteName             string    `json:"site_name" gorm:"size:255;not null;default:''"`
+	Domain               string    `json:"domain" gorm:"uniqueIndex;size:255;not null"`
+	Domains              string    `json:"domains" gorm:"type:text;not null;default:'[]'"`
+	OriginID             *uint     `json:"origin_id" gorm:"index"`
+	OriginURL            string    `json:"origin_url" gorm:"size:2048;not null"`
+	OriginHost           string    `json:"origin_host" gorm:"size:255"`
+	Upstreams            string    `json:"upstreams" gorm:"type:text;not null;default:'[]'"`
+	Enabled              bool      `json:"enabled" gorm:"not null;default:true"`
+	EnableHTTPS          bool      `json:"enable_https" gorm:"column:enable_https;not null;default:false"`
+	CertID               *uint     `json:"cert_id"`
+	CertIDs              string    `json:"cert_ids" gorm:"type:text;not null;default:'[]'"`
+	DomainCertIDs        string    `json:"domain_cert_ids" gorm:"type:text;not null;default:'[]'"`
+	RedirectHTTP         bool      `json:"redirect_http" gorm:"not null;default:false"`
+	LimitConnPerServer   int       `json:"limit_conn_per_server" gorm:"not null;default:0"`
+	LimitConnPerIP       int       `json:"limit_conn_per_ip" gorm:"not null;default:0"`
+	LimitRate            string    `json:"limit_rate" gorm:"size:32;not null;default:''"`
+	CacheEnabled         bool      `json:"cache_enabled" gorm:"not null;default:false"`
+	CachePolicy          string    `json:"cache_policy" gorm:"size:32;not null;default:''"`
+	CacheRules           string    `json:"cache_rules" gorm:"type:text;not null;default:'[]'"`
+	CustomHeaders        string    `json:"custom_headers" gorm:"type:text;not null;default:'[]'"`
+	BasicAuthEnabled     bool      `json:"basic_auth_enabled" gorm:"not null;default:false"`
+	BasicAuthUsername    string    `json:"basic_auth_username" gorm:"size:255;not null;default:''"`
+	BasicAuthPassword    string    `json:"basic_auth_password" gorm:"size:255;not null;default:''"`
+	Remark               string    `json:"remark" gorm:"size:255"`
+	UpstreamType         string    `json:"upstream_type" gorm:"size:32;not null;default:'direct'"`
+	TunnelNodeID         *uint     `json:"tunnel_node_id" gorm:"index"`
+	TunnelTargetAddr     string    `json:"tunnel_target_addr" gorm:"size:512"`
+	TunnelTargetProtocol string    `json:"tunnel_target_protocol" gorm:"size:16"`
+	PagesProjectID       *uint     `json:"pages_project_id" gorm:"index"`
+	CreatedAt            time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt            time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名。
+func (ProxyRoute) TableName() string {
+	return "of_proxy_routes"
+}
+
+// ListProxyRoutes 列出全部代理规则。
+func ListProxyRoutes(ctx context.Context) ([]*ProxyRoute, error) {
+	var routes []*ProxyRoute
+	if err := db.DB(ctx).Order("id desc").Find(&routes).Error; err != nil {
+		return nil, err
+	}
+	return routes, nil
+}
+
+// GetProxyRouteByID 按 ID 查询代理规则。
+func GetProxyRouteByID(ctx context.Context, id uint) (*ProxyRoute, error) {
+	var route ProxyRoute
+	if err := db.DB(ctx).First(&route, id).Error; err != nil {
+		return nil, err
+	}
+	return &route, nil
+}
+
+// CreateProxyRouteRecord 创建代理规则。
+func CreateProxyRouteRecord(ctx context.Context, route *ProxyRoute) error {
+	return db.DB(ctx).Create(route).Error
+}
+
+// UpdateProxyRouteRecord 更新代理规则。
+func UpdateProxyRouteRecord(ctx context.Context, route *ProxyRoute) error {
+	return db.DB(ctx).Model(&ProxyRoute{}).Where("id = ?", route.ID).Updates(map[string]any{
+		"site_name":              route.SiteName,
+		"domain":                 route.Domain,
+		"domains":                route.Domains,
+		"origin_id":              route.OriginID,
+		"origin_url":             route.OriginURL,
+		"origin_host":            route.OriginHost,
+		"upstreams":              route.Upstreams,
+		"enabled":                route.Enabled,
+		"enable_https":           route.EnableHTTPS,
+		"cert_id":                route.CertID,
+		"cert_ids":               route.CertIDs,
+		"domain_cert_ids":        route.DomainCertIDs,
+		"redirect_http":          route.RedirectHTTP,
+		"limit_conn_per_server":  route.LimitConnPerServer,
+		"limit_conn_per_ip":      route.LimitConnPerIP,
+		"limit_rate":             route.LimitRate,
+		"cache_enabled":          route.CacheEnabled,
+		"cache_policy":           route.CachePolicy,
+		"cache_rules":            route.CacheRules,
+		"custom_headers":         route.CustomHeaders,
+		"basic_auth_enabled":     route.BasicAuthEnabled,
+		"basic_auth_username":    route.BasicAuthUsername,
+		"basic_auth_password":    route.BasicAuthPassword,
+		"remark":                 route.Remark,
+		"upstream_type":          route.UpstreamType,
+		"tunnel_node_id":         route.TunnelNodeID,
+		"tunnel_target_addr":     route.TunnelTargetAddr,
+		"tunnel_target_protocol": route.TunnelTargetProtocol,
+		"pages_project_id":       route.PagesProjectID,
+	}).Error
+}
+
+// DeleteProxyRouteRecord 删除代理规则。
+func DeleteProxyRouteRecord(ctx context.Context, id uint) error {
+	return db.DB(ctx).Delete(&ProxyRoute{}, id).Error
+}

internal/model/openflare_tls.go

@@ -0,0 +1,139 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+)
+
+// TLSCertificate OpenFlare TLS 证书实体。
+type TLSCertificate struct {
+	ID            uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	Name          string    `json:"name" gorm:"uniqueIndex;size:255;not null"`
+	CertPEM       string    `json:"-" gorm:"type:text;not null"`
+	KeyPEM        string    `json:"-" gorm:"type:text;not null"`
+	NotBefore     time.Time `json:"not_before"`
+	NotAfter      time.Time `json:"not_after"`
+	Remark        string    `json:"remark" gorm:"size:255"`
+	Provider      string    `json:"provider" gorm:"size:64;default:upload"`
+	AcmeAccountID uint      `json:"acme_account_id"`
+	DnsAccountID  uint      `json:"dns_account_id"`
+	KeyAlgorithm  string    `json:"key_algorithm" gorm:"size:32"`
+	AutoRenew     bool      `json:"auto_renew"`
+	PrimaryDomain string    `json:"primary_domain" gorm:"size:255"`
+	OtherDomains  string    `json:"other_domains" gorm:"type:text"`
+	DisableCNAME  bool      `json:"disable_cname"`
+	SkipDNS       bool      `json:"skip_dns"`
+	DNS1          string    `json:"dns1" gorm:"size:128"`
+	DNS2          string    `json:"dns2" gorm:"size:128"`
+	ApplyStatus   string    `json:"apply_status" gorm:"size:64;default:ready"`
+	ApplyMessage  string    `json:"apply_message" gorm:"type:text"`
+	CreatedAt     time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt     time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名。
+func (TLSCertificate) TableName() string {
+	return "of_tls_certificates"
+}
+
+// TLSProxyRouteRef 删除证书时检查代理规则引用的最小字段集。
+type TLSProxyRouteRef struct {
+	ID            uint   `gorm:"column:id;primaryKey"`
+	CertID        *uint  `gorm:"column:cert_id"`
+	CertIDs       string `gorm:"column:cert_ids"`
+	DomainCertIDs string `gorm:"column:domain_cert_ids"`
+}
+
+// TableName 表名。
+func (TLSProxyRouteRef) TableName() string {
+	return "of_proxy_routes"
+}
+
+// HasTLSProxyRoutesTable 判断代理规则表是否已迁移。
+func HasTLSProxyRoutesTable(ctx context.Context) bool {
+	return db.DB(ctx).Migrator().HasTable(&TLSProxyRouteRef{})
+}
+
+// ListTLSCertificates 列出全部证书（不含 PEM 敏感字段的 JSON 暴露由 struct tag 控制）。
+func ListTLSCertificates(ctx context.Context) ([]TLSCertificate, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var certificates []TLSCertificate
+	if err := conn.Order("id desc").Find(&certificates).Error; err != nil {
+		return nil, err
+	}
+	return certificates, nil
+}
+
+// GetTLSCertificateByID 按 ID 查询证书。
+func GetTLSCertificateByID(ctx context.Context, id uint) (*TLSCertificate, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	var certificate TLSCertificate
+	if err := conn.First(&certificate, id).Error; err != nil {
+		return nil, err
+	}
+	return &certificate, nil
+}
+
+// CreateTLSCertificateRecord 创建证书记录。
+func CreateTLSCertificateRecord(ctx context.Context, certificate *TLSCertificate) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Create(certificate).Error
+}
+
+// SaveTLSCertificate 保存证书记录。
+func SaveTLSCertificate(ctx context.Context, certificate *TLSCertificate) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Save(certificate).Error
+}
+
+// DeleteTLSCertificateRecord 删除证书记录。
+func DeleteTLSCertificateRecord(ctx context.Context, id uint) error {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return errors.New(errDatabaseNotInitialized)
+	}
+	return conn.Delete(&TLSCertificate{}, id).Error
+}
+
+// CountTLSCertificatesByDNSAccountID 统计引用指定 DNS 账号的证书数量。
+func CountTLSCertificatesByDNSAccountID(ctx context.Context, dnsAccountID uint) (int64, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return 0, errors.New(errDatabaseNotInitialized)
+	}
+	var count int64
+	if err := conn.Model(&TLSCertificate{}).Where("dns_account_id = ?", dnsAccountID).Count(&count).Error; err != nil {
+		return 0, err
+	}
+	return count, nil
+}
+
+// ListTLSProxyRouteRefs 列出代理规则证书引用字段。
+func ListTLSProxyRouteRefs(ctx context.Context) ([]TLSProxyRouteRef, error) {
+	if !HasTLSProxyRoutesTable(ctx) {
+		return nil, nil
+	}
+	var routes []TLSProxyRouteRef
+	if err := db.DB(ctx).Order("id asc").Find(&routes).Error; err != nil {
+		return nil, err
+	}
+	return routes, nil
+}

