[功能] POW 集成

openflare_server/service/agent.go

@@ -217,7 +217,7 @@ func GetActiveConfigForAgent() (*AgentConfigResponse, error) {
 			return nil, err
 		}
 	}
-	supportFiles = filterCertificateSupportFiles(supportFiles)
+	supportFiles = filterAgentSupportFiles(supportFiles)
 	slog.Debug("agent fetched active config", "version", version.Version, "checksum", version.Checksum)
 	return &AgentConfigResponse{
 		Version:        version.Version,
@@ -230,7 +230,7 @@ func GetActiveConfigForAgent() (*AgentConfigResponse, error) {
 	}, nil
 }
 
-func filterCertificateSupportFiles(files []SupportFile) []SupportFile {
+func filterAgentSupportFiles(files []SupportFile) []SupportFile {
 	if len(files) == 0 {
 		return nil
 	}
@@ -240,6 +240,8 @@ func filterCertificateSupportFiles(files []SupportFile) []SupportFile {
 		switch {
 		case strings.HasSuffix(path, ".crt"), strings.HasSuffix(path, ".key"), strings.HasSuffix(path, ".pem"):
 			filtered = append(filtered, file)
+		case path == "pow_config.json":
+			filtered = append(filtered, file)
 		}
 	}
 	return filtered

openflare_server/service/agent_test.go

@@ -0,0 +1,41 @@
+package service
+
+import "testing"
+
+func TestGetActiveConfigForAgentIncludesPoWConfig(t *testing.T) {
+	setupServiceTestDB(t)
+
+	_, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:     "pow-agent.example.com",
+		OriginURL:  "https://origin.internal",
+		Enabled:    true,
+		PoWEnabled: true,
+		PoWConfig:  `{"difficulty":4,"algorithm":"fast","session_ttl":86400,"challenge_ttl":300,"whitelist":{"paths":["/.well-known/*","/favicon.ico","/robots.txt"],"user_agents":["Googlebot","bingbot","Baiduspider"]},"blacklist":{"ips":[],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]}}`,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	if _, err := PublishConfigVersion("root"); err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+
+	activeConfig, err := GetActiveConfigForAgent()
+	if err != nil {
+		t.Fatalf("GetActiveConfigForAgent failed: %v", err)
+	}
+
+	foundPowConfig := false
+	for _, file := range activeConfig.SupportFiles {
+		if file.Path != "pow_config.json" {
+			continue
+		}
+		foundPowConfig = true
+		if file.Content == "" {
+			t.Fatal("expected pow_config.json content to be populated")
+		}
+	}
+	if !foundPowConfig {
+		t.Fatal("expected agent config to include pow_config.json support file")
+	}
+}

openflare_server/service/config_version.go

@@ -83,6 +83,8 @@ type snapshotRoute struct {
 	CachePolicy        string                        `json:"cache_policy,omitempty"`
 	CacheRules         []string                      `json:"cache_rules,omitempty"`
 	CustomHeaders      []ProxyRouteCustomHeaderInput `json:"custom_headers,omitempty"`
+	PoWEnabled         bool                          `json:"pow_enabled,omitempty"`
+	PoWConfig          *ProxyRoutePoWConfig          `json:"pow_config,omitempty"`
 	Remark             string                        `json:"remark,omitempty"`
 }
 
