[修复] 修复github登录问题

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1 @@
-blank_issues_enabled: false
-contact_links:
-  - name: 赞赏支持
-    url: https://iamazing.cn/page/reward
-    about: 请作者喝杯咖啡，以激励作者持续开发
+blank_issues_enabled: false

.gitignore

@@ -46,4 +46,5 @@ go.work.sum
 *.log
 
 .DS_Store
-.codex-cache
+.codex-cache
+/.gomodcache/

README.md

@@ -24,6 +24,12 @@
   </a>
 </p>
 
+> [!NOTE]
+> 当前项目处于快速迭代期，设计与实现均不稳定，请确保使用最新版本并关注更新日志。
+
+> [!WARNING]
+> 使用 root 用户初次登录系统后，务必修改默认密码 `123456`，并且确保关闭新用户注册功能。
+
 ## 为什么存在
 
 OpenFlare 解决的是一类朴素但高频的运维问题：
@@ -112,12 +118,9 @@ services:
       DSN: postgres://openflare:replace-with-strong-password@postgres:5432/openflare?sslmode=disable
       GIN_MODE: release
       LOG_LEVEL: info
-    volumes:
-      - openflare-data:/data
 
 volumes:
   postgres-data:
-  openflare-data:
 ```
 
 ```bash
@@ -153,6 +156,17 @@ curl -fsSL https://raw.githubusercontent.com/Rain-kl/OpenFlare/main/scripts/inst
 
 安装脚本默认写入 `/opt/openflare-agent`，创建 `openflare-agent.service`，并可重复执行以重装或升级 Agent。
 
+如需彻底卸载 Agent 并清空本地数据，可执行：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/Rain-kl/OpenFlare/main/scripts/uninstall-agent.sh | bash
+```
+
+卸载脚本会先停止并移除 `openflare-agent.service`、删除整个 `/opt/openflare-agent` 目录，然后根据卸载前保存的 `agent.json` 判断 OpenResty 安装方式：
+
+* Docker 模式：删除对应 OpenResty 容器，并尝试移除镜像
+* 本机 `openresty_path` 模式：不改动本机 OpenResty，只提示用户手动卸载
+
 ### 3. 发布第一份配置
 
 1. 登录管理端并新增反代规则
@@ -199,17 +213,6 @@ cd openflare_agent
 go run ./cmd/agent -config /path/to/agent.json
 ```
 
-## 文档导航
-
-建议按以下顺序阅读：
-
-1. [docs/design.md](./docs/design.md)
-2. [docs/development-guidelines.md](./docs/development-guidelines.md)
-3. [docs/development-plan.md](./docs/development-plan.md)
-4. [docs/frontend-development-guidelines.md](./docs/frontend-development-guidelines.md)
-5. [docs/deployment.md](./docs/deployment.md)
-6. [docs/app-config.md](./docs/app-config.md)
-
 ## 管理端与接口
 
 管理端当前覆盖：
@@ -226,9 +229,6 @@ go run ./cmd/agent -config /path/to/agent.json
 
 登录管理端后，可访问 Swagger UI：`/swagger/index.html`
 
-如需重新生成 Swagger 文档，请使用与服务端依赖一致的版本：
-`go install github.com/swaggo/swag/cmd/swag@v1.16.4`
-
 ## 开源协议
 
 本项目采用 [Apache License 2.0](./LICENSE) 开源。

docs/app-config.md

@@ -57,12 +57,21 @@ go run . --port 3000 --log-dir ./logs
 | `NodeOfflineThreshold` | 节点离线阈值（毫秒） | `120000` |
 | `AgentUpdateRepo` | Agent 自更新仓库 | `Rain-kl/OpenFlare` |
 | `GeoIPProvider` | 节点/IP 归属解析方式 | `ipinfo` |
+| `RegisterEnabled` | 是否允许新用户注册 | `false` |
+| `PasswordRegisterEnabled` | 是否允许通过密码方式注册 | `true` |
+| `DatabaseAutoCleanupEnabled` | 是否启用每日自动清理观测数据 | `false` |
+| `DatabaseAutoCleanupRetentionDays` | 自动清理保留天数（至少 1 天） | `30` |
 | `GlobalApiRateLimitNum` / `GlobalApiRateLimitDuration` | 全局 API 限流次数 / 时间窗口 | `300` / `180` |
 | `GlobalWebRateLimitNum` / `GlobalWebRateLimitDuration` | 全局 Web 限流次数 / 时间窗口 | `300` / `180` |
 | `UploadRateLimitNum` / `UploadRateLimitDuration` | 上传接口限流次数 / 时间窗口 | `50` / `60` |
 | `DownloadRateLimitNum` / `DownloadRateLimitDuration` | 下载接口限流次数 / 时间窗口 | `50` / `60` |
 | `CriticalRateLimitNum` / `CriticalRateLimitDuration` | 敏感接口限流次数 / 时间窗口 | `100` / `1200` |
 
+说明：
+
+* `DatabaseAutoCleanupEnabled` 开启后，Server 会在每天凌晨 3 点自动清理 `node_access_logs`、`node_metric_snapshots`、`node_request_reports` 三类观测数据
+* `DatabaseAutoCleanupRetentionDays` 为统一保留天数，必须大于等于 1；管理端支持手动清理时留空保留天数，以直接删除对应数据集的全部历史记录
+
 ### 1.4 OpenResty 参数
 
 OpenResty 性能参数与缓存参数继续统一保存在 `Option` 表。当前常用项包括：
@@ -124,7 +133,7 @@ Agent 当前支持：
 | `agent_token` | 节点专属认证 Token | 与 `discovery_token` 二选一 | 空 |
 | `discovery_token` | 首次自动注册使用的全局 Token | 与 `agent_token` 二选一 | 空 |
 | `node_name` | 节点名称 | 否 | 自动使用主机名 |
-| `node_ip` | 节点 IP | 否 | 自动探测 |
+| `node_ip` | 节点 IP | 否 | 自动探测，优先选择公网 IPv4；仅无公网地址时退回可用内网地址 |
 | `openresty_path` | 本机 OpenResty 路径 | 否 | 空，未设置时走 Docker 模式 |
 | `openresty_container_name` | Docker 模式下的容器名 | 否 | `openflare-openresty` |
 | `openresty_docker_image` | Docker 模式下的镜像 | 否 | `openresty/openresty:alpine` |
@@ -148,6 +157,7 @@ Agent 当前支持：
 * `agent_token` 与 `discovery_token` 不能同时为空
 * `heartbeat_interval` 与 `request_timeout` 支持毫秒整数或 Go duration 字符串
 * 未配置 `openresty_path` 时默认使用 Docker OpenResty 模式
+* Agent 自动探测到私网 `node_ip` 时，Server 会在注册/心跳阶段优先保留 Agent 直连来源的公网地址，避免 NAT/多网卡场景误登记内网网卡地址
 
 ## 3. 维护要求
 

docs/deployment.md

@@ -12,7 +12,7 @@
 
 ### 1.2 Agent
 
-* Go 1.23+
+* Go 1.24+
 * 对 Agent 数据目录有写权限
 * 本机模式下可执行 `openresty -t` 与 `openresty -s reload`
 * Docker 模式下具备 Docker 执行权限
@@ -237,6 +237,22 @@ curl -fsSL https://raw.githubusercontent.com/Rain-kl/OpenFlare/main/scripts/inst
 
 安装脚本会下载最新 Agent、生成 `agent.json`、创建 `openflare-agent.service` 并启动服务。
 
+如需彻底卸载 Agent 并清空本地数据，可执行：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/Rain-kl/OpenFlare/main/scripts/uninstall-agent.sh | bash
+```
+
+支持参数：
+
+* `--install-dir`
+* `--service-name`
+
+卸载脚本会先停止 Agent、移除 `openflare-agent.service`、删除整个安装目录，再根据卸载前保存的 `agent.json` 判断 OpenResty 安装方式：
+
+* Docker 模式：删除对应容器，并尝试移除 OpenResty 镜像
+* 本机 `openresty_path` 模式：不改动本机 OpenResty，仅提示用户手动卸载
+
 ## 9. 文档维护要求
 
 部署方式、升级方式、接入模式或联调流程变化时，同步更新本文档和 `README.md`。

docs/design.md

@@ -9,6 +9,8 @@ OpenFlare 是一套自托管的 OpenResty 控制面，面向单团队或单组
 当前稳定能力包括：
 
 * 反代规则管理
+* 网站级配置与多域名绑定
+* 源站管理与复用
 * 配置预览、发布、激活与回滚
 * Agent 注册、心跳、同步、应用结果上报
 * OpenResty 主配置模板、性能参数与缓存参数托管
@@ -23,28 +25,6 @@ OpenFlare 是一套自托管的 OpenResty 控制面，面向单团队或单组
 * Server 保存配置与状态，不直接 SSH 管理节点
 * Agent 是节点侧唯一受控落地入口
 
-## 2. 范围边界
-
-当前明确不做：
-
-* 多租户
-* CDN SaaS 化能力
-* GeoDNS、全球调度、智能选路
-* WAF、Bot 管理、限流平台化
-* 灰度百分比发布、按节点差异化配置
-* 对象存储、消息队列、Prometheus、ClickHouse、Kafka 等前置基础设施
-* 通用日志检索平台、APM、调用链系统、任意 BI 报表
-* 证书自动签发与自动续期
-* 平台化抽象对象，如 `zone`、`origin_pool`、`policy`、`deployment`
-
-边界补充：
-
-* OpenResty 代理缓存只作为当前反代链路优化能力存在，不扩展为独立缓存产品
-* 主配置文件由 Server 统一渲染并由 Agent 受控写入，不支持节点侧手工编辑后回传合并
-* 节点观测聚焦运营与运维排障所需的摘要、趋势和受控窗口数据，不提供长期日志托管
-
-新增能力如果超出上述边界，先更新本文档，再进入实现。
-
 ## 3. 技术基线
 
 ### 3.1 Server
@@ -105,6 +85,7 @@ Origin
 当前有效实体：
 
 * `proxy_routes`
+* `origins`
 * `config_versions`
 * `nodes`
 * `node_system_profiles`
@@ -119,11 +100,19 @@ Origin
 
 稳定约束：
 
-* 一个域名只对应一条 `proxy_routes` 规则
+* `proxy_routes` 从“单域名规则”升级为“网站配置”聚合对象；一条记录对应一个网站，可绑定一个或多个域名，并共享一组站点级配置
+* `proxy_routes.site_name` 是网站的业务唯一标识；新建时默认取 `domains[0]`，后续允许独立维护，不随域名改动自动重写
+* `proxy_routes.domains` 至少包含一个域名，且 `domains[0]` 作为主域名；任一域名全局只能属于一个 `proxy_routes`
+* 为兼容历史数据，迁移期可保留 `proxy_routes.domain` 作为 `domains[0]` 的镜像字段，但业务读写与后续扩展必须以 `site_name` + `domains` 为准
+* `origins` 只保存源站地址、展示名与备注，不承载协议、端口、路径、权重或健康检查策略
+* `proxy_routes` 可选关联一个 `origins` 记录，用于复用源站地址；规则仍保存完整 `origin_url` 快照以参与渲染与版本快照
 * `proxy_routes` 至少包含一个上游地址；为兼容历史数据保留 `origin_url` 主上游字段，也允许在同一规则内补充多个上游做负载均衡
 * `proxy_routes` 上游统一渲染为带 keepalive 的 named `upstream`；单上游可附带 base path 或 query 并在 `proxy_pass` 中追加，多上游仍限定为纯 `scheme://host[:port]`
 * `proxy_routes.origin_host` 为可选字段，用于回源时覆盖 `Host` 请求头；未设置时默认透传访问域名
-* `proxy_routes.domain` 必须唯一
+* 网站级流量限制、反向代理与缓存配置当前按站点共享，不在同一网站内做域名级差异化配置；但 HTTPS 允许在同一站点内按域名绑定证书
+* `proxy_routes.domain_cert_ids` 用于记录与 `domains` 平行的域名证书绑定；值为 `0` 表示该域名不启用 HTTPS，仅保留 HTTP
+* 发布渲染时，带证书的域名按证书分组输出独立 `443 ssl` `server` 块；未绑定证书的域名不得被自动带入 HTTPS
+* 发布渲染时必须将 `proxy_routes.domains` 中的全部域名一并纳入同一站点配置，避免同站点在版本快照中被拆散
 * 所有上游地址都必须为合法 `http://` 或 `https://`
 * `config_versions` 必须保存完整快照、渲染结果与 `checksum`
 * 全局同时只能有一个激活版本
@@ -189,3 +178,4 @@ Origin
 * 产品范围或系统边界变化时更新本文档
 * 已完成阶段不再以“版本计划”形式回填
 * 新阶段开始前，先补设计，再进入实现
+* 涉及网站级规则改造的详细需求与实施顺序，见 [docs/website-configuration-redesign.md](./website-configuration-redesign.md)

docs/development-guidelines.md

@@ -20,7 +20,7 @@
 
 `openflare_agent` 继续作为 Go 单体程序：
 
-* Go 1.23+
+* Go 1.24+
 * 单二进制
 * 节点本地执行
 * `openresty_path` 优先
@@ -99,6 +99,7 @@
 当前有效实体：
 
 * `proxy_routes`
+* `origins`
 * `config_versions`
 * `nodes`
 * `node_system_profiles`
@@ -115,9 +116,17 @@
 通用约束：
 
 * 不新增平台化对象，除非设计文档明确要求
-* `proxy_routes` 维持一条域名对应一条规则；规则内允许保存一个或多个上游地址用于负载均衡，但不引入独立 `origin_pool`
+* `origins` 仅作为可复用源站地址目录，字段保持轻量；协议、端口、路径与查询参数继续归属具体 `proxy_routes`
+* `proxy_routes` 以“网站配置”作为聚合边界，必须包含唯一 `site_name` 与非空 `domains` 列表；数据库内部 `id` 可继续作为技术主键，但不能替代 `site_name` 的业务唯一性
+* `proxy_routes.domains` 中的每个域名都必须全局唯一；列表第一项视为主域名，创建时若未显式填写 `site_name`，则默认使用主域名
+* `proxy_routes` 继续允许保存一个或多个上游地址用于负载均衡，但不引入独立 `origin_pool`
+* 迁移期如保留遗留 `domain` 字段，只能作为 `domains[0]` 的兼容镜像；新代码不得继续以该字段作为唯一业务输入
+* `proxy_routes` 如关联 `origins`，必须同时保存可直接渲染的 `origin_url`；源站地址变更时，由 service 负责同步更新引用该源站的规则快照
 * `proxy_routes` 的上游统一使用 named `upstream` + keepalive；单上游如带 base path 或 query，应在 `proxy_pass` 上补回 URI，多上游仅允许纯 `scheme://host[:port]`
 * `proxy_routes.origin_host` 为可选字段，仅用于覆盖回源 `Host` 请求头，不引入新的平台化对象
+* 流量限制、反向代理与缓存配置当前都归属站点级 `proxy_routes`，同一网站内不拆分域名级差异配置
+* HTTPS 的启停仍由站点级 `proxy_routes` 控制，但证书绑定必须通过与 `domains` 平行的 `domain_cert_ids` 记录逐域名保存；未绑定证书的域名不得参与 HTTPS 渲染
+* `proxy_routes.cert_ids` 仅作为站点级证书集合与兼容镜像，必须由 `domain_cert_ids` 推导生成；`cert_id` 继续作为首个已使用证书的兼容镜像
 * `config_versions` 必须保存完整快照与渲染结果
 * 全局同时只能有一个激活版本
 * 回滚通过重新激活旧版本实现
@@ -126,6 +135,18 @@
 * 快照与聚合结果采用追加式模型，不覆盖历史
 * 原始访问明细必须有受控保留策略
 
+### 3.1 数据库版本与迁移
+
+* 任何涉及表结构、索引、列类型、分表规则或内部持久化元数据的修改，都必须同步提升数据库版本号
+* 数据库版本号定义在 `openflare_server/model`，不得只依赖 `AutoMigrate` 隐式升级存量数据库
+* 每次提升数据库版本号时，必须补充从上一版本升级到新版本的显式迁移方法
+* 迁移方法必须包含升级后的校验逻辑；只有校验通过，才能写入新的数据库版本记录
+* 新包启动后必须先检查数据库当前版本，再按顺序逐步升级到目标版本；禁止跳过中间升级步骤直接写目标版本
+* 空库初始化可以直接建立当前版本结构，但初始化完成后仍必须执行同版本校验，并落库当前数据库版本
+* 数据库版本元数据属于内部控制信息，必须保存在独立内部表中，不能混入业务配置表
+* 如果迁移失败或校验失败，启动流程必须中止，且不得提升数据库版本记录
+* 涉及数据库版本变更的提交，必须补充对应的迁移测试或等效回归测试
+
 ## 4. API 与鉴权规范
 
 ### 4.1 API

docs/development-plan.md

@@ -48,3 +48,14 @@
 * 部署与配置变动：更新 `README.md`、`docs/deployment.md`、`docs/app-config.md`
 
 如果未来出现明确的新阶段目标，再单独新增专项计划文档；不要把已完成的历史计划继续堆回本文件。
+
+## 6. 当前专项计划
+
+已确认需要推进“网站级规则与配置界面改造”专项，详细需求、实施顺序与验收标准见 [docs/website-configuration-redesign.md](./website-configuration-redesign.md)。
+
+本专项的执行顺序固定为：
+
+1. 先完成数据模型与配置渲染兼容方案
+2. 再调整接口、校验与版本 diff 语义
+3. 然后改造规则列表与网站配置子页面
+4. 最后补齐迁移、回归测试与文档联动

docs/frontend-development-guidelines.md

@@ -24,11 +24,6 @@
 * 默认使用 App Router
 * 前端必须支持 `light`、`dark`、`system` 三种主题模式
 
-禁止：
-
-* 引入 Semantic UI
-* 新增大型 UI 框架破坏现有组件基线
-* 使用 jQuery 风格 DOM 操作
 
 ## 2. 目录与分层
 
@@ -131,24 +126,3 @@ tests/
 * 同时支持 `light`、`dark`、`system`
 * 用户选择必须持久化
 * 首屏尽量避免主题闪烁
-
-## 7. 测试与交付
-
-每个页面至少具备：
-
-* 加载态
-* 空态
-* 错误态
-* 成功反馈
-
-测试要求：
-
-* 公共工具、类型转换、主题逻辑补单元测试
-* 关键页面交互补组件测试
-* 核心主链路补 Playwright 或等效联调验证
-
-交付要求：
-
-* 构建产物保持可静态导出
-* 构建结果可被 Go Server 托管
-* 新页面默认通过亮色与暗色模式验收

docs/website-configuration-redesign.md

@@ -0,0 +1,266 @@
+# 网站配置改造需求与开发计划
+
+## 1. 背景
+
+当前规则模块以“一个域名对应一条规则”为中心，已经支持单域名绑定一个或多个上游，但无法表达“多个域名共享同一套站点配置”的场景。
+
+现阶段已经出现以下真实需求：
+
+* 多个域名指向同一站点，并共享反向代理、缓存等设置，同时允许按域名分别绑定 HTTPS 证书
+* 后续希望围绕“网站”继续叠加更多功能，而不是持续在规则列表中堆积字段
+* 现有抽屉式编辑界面已经不适合承载更复杂的配置结构
+
+因此，本轮改造将 `proxy_routes` 从“单域名规则”升级为“网站配置”视角，并引入独立的配置子页面。
+
+## 2. 目标
+
+本轮改造的目标如下：
+
+* 支持一个网站绑定多个域名
+* 支持一个网站绑定一个或多个上游
+* 引入 `site_name` 作为网站业务唯一标识
+* 将原列表页的“编辑”操作替换为“配置”，进入独立子页面管理
+* 将网站配置拆分为更清晰的功能分区，为后续扩展预留结构
+
+## 3. 本轮范围
+
+本轮仅覆盖以下站点级配置能力：
+
+* 域名设置
+* 流量限制
+* 反向代理
+* 缓存
+
+## 4. 核心模型要求
+
+### 4.1 网站标识
+
+* `site_name` 为网站业务唯一标识
+* 新建网站时，若用户未输入 `site_name`，默认取域名列表第一项
+* `site_name` 在首次生成后允许独立编辑，不随域名变更自动同步，避免影响引用、跳转和审计
+* 数据库内部主键可以继续使用现有数值 `id`，但业务层必须校验 `site_name` 唯一性
+
+### 4.2 域名列表
+
+* 网站的域名字段改为 `domains` 列表
+* `domains` 至少包含一个有效域名
+* `domains[0]` 视为主域名，用于列表摘要、默认展示和兼容历史逻辑
+* 同一网站内域名不能重复
+* 任一域名在全局只能属于一个网站
+* 域名列表需要支持新增、删除和调整顺序
+
+### 4.3 历史兼容
+
+* 存量单域名数据迁移后应自动转换为：
+  `site_name = domain`
+  `domains = [domain]`
+* 若迁移期保留旧 `domain` 字段，该字段仅作为 `domains[0]` 的兼容镜像，不再作为主要业务输入
+* 版本渲染、差异预览、接口返回和前端展示都应逐步以 `site_name + domains` 为准
+
+## 5. 功能需求
+
+### 5.1 列表页改造
+
+规则列表改造为“网站列表”视图，要求如下：
+
+* 保留当前列表页入口，但展示对象改为网站
+* 原“编辑”按钮替换为“配置”按钮
+* 点击“配置”进入网站配置子页面
+* 列表项至少展示：
+  `site_name`
+  主域名
+  域名数量
+  上游摘要
+  HTTPS/缓存/启用状态摘要
+* 删除、发布等现有高风险操作仍保留明确确认
+
+### 5.2 网站配置子页面
+
+网站配置采用左右布局：
+
+* 左侧为菜单栏，用于切换配置分区
+* 右侧为当前分区的设置面板
+* 默认进入“域名设置”分区
+* 建议基于 App Router 子路由或稳定的 tab 路由参数实现，保证可直接访问和刷新恢复
+
+建议左侧菜单项固定为：
+
+1. 域名设置
+2. 流量限制
+3. 反向代理
+4. 缓存
+
+为降低跨分区校验干扰，每个分区应支持独立保存与反馈；若采用统一保存，也必须提供未保存修改提示。
+
+### 5.3 域名设置
+
+域名设置分区负责维护网站身份与域名列表，要求如下：
+
+* 可编辑 `site_name`
+* 可维护 `domains` 列表
+* 可新增、删除、排序域名
+* 明确提示第一项为主域名
+* 每个域名可单独选择一张证书，形成与 `domains` 平行的 `domain_cert_ids`
+* 若某个域名未选择证书，则该域名不启用 HTTPS
+* `HTTP -> HTTPS` 跳转逻辑与域名证书绑定放在同一分区维护
+* 保存前校验：
+  `site_name` 非空且唯一
+  `domains` 非空
+  每个域名格式合法
+  域名在当前站点内不重复
+  域名在全局不与其他网站冲突
+  已选择证书的域名必须被对应证书覆盖
+
+### 5.4 流量限制
+
+流量限制分区用于配置站点级限流，第一期要求覆盖以下字段：
+
+* `limit_conn perserver`
+* `limit_conn perip`
+* `limit_rate`
+
+要求如下：
+
+* 采用结构化字段存储，不允许直接录入原始 Nginx 片段
+* `limit_conn perserver` 与 `limit_conn perip` 为整数；空值或 `0` 视为未启用
+* `limit_rate` 采用人类可读格式录入，例如 `512k`、`1m`
+* 保存前进行格式校验，并在页面中提供示例说明
+* 配置发布后渲染为对应的 OpenResty/Nginx 指令
+
+### 5.5 反向代理
+
+反向代理分区负责维护网站回源配置，要求如下：
+
+* 支持一个或多个上游
+* 至少保留一个上游
+* 支持维护回源主机名 `origin_host`
+* 继续兼容当前单上游带 path/query、多上游做负载均衡的模式
+* 若复用 `origins` 目录，只作为地址候选来源，不改变网站配置为主的编辑模型
+
+建议继续保留当前兼容约束：
+
+* 单上游可附带 path/query
+* 多上游模式下，上游项保持 `scheme://host[:port]` 形式
+* 同一网站的多个上游在多上游模式下维持统一协议，降低渲染复杂度
+
+### 5.6 缓存
+
+缓存分区负责维护站点级缓存策略，要求如下：
+