internal/model/openflare_waf.go

@@ -0,0 +1,392 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"gorm.io/gorm"
+)
+
+// OpenFlareWAFRuleGroup stores a WAF rule group.
+type OpenFlareWAFRuleGroup struct {
+	ID                uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	Name              string    `json:"name" gorm:"size:255;not null"`
+	Enabled           bool      `json:"enabled" gorm:"not null;default:true"`
+	IsGlobal          bool      `json:"is_global" gorm:"not null;default:false;index"`
+	BlockStatusCode   int       `json:"block_status_code" gorm:"not null;default:418"`
+	BlockResponseBody string    `json:"block_response_body" gorm:"type:text;not null;default:''"`
+	IPWhitelist       string    `json:"ip_whitelist" gorm:"type:text;not null;default:'[]'"`
+	IPBlacklist       string    `json:"ip_blacklist" gorm:"type:text;not null;default:'[]'"`
+	IPWhitelistGroups string    `json:"ip_whitelist_group_ids" gorm:"column:ip_whitelist_groups;type:text;not null;default:'[]'"`
+	IPBlacklistGroups string    `json:"ip_blacklist_group_ids" gorm:"column:ip_blacklist_groups;type:text;not null;default:'[]'"`
+	CountryWhitelist  string    `json:"country_whitelist" gorm:"type:text;not null;default:'[]'"`
+	CountryBlacklist  string    `json:"country_blacklist" gorm:"type:text;not null;default:'[]'"`
+	RegionWhitelist   string    `json:"region_whitelist" gorm:"type:text;not null;default:'[]'"`
+	RegionBlacklist   string    `json:"region_blacklist" gorm:"type:text;not null;default:'[]'"`
+	PoWEnabled        bool      `json:"pow_enabled" gorm:"column:pow_enabled;not null;default:false"`
+	PoWConfig         string    `json:"pow_config" gorm:"column:pow_config;type:text;not null;default:'{}'"`
+	Remark            string    `json:"remark" gorm:"size:255"`
+	CreatedAt         time.Time `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt         time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareWAFRuleGroup) TableName() string {
+	return "of_waf_rule_groups"
+}
+
+// OpenFlareWAFIPGroup stores a WAF IP group.
+type OpenFlareWAFIPGroup struct {
+	ID                      uint       `json:"id" gorm:"primaryKey;autoIncrement"`
+	Name                    string     `json:"name" gorm:"size:255;not null"`
+	Type                    string     `json:"type" gorm:"size:32;not null;index"`
+	Enabled                 bool       `json:"enabled" gorm:"not null;default:true"`
+	IPList                  string     `json:"ip_list" gorm:"type:text;not null;default:'[]'"`
+	AutoConfig              string     `json:"auto_config" gorm:"type:text;not null;default:'{}'"`
+	ExtIPs                  string     `json:"ext_ips" gorm:"type:text;not null;default:'[]'"`
+	SubscriptionURL         string     `json:"subscription_url" gorm:"size:2048;not null;default:''"`
+	SubscriptionFormat      string     `json:"subscription_format" gorm:"size:32;not null;default:'text'"`
+	SubscriptionMappingRule string     `json:"subscription_mapping_rule" gorm:"size:255;not null;default:''"`
+	SyncIntervalMinutes     int        `json:"sync_interval_minutes" gorm:"not null;default:1440"`
+	LastSyncedAt            *time.Time `json:"last_synced_at"`
+	NextSyncAt              *time.Time `json:"next_sync_at" gorm:"index"`
+	LastSyncStatus          string     `json:"last_sync_status" gorm:"size:32;not null;default:''"`
+	LastSyncMessage         string     `json:"last_sync_message" gorm:"type:text;not null;default:''"`
+	Remark                  string     `json:"remark" gorm:"size:255"`
+	CreatedAt               time.Time  `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt               time.Time  `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareWAFIPGroup) TableName() string {
+	return "of_waf_ip_groups"
+}
+
+// OpenFlareWAFRuleGroupBinding binds a rule group to a proxy route.
+type OpenFlareWAFRuleGroupBinding struct {
+	ID           uint      `json:"id" gorm:"primaryKey;autoIncrement"`
+	RuleGroupID  uint      `json:"rule_group_id" gorm:"not null;uniqueIndex:idx_of_waf_group_route"`
+	ProxyRouteID uint      `json:"proxy_route_id" gorm:"not null;uniqueIndex:idx_of_waf_group_route;index"`
+	CreatedAt    time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName returns the GORM table name.
+func (OpenFlareWAFRuleGroupBinding) TableName() string {
+	return "of_waf_rule_group_bindings"
+}
+
+func wafDB(ctx context.Context) (*gorm.DB, error) {
+	conn := db.DB(ctx)
+	if conn == nil {
+		return nil, errors.New(errDatabaseNotInitialized)
+	}
+	return conn, nil
+}
+
+// ListOpenFlareWAFRuleGroups returns all rule groups.
+func ListOpenFlareWAFRuleGroups(ctx context.Context) ([]*OpenFlareWAFRuleGroup, error) {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var groups []*OpenFlareWAFRuleGroup
+	if err = conn.Order("is_global desc").Order("id asc").Find(&groups).Error; err != nil {
+		return nil, err
+	}
+	return groups, nil
+}
+
+// GetOpenFlareWAFRuleGroupByID returns a rule group by id.
+func GetOpenFlareWAFRuleGroupByID(ctx context.Context, id uint) (*OpenFlareWAFRuleGroup, error) {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var group OpenFlareWAFRuleGroup
+	if err = conn.First(&group, id).Error; err != nil {
+		return nil, err
+	}
+	return &group, nil
+}
+
+// GetGlobalOpenFlareWAFRuleGroup returns the global rule group if present.
+func GetGlobalOpenFlareWAFRuleGroup(ctx context.Context) (*OpenFlareWAFRuleGroup, error) {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var group OpenFlareWAFRuleGroup
+	if err = conn.Where("is_global = ?", true).Order("id asc").First(&group).Error; err != nil {
+		return nil, err
+	}
+	return &group, nil
+}
+
+// CreateOpenFlareWAFRuleGroup inserts a rule group.
+func CreateOpenFlareWAFRuleGroup(ctx context.Context, group *OpenFlareWAFRuleGroup) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Create(group).Error
+}
+
+// UpdateOpenFlareWAFRuleGroup updates mutable rule group fields.
+func UpdateOpenFlareWAFRuleGroup(ctx context.Context, group *OpenFlareWAFRuleGroup) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Model(&OpenFlareWAFRuleGroup{}).Where("id = ?", group.ID).Updates(map[string]any{
+		"name":                group.Name,
+		"enabled":             group.Enabled,
+		"is_global":           group.IsGlobal,
+		"block_status_code":   group.BlockStatusCode,
+		"block_response_body": group.BlockResponseBody,
+		"ip_whitelist":        group.IPWhitelist,
+		"ip_blacklist":        group.IPBlacklist,
+		"ip_whitelist_groups": group.IPWhitelistGroups,
+		"ip_blacklist_groups": group.IPBlacklistGroups,
+		"country_whitelist":   group.CountryWhitelist,
+		"country_blacklist":   group.CountryBlacklist,
+		"region_whitelist":    group.RegionWhitelist,
+		"region_blacklist":    group.RegionBlacklist,
+		"pow_enabled":         group.PoWEnabled,
+		"pow_config":          group.PoWConfig,
+		"remark":              group.Remark,
+	}).Error
+}
+
+// DeleteOpenFlareWAFRuleGroup removes a rule group.
+func DeleteOpenFlareWAFRuleGroup(ctx context.Context, id uint) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Delete(&OpenFlareWAFRuleGroup{}, id).Error
+}
+
+// ListOpenFlareWAFIPGroups returns all IP groups.
+func ListOpenFlareWAFIPGroups(ctx context.Context) ([]*OpenFlareWAFIPGroup, error) {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var groups []*OpenFlareWAFIPGroup
+	if err = conn.Order("type asc").Order("id asc").Find(&groups).Error; err != nil {
+		return nil, err
+	}
+	return groups, nil
+}
+
+// ListOpenFlareWAFIPGroupsByIDs returns IP groups for the given ids.
+func ListOpenFlareWAFIPGroupsByIDs(ctx context.Context, ids []uint) ([]*OpenFlareWAFIPGroup, error) {
+	if len(ids) == 0 {
+		return []*OpenFlareWAFIPGroup{}, nil
+	}
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var groups []*OpenFlareWAFIPGroup
+	if err = conn.Where("id IN ?", ids).Find(&groups).Error; err != nil {
+		return nil, err
+	}
+	return groups, nil
+}
+
+// GetOpenFlareWAFIPGroupByID returns an IP group by id.
+func GetOpenFlareWAFIPGroupByID(ctx context.Context, id uint) (*OpenFlareWAFIPGroup, error) {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var group OpenFlareWAFIPGroup
+	if err = conn.First(&group, id).Error; err != nil {
+		return nil, err
+	}
+	return &group, nil
+}
+
+// CreateOpenFlareWAFIPGroup inserts an IP group.
+func CreateOpenFlareWAFIPGroup(ctx context.Context, group *OpenFlareWAFIPGroup) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Create(group).Error
+}
+
+// UpdateOpenFlareWAFIPGroup updates mutable IP group fields.
+func UpdateOpenFlareWAFIPGroup(ctx context.Context, group *OpenFlareWAFIPGroup) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Model(&OpenFlareWAFIPGroup{}).Where("id = ?", group.ID).Updates(map[string]any{
+		"name":                      group.Name,
+		"type":                      group.Type,
+		"enabled":                   group.Enabled,
+		"ip_list":                   group.IPList,
+		"auto_config":               group.AutoConfig,
+		"ext_ips":                   group.ExtIPs,
+		"subscription_url":          group.SubscriptionURL,
+		"subscription_format":       group.SubscriptionFormat,
+		"subscription_mapping_rule": group.SubscriptionMappingRule,
+		"sync_interval_minutes":     group.SyncIntervalMinutes,
+		"next_sync_at":              group.NextSyncAt,
+		"last_sync_status":          group.LastSyncStatus,
+		"last_sync_message":         group.LastSyncMessage,
+		"remark":                    group.Remark,
+	}).Error
+}
+
+// ListDueOpenFlareWAFIPGroups returns enabled automatic/subscription groups due for sync.
+func ListDueOpenFlareWAFIPGroups(ctx context.Context, now time.Time) ([]*OpenFlareWAFIPGroup, error) {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var groups []*OpenFlareWAFIPGroup
+	err = conn.Where(
+		"enabled = ? AND (type = ? OR (type = ? AND subscription_url <> '')) AND (next_sync_at IS NULL OR next_sync_at <= ?)",
+		true, "automatic", "subscription", now,
+	).Order("id asc").Find(&groups).Error
+	return groups, err
+}
+
+// UpdateOpenFlareWAFIPGroupSyncResult persists IP group sync outcome fields.
+func UpdateOpenFlareWAFIPGroupSyncResult(ctx context.Context, group *OpenFlareWAFIPGroup) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Model(&OpenFlareWAFIPGroup{}).Where("id = ?", group.ID).Updates(map[string]any{
+		"ip_list":             group.IPList,
+		"ext_ips":             group.ExtIPs,
+		"last_synced_at":      group.LastSyncedAt,
+		"next_sync_at":        group.NextSyncAt,
+		"last_sync_status":    group.LastSyncStatus,
+		"last_sync_message":   group.LastSyncMessage,
+		"subscription_format": group.SubscriptionFormat,
+	}).Error
+}
+
+// DeleteOpenFlareWAFIPGroup removes an IP group.
+func DeleteOpenFlareWAFIPGroup(ctx context.Context, id uint) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Delete(&OpenFlareWAFIPGroup{}, id).Error
+}
+
+// ListOpenFlareWAFRuleGroupBindings returns all bindings.
+func ListOpenFlareWAFRuleGroupBindings(ctx context.Context) ([]OpenFlareWAFRuleGroupBinding, error) {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var bindings []OpenFlareWAFRuleGroupBinding
+	if err = conn.Order("rule_group_id asc").Order("proxy_route_id asc").Find(&bindings).Error; err != nil {
+		return nil, err
+	}
+	return bindings, nil
+}
+
+// ListOpenFlareWAFRuleGroupBindingsByRouteID returns bindings for a proxy route.
+func ListOpenFlareWAFRuleGroupBindingsByRouteID(ctx context.Context, routeID uint) ([]OpenFlareWAFRuleGroupBinding, error) {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var bindings []OpenFlareWAFRuleGroupBinding
+	if err = conn.Where("proxy_route_id = ?", routeID).Order("rule_group_id asc").Find(&bindings).Error; err != nil {
+		return nil, err
+	}
+	return bindings, nil
+}
+
+// ReplaceOpenFlareWAFRuleGroupBindings replaces bindings for a rule group.
+func ReplaceOpenFlareWAFRuleGroupBindings(ctx context.Context, groupID uint, routeIDs []uint) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Transaction(func(tx *gorm.DB) error {
+		if err = tx.Where("rule_group_id = ?", groupID).Delete(&OpenFlareWAFRuleGroupBinding{}).Error; err != nil {
+			return err
+		}
+		for _, routeID := range routeIDs {
+			binding := OpenFlareWAFRuleGroupBinding{RuleGroupID: groupID, ProxyRouteID: routeID}
+			if err = tx.Create(&binding).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
+// ReplaceOpenFlareWAFSiteRuleGroupBindings replaces bindings for a proxy route.
+func ReplaceOpenFlareWAFSiteRuleGroupBindings(ctx context.Context, routeID uint, groupIDs []uint) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Transaction(func(tx *gorm.DB) error {
+		if err = tx.Where("proxy_route_id = ?", routeID).Delete(&OpenFlareWAFRuleGroupBinding{}).Error; err != nil {
+			return err
+		}
+		for _, groupID := range groupIDs {
+			binding := OpenFlareWAFRuleGroupBinding{RuleGroupID: groupID, ProxyRouteID: routeID}
+			if err = tx.Create(&binding).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
+// DeleteOpenFlareWAFRuleGroupBindingsByGroupID removes bindings for a rule group.
+func DeleteOpenFlareWAFRuleGroupBindingsByGroupID(ctx context.Context, groupID uint) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Where("rule_group_id = ?", groupID).Delete(&OpenFlareWAFRuleGroupBinding{}).Error
+}
+
+// DeleteOpenFlareWAFRuleGroupWithBindings removes a rule group and its bindings.
+func DeleteOpenFlareWAFRuleGroupWithBindings(ctx context.Context, groupID uint) error {
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return err
+	}
+	return conn.Transaction(func(tx *gorm.DB) error {
+		if err = tx.Where("rule_group_id = ?", groupID).Delete(&OpenFlareWAFRuleGroupBinding{}).Error; err != nil {
+			return err
+		}
+		return tx.Delete(&OpenFlareWAFRuleGroup{}, groupID).Error
+	})
+}
+
+// GetOpenFlareProxyRouteByID returns a proxy route by id when the table exists.
+func GetOpenFlareProxyRouteByID(ctx context.Context, id uint) (*OriginProxyRoute, error) {
+	if !HasProxyRoutesTable(ctx) {
+		return nil, gorm.ErrRecordNotFound
+	}
+	conn, err := wafDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var route OriginProxyRoute
+	if err = conn.First(&route, id).Error; err != nil {
+		return nil, err
+	}
+	return &route, nil
+}

