[功能] 添加OpenRestyResolvers支持，优化DNS解析器配置和验证逻辑

openflare_agent/cmd/agent/main.go

@@ -73,7 +73,7 @@ func main() {
 		NginxLuaDir:                  cfg.OpenrestyLuaDir,
 		OpenrestyObservabilityListen: nginx.ObservabilityListenAddress(cfg.OpenrestyPath, cfg.OpenrestyObservabilityPort),
 		OpenrestyObservabilityPort:   cfg.OpenrestyObservabilityPort,
-		OpenrestyResolverDirective:   nginx.ResolverDirective(cfg.OpenrestyPath),
+		OpenrestyResolverDirective:   "",
 		Executor: nginx.NewExecutor(nginx.ExecutorOptions{
 			NginxPath:                  cfg.OpenrestyPath,
 			DockerBinary:               cfg.DockerBinary,

openflare_agent/internal/config/config.go

@@ -33,6 +33,7 @@ type Config struct {
 	AgentVersion               string              `json:"-"`
 	NginxVersion               string              `json:"-"`
 	OpenrestyPath              string              `json:"openresty_path"`
+	OpenrestyResolvers         []string            `json:"openresty_resolvers,omitempty"`
 	OpenrestyContainerName     string              `json:"openresty_container_name"`
 	OpenrestyDockerImage       string              `json:"openresty_docker_image"`
 	DockerBinary               string              `json:"docker_binary"`
@@ -59,6 +60,7 @@ type configFile struct {
 	NodeName                   string              `json:"node_name"`
 	NodeIP                     string              `json:"node_ip"`
 	OpenrestyPath              string              `json:"openresty_path"`
+	OpenrestyResolvers         []string            `json:"openresty_resolvers"`
 	OpenrestyContainerName     string              `json:"openresty_container_name"`
 	OpenrestyDockerImage       string              `json:"openresty_docker_image"`
 	DockerBinary               string              `json:"docker_binary"`
@@ -93,6 +95,7 @@ func Load(path string) (*Config, error) {
 		NodeName:                   file.NodeName,
 		NodeIP:                     file.NodeIP,
 		OpenrestyPath:              file.OpenrestyPath,
+		OpenrestyResolvers:         append([]string{}, file.OpenrestyResolvers...),
 		OpenrestyContainerName:     file.OpenrestyContainerName,
 		OpenrestyDockerImage:       file.OpenrestyDockerImage,
 		DockerBinary:               file.DockerBinary,
@@ -121,6 +124,7 @@ func Load(path string) (*Config, error) {
 func applyDefaults(cfg *Config, baseDir string) {
 	baseDir = filepath.Clean(baseDir)
 	cfg.AgentVersion = AgentVersion
+	cfg.OpenrestyResolvers = normalizeResolverList(cfg.OpenrestyResolvers)
 	if cfg.OpenrestyContainerName == "" {
 		cfg.OpenrestyContainerName = "openflare-openresty"
 	}
@@ -290,6 +294,29 @@ func detectHostname() string {
 	return strings.TrimSpace(host)
 }
 
+func normalizeResolverList(values []string) []string {
+	if len(values) == 0 {
+		return nil
+	}
+	result := make([]string, 0, len(values))
+	seen := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		trimmed := strings.TrimSpace(value)
+		if trimmed == "" {
+			continue
+		}
+		if _, ok := seen[trimmed]; ok {
+			continue
+		}
+		seen[trimmed] = struct{}{}
+		result = append(result, trimmed)
+	}
+	if len(result) == 0 {
+		return nil
+	}
+	return result
+}
+
 func firstNonEmpty(values ...string) string {
 	for _, value := range values {
 		if strings.TrimSpace(value) != "" {

openflare_agent/internal/config/config_test.go

@@ -120,6 +120,40 @@ func TestLoadPathModeKeepsExplicitPaths(t *testing.T) {
 	}
 }
 