@@ -429,7 +431,13 @@ func buildCurrentConfigBundle(requireRoutes bool) (*configBundle, error) {
 	if err != nil {
 		return nil, err
 	}
+	powConfigJSON, powSupportFiles, err := renderPowConfigBundle(routes)
+	if err != nil {
+		return nil, err
+	}
+	supportFiles = append(supportFiles, powSupportFiles...)
 	mainConfig := renderMainConfig(openRestyConfig)
+	supportFiles = append(supportFiles, SupportFile{Path: "pow_config.json", Content: powConfigJSON})
 	return &configBundle{
 		Routes:            routes,
 		SnapshotRoutes:    snapshotRoutes,
@@ -462,6 +470,13 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 		if err != nil {
 			return nil, fmt.Errorf("路由 %s 缓存规则无效", route.Domain)
 		}
+		powConfig, err := decodeStoredPoWConfig(route.PoWEnabled, route.PoWConfig)
+		if err != nil {
+			return nil, fmt.Errorf("路由 %s PoW 配置无效", route.Domain)
+		}
+		if !route.PoWEnabled {
+			powConfig = nil
+		}
 		items = append(items, snapshotRoute{
 			SiteName:           normalizeProxyRouteSiteNameInput(route, route.SiteName, domains[0]),
 			Domain:             domains[0],
@@ -482,6 +497,8 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 			CachePolicy:        route.CachePolicy,
 			CacheRules:         cacheRules,
 			CustomHeaders:      customHeaders,
+			PoWEnabled:         route.PoWEnabled,
+			PoWConfig:          powConfig,
 			Remark:             route.Remark,
 		})
 	}
@@ -586,6 +603,17 @@ func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
 		if err == nil {
 			routes[index].LimitRate = normalizedLimitRate
 		}
+		if routes[index].PoWEnabled {
+			raw, err := json.Marshal(routes[index].PoWConfig)
+			if err == nil {
+				normalizedPoWConfig, err := normalizePoWConfig(true, string(raw))
+				if err == nil {
+					routes[index].PoWConfig = &normalizedPoWConfig
+				}
+			}
+		} else {
+			routes[index].PoWConfig = nil
+		}
 	}
 	return routes
 }
@@ -611,7 +639,7 @@ func flattenSnapshotRoutesByDomain(routes []snapshotRoute) map[string]snapshotRo
 }
 
 func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
-	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP || left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || !uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
+	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP || left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || left.PoWEnabled != right.PoWEnabled || !uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
 		return false
 	}
 	if len(left.Domains) != len(right.Domains) {
@@ -646,6 +674,41 @@ func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
 			return false
 		}
 	}
+	if !snapshotPoWConfigEqual(left.PoWConfig, right.PoWConfig) {
+		return false
+	}
+	return true
+}
+
+func snapshotPoWConfigEqual(left *ProxyRoutePoWConfig, right *ProxyRoutePoWConfig) bool {
+	if left == nil || right == nil {
+		return left == nil && right == nil
+	}
+	return left.Difficulty == right.Difficulty &&
+		left.Algorithm == right.Algorithm &&
+		left.SessionTTL == right.SessionTTL &&
+		left.ChallengeTTL == right.ChallengeTTL &&
+		stringSliceEqual(left.Whitelist.IPs, right.Whitelist.IPs) &&
+		stringSliceEqual(left.Whitelist.IPCidrs, right.Whitelist.IPCidrs) &&
+		stringSliceEqual(left.Whitelist.Paths, right.Whitelist.Paths) &&
+		stringSliceEqual(left.Whitelist.PathRegexes, right.Whitelist.PathRegexes) &&
+		stringSliceEqual(left.Whitelist.UserAgents, right.Whitelist.UserAgents) &&
+		stringSliceEqual(left.Blacklist.IPs, right.Blacklist.IPs) &&
+		stringSliceEqual(left.Blacklist.IPCidrs, right.Blacklist.IPCidrs) &&
+		stringSliceEqual(left.Blacklist.Paths, right.Blacklist.Paths) &&
+		stringSliceEqual(left.Blacklist.PathRegexes, right.Blacklist.PathRegexes) &&
+		stringSliceEqual(left.Blacklist.UserAgents, right.Blacklist.UserAgents)
+}
+
+func stringSliceEqual(left []string, right []string) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
 	return true
 }
 