internal/model/push_channel.go

@@ -0,0 +1,99 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"encoding/json"
+	"errors"
+	"regexp"
+	"strings"
+	"time"
+)
+
+const (
+	// TypeCustom 自定义消息通道类型
+	TypeCustom = "custom"
+	// TypeEmail 邮件推送消息通道类型
+	TypeEmail = "email"
+	// TypeTelegram 电报机器人推送消息通道类型
+	TypeTelegram = "telegram"
+)
+
+// PushChannel 消息通道模型
+type PushChannel struct {
+	ID          uint64    `json:"id" gorm:"primaryKey;autoIncrement"`
+	Name        string    `json:"name" gorm:"uniqueIndex;size:80;not null"`      // 通道名称，仅英文字母和下划线，唯一
+	Description string    `json:"description" gorm:"size:255"`                   // 备注
+	Type        string    `json:"type" gorm:"size:50;not null;default:'custom'"` // 通道类型：custom, lark, email
+	Token       string    `json:"token" gorm:"size:100"`                         // 鉴权令牌或发信用户名等
+	URL         string    `json:"url" gorm:"type:text;not null"`                 // 请求地址，HTTPS 协议或 SMTP 地址
+	Other       string    `json:"other" gorm:"type:text;not null"`               // 请求体/SMTP 密码等
+	Enabled     bool      `json:"enabled" gorm:"index;not null;default:true"`    // 通道是否启用
+	CreatedAt   time.Time `json:"created_at" gorm:"autoCreateTime;index"`
+	UpdatedAt   time.Time `json:"updated_at" gorm:"autoUpdateTime;index"`
+}
+
+// TableName 指定 GORM 表名
+func (PushChannel) TableName() string {
+	return "w_push_channels"
+}
+
+var nameRegex = regexp.MustCompile(`^[a-zA-Z0-9_]+$`)
+
+// Validate 参数合法性与 JSON 格式校验
+func (pc *PushChannel) Validate() error {
+	pc.Name = strings.TrimSpace(pc.Name)
+	pc.URL = strings.TrimSpace(pc.URL)
+	pc.Other = strings.TrimSpace(pc.Other)
+	pc.Type = strings.TrimSpace(pc.Type)
+
+	if pc.Type == "" {
+		pc.Type = TypeCustom
+	}
+
+	if pc.Type == TypeTelegram && pc.URL == "" {
+		pc.URL = "https://api.telegram.org"
+	}
+
+	if pc.Name == "" {
+		return errors.New("channel name is required")
+	}
+	if !nameRegex.MatchString(pc.Name) {
+		return errors.New("channel name can only contain letters, numbers, and underscores")
+	}
+	if pc.Type != TypeEmail && pc.URL == "" {
+		return errors.New("request URL/address is required")
+	}
+
+	if pc.Type != TypeEmail && !strings.HasPrefix(pc.URL, "https://") {
+		return errors.New("request URL must use HTTPS protocol for security reasons")
+	}
+
+	switch pc.Type {
+	case TypeCustom:
+		if pc.Other == "" {
+			return errors.New("payload schema (request body) is required")
+		}
+		return validateJSON(pc.Other)
+	case TypeEmail:
+		// Email channel SMTP configs fall back to global settings, so they are not required to be filled.
+	case TypeTelegram:
+		if pc.Token == "" {
+			return errors.New("telegram bot token is required")
+		}
+	}
+	return nil
+}
+
+func validateJSON(s string) error {
+	var jsonTest map[string]any
+	if err := json.Unmarshal([]byte(s), &jsonTest); err == nil {
+		return nil
+	}
+	var jsonArr []any
+	if err := json.Unmarshal([]byte(s), &jsonArr); err == nil {
+		return nil
+	}
+	return errors.New("payload schema must be a valid JSON format")
+}

internal/model/push_event.go

@@ -0,0 +1,50 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"errors"
+	"strings"
+	"time"
+)
+
+// PushEvent 系统通知事件模型
+type PushEvent struct {
+	ID        uint64    `json:"id" gorm:"primaryKey;autoIncrement"`
+	EventKey  string    `json:"event_key" gorm:"uniqueIndex;size:80;not null"`       // 如 admin_login
+	Name      string    `json:"name" gorm:"size:100;not null"`                       // 如 管理员登录
+	TaskType  string    `json:"task_type" gorm:"size:100;index;not null;default:''"` // 关联的异步任务类型
+	Channels  []string  `json:"channels" gorm:"type:text;serializer:json;not null"`  // 推送渠道列表，如 ["lark"]
+	Targets   []string  `json:"targets" gorm:"type:text;serializer:json;not null"`   // 推送目标用户/邮箱列表
+	Template  string    `json:"template" gorm:"type:text;not null"`                  // 消息模板 JSON
+	Enabled   bool      `json:"enabled" gorm:"index;not null;default:false"`         // 是否启用
+	CreatedAt time.Time `json:"created_at" gorm:"autoCreateTime;index"`
+	UpdatedAt time.Time `json:"updated_at" gorm:"autoUpdateTime;index"`
+}
+
+// TableName 指定 GORM 表名
+func (PushEvent) TableName() string {
+	return "w_push_events"
+}
+
+// Validate 基础校验
+func (pe *PushEvent) Validate() error {
+	pe.EventKey = strings.TrimSpace(pe.EventKey)
+	pe.Name = strings.TrimSpace(pe.Name)
+	pe.Template = strings.TrimSpace(pe.Template)
+
+	if pe.EventKey == "" {
+		return errors.New("event key is required")
+	}
+	if pe.Name == "" {
+		return errors.New("event name is required")
+	}
+	if pe.Template == "" {
+		return errors.New("event template is required")
+	}
+	if pe.Enabled && len(pe.Channels) == 0 {
+		return errors.New("cannot enable event without any push channels configured")
+	}
+	return nil
+}

