refactor(repo): consolidate openflare-server to root and move subprojects to internal/apps

- Merge all files inside openflare-server to the repository root directory.
- Relocate agent, relay, and flared subprojects from internal/ to internal/apps/.
- Combine docker-compose files and update build context paths to root.
- Update GitHub workflows and Dockerfiles to refer to new directories and package names.
- Rewrite Go package imports across all files.
- Resolve database renew test race condition and clean up docs.

.dockerignore

@@ -1,5 +1,6 @@
 .git
 .idea
+.vscode
 .github
 anubis-source
 **/node_modules
@@ -16,4 +17,19 @@ logs
 .env
 .env.*
 docker-compose*.yml
-
+config.yaml
+bin/
+data/
+uploads/
+s3_cache/
+frontend/node_modules/
+frontend/.next/
+frontend/out/
+frontend/build/
+frontend/disk/
+frontend/.env
+frontend/next-env.d.ts
+frontend/*.tsbuildinfo
+frontend/package-lock.json
+internal/router/dist/
+internal/router/root/dist/

.github/workflows/docker-server.yml

@@ -74,7 +74,7 @@ jobs:
         id: build
         uses: docker/build-push-action@v7
         with:
-          context: ./openflare-server
+          context: .
           file: ./docker/Dockerfile
           platforms: ${{ matrix.platform }}
           outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true

.github/workflows/github-pages.yml

@@ -17,7 +17,7 @@ jobs:
         env:
           CI: ""
         run: |
-          cd openflare-server/frontend
+          cd frontend
           corepack enable
           pnpm install --frozen-lockfile
           pnpm build:embed
@@ -27,4 +27,4 @@ jobs:
         with:
           ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
           BRANCH: gh-pages # The branch the action should deploy to.
-          FOLDER: openflare-server/frontend/out # The folder the action should deploy.
+          FOLDER: frontend/out # The folder the action should deploy.

.github/workflows/release.yml

@@ -80,10 +80,10 @@ jobs:
         with:
           node-version: 22
           cache: pnpm
-          cache-dependency-path: openflare-server/frontend/pnpm-lock.yaml
+          cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Build Frontend
-        working-directory: openflare-server/frontend
+        working-directory: frontend
         env:
           CI: ""
           NEXT_PUBLIC_APP_VERSION: ${{ needs.prepare.outputs.version }}
@@ -93,14 +93,14 @@ jobs:
 
       - name: Prepare embed directory
         run: |
-          rm -rf openflare-server/internal/router/root/dist
+          rm -rf internal/router/root/dist
-          cp -R openflare-server/frontend/out openflare-server/internal/router/root/dist
+          cp -R frontend/out internal/router/root/dist
 
       - name: Upload Frontend Artifact
         uses: actions/upload-artifact@v4
         with:
           name: frontend-build
-          path: openflare-server/internal/router/root/dist
+          path: internal/router/root/dist
           retention-days: 1
 
   build-binaries:
@@ -139,16 +139,15 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           name: frontend-build
-          path: openflare-server/internal/router/root/dist
+          path: internal/router/root/dist
 
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version-file: openflare-server/go.mod
+          go-version-file: go.mod
-          cache-dependency-path: openflare-server/go.sum
+          cache-dependency-path: go.sum
 
       - name: Build Server
-        working-directory: openflare-server
         env:
           CGO_ENABLED: 0
           GOOS: ${{ matrix.goos }}
@@ -157,10 +156,10 @@ jobs:
           VERSION: ${{ needs.prepare.outputs.version }}
         run: |
           go mod download
-          mkdir -p ../dist
+          mkdir -p dist
           go build -trimpath -tags embed_frontend \
             -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/buildinfo.Version=$VERSION'" \
-            -o "../dist/$ASSET_NAME" ./main.go
+            -o "dist/$ASSET_NAME" ./main.go
 
       - name: Upload Binary Artifact
         uses: actions/upload-artifact@v4
@@ -202,7 +201,6 @@ jobs:
           go-version-file: go.mod
 