+* 支持开启或关闭缓存
+* 支持多种缓存策略
+* 第一阶段至少兼容当前已存在的策略：
+  `url`
+  `suffix`
+  `path_prefix`
+  `path_exact`
+* 缓存规则继续采用结构化配置，不直接暴露原始 Nginx 片段
+* 保持当前安全绕过逻辑，不因界面改造改变默认缓存边界
+
+## 6. 接口与渲染要求
+
+* 列表接口需要返回 `site_name`、`domains`、主域名、状态摘要等字段
+* 详情接口需要按分区所需字段返回完整站点配置
+* 更新接口需要支持按分区或按网站整体更新，但服务端必须统一做跨字段校验
+* 配置 diff 不再只关注单个域名变更，还要能识别：
+  网站新增/删除
+  域名列表变更
+  站点级配置变更
+* 发布渲染时，同一网站的全部域名必须落入同一份站点配置上下文中
+* 同一网站内，带证书的域名需按证书分组生成 HTTPS `server`；未配置证书的域名只保留 HTTP
+
+## 7. 前端实现要求
+
+* 列表页负责导航与摘要，不再承载完整编辑表单
+* 网站配置子页面中的每个分区表单继续遵循 `React Hook Form + Zod`
+* API 请求统一收敛在 `lib/api/`
+* 站点级数据查询与缓存继续使用 TanStack Query
+* 左侧菜单切换时需要明确处理未保存状态，避免无提示丢失修改
+* 页面至少覆盖加载态、空态、错误态和保存成功反馈
+
+## 8. 数据迁移要求
+
+实施前必须准备显式数据库迁移与校验逻辑，至少包含：
+
+1. 新增 `site_name`、`domains` 与 `domain_cert_ids` 存储结构
+2. 将旧数据从单域名回填到站点结构，并补齐逐域名证书映射
+3. 为 `site_name` 建立唯一约束
+4. 为域名唯一性建立可校验约束
+5. 对迁移结果做一致性校验
+
+迁移失败时，启动流程必须中止，不允许带半迁移状态继续运行。
+
+## 9. 开发计划
+
+### 阶段一：模型与渲染改造
+
+目标：
+
+* 定义网站级 `proxy_routes` 数据结构
+* 完成存量数据迁移
+* 调整配置渲染与发布链路，支持多域名同站点输出
+
+交付物：
+
+* 数据库迁移
+* model/service 调整
+* 配置渲染兼容实现
+* 迁移与渲染测试
+
+### 阶段二：接口与校验改造
+
+目标：
+
+* 更新列表、详情、创建、更新接口的数据结构
+* 引入 `site_name`、`domains`、流量限制等字段校验
+* 调整版本 diff 与发布预览语义
+
+交付物：
+
+* API 契约更新
+* 服务端参数校验与错误消息
+* diff/preview 适配
+* 接口回归测试
+
+### 阶段三：前端网站列表与配置子页面
+
+目标：
+
+* 将规则列表切换为网站列表
+* 用“配置”按钮替代“编辑”按钮
+* 落地左右布局的网站配置子页面与五个分区
+
+交付物：
+
+* 列表页 UI 改造
+* 子页面路由与布局
+* 域名设置、流量限制、反向代理、缓存四个分区
+* 前端交互与表单测试
+
+### 阶段四：联调、发布验证与文档收口
+
+目标：
+
+* 验证从创建网站到发布配置的全链路
+* 验证 Agent 拉取、应用与回滚不受影响
+* 收口文档与测试
+
+交付物：
+
+* 联调记录
+* 发布/回滚回归验证
+* 文档同步更新
+
+## 10. 验收标准
+
+满足以下条件后，本专项可视为完成：
+
+* 可以创建一个网站，并绑定多个域名
+* 一个网站可以绑定单个或多个上游
+* `site_name` 唯一，且创建时默认取第一个域名
+* 原列表页已用“配置”按钮替代“编辑”按钮
+* 网站配置子页面已经采用左侧菜单、右侧设置的布局
+* 五个分区均可独立完成基本配置与保存
+* 发布后的渲染结果可正确覆盖同一网站的全部域名，并只为已绑定证书的域名生成 HTTPS 配置
+* Agent 同步、应用、回滚链路不被破坏
+* 迁移、接口、渲染与前端关键路径均有对应测试或等效回归验证

openflare_agent/go.mod

@@ -1,3 +1,7 @@
 module openflare-agent
 
-go 1.23.0
+go 1.24.0
+
+require openflare v0.0.0
+
+replace openflare => ../openflare_server

openflare_agent/internal/config/config.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"net"
+	"openflare/utils/geoip/iputil"
 	"os"
 	pathpkg "path"
 	"path/filepath"
@@ -331,6 +332,8 @@ func detectNodeIP() string {
 	if err != nil {
 		return ""
 	}
+	bestIP := ""
+	bestPriority := -1
 	for _, iface := range interfaces {
 		if iface.Flags&net.FlagUp == 0 || iface.Flags&net.FlagLoopback != 0 {
 			continue
@@ -344,11 +347,27 @@ func detectNodeIP() string {
 			if !ok || ipNet.IP == nil || ipNet.IP.IsLoopback() {
 				continue
 			}
-			ipv4 := ipNet.IP.To4()
-			if ipv4 != nil {
-				return ipv4.String()
+			ipv4 := normalizeIPv4(ipNet.IP)
+			priority := nodeIPPriority(ipv4)
+			if priority > bestPriority {
+				bestIP = ipv4.String()
+				bestPriority = priority
+			}
+			if bestPriority == 2 {
+				return bestIP
 			}
 		}
 	}
-	return ""
+	return bestIP
+}
+
+func normalizeIPv4(ip net.IP) net.IP {
+	if ip == nil {
+		return nil
+	}
+	return ip.To4()
+}
+
+func nodeIPPriority(ip net.IP) int {
+	return iputil.Score(ip)
 }

openflare_agent/internal/config/config_test.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"encoding/json"
+	"net"
 	"os"
 	"path/filepath"
 	"testing"
@@ -326,3 +327,49 @@ func TestInitialAuthToken(t *testing.T) {
 		})
 	}
 }
+
+func TestNodeIPPriority(t *testing.T) {
+	tests := []struct {
+		name     string
+		ip       string
+		expected int
+	}{
+		{
+			name:     "public ipv4 preferred",
+			ip:       "8.8.8.8",
+			expected: 2,
+		},
+		{
+			name:     "private ipv4 fallback",
+			ip:       "10.0.0.8",
+			expected: 1,
+		},
+		{
+			name:     "link local ignored",
+			ip:       "169.254.1.10",
+			expected: -1,
+		},
+		{
+			name:     "loopback ignored",
+			ip:       "127.0.0.1",
+			expected: -1,
+		},
+		{
+			name:     "nil ignored",
+			ip:       "",
+			expected: -1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var parsed net.IP
+			if tt.ip != "" {
+				parsed = net.ParseIP(tt.ip)
+			}
+			if got := nodeIPPriority(parsed); got != tt.expected {
+				t.Fatalf("unexpected priority for %q: got %d want %d", tt.ip, got, tt.expected)
+			}
+		})
+	}
+}

openflare_agent/internal/observability/traffic.go

@@ -327,18 +327,28 @@ type trafficCountItem struct {
 	value int64
 }
 
+const accessLogPathMaxRunes = 100
+
 func normalizeAccessLogPath(value string) string {
 	trimmed := strings.TrimSpace(value)
 	if trimmed == "" {
 		return ""
 	}
 	if strings.HasPrefix(trimmed, "http://") || strings.HasPrefix(trimmed, "https://") {
-		return trimmed
+		return truncateAccessLogPath(trimmed)
 	}
 	if strings.HasPrefix(trimmed, "/") {
-		return trimmed
+		return truncateAccessLogPath(trimmed)
 	}
-	return "/" + trimmed
+	return truncateAccessLogPath("/" + trimmed)
+}
+
+func truncateAccessLogPath(value string) string {
+	runes := []rune(value)
+	if len(runes) <= accessLogPathMaxRunes {
+		return value
+	}
+	return string(runes[:accessLogPathMaxRunes])
 }
 
 func topCounts(values map[string]int64, limit int) map[string]int64 {

openflare_agent/internal/observability/traffic_test.go

@@ -3,6 +3,7 @@ package observability
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"openflare-agent/internal/config"
@@ -108,6 +109,31 @@ func TestBuildTrafficObservabilityReturnsAccessLogs(t *testing.T) {
 	}
 }
 
+func TestBuildTrafficObservabilityTruncatesLongAccessLogPath(t *testing.T) {
+	tempDir := t.TempDir()
+	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
+	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
+	longPath := "/" + strings.Repeat("a", 140)
+	content := []byte(
+		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"" + longPath + "\",\"remote_addr\":\"10.0.0.1\",\"status\":200}\n",
+	)
+	if err := os.WriteFile(logPath, content, 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+
+	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
+	_, accessLogs, _ := BuildTrafficObservability(&config.Config{RouteConfigPath: routeConfigPath}, stateStore, nil)
+	if len(accessLogs) != 1 {
+		t.Fatalf("expected one access log, got %+v", accessLogs)
+	}
+	if got := len([]rune(accessLogs[0].Path)); got != accessLogPathMaxRunes {
+		t.Fatalf("expected truncated path length %d, got %d (%q)", accessLogPathMaxRunes, got, accessLogs[0].Path)
+	}
+}
+
 func TestBuildTrafficReportParsesCombinedAccessLog(t *testing.T) {
 	tempDir := t.TempDir()
 	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")

openflare_server/common/constants.go

@@ -31,7 +31,7 @@ var EmailVerificationEnabled = false
 var GitHubOAuthEnabled = false
 var WeChatAuthEnabled = false
 var TurnstileCheckEnabled = false
-var RegisterEnabled = true
+var RegisterEnabled = false
 
 var SMTPServer = ""
 var SMTPPort = 587
@@ -55,6 +55,8 @@ var NodeOfflineThreshold = 2 * time.Minute
 var AgentHeartbeatInterval = 10000 // milliseconds
 var AgentUpdateRepo = "Rain-kl/OpenFlare"
 var GeoIPProvider = "ipinfo"
+var DatabaseAutoCleanupEnabled = false
+var DatabaseAutoCleanupRetentionDays = 30
 
 // V5 OpenResty performance settings (hot-reloadable via Option table)
 var OpenRestyWorkerProcesses = "auto"

openflare_server/controller/agent.go

@@ -24,6 +24,7 @@ func AgentRegister(c *gin.Context) {
 		respondBadRequest(c, "")
 		return
 	}
+	payload.IP = service.ResolveReportedNodeIP(payload.IP, c.Request.RemoteAddr)
 
 	var (
 		result *service.AgentRegistrationResponse
@@ -57,6 +58,7 @@ func AgentHeartbeat(c *gin.Context) {
 		respondBadRequest(c, "")
 		return
 	}
+	payload.IP = service.ResolveReportedNodeIP(payload.IP, c.Request.RemoteAddr)
 
 	authNode, ok := c.Get("agent_node")
 	if !ok {

openflare_server/controller/database.go

@@ -0,0 +1,34 @@
+package controller
+
+import (
+	"net/http"
+	"openflare/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+// CleanupDatabaseObservability godoc
+// @Summary Cleanup observability tables
+// @Tags Options
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} map[string]interface{}
+// @Router /api/option/database/cleanup [post]
+func CleanupDatabaseObservability(c *gin.Context) {
+	var input service.DatabaseCleanupInput
+	if err := decodeOptionalJSONBody(c.Request.Body, &input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "参数错误",
+			"error":   err.Error(),
+		})
+		return
+	}
+	result, err := service.CleanupDatabaseObservability(input)
+	if err != nil {
+		respondFailure(c, err.Error())
+		return
+	}
+	respondSuccess(c, result)
+}

openflare_server/controller/misc.go

@@ -23,19 +23,21 @@ func GetStatus(c *gin.Context) {
 		"success": true,
 		"message": "",
 		"data": gin.H{
-			"version":            common.Version,
-			"start_time":         common.StartTime,
-			"email_verification": common.EmailVerificationEnabled,
-			"github_oauth":       common.GitHubOAuthEnabled,
-			"github_client_id":   common.GitHubClientId,
-			"system_name":        common.SystemName,
-			"home_page_link":     common.HomePageLink,
-			"footer_html":        common.Footer,
-			"wechat_qrcode":      common.WeChatAccountQRCodeImageURL,
-			"wechat_login":       common.WeChatAuthEnabled,
-			"server_address":     common.ServerAddress,
-			"turnstile_check":    common.TurnstileCheckEnabled,
-			"turnstile_site_key": common.TurnstileSiteKey,
+			"version":                   common.Version,
+			"start_time":                common.StartTime,
+			"email_verification":        common.EmailVerificationEnabled,
+			"github_oauth":              common.GitHubOAuthEnabled,
+			"github_client_id":          common.GitHubClientId,
+			"system_name":               common.SystemName,
+			"home_page_link":            common.HomePageLink,
+			"footer_html":               common.Footer,
+			"wechat_qrcode":             common.WeChatAccountQRCodeImageURL,
+			"wechat_login":              common.WeChatAuthEnabled,
+			"server_address":            common.ServerAddress,
+			"turnstile_check":           common.TurnstileCheckEnabled,
+			"turnstile_site_key":        common.TurnstileSiteKey,
+			"register_enabled":          common.RegisterEnabled,
+			"password_register_enabled": common.PasswordRegisterEnabled,
 		},
 	})
 	return

openflare_server/controller/option.go

@@ -22,6 +22,10 @@ var (
 	openRestyDurationTokenPattern = regexp.MustCompile(`^\d+[smhdwSMHDW]$`)
 )
 
+type optionBatchPayload struct {
+	Options []model.Option `json:"options"`
+}
+
 func validateRateLimitOption(key string, value string) error {
 	maxDurationSeconds := int(common.RateLimitKeyExpirationDuration.Seconds())
 
@@ -73,6 +77,21 @@ func validateGeoIPOption(key string, value string) error {
 	return nil
 }
 
+func validateDatabaseCleanupOption(key string, value string) error {
+	switch key {
+	case "DatabaseAutoCleanupEnabled":
+		return validateBooleanOption(key, value)
+	case "DatabaseAutoCleanupRetentionDays":
+		intValue, err := strconv.Atoi(value)
+		if err != nil || intValue < 1 {
+			return fmt.Errorf("%s 必须为大于等于 1 的整数天", key)
+		}
+		return nil
+	default:
+		return nil
+	}
+}
+
 func validateOpenRestyOption(key string, value string) error {
 	trimmed := strings.TrimSpace(value)
 
@@ -178,6 +197,69 @@ func validateOpenRestyOption(key string, value string) error {
 	}
 }
 
+func buildOptionValidationState(options []model.Option) map[string]string {
+	common.OptionMapRWMutex.RLock()
+	state := make(map[string]string, len(common.OptionMap)+len(options))
+	for key, value := range common.OptionMap {
+		state[key] = value
+	}
+	common.OptionMapRWMutex.RUnlock()
+
+	for _, option := range options {
+		state[option.Key] = option.Value
+	}
+	return state
+}
+
+func validateOptionWithState(option model.Option, state map[string]string) error {
+	switch option.Key {
+	case "GitHubOAuthEnabled":
+		if option.Value == "true" && strings.TrimSpace(state["GitHubClientId"]) == "" {
+			return fmt.Errorf("鏃犳硶鍚敤 GitHub OAuth锛岃鍏堝～鍏?GitHub Client ID 浠ュ強 GitHub Client Secret锛?")
+		}
+	case "WeChatAuthEnabled":
+		if option.Value == "true" && strings.TrimSpace(state["WeChatServerAddress"]) == "" {
+			return fmt.Errorf("鏃犳硶鍚敤寰俊鐧诲綍锛岃鍏堝～鍏ュ井淇＄櫥褰曠浉鍏抽厤缃俊鎭紒")
+		}
+	case "TurnstileCheckEnabled":
+		if option.Value == "true" && strings.TrimSpace(state["TurnstileSiteKey"]) == "" {
+			return fmt.Errorf("鏃犳硶鍚敤 Turnstile 鏍￠獙锛岃鍏堝～鍏?Turnstile 鏍￠獙鐩稿叧閰嶇疆淇℃伅锛?")
+		}
+	}
+
+	if err := validateRateLimitOption(option.Key, option.Value); err != nil {
+		return err
+	}
+	if err := validateOpenRestyOption(option.Key, option.Value); err != nil {
+		return err
+	}
+	if err := validateGeoIPOption(option.Key, option.Value); err != nil {
+		return err
+	}
+	if err := validateDatabaseCleanupOption(option.Key, option.Value); err != nil {
+		return err
+	}
+	return nil
+}
+
+func updateOptions(options []model.Option) error {
+	if len(options) == 0 {
+		return fmt.Errorf("鏃犳晥鐨勫弬鏁?")
+	}
+
+	state := buildOptionValidationState(options)
+	for _, option := range options {
+		if strings.TrimSpace(option.Key) == "" {
+			return fmt.Errorf("鏃犳晥鐨勫弬鏁?")