internal/model/push_history.go

@@ -0,0 +1,27 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"time"
+)
+
+// PushHistory 推送日志/历史实体
+type PushHistory struct {
+	ID        uint64    `json:"id" gorm:"primaryKey;autoIncrement"`
+	EventKey  string    `json:"event_key" gorm:"size:80;not null;index"`
+	Channel   string    `json:"channel" gorm:"size:50;not null"`
+	Target    string    `json:"target" gorm:"size:255;not null"`
+	Title     string    `json:"title" gorm:"size:255;not null"`
+	Content   string    `json:"content" gorm:"type:text;not null"`
+	Level     string    `json:"level" gorm:"size:20;not null"`
+	Status    string    `json:"status" gorm:"size:20;not null"` // success / failed
+	ErrorMsg  string    `json:"error_msg" gorm:"type:text"`
+	CreatedAt time.Time `json:"created_at" gorm:"autoCreateTime;index"`
+}
+
+// TableName 指定表名
+func (PushHistory) TableName() string {
+	return "w_push_histories"
+}

internal/model/schedule.go

@@ -0,0 +1,70 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+)
+
+// Schedule 定时任务配置表
+type Schedule struct {
+	ID        uint64    `json:"id,string" gorm:"primaryKey"`
+	Name      string    `json:"name" gorm:"size:128;not null"`
+	TaskType  string    `json:"task_type" gorm:"size:64;not null"`
+	Cron      string    `json:"cron" gorm:"size:64;not null"`
+	Payload   string    `json:"payload" gorm:"type:text"`
+	IsActive  bool      `json:"is_active" gorm:"not null;default:true"`
+	CreatedAt time.Time `json:"created_at" gorm:"autoCreateTime;index"`
+	UpdatedAt time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名
+func (Schedule) TableName() string {
+	return "w_schedules"
+}
+
+// CreateSchedule 创建定时任务
+func CreateSchedule(ctx context.Context, schedule *Schedule) error {
+	return db.DB(ctx).Create(schedule).Error
+}
+
+// UpdateSchedule 更新定时任务
+func UpdateSchedule(ctx context.Context, schedule *Schedule) error {
+	return db.DB(ctx).Save(schedule).Error
+}
+
+// DeleteSchedule 删除定时任务
+func DeleteSchedule(ctx context.Context, id uint64) error {
+	return db.DB(ctx).Delete(&Schedule{}, id).Error
+}
+
+// GetScheduleByID 根据 ID 获取定时任务
+func GetScheduleByID(ctx context.Context, id uint64) (*Schedule, error) {
+	var schedule Schedule
+	if err := db.DB(ctx).Where("id = ?", id).First(&schedule).Error; err != nil {
+		return nil, err
+	}
+	return &schedule, nil
+}
+
+// ListSchedules 获取所有定时任务
+func ListSchedules(ctx context.Context) ([]Schedule, error) {
+	var schedules []Schedule
+	if err := db.DB(ctx).Order("id DESC").Find(&schedules).Error; err != nil {
+		return nil, err
+	}
+	return schedules, nil
+}
+
+// ListActiveSchedules 获取所有启用的定时任务
+func ListActiveSchedules(ctx context.Context) ([]Schedule, error) {
+	var schedules []Schedule
+	if err := db.DB(ctx).Where("is_active = ?", true).Find(&schedules).Error; err != nil {
+		return nil, err
+	}
+	return schedules, nil
+}

internal/model/system_configs.go

@@ -0,0 +1,63 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import "time"
+
+// 配置键常量 - 所有系统配置的 key 定义
+const (
+	ConfigKeyUploadAllowedExtensions          = "upload_allowed_extensions"           // 允许上传的文件扩展名，逗号分隔
+	ConfigKeySiteName                         = "site_name"                           // 站点名称
+	ConfigKeyPasswordLoginEnabled             = "password_login_enabled"              // 是否允许密码登录
+	ConfigKeyRegistrationEnabled              = "registration_enabled"                // 是否允许注册
+	ConfigKeyPasswordRegisterEnabled          = "password_register_enabled"           // 是否允许密码注册
+	ConfigKeyOIDCLoginEnabled                 = "oidc_login_enabled"                  // 是否允许 OIDC 登录
+	ConfigKeyMaxAPIKeysPerUser                = "max_api_keys_per_user"               //nolint:gosec // false positive: config key name. 每个用户最大 API Key 数量
+	ConfigKeyCapLoginEnabled                  = "cap_login_enabled"                   // 是否启用登录人机验证
+	ConfigKeyCapAutoSolve                     = "cap_auto_solve"                      // 打开页面后是否自动开始计算（false 则需用户手动点击）
+	ConfigKeyCapChallengeCount                = "cap_challenge_count"                 // 客户端需求解的 PoW 难题总数，默认 1，推荐 1～5
+	ConfigKeyCapChallengeSize                 = "cap_challenge_size"                  // 人机验证盐值长度
+	ConfigKeyCapChallengeDifficulty           = "cap_challenge_difficulty"            // 人机验证 PoW 难度（目标前缀长度）
+	ConfigKeyCapChallengeTTL                  = "cap_challenge_ttl_seconds"           // 人机验证难题有效时间（秒）
+	ConfigKeyCapTokenTTL                      = "cap_token_ttl_seconds"               //nolint:gosec // false positive: config key name. 人机验证兑换凭证有效时间（秒）
+	ConfigKeyServerAddress                    = "server_address"                      // 服务器地址
+	ConfigKeySMTPHost                         = "smtp_host"                           // SMTP 服务器地址
+	ConfigKeySMTPPort                         = "smtp_port"                           // SMTP 端口
+	ConfigKeySMTPUsername                     = "smtp_username"                       // SMTP 账户
+	ConfigKeySMTPPassword                     = "smtp_password"                       // SMTP 访问凭证
+	ConfigKeyEmailLoginVerificationEnabled    = "email_login_verification_enabled"    // 是否启用邮箱登录验证
+	ConfigKeyEmailRegisterVerificationEnabled = "email_register_verification_enabled" // 是否启用邮箱注册验证
+	ConfigKeyMenuDisplayConfig                = "menu_display_config"                 // 目录显示配置 (JSON 字符串)
+	ConfigKeySearchEngineIndexingEnabled      = "search_engine_indexing_enabled"      // 是否允许搜索引擎检索
+	ConfigKeyFileAccessWhitelist              = "file_access_whitelist"               // 免登录访问的文件业务类型白名单 (JSON 数组格式)
+	ConfigKeyDiskCacheMaxSizeMB               = "disk_cache_max_size_mb"              // 磁盘缓存最大空间大小 (MB)
+	ConfigKeyDiskCacheTTLMinutes              = "disk_cache_ttl_minutes"              // 磁盘缓存默认有效期 (分钟)
+	ConfigKeyDiskCacheLRUEnabled              = "disk_cache_lru_enabled"              // 是否启用 LRU 淘汰机制
+	ConfigKeyLoginSessionTTLHours             = "login_session_ttl_hours"             // 登录会话过期时间 (小时，0表示浏览器关闭后自动退出登录，-1表示永不过期)
+	ConfigKeyUpdateUpstreamRepository         = "update_upstream_repository"          // GitHub Actions Release 上游仓库
+	ConfigKeyStorageConfig                    = "storage_config"                      // 文件存储配置 (JSON)
+)
+
+const (
+	// ConfigVisibilityHidden 表示配置不通过公共配置接口暴露
+	ConfigVisibilityHidden = 0
+	// ConfigVisibilityVisible 表示配置通过公共配置接口暴露
+	ConfigVisibilityVisible = 1
+)
+
+// SystemConfig 系统配置实体
+type SystemConfig struct {
+	Key         string    `json:"key" gorm:"primaryKey;size:64;not null"`
+	Value       string    `json:"value" gorm:"type:text;not null"`
+	Type        string    `json:"type" gorm:"size:32;not null;default:'system'"`
+	Visibility  int       `json:"visibility" gorm:"not null;default:0"`
+	Description string    `json:"description" gorm:"size:255"`
+	UpdatedAt   time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+	CreatedAt   time.Time `json:"created_at" gorm:"autoCreateTime"`
+}
+
+// TableName 表名
+func (SystemConfig) TableName() string {
+	return "w_system_configs"
+}