       - name: Build Agent
-        working-directory: openflare-agent
         env:
           CGO_ENABLED: 0
           GOOS: ${{ matrix.goos }}
@@ -211,9 +209,9 @@ jobs:
           VERSION: ${{ needs.prepare.outputs.version }}
         run: |
           go mod download
-          mkdir -p ../dist
+          mkdir -p dist
-          go build -trimpath -ldflags "-s -w -X 'github.com/rain-kl/openflare/openflare-agent/internal/config.Version=$VERSION'" -o "../dist/$ASSET_NAME" ./cmd/agent
+          go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/apps/agent/config.Version=$VERSION'" -o "dist/$ASSET_NAME" ./cmd/agent/main.go
-          (cd ../dist && sha256sum "$ASSET_NAME" > "$ASSET_NAME.sha256")
+          (cd dist && sha256sum "$ASSET_NAME" > "$ASSET_NAME.sha256")
 
       - name: Upload Agent Artifact
         uses: actions/upload-artifact@v4
@@ -257,7 +255,6 @@ jobs:
           go-version-file: go.mod
 
       - name: Build Relay
-        working-directory: openflare-relay
         env:
           CGO_ENABLED: 0
           GOOS: ${{ matrix.goos }}
@@ -266,9 +263,9 @@ jobs:
           VERSION: ${{ needs.prepare.outputs.version }}
         run: |
           go mod download
-          mkdir -p ../dist
+          mkdir -p dist
-          go build -trimpath -ldflags "-s -w -X 'github.com/rain-kl/openflare/openflare-relay/internal/config.Version=$VERSION'" -o "../dist/$ASSET_NAME" ./cmd/relay
+          go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/apps/relay/config.Version=$VERSION'" -o "dist/$ASSET_NAME" ./cmd/relay/main.go
-          (cd ../dist && sha256sum "$ASSET_NAME" > "$ASSET_NAME.sha256")
+          (cd dist && sha256sum "$ASSET_NAME" > "$ASSET_NAME.sha256")
 
       - name: Upload Relay Artifact
         uses: actions/upload-artifact@v4
@@ -312,7 +309,6 @@ jobs:
           go-version-file: go.mod
 
       - name: Build Flared
-        working-directory: openflared
         env:
           CGO_ENABLED: 0
           GOOS: ${{ matrix.goos }}
@@ -321,9 +317,9 @@ jobs:
           VERSION: ${{ needs.prepare.outputs.version }}
         run: |
           go mod download
-          mkdir -p ../dist
+          mkdir -p dist
-          go build -trimpath -ldflags "-s -w -X 'github.com/rain-kl/openflare/openflared/internal/config.Version=$VERSION'" -o "../dist/$ASSET_NAME" ./cmd/flared
+          go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/apps/flared/config.Version=$VERSION'" -o "dist/$ASSET_NAME" ./cmd/flared/main.go
-          (cd ../dist && sha256sum "$ASSET_NAME" > "$ASSET_NAME.sha256")
+          (cd dist && sha256sum "$ASSET_NAME" > "$ASSET_NAME.sha256")
 
       - name: Upload Flared Artifact
         uses: actions/upload-artifact@v4

.gitignore

@@ -1,57 +1,80 @@
-.cache
+# IDE
-.gocache*
+.idea/*
 .idea
+!.idea/icon.png
 .vscode
-/upload/
+.pnpm-store/
-*.exe
+
-*.db
+# logs
-build
-*.log
 /logs/
-.gocache
+*.log
 
-# If you prefer the allow list template instead of the deny list, see community template:
+# config
-# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+config.yaml
-#
+.env
-# Binaries for programs and plugins
+.env.*
-*.exe~
+!.env.example
-*.dll
-*.so
-*.dylib
 
-# Test binary, built with `go test -c`
+# sqlite
-*.test
+*.db
+*.db-journal
+*.db-shm
+*.db-wal
 