@@ -835,7 +898,7 @@ func renderRouteConfig(routes []*model.ProxyRoute, cfg openRestyConfigSnapshot)
 			builder.WriteString(renderNamedUpstreamBlock(upstreamConfig))
 		}
 		if !route.EnableHTTPS {
-			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, cfg))
+			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, cfg))
 			continue
 		}
 		certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
@@ -896,7 +959,7 @@ func renderRouteConfig(routes []*model.ProxyRoute, cfg openRestyConfigSnapshot)
 
 		if route.RedirectHTTP {
 			if len(httpOnlyDomains) > 0 {
-				builder.WriteString(renderHTTPProxyServer(renderServerNames(httpOnlyDomains), route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, cfg))
+				builder.WriteString(renderHTTPProxyServer(renderServerNames(httpOnlyDomains), route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, cfg))
 			}
 			for _, certID := range certIDs {
 				assignedDomains := domainsByCertID[certID]
@@ -906,14 +969,14 @@ func renderRouteConfig(routes []*model.ProxyRoute, cfg openRestyConfigSnapshot)
 				builder.WriteString(renderHTTPRedirectServer(renderServerNames(assignedDomains)))
 			}
 		} else {
-			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, cfg))
+			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, cfg))
 		}
 		for _, certID := range certIDs {
 			assignedDomains := domainsByCertID[certID]
 			if len(assignedDomains) == 0 {
 				continue
 			}
-			builder.WriteString(renderHTTPSServer(renderServerNames(assignedDomains), route.OriginURL, route.OriginHost, certID, customHeaders, cacheConfig, limitConfig, upstreamConfig, cfg))
+			builder.WriteString(renderHTTPSServer(renderServerNames(assignedDomains), route.OriginURL, route.OriginHost, certID, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, cfg))
 		}
 	}
 	return builder.String(), dedupeSupportFiles(supportFiles), nil
@@ -1020,6 +1083,32 @@ func onOff(value bool) string {
 	return "off"
 }
 
+const nginxPowStaticDirPlaceholder = "__OPENFLARE_POW_STATIC_DIR__"
+
+func renderPowAccessBlock(powEnabled bool) string {
+	if !powEnabled {
+		return ""
+	}
+	return fmt.Sprintf("        access_by_lua_file %s/pow/check.lua;\n", nginxLuaDirPlaceholder)
+}
+
+func renderPowLocationBlocks(powEnabled bool) string {
+	if !powEnabled {
+		return ""
+	}
+	return fmt.Sprintf("\n    location = %spass-challenge {\n        content_by_lua_file %s/pow/verify.lua;\n    }\n\n    location = %smake-challenge {\n        content_by_lua_file %s/pow/challenge.lua;\n    }\n\n", anubisAPIPrefix, nginxLuaDirPlaceholder, anubisAPIPrefix, nginxLuaDirPlaceholder)
+}
+
+func renderPowStaticLocationBlock(powEnabled bool) string {
+	if !powEnabled {
+		return ""
+	}
+	return fmt.Sprintf("    location %s {\n        alias %s/;\n    }\n\n", anubisStaticPrefix, nginxPowStaticDirPlaceholder)
+}
+
+const anubisStaticPrefix = "/.within.website/x/cmd/anubis/static/"
+const anubisAPIPrefix = "/.within.website/x/cmd/anubis/api/"
+
 func normalizeSnapshotCertificateIDs(primaryCertID *uint, certIDs []uint) ([]uint, *uint, error) {
 	candidates := make([]uint, 0, len(certIDs)+1)
 	if primaryCertID != nil && *primaryCertID != 0 {
@@ -1130,18 +1219,18 @@ func nextVersionNumber(now time.Time) (string, error) {
 	return fmt.Sprintf("%s-%03d", prefix, count+1), nil
 }
 
-func renderHTTPProxyServer(serverNames string, originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, cfg openRestyConfigSnapshot) string {
-	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    location / {\n%s%s%s%s    }\n}\n\n", serverNames, renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig))
+func renderHTTPProxyServer(serverNames string, originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, cfg openRestyConfigSnapshot) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, renderPowLocationBlocks(powEnabled), renderPowAccessBlock(powEnabled), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
 }
 
 func renderHTTPRedirectServer(serverNames string) string {
 	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    return 301 https://$host$request_uri;\n}\n\n", serverNames)
 }
 