internal/model/task_execution.go

@@ -0,0 +1,296 @@
+// Copyright 2025 linux.do
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"github.com/Rain-kl/Wavelet/internal/db/idgen"
+	"github.com/redis/go-redis/v9"
+)
+
+// TaskExecutionStatus 任务执行状态
+type TaskExecutionStatus string
+
+// 任务执行状态
+const (
+	TaskExecutionStatusPending   TaskExecutionStatus = "pending"
+	TaskExecutionStatusRunning   TaskExecutionStatus = "running"
+	TaskExecutionStatusSucceeded TaskExecutionStatus = "succeeded"
+	TaskExecutionStatusFailed    TaskExecutionStatus = "failed"
+
+	taskExecutionLogRedisKeyPrefix = "task:execution:log:"
+	taskExecutionLogExpiration     = 24 * time.Hour
+	taskExecutionLogMaxLines       = 1000
+)
+
+// TaskExecution 任务执行记录
+type TaskExecution struct {
+	ID           uint64              `json:"id,string" gorm:"primaryKey"`
+	TaskID       string              `json:"task_id" gorm:"size:128;uniqueIndex;not null"`
+	TaskType     string              `json:"task_type" gorm:"size:64;index;not null"`
+	TaskName     string              `json:"task_name" gorm:"size:128"`
+	Status       TaskExecutionStatus `json:"status" gorm:"size:32;index;not null"`
+	Retryable    bool                `json:"retryable" gorm:"not null;default:false"`
+	MaxRetry     int                 `json:"max_retry" gorm:"not null;default:0"`
+	RetryCount   int                 `json:"retry_count" gorm:"not null;default:0"`
+	Log          string              `json:"log" gorm:"type:text"`
+	ErrorMessage string              `json:"error_message" gorm:"type:text"`
+	Result       string              `json:"result" gorm:"type:text"`
+	StartedAt    *time.Time          `json:"started_at" gorm:"index"`
+	FinishedAt   *time.Time          `json:"finished_at"`
+	Duration     int64               `json:"duration" gorm:"comment:耗时毫秒"`
+	Payload      string              `json:"payload" gorm:"type:text"`
+	TriggeredBy  string              `json:"triggered_by" gorm:"size:32;not null;default:system"`
+	CreatedAt    time.Time           `json:"created_at" gorm:"autoCreateTime;index"`
+	UpdatedAt    time.Time           `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TaskExecutionCleanupStats describes task execution log cleanup results.
+type TaskExecutionCleanupStats struct {
+	HighFrequencyDeleted int64
+	LowFrequencyDeleted  int64
+}
+
+// TableName 表名
+func (TaskExecution) TableName() string {
+	return "w_task_executions"
+}
+
+// CreateTaskExecution 创建任务执行记录
+func CreateTaskExecution(ctx context.Context, execution *TaskExecution) error {
+	execution.ID = idgen.NextUint64ID()
+	return db.DB(ctx).Create(execution).Error
+}
+
+// UpdateTaskExecution 更新任务执行记录，忽略由 Redis 缓冲和归档流程管理的 log 字段。
+func UpdateTaskExecution(ctx context.Context, execution *TaskExecution) error {
+	return db.DB(ctx).Omit("log").Save(execution).Error
+}
+
+// GetTaskExecutionByTaskID 根据 TaskID 获取执行记录
+func GetTaskExecutionByTaskID(ctx context.Context, taskID string) (*TaskExecution, error) {
+	var execution TaskExecution
+	if err := db.DB(ctx).Where("task_id = ?", taskID).First(&execution).Error; err != nil {
+		return nil, err
+	}
+	if err := loadTaskExecutionLog(ctx, &execution); err != nil {
+		return nil, err
+	}
+	return &execution, nil
+}
+
+// GetTaskExecutionByID 根据 ID 获取执行记录
+func GetTaskExecutionByID(ctx context.Context, id uint64) (*TaskExecution, error) {
+	var execution TaskExecution
+	if err := db.DB(ctx).Where("id = ?", id).First(&execution).Error; err != nil {
+		return nil, err
+	}
+	if err := loadTaskExecutionLog(ctx, &execution); err != nil {
+		return nil, err
+	}
+	return &execution, nil
+}
+
+// AppendTaskExecutionLog 将日志追加到 Redis 缓冲，任务完成后再持久化到数据库。
+func AppendTaskExecutionLog(ctx context.Context, taskID string, logLine string) error {
+	if db.Redis == nil {
+		return errors.New("redis client is not initialized")
+	}
+
+	now := time.Now().Format("15:04:05")
+	line := fmt.Sprintf("[%s] %s\n", now, logLine)
+	key := taskExecutionLogRedisKey(taskID)
+
+	_, err := db.Redis.TxPipelined(ctx, func(pipe redis.Pipeliner) error {
+		pipe.RPush(ctx, key, line)
+		pipe.LTrim(ctx, key, -taskExecutionLogMaxLines, -1)
+		pipe.Expire(ctx, key, taskExecutionLogExpiration)
+		return nil
+	})
+	if err != nil {
+		return fmt.Errorf("append task execution log to redis: %w", err)
+	}
+	return nil
+}
+
+// FlushTaskExecutionLog 将 Redis 中的完整任务日志写入数据库，并在成功后清理缓存。
+func FlushTaskExecutionLog(ctx context.Context, taskID string) error {
+	if db.Redis == nil {
+		return errors.New("redis client is not initialized")
+	}
+
+	key := taskExecutionLogRedisKey(taskID)
+	logLines, err := db.Redis.LRange(ctx, key, 0, -1).Result()
+	if err != nil {
+		return fmt.Errorf("get task execution log from redis: %w", err)
+	}
+	if len(logLines) == 0 {
+		return nil
+	}
+	logText := strings.Join(logLines, "")
+
+	result := db.DB(ctx).Model(&TaskExecution{}).
+		Where("task_id = ?", taskID).
+		Update("log", logText)
+	if result.Error != nil {
+		return fmt.Errorf("persist task execution log: %w", result.Error)
+	}
+	if result.RowsAffected == 0 {
+		return fmt.Errorf("persist task execution log: task %q not found", taskID)
+	}
+
+	if err := db.Redis.Del(ctx, key).Err(); err != nil {
+		return fmt.Errorf("delete persisted task execution log from redis: %w", err)
+	}
+	return nil
+}
+
+// ListTaskExecutionsRequest 查询任务执行记录列表请求
+type ListTaskExecutionsRequest struct {
+	Status   string `form:"status"`
+	TaskType string `form:"task_type"`
+	Page     int    `form:"page"`
+	PageSize int    `form:"page_size"`
+}
+
+// ListTaskExecutions 分页查询任务执行记录
+func ListTaskExecutions(ctx context.Context, req ListTaskExecutionsRequest) ([]TaskExecution, int64, error) {
+	if req.Page <= 0 {
+		req.Page = 1
+	}
+	if req.PageSize <= 0 {
+		req.PageSize = 20
+	}
+
+	query := db.DB(ctx).Model(&TaskExecution{})
+
+	if req.Status != "" {
+		query = query.Where("status = ?", req.Status)
+	}
+	if req.TaskType != "" {
+		query = query.Where("task_type = ?", req.TaskType)
+	}
+
+	var total int64
+	if err := query.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+
+	var executions []TaskExecution
+	offset := (req.Page - 1) * req.PageSize
+	if err := query.Order("id DESC").Offset(offset).Limit(req.PageSize).Find(&executions).Error; err != nil {
+		return nil, 0, err
+	}
+	if err := loadTaskExecutionLogs(ctx, executions); err != nil {
+		return nil, 0, err
+	}
+
+	return executions, total, nil
+}
+
+// CleanupTaskExecutionLogs removes finished task execution logs according to frequency-based retention.
+func CleanupTaskExecutionLogs(ctx context.Context, now time.Time) (TaskExecutionCleanupStats, error) {
+	const (
+		frequencyWindowDays    = 30
+		highFrequencyThreshold = frequencyWindowDays
+	)
+
+	frequencyWindowStart := now.AddDate(0, 0, -frequencyWindowDays)
+	highFrequencyCutoff := now.AddDate(0, 0, -3)
+	lowFrequencyCutoff := now.AddDate(0, 0, -30)
+	terminalStatuses := []TaskExecutionStatus{TaskExecutionStatusSucceeded, TaskExecutionStatusFailed}
+
+	var highFrequencyTaskTypes []string
+	if err := db.DB(ctx).
+		Model(&TaskExecution{}).
+		Select("task_type").
+		Where("created_at >= ?", frequencyWindowStart).
+		Group("task_type").
+		Having("COUNT(*) > ?", highFrequencyThreshold).
+		Pluck("task_type", &highFrequencyTaskTypes).Error; err != nil {
+		return TaskExecutionCleanupStats{}, fmt.Errorf("query high-frequency task types: %w", err)
+	}
+
+	var highFrequencyDeleted int64
+	if len(highFrequencyTaskTypes) > 0 {
+		highFrequencyResult := db.DB(ctx).
+			Where("status IN ?", terminalStatuses).
+			Where("created_at < ?", highFrequencyCutoff).
+			Where("task_type IN ?", highFrequencyTaskTypes).
+			Delete(&TaskExecution{})
+		if highFrequencyResult.Error != nil {
+			return TaskExecutionCleanupStats{}, fmt.Errorf("delete high-frequency task execution logs: %w", highFrequencyResult.Error)
+		}
+		highFrequencyDeleted = highFrequencyResult.RowsAffected
+	}
+
+	lowFrequencyQuery := db.DB(ctx).
+		Where("status IN ?", terminalStatuses).
+		Where("created_at < ?", lowFrequencyCutoff)
+	if len(highFrequencyTaskTypes) > 0 {
+		lowFrequencyQuery = lowFrequencyQuery.Where("task_type NOT IN ?", highFrequencyTaskTypes)
+	}
+	lowFrequencyResult := lowFrequencyQuery.Delete(&TaskExecution{})
+	if lowFrequencyResult.Error != nil {
+		return TaskExecutionCleanupStats{}, fmt.Errorf("delete low-frequency task execution logs: %w", lowFrequencyResult.Error)
+	}
+
+	return TaskExecutionCleanupStats{
+		HighFrequencyDeleted: highFrequencyDeleted,
+		LowFrequencyDeleted:  lowFrequencyResult.RowsAffected,
+	}, nil
+}
+
+func taskExecutionLogRedisKey(taskID string) string {
+	return db.PrefixedKey(taskExecutionLogRedisKeyPrefix + taskID)
+}
+
+func loadTaskExecutionLog(ctx context.Context, execution *TaskExecution) error {
+	if db.Redis == nil {
+		return nil
+	}
+
+	logLines, err := db.Redis.LRange(ctx, taskExecutionLogRedisKey(execution.TaskID), 0, -1).Result()
+	if err != nil {
+		return fmt.Errorf("get task execution log from redis: %w", err)
+	}
+	if len(logLines) == 0 {
+		return nil
+	}
+
+	execution.Log = strings.Join(logLines, "")
+	return nil
+}
+
+func loadTaskExecutionLogs(ctx context.Context, executions []TaskExecution) error {
+	if db.Redis == nil || len(executions) == 0 {
+		return nil
+	}
+
+	commands := make([]*redis.StringSliceCmd, len(executions))
+	_, err := db.Redis.Pipelined(ctx, func(pipe redis.Pipeliner) error {
+		for i := range executions {
+			commands[i] = pipe.LRange(ctx, taskExecutionLogRedisKey(executions[i].TaskID), 0, -1)
+		}
+		return nil
+	})
+	if err != nil {
+		return fmt.Errorf("get task execution logs from redis: %w", err)
+	}
+
+	for i := range executions {
+		logLines := commands[i].Val()
+		if len(logLines) > 0 {
+			executions[i].Log = strings.Join(logLines, "")
+		}
+	}
+	return nil
+}