+		}
+		if err := validateOptionWithState(option, state); err != nil {
+			return err
+		}
+	}
+
+	return model.UpdateOptions(options)
+}
+
 // GetOptions godoc
 // @Summary List editable options
 // @Tags Options
@@ -271,6 +353,13 @@ func UpdateOption(c *gin.Context) {
 		})
 		return
 	}
+	if err = validateDatabaseCleanupOption(option.Key, option.Value); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
 	err = model.UpdateOption(option.Key, option.Value)
 	if err != nil {
 		c.JSON(http.StatusOK, gin.H{
@@ -285,3 +374,36 @@ func UpdateOption(c *gin.Context) {
 	})
 	return
 }
+
+// UpdateOptionsBatch godoc
+// @Summary Batch update options
+// @Tags Options
+// @Accept json
+// @Produce json
+// @Param payload body optionBatchPayload true "Batch option payload"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/option/update-batch [post]
+func UpdateOptionsBatch(c *gin.Context) {
+	var payload optionBatchPayload
+	if err := json.NewDecoder(c.Request.Body).Decode(&payload); err != nil || len(payload.Options) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "鏃犳晥鐨勫弬鏁?",
+		})
+		return
+	}
+
+	if err := updateOptions(payload.Options); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+}

openflare_server/controller/origin.go

@@ -0,0 +1,128 @@
+package controller
+
+import (
+	"encoding/json"
+	"net/http"
+	"openflare/service"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+)
+
+func GetOrigins(c *gin.Context) {
+	origins, err := service.ListOrigins()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    origins,
+	})
+}
+
+func GetOrigin(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	origin, err := service.GetOriginDetail(uint(id))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    origin,
+	})
+}
+
+func CreateOrigin(c *gin.Context) {
+	var input service.OriginInput
+	if err := json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	origin, err := service.CreateOrigin(input)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    origin,
+	})
+}
+
+func UpdateOrigin(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	var input service.OriginInput
+	if err = json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	origin, err := service.UpdateOrigin(uint(id), input)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    origin,
+	})
+}
+
+func DeleteOrigin(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "无效的参数",
+		})
+		return
+	}
+	if err = service.DeleteOrigin(uint(id)); err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+	})
+}

openflare_server/controller/proxy_route.go

@@ -2,10 +2,11 @@ package controller
 
 import (
 	"encoding/json"
-	"github.com/gin-gonic/gin"
 	"net/http"
 	"openflare/service"
 	"strconv"
+
+	"github.com/gin-gonic/gin"
 )
 
 // GetProxyRoutes godoc
@@ -31,6 +32,39 @@ func GetProxyRoutes(c *gin.Context) {
 	})
 }
 
+// GetProxyRoute godoc
+// @Summary Get proxy route detail
+// @Tags ProxyRoutes
+// @Produce json
+// @Security BearerAuth
+// @Param id path int true "Route ID"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]interface{}
+// @Router /api/proxy-routes/{id} [get]
+func GetProxyRoute(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"success": false,
+			"message": "invalid id",
+		})
+		return
+	}
+	route, err := service.GetProxyRoute(uint(id))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"success": true,
+		"message": "",
+		"data":    route,
+	})
+}
+
 // CreateProxyRoute godoc
 // @Summary Create proxy route
 // @Tags ProxyRoutes
@@ -46,7 +80,7 @@ func CreateProxyRoute(c *gin.Context) {
 	if err := json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{
 			"success": false,
-			"message": "无效的参数",
+			"message": "invalid payload",
 		})
 		return
 	}
@@ -81,7 +115,7 @@ func UpdateProxyRoute(c *gin.Context) {
 	if err != nil || id == 0 {
 		c.JSON(http.StatusBadRequest, gin.H{
 			"success": false,
-			"message": "无效的参数",
+			"message": "invalid id",
 		})
 		return
 	}
@@ -89,7 +123,7 @@ func UpdateProxyRoute(c *gin.Context) {
 	if err = json.NewDecoder(c.Request.Body).Decode(&input); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{
 			"success": false,
-			"message": "无效的参数",
+			"message": "invalid payload",
 		})
 		return
 	}
@@ -122,7 +156,7 @@ func DeleteProxyRoute(c *gin.Context) {
 	if err != nil || id == 0 {
 		c.JSON(http.StatusBadRequest, gin.H{
 			"success": false,
-			"message": "无效的参数",
+			"message": "invalid id",
 		})
 		return
 	}

openflare_server/docs/docs.go

@@ -1442,6 +1442,34 @@ const docTemplate = `{
                 }
             }
         },
+        "/api/option/database/cleanup": {
+            "post": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Options"
+                ],
+                "summary": "Cleanup observability tables",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "type": "object",
+                            "additionalProperties": true
+                        }
+                    }
+                }
+            }
+        },
         "/api/option/geoip/lookup": {
             "post": {
                 "consumes": [
@@ -2351,22 +2379,19 @@ const docTemplate = `{
                 "source_countries": {
                     "type": "object",
                     "additionalProperties": {
-                        "type": "integer",
-                        "format": "int64"
+                        "type": "integer"
                     }
                 },
                 "status_codes": {
                     "type": "object",
                     "additionalProperties": {
-                        "type": "integer",
-                        "format": "int64"
+                        "type": "integer"
                     }
                 },
                 "top_domains": {
                     "type": "object",
                     "additionalProperties": {
-                        "type": "integer",
-                        "format": "int64"
+                        "type": "integer"
                     }
                 },
                 "unique_visitor_count": {

openflare_server/docs/swagger.json

@@ -1439,6 +1439,34 @@
                 }
             }
         },
+        "/api/option/database/cleanup": {
+            "post": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Options"
+                ],
+                "summary": "Cleanup observability tables",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "type": "object",
+                            "additionalProperties": true
+                        }
+                    }
+                }
+            }
+        },
         "/api/option/geoip/lookup": {
             "post": {
                 "consumes": [
@@ -2348,22 +2376,19 @@
                 "source_countries": {
                     "type": "object",
                     "additionalProperties": {
-                        "type": "integer",
-                        "format": "int64"
+                        "type": "integer"
                     }
                 },
                 "status_codes": {
                     "type": "object",
                     "additionalProperties": {
-                        "type": "integer",
-                        "format": "int64"
+                        "type": "integer"
                     }
                 },
                 "top_domains": {
                     "type": "object",
                     "additionalProperties": {
-                        "type": "integer",
-                        "format": "int64"
+                        "type": "integer"
                     }
                 },
                 "unique_visitor_count": {

openflare_server/docs/swagger.yaml

@@ -156,17 +156,14 @@ definitions:
         type: integer
       source_countries:
         additionalProperties:
-          format: int64
           type: integer
         type: object
       status_codes:
         additionalProperties:
-          format: int64
           type: integer
         type: object
       top_domains:
         additionalProperties:
-          format: int64
           type: integer
         type: object
       unique_visitor_count:
@@ -1178,6 +1175,23 @@ paths:
       summary: List editable options
       tags:
       - Options
+  /api/option/database/cleanup:
+    post:
+      consumes:
+      - application/json
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            additionalProperties: true
+            type: object
+      security:
+      - BearerAuth: []
+      summary: Cleanup observability tables
+      tags:
+      - Options
   /api/option/geoip/lookup:
     post:
       consumes:

openflare_server/go.mod

@@ -1,6 +1,6 @@
 module openflare
 
-// +heroku goVersion go1.18
+// +heroku goVersion go1.24
 go 1.24.0
 
 require (
@@ -28,6 +28,7 @@ require (
 	github.com/PuerkitoBio/purell v1.1.1 // indirect
 	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
 	github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff // indirect
+	github.com/bwmarrin/snowflake v0.3.0 // indirect
 	github.com/bytedance/sonic v1.11.2 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chenzhuoyu/base64x v0.0.0-20230717121745-296ad89f973d // indirect
@@ -58,6 +59,7 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/longbridgeapp/sqlparser v0.3.1 // indirect
 	github.com/mailru/easyjson v0.7.6 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -67,6 +69,7 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
 	golang.org/x/arch v0.7.0 // indirect
+	golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63 // indirect
 	golang.org/x/sync v0.18.0 // indirect
 	golang.org/x/sys v0.38.0 // indirect
 	golang.org/x/text v0.31.0 // indirect
@@ -74,6 +77,7 @@ require (
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gorm.io/sharding v0.6.2 // indirect
 	modernc.org/libc v1.22.5 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
 	modernc.org/memory v1.5.0 // indirect

openflare_server/go.sum

@@ -6,6 +6,8 @@ github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff h1:RmdPFa+slIr4SCBg4st/l/vZWVe9QJKMXGO60Bxbe04=
 github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff/go.mod h1:+RTT1BOk5P97fT2CiHkbFQwkK3mjsFAP6zCYV2aXtjw=
+github.com/bwmarrin/snowflake v0.3.0 h1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=
+github.com/bwmarrin/snowflake v0.3.0/go.mod h1:NdZxfVWX+oR6y2K0o6qAYv6gIOP9rjG0/E9WsDpxqwE=
 github.com/bytedance/sonic v1.5.0/go.mod h1:ED5hyg4y6t3/9Ku1R6dU/4KyJ48DZ4jPhfY1O2AihPM=
 github.com/bytedance/sonic v1.10.0-rc/go.mod h1:ElCzW+ufi8qKqNW0FY314xriJhyJhuoJ3gFZdAHF7NM=
 github.com/bytedance/sonic v1.11.2 h1:ywfwo0a/3j9HR8wsYGWsIWl2mvRsI950HyoxiBERw5A=
@@ -76,6 +78,7 @@ github.com/go-playground/validator/v10 v10.19.0 h1:ol+5Fu+cSq9JD7SoSqe04GMI92cbn
 github.com/go-playground/validator/v10 v10.19.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
+github.com/go-test/deep v1.0.7/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
@@ -126,6 +129,8 @@ github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/longbridgeapp/sqlparser v0.3.1 h1:iWOZWGIFgQrJRgobLXUNJdvqGRpbVXkyKUKUA5CNJBE=
+github.com/longbridgeapp/sqlparser v0.3.1/go.mod h1:GIHaUq8zvYyHLCLMJJykx1CdM6LHtkUih/QaJXySSx4=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA=
@@ -157,6 +162,7 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
 github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -190,6 +196,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
 golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63 h1:m64FZMko/V45gv0bNmrNYoDEq8U5YUhetc9cBWKS1TQ=
+golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63/go.mod h1:0v4NqG35kSWCMzLaMeX+IQrlSnVE/bqGSyC2cz/9Le8=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
 golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
@@ -253,6 +261,8 @@ gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
 gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
 gorm.io/gorm v1.25.10 h1:dQpO+33KalOA+aFYGlK+EfxcI5MbO7EP2yYygwh9h+s=
 gorm.io/gorm v1.25.10/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
+gorm.io/sharding v0.6.2 h1:V9inmbdhN+RfWPEKTvbKKKv7qxLz1CneBDQvuL5P7jg=
+gorm.io/sharding v0.6.2/go.mod h1:dXaAZv0qyUmLkLAciQ+NH2O1D1A4/ttrrZ/XK4xW9HU=
 modernc.org/libc v1.22.5 h1:91BNch/e5B0uPbJFgqbxXuOnxBQjlS//icfQEGmvyjE=
 modernc.org/libc v1.22.5/go.mod h1:jj+Z7dTNX8fBScMVNRAYZ/jF91K8fdT2hYMThc3YjBY=
 modernc.org/mathutil v1.5.0 h1:rV0Ko/6SfM+8G+yKiyI830l3Wuz1zRutdslNoQ0kfiQ=

openflare_server/main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"embed"
 	"fmt"
 	"github.com/gin-contrib/sessions"
@@ -13,6 +14,7 @@ import (
 	"openflare/middleware"
 	"openflare/model"
 	"openflare/router"
+	"openflare/service"
 	"openflare/utils/geoip"
 	"os"
 	"strconv"
@@ -67,6 +69,9 @@ func main() {
 	// Initialize options
 	model.InitOptionMap()
 	geoip.InitGeoIP()
+	backgroundCtx, cancelBackgroundTasks := context.WithCancel(context.Background())
+	defer cancelBackgroundTasks()
+	service.StartDatabaseAutoCleanupScheduler(backgroundCtx)
 
 	// Initialize HTTP server
 	server := gin.Default()

openflare_server/model/database_schema_version.go

@@ -0,0 +1,19 @@
+package model
+
+import "time"
+
+const (
+	legacyDatabaseSchemaVersion  = 1
+	currentDatabaseSchemaVersion = 8
+	databaseSchemaVersionRowID   = 1
+)
+
+type DatabaseSchemaVersion struct {
+	ID        uint      `json:"id" gorm:"primaryKey"`
+	Version   int       `json:"version" gorm:"not null"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+func (DatabaseSchemaVersion) TableName() string {
+	return "database_schema_versions"
+}

openflare_server/model/main.go

@@ -27,6 +27,7 @@ func registeredModels() []any {
 		&File{},
 		&User{},
 		&Option{},
+		&Origin{},
 		&ProxyRoute{},
 		&ConfigVersion{},
 		&Node{},
@@ -41,6 +42,12 @@ func registeredModels() []any {
 	}
 }
 
+func schemaMetadataModels() []any {
+	return []any{
+		&DatabaseSchemaVersion{},
+	}
+}
+
 func buildDBModels() ([]dbModel, error) {
 	models := registeredModels()
 	result := make([]dbModel, 0, len(models))
@@ -61,16 +68,6 @@ func buildDBModels() ([]dbModel, error) {
 	return result, nil
 }
 
-func migrateProxyRouteEnableHTTPSColumn(db *gorm.DB) error {
-	if !db.Migrator().HasTable(&ProxyRoute{}) {
-		return nil
-	}
-	if db.Migrator().HasColumn(&ProxyRoute{}, "enable_https") || !db.Migrator().HasColumn(&ProxyRoute{}, "enable_http_s") {
-		return nil
-	}
-	return db.Migrator().RenameColumn(&ProxyRoute{}, "enable_http_s", "enable_https")
-}
-
 func createRootAccountIfNeed() error {
 	var user User
 	//if user.Status != common.UserStatusEnabled {
@@ -99,17 +96,13 @@ func CountTable(tableName string) (num int64) {
 
 func openDatabase() (*gorm.DB, string, error) {
 	if common.SQLDSN != "" {
-		db, err := gorm.Open(postgres.Open(common.SQLDSN), &gorm.Config{
-			PrepareStmt: true,
-		})
+		db, err := gorm.Open(postgres.Open(common.SQLDSN), &gorm.Config{})
 		if err != nil {
 			return nil, "", err
 		}
 		return db, "postgres", nil
 	}
-	db, err := gorm.Open(sqlite.Open(common.SQLitePath), &gorm.Config{
-		PrepareStmt: true,
-	})
+	db, err := gorm.Open(sqlite.Open(common.SQLitePath), &gorm.Config{})
 	if err != nil {
 		return nil, "", err
 	}
@@ -126,37 +119,32 @@ func autoMigrateAll(db *gorm.DB) error {
 	return nil
 }
 
-func migrateTextColumns(db *gorm.DB, backend string) error {
-	if backend != "postgres" {
-		return nil
+func isDatabaseEmpty(db *gorm.DB) (bool, error) {
+	models, err := buildDBModels()
+	if err != nil {
+		return false, err
 	}
-	type textColumn struct {
-		model  any
-		table  string
-		column string
-	}
-	columns := []textColumn{
-		{model: &Node{}, table: "nodes", column: "openresty_message"},
-		{model: &Node{}, table: "nodes", column: "last_error"},
-		{model: &ApplyLog{}, table: "apply_logs", column: "message"},
-		{model: &NodeHealthEvent{}, table: "node_health_events", column: "message"},
-	}
-	for _, item := range columns {
-		if !db.Migrator().HasTable(item.model) || !db.Migrator().HasColumn(item.model, item.column) {
+	for _, item := range models {
+		if isShardedObservabilityTable(item.tableName) {
+			for _, table := range observabilityShardTables(item.tableName) {
+				if !db.Migrator().HasTable(table) {
+					continue
+				}
+				var count int64
+				if err := db.Table(table).Limit(1).Count(&count).Error; err != nil {
+					return false, err
+				}
+				if count > 0 {
+					return false, nil
+				}
+			}
 			continue
 		}
-		sql := fmt.Sprintf(`ALTER TABLE "%s" ALTER COLUMN "%s" TYPE text`, item.table, item.column)
-		if err := db.Exec(sql).Error; err != nil {
-			return fmt.Errorf("migrate column %s.%s to text failed: %w", item.table, item.column, err)
+		if !db.Migrator().HasTable(item.value) {
+			continue
 		}
-	}
-	return nil
-}
-
-func isDatabaseEmpty(db *gorm.DB) (bool, error) {
-	for _, item := range registeredModels() {
 		var count int64
-		if err := db.Model(item).Limit(1).Count(&count).Error; err != nil {
+		if err := db.Model(item.value).Limit(1).Count(&count).Error; err != nil {
 			return false, err
 		}
 		if count > 0 {
@@ -265,8 +253,17 @@ func migrateTableData(source *gorm.DB, target *gorm.DB, item dbModel) error {
 		if batchLen == 0 {
 			break
 		}
-		if err := target.Create(batchPtr.Interface()).Error; err != nil {
-			return fmt.Errorf("write target table %s failed: %w", item.tableName, err)
+		if isShardedObservabilityTable(item.tableName) {
+			for index := 0; index < batchLen; index++ {
+				record := batchPtr.Elem().Index(index)
+				if err := target.Create(record.Addr().Interface()).Error; err != nil {
+					return fmt.Errorf("write target sharded table %s failed: %w", item.tableName, err)
+				}
+			}
+		} else {
+			if err := target.Create(batchPtr.Interface()).Error; err != nil {
+				return fmt.Errorf("write target table %s failed: %w", item.tableName, err)
+			}
 		}
 		migrated += int64(batchLen)
 		offset += batchLen
@@ -293,16 +290,10 @@ func InitDB() (err error) {
 		os.Exit(1)
 	}
 	DB = db
-	if err = migrateProxyRouteEnableHTTPSColumn(db); err != nil {
+	if err = registerSharding(db, backend); err != nil {
 		return err
 	}
-	if err = autoMigrateAll(db); err != nil {
-		return err
-	}
-	if err = migrateTextColumns(db, backend); err != nil {
-		return err
-	}
-	if err = migrateSQLiteDataIfNeeded(db, backend); err != nil {
+	if err = ensureDatabaseSchemaUpToDate(db, backend); err != nil {
 		return err
 	}
 	return createRootAccountIfNeed()

openflare_server/model/main_test.go

@@ -1,23 +1,131 @@
 package model
 
 import (