-func renderHTTPSServer(serverNames string, originURL string, originHost string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, cfg openRestyConfigSnapshot) string {
+func renderHTTPSServer(serverNames string, originURL string, originHost string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, cfg openRestyConfigSnapshot) string {
 	certPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateCertFileName(certificateID))
 	keyPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateKeyFileName(certificateID))
-	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n\n    location / {\n%s%s%s%s    }\n}\n\n", serverNames, certPath, keyPath, renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig))
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, certPath, keyPath, renderPowLocationBlocks(powEnabled), renderPowAccessBlock(powEnabled), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
 }
 
 func renderHTTPSServerWithCertificates(serverNames string, originURL string, originHost string, certificateIDs []uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, cfg openRestyConfigSnapshot) string {
@@ -1505,3 +1594,40 @@ func dedupeSupportFiles(files []SupportFile) []SupportFile {
 	}
 	return result
 }
+
+func renderPowConfigBundle(routes []*model.ProxyRoute) (string, []SupportFile, error) {
+	type domainEntry struct {
+		Domains []string               `json:"domains"`
+		Enabled bool                   `json:"enabled"`
+		Config  map[string]interface{} `json:"config"`
+	}
+	entries := make([]domainEntry, 0)
+	hasPow := false
+	for _, route := range routes {
+		if !route.PoWEnabled {
+			continue
+		}
+		hasPow = true
+		domains, err := decodeStoredDomains(route.Domains, route.Domain)
+		if err != nil {
+			return "", nil, err
+		}
+		var cfg map[string]interface{}
+		if err := json.Unmarshal([]byte(route.PoWConfig), &cfg); err != nil {
+			return "", nil, fmt.Errorf("route %s pow_config is invalid", route.Domain)
+		}
+		entries = append(entries, domainEntry{
+			Domains: domains,
+			Enabled: true,
+			Config:  cfg,
+		})
+	}
+	if !hasPow {
+		return "{}", nil, nil
+	}
+	data, err := json.Marshal(entries)
+	if err != nil {
+		return "", nil, err
+	}
+	return string(data), nil, nil
+}

openflare_server/service/https_phase1_test.go

@@ -5,6 +5,7 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"encoding/json"
 	"encoding/pem"
 	"math/big"
 	"openflare/common"
@@ -923,6 +924,90 @@ func TestPreviewAndDiffConfigVersion(t *testing.T) {
 	}
 }
 