internal/model/task_execution_test.go

@@ -0,0 +1,484 @@
+// Copyright 2025 linux.do
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"github.com/alicebob/miniredis/v2"
+	"github.com/glebarez/sqlite"
+	"github.com/redis/go-redis/v9"
+	"github.com/redis/go-redis/v9/maintnotifications"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func setupTaskExecutionTestEnvironment(t *testing.T) func() {
+	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		DisableForeignKeyConstraintWhenMigrating: true,
+	})
+	require.NoError(t, err)
+
+	err = sqliteDB.AutoMigrate(&TaskExecution{})
+	require.NoError(t, err)
+
+	miniRedis, err := miniredis.Run()
+	require.NoError(t, err)
+	redisClient := redis.NewClient(&redis.Options{
+		Addr: miniRedis.Addr(),
+		MaintNotificationsConfig: &maintnotifications.Config{
+			Mode: maintnotifications.ModeDisabled,
+		},
+	})
+
+	db.SetDB(sqliteDB)
+	db.Redis = redisClient
+
+	return func() {
+		require.NoError(t, redisClient.Close())
+		miniRedis.Close()
+		db.SetDB(nil)
+		db.Redis = nil
+	}
+}
+
+func TestCreateTaskExecution(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	execution := &TaskExecution{
+		TaskID:      "manual_cleanup_123",
+		TaskType:    "system:cleanup",
+		TaskName:    "清理未使用上传",
+		Status:      TaskExecutionStatusPending,
+		Retryable:   true,
+		MaxRetry:    3,
+		RetryCount:  0,
+		Payload:     `{"test": true}`,
+		TriggeredBy: "manual",
+	}
+
+	err := CreateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+	assert.NotZero(t, execution.ID, "ID should be generated")
+	assert.NotZero(t, execution.CreatedAt, "CreatedAt should be set")
+	assert.NotZero(t, execution.UpdatedAt, "UpdatedAt should be set")
+}
+
+func TestGetTaskExecutionByTaskID(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	// 创建记录
+	execution := &TaskExecution{
+		TaskID:      "test_task_id_001",
+		TaskType:    "system:cleanup",
+		TaskName:    "清理未使用上传",
+		Status:      TaskExecutionStatusPending,
+		Retryable:   true,
+		MaxRetry:    3,
+		TriggeredBy: "manual",
+	}
+	err := CreateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	// 按 TaskID 查询
+	found, err := GetTaskExecutionByTaskID(ctx, "test_task_id_001")
+	require.NoError(t, err)
+	assert.Equal(t, execution.ID, found.ID)
+	assert.Equal(t, "test_task_id_001", found.TaskID)
+	assert.Equal(t, TaskExecutionStatusPending, found.Status)
+	assert.True(t, found.Retryable)
+	assert.Equal(t, 3, found.MaxRetry)
+
+	// 查询不存在的 TaskID
+	_, err = GetTaskExecutionByTaskID(ctx, "nonexistent")
+	assert.Error(t, err, "should return error for non-existent taskID")
+}
+
+func TestGetTaskExecutionByID(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	execution := &TaskExecution{
+		TaskID:      "test_by_id_001",
+		TaskType:    "system:cleanup",
+		TaskName:    "清理未使用上传",
+		Status:      TaskExecutionStatusPending,
+		TriggeredBy: "system",
+	}
+	err := CreateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	// 按主键查询
+	found, err := GetTaskExecutionByID(ctx, execution.ID)
+	require.NoError(t, err)
+	assert.Equal(t, execution.TaskID, found.TaskID)
+}
+
+func TestUpdateTaskExecution(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	// 创建记录
+	execution := &TaskExecution{
+		TaskID:      "test_update_001",
+		TaskType:    "system:cleanup",
+		TaskName:    "清理未使用上传",
+		Status:      TaskExecutionStatusPending,
+		TriggeredBy: "manual",
+	}
+	err := CreateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	// 更新状态为 running
+	now := time.Now()
+	execution.Status = TaskExecutionStatusRunning
+	execution.StartedAt = &now
+	err = UpdateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	// 验证更新
+	found, err := GetTaskExecutionByTaskID(ctx, "test_update_001")
+	require.NoError(t, err)
+	assert.Equal(t, TaskExecutionStatusRunning, found.Status)
+	assert.NotNil(t, found.StartedAt)
+
+	// 更新为 succeeded
+	finishTime := time.Now()
+	execution.Status = TaskExecutionStatusSucceeded
+	execution.FinishedAt = &finishTime
+	execution.Duration = 1500
+	execution.Result = "共清理 50 个文件"
+	err = UpdateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	found, err = GetTaskExecutionByTaskID(ctx, "test_update_001")
+	require.NoError(t, err)
+	assert.Equal(t, TaskExecutionStatusSucceeded, found.Status)
+	assert.Equal(t, int64(1500), found.Duration)
+	assert.Equal(t, "共清理 50 个文件", found.Result)
+}
+
+func TestUpdateTaskExecutionFailed(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	execution := &TaskExecution{
+		TaskID:      "test_fail_001",
+		TaskType:    "system:cleanup",
+		TaskName:    "清理未使用上传",
+		Status:      TaskExecutionStatusPending,
+		Retryable:   true,
+		MaxRetry:    3,
+		TriggeredBy: "manual",
+	}
+	err := CreateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	// 标记为失败
+	now := time.Now()
+	execution.Status = TaskExecutionStatusFailed
+	execution.StartedAt = &now
+	execution.FinishedAt = &now
+	execution.Duration = 200
+	execution.ErrorMessage = "S3 连接超时"
+	err = UpdateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	found, err := GetTaskExecutionByTaskID(ctx, "test_fail_001")
+	require.NoError(t, err)
+	assert.Equal(t, TaskExecutionStatusFailed, found.Status)
+	assert.Equal(t, "S3 连接超时", found.ErrorMessage)
+	assert.Equal(t, int64(200), found.Duration)
+}
+
+func TestUpdateTaskExecutionDoesNotPersistBufferedLog(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	execution := &TaskExecution{
+		TaskID:      "test_omit_log_001",
+		TaskType:    "system:cleanup",
+		TaskName:    "清理未使用上传",
+		Status:      TaskExecutionStatusPending,
+		TriggeredBy: "manual",
+	}
+	err := CreateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	// 运行中的日志仅缓存在 Redis。
+	err = AppendTaskExecutionLog(ctx, "test_omit_log_001", "第一条执行日志")
+	require.NoError(t, err)
+
+	assert.Empty(t, execution.Log)
+
+	execution.Status = TaskExecutionStatusSucceeded
+	execution.Duration = 100
+	err = UpdateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	var persisted TaskExecution
+	err = db.DB(ctx).Where("task_id = ?", "test_omit_log_001").First(&persisted).Error
+	require.NoError(t, err)
+	assert.Equal(t, TaskExecutionStatusSucceeded, persisted.Status)
+	assert.Empty(t, persisted.Log)
+
+	found, err := GetTaskExecutionByTaskID(ctx, "test_omit_log_001")
+	require.NoError(t, err)
+	assert.Contains(t, found.Log, "第一条执行日志")
+}
+
+func TestAppendTaskExecutionLog(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	execution := &TaskExecution{
+		TaskID:      "test_log_001",
+		TaskType:    "system:cleanup",
+		TaskName:    "清理未使用上传",
+		Status:      TaskExecutionStatusPending,
+		TriggeredBy: "manual",
+	}
+	err := CreateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+
+	// 追加多条日志
+	err = AppendTaskExecutionLog(ctx, "test_log_001", "开始扫描未使用上传文件")
+	require.NoError(t, err)
+
+	err = AppendTaskExecutionLog(ctx, "test_log_001", "本批次找到 42 个待清理文件")
+	require.NoError(t, err)
+
+	err = AppendTaskExecutionLog(ctx, "test_log_001", "清理完成，共删除 42 个文件")
+	require.NoError(t, err)
+
+	// 读取时优先返回 Redis 中的在途日志。
+	found, err := GetTaskExecutionByTaskID(ctx, "test_log_001")
+	require.NoError(t, err)
+	assert.Contains(t, found.Log, "开始扫描未使用上传文件")
+	assert.Contains(t, found.Log, "本批次找到 42 个待清理文件")
+	assert.Contains(t, found.Log, "清理完成，共删除 42 个文件")
+
+	var persisted TaskExecution
+	err = db.DB(ctx).Where("task_id = ?", "test_log_001").First(&persisted).Error
+	require.NoError(t, err)
+	assert.Empty(t, persisted.Log)
+
+	err = FlushTaskExecutionLog(ctx, "test_log_001")
+	require.NoError(t, err)
+
+	err = db.DB(ctx).Where("task_id = ?", "test_log_001").First(&persisted).Error
+	require.NoError(t, err)
+	assert.Contains(t, persisted.Log, "开始扫描未使用上传文件")
+
+	exists, err := db.Redis.Exists(ctx, taskExecutionLogRedisKey("test_log_001")).Result()
+	require.NoError(t, err)
+	assert.Zero(t, exists)
+}
+
+func TestAppendTaskExecutionLogLimitsLinesAndRefreshesTTL(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	const taskID = "limited_log_001"
+	for i := 0; i < taskExecutionLogMaxLines+5; i++ {
+		err := AppendTaskExecutionLog(ctx, taskID, fmt.Sprintf("日志-%04d", i))
+		require.NoError(t, err)
+	}
+
+	key := taskExecutionLogRedisKey(taskID)
+	logLines, err := db.Redis.LRange(ctx, key, 0, -1).Result()
+	require.NoError(t, err)
+	assert.Len(t, logLines, taskExecutionLogMaxLines)
+	assert.Contains(t, logLines[0], "日志-0005")
+	assert.Contains(t, logLines[len(logLines)-1], "日志-1004")
+
+	ttl, err := db.Redis.TTL(ctx, key).Result()
+	require.NoError(t, err)
+	assert.Equal(t, taskExecutionLogExpiration, ttl)
+}
+
+func TestAppendTaskExecutionLogNonExistent(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	// Redis 缓冲不依赖数据库记录是否已经创建。
+	err := AppendTaskExecutionLog(ctx, "nonexistent_task", "测试日志")
+	assert.NoError(t, err)
+
+	err = FlushTaskExecutionLog(ctx, "nonexistent_task")
+	assert.Error(t, err)
+}
+
+func TestGetTaskExecutionLogPrefersRedis(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	execution := &TaskExecution{
+		TaskID:      "redis_priority_001",
+		TaskType:    "system:cleanup",
+		TaskName:    "清理未使用上传",
+		Status:      TaskExecutionStatusRunning,
+		Log:         "数据库旧日志",
+		TriggeredBy: "manual",
+	}
+	err := CreateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+	err = AppendTaskExecutionLog(ctx, execution.TaskID, "Redis 最新日志")
+	require.NoError(t, err)
+
+	found, err := GetTaskExecutionByID(ctx, execution.ID)
+	require.NoError(t, err)
+	assert.Contains(t, found.Log, "Redis 最新日志")
+	assert.NotContains(t, found.Log, "数据库旧日志")
+}
+
+func TestListTaskExecutions(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	// 创建多条记录，包含不同状态和类型
+	records := []*TaskExecution{
+		{TaskID: "list_001", TaskType: "system:cleanup", TaskName: "系统垃圾清理", Status: TaskExecutionStatusSucceeded, TriggeredBy: "manual"},
+		{TaskID: "list_002", TaskType: "system:cleanup", TaskName: "系统垃圾清理", Status: TaskExecutionStatusFailed, TriggeredBy: "system"},
+		{TaskID: "list_003", TaskType: "other:task", TaskName: "其他任务", Status: TaskExecutionStatusPending, TriggeredBy: "manual"},
+		{TaskID: "list_004", TaskType: "system:cleanup", TaskName: "系统垃圾清理", Status: TaskExecutionStatusRunning, TriggeredBy: "manual"},
+		{TaskID: "list_005", TaskType: "other:task", TaskName: "其他任务", Status: TaskExecutionStatusSucceeded, TriggeredBy: "system"},
+	}
+	for _, r := range records {
+		err := CreateTaskExecution(ctx, r)
+		require.NoError(t, err)
+	}
+	err := AppendTaskExecutionLog(ctx, "list_004", "运行中的 Redis 日志")
+	require.NoError(t, err)
+
+	// 查询全部（分页）
+	items, total, err := ListTaskExecutions(ctx, ListTaskExecutionsRequest{Page: 1, PageSize: 10})
+	require.NoError(t, err)
+	assert.Equal(t, int64(5), total)
+	assert.Len(t, items, 5)
+	for _, item := range items {
+		if item.TaskID == "list_004" {
+			assert.Contains(t, item.Log, "运行中的 Redis 日志")
+		}
+	}
+
+	// 按状态筛选：failed
+	items, total, err = ListTaskExecutions(ctx, ListTaskExecutionsRequest{Status: "failed", Page: 1, PageSize: 10})
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), total)
+	assert.Len(t, items, 1)
+	assert.Equal(t, "list_002", items[0].TaskID)
+
+	// 按类型筛选
+	_, total, err = ListTaskExecutions(ctx, ListTaskExecutionsRequest{TaskType: "other:task", Page: 1, PageSize: 10})
+	require.NoError(t, err)
+	assert.Equal(t, int64(2), total)
+
+	// 分页测试
+	items, total, err = ListTaskExecutions(ctx, ListTaskExecutionsRequest{Page: 1, PageSize: 2})
+	require.NoError(t, err)
+	assert.Equal(t, int64(5), total)
+	assert.Len(t, items, 2)
+
+	items2, total2, err := ListTaskExecutions(ctx, ListTaskExecutionsRequest{Page: 2, PageSize: 2})
+	require.NoError(t, err)
+	assert.Equal(t, int64(5), total2)
+	assert.Len(t, items2, 2)
+
+	// 确保分页数据不重复
+	assert.NotEqual(t, items[0].ID, items2[0].ID)
+
+	// 状态 + 类型组合筛选
+	items, total, err = ListTaskExecutions(ctx, ListTaskExecutionsRequest{Status: "succeeded", TaskType: "system:cleanup", Page: 1, PageSize: 10})
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), total)
+	assert.Equal(t, "list_001", items[0].TaskID)
+}
+
+func TestListTaskExecutionsDefaultPaging(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	// 不传分页参数，应使用默认值 page=1, pageSize=20
+	items, total, err := ListTaskExecutions(ctx, ListTaskExecutionsRequest{})
+	require.NoError(t, err)
+	assert.Equal(t, int64(0), total)
+	assert.Len(t, items, 0)
+}
+
+func TestCleanupTaskExecutionLogs(t *testing.T) {
+	cleanup := setupTaskExecutionTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	now := time.Date(2026, 6, 17, 12, 0, 0, 0, time.UTC)
+	for i := 0; i < 31; i++ {
+		createTaskExecutionForCleanup(t, ctx, fmt.Sprintf("high_recent_%02d", i), "high:task", TaskExecutionStatusSucceeded, now.Add(-2*time.Hour))
+	}
+	createTaskExecutionForCleanup(t, ctx, "high_old_4d", "high:task", TaskExecutionStatusSucceeded, now.AddDate(0, 0, -4))
+	createTaskExecutionForCleanup(t, ctx, "high_old_40d", "high:task", TaskExecutionStatusFailed, now.AddDate(0, 0, -40))
+	createTaskExecutionForCleanup(t, ctx, "high_running_old", "high:task", TaskExecutionStatusRunning, now.AddDate(0, 0, -10))
+	createTaskExecutionForCleanup(t, ctx, "low_old_31d", "low:task", TaskExecutionStatusSucceeded, now.AddDate(0, 0, -31))
+	createTaskExecutionForCleanup(t, ctx, "low_recent_29d", "low:task", TaskExecutionStatusSucceeded, now.AddDate(0, 0, -29))
+	createTaskExecutionForCleanup(t, ctx, "low_pending_old", "low:task", TaskExecutionStatusPending, now.AddDate(0, 0, -45))
+
+	stats, err := CleanupTaskExecutionLogs(ctx, now)
+	require.NoError(t, err)
+	assert.Equal(t, int64(2), stats.HighFrequencyDeleted)
+	assert.Equal(t, int64(1), stats.LowFrequencyDeleted)
+
+	for _, taskID := range []string{"high_old_4d", "high_old_40d", "low_old_31d"} {
+		var count int64
+		err := db.DB(ctx).Model(&TaskExecution{}).Where("task_id = ?", taskID).Count(&count).Error
+		require.NoError(t, err)
+		assert.Equal(t, int64(0), count, "CleanupTaskExecutionLogs(%s) should delete expired log", taskID)
+	}
+	for _, taskID := range []string{"high_recent_00", "high_running_old", "low_recent_29d", "low_pending_old"} {
+		var count int64
+		err := db.DB(ctx).Model(&TaskExecution{}).Where("task_id = ?", taskID).Count(&count).Error
+		require.NoError(t, err)
+		assert.Equal(t, int64(1), count, "CleanupTaskExecutionLogs(%s) should keep retained log", taskID)
+	}
+}
+
+func TestTaskExecutionTableName(t *testing.T) {
+	execution := TaskExecution{}
+	assert.Equal(t, "w_task_executions", execution.TableName())
+}
+
+func createTaskExecutionForCleanup(t *testing.T, ctx context.Context, taskID string, taskType string, status TaskExecutionStatus, createdAt time.Time) {
+	t.Helper()
+
+	execution := &TaskExecution{
+		TaskID:      taskID,
+		TaskType:    taskType,
+		TaskName:    taskType,
+		Status:      status,
+		CreatedAt:   createdAt,
+		UpdatedAt:   createdAt,
+		TriggeredBy: "system",
+	}
+	err := CreateTaskExecution(ctx, execution)
+	require.NoError(t, err)
+}