+	"encoding/json"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/glebarez/sqlite"
 	"gorm.io/gorm"
 )
 
-func openTestSQLiteDB(t *testing.T, name string) *gorm.DB {
+type legacyProxyRouteV4 struct {
+	ID            uint   `gorm:"primaryKey"`
+	Domain        string `gorm:"uniqueIndex;size:255;not null"`
+	OriginID      *uint  `gorm:"index"`
+	OriginURL     string `gorm:"size:2048;not null"`
+	OriginHost    string `gorm:"size:255"`
+	Upstreams     string `gorm:"type:text;not null;default:'[]'"`
+	Enabled       bool   `gorm:"not null;default:true"`
+	EnableHTTPS   bool   `gorm:"column:enable_https;not null;default:false"`
+	CertID        *uint
+	RedirectHTTP  bool   `gorm:"not null;default:false"`
+	CacheEnabled  bool   `gorm:"not null;default:false"`
+	CachePolicy   string `gorm:"size:32;not null;default:''"`
+	CacheRules    string `gorm:"type:text;not null;default:'[]'"`
+	CustomHeaders string `gorm:"type:text;not null;default:'[]'"`
+	Remark        string `gorm:"size:255"`
+	CreatedAt     time.Time
+	UpdatedAt     time.Time
+}
+
+func (legacyProxyRouteV4) TableName() string {
+	return "proxy_routes"
+}
+
+type legacyProxyRouteV5 struct {
+	ID            uint   `gorm:"primaryKey"`
+	SiteName      string `gorm:"size:255;not null;default:''"`
+	Domain        string `gorm:"uniqueIndex;size:255;not null"`
+	Domains       string `gorm:"type:text;not null;default:'[]'"`
+	OriginID      *uint  `gorm:"index"`
+	OriginURL     string `gorm:"size:2048;not null"`
+	OriginHost    string `gorm:"size:255"`
+	Upstreams     string `gorm:"type:text;not null;default:'[]'"`
+	Enabled       bool   `gorm:"not null;default:true"`
+	EnableHTTPS   bool   `gorm:"column:enable_https;not null;default:false"`
+	CertID        *uint
+	RedirectHTTP  bool   `gorm:"not null;default:false"`
+	CacheEnabled  bool   `gorm:"not null;default:false"`
+	CachePolicy   string `gorm:"size:32;not null;default:''"`
+	CacheRules    string `gorm:"type:text;not null;default:'[]'"`
+	CustomHeaders string `gorm:"type:text;not null;default:'[]'"`
+	Remark        string `gorm:"size:255"`
+	CreatedAt     time.Time
+	UpdatedAt     time.Time
+}
+
+func (legacyProxyRouteV5) TableName() string {
+	return "proxy_routes"
+}
+
+type legacyProxyRouteV6 struct {
+	ID                 uint   `gorm:"primaryKey"`
+	SiteName           string `gorm:"size:255;not null;default:''"`
+	Domain             string `gorm:"uniqueIndex;size:255;not null"`
+	Domains            string `gorm:"type:text;not null;default:'[]'"`
+	OriginID           *uint  `gorm:"index"`
+	OriginURL          string `gorm:"size:2048;not null"`
+	OriginHost         string `gorm:"size:255"`
+	Upstreams          string `gorm:"type:text;not null;default:'[]'"`
+	Enabled            bool   `gorm:"not null;default:true"`
+	EnableHTTPS        bool   `gorm:"column:enable_https;not null;default:false"`
+	CertID             *uint
+	RedirectHTTP       bool   `gorm:"not null;default:false"`
+	LimitConnPerServer int    `gorm:"not null;default:0"`
+	LimitConnPerIP     int    `gorm:"not null;default:0"`
+	LimitRate          string `gorm:"size:32;not null;default:''"`
+	CacheEnabled       bool   `gorm:"not null;default:false"`
+	CachePolicy        string `gorm:"size:32;not null;default:''"`
+	CacheRules         string `gorm:"type:text;not null;default:'[]'"`
+	CustomHeaders      string `gorm:"type:text;not null;default:'[]'"`
+	Remark             string `gorm:"size:255"`
+	CreatedAt          time.Time
+	UpdatedAt          time.Time
+}
+
+func (legacyProxyRouteV6) TableName() string {
+	return "proxy_routes"
+}
+
+type legacyProxyRouteV7 struct {
+	ID                 uint   `gorm:"primaryKey"`
+	SiteName           string `gorm:"size:255;not null;default:''"`
+	Domain             string `gorm:"uniqueIndex;size:255;not null"`
+	Domains            string `gorm:"type:text;not null;default:'[]'"`
+	OriginID           *uint  `gorm:"index"`
+	OriginURL          string `gorm:"size:2048;not null"`
+	OriginHost         string `gorm:"size:255"`
+	Upstreams          string `gorm:"type:text;not null;default:'[]'"`
+	Enabled            bool   `gorm:"not null;default:true"`
+	EnableHTTPS        bool   `gorm:"column:enable_https;not null;default:false"`
+	CertID             *uint
+	CertIDs            string `gorm:"type:text;not null;default:'[]'"`
+	RedirectHTTP       bool   `gorm:"not null;default:false"`
+	LimitConnPerServer int    `gorm:"not null;default:0"`
+	LimitConnPerIP     int    `gorm:"not null;default:0"`
+	LimitRate          string `gorm:"size:32;not null;default:''"`
+	CacheEnabled       bool   `gorm:"not null;default:false"`
+	CachePolicy        string `gorm:"size:32;not null;default:''"`
+	CacheRules         string `gorm:"type:text;not null;default:'[]'"`
+	CustomHeaders      string `gorm:"type:text;not null;default:'[]'"`
+	Remark             string `gorm:"size:255"`
+	CreatedAt          time.Time
+	UpdatedAt          time.Time
+}
+
+func (legacyProxyRouteV7) TableName() string {
+	return "proxy_routes"
+}
+
+func openBareTestSQLiteDB(t *testing.T, name string) *gorm.DB {
 	t.Helper()
 
 	db, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), name)), &gorm.Config{})
 	if err != nil {
 		t.Fatalf("open sqlite db: %v", err)
 	}
-	if err := autoMigrateAll(db); err != nil {
-		t.Fatalf("auto migrate db: %v", err)
-	}
 	sqlDB, err := db.DB()
 	if err != nil {
 		t.Fatalf("get sql db: %v", err)
@@ -28,6 +136,16 @@ func openTestSQLiteDB(t *testing.T, name string) *gorm.DB {
 	return db
 }
 
+func openTestSQLiteDB(t *testing.T, name string) *gorm.DB {
+	t.Helper()
+
+	db := openBareTestSQLiteDB(t, name)
+	if err := autoMigrateAll(db); err != nil {
+		t.Fatalf("auto migrate db: %v", err)
+	}
+	return db
+}
+
 func findDBModelByTableName(t *testing.T, tableName string) dbModel {
 	t.Helper()
 
@@ -121,3 +239,647 @@ func TestMigrateTableDataCopiesRows(t *testing.T) {
 		t.Fatalf("unexpected migrated option value: %s", gotOption.Value)
 	}
 }
+
+func TestRegisterShardingAutoMigratesShardTables(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "sharded.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+	if err := autoMigrateAll(db); err != nil {
+		t.Fatalf("auto migrate db: %v", err)
+	}
+
+	for _, table := range []string{
+		"node_metric_snapshots_00",
+		"node_metric_snapshots_09",
+		"node_request_reports_00",
+		"node_request_reports_09",
+		"node_access_logs_00",
+		"node_access_logs_09",
+	} {
+		if !db.Migrator().HasTable(table) {
+			t.Fatalf("expected sharded table %s to exist", table)
+		}
+	}
+}
+
+func TestMigrateObservabilityLegacyColumnsBackfillsHealthEventMetadata(t *testing.T) {
+	db := openTestSQLiteDB(t, "legacy-health-events.db")
+
+	if err := db.Exec("ALTER TABLE node_health_events ADD COLUMN raw_json TEXT").Error; err != nil {
+		t.Fatalf("add raw_json column: %v", err)
+	}
+	rawJSON, err := json.Marshal(map[string]any{
+		"event_type": "sync_error",
+		"metadata": map[string]string{
+			"reason": "checksum_mismatch",
+			"scope":  "routes",
+		},
+	})
+	if err != nil {
+		t.Fatalf("marshal raw json: %v", err)
+	}
+	event := &NodeHealthEvent{
+		NodeID:           "node-legacy",
+		EventType:        "sync_error",
+		Severity:         "warning",
+		Status:           "active",
+		Message:          "checksum mismatch",
+		FirstTriggeredAt: time.Now().Add(-time.Minute),
+		LastTriggeredAt:  time.Now(),
+		ReportedAt:       time.Now(),
+	}
+	if err := db.Create(event).Error; err != nil {
+		t.Fatalf("create health event: %v", err)
+	}
+	if err := db.Exec("UPDATE node_health_events SET raw_json = ? WHERE id = ?", string(rawJSON), event.ID).Error; err != nil {
+		t.Fatalf("seed legacy raw_json: %v", err)
+	}
+
+	if err := migrateObservabilityLegacyColumns(db); err != nil {
+		t.Fatalf("migrateObservabilityLegacyColumns: %v", err)
+	}
+
+	var got NodeHealthEvent
+	if err := db.First(&got, event.ID).Error; err != nil {
+		t.Fatalf("query health event: %v", err)
+	}
+	if got.MetadataJSON == "" {
+		t.Fatal("expected metadata_json to be backfilled")
+	}
+}
+
+func TestEnsureDatabaseSchemaUpToDateInitializesFreshDatabase(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "fresh-schema.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+
+	if err := ensureDatabaseSchemaUpToDate(db, "sqlite"); err != nil {
+		t.Fatalf("ensureDatabaseSchemaUpToDate: %v", err)
+	}
+
+	version, exists, err := loadDatabaseSchemaVersion(db)
+	if err != nil {
+		t.Fatalf("loadDatabaseSchemaVersion: %v", err)
+	}
+	if !exists {
+		t.Fatal("expected database schema version to be recorded")
+	}
+	if version != currentDatabaseSchemaVersion {
+		t.Fatalf("unexpected schema version: got %d want %d", version, currentDatabaseSchemaVersion)
+	}
+}
+
+func TestEnsureDatabaseSchemaUpToDateUpgradesLegacyDatabase(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "legacy-schema.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+	if err := autoMigrateAll(db); err != nil {
+		t.Fatalf("auto migrate db: %v", err)
+	}
+	if err := db.Create(&User{
+		Username:    "legacy",
+		Password:    "secret",
+		DisplayName: "Legacy User",
+		Role:        1,
+		Status:      1,
+	}).Error; err != nil {
+		t.Fatalf("seed legacy user: %v", err)
+	}
+
+	if err := ensureDatabaseSchemaUpToDate(db, "sqlite"); err != nil {
+		t.Fatalf("ensureDatabaseSchemaUpToDate: %v", err)
+	}
+
+	version, exists, err := loadDatabaseSchemaVersion(db)
+	if err != nil {
+		t.Fatalf("loadDatabaseSchemaVersion: %v", err)
+	}
+	if !exists {
+		t.Fatal("expected legacy database to gain a schema version record")
+	}
+	if version != currentDatabaseSchemaVersion {
+		t.Fatalf("unexpected schema version: got %d want %d", version, currentDatabaseSchemaVersion)
+	}
+}
+
+func TestEnsureDatabaseSchemaUpToDateMigratesObservabilityShardsToID(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "legacy-observability-shards.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+	if err := autoMigrateAll(db); err != nil {
+		t.Fatalf("auto migrate db: %v", err)
+	}
+	if err := autoMigrateSchemaMetadata(db); err != nil {
+		t.Fatalf("auto migrate schema metadata: %v", err)
+	}
+
+	now := time.Now().UTC()
+	if err := db.Table("node_metric_snapshots_00").Create(&NodeMetricSnapshot{
+		ID:               1,
+		NodeID:           "node-a",
+		CapturedAt:       now.Add(-2 * time.Minute),
+		CPUUsagePercent:  22,
+		MemoryUsedBytes:  2,
+		MemoryTotalBytes: 8,
+	}).Error; err != nil {
+		t.Fatalf("seed metric snapshot shard 00: %v", err)
+	}
+	if err := db.Table("node_metric_snapshots_01").Create(&NodeMetricSnapshot{
+		ID:               1,
+		NodeID:           "node-b",
+		CapturedAt:       now.Add(-time.Minute),
+		CPUUsagePercent:  44,
+		MemoryUsedBytes:  4,
+		MemoryTotalBytes: 8,
+	}).Error; err != nil {
+		t.Fatalf("seed metric snapshot shard 01: %v", err)
+	}
+	if err := db.Table("node_request_reports_00").Create(&NodeRequestReport{
+		ID:                 1,
+		NodeID:             "node-a",
+		WindowStartedAt:    now.Add(-3 * time.Minute),
+		WindowEndedAt:      now.Add(-2 * time.Minute),
+		RequestCount:       12,
+		ErrorCount:         1,
+		UniqueVisitorCount: 6,
+	}).Error; err != nil {
+		t.Fatalf("seed request report shard 00: %v", err)
+	}
+	if err := db.Table("node_request_reports_01").Create(&NodeRequestReport{
+		ID:                 1,
+		NodeID:             "node-b",
+		WindowStartedAt:    now.Add(-2 * time.Minute),
+		WindowEndedAt:      now.Add(-time.Minute),
+		RequestCount:       21,
+		ErrorCount:         2,
+		UniqueVisitorCount: 9,
+	}).Error; err != nil {
+		t.Fatalf("seed request report shard 01: %v", err)
+	}
+	if err := db.Table("node_access_logs_00").Create(&NodeAccessLog{
+		ID:         1,
+		NodeID:     "node-a",
+		LoggedAt:   now.Add(-90 * time.Second),
+		RemoteAddr: "203.0.113.10",
+		Host:       "a.example.com",
+		Path:       "/alpha",
+		StatusCode: 200,
+	}).Error; err != nil {
+		t.Fatalf("seed access log shard 00: %v", err)
+	}
+	if err := db.Table("node_access_logs_01").Create(&NodeAccessLog{
+		ID:         1,
+		NodeID:     "node-b",
+		LoggedAt:   now.Add(-60 * time.Second),
+		RemoteAddr: "203.0.113.11",
+		Host:       "b.example.com",
+		Path:       "/beta",
+		StatusCode: 502,
+	}).Error; err != nil {
+		t.Fatalf("seed access log shard 01: %v", err)
+	}
+	if err := saveDatabaseSchemaVersion(db, 2); err != nil {
+		t.Fatalf("save schema version: %v", err)
+	}
+
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+	})
+
+	if err := ensureDatabaseSchemaUpToDate(db, "sqlite"); err != nil {
+		t.Fatalf("ensureDatabaseSchemaUpToDate: %v", err)
+	}
+
+	version, exists, err := loadDatabaseSchemaVersion(db)
+	if err != nil {
+		t.Fatalf("loadDatabaseSchemaVersion: %v", err)
+	}
+	if !exists {
+		t.Fatal("expected migrated database to keep schema version record")
+	}
+	if version != currentDatabaseSchemaVersion {
+		t.Fatalf("unexpected schema version: got %d want %d", version, currentDatabaseSchemaVersion)
+	}
+
+	for _, baseTable := range shardedObservabilityBaseTables() {
+		for _, table := range observabilityShardTables(baseTable) {
+			legacyTable := legacyObservabilityShardTableName(table)
+			if db.Migrator().HasTable(legacyTable) {
+				t.Fatalf("expected legacy shard table %s to be removed", legacyTable)
+			}
+		}
+	}
+
+	snapshots, err := ListMetricSnapshotsSince(time.Time{})
+	if err != nil {
+		t.Fatalf("ListMetricSnapshotsSince failed: %v", err)
+	}
+	if len(snapshots) != 2 {
+		t.Fatalf("expected 2 migrated metric snapshots, got %+v", snapshots)
+	}
+	reports, err := ListRequestReportsSince(time.Time{})
+	if err != nil {
+		t.Fatalf("ListRequestReportsSince failed: %v", err)
+	}
+	if len(reports) != 2 {
+		t.Fatalf("expected 2 migrated request reports, got %+v", reports)
+	}
+	logs, err := ListNodeAccessLogs(NodeAccessLogQuery{Page: 0, PageSize: 10})
+	if err != nil {
+		t.Fatalf("ListNodeAccessLogs failed: %v", err)
+	}
+	if len(logs) != 2 {
+		t.Fatalf("expected 2 migrated access logs, got %+v", logs)
+	}
+
+	seenSnapshotIDs := make(map[uint]struct{}, len(snapshots))
+	for _, item := range snapshots {
+		if item == nil || item.ID == 0 {
+			t.Fatalf("expected migrated metric snapshot to have a new non-zero id: %+v", item)
+		}
+		if _, exists := seenSnapshotIDs[item.ID]; exists {
+			t.Fatalf("expected migrated metric snapshot ids to be unique, got duplicate %d", item.ID)
+		}
+		seenSnapshotIDs[item.ID] = struct{}{}
+		targetTable := observabilityShardTableForID("node_metric_snapshots", item.ID)
+		var count int64
+		if err := db.Table(targetTable).Where("id = ?", item.ID).Count(&count).Error; err != nil {
+			t.Fatalf("count migrated metric snapshot in target shard: %v", err)
+		}
+		if count != 1 {
+			t.Fatalf("expected migrated metric snapshot id %d to be stored in %s", item.ID, targetTable)
+		}
+	}
+}
+
+func TestMigrateOriginsSchemaBackfillsOrigins(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "legacy-origins.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+	if err := applyCurrentSchema(db, "sqlite"); err != nil {
+		t.Fatalf("applyCurrentSchema: %v", err)
+	}
+	now := time.Now().UTC()
+	route := &ProxyRoute{
+		Domain:    "app.example.com",
+		OriginURL: "https://origin-a.internal:8443/api",
+		Upstreams: `["https://origin-a.internal:8443/api"]`,
+		Enabled:   true,
+		CreatedAt: now,
+		UpdatedAt: now,
+	}
+	if err := db.Create(route).Error; err != nil {
+		t.Fatalf("seed proxy route: %v", err)
+	}
+	if err := db.Exec(`DELETE FROM origins`).Error; err != nil {
+		t.Fatalf("clear origins: %v", err)
+	}
+	if err := db.Model(&ProxyRoute{}).Where("id = ?", route.ID).Update("origin_id", nil).Error; err != nil {
+		t.Fatalf("clear route origin_id: %v", err)
+	}
+
+	if err := backfillOriginsFromProxyRoutes(db); err != nil {
+		t.Fatalf("backfillOriginsFromProxyRoutes: %v", err)
+	}
+
+	if !db.Migrator().HasTable(&Origin{}) {
+		t.Fatal("expected origins table to exist")
+	}
+	if !db.Migrator().HasColumn(&ProxyRoute{}, "origin_id") {
+		t.Fatal("expected proxy_routes.origin_id column to exist")
+	}
+
+	reloadedRoute := &ProxyRoute{}
+	if err := db.First(reloadedRoute, route.ID).Error; err != nil {
+		t.Fatalf("query proxy route: %v", err)
+	}
+	if reloadedRoute.OriginID == nil || *reloadedRoute.OriginID == 0 {
+		t.Fatal("expected migrated route to be linked to a backfilled origin")
+	}
+
+	origin := &Origin{}
+	if err := db.First(origin, *reloadedRoute.OriginID).Error; err != nil {
+		t.Fatalf("query origin: %v", err)
+	}
+	if origin.Address != "origin-a.internal" {
+		t.Fatalf("unexpected backfilled origin address: %s", origin.Address)
+	}
+}
+
+func TestEnsureDatabaseSchemaUpToDateBackfillsProxyRouteSiteFields(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "legacy-proxy-route-sites.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+	if err := autoMigrateSchemaMetadata(db); err != nil {
+		t.Fatalf("auto migrate schema metadata: %v", err)
+	}
+
+	for _, item := range registeredModels() {
+		if _, ok := item.(*ProxyRoute); ok {
+			continue
+		}
+		if err := db.AutoMigrate(item); err != nil {
+			t.Fatalf("auto migrate supporting table: %v", err)
+		}
+	}
+	if err := db.AutoMigrate(&legacyProxyRouteV4{}); err != nil {
+		t.Fatalf("auto migrate legacy proxy_routes: %v", err)
+	}
+
+	now := time.Now().UTC()
+	if err := db.Create(&legacyProxyRouteV4{
+		Domain:        "app.example.com",
+		OriginURL:     "https://origin-a.internal:8443",
+		Upstreams:     `["https://origin-a.internal:8443","https://origin-b.internal:8443"]`,
+		Enabled:       true,
+		EnableHTTPS:   false,
+		RedirectHTTP:  false,
+		CacheEnabled:  false,
+		CachePolicy:   "",
+		CacheRules:    `[]`,
+		CustomHeaders: `[]`,
+		CreatedAt:     now,
+		UpdatedAt:     now,
+	}).Error; err != nil {
+		t.Fatalf("seed legacy proxy route: %v", err)
+	}
+	if err := saveDatabaseSchemaVersion(db, 4); err != nil {
+		t.Fatalf("save schema version: %v", err)
+	}
+
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+	})
+
+	if err := ensureDatabaseSchemaUpToDate(db, "sqlite"); err != nil {
+		t.Fatalf("ensureDatabaseSchemaUpToDate: %v", err)
+	}
+
+	var route ProxyRoute
+	if err := db.First(&route).Error; err != nil {
+		t.Fatalf("query migrated proxy route: %v", err)
+	}
+	if route.SiteName != "app.example.com" {
+		t.Fatalf("unexpected site_name after migration: %s", route.SiteName)
+	}
+	if route.Domain != "app.example.com" {
+		t.Fatalf("unexpected domain mirror after migration: %s", route.Domain)
+	}
+
+	var domains []string
+	if err := json.Unmarshal([]byte(route.Domains), &domains); err != nil {