-# Code coverage profiles and other test artifacts
+# frontend
+frontend/build
+frontend/disk
+frontend/node_modules/*
+frontend/.next/*
+frontend/next-env.d.ts
+frontend/package-lock.json
+frontend/.env
+*.tsbuildinfo
+
+# os
+.DS_Store
+Thumbs.db
+
+# build
+/build/
+/bin/
+/dist/
+
+# go workspace
+go.work
+go.work.sum
+main
+
+# upload
+/uploads/
+s3_cache
+
+/frontend/.next/
+/data/
+/internal/router/dist/
+/frontend/out/
+/internal/router/root/dist/
+.dmux/
+
+# test coverage
 *.out
 coverage.*
 *.coverprofile
 profile.cov
 
-# Dependency directories (remove the comment below to include it)
+# generic ignores
-# vendor/
+.cache
-
+.gocache*
-# Go workspace file
+*.exe
-go.work
+*.exe~
-go.work.sum
+*.dll
-
+*.so
-# env file
+*.dylib
-.env
+*.test
-
-# Editor/IDE
-# .idea/
-# .vscode/
-
-.DS_Store
-.codex-cache
-/.gomodcache/
-*.mmdb
-!openflare_agent/internal/geoipdata/GeoLite2-Country.mmdb
-
 *-source
 *-source.zip
 .codex*
-
-/bin/
-.dmux/
 .grok
+/.gomodcache/
+*.mmdb
+!openflare_agent/internal/geoipdata/GeoLite2-Country.mmdb

cmd/agent/main.go

@@ -8,17 +8,17 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/Rain-kl/Wavelet/internal/agent/agent"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/agent"
-	"github.com/Rain-kl/Wavelet/internal/agent/config"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/config"
-	"github.com/Rain-kl/Wavelet/internal/agent/geoipupdate"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/geoipupdate"
-	"github.com/Rain-kl/Wavelet/internal/agent/heartbeat"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/heartbeat"
-	"github.com/Rain-kl/Wavelet/internal/agent/httpclient"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/httpclient"
-	"github.com/Rain-kl/Wavelet/internal/agent/logging"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/logging"
-	"github.com/Rain-kl/Wavelet/internal/agent/nginx"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/nginx"
-	"github.com/Rain-kl/Wavelet/internal/agent/state"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/state"
-	syncservice "github.com/Rain-kl/Wavelet/internal/agent/sync"
+	syncservice "github.com/Rain-kl/Wavelet/internal/apps/agent/sync"
-	"github.com/Rain-kl/Wavelet/internal/agent/updater"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/updater"
-	"github.com/Rain-kl/Wavelet/internal/agent/wsclient"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/wsclient"
 )
 
 func main() {

cmd/flared/main.go

@@ -9,13 +9,13 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/Rain-kl/Wavelet/internal/flared/config"
+	"github.com/Rain-kl/Wavelet/internal/apps/flared/config"
-	"github.com/Rain-kl/Wavelet/internal/flared/flared"
+	"github.com/Rain-kl/Wavelet/internal/apps/flared/flared"
-	"github.com/Rain-kl/Wavelet/internal/flared/frpc"
+	"github.com/Rain-kl/Wavelet/internal/apps/flared/frpc"
-	"github.com/Rain-kl/Wavelet/internal/flared/heartbeat"
+	"github.com/Rain-kl/Wavelet/internal/apps/flared/heartbeat"
-	"github.com/Rain-kl/Wavelet/internal/flared/httpclient"
+	"github.com/Rain-kl/Wavelet/internal/apps/flared/httpclient"
-	"github.com/Rain-kl/Wavelet/internal/flared/sync"
+	"github.com/Rain-kl/Wavelet/internal/apps/flared/sync"
-	"github.com/Rain-kl/Wavelet/internal/flared/wsclient"
+	"github.com/Rain-kl/Wavelet/internal/apps/flared/wsclient"
 )
 