internal/model/templates.go

@@ -0,0 +1,88 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"bytes"
+	"errors"
+	"strings"
+	"text/template"
+	"time"
+)
+
+// Template 邮件/消息模板实体
+type Template struct {
+	ID          uint64    `json:"id" gorm:"primaryKey;autoIncrement"`
+	Key         string    `json:"key" gorm:"uniqueIndex;size:80;not null"`
+	Name        string    `json:"name" gorm:"size:100;not null"`
+	Type        string    `json:"type" gorm:"size:20;not null;default:'email'"`
+	Subject     string    `json:"subject" gorm:"size:255"`
+	Content     string    `json:"content" gorm:"type:text;not null"`
+	Description string    `json:"description" gorm:"size:255"`
+	IsSystem    bool      `json:"is_system" gorm:"index;not null;default:false"`
+	CreatedAt   time.Time `json:"created_at" gorm:"autoCreateTime;index"`
+	UpdatedAt   time.Time `json:"updated_at" gorm:"autoUpdateTime;index"`
+}
+
+// TableName 表名
+func (Template) TableName() string {
+	return "w_templates"
+}
+
+// Normalize 规范化模板字段
+func (t *Template) Normalize() {
+	t.Key = strings.TrimSpace(t.Key)
+	t.Name = strings.TrimSpace(t.Name)
+	t.Type = strings.ToLower(strings.TrimSpace(t.Type))
+	t.Subject = strings.TrimSpace(t.Subject)
+	t.Content = strings.TrimSpace(t.Content)
+	t.Description = strings.TrimSpace(t.Description)
+	if t.Type == "" {
+		t.Type = "email"
+	}
+}
+
+// Validate 校验模板必填字段
+func (t *Template) Validate() error {
+	t.Normalize()
+	if t.Key == "" {
+		return errors.New(errTemplateKeyRequired)
+	}
+	if t.Name == "" {
+		return errors.New(errTemplateNameRequired)
+	}
+	if t.Content == "" {
+		return errors.New(errTemplateContentRequired)
+	}
+	return nil
+}
+
+// Render 渲染模板的 Subject 和 Content
+func (t *Template) Render(data any) (string, string, error) {
+	// Render Subject
+	var subject string
+	if t.Subject != "" {
+		tmplSubject, err := template.New(t.Key + "_subject").Parse(t.Subject)
+		if err != nil {
+			return "", "", err
+		}
+		var subBuf bytes.Buffer
+		if err := tmplSubject.Execute(&subBuf, data); err != nil {
+			return "", "", err
+		}
+		subject = subBuf.String()
+	}
+
+	// Render Content
+	tmplContent, err := template.New(t.Key + "_content").Parse(t.Content)
+	if err != nil {
+		return "", "", err
+	}
+	var bodyBuf bytes.Buffer
+	if err := tmplContent.Execute(&bodyBuf, data); err != nil {
+		return "", "", err
+	}
+
+	return subject, bodyBuf.String(), nil
+}