+		t.Fatalf("decode migrated domains: %v", err)
+	}
+	if len(domains) != 1 || domains[0] != "app.example.com" {
+		t.Fatalf("unexpected migrated domains: %#v", domains)
+	}
+}
+
+func TestEnsureDatabaseSchemaUpToDateAddsProxyRouteRateLimitFields(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "legacy-proxy-route-rate-limits.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+	if err := autoMigrateSchemaMetadata(db); err != nil {
+		t.Fatalf("auto migrate schema metadata: %v", err)
+	}
+
+	for _, item := range registeredModels() {
+		if _, ok := item.(*ProxyRoute); ok {
+			continue
+		}
+		if err := db.AutoMigrate(item); err != nil {
+			t.Fatalf("auto migrate supporting table: %v", err)
+		}
+	}
+	if err := db.AutoMigrate(&legacyProxyRouteV5{}); err != nil {
+		t.Fatalf("auto migrate legacy proxy_routes v5: %v", err)
+	}
+
+	now := time.Now().UTC()
+	if err := db.Create(&legacyProxyRouteV5{
+		SiteName:      "main-site",
+		Domain:        "app.example.com",
+		Domains:       `["app.example.com","www.example.com"]`,
+		OriginURL:     "https://origin-a.internal:8443",
+		Upstreams:     `["https://origin-a.internal:8443"]`,
+		Enabled:       true,
+		EnableHTTPS:   false,
+		RedirectHTTP:  false,
+		CacheEnabled:  false,
+		CachePolicy:   "",
+		CacheRules:    `[]`,
+		CustomHeaders: `[]`,
+		CreatedAt:     now,
+		UpdatedAt:     now,
+	}).Error; err != nil {
+		t.Fatalf("seed legacy proxy route v5: %v", err)
+	}
+	if err := saveDatabaseSchemaVersion(db, 5); err != nil {
+		t.Fatalf("save schema version: %v", err)
+	}
+
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+	})
+
+	if err := ensureDatabaseSchemaUpToDate(db, "sqlite"); err != nil {
+		t.Fatalf("ensureDatabaseSchemaUpToDate: %v", err)
+	}
+
+	var route ProxyRoute
+	if err := db.First(&route).Error; err != nil {
+		t.Fatalf("query migrated proxy route: %v", err)
+	}
+	if route.LimitConnPerServer != 0 || route.LimitConnPerIP != 0 || route.LimitRate != "" {
+		t.Fatalf("expected new rate limit fields to default to disabled values, got %+v", route)
+	}
+}
+
+func TestEnsureDatabaseSchemaUpToDateAddsProxyRouteCertificateListFields(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "legacy-proxy-route-cert-ids.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+	if err := autoMigrateSchemaMetadata(db); err != nil {
+		t.Fatalf("auto migrate schema metadata: %v", err)
+	}
+
+	for _, item := range registeredModels() {
+		if _, ok := item.(*ProxyRoute); ok {
+			continue
+		}
+		if err := db.AutoMigrate(item); err != nil {
+			t.Fatalf("auto migrate supporting table: %v", err)
+		}
+	}
+	if err := db.AutoMigrate(&legacyProxyRouteV6{}); err != nil {
+		t.Fatalf("auto migrate legacy proxy_routes v6: %v", err)
+	}
+
+	now := time.Now().UTC()
+	certID := uint(9)
+	if err := db.Create(&legacyProxyRouteV6{
+		SiteName:           "secure-site",
+		Domain:             "secure.example.com",
+		Domains:            `["secure.example.com","www.secure.example.com"]`,
+		OriginURL:          "https://origin-secure.internal:8443",
+		Upstreams:          `["https://origin-secure.internal:8443"]`,
+		Enabled:            true,
+		EnableHTTPS:        true,
+		CertID:             &certID,
+		RedirectHTTP:       true,
+		LimitConnPerServer: 120,
+		LimitConnPerIP:     12,
+		LimitRate:          "512k",
+		CacheEnabled:       false,
+		CachePolicy:        "",
+		CacheRules:         `[]`,
+		CustomHeaders:      `[]`,
+		CreatedAt:          now,
+		UpdatedAt:          now,
+	}).Error; err != nil {
+		t.Fatalf("seed legacy proxy route v6: %v", err)
+	}
+	if err := saveDatabaseSchemaVersion(db, 6); err != nil {
+		t.Fatalf("save schema version: %v", err)
+	}
+
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+	})
+
+	if err := ensureDatabaseSchemaUpToDate(db, "sqlite"); err != nil {
+		t.Fatalf("ensureDatabaseSchemaUpToDate: %v", err)
+	}
+
+	var route ProxyRoute
+	if err := db.First(&route).Error; err != nil {
+		t.Fatalf("query migrated proxy route: %v", err)
+	}
+	if route.CertID == nil || *route.CertID != certID {
+		t.Fatalf("expected cert_id mirror to be preserved, got %+v", route.CertID)
+	}
+
+	var certIDs []uint
+	if err := json.Unmarshal([]byte(route.CertIDs), &certIDs); err != nil {
+		t.Fatalf("decode migrated cert_ids: %v", err)
+	}
+	if len(certIDs) != 1 || certIDs[0] != certID {
+		t.Fatalf("unexpected migrated cert_ids: %#v", certIDs)
+	}
+}
+
+func TestEnsureDatabaseSchemaUpToDateAddsProxyRouteDomainCertificateFields(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "legacy-proxy-route-domain-cert-ids.db")
+	if err := registerSharding(db, "sqlite"); err != nil {
+		t.Fatalf("register sharding: %v", err)
+	}
+	if err := autoMigrateSchemaMetadata(db); err != nil {
+		t.Fatalf("auto migrate schema metadata: %v", err)
+	}
+
+	for _, item := range registeredModels() {
+		if _, ok := item.(*ProxyRoute); ok {
+			continue
+		}
+		if err := db.AutoMigrate(item); err != nil {
+			t.Fatalf("auto migrate supporting table: %v", err)
+		}
+	}
+	if err := db.AutoMigrate(&legacyProxyRouteV7{}); err != nil {
+		t.Fatalf("auto migrate legacy proxy_routes v7: %v", err)
+	}
+
+	now := time.Now().UTC()
+	certID := uint(9)
+	if err := db.Create(&legacyProxyRouteV7{
+		SiteName:           "secure-site",
+		Domain:             "secure.example.com",
+		Domains:            `["secure.example.com","www.secure.example.com"]`,
+		OriginURL:          "https://origin-secure.internal:8443",
+		Upstreams:          `["https://origin-secure.internal:8443"]`,
+		Enabled:            true,
+		EnableHTTPS:        true,
+		CertID:             &certID,
+		CertIDs:            `[9]`,
+		RedirectHTTP:       true,
+		LimitConnPerServer: 120,
+		LimitConnPerIP:     12,
+		LimitRate:          "512k",
+		CacheEnabled:       false,
+		CachePolicy:        "",
+		CacheRules:         `[]`,
+		CustomHeaders:      `[]`,
+		CreatedAt:          now,
+		UpdatedAt:          now,
+	}).Error; err != nil {
+		t.Fatalf("seed legacy proxy route v7: %v", err)
+	}
+	if err := saveDatabaseSchemaVersion(db, 7); err != nil {
+		t.Fatalf("save schema version: %v", err)
+	}
+
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+	})
+
+	if err := ensureDatabaseSchemaUpToDate(db, "sqlite"); err != nil {
+		t.Fatalf("ensureDatabaseSchemaUpToDate: %v", err)
+	}
+
+	var route ProxyRoute
+	if err := db.First(&route).Error; err != nil {
+		t.Fatalf("query migrated proxy route: %v", err)
+	}
+
+	var domainCertIDs []uint
+	if err := json.Unmarshal([]byte(route.DomainCertIDs), &domainCertIDs); err != nil {
+		t.Fatalf("decode migrated domain_cert_ids: %v", err)
+	}
+	if len(domainCertIDs) != 2 || domainCertIDs[0] != certID || domainCertIDs[1] != certID {
+		t.Fatalf("unexpected migrated domain_cert_ids: %#v", domainCertIDs)
+	}
+}
+
+func TestRunDatabaseSchemaMigrationDoesNotAdvanceVersionWhenValidationFails(t *testing.T) {
+	db := openBareTestSQLiteDB(t, "failed-validation.db")
+
+	err := runDatabaseSchemaMigration(db, "sqlite", databaseSchemaMigration{
+		fromVersion: legacyDatabaseSchemaVersion,
+		toVersion:   currentDatabaseSchemaVersion,
+		migrate: func(tx *gorm.DB, backend string) error {
+			return autoMigrateSchemaMetadata(tx)
+		},
+		validate: func(tx *gorm.DB, backend string) error {
+			return gorm.ErrInvalidDB
+		},
+	})
+	if err == nil {
+		t.Fatal("expected migration validation to fail")
+	}
+
+	_, exists, loadErr := loadDatabaseSchemaVersion(db)
+	if loadErr != nil {
+		t.Fatalf("loadDatabaseSchemaVersion: %v", loadErr)
+	}
+	if exists {
+		t.Fatal("expected schema version to remain unset after failed validation")
+	}
+}

openflare_server/model/node_access_log.go

@@ -2,6 +2,7 @@ package model
 
 import (
 	"fmt"
+	"sort"
 	"strings"
 	"time"
 
@@ -10,14 +11,13 @@ import (
 
 type NodeAccessLog struct {
 	ID         uint      `json:"id" gorm:"primaryKey"`
-	NodeID     string    `json:"node_id" gorm:"index:idx_node_access_logs_node_logged_at,priority:1;size:64;not null"`
-	LoggedAt   time.Time `json:"logged_at" gorm:"index:idx_node_access_logs_logged_at;index:idx_node_access_logs_node_logged_at,priority:2"`
-	RemoteAddr string    `json:"remote_addr" gorm:"index:idx_node_access_logs_remote_addr;size:128"`
+	NodeID     string    `json:"node_id" gorm:"index:,composite:node_logged_at,priority:1;size:64;not null"`
+	LoggedAt   time.Time `json:"logged_at" gorm:"index;index:,composite:node_logged_at,priority:2"`
+	RemoteAddr string    `json:"remote_addr" gorm:"index;size:128"`
 	Region     string    `json:"region" gorm:"size:128"`
-	Host       string    `json:"host" gorm:"index:idx_node_access_logs_host;size:255"`
+	Host       string    `json:"host" gorm:"index;size:255"`
 	Path       string    `json:"path" gorm:"size:2048"`
-	StatusCode int       `json:"status_code" gorm:"index:idx_node_access_logs_status_code"`
-	RawJSON    string    `json:"raw_json" gorm:"type:text"`
+	StatusCode int       `json:"status_code" gorm:"index"`
 	CreatedAt  time.Time `json:"created_at"`
 }
 
@@ -92,85 +92,92 @@ type NodeAccessLogTrendPointRow struct {
 	RequestCount int64 `json:"request_count"`
 }
 
+func (log *NodeAccessLog) BeforeCreate(tx *gorm.DB) error {
+	return assignObservabilityID(&log.ID)
+}
+
 func ListNodeAccessLogs(query NodeAccessLogQuery) (logs []*NodeAccessLog, err error) {
-	offset := query.Page * query.PageSize
-	db := buildNodeAccessLogQuery(DB, query).
-		Order(buildNodeAccessLogSortClause(query.SortBy, query.SortOrder)).
-		Limit(query.PageSize).
-		Offset(offset)
-	err = db.Find(&logs).Error
-	return logs, err
+	all, err := listNodeAccessLogsAcrossShards(query)
+	if err != nil {
+		return nil, err
+	}
+	start, end := paginateBounds(len(all), query.Page, query.PageSize)
+	if start >= len(all) {
+		return []*NodeAccessLog{}, nil
+	}
+	return all[start:end], nil
 }
 
 func CountNodeAccessLogs(query NodeAccessLogQuery) (totalRecords int64, totalIPs int64, err error) {
-	base := buildNodeAccessLogQuery(DB.Model(&NodeAccessLog{}), query)
-	if err = base.Count(&totalRecords).Error; err != nil {
+	all, err := listNodeAccessLogsAcrossShards(query)
+	if err != nil {
 		return 0, 0, err
 	}
-	distinctQuery := buildNodeAccessLogQuery(DB.Model(&NodeAccessLog{}), query).
-		Where("remote_addr <> ''").
-		Distinct("remote_addr")
-	if err = distinctQuery.Count(&totalIPs).Error; err != nil {
-		return 0, 0, err
+	ips := make(map[string]struct{}, len(all))
+	for _, item := range all {
+		if item == nil {
+			continue
+		}
+		trimmed := strings.TrimSpace(item.RemoteAddr)
+		if trimmed != "" {
+			ips[trimmed] = struct{}{}
+		}
 	}
-	return totalRecords, totalIPs, nil
+	return int64(len(all)), int64(len(ips)), nil
 }
 
 func ListNodeAccessLogRegionCounts(nodeID string, since time.Time, limit int) (items []*NodeAccessLogRegionCount, err error) {
-	query := DB.Model(&NodeAccessLog{}).
-		Select("region as region, count(*) as count").
-		Where("region <> ''")
-	if nodeID != "" {
-		query = query.Where("node_id = ?", nodeID)
+	logs, err := listNodeAccessLogsAcrossShards(NodeAccessLogQuery{
+		NodeID: nodeID,
+		Since:  since,
+	})
+	if err != nil {
+		return nil, err
 	}
-	if !since.IsZero() {
-		query = query.Where("logged_at >= ?", since)
+	counts := make(map[string]int64)
+	for _, item := range logs {
+		if item == nil {
+			continue
+		}
+		region := strings.TrimSpace(item.Region)
+		if region == "" {
+			continue
+		}
+		counts[region]++
 	}
-	query = query.Group("region").Order("count desc, region asc")
-	if limit > 0 {
-		query = query.Limit(limit)
+	items = make([]*NodeAccessLogRegionCount, 0, len(counts))
+	for region, count := range counts {
+		items = append(items, &NodeAccessLogRegionCount{
+			Region: region,
+			Count:  count,
+		})
 	}
-	err = query.Scan(&items).Error
-	return items, err
+	sort.Slice(items, func(i int, j int) bool {
+		if items[i].Count == items[j].Count {
+			return items[i].Region < items[j].Region
+		}
+		return items[i].Count > items[j].Count
+	})
+	if limit > 0 && len(items) > limit {
+		items = items[:limit]
+	}
+	return items, nil
 }
 
 func ListNodeAccessLogBuckets(query NodeAccessLogBucketQuery) (items []*NodeAccessLogBucketRow, err error) {
-	offset := query.Page * query.PageSize
-	bucketExpr := accessLogBucketEpochExpr(query.FoldMinutes)
-	base := buildNodeAccessLogQuery(DB.Model(&NodeAccessLog{}), NodeAccessLogQuery{
-		NodeID:     query.NodeID,
-		RemoteAddr: query.RemoteAddr,
-		Host:       query.Host,
-		Path:       query.Path,
-		Since:      query.Since,
-	})
-	err = base.Select(fmt.Sprintf(
-		"%s as bucket_epoch, count(*) as request_count, count(distinct remote_addr) as unique_ip_count, count(distinct host) as unique_host_count, sum(case when status_code < 400 then 1 else 0 end) as success_count, sum(case when status_code >= 400 and status_code < 500 then 1 else 0 end) as client_error_count, sum(case when status_code >= 500 then 1 else 0 end) as server_error_count",
-		bucketExpr,
-	)).
-		Group(bucketExpr).
-		Order(buildNodeAccessLogBucketSortClause(query.SortBy, query.SortOrder)).
-		Limit(query.PageSize).
-		Offset(offset).
-		Scan(&items).Error
-	return items, err
+	rows, err := buildNodeAccessLogBucketRows(query)
+	if err != nil {
+		return nil, err
+	}
+	start, end := paginateBounds(len(rows), query.Page, query.PageSize)
+	if start >= len(rows) {
+		return []*NodeAccessLogBucketRow{}, nil
+	}
+	return rows[start:end], nil
 }
 
 func CountNodeAccessLogBuckets(query NodeAccessLogBucketQuery) (total int64, err error) {
-	bucketExpr := accessLogBucketEpochExpr(query.FoldMinutes)
-	base := buildNodeAccessLogQuery(DB.Model(&NodeAccessLog{}), NodeAccessLogQuery{
-		NodeID:     query.NodeID,
-		RemoteAddr: query.RemoteAddr,
-		Host:       query.Host,
-		Path:       query.Path,
-		Since:      query.Since,
-	})
-	rows := []struct {
-		BucketEpoch int64 `gorm:"column:bucket_epoch"`
-	}{}
-	err = base.Select(fmt.Sprintf("%s as bucket_epoch", bucketExpr)).
-		Group(bucketExpr).
-		Scan(&rows).Error
+	rows, err := buildNodeAccessLogBucketRows(query)
 	if err != nil {
 		return 0, err
 	}
@@ -178,39 +185,19 @@ func CountNodeAccessLogBuckets(query NodeAccessLogBucketQuery) (total int64, err
 }
 
 func ListNodeAccessLogIPSummaries(query NodeAccessLogIPSummaryQuery, recentSince time.Time) (items []*NodeAccessLogIPSummaryRow, err error) {
-	offset := query.Page * query.PageSize
-	base := buildNodeAccessLogQuery(DB.Model(&NodeAccessLog{}), NodeAccessLogQuery{
-		NodeID:     query.NodeID,
-		RemoteAddr: query.RemoteAddr,
-		Host:       query.Host,
-		Since:      query.Since,
-	}).Where("remote_addr <> ''")
-	lastSeenExpr := accessLogEpochExpr("max(logged_at)")
-	err = base.Select(
-		"remote_addr as remote_addr, count(*) as total_requests, sum(case when logged_at >= ? then 1 else 0 end) as recent_requests, "+lastSeenExpr+" as last_seen_epoch",
-		recentSince,
-	).
-		Group("remote_addr").
-		Order(buildNodeAccessLogIPSummarySortClause(query.SortBy, query.SortOrder)).
-		Limit(query.PageSize).
-		Offset(offset).
-		Scan(&items).Error
-	return items, err
+	rows, err := buildNodeAccessLogIPSummaryRows(query, recentSince)
+	if err != nil {
+		return nil, err
+	}
+	start, end := paginateBounds(len(rows), query.Page, query.PageSize)
+	if start >= len(rows) {
+		return []*NodeAccessLogIPSummaryRow{}, nil
+	}
+	return rows[start:end], nil
 }
 
 func CountNodeAccessLogIPSummaries(query NodeAccessLogIPSummaryQuery) (total int64, err error) {
-	base := buildNodeAccessLogQuery(DB.Model(&NodeAccessLog{}), NodeAccessLogQuery{
-		NodeID:     query.NodeID,
-		RemoteAddr: query.RemoteAddr,
-		Host:       query.Host,
-		Since:      query.Since,
-	}).Where("remote_addr <> ''")
-	rows := []struct {
-		RemoteAddr string `gorm:"column:remote_addr"`
-	}{}
-	err = base.Select("remote_addr").
-		Group("remote_addr").
-		Scan(&rows).Error
+	rows, err := buildNodeAccessLogIPSummaryRows(query, time.Time{})
 	if err != nil {
 		return 0, err
 	}
@@ -218,23 +205,82 @@ func CountNodeAccessLogIPSummaries(query NodeAccessLogIPSummaryQuery) (total int
 }
 
 func ListNodeAccessLogIPTrend(query NodeAccessLogIPTrendQuery) (items []*NodeAccessLogTrendPointRow, err error) {
-	bucketExpr := accessLogBucketEpochExpr(query.BucketMinutes)
-	base := buildNodeAccessLogQuery(DB.Model(&NodeAccessLog{}), NodeAccessLogQuery{
+	logs, err := listNodeAccessLogsAcrossShards(NodeAccessLogQuery{
 		NodeID:     query.NodeID,
 		RemoteAddr: query.RemoteAddr,
 		Host:       query.Host,
 		Since:      query.Since,
-	}).Where("remote_addr = ?", strings.TrimSpace(query.RemoteAddr))
-	err = base.Select(fmt.Sprintf("%s as bucket_epoch, count(*) as request_count", bucketExpr)).
-		Group(bucketExpr).
-		Order("bucket_epoch asc").
-		Scan(&items).Error
-	return items, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	remoteAddr := strings.TrimSpace(query.RemoteAddr)
+	if remoteAddr == "" {
+		return []*NodeAccessLogTrendPointRow{}, nil
+	}
+	buckets := make(map[int64]int64)
+	for _, item := range logs {
+		if item == nil || strings.TrimSpace(item.RemoteAddr) != remoteAddr {
+			continue
+		}
+		bucketEpoch := bucketEpochForTime(item.LoggedAt, query.BucketMinutes)
+		buckets[bucketEpoch]++
+	}
+	items = make([]*NodeAccessLogTrendPointRow, 0, len(buckets))
+	for bucketEpoch, requestCount := range buckets {
+		items = append(items, &NodeAccessLogTrendPointRow{
+			BucketEpoch:  bucketEpoch,
+			RequestCount: requestCount,
+		})
+	}
+	sort.Slice(items, func(i int, j int) bool {
+		return items[i].BucketEpoch < items[j].BucketEpoch
+	})
+	return items, nil
 }
 
 func DeleteNodeAccessLogsBefore(before time.Time) (deleted int64, err error) {
-	result := DB.Where("logged_at < ?", before).Delete(&NodeAccessLog{})
-	return result.RowsAffected, result.Error
+	return deleteAcrossShards(DB, "node_access_logs", &NodeAccessLog{}, func(tx *gorm.DB) *gorm.DB {
+		return tx.Where("logged_at < ?", before)
+	})
+}
+
+func DeleteAllNodeAccessLogs(db *gorm.DB) (deleted int64, err error) {
+	return deleteAcrossShards(db, "node_access_logs", &NodeAccessLog{}, nil)
+}
+
+func NodeAccessLogExists(db *gorm.DB, record *NodeAccessLog) (bool, error) {
+	if record == nil {
+		return false, nil
+	}
+	db = normalizeShardedDB(db)
+	for _, table := range observabilityShardTables("node_access_logs") {
+		var count int64
+		if err := db.Table(table).
+			Where(
+				"node_id = ? AND logged_at = ? AND remote_addr = ? AND host = ? AND path = ? AND status_code = ?",
+				record.NodeID,
+				record.LoggedAt,
+				record.RemoteAddr,
+				record.Host,
+				record.Path,
+				record.StatusCode,
+			).
+			Limit(1).