+func TestPublishConfigVersionDetectsPoWChanges(t *testing.T) {
+	setupServiceTestDB(t)
+
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:    "pow.example.com",
+		OriginURL: "https://origin.internal",
+		Enabled:   true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	firstRelease, err := PublishConfigVersion("root")
+	if err != nil {
+		t.Fatalf("initial PublishConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(firstRelease.Version.SupportFilesJSON, `"path":"pow_config.json"`) {
+		t.Fatal("expected publish to include pow_config.json support file")
+	}
+
+	_, err = UpdateProxyRoute(route.ID, ProxyRouteInput{
+		Domain:       route.Domain,
+		OriginURL:    route.OriginURL,
+		Enabled:      true,
+		PoWEnabled:   true,
+		PoWConfig:    `{"difficulty":5,"algorithm":"slow","session_ttl":7200,"challenge_ttl":180,"whitelist":{"ips":["127.0.0.1"],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]},"blacklist":{"ips":[],"ip_cidrs":[],"paths":["/login"],"path_regexes":[],"user_agents":[]}}`,
+		RedirectHTTP: false,
+	})
+	if err != nil {
+		t.Fatalf("UpdateProxyRoute failed: %v", err)
+	}
+
+	diff, err := DiffConfigVersion()
+	if err != nil {
+		t.Fatalf("DiffConfigVersion failed: %v", err)
+	}
+	if len(diff.ModifiedDomains) != 1 || diff.ModifiedDomains[0] != "pow.example.com" {
+		t.Fatalf("expected PoW change to mark domain as modified, got %#v", diff.ModifiedDomains)
+	}
+	if len(diff.ModifiedSites) != 1 || diff.ModifiedSites[0] != "pow.example.com" {
+		t.Fatalf("expected PoW change to mark site as modified, got %#v", diff.ModifiedSites)
+	}
+
+	secondRelease, err := PublishConfigVersion("root")
+	if err != nil {
+		t.Fatalf("PublishConfigVersion after PoW change failed: %v", err)
+	}
+	if firstRelease.Version.Checksum == secondRelease.Version.Checksum {
+		t.Fatal("expected PoW change to alter published checksum")
+	}
+	if !strings.Contains(secondRelease.Version.SnapshotJSON, `"pow_enabled":true`) {
+		t.Fatal("expected snapshot to persist PoW enabled state")
+	}
+	if !strings.Contains(secondRelease.Version.MainConfig, "lua_shared_dict openflare_pow_config 1m;") {
+		t.Fatal("expected main config to declare shared dict for pow config")
+	}
+	if !strings.Contains(secondRelease.Version.RenderedConfig, "location /.within.website/x/cmd/anubis/static/ {") {
+		t.Fatal("expected rendered config to expose anubis static location")
+	}
+	if strings.Contains(secondRelease.Version.RenderedConfig, "location /.within.website/x/cmd/anubis/static/static/ {") {
+		t.Fatal("expected rendered config to avoid duplicate static path segment")
+	}
+	if !strings.Contains(secondRelease.Version.SnapshotJSON, `"difficulty":5`) {
+		t.Fatal("expected snapshot to persist PoW config")
+	}
+	var supportFiles []SupportFile
+	if err := json.Unmarshal([]byte(secondRelease.Version.SupportFilesJSON), &supportFiles); err != nil {
+		t.Fatalf("failed to decode support files: %v", err)
+	}
+	foundPowSupportFile := false
+	for _, file := range supportFiles {
+		if file.Path != "pow_config.json" {
+			continue
+		}
+		foundPowSupportFile = true
+		if !strings.Contains(file.Content, `"difficulty":5`) {
+			t.Fatalf("expected pow support file to persist config, got %s", file.Content)
+		}
+	}
+	if !foundPowSupportFile {
+		t.Fatal("expected publish to include pow_config.json support file")
+	}
+}
+
 func TestRenderConfigUsesDefaultServerFallback(t *testing.T) {
 	setupServiceTestDB(t)
 

openflare_server/service/openresty_observability_assets.go

@@ -11,6 +11,9 @@ const (
 func renderOpenRestyObservabilityTemplateBlock() string {
 	return stringsJoinLines(
 		"    lua_shared_dict openflare_observability 10m;",
+		"    lua_shared_dict openflare_pow_config 1m;",
+		"    lua_shared_dict openflare_pow_challenges 10m;",
+		"    lua_shared_dict openflare_pow_sessions 20m;",
 		fmt.Sprintf("    init_worker_by_lua_file %s/%s;", nginxLuaDirPlaceholder, openRestyObservabilityInitLuaPath),
 		fmt.Sprintf("    log_by_lua_file %s/%s;", nginxLuaDirPlaceholder, openRestyObservabilityLogLuaPath),
 		"",

openflare_server/service/proxy_route.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net"
 	"net/url"
 	"openflare/model"
 	"regexp"
@@ -53,6 +54,8 @@ type ProxyRouteInput struct {
 	CachePolicy        string                        `json:"cache_policy"`
 	CacheRules         []string                      `json:"cache_rules"`
 	CustomHeaders      []ProxyRouteCustomHeaderInput `json:"custom_headers"`
+	PoWEnabled         bool                          `json:"pow_enabled"`
+	PoWConfig          string                        `json:"pow_config"`
 	Remark             string                        `json:"remark"`
 }
 