internal/model/upload_stats.go

@@ -0,0 +1,28 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import "time"
+
+// Upload stats dimension keys stored in w_upload_stats.dimension.
+const (
+	UploadStatDimensionTotal    = "total"
+	UploadStatDimensionType     = "type"
+	UploadStatDimensionCategory = "category"
+	UploadStatDimensionTrend    = "trend"
+)
+
+// UploadStat stores incremental upload statistics keyed by dimension and stat_key.
+type UploadStat struct {
+	Dimension string    `json:"dimension" gorm:"primaryKey;size:32;not null"`
+	StatKey   string    `json:"stat_key" gorm:"primaryKey;size:64;not null;default:''"`
+	FileCount int64     `json:"file_count" gorm:"not null;default:0"`
+	FileSize  int64     `json:"file_size" gorm:"not null;default:0"`
+	UpdatedAt time.Time `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName returns the upload stats table name.
+func (UploadStat) TableName() string {
+	return "w_upload_stats"
+}

internal/model/uploads.go

@@ -0,0 +1,54 @@
+// Copyright 2025 linux.do
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"time"
+)
+
+// UploadStatus 上传状态
+type UploadStatus string
+
+// 上传状态
+const (
+	UploadStatusPending UploadStatus = "pending" // 待使用
+	UploadStatusUsed    UploadStatus = "used"    // 已使用
+	UploadStatusDeleted UploadStatus = "deleted" // 已删除
+)
+
+// UploadMetadata 自定义可扩展的 JSON 字段存储非核心或可选的文件元数据
+type UploadMetadata struct {
+	Width        int            `json:"width,omitempty"`         // 图像/视频宽度 (px)
+	Height       int            `json:"height,omitempty"`        // 图像/视频高度 (px)
+	Duration     float64        `json:"duration,omitempty"`      // 音视频时长 (s)
+	OriginalMime string         `json:"original_mime,omitempty"` // 原始 MIME 类型
+	UserAgent    string         `json:"user_agent,omitempty"`    // 上传者的 UA
+	ClientIP     string         `json:"client_ip,omitempty"`     // 上传者 IP
+	Bucket       string         `json:"bucket,omitempty"`        // 存储桶名称 (适用于 S3 等)
+	Extra        map[string]any `json:"extra,omitempty"`         // 其它任意业务自定义元数据
+}
+
+// Upload 上传文件记录
+type Upload struct {
+	ID         uint64         `json:"id,string" gorm:"primaryKey"`
+	UserID     uint64         `json:"user_id,string" gorm:"index;not null"`
+	FileName   string         `json:"file_name" gorm:"size:255;not null"`             // 原始文件名 (例如: image.png)
+	FilePath   string         `json:"file_path" gorm:"size:500;not null;index"`       // 文件相对路径 / S3 Key
+	FileSize   int64          `json:"file_size" gorm:"not null"`                      // 文件大小（字节）
+	MimeType   string         `json:"mime_type" gorm:"size:100;not null"`             // 媒体类型 (MIME, 如 image/png)
+	Extension  string         `json:"extension" gorm:"size:50;not null"`              // 文件后缀名 (不含点，如 png, pdf)
+	Hash       string         `json:"hash" gorm:"size:64;index"`                      // 文件哈希 (SHA-256/MD5，可用于排重)
+	Type       string         `json:"type" gorm:"column:type;size:50;not null;index"` // 业务标识类型 (如 avatar, doc, attachment)
+	Status     UploadStatus   `json:"status" gorm:"type:varchar(20);not null"`        // 状态
+	AccessMode int            `json:"access_mode" gorm:"column:access_mode;not null;default:0"`
+	Metadata   UploadMetadata `json:"metadata" gorm:"serializer:json;type:jsonb"` // 业务扩展元数据
+	CreatedAt  time.Time      `json:"created_at" gorm:"autoCreateTime"`
+	UpdatedAt  time.Time      `json:"updated_at" gorm:"autoUpdateTime"`
+}
+
+// TableName 表名
+func (Upload) TableName() string {
+	return "w_uploads"
+}

internal/model/users.go

@@ -0,0 +1,195 @@
+// Copyright 2025 linux.do
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/common"
+	"github.com/Rain-kl/Wavelet/internal/db/idgen"
+	"github.com/Rain-kl/Wavelet/pkg/util"
+	"gorm.io/gorm"
+)
+
+// OAuthUserInfo 用户信息结构（同时支持 OIDC ID Token claims 和 UserEndpoint 响应）
+type OAuthUserInfo struct {
+	ID                uint64 `json:"id"`
+	Sub               string `json:"sub"`
+	Username          string `json:"username"`
+	PreferredUsername string `json:"preferred_username"`
+	Email             string `json:"email"`
+	Name              string `json:"name"`
+	Active            bool   `json:"active"`
+	AvatarURL         string `json:"avatar_url"`
+}
+
+// GetID 获取用户 ID
+func (u *OAuthUserInfo) GetID() uint64 {
+	if u.ID != 0 {
+		return u.ID
+	}
+	// 从 sub 解析（OIDC 格式）
+	if u.Sub != "" {
+		if id, err := strconv.ParseUint(u.Sub, 10, 64); err == nil {
+			return id
+		}
+	}
+	return 0
+}
+
+// User 用户表实体
+type User struct {
+	ID          uint64    `json:"id,string" gorm:"primaryKey;not null"`
+	Username    string    `json:"username" gorm:"size:64;uniqueIndex"`
+	Password    string    `json:"password,omitempty" gorm:"size:255"`
+	Nickname    string    `json:"nickname" gorm:"size:255"`
+	Email       string    `json:"email" gorm:"size:255;index"`
+	AvatarURL   string    `json:"avatar_url" gorm:"size:255"`
+	IsActive    bool      `json:"is_active" gorm:"default:true;index"`
+	IsAdmin     bool      `json:"is_admin" gorm:"default:false"`
+	Bio         string    `json:"bio" gorm:"size:500"`
+	Phone       string    `json:"phone" gorm:"size:32"`
+	Gender      string    `json:"gender" gorm:"size:16"`
+	Website     string    `json:"website" gorm:"size:255"`
+	Location    string    `json:"location" gorm:"size:255"`
+	LastLoginAt time.Time `json:"last_login_at" gorm:"index"`
+	CreatedAt   time.Time `json:"created_at" gorm:"autoCreateTime;index"`
+	UpdatedAt   time.Time `json:"updated_at" gorm:"autoUpdateTime;index"`
+}
+
+// TableName 表名
+func (User) TableName() string {
+	return "w_users"
+}
+
+// SetPassword 设置明文密码
+func (u *User) SetPassword(password string) error {
+	u.Password = password
+	return nil
+}
+
+// SetEncryptedPassword 设置加密密码
+func (u *User) SetEncryptedPassword(password string) error {
+	if password == "" {
+		u.Password = ""
+		return nil
+	}
+	hashed, err := util.HashPassword(password)
+	if err != nil {
+		return err
+	}
+	u.Password = hashed
+	return nil
+}
+
+// IsPasswordEncrypted 检查密码是否已加密
+func (u *User) IsPasswordEncrypted() bool {
+	return strings.HasPrefix(u.Password, "$2a$") || strings.HasPrefix(u.Password, "$2b$") || strings.HasPrefix(u.Password, "$2y$")
+}
+
+// CheckPassword 验证密码是否匹配
+func (u *User) CheckPassword(password string) bool {
+	if u.Password == "" || password == "" {
+		return false
+	}
+	if u.IsPasswordEncrypted() {
+		return util.CheckPasswordHash(u.Password, password)
+	}
+	return u.Password == password
+}
+
+// GetByID 根据 ID 查询用户
+func (u *User) GetByID(tx *gorm.DB, id uint64) error {
+	if err := tx.Where("id = ?", id).First(u).Error; err != nil {
+		return err
+	}
+	return nil
+}
+
+// UpdateFromOAuthInfo 根据 OAuth 信息更新用户数据
+func (u *User) UpdateFromOAuthInfo(oauthInfo *OAuthUserInfo) {
+	u.Username = oauthInfo.Username
+	u.Nickname = oauthInfo.Name
+	u.Email = oauthInfo.Email
+	u.AvatarURL = oauthInfo.AvatarURL
+	u.IsActive = oauthInfo.Active
+	u.LastLoginAt = time.Now()
+}
+
+// CheckActive 检查用户账户是否激活,未激活则返回错误
+func (u *User) CheckActive() error {
+	if !u.IsActive {
+		return errors.New(common.BannedAccount)
+	}
+	return nil
+}
+
+func (u *User) assignIDIfMissing() error {
+	if u.ID != 0 {
+		return nil
+	}
+	u.ID = idgen.NextUint64ID()
+	return nil
+}
+
+// CreateUser 创建新用户（用于 OAuth/OIDC 自动注册，含底层权限校验）
+func (u *User) CreateUser(_ context.Context, tx *gorm.DB, oauthInfo *OAuthUserInfo) error {
+	now := time.Now()
+	userID := oauthInfo.GetID()
+	newUser := User{
+		ID:          userID,
+		Username:    oauthInfo.Username,
+		Nickname:    oauthInfo.Name,
+		Email:       oauthInfo.Email,
+		AvatarURL:   oauthInfo.AvatarURL,
+		IsActive:    oauthInfo.Active,
+		LastLoginAt: now,
+		IsAdmin:     false,
+	}
+	if err := newUser.assignIDIfMissing(); err != nil {
+		return err
+	}
+	if err := tx.Create(&newUser).Error; err != nil {
+		return err
+	}
+
+	*u = newUser
+	return nil
+}
+
+// RegisterUser 创建新用户并注册（用于本地密码注册，含全局开关和唯一性多重底层校验）
+func (u *User) RegisterUser(_ context.Context, tx *gorm.DB) error {
+	// 检查用户名冲突
+	var count int64
+	if err := tx.Model(&User{}).Where("username = ?", u.Username).Count(&count).Error; err != nil {
+		return err
+	}
+	if count > 0 {
+		return errors.New(errUsernameExists)
+	}
+
+	// 检查邮箱冲突
+	if u.Email != "" {
+		var emailCount int64
+		if err := tx.Model(&User{}).Where("email = ?", u.Email).Count(&emailCount).Error; err != nil {
+			return err
+		}
+		if emailCount > 0 {
+			return errors.New(errEmailAlreadyBound)
+		}
+	}
+
+	if err := u.assignIDIfMissing(); err != nil {
+		return err
+	}
+	if err := tx.Create(u).Error; err != nil {
+		return err
+	}
+	return nil
+}