+			Count(&count).Error; err != nil {
+			return false, err
+		}
+		if count > 0 {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func DeleteNodeAccessLogsByNodeBefore(db *gorm.DB, nodeID string, before time.Time) (deleted int64, err error) {
+	return deleteAcrossShards(db, "node_access_logs", &NodeAccessLog{}, func(tx *gorm.DB) *gorm.DB {
+		return tx.Where("node_id = ? AND logged_at < ?", nodeID, before)
+	})
 }
 
 func buildNodeAccessLogQuery(db *gorm.DB, query NodeAccessLogQuery) *gorm.DB {
@@ -244,6 +290,10 @@ func buildNodeAccessLogQuery(db *gorm.DB, query NodeAccessLogQuery) *gorm.DB {
 	if db.Statement == nil || db.Statement.Model == nil {
 		db = db.Model(&NodeAccessLog{})
 	}
+	return applyNodeAccessLogFilters(db, query)
+}
+
+func applyNodeAccessLogFilters(db *gorm.DB, query NodeAccessLogQuery) *gorm.DB {
 	if trimmed := strings.TrimSpace(query.NodeID); trimmed != "" {
 		db = db.Where("node_id LIKE ?", "%"+trimmed+"%")
 	}
@@ -262,6 +312,297 @@ func buildNodeAccessLogQuery(db *gorm.DB, query NodeAccessLogQuery) *gorm.DB {
 	return db
 }
 
+func listNodeAccessLogsAcrossShards(query NodeAccessLogQuery) ([]*NodeAccessLog, error) {
+	items, err := queryAcrossShards("node_access_logs", func(tx *gorm.DB) ([]*NodeAccessLog, error) {
+		var shardRows []*NodeAccessLog
+		if err := applyNodeAccessLogFilters(tx, query).Find(&shardRows).Error; err != nil {
+			return nil, err
+		}
+		return shardRows, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	sortNodeAccessLogs(items, query.SortBy, query.SortOrder)
+	return items, nil
+}
+
+func buildNodeAccessLogBucketRows(query NodeAccessLogBucketQuery) ([]*NodeAccessLogBucketRow, error) {
+	logs, err := listNodeAccessLogsAcrossShards(NodeAccessLogQuery{
+		NodeID:     query.NodeID,
+		RemoteAddr: query.RemoteAddr,
+		Host:       query.Host,
+		Path:       query.Path,
+		Since:      query.Since,
+	})
+	if err != nil {
+		return nil, err
+	}
+	type bucketAccumulator struct {
+		requestCount     int64
+		uniqueIPs        map[string]struct{}
+		uniqueHosts      map[string]struct{}
+		successCount     int64
+		clientErrorCount int64
+		serverErrorCount int64
+	}
+	accumulators := make(map[int64]*bucketAccumulator)
+	for _, item := range logs {
+		if item == nil {
+			continue
+		}
+		bucketEpoch := bucketEpochForTime(item.LoggedAt, query.FoldMinutes)
+		accumulator := accumulators[bucketEpoch]
+		if accumulator == nil {
+			accumulator = &bucketAccumulator{
+				uniqueIPs:   make(map[string]struct{}),
+				uniqueHosts: make(map[string]struct{}),
+			}
+			accumulators[bucketEpoch] = accumulator
+		}
+		accumulator.requestCount++
+		if trimmed := strings.TrimSpace(item.RemoteAddr); trimmed != "" {
+			accumulator.uniqueIPs[trimmed] = struct{}{}
+		}
+		if trimmed := strings.TrimSpace(item.Host); trimmed != "" {
+			accumulator.uniqueHosts[trimmed] = struct{}{}
+		}
+		switch {
+		case item.StatusCode < 400:
+			accumulator.successCount++
+		case item.StatusCode < 500:
+			accumulator.clientErrorCount++
+		default:
+			accumulator.serverErrorCount++
+		}
+	}
+	rows := make([]*NodeAccessLogBucketRow, 0, len(accumulators))
+	for bucketEpoch, accumulator := range accumulators {
+		rows = append(rows, &NodeAccessLogBucketRow{
+			BucketEpoch:      bucketEpoch,
+			RequestCount:     accumulator.requestCount,
+			UniqueIPCount:    int64(len(accumulator.uniqueIPs)),
+			UniqueHostCount:  int64(len(accumulator.uniqueHosts)),
+			SuccessCount:     accumulator.successCount,
+			ClientErrorCount: accumulator.clientErrorCount,
+			ServerErrorCount: accumulator.serverErrorCount,
+		})
+	}
+	sortNodeAccessLogBucketRows(rows, query.SortBy, query.SortOrder)
+	return rows, nil
+}
+
+func buildNodeAccessLogIPSummaryRows(query NodeAccessLogIPSummaryQuery, recentSince time.Time) ([]*NodeAccessLogIPSummaryRow, error) {
+	logs, err := listNodeAccessLogsAcrossShards(NodeAccessLogQuery{
+		NodeID:     query.NodeID,
+		RemoteAddr: query.RemoteAddr,
+		Host:       query.Host,
+		Since:      query.Since,
+	})
+	if err != nil {
+		return nil, err
+	}
+	type accumulator struct {
+		totalRequests  int64
+		recentRequests int64
+		lastSeenAt     time.Time
+	}
+	accumulators := make(map[string]*accumulator)
+	for _, item := range logs {
+		if item == nil {
+			continue
+		}
+		remoteAddr := strings.TrimSpace(item.RemoteAddr)
+		if remoteAddr == "" {
+			continue
+		}
+		acc := accumulators[remoteAddr]
+		if acc == nil {
+			acc = &accumulator{}
+			accumulators[remoteAddr] = acc
+		}
+		acc.totalRequests++
+		if !recentSince.IsZero() && !item.LoggedAt.Before(recentSince) {
+			acc.recentRequests++
+		}
+		if item.LoggedAt.After(acc.lastSeenAt) {
+			acc.lastSeenAt = item.LoggedAt
+		}
+	}
+	rows := make([]*NodeAccessLogIPSummaryRow, 0, len(accumulators))
+	for remoteAddr, acc := range accumulators {
+		rows = append(rows, &NodeAccessLogIPSummaryRow{
+			RemoteAddr:     remoteAddr,
+			TotalRequests:  acc.totalRequests,
+			RecentRequests: acc.recentRequests,
+			LastSeenEpoch:  acc.lastSeenAt.Unix(),
+		})
+	}
+	sortNodeAccessLogIPSummaryRows(rows, query.SortBy, query.SortOrder)
+	return rows, nil
+}
+
+func sortNodeAccessLogs(items []*NodeAccessLog, sortBy string, sortOrder string) {
+	desc := normalizeSortOrder(sortOrder) != "asc"
+	sort.Slice(items, func(i int, j int) bool {
+		left := items[i]
+		right := items[j]
+		if left == nil || right == nil {
+			return left != nil
+		}
+		var compare int
+		switch strings.TrimSpace(sortBy) {
+		case "status_code":
+			compare = compareInt(left.StatusCode, right.StatusCode)
+		case "remote_addr":
+			compare = strings.Compare(left.RemoteAddr, right.RemoteAddr)
+		case "host":
+			compare = strings.Compare(left.Host, right.Host)
+		case "path":
+			compare = strings.Compare(left.Path, right.Path)
+		default:
+			compare = compareTime(left.LoggedAt, right.LoggedAt)
+		}
+		if compare == 0 {
+			compare = compareTime(left.LoggedAt, right.LoggedAt)
+		}
+		if compare == 0 {
+			compare = compareUint(left.ID, right.ID)
+		}
+		if desc {
+			return compare > 0
+		}
+		return compare < 0
+	})
+}
+
+func sortNodeAccessLogBucketRows(items []*NodeAccessLogBucketRow, sortBy string, sortOrder string) {
+	desc := normalizeSortOrder(sortOrder) != "asc"
+	sort.Slice(items, func(i int, j int) bool {
+		left := items[i]
+		right := items[j]
+		if left == nil || right == nil {
+			return left != nil
+		}
+		var compare int
+		switch strings.TrimSpace(sortBy) {
+		case "request_count":
+			compare = compareInt64(left.RequestCount, right.RequestCount)
+		default:
+			compare = compareInt64(left.BucketEpoch, right.BucketEpoch)
+		}
+		if compare == 0 {
+			compare = compareInt64(left.BucketEpoch, right.BucketEpoch)
+		}
+		if desc {
+			return compare > 0
+		}
+		return compare < 0
+	})
+}
+
+func sortNodeAccessLogIPSummaryRows(items []*NodeAccessLogIPSummaryRow, sortBy string, sortOrder string) {
+	desc := normalizeSortOrder(sortOrder) != "asc"
+	sort.Slice(items, func(i int, j int) bool {
+		left := items[i]
+		right := items[j]
+		if left == nil || right == nil {
+			return left != nil
+		}
+		var compare int
+		switch strings.TrimSpace(sortBy) {
+		case "recent_requests":
+			compare = compareInt64(left.RecentRequests, right.RecentRequests)
+		case "last_seen_at":
+			compare = compareInt64(left.LastSeenEpoch, right.LastSeenEpoch)
+		case "remote_addr":
+			compare = strings.Compare(left.RemoteAddr, right.RemoteAddr)
+		default:
+			compare = compareInt64(left.TotalRequests, right.TotalRequests)
+		}
+		if compare == 0 {
+			compare = compareInt64(left.LastSeenEpoch, right.LastSeenEpoch)
+		}
+		if compare == 0 {
+			compare = strings.Compare(left.RemoteAddr, right.RemoteAddr)
+		}
+		if desc {
+			return compare > 0
+		}
+		return compare < 0
+	})
+}
+
+func paginateBounds(total int, page int, pageSize int) (int, int) {
+	if page < 0 {
+		page = 0
+	}
+	if pageSize <= 0 {
+		return 0, total
+	}
+	start := page * pageSize
+	if start > total {
+		start = total
+	}
+	end := start + pageSize
+	if end > total {
+		end = total
+	}
+	return start, end
+}
+
+func bucketEpochForTime(value time.Time, bucketMinutes int) int64 {
+	bucketSeconds := int64(bucketMinutes * 60)
+	if bucketSeconds <= 0 {
+		bucketSeconds = 180
+	}
+	return (value.UTC().Unix() / bucketSeconds) * bucketSeconds
+}
+
+func compareTime(left time.Time, right time.Time) int {
+	switch {
+	case left.After(right):
+		return 1
+	case left.Before(right):
+		return -1
+	default:
+		return 0
+	}
+}
+
+func compareInt(left int, right int) int {
+	switch {
+	case left > right:
+		return 1
+	case left < right:
+		return -1
+	default:
+		return 0
+	}
+}
+
+func compareInt64(left int64, right int64) int {
+	switch {
+	case left > right:
+		return 1
+	case left < right:
+		return -1
+	default:
+		return 0
+	}
+}
+
+func compareUint(left uint, right uint) int {
+	switch {
+	case left > right:
+		return 1
+	case left < right:
+		return -1
+	default:
+		return 0
+	}
+}
+
 func buildNodeAccessLogSortClause(sortBy string, sortOrder string) string {
 	column := "logged_at"
 	switch strings.TrimSpace(sortBy) {

openflare_server/model/node_health_event.go

@@ -13,7 +13,7 @@ type NodeHealthEvent struct {
 	LastTriggeredAt  time.Time  `json:"last_triggered_at" gorm:"index"`
 	ReportedAt       time.Time  `json:"reported_at" gorm:"index"`
 	ResolvedAt       *time.Time `json:"resolved_at" gorm:"index"`
-	RawJSON          string     `json:"raw_json" gorm:"type:text"`
+	MetadataJSON     string     `json:"metadata_json" gorm:"type:text"`
 	CreatedAt        time.Time  `json:"created_at"`
 	UpdatedAt        time.Time  `json:"updated_at"`
 }

openflare_server/model/node_metric_snapshot.go

@@ -1,6 +1,11 @@
 package model
 
-import "time"
+import (
+	"sort"
+	"time"
+
+	"gorm.io/gorm"
+)
 
 type NodeMetricSnapshot struct {
 	ID                   uint      `json:"id" gorm:"primaryKey"`
@@ -18,31 +23,94 @@ type NodeMetricSnapshot struct {
 	OpenrestyRxBytes     int64     `json:"openresty_rx_bytes"`
 	OpenrestyTxBytes     int64     `json:"openresty_tx_bytes"`
 	OpenrestyConnections int64     `json:"openresty_connections"`
-	RawJSON              string    `json:"raw_json" gorm:"type:text"`
 	CreatedAt            time.Time `json:"created_at"`
 }
 
+func (snapshot *NodeMetricSnapshot) BeforeCreate(tx *gorm.DB) error {
+	return assignObservabilityID(&snapshot.ID)
+}
+
 func (snapshot *NodeMetricSnapshot) Insert() error {
 	return DB.Create(snapshot).Error
 }
 
 func ListNodeMetricSnapshots(nodeID string, since time.Time, limit int) (snapshots []*NodeMetricSnapshot, err error) {
-	query := DB.Where("node_id = ?", nodeID).Order("captured_at desc")
-	if !since.IsZero() {
-		query = query.Where("captured_at >= ?", since)
+	rows, err := queryAcrossShards("node_metric_snapshots", func(tx *gorm.DB) ([]*NodeMetricSnapshot, error) {
+		var shardRows []*NodeMetricSnapshot
+		query := tx.Order("captured_at desc, id desc")
+		if nodeID != "" {
+			query = query.Where("node_id = ?", nodeID)
+		}
+		if !since.IsZero() {
+			query = query.Where("captured_at >= ?", since)
+		}
+		if err := query.Find(&shardRows).Error; err != nil {
+			return nil, err
+		}
+		return shardRows, nil
+	})
+	if err != nil {
+		return nil, err
 	}
-	if limit > 0 {
-		query = query.Limit(limit)
+	sort.Slice(rows, func(i int, j int) bool {
+		if rows[i].CapturedAt.Equal(rows[j].CapturedAt) {
+			return rows[i].ID > rows[j].ID
+		}
+		return rows[i].CapturedAt.After(rows[j].CapturedAt)
+	})
+	if limit > 0 && len(rows) > limit {
+		rows = rows[:limit]
 	}
-	err = query.Find(&snapshots).Error
-	return snapshots, err
+	return rows, nil
 }
 
 func ListMetricSnapshotsSince(since time.Time) (snapshots []*NodeMetricSnapshot, err error) {
-	query := DB.Order("captured_at desc")
-	if !since.IsZero() {
-		query = query.Where("captured_at >= ?", since)
+	rows, err := queryAcrossShards("node_metric_snapshots", func(tx *gorm.DB) ([]*NodeMetricSnapshot, error) {
+		var shardRows []*NodeMetricSnapshot
+		query := tx.Order("captured_at desc")
+		if !since.IsZero() {
+			query = query.Where("captured_at >= ?", since)
+		}
+		if err := query.Find(&shardRows).Error; err != nil {
+			return nil, err
+		}
+		return shardRows, nil
+	})
+	if err != nil {
+		return nil, err
 	}
-	err = query.Find(&snapshots).Error
-	return snapshots, err
+	sort.Slice(rows, func(i int, j int) bool {
+		if rows[i].CapturedAt.Equal(rows[j].CapturedAt) {
+			return rows[i].ID > rows[j].ID
+		}
+		return rows[i].CapturedAt.After(rows[j].CapturedAt)
+	})
+	return rows, nil
+}
+
+func NodeMetricSnapshotExists(db *gorm.DB, nodeID string, capturedAt time.Time) (bool, error) {
+	db = normalizeShardedDB(db)
+	for _, table := range observabilityShardTables("node_metric_snapshots") {
+		var count int64
+		if err := db.Table(table).
+			Where("node_id = ? AND captured_at = ?", nodeID, capturedAt).
+			Limit(1).
+			Count(&count).Error; err != nil {
+			return false, err
+		}
+		if count > 0 {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func DeleteNodeMetricSnapshotsBefore(db *gorm.DB, before time.Time) (int64, error) {
+	return deleteAcrossShards(db, "node_metric_snapshots", &NodeMetricSnapshot{}, func(tx *gorm.DB) *gorm.DB {
+		return tx.Where("captured_at < ?", before)
+	})
+}
+
+func DeleteAllNodeMetricSnapshots(db *gorm.DB) (int64, error) {
+	return deleteAcrossShards(db, "node_metric_snapshots", &NodeMetricSnapshot{}, nil)
 }

openflare_server/model/node_request_report.go

@@ -1,6 +1,11 @@
 package model
 
-import "time"
+import (
+	"sort"
+	"time"
+
+	"gorm.io/gorm"
+)
 
 type NodeRequestReport struct {
 	ID                  uint      `json:"id" gorm:"primaryKey"`
@@ -13,31 +18,94 @@ type NodeRequestReport struct {
 	StatusCodesJSON     string    `json:"status_codes_json" gorm:"type:text"`
 	TopDomainsJSON      string    `json:"top_domains_json" gorm:"type:text"`
 	SourceCountriesJSON string    `json:"source_countries_json" gorm:"type:text"`
-	RawJSON             string    `json:"raw_json" gorm:"type:text"`
 	CreatedAt           time.Time `json:"created_at"`
 }
 
+func (report *NodeRequestReport) BeforeCreate(tx *gorm.DB) error {
+	return assignObservabilityID(&report.ID)
+}
+
 func (report *NodeRequestReport) Insert() error {
 	return DB.Create(report).Error
 }
 
 func ListNodeRequestReports(nodeID string, since time.Time, limit int) (reports []*NodeRequestReport, err error) {
-	query := DB.Where("node_id = ?", nodeID).Order("window_ended_at desc")
-	if !since.IsZero() {
-		query = query.Where("window_ended_at >= ?", since)
+	rows, err := queryAcrossShards("node_request_reports", func(tx *gorm.DB) ([]*NodeRequestReport, error) {
+		var shardRows []*NodeRequestReport
+		query := tx.Order("window_ended_at desc, id desc")
+		if nodeID != "" {
+			query = query.Where("node_id = ?", nodeID)
+		}
+		if !since.IsZero() {
+			query = query.Where("window_ended_at >= ?", since)
+		}
+		if err := query.Find(&shardRows).Error; err != nil {
+			return nil, err
+		}
+		return shardRows, nil
+	})
+	if err != nil {
+		return nil, err
 	}
-	if limit > 0 {
-		query = query.Limit(limit)
+	sort.Slice(rows, func(i int, j int) bool {
+		if rows[i].WindowEndedAt.Equal(rows[j].WindowEndedAt) {
+			return rows[i].ID > rows[j].ID
+		}
+		return rows[i].WindowEndedAt.After(rows[j].WindowEndedAt)
+	})
+	if limit > 0 && len(rows) > limit {
+		rows = rows[:limit]
 	}
-	err = query.Find(&reports).Error
-	return reports, err
+	return rows, nil
 }
 
 func ListRequestReportsSince(since time.Time) (reports []*NodeRequestReport, err error) {
-	query := DB.Order("window_ended_at desc")
-	if !since.IsZero() {
-		query = query.Where("window_ended_at >= ?", since)
+	rows, err := queryAcrossShards("node_request_reports", func(tx *gorm.DB) ([]*NodeRequestReport, error) {
+		var shardRows []*NodeRequestReport
+		query := tx.Order("window_ended_at desc")
+		if !since.IsZero() {
+			query = query.Where("window_ended_at >= ?", since)
+		}
+		if err := query.Find(&shardRows).Error; err != nil {
+			return nil, err
+		}
+		return shardRows, nil
+	})
+	if err != nil {
+		return nil, err
 	}
-	err = query.Find(&reports).Error
-	return reports, err
+	sort.Slice(rows, func(i int, j int) bool {
+		if rows[i].WindowEndedAt.Equal(rows[j].WindowEndedAt) {
+			return rows[i].ID > rows[j].ID
+		}
+		return rows[i].WindowEndedAt.After(rows[j].WindowEndedAt)
+	})
+	return rows, nil
+}
+
+func NodeRequestReportExists(db *gorm.DB, nodeID string, windowStartedAt time.Time, windowEndedAt time.Time) (bool, error) {
+	db = normalizeShardedDB(db)
+	for _, table := range observabilityShardTables("node_request_reports") {
+		var count int64
+		if err := db.Table(table).
+			Where("node_id = ? AND window_started_at = ? AND window_ended_at = ?", nodeID, windowStartedAt, windowEndedAt).
+			Limit(1).
+			Count(&count).Error; err != nil {
+			return false, err
+		}
+		if count > 0 {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func DeleteNodeRequestReportsBefore(db *gorm.DB, before time.Time) (int64, error) {
+	return deleteAcrossShards(db, "node_request_reports", &NodeRequestReport{}, func(tx *gorm.DB) *gorm.DB {
+		return tx.Where("window_ended_at < ?", before)
+	})
+}
+
+func DeleteAllNodeRequestReports(db *gorm.DB) (int64, error) {
+	return deleteAcrossShards(db, "node_request_reports", &NodeRequestReport{}, nil)
 }

openflare_server/model/node_system_profile.go

@@ -20,7 +20,6 @@ type NodeSystemProfile struct {
 	TotalDiskBytes   int64     `json:"total_disk_bytes"`
 	UptimeSeconds    int64     `json:"uptime_seconds"`
 	ReportedAt       time.Time `json:"reported_at" gorm:"index"`
-	RawJSON          string    `json:"raw_json" gorm:"type:text"`
 	CreatedAt        time.Time `json:"created_at"`
 	UpdatedAt        time.Time `json:"updated_at"`
 }
@@ -49,7 +48,6 @@ func UpsertNodeSystemProfile(profile *NodeSystemProfile) error {
 			"total_disk_bytes",
 			"uptime_seconds",
 			"reported_at",
-			"raw_json",
 			"updated_at",
 		}),
 	}).Create(profile).Error

openflare_server/model/option.go

@@ -6,6 +6,8 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"gorm.io/gorm"
 )
 
 type Option struct {
@@ -56,6 +58,8 @@ func InitOptionMap() {
 	common.OptionMap["NodeOfflineThreshold"] = strconv.Itoa(int(common.NodeOfflineThreshold.Milliseconds()))
 	common.OptionMap["AgentUpdateRepo"] = common.AgentUpdateRepo
 	common.OptionMap["GeoIPProvider"] = common.GeoIPProvider
+	common.OptionMap["DatabaseAutoCleanupEnabled"] = strconv.FormatBool(common.DatabaseAutoCleanupEnabled)
+	common.OptionMap["DatabaseAutoCleanupRetentionDays"] = strconv.Itoa(common.DatabaseAutoCleanupRetentionDays)
 	common.OptionMap["OpenRestyWorkerProcesses"] = common.OpenRestyWorkerProcesses
 	common.OptionMap["OpenRestyWorkerConnections"] = strconv.Itoa(common.OpenRestyWorkerConnections)
 	common.OptionMap["OpenRestyWorkerRlimitNofile"] = strconv.Itoa(common.OpenRestyWorkerRlimitNofile)
@@ -108,19 +112,38 @@ func InitOptionMap() {
 }
 
 func UpdateOption(key string, value string) error {
-	// Save to database first
-	option := Option{
-		Key: key,
+	return UpdateOptions([]Option{{
+		Key:   key,
+		Value: value,
+	}})
+}
+
+func UpdateOptions(options []Option) error {
+	if len(options) == 0 {
+		return nil
+	}
+
+	if err := DB.Transaction(func(tx *gorm.DB) error {
+		for _, item := range options {
+			option := Option{
+				Key: item.Key,
+			}
+			if err := tx.FirstOrCreate(&option, Option{Key: item.Key}).Error; err != nil {
+				return err
+			}
+			option.Value = item.Value
+			if err := tx.Save(&option).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	for _, item := range options {
+		updateOptionMap(item.Key, item.Value)
 	}
-	// https://gorm.io/docs/update.html#Save-All-Fields
-	DB.FirstOrCreate(&option, Option{Key: key})
-	option.Value = value
-	// Save is a combination function.