@@ -83,6 +86,8 @@ type ProxyRouteView struct {
 	CacheRuleList      []string                      `json:"cache_rule_list"`
 	CustomHeaders      string                        `json:"custom_headers"`
 	CustomHeaderList   []ProxyRouteCustomHeaderInput `json:"custom_header_list"`
+	PoWEnabled         bool                          `json:"pow_enabled"`
+	PoWConfig          *ProxyRoutePoWConfig          `json:"pow_config"`
 	Remark             string                        `json:"remark"`
 	CreatedAt          time.Time                     `json:"created_at"`
 	UpdatedAt          time.Time                     `json:"updated_at"`
@@ -196,6 +201,16 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 	if err != nil {
 		return nil, err
 	}
+
+	powConfig, err := normalizePoWConfig(input.PoWEnabled, input.PoWConfig)
+	if err != nil {
+		return nil, err
+	}
+	powConfigJSON, err := json.Marshal(powConfig)
+	if err != nil {
+		return nil, err
+	}
+
 	if !input.EnableHTTPS {
 		input.RedirectHTTP = false
 		input.CertID = nil
@@ -267,6 +282,8 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 	route.CachePolicy = normalizeCachePolicy(input.CacheEnabled, cachePolicy)
 	route.CacheRules = string(cacheRulesJSON)
 	route.CustomHeaders = string(customHeadersJSON)
+	route.PoWEnabled = input.PoWEnabled
+	route.PoWConfig = string(powConfigJSON)
 	route.Remark = remark
 	return route, nil
 }
@@ -303,6 +320,10 @@ func buildProxyRouteView(route *model.ProxyRoute) (*ProxyRouteView, error) {
 	if err != nil {
 		return nil, err
 	}
+	powConfig, err := decodeStoredPoWConfig(route.PoWEnabled, route.PoWConfig)
+	if err != nil {
+		return nil, err
+	}
 	certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
 	if err != nil {
 		return nil, err
@@ -343,6 +364,8 @@ func buildProxyRouteView(route *model.ProxyRoute) (*ProxyRouteView, error) {
 		CacheRuleList:      cacheRules,
 		CustomHeaders:      route.CustomHeaders,
 		CustomHeaderList:   customHeaders,
+		PoWEnabled:         route.PoWEnabled,
+		PoWConfig:          powConfig,
 		Remark:             route.Remark,
 		CreatedAt:          route.CreatedAt,
 		UpdatedAt:          route.UpdatedAt,
@@ -1048,3 +1071,132 @@ func validateOriginHost(raw string) error {
 func isUniqueConstraintError(err error) bool {
 	return err != nil && strings.Contains(strings.ToLower(err.Error()), "unique")
 }
+
+// PoW configuration types and validation
+
+type ProxyRoutePoWListConfig struct {
+	IPs         []string `json:"ips"`
+	IPCidrs     []string `json:"ip_cidrs"`
+	Paths       []string `json:"paths"`
+	PathRegexes []string `json:"path_regexes"`
+	UserAgents  []string `json:"user_agents"`
+}
+
+type ProxyRoutePoWConfig struct {
+	Difficulty   int                     `json:"difficulty"`
+	Algorithm    string                  `json:"algorithm"`
+	SessionTTL   int                     `json:"session_ttl"`
+	ChallengeTTL int                     `json:"challenge_ttl"`
+	Whitelist    ProxyRoutePoWListConfig `json:"whitelist"`
+	Blacklist    ProxyRoutePoWListConfig `json:"blacklist"`
+}
+
+var powAlgorithmValues = map[string]bool{"fast": true, "slow": true}
+
+func defaultPoWConfig() ProxyRoutePoWConfig {
+	return ProxyRoutePoWConfig{