 func main() {

cmd/relay/main.go

@@ -9,13 +9,13 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/Rain-kl/Wavelet/internal/relay/config"
+	"github.com/Rain-kl/Wavelet/internal/apps/relay/config"
-	"github.com/Rain-kl/Wavelet/internal/relay/frps"
+	"github.com/Rain-kl/Wavelet/internal/apps/relay/frps"
-	"github.com/Rain-kl/Wavelet/internal/relay/heartbeat"
+	"github.com/Rain-kl/Wavelet/internal/apps/relay/heartbeat"
-	"github.com/Rain-kl/Wavelet/internal/relay/httpclient"
+	"github.com/Rain-kl/Wavelet/internal/apps/relay/httpclient"
-	"github.com/Rain-kl/Wavelet/internal/relay/relay"
+	"github.com/Rain-kl/Wavelet/internal/apps/relay/relay"
-	"github.com/Rain-kl/Wavelet/internal/relay/state"
+	"github.com/Rain-kl/Wavelet/internal/apps/relay/state"
-	"github.com/Rain-kl/Wavelet/internal/relay/wsclient"
+	"github.com/Rain-kl/Wavelet/internal/apps/relay/wsclient"
 )
 
 func main() {

docker-compose.yaml

@@ -1,30 +1,120 @@
 services:
+  wavelet:
+    build:
+      context: .
+      dockerfile: docker/Dockerfile
+      args:
+        VERSION: v0.9.9
+#    image: ghcr.io/rain-kl/wavelet:latest
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      TZ: ${TZ:-Asia/Shanghai}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-http://jaeger:4317}
+      OTEL_EXPORTER_OTLP_INSECURE: ${OTEL_EXPORTER_OTLP_INSECURE:-true}
+      OTEL_SAMPLING_RATE: ${OTEL_SAMPLING_RATE:-1.0}
+    ports:
+      - "${APP_PORT:-3000}:3000"
+    volumes:
+      - ./uploads:/app/uploads
+      - ./data/sqlite:/app/data
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      clickhouse:
+        condition: service_healthy
+      jaeger:
+        condition: service_started
+
+  postgres:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-openflare}
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
+      TZ: ${TZ:-Asia/Shanghai}
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    volumes:
+      - ./data/postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-openflare}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+
+  redis:
+    image: valkey/valkey:8.0-alpine
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    ports:
+      - "${REDIS_PORT:-6379}:6379"
+    volumes:
+      - ./data/valkey:/data
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
+
+  jaeger:
+    image: jaegertracing/jaeger:${JAEGER_VERSION:-2.19.0}
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ:-Asia/Shanghai}
+    ports:
+      - "${JAEGER_UI_PORT:-16686}:16686"
+      - "${JAEGER_OTLP_GRPC_PORT:-4317}:4317"
+      - "${JAEGER_OTLP_HTTP_PORT:-4318}:4318"
+
+  clickhouse:
+    image: clickhouse/clickhouse-server:25.3-alpine
+    restart: unless-stopped
+    environment:
+      CLICKHOUSE_DB: ${CLICKHOUSE_DB:-openflare}
+      CLICKHOUSE_USER: ${CLICKHOUSE_USER:-default}
+      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-}
+      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
+      TZ: ${TZ:-Asia/Shanghai}
+    ports:
+      - "${CLICKHOUSE_HTTP_PORT:-8123}:8123"
+      - "${CLICKHOUSE_NATIVE_PORT:-9000}:9000"
+    volumes:
+      - ./data/clickhouse_data:/var/lib/clickhouse
+    healthcheck:
+      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+
   agent:
     build:
-        context: ./openflare-server
+      context: .
       dockerfile: docker/Dockerfile.agent
     container_name: openflare-agent
     restart: unless-stopped
-
     ports:
       - "80:80"
       - "443:443"
       - "127.0.0.1:18081:18081"
-
     volumes:
       - ./data/agent/:/data
-
     environment:
       OPENFLARE_SERVER_URL: "http://host.docker.internal:3000"
       OPENFLARE_AGENT_TOKEN: "ce5a664631a7c5c54d3406a376847535"
       LOG_LEVEL: "debug"
-
     extra_hosts:
       - "host.docker.internal:host-gateway"
 
   relay:
     build:
-      context: ./openflare-server
+      context: .
       dockerfile: docker/Dockerfile.relay
     container_name: openflare-relay
     network_mode: host
@@ -38,10 +128,9 @@ services:
     extra_hosts:
       - "host.docker.internal:host-gateway"
 