-	// If save value does not contain primary key, it will execute Create,
-	// otherwise it will execute Update (with all fields).
-	DB.Save(&option)
-	// Update OptionMap
-	updateOptionMap(key, value)
 	return nil
 }
 
@@ -219,6 +242,12 @@ func updateOptionMap(key string, value string) {
 			common.GeoIPProvider = value
 			shouldRefreshGeoIP = true
 		}
+	case "DatabaseAutoCleanupEnabled":
+		common.DatabaseAutoCleanupEnabled = value == "true"
+	case "DatabaseAutoCleanupRetentionDays":
+		if v, err := strconv.Atoi(value); err == nil && v >= 1 {
+			common.DatabaseAutoCleanupRetentionDays = v
+		}
 	case "OpenRestyWorkerProcesses":
 		if strings.TrimSpace(value) != "" {
 			common.OpenRestyWorkerProcesses = value

openflare_server/model/option_test.go

@@ -0,0 +1,30 @@
+package model
+
+import (
+	"openflare/common"
+	"testing"
+)
+
+func TestInitOptionMapDefaultsRegisterDisabled(t *testing.T) {
+	previousRegisterEnabled := common.RegisterEnabled
+	previousOptionMap := common.OptionMap
+	previousDB := DB
+	t.Cleanup(func() {
+		common.RegisterEnabled = previousRegisterEnabled
+		common.OptionMap = previousOptionMap
+		DB = previousDB
+	})
+
+	DB = openTestSQLiteDB(t, "options-defaults.db")
+	common.RegisterEnabled = false
+	common.OptionMap = nil
+
+	InitOptionMap()
+
+	if got := common.OptionMap["RegisterEnabled"]; got != "false" {
+		t.Fatalf("expected RegisterEnabled default to be false, got %q", got)
+	}
+	if common.RegisterEnabled {
+		t.Fatal("expected RegisterEnabled to remain false after InitOptionMap")
+	}
+}

openflare_server/model/origin.go

@@ -0,0 +1,56 @@
+package model
+
+import "time"
+
+type Origin struct {
+	ID        uint      `json:"id" gorm:"primaryKey"`
+	Name      string    `json:"name" gorm:"size:255;not null"`
+	Address   string    `json:"address" gorm:"uniqueIndex;size:255;not null"`
+	Remark    string    `json:"remark" gorm:"size:255"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+type OriginRouteCount struct {
+	OriginID   uint  `json:"origin_id"`
+	RouteCount int64 `json:"route_count"`
+}
+
+func ListOrigins() (origins []*Origin, err error) {
+	err = DB.Order("id desc").Find(&origins).Error
+	return origins, err
+}
+
+func GetOriginByID(id uint) (*Origin, error) {
+	origin := &Origin{}
+	err := DB.First(origin, id).Error
+	return origin, err
+}
+
+func GetOriginByAddress(address string) (*Origin, error) {
+	origin := &Origin{}
+	err := DB.Where("address = ?", address).First(origin).Error
+	return origin, err
+}
+
+func ListOriginRouteCounts() ([]OriginRouteCount, error) {
+	result := make([]OriginRouteCount, 0)
+	err := DB.Model(&ProxyRoute{}).
+		Select("origin_id, COUNT(*) AS route_count").
+		Where("origin_id IS NOT NULL").
+		Group("origin_id").
+		Scan(&result).Error
+	return result, err
+}
+
+func (origin *Origin) Insert() error {
+	return DB.Create(origin).Error
+}
+
+func (origin *Origin) Update() error {
+	return DB.Save(origin).Error
+}
+
+func (origin *Origin) Delete() error {
+	return DB.Delete(origin).Error
+}

openflare_server/model/proxy_route.go

@@ -3,22 +3,30 @@ package model
 import "time"
 
 type ProxyRoute struct {
-	ID            uint      `json:"id" gorm:"primaryKey"`
-	Domain        string    `json:"domain" gorm:"uniqueIndex;size:255;not null"`
-	OriginURL     string    `json:"origin_url" gorm:"size:2048;not null"`
-	OriginHost    string    `json:"origin_host" gorm:"size:255"`
-	Upstreams     string    `json:"upstreams" gorm:"type:text;not null;default:'[]'"`
-	Enabled       bool      `json:"enabled" gorm:"not null;default:true"`
-	EnableHTTPS   bool      `json:"enable_https" gorm:"column:enable_https;not null;default:false"`
-	CertID        *uint     `json:"cert_id"`
-	RedirectHTTP  bool      `json:"redirect_http" gorm:"not null;default:false"`
-	CacheEnabled  bool      `json:"cache_enabled" gorm:"not null;default:false"`
-	CachePolicy   string    `json:"cache_policy" gorm:"size:32;not null;default:''"`
-	CacheRules    string    `json:"cache_rules" gorm:"type:text;not null;default:'[]'"`
-	CustomHeaders string    `json:"custom_headers" gorm:"type:text;not null;default:'[]'"`
-	Remark        string    `json:"remark" gorm:"size:255"`
-	CreatedAt     time.Time `json:"created_at"`
-	UpdatedAt     time.Time `json:"updated_at"`
+	ID                 uint      `json:"id" gorm:"primaryKey"`
+	SiteName           string    `json:"site_name" gorm:"size:255;not null;default:''"`
+	Domain             string    `json:"domain" gorm:"uniqueIndex;size:255;not null"`
+	Domains            string    `json:"domains" gorm:"type:text;not null;default:'[]'"`
+	OriginID           *uint     `json:"origin_id" gorm:"index"`
+	OriginURL          string    `json:"origin_url" gorm:"size:2048;not null"`
+	OriginHost         string    `json:"origin_host" gorm:"size:255"`
+	Upstreams          string    `json:"upstreams" gorm:"type:text;not null;default:'[]'"`
+	Enabled            bool      `json:"enabled" gorm:"not null;default:true"`
+	EnableHTTPS        bool      `json:"enable_https" gorm:"column:enable_https;not null;default:false"`
+	CertID             *uint     `json:"cert_id"`
+	CertIDs            string    `json:"cert_ids" gorm:"type:text;not null;default:'[]'"`
+	DomainCertIDs      string    `json:"domain_cert_ids" gorm:"type:text;not null;default:'[]'"`
+	RedirectHTTP       bool      `json:"redirect_http" gorm:"not null;default:false"`
+	LimitConnPerServer int       `json:"limit_conn_per_server" gorm:"not null;default:0"`
+	LimitConnPerIP     int       `json:"limit_conn_per_ip" gorm:"not null;default:0"`
+	LimitRate          string    `json:"limit_rate" gorm:"size:32;not null;default:''"`
+	CacheEnabled       bool      `json:"cache_enabled" gorm:"not null;default:false"`
+	CachePolicy        string    `json:"cache_policy" gorm:"size:32;not null;default:''"`
+	CacheRules         string    `json:"cache_rules" gorm:"type:text;not null;default:'[]'"`
+	CustomHeaders      string    `json:"custom_headers" gorm:"type:text;not null;default:'[]'"`
+	Remark             string    `json:"remark" gorm:"size:255"`
+	CreatedAt          time.Time `json:"created_at"`
+	UpdatedAt          time.Time `json:"updated_at"`
 }
 
 func ListProxyRoutes() (routes []*ProxyRoute, err error) {
@@ -27,7 +35,7 @@ func ListProxyRoutes() (routes []*ProxyRoute, err error) {
 }
 
 func GetEnabledProxyRoutes() (routes []*ProxyRoute, err error) {
-	err = DB.Where("enabled = ?", true).Order("domain asc").Find(&routes).Error
+	err = DB.Where("enabled = ?", true).Order("site_name asc").Order("domain asc").Find(&routes).Error
 	return routes, err
 }
 
@@ -37,25 +45,38 @@ func GetProxyRouteByID(id uint) (*ProxyRoute, error) {
 	return route, err
 }
 
+func ListProxyRoutesByOriginID(originID uint) (routes []*ProxyRoute, err error) {
+	err = DB.Where("origin_id = ?", originID).Order("id desc").Find(&routes).Error
+	return routes, err
+}
+
 func (route *ProxyRoute) Insert() error {
 	return DB.Create(route).Error
 }
 
 func (route *ProxyRoute) Update() error {
 	return DB.Model(&ProxyRoute{}).Where("id = ?", route.ID).Updates(map[string]any{
-		"domain":         route.Domain,
-		"origin_url":     route.OriginURL,
-		"origin_host":    route.OriginHost,
-		"upstreams":      route.Upstreams,
-		"enabled":        route.Enabled,
-		"enable_https":   route.EnableHTTPS,
-		"cert_id":        route.CertID,
-		"redirect_http":  route.RedirectHTTP,
-		"cache_enabled":  route.CacheEnabled,
-		"cache_policy":   route.CachePolicy,
-		"cache_rules":    route.CacheRules,
-		"custom_headers": route.CustomHeaders,
-		"remark":         route.Remark,
+		"site_name":             route.SiteName,
+		"domain":                route.Domain,
+		"domains":               route.Domains,
+		"origin_id":             route.OriginID,
+		"origin_url":            route.OriginURL,
+		"origin_host":           route.OriginHost,
+		"upstreams":             route.Upstreams,
+		"enabled":               route.Enabled,
+		"enable_https":          route.EnableHTTPS,
+		"cert_id":               route.CertID,
+		"cert_ids":              route.CertIDs,
+		"domain_cert_ids":       route.DomainCertIDs,
+		"redirect_http":         route.RedirectHTTP,
+		"limit_conn_per_server": route.LimitConnPerServer,
+		"limit_conn_per_ip":     route.LimitConnPerIP,
+		"limit_rate":            route.LimitRate,
+		"cache_enabled":         route.CacheEnabled,
+		"cache_policy":          route.CachePolicy,
+		"cache_rules":           route.CacheRules,
+		"custom_headers":        route.CustomHeaders,
+		"remark":                route.Remark,
 	}).Error
 }
 

openflare_server/model/sharding.go

@@ -0,0 +1,231 @@
+package model
+
+import (
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/bwmarrin/snowflake"
+	"gorm.io/gorm"
+	"gorm.io/sharding"
+)
+
+const observabilityShardCount = 10
+
+var (
+	observabilityIDNode     *snowflake.Node
+	observabilityIDNodeErr  error
+	observabilityIDNodeOnce sync.Once
+)
+
+func registerSharding(db *gorm.DB, backend string) error {
+	if db == nil {
+		return nil
+	}
+	_ = backend
+	if err := db.Use(sharding.Register(sharding.Config{
+		ShardingKey:    "id",
+		NumberOfShards: observabilityShardCount,
+		ShardingAlgorithm: func(value any) (string, error) {
+			return observabilityShardSuffixForValue(value)
+		},
+		ShardingAlgorithmByPrimaryKey: func(id int64) string {
+			return observabilityShardSuffixForInt64(id)
+		},
+		PrimaryKeyGenerator: sharding.PKCustom,
+		PrimaryKeyGeneratorFn: func(tableIdx int64) int64 {
+			return 0
+		},
+	}, shardedObservabilityTables()...)); err != nil {
+		return fmt.Errorf("register observability sharding failed: %w", err)
+	}
+	return nil
+}
+
+func shardedObservabilityTables() []any {
+	return []any{
+		&NodeMetricSnapshot{},
+		&NodeRequestReport{},
+		&NodeAccessLog{},
+	}
+}
+
+func shardedObservabilityBaseTables() []string {
+	return []string{
+		"node_metric_snapshots",
+		"node_request_reports",
+		"node_access_logs",
+	}
+}
+
+func isShardedObservabilityTable(tableName string) bool {
+	switch strings.TrimSpace(tableName) {
+	case "node_metric_snapshots", "node_request_reports", "node_access_logs":
+		return true
+	default:
+		return false
+	}
+}
+
+func observabilityShardTables(baseTable string) []string {
+	tables := make([]string, 0, observabilityShardCount)
+	for _, suffix := range observabilityShardSuffixes() {
+		tables = append(tables, baseTable+suffix)
+	}
+	return tables
+}
+
+func observabilityShardSuffixes() []string {
+	suffixes := make([]string, 0, observabilityShardCount)
+	for index := 0; index < observabilityShardCount; index++ {
+		suffixes = append(suffixes, fmt.Sprintf("_%02d", index))
+	}
+	return suffixes
+}
+
+func observabilityShardSuffixForID(id uint) string {
+	return fmt.Sprintf("_%02d", uint64(id)%uint64(observabilityShardCount))
+}
+
+func observabilityShardSuffixForInt64(id int64) string {
+	if id < 0 {
+		id = -id
+	}
+	return fmt.Sprintf("_%02d", uint64(id)%uint64(observabilityShardCount))
+}
+
+func observabilityShardSuffixForValue(value any) (string, error) {
+	switch typed := value.(type) {
+	case int:
+		return observabilityShardSuffixForInt64(int64(typed)), nil
+	case int8:
+		return observabilityShardSuffixForInt64(int64(typed)), nil
+	case int16:
+		return observabilityShardSuffixForInt64(int64(typed)), nil
+	case int32:
+		return observabilityShardSuffixForInt64(int64(typed)), nil
+	case int64:
+		return observabilityShardSuffixForInt64(typed), nil
+	case uint:
+		return observabilityShardSuffixForID(typed), nil
+	case uint8:
+		return observabilityShardSuffixForID(uint(typed)), nil
+	case uint16:
+		return observabilityShardSuffixForID(uint(typed)), nil
+	case uint32:
+		return observabilityShardSuffixForID(uint(typed)), nil
+	case uint64:
+		return fmt.Sprintf("_%02d", typed%uint64(observabilityShardCount)), nil
+	case string:
+		id, err := strconv.ParseUint(strings.TrimSpace(typed), 10, 64)
+		if err != nil {
+			return "", fmt.Errorf("invalid sharding id %q", typed)
+		}
+		return fmt.Sprintf("_%02d", id%uint64(observabilityShardCount)), nil
+	default:
+		return "", fmt.Errorf("unsupported observability sharding value type %T", value)
+	}
+}
+
+func observabilityShardTableForID(baseTable string, id uint) string {
+	return baseTable + observabilityShardSuffixForID(id)
+}
+
+func legacyObservabilityShardTableName(tableName string) string {
+	return tableName + "_legacy_v2_to_v3"
+}
+
+func normalizeShardedDB(db *gorm.DB) *gorm.DB {
+	if db != nil {
+		return db
+	}
+	return DB
+}
+
+func sessionIgnoringSharding(db *gorm.DB) *gorm.DB {
+	db = normalizeShardedDB(db)
+	if db == nil {
+		return nil
+	}
+	return db.Session(&gorm.Session{}).Set(sharding.ShardingIgnoreStoreKey, true)
+}
+
+func baseDialector(db *gorm.DB) gorm.Dialector {
+	if db == nil {
+		return nil
+	}
+	if dialector, ok := db.Dialector.(sharding.ShardingDialector); ok {
+		return dialector.Dialector
+	}
+	return db.Dialector
+}
+
+func nextObservabilityID() (uint, error) {
+	observabilityIDNodeOnce.Do(func() {
+		observabilityIDNode, observabilityIDNodeErr = snowflake.NewNode(0)
+	})
+	if observabilityIDNodeErr != nil {
+		return 0, observabilityIDNodeErr
+	}
+	id := observabilityIDNode.Generate().Int64()
+	if id <= 0 {
+		return 0, fmt.Errorf("generated invalid observability id %d", id)
+	}
+	return uint(id), nil
+}
+
+func assignObservabilityID(id *uint) error {
+	if id == nil || *id != 0 {
+		return nil
+	}
+	generated, err := nextObservabilityID()
+	if err != nil {
+		return err
+	}
+	*id = generated
+	return nil
+}
+
+func queryAcrossShards[T any](baseTable string, query func(tx *gorm.DB) ([]T, error)) ([]T, error) {
+	return queryAcrossShardsWithDB(DB, baseTable, query)
+}
+
+func queryAcrossShardsWithDB[T any](db *gorm.DB, baseTable string, query func(tx *gorm.DB) ([]T, error)) ([]T, error) {
+	items := make([]T, 0)
+	db = normalizeShardedDB(db)
+	for _, table := range observabilityShardTables(baseTable) {
+		rows, err := query(db.Table(table))
+		if err != nil {
+			return nil, err
+		}
+		items = append(items, rows...)