+func TestLoadNormalizesExplicitResolvers(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "agent.json")
+	payload := map[string]any{
+		"server_url":          "http://127.0.0.1:3000",
+		"agent_token":         "token",
+		"node_name":           "edge-01",
+		"node_ip":             "10.0.0.8",
+		"openresty_resolvers": []string{" 10.0.0.2 ", "10.0.0.2", "", "1.1.1.1"},
+	}
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+	if err = os.WriteFile(configPath, data, 0o644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+
+	expected := []string{"10.0.0.2", "1.1.1.1"}
+	if len(cfg.OpenrestyResolvers) != len(expected) {
+		t.Fatalf("unexpected resolver count: %#v", cfg.OpenrestyResolvers)
+	}
+	for index, value := range expected {
+		if cfg.OpenrestyResolvers[index] != value {
+			t.Fatalf("unexpected resolver at %d: got %q want %q", index, cfg.OpenrestyResolvers[index], value)
+		}
+	}
+}
+
 func TestLoadUsesCustomDataDirForGeneratedFiles(t *testing.T) {
 	dir := t.TempDir()
 	configPath := filepath.Join(dir, "agent.json")
@@ -209,6 +243,7 @@ func TestSavePersistsMillisecondsAndOmitsRuntimeVersions(t *testing.T) {
 	cfg.NginxVersion = "1.27.1.2"
 	cfg.HeartbeatInterval = MillisecondDuration(5 * time.Second)
 	cfg.RequestTimeout = MillisecondDuration(7 * time.Second)
+	cfg.OpenrestyResolvers = []string{"10.0.0.2", "1.1.1.1"}
 
 	if err = cfg.Save(); err != nil {
 		t.Fatalf("Save failed: %v", err)
@@ -234,6 +269,10 @@ func TestSavePersistsMillisecondsAndOmitsRuntimeVersions(t *testing.T) {
 	if decoded["request_timeout"] != float64(7000) {
 		t.Fatalf("unexpected request timeout: %#v", decoded["request_timeout"])
 	}
+	resolvers, ok := decoded["openresty_resolvers"].([]any)
+	if !ok || len(resolvers) != 2 || resolvers[0] != "10.0.0.2" || resolvers[1] != "1.1.1.1" {
+		t.Fatalf("unexpected resolvers: %#v", decoded["openresty_resolvers"])
+	}
 	if decoded["openresty_observability_port"] != float64(defaultOpenRestyObservabilityPort) {
 		t.Fatalf("unexpected observability port: %#v", decoded["openresty_observability_port"])
 	}

openflare_agent/internal/nginx/manager.go

@@ -8,6 +8,8 @@ import (
 	"fmt"
 	"io/fs"
 	"log/slog"
+	"net"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -394,6 +396,9 @@ func (m *Manager) writeTargetFiles(mainConfig string, routeConfig string, suppor
 	if err := m.writeCertFiles(supportFiles); err != nil {
 		return err
 	}
+	if strings.TrimSpace(m.OpenrestyResolverDirective) == "" && strings.Contains(routeConfig, "set $openflare_upstream ") {
+		slog.Warn("runtime-resolved hostname upstreams detected without available resolvers; hostname origin requests may fail until resolvers are configured")
+	}
 	renderedMainConfig := m.renderMainConfig(mainConfig)
 	if err := os.WriteFile(m.MainConfigPath, []byte(renderedMainConfig), 0o644); err != nil {
 		return err
@@ -1022,23 +1027,27 @@ func ObservabilityListenAddress(openrestyPath string, port int) string {
 	return fmt.Sprintf("%d", port)
 }
 
-func ResolverDirective(openrestyPath string) string {
-	resolvers := resolverAddresses(openrestyPath)
+func ResolverDirective(openrestyPath string, explicitResolvers []string) string {
+	resolvers := resolverAddresses(openrestyPath, explicitResolvers)
 	if len(resolvers) == 0 {
 		return ""
 	}
 	return fmt.Sprintf("    resolver %s valid=30s ipv6=off;\n    resolver_timeout 5s;\n", strings.Join(resolvers, " "))
 }
 
-func resolverAddresses(openrestyPath string) []string {
-	if strings.TrimSpace(openrestyPath) == "" {
-		return []string{"127.0.0.11"}
+func resolverAddresses(openrestyPath string, explicitResolvers []string) []string {
+	if resolvers := normalizeResolverAddresses(explicitResolvers); len(resolvers) > 0 {
+		return resolvers
 	}
 	data, err := os.ReadFile("/etc/resolv.conf")
 	if err != nil {
 		return nil
 	}
-	lines := strings.Split(string(data), "\n")
+	return parseResolverAddresses(string(data), strings.TrimSpace(openrestyPath) == "")
+}
+
+func parseResolverAddresses(content string, dockerMode bool) []string {
+	lines := strings.Split(content, "\n")
 	resolvers := make([]string, 0, 2)
 	seen := make(map[string]struct{})
 	for _, line := range lines {
@@ -1050,6 +1059,9 @@ func resolverAddresses(openrestyPath string) []string {
 		if addr == "" {
 			continue
 		}
+		if dockerMode && !isUsableDockerResolver(addr) {
+			continue
+		}
 		if _, ok := seen[addr]; ok {
 			continue
 		}
@@ -1059,6 +1071,45 @@ func resolverAddresses(openrestyPath string) []string {
 	return resolvers
 }
 