-
   flared:
     build:
-      context: ./openflare-server
+      context: .
       dockerfile: docker/Dockerfile.flared
     container_name: openflare-flared
     network_mode: "host"
@@ -51,5 +140,3 @@ services:
     environment:
       OPENFLARE_SERVER_URL: "http://host.docker.internal:3000"
       OPENFLARE_TUNNEL_TOKEN: deb0783ac1e264a9d86440169aca0f09
-
-

docker/Dockerfile.agent

@@ -19,7 +19,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 COPY . .
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
-    go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/agent/config.Version=$VERSION'" -o /build/bin/openflare-agent ./cmd/agent/main.go
+    go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/apps/agent/config.Version=$VERSION'" -o /build/bin/openflare-agent ./cmd/agent/main.go
 
 FROM openresty/openresty:alpine
 

docker/Dockerfile.flared

@@ -13,7 +13,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 COPY . .
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
-    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/flared/config.Version=$VERSION'" -o flared ./cmd/flared/main.go
+    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/apps/flared/config.Version=$VERSION'" -o flared ./cmd/flared/main.go
 
 # Final runtime image
 FROM fatedier/frpc:v0.69.0

docker/Dockerfile.relay

@@ -13,7 +13,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 COPY . .
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
-    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/relay/config.Version=$VERSION'" -o /build/bin/openflare-relay ./cmd/relay/main.go
+    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/apps/relay/config.Version=$VERSION'" -o /build/bin/openflare-relay ./cmd/relay/main.go
 
 # Final runtime image
 FROM fatedier/frps:v0.69.0

docs/design/index.md

@@ -66,17 +66,15 @@ OpenFlare 适合需要统一管理多台 OpenResty 代理节点的团队，具
 
 | 路径                   | 职责                                                 |
 | ---------------------- | ---------------------------------------------------- |
-| `openflare-server`     | Gin + GORM + SQLite/PostgreSQL 单体控制面            |
+| `cmd`                  | 各组件的命令行启动入口及主函数（server, agent, relay, flared） |
-| `openflare-server/frontend` | Next.js App Router 管理端前端，由 Go Server 嵌入托管  |
+| `internal`             | 各组件的内部业务逻辑，通过子包隔离控制（agent, relay, flared, 核心控制面等） |
+| `frontend`             | Next.js App Router 管理端前端，由 Go Server 嵌入托管  |
 | `pkg`                  | 跨组件复用的协议类型与通用工具包                     |
-| `openflare-agent`      | Go 单体 Agent，运行在节点侧                          |
-| `openflare-relay`      | Tunnel 中继代理，运行在公网边缘管理 frps 进程        |
-| `openflared`           | Tunnel 客户端，运行在内网服务器侧管理 frpc 进程      |
 | `scripts`              | 安装、自更新等系统辅助脚本                           |
 | `docs`                 | VitePress 文档站、设计基线、开发规范、部署与配置文档 |
-| `docs/en`              | 英文版文档                                           |
+| `docker`               | 各组件 of Dockerfile 构建文件                         |
 
-### 1. Server 分层 (`openflare-server/`)
+### 1. Server 分层 (`internal/` / `cmd/server/`)
 