+		Difficulty:   4,
+		Algorithm:    "fast",
+		SessionTTL:   86400,
+		ChallengeTTL: 300,
+		Whitelist:    ProxyRoutePoWListConfig{IPs: []string{}, IPCidrs: []string{}, Paths: []string{}, PathRegexes: []string{}, UserAgents: []string{}},
+		Blacklist:    ProxyRoutePoWListConfig{IPs: []string{}, IPCidrs: []string{}, Paths: []string{}, PathRegexes: []string{}, UserAgents: []string{}},
+	}
+}
+
+func normalizePoWConfig(enabled bool, raw string) (ProxyRoutePoWConfig, error) {
+	if !enabled {
+		return defaultPoWConfig(), nil
+	}
+
+	cfg := defaultPoWConfig()
+	text := strings.TrimSpace(raw)
+	if text != "" && text != "{}" {
+		if err := json.Unmarshal([]byte(text), &cfg); err != nil {
+			return cfg, errors.New("pow_config 格式无效")
+		}
+	}
+
+	if cfg.Difficulty < 1 || cfg.Difficulty > 16 {
+		return cfg, errors.New("pow_config.difficulty 必须在 1-16 之间")
+	}
+	if !powAlgorithmValues[cfg.Algorithm] {
+		return cfg, errors.New("pow_config.algorithm 必须为 fast 或 slow")
+	}
+	if cfg.SessionTTL < 60 {
+		return cfg, errors.New("pow_config.session_ttl 不能小于 60 秒")
+	}
+	if cfg.ChallengeTTL < 30 {
+		return cfg, errors.New("pow_config.challenge_ttl 不能小于 30 秒")
+	}
+
+	for _, cidr := range cfg.Whitelist.IPCidrs {
+		if _, _, err := net.ParseCIDR(cidr); err != nil {
+			return cfg, fmt.Errorf("pow_config 白名单 IP CIDR 格式无效: %s", cidr)
+		}
+	}
+	for _, cidr := range cfg.Blacklist.IPCidrs {
+		if _, _, err := net.ParseCIDR(cidr); err != nil {
+			return cfg, fmt.Errorf("pow_config 黑名单 IP CIDR 格式无效: %s", cidr)
+		}
+	}
+
+	for _, re := range cfg.Whitelist.PathRegexes {
+		if _, err := regexp.Compile(re); err != nil {
+			return cfg, fmt.Errorf("pow_config 白名单路径正则格式无效: %s", re)
+		}
+	}
+	for _, re := range cfg.Blacklist.PathRegexes {
+		if _, err := regexp.Compile(re); err != nil {
+			return cfg, fmt.Errorf("pow_config 黑名单路径正则格式无效: %s", re)
+		}
+	}
+
+	for _, ip := range cfg.Whitelist.IPs {
+		if net.ParseIP(ip) == nil {
+			return cfg, fmt.Errorf("pow_config 白名单 IP 格式无效: %s", ip)
+		}
+	}
+	for _, ip := range cfg.Blacklist.IPs {
+		if net.ParseIP(ip) == nil {
+			return cfg, fmt.Errorf("pow_config 黑名单 IP 格式无效: %s", ip)
+		}
+	}
+
+	type dimension struct {
+		name string
+		wl   []string
+		bl   []string
+	}
+	dimensions := []dimension{
+		{"IP", cfg.Whitelist.IPs, cfg.Blacklist.IPs},
+		{"IP CIDR", cfg.Whitelist.IPCidrs, cfg.Blacklist.IPCidrs},
+		{"路径", cfg.Whitelist.Paths, cfg.Blacklist.Paths},
+		{"路径正则", cfg.Whitelist.PathRegexes, cfg.Blacklist.PathRegexes},
+		{"User-Agent", cfg.Whitelist.UserAgents, cfg.Blacklist.UserAgents},
+	}
+	for _, dim := range dimensions {
+		if len(dim.wl) > 0 && len(dim.bl) > 0 {
+			return cfg, fmt.Errorf("pow_config %s 不能同时配置白名单和黑名单", dim.name)
+		}
+	}
+
+	return cfg, nil
+}
+
+func decodeStoredPoWConfig(enabled bool, raw string) (*ProxyRoutePoWConfig, error) {
+	if !enabled {
+		cfg := defaultPoWConfig()
+		return &cfg, nil
+	}
+	text := strings.TrimSpace(raw)
+	if text == "" || text == "{}" {
+		cfg := defaultPoWConfig()
+		return &cfg, nil
+	}
+	var cfg ProxyRoutePoWConfig
+	if err := json.Unmarshal([]byte(text), &cfg); err != nil {
+		return nil, errors.New("pow_config 格式无效")
+	}
+	return &cfg, nil
+}