+func isUsableDockerResolver(addr string) bool {
+	ip := net.ParseIP(addr)
+	if ip == nil {
+		return false
+	}
+	return !ip.IsLoopback() && !ip.IsUnspecified()
+}
+
+func normalizeResolverAddresses(values []string) []string {
+	if len(values) == 0 {
+		return nil
+	}
+	resolvers := make([]string, 0, len(values))
+	seen := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		addr := strings.TrimSpace(value)
+		if addr == "" {
+			continue
+		}
+		if _, ok := seen[addr]; ok {
+			continue
+		}
+		seen[addr] = struct{}{}
+		resolvers = append(resolvers, addr)
+	}
+	if len(resolvers) == 0 {
+		return nil
+	}
+	return resolvers
+}
+
+func RequiresRuntimeResolver(originURL string) bool {
+	parsed, err := url.Parse(strings.TrimSpace(originURL))
+	if err != nil || parsed.Hostname() == "" {
+		return false
+	}
+	return net.ParseIP(parsed.Hostname()) == nil
+}
+
 func (m *Manager) routeConfigIncludePath() string {
 	if strings.TrimSpace(m.RuntimeRouteConfigPath) != "" {
 		return strings.TrimSpace(m.RuntimeRouteConfigPath)

openflare_agent/internal/nginx/manager_test.go

@@ -762,10 +762,55 @@ func TestManagerApplyWritesSupportFilesAndReplacesPlaceholder(t *testing.T) {
 	}
 }
 
-func TestResolverDirectiveForDockerMode(t *testing.T) {
-	got := ResolverDirective("")
-	if !strings.Contains(got, "resolver 127.0.0.11") {
-		t.Fatalf("expected docker resolver directive, got %q", got)
+func TestResolverDirectiveUsesExplicitResolvers(t *testing.T) {
+	got := ResolverDirective("", []string{"10.0.0.2", "1.1.1.1"})
+	if !strings.Contains(got, "resolver 10.0.0.2 1.1.1.1") {
+		t.Fatalf("expected explicit resolver directive, got %q", got)
+	}
+}
+
+func TestParseResolverAddressesFiltersLoopbackForDocker(t *testing.T) {
+	content := strings.Join([]string{
+		"nameserver 127.0.0.53",
+		"nameserver 10.0.0.2",
+		"nameserver ::1",
+		"nameserver 1.1.1.1",
+	}, "\n")
+	got := parseResolverAddresses(content, true)
+	expected := []string{"10.0.0.2", "1.1.1.1"}
+	if !reflect.DeepEqual(got, expected) {
+		t.Fatalf("unexpected docker resolvers: got %#v want %#v", got, expected)
+	}
+}
+
+func TestParseResolverAddressesKeepsLoopbackForLocalBinary(t *testing.T) {
+	content := strings.Join([]string{
+		"nameserver 127.0.0.53",
+		"nameserver 10.0.0.2",
+	}, "\n")
+	got := parseResolverAddresses(content, false)
+	expected := []string{"127.0.0.53", "10.0.0.2"}
+	if !reflect.DeepEqual(got, expected) {
+		t.Fatalf("unexpected local resolvers: got %#v want %#v", got, expected)
+	}
+}
+
+func TestRequiresRuntimeResolver(t *testing.T) {
+	testCases := []struct {
+		name      string
+		originURL string
+		want      bool
+	}{
+		{name: "hostname", originURL: "https://origin.internal", want: true},
+		{name: "ipv4", originURL: "https://10.0.0.8", want: false},
+		{name: "ipv6", originURL: "https://[2001:db8::1]", want: false},
+		{name: "invalid", originURL: "://bad", want: false},
+	}
+
+	for _, testCase := range testCases {
+		if got := RequiresRuntimeResolver(testCase.originURL); got != testCase.want {
+			t.Fatalf("%s: got %v want %v", testCase.name, got, testCase.want)
+		}
 	}
 }