 | 目录                    | 职责                                             |
 | ----------------------- | ------------------------------------------------ |
@@ -90,7 +88,7 @@ OpenFlare 适合需要统一管理多台 OpenResty 代理节点的团队，具
 | `internal/common/`      | 配置、全局状态与初始化入口                       |
 | `internal/job/`         | 定时任务（各业务定时逻辑在独立文件中定义，cron.go 仅用于初始化调度） |
 | `internal/utils/`       | 仅 Server 内部使用的基础能力包，如 ACME、限流、验证码、邮件、安全校验等 |
-| `pkg/protocol/`         | Server、Relay、OpenFlared 之间共享的 HTTP/WS 协议结构 |
+| `pkg/protocol/`         | Server、Relay、OpenFlared 之间共享 of HTTP/WS 协议结构 |
 | `pkg/utils/`            | 跨组件可复用的纯工具函数                         |
 | `pkg/geoip`、`pkg/render`、`pkg/wsclient` | 被多个组件复用的 GeoIP、OpenResty 配置渲染与 WebSocket 客户端能力 |
 | `upload/`               | 运行时本地临时文件上传目录（在 .gitignore 中忽略） |
@@ -98,27 +96,27 @@ OpenFlare 适合需要统一管理多台 OpenResty 代理节点的团队，具
 | `docs/`                 | API 文档（Swagger）                              |
 | `data/`                 | 静态数据（如 GeoIP 数据库）                      |
 
-### 2. Agent 模块 (`openflare-agent/`)
+### 2. Agent 模块 (`internal/apps/agent/` / `cmd/agent/`)
 
 | 目录/模块                     | 职责                                         |
 | ----------------------------- | -------------------------------------------- |
 | `cmd/agent/`                  | Agent 命令行启动入口及主函数                 |
-| `internal/config/`            | 配置读取与默认值                             |
+| `internal/apps/agent/config/`      | 配置读取与默认值                             |
-| `internal/heartbeat/`         | 心跳与版本摘要判断                           |
+| `internal/apps/agent/heartbeat/`   | 心跳与版本摘要判断                           |
-| `internal/sync/`              | 配置拉取与应用编排                           |
+| `internal/apps/agent/sync/`        | 配置拉取与应用编排                           |
-| `internal/nginx/`             | OpenResty 文件写入、校验、reload、启动与回滚 |
+| `internal/apps/agent/nginx/`       | OpenResty 文件写入、校验、reload、启动与回滚 |
-| `internal/state/`             | 本地状态与观测补报缓冲                       |
+| `internal/apps/agent/state/`       | 本地状态与观测补报缓冲                       |
-| `internal/httpclient/`        | Server 通信                                  |
+| `internal/apps/agent/httpclient/`  | Server 通信                                  |
-| `internal/wsclient/`          | WebSocket 客户端通信                         |
+| `internal/apps/agent/wsclient/`    | WebSocket 客户端通信                         |
-| `internal/protocol/`          | Agent API 协议类型                           |
+| `internal/apps/agent/protocol/`    | Agent API 协议类型                           |
-| `internal/updater/`           | Agent 自更新逻辑                             |
+| `internal/apps/agent/updater/`     | Agent 自更新逻辑                             |
-| `internal/logging/`           | 日志处理                                     |
+| `internal/apps/agent/logging/`     | 日志处理                                     |
-| `internal/observability/`     | 可观测性（指标、链路等）                     |
+| `internal/apps/agent/observability/`| 可观测性（指标、链路等）                     |
-| `internal/geoipdata/`         | GeoIP 数据处理                               |
+| `internal/apps/agent/geoipdata/`   | GeoIP 数据处理                               |
-| `internal/geoipupdate/`       | GeoIP 数据更新                               |
+| `internal/apps/agent/geoipupdate/` | GeoIP 数据更新                               |
-| `internal/agent/`             | 核心 Agent 逻辑与生命周期                    |
+| `internal/apps/agent/agent/`       | 核心 Agent 逻辑与生命周期                    |
 
-### 3. Frontend 分层 (`openflare-server/web/`)
+### 3. Frontend 分层 (`frontend/`)
 
 | 目录          | 职责                                         |
 | ------------- | -------------------------------------------- |
@@ -133,34 +131,34 @@ OpenFlare 适合需要统一管理多台 OpenResty 代理节点的团队，具
 | `scripts/`    | 构建和部署相关脚本                           |
 | `public/`     | 静态资源                                     |
 
-### 4. Relay 模块 (`openflare-relay/`)
+### 4. Relay 模块 (`internal/apps/relay/` / `cmd/relay/`)
 
 | 模块             | 职责                                             |
 | ---------------- | ------------------------------------------------ |
 | `cmd/`           | Relay 命令行启动入口及初始化主函数               |
-| `internal/config/`| 本地配置文件解析与默认参数初始化                 |
+| `internal/apps/relay/config/`| 本地配置文件解析与默认参数初始化                 |
-| `internal/frps/` | 管理 frps 进程生命周期、端口与 Token 并监控运行   |
+| `internal/apps/relay/frps/` | 管理 frps 进程生命周期、端口与 Token 并监控运行   |
-| `internal/heartbeat/`| 周期性 HTTP 心跳通信、上报状态并获取更新请求  |
+| `internal/apps/relay/heartbeat/`| 周期性 HTTP 心跳通信、上报状态并获取更新请求  |
-| `internal/httpclient/`| Server 的通用 API 客户端调用工具类              |
+| `internal/apps/relay/httpclient/`| Server 的通用 API 客户端调用工具类              |
-| `internal/observability/`| 采集本地宿主机、frps 的基础运行指标并进行预聚合 |
+| `internal/apps/relay/observability/`| 采集本地宿主机、frps 的基础运行指标并进行预聚合 |
-| `internal/relay/` | 协调中继的核心生命周期、初始化与清理             |
+| `internal/apps/relay/relay/` | 协调中继的核心生命周期、初始化与清理             |
-| `internal/state/` | 本地运行时状态、错误记录与持久化缓存             |
+| `internal/apps/relay/state/` | 本地运行时状态、错误记录与持久化缓存             |
-| `internal/updater/`| Relay 升级检查、下载安装与重启机制               |
+| `internal/apps/relay/updater/`| Relay 升级检查、下载安装与重启机制               |
-| `internal/wsclient/`| 与 Server 保持的长连接 WebSocket 双向通信管道     |
+| `internal/apps/relay/wsclient/`| 与 Server 保持的长连接 WebSocket 双向通信管道     |
 
-### 5. OpenFlared (Client) 模块 (`openflared/`)
+### 5. OpenFlared (Client) 模块 (`internal/apps/flared/` / `cmd/flared/`)
 
 | 模块             | 职责                                             |
 | ---------------- | ------------------------------------------------ |
 | `cmd/`           | Client 命令行启动入口及初始化主函数              |
-| `internal/config/`| 本地客户端配置加载与解析                         |
+| `internal/apps/flared/config/`| 本地客户端配置加载与解析                         |
-| `internal/flared/`| 内网穿透客户端的核心调度与状态管理机制           |
+| `internal/apps/flared/flared/`| 内网穿透客户端的核心调度与状态管理机制           |
-| `internal/frpc/` | 热重载/动态生成多 Relay 的 `frpc.toml` 并监控 frpc |
+| `internal/apps/flared/frpc/` | 热重载/动态生成多 Relay 的 `frpc.toml` 并监控 frpc |
-| `internal/heartbeat/`| 与控制面进行的心跳通信，包含 Token 校验机制       |
+| `internal/apps/flared/heartbeat/`| 与控制面进行的心跳通信，包含 Token 校验机制       |
-| `internal/httpclient/`| 客户端通用 API 通信客户端                       |
+| `internal/apps/flared/httpclient/`| 客户端通用 API 通信客户端                       |
-| `internal/sync/`  | 增量拉取最新 Tunnel 路由绑定关系、生成快照并应用  |
+| `internal/apps/flared/sync/`  | 增量拉取最新 Tunnel 路由绑定关系、生成快照并应用  |
-| `internal/updater/`| 客户端自更新、新版检查与更新落地逻辑             |
+| `internal/apps/flared/updater/`| 客户端自更新、新版检查与更新落地逻辑             |
-| `internal/wsclient/`| 用于实时监听 Server 端隧道配置变更推送的 WS 信道  |
+| `internal/apps/flared/wsclient/`| 用于实时监听 Server 端隧道配置变更推送的 WS 信道  |
 
 ---