+	}
+	return items, nil
+}
+
+func deleteAcrossShards(db *gorm.DB, baseTable string, model any, apply func(tx *gorm.DB) *gorm.DB) (int64, error) {
+	db = normalizeShardedDB(db)
+	var deleted int64
+	for _, table := range observabilityShardTables(baseTable) {
+		tx := db.Table(table)
+		if apply != nil {
+			tx = apply(tx)
+		} else {
+			tx = tx.Session(&gorm.Session{AllowGlobalUpdate: true})
+		}
+		result := tx.Delete(model)
+		if result.Error != nil {
+			return deleted, result.Error
+		}
+		deleted += result.RowsAffected
+	}
+	return deleted, nil
+}
+
+func sortShardRows[T any](items []T, less func(left T, right T) bool) {
+	sort.Slice(items, func(i int, j int) bool {
+		return less(items[i], items[j])
+	})
+}

openflare_server/router/api-router.go

@@ -54,7 +54,9 @@ func SetApiRouter(router *gin.Engine) {
 		{
 			optionRoute.GET("/", controller.GetOptions)
 			optionRoute.POST("/update", controller.UpdateOption)
+			optionRoute.POST("/update-batch", controller.UpdateOptionsBatch)
 			optionRoute.POST("/geoip/lookup", controller.LookupGeoIP)
+			optionRoute.POST("/database/cleanup", controller.CleanupDatabaseObservability)
 		}
 		updateRoute := apiRouter.Group("/update")
 		updateRoute.Use(middleware.RootAuth(), middleware.NoTokenAuth())
@@ -77,10 +79,20 @@ func SetApiRouter(router *gin.Engine) {
 		proxyRoute.Use(middleware.AdminAuth())
 		{
 			proxyRoute.GET("/", controller.GetProxyRoutes)
+			proxyRoute.GET("/:id", controller.GetProxyRoute)
 			proxyRoute.POST("/", controller.CreateProxyRoute)
 			proxyRoute.POST("/:id/update", controller.UpdateProxyRoute)
 			proxyRoute.POST("/:id/delete", controller.DeleteProxyRoute)
 		}
+		originRoute := apiRouter.Group("/origins")
+		originRoute.Use(middleware.AdminAuth())
+		{
+			originRoute.GET("/", controller.GetOrigins)
+			originRoute.GET("/:id", controller.GetOrigin)
+			originRoute.POST("/", controller.CreateOrigin)
+			originRoute.POST("/:id/update", controller.UpdateOrigin)
+			originRoute.POST("/:id/delete", controller.DeleteOrigin)
+		}
 		managedDomainRoute := apiRouter.Group("/managed-domains")
 		managedDomainRoute.Use(middleware.AdminAuth())
 		{

openflare_server/router/api_phase1_test.go

@@ -55,7 +55,7 @@ func TestPhase1PublishLifecycle(t *testing.T) {
 		"remark":        "primary route",
 	}
 	resp := performJSONRequest(t, engine, token, http.MethodPost, "/api/proxy-routes/", createBody)
-	var createdRoute model.ProxyRoute
+	var createdRoute service.ProxyRouteView
 	decodeResponseData(t, resp, &createdRoute)
 	if createdRoute.Domain != "app.example.com" {
 		t.Fatalf("unexpected created route domain: %s", createdRoute.Domain)
@@ -74,7 +74,7 @@ func TestPhase1PublishLifecycle(t *testing.T) {
 	}
 
 	resp = performJSONRequest(t, engine, token, http.MethodGet, "/api/proxy-routes/", nil)
-	var routes []model.ProxyRoute
+	var routes []service.ProxyRouteView
 	decodeResponseData(t, resp, &routes)
 	if len(routes) != 1 {
 		t.Fatalf("expected 1 route, got %d", len(routes))
@@ -289,7 +289,7 @@ func TestPhase1HTTPSAndCertificateImportLifecycle(t *testing.T) {
 		"redirect_http": true,
 		"remark":        "https route",
 	})
-	var route model.ProxyRoute
+	var route service.ProxyRouteView
 	decodeResponseData(t, resp, &route)
 	if !route.EnableHTTPS || route.CertID == nil || *route.CertID != manualCertificate.ID {
 		t.Fatal("expected route to persist https certificate binding")
@@ -324,7 +324,7 @@ func TestPhase1HTTPSAndCertificateImportLifecycle(t *testing.T) {
 	}
 
 	listResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/proxy-routes/", nil)
-	var routes []model.ProxyRoute
+	var routes []service.ProxyRouteView
 	decodeResponseData(t, listResp, &routes)
 	if len(routes) != 1 || !routes[0].EnableHTTPS || routes[0].CertID == nil || *routes[0].CertID != manualCertificate.ID || !routes[0].RedirectHTTP {
 		t.Fatalf("expected route list to reflect https update, got %+v", routes)

openflare_server/router/api_phase2_test.go

@@ -41,21 +41,25 @@ func TestPhase2RateLimitOptionsHotReload(t *testing.T) {
 
 	loginCookie := loginAsRoot(t, engine)
 
-	performSessionJSONRequest(t, engine, loginCookie, http.MethodPost, "/api/option/update", map[string]any{
-		"key":   "GlobalApiRateLimitNum",
-		"value": "450",
-	})
-	performSessionJSONRequest(t, engine, loginCookie, http.MethodPost, "/api/option/update", map[string]any{
-		"key":   "GlobalApiRateLimitDuration",
-		"value": "240",
-	})
-	performSessionJSONRequest(t, engine, loginCookie, http.MethodPost, "/api/option/update", map[string]any{
-		"key":   "CriticalRateLimitNum",
-		"value": "150",
-	})
-	performSessionJSONRequest(t, engine, loginCookie, http.MethodPost, "/api/option/update", map[string]any{
-		"key":   "CriticalRateLimitDuration",
-		"value": "900",
+	performSessionJSONRequest(t, engine, loginCookie, http.MethodPost, "/api/option/update-batch", map[string]any{
+		"options": []map[string]any{
+			{
+				"key":   "GlobalApiRateLimitNum",
+				"value": "450",
+			},
+			{
+				"key":   "GlobalApiRateLimitDuration",
+				"value": "240",
+			},
+			{
+				"key":   "CriticalRateLimitNum",
+				"value": "150",
+			},
+			{
+				"key":   "CriticalRateLimitDuration",
+				"value": "900",
+			},
+		},
 	})
 
 	if common.GlobalApiRateLimitNum != 450 {
@@ -88,6 +92,115 @@ func TestPhase2RateLimitOptionsHotReload(t *testing.T) {
 	}
 }
 
+func TestPhase2BatchOptionUpdateIsAtomic(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+	model.InitOptionMap()
+
+	oldGlobalAPI := common.GlobalApiRateLimitNum
+	t.Cleanup(func() {
+		common.GlobalApiRateLimitNum = oldGlobalAPI
+	})
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	loginCookie := loginAsRoot(t, engine)
+
+	payload, err := json.Marshal(map[string]any{
+		"options": []map[string]any{
+			{
+				"key":   "GlobalApiRateLimitNum",
+				"value": "451",
+			},
+			{
+				"key":   "CriticalRateLimitDuration",
+				"value": "1800",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("failed to marshal batch payload: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/option/update-batch", bytes.NewReader(payload))
+	req.Header.Set("Content-Type", "application/json")
+	req.AddCookie(loginCookie)
+
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, req)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected status %d: %s", recorder.Code, recorder.Body.String())
+	}
+
+	var resp apiResponse
+	if err = json.Unmarshal(recorder.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to unmarshal response: %v", err)
+	}
+	if resp.Success {
+		t.Fatal("expected invalid batch update to fail")
+	}
+
+	if common.GlobalApiRateLimitNum != oldGlobalAPI {
+		t.Fatalf("expected GlobalApiRateLimitNum to remain %d after failed batch, got %d", oldGlobalAPI, common.GlobalApiRateLimitNum)
+	}
+
+	resp = performSessionJSONRequest(t, engine, loginCookie, http.MethodGet, "/api/option/", nil)
+	var options []model.Option
+	decodeResponseData(t, resp, &options)
+
+	optionMap := make(map[string]string, len(options))
+	for _, option := range options {
+		optionMap[option.Key] = option.Value
+	}
+
+	if optionMap["GlobalApiRateLimitNum"] == "451" {
+		t.Fatal("expected failed batch update to avoid persisting partial values")
+	}
+}
+
+func TestPhase2BatchOptionUpdateValidatesMergedState(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+	model.InitOptionMap()
+
+	oldGitHubClientID := common.GitHubClientId
+	oldGitHubOAuthEnabled := common.GitHubOAuthEnabled
+	t.Cleanup(func() {
+		common.GitHubClientId = oldGitHubClientID
+		common.GitHubOAuthEnabled = oldGitHubOAuthEnabled
+	})
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	loginCookie := loginAsRoot(t, engine)
+
+	performSessionJSONRequest(t, engine, loginCookie, http.MethodPost, "/api/option/update-batch", map[string]any{
+		"options": []map[string]any{
+			{
+				"key":   "GitHubClientId",
+				"value": "client-id-from-batch",
+			},
+			{
+				"key":   "GitHubOAuthEnabled",
+				"value": "true",
+			},
+		},
+	})
+
+	if common.GitHubClientId != "client-id-from-batch" {
+		t.Fatalf("expected GitHubClientId to be updated from batch, got %q", common.GitHubClientId)
+	}
+	if !common.GitHubOAuthEnabled {
+		t.Fatal("expected GitHubOAuthEnabled to be enabled by merged batch state")
+	}
+}
+
 func loginAsRoot(t *testing.T, engine http.Handler) *http.Cookie {
 	t.Helper()
 	payload, err := json.Marshal(map[string]any{
@@ -212,10 +325,10 @@ func TestPhase2AgentLifecycle(t *testing.T) {
 		"current_version":   "",
 		"last_error":        "",
 	}
-	resp := performAgentJSONRequestWithToken(t, engine, createdNode.AgentToken, http.MethodPost, "/api/agent/nodes/heartbeat", heartbeatPayload)
+	resp := performAgentJSONRequestWithTokenAndRemote(t, engine, createdNode.AgentToken, http.MethodPost, "/api/agent/nodes/heartbeat", heartbeatPayload, "198.51.100.10:1234")
 	var registeredNode model.Node
 	decodeResponseData(t, resp, &registeredNode)
-	if registeredNode.IP != "10.0.0.9" || registeredNode.AgentVersion != "0.1.1" || registeredNode.NodeID != createdNode.NodeID {
+	if registeredNode.IP != "198.51.100.10" || registeredNode.AgentVersion != "0.1.1" || registeredNode.NodeID != createdNode.NodeID {
 		t.Fatal("expected heartbeat to update node metadata")
 	}
 	if registeredNode.OpenrestyStatus != service.OpenrestyStatusUnhealthy {
@@ -330,6 +443,7 @@ func TestPhase2AgentLifecycle(t *testing.T) {
 	restartHeartbeatReq := httptest.NewRequest(http.MethodPost, "/api/agent/nodes/heartbeat", bytes.NewReader(rawHeartbeatPayload))
 	restartHeartbeatReq.Header.Set("Content-Type", "application/json")
 	restartHeartbeatReq.Header.Set("X-Agent-Token", createdNode.AgentToken)
+	restartHeartbeatReq.RemoteAddr = "198.51.100.10:1234"
 	restartHeartbeatRecorder := httptest.NewRecorder()
 	engine.ServeHTTP(restartHeartbeatRecorder, restartHeartbeatReq)
 	if restartHeartbeatRecorder.Code != http.StatusOK {
@@ -459,7 +573,7 @@ func TestPhase2CustomHeadersPreviewAndDiffLifecycle(t *testing.T) {
 			{"key": "X-Trace-Id", "value": "$request_id"},
 		},
 	})
-	var createdRoute model.ProxyRoute
+	var createdRoute service.ProxyRouteView
 	decodeResponseData(t, createResp, &createdRoute)
 	if !strings.Contains(createdRoute.CustomHeaders, "X-Trace-Id") {
 		t.Fatalf("expected custom headers to be stored as json, got %s", createdRoute.CustomHeaders)
@@ -467,6 +581,9 @@ func TestPhase2CustomHeadersPreviewAndDiffLifecycle(t *testing.T) {
 	if createdRoute.OriginHost != "preview-origin.internal" {
 		t.Fatalf("expected origin_host to be stored, got %s", createdRoute.OriginHost)
 	}
+	if createdRoute.SiteName != "preview.example.com" || createdRoute.PrimaryDomain != "preview.example.com" || createdRoute.DomainCount != 1 {
+		t.Fatalf("expected website identity fields in create response, got %+v", createdRoute)
+	}
 
 	performJSONRequest(t, engine, token, http.MethodPost, "/api/config-versions/publish", nil)
 
@@ -490,6 +607,9 @@ func TestPhase2CustomHeadersPreviewAndDiffLifecycle(t *testing.T) {
 	var preview map[string]any
 	decodeResponseData(t, previewResp, &preview)
 	renderedConfig, _ := preview["rendered_config"].(string)
+	if websiteCount, ok := preview["website_count"].(float64); !ok || int(websiteCount) != 2 {
+		t.Fatalf("expected preview website_count=2, got %#v", preview["website_count"])
+	}
 	if !strings.Contains(renderedConfig, `proxy_set_header X-Release "candidate";`) {
 		t.Fatalf("expected preview endpoint to return custom header, got %s", renderedConfig)
 	}
@@ -514,6 +634,67 @@ func TestPhase2CustomHeadersPreviewAndDiffLifecycle(t *testing.T) {
 	if !ok || len(addedDomains) != 1 || addedDomains[0].(string) != "new-preview.example.com" {
 		t.Fatalf("unexpected added domains: %#v", diff["added_domains"])
 	}
+	modifiedSites, ok := diff["modified_sites"].([]any)
+	if !ok || len(modifiedSites) != 1 || modifiedSites[0].(string) != "preview.example.com" {
+		t.Fatalf("unexpected modified sites: %#v", diff["modified_sites"])
+	}
+	addedSites, ok := diff["added_sites"].([]any)
+	if !ok || len(addedSites) != 1 || addedSites[0].(string) != "new-preview.example.com" {
+		t.Fatalf("unexpected added sites: %#v", diff["added_sites"])
+	}
+}
+
+func TestPhase2ProxyRouteWebsiteDetailAndLimits(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	common.RedisEnabled = false
+	setupTestDB(t)
+
+	engine := gin.New()
+	engine.Use(sessions.Sessions("session", cookie.NewStore([]byte("test-secret"))))
+	router.SetApiRouter(engine)
+
+	token := prepareRootToken(t)
+
+	createResp := performJSONRequest(t, engine, token, http.MethodPost, "/api/proxy-routes/", map[string]any{
+		"site_name":             "marketing-site",
+		"domains":               []string{"app.example.com", "www.example.com"},
+		"origin_url":            "https://origin.internal",
+		"enabled":               true,
+		"limit_conn_per_server": 120,
+		"limit_conn_per_ip":     12,
+		"limit_rate":            "512K",
+	})
+	var createdRoute service.ProxyRouteView
+	decodeResponseData(t, createResp, &createdRoute)
+	if createdRoute.SiteName != "marketing-site" || createdRoute.PrimaryDomain != "app.example.com" {
+		t.Fatalf("unexpected create payload: %+v", createdRoute)
+	}
+	if createdRoute.DomainCount != 2 || len(createdRoute.Domains) != 2 || createdRoute.Domains[1] != "www.example.com" {
+		t.Fatalf("expected multi-domain website view, got %+v", createdRoute)
+	}
+	if createdRoute.LimitConnPerServer != 120 || createdRoute.LimitConnPerIP != 12 || createdRoute.LimitRate != "512k" {
+		t.Fatalf("expected normalized rate limit fields, got %+v", createdRoute)
+	}
+	if len(createdRoute.UpstreamList) != 1 || createdRoute.UpstreamList[0] != "https://origin.internal" {
+		t.Fatalf("expected structured upstream list, got %+v", createdRoute.UpstreamList)
+	}
+
+	detailResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/proxy-routes/"+toString(createdRoute.ID), nil)
+	var detail service.ProxyRouteView
+	decodeResponseData(t, detailResp, &detail)
+	if detail.ID != createdRoute.ID || detail.SiteName != "marketing-site" || detail.LimitRate != "512k" {
+		t.Fatalf("unexpected detail response: %+v", detail)
+	}
+	if len(detail.Domains) != 2 || detail.Domains[0] != "app.example.com" || detail.Domains[1] != "www.example.com" {
+		t.Fatalf("expected detail response to expose full domain list, got %+v", detail.Domains)
+	}
+
+	listResp := performJSONRequest(t, engine, token, http.MethodGet, "/api/proxy-routes/", nil)
+	var routes []service.ProxyRouteView
+	decodeResponseData(t, listResp, &routes)
+	if len(routes) != 1 || routes[0].SiteName != "marketing-site" || routes[0].LimitConnPerServer != 120 {
+		t.Fatalf("unexpected proxy route list response: %+v", routes)
+	}
 }
 
 func TestPhase2GlobalDiscoveryRegistration(t *testing.T) {
@@ -533,7 +714,7 @@ func TestPhase2GlobalDiscoveryRegistration(t *testing.T) {
 		t.Fatal("expected global discovery token to be available")
 	}
 
-	resp := performAgentJSONRequestWithToken(t, engine, bootstrap.DiscoveryToken, http.MethodPost, "/api/agent/nodes/register", map[string]any{
+	resp := performAgentJSONRequestWithTokenAndRemote(t, engine, bootstrap.DiscoveryToken, http.MethodPost, "/api/agent/nodes/register", map[string]any{
 		"node_id":         "local-node-id",
 		"name":            "bulk-edge-1",
 		"ip":              "10.0.0.18",
@@ -541,7 +722,7 @@ func TestPhase2GlobalDiscoveryRegistration(t *testing.T) {
 		"nginx_version":   "1.25.5",
 		"current_version": "",
 		"last_error":      "",
-	})
+	}, "203.0.113.18:4321")
 	var registration service.AgentRegistrationResponse
 	decodeResponseData(t, resp, &registration)
 	if registration.AgentToken == "" || registration.NodeID == "" {
@@ -557,9 +738,16 @@ func TestPhase2GlobalDiscoveryRegistration(t *testing.T) {
 	if nodes[0].Name != "bulk-edge-1" || nodes[0].AgentToken != registration.AgentToken || nodes[0].Status != service.NodeStatusOnline {
 		t.Fatal("expected discovered node to be created online with issued agent token")
 	}
+	if nodes[0].IP != "203.0.113.18" {
+		t.Fatalf("expected discovered node to keep public source ip, got %s", nodes[0].IP)
+	}
 }
 
 func performAgentJSONRequestWithToken(t *testing.T, engine http.Handler, token string, method string, path string, body any) apiResponse {
+	return performAgentJSONRequestWithTokenAndRemote(t, engine, token, method, path, body, "")
+}
+
+func performAgentJSONRequestWithTokenAndRemote(t *testing.T, engine http.Handler, token string, method string, path string, body any, remoteAddr string) apiResponse {
 	t.Helper()
 	var payload []byte
 	var err error
@@ -573,6 +761,9 @@ func performAgentJSONRequestWithToken(t *testing.T, engine http.Handler, token s
 	if body != nil {
 		req.Header.Set("Content-Type", "application/json")
 	}
+	if remoteAddr != "" {
+		req.RemoteAddr = remoteAddr
+	}
 	req.Header.Set("X-Agent-Token", token)
 	recorder := httptest.NewRecorder()
 	engine.ServeHTTP(recorder, req)

openflare_server/service/access_log_test.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"openflare/model"
+	"strings"
 	"testing"
 	"time"
 )
@@ -60,9 +61,7 @@ func TestListAccessLogsIncludesSummaryTotals(t *testing.T) {
 			StatusCode: 200,
 		},
 	}
-	if err := model.DB.Create(&logs).Error; err != nil {
-		t.Fatalf("failed to seed access logs: %v", err)
-	}
+	seedNodeAccessLogs(t, logs)
 
 	result, err := ListAccessLogs(AccessLogQuery{Page: 0, PageSize: 2})
 	if err != nil {
@@ -121,9 +120,7 @@ func TestListAccessLogsUsesDefaultPageSize(t *testing.T) {
 			StatusCode: 200,
 		})
 	}
-	if err := model.DB.Create(&logs).Error; err != nil {
-		t.Fatalf("failed to seed access logs: %v", err)
-	}
+	seedNodeAccessLogs(t, logs)
 
 	result, err := ListAccessLogs(AccessLogQuery{})
 	if err != nil {
@@ -143,7 +140,7 @@ func TestListAccessLogsUsesDefaultPageSize(t *testing.T) {
 func TestListFoldedAccessLogsAndIPSummaries(t *testing.T) {
 	setupServiceTestDB(t)
 
-	now := time.Now().UTC()
+	now := time.Date(2026, 3, 19, 8, 12, 30, 0, time.UTC)
 	if err := model.DB.Create(&model.Node{
 		NodeID: "node-folded",
 		Name:   "edge-folded",
@@ -176,9 +173,7 @@ func TestListFoldedAccessLogsAndIPSummaries(t *testing.T) {
 			StatusCode: 404,
 		},
 	}
-	if err := model.DB.Create(&logs).Error; err != nil {
-		t.Fatalf("failed to seed access logs: %v", err)
-	}
+	seedNodeAccessLogs(t, logs)
 
 	folded, err := ListFoldedAccessLogs(AccessLogQuery{
 		NodeID:      "node-folded",
@@ -221,7 +216,7 @@ func TestCleanupAccessLogsDeletesExpiredData(t *testing.T) {
 	setupServiceTestDB(t)
 
 	now := time.Now().UTC()
-	if err := model.DB.Create([]*model.NodeAccessLog{
+	seedNodeAccessLogs(t, []*model.NodeAccessLog{
 		{
 			NodeID:     "node-cleanup",
 			LoggedAt:   now.Add(-10 * 24 * time.Hour),
@@ -238,9 +233,7 @@ func TestCleanupAccessLogsDeletesExpiredData(t *testing.T) {
 			Path:       "/recent",
 			StatusCode: 200,
 		},
-	}).Error; err != nil {
-		t.Fatalf("failed to seed cleanup logs: %v", err)
-	}
+	})
 
 	result, err := CleanupAccessLogs(AccessLogCleanupInput{RetentionDays: 7})
 	if err != nil {
@@ -258,3 +251,45 @@ func TestCleanupAccessLogsDeletesExpiredData(t *testing.T) {
 		t.Fatalf("unexpected remaining logs after cleanup: %+v", remaining.Items)
 	}
 }
+
+func TestPersistNodeAccessLogsTruncatesLongPath(t *testing.T) {
+	setupServiceTestDB(t)
+
+	longPath := "/" + strings.Repeat("a", 140)
+	reportedAt := time.Now().UTC()
+	if err := persistNodeAccessLogs(model.DB, "node-truncate", []AgentNodeAccessLog{
+		{
+			LoggedAtUnix: reportedAt.Unix(),
+			RemoteAddr:   "203.0.113.10",
+			Host:         "truncate.example.com",
+			Path:         longPath,
+			StatusCode:   200,
+		},
+	}, reportedAt); err != nil {
+		t.Fatalf("persistNodeAccessLogs failed: %v", err)
+	}
+
+	logs, err := model.ListNodeAccessLogs(model.NodeAccessLogQuery{
+		NodeID:   "node-truncate",
+		Page:     0,
+		PageSize: 10,
+	})
+	if err != nil {
+		t.Fatalf("ListNodeAccessLogs failed: %v", err)
+	}
+	if len(logs) != 1 {
+		t.Fatalf("expected one stored log, got %+v", logs)
+	}
+	if got := len([]rune(logs[0].Path)); got != nodeAccessLogPathMaxLength {
+		t.Fatalf("expected truncated path length %d, got %d (%q)", nodeAccessLogPathMaxLength, got, logs[0].Path)
+	}
+}
+
+func seedNodeAccessLogs(t *testing.T, logs []*model.NodeAccessLog) {
+	t.Helper()
+	for _, item := range logs {
+		if err := model.DB.Create(item).Error; err != nil {
+			t.Fatalf("failed to seed access log: %v", err)
+		}
+	}
+}

openflare_server/service/config_version.go

@@ -35,6 +35,7 @@ type ConfigPreviewResult struct {
 	SupportFiles   []SupportFile `json:"support_files"`
 	Checksum       string        `json:"checksum"`
 	RouteCount     int           `json:"route_count"`
+	WebsiteCount   int           `json:"website_count"`
 }
 
 type ConfigVersionSummary = model.ConfigVersionSummary
@@ -43,12 +44,17 @@ type ConfigVersionDetail = model.ConfigVersion
 
 type ConfigDiffResult struct {
 	ActiveVersion        string                 `json:"active_version,omitempty"`
+	AddedSites           []string               `json:"added_sites"`
+	RemovedSites         []string               `json:"removed_sites"`
+	ModifiedSites        []string               `json:"modified_sites"`
 	AddedDomains         []string               `json:"added_domains"`
 	RemovedDomains       []string               `json:"removed_domains"`
 	ModifiedDomains      []string               `json:"modified_domains"`
 	MainConfigChanged    bool                   `json:"main_config_changed"`
 	ChangedOptionKeys    []string               `json:"changed_option_keys"`
 	ChangedOptionDetails []ConfigOptionDiffItem `json:"changed_option_details"`
+	CurrentWebsiteCount  int                    `json:"current_website_count"`
+	ActiveWebsiteCount   int                    `json:"active_website_count"`
 }
 
 type ConfigOptionDiffItem struct {
@@ -58,19 +64,26 @@ type ConfigOptionDiffItem struct {
 }
 
 type snapshotRoute struct {
-	Domain        string                        `json:"domain"`
-	OriginURL     string                        `json:"origin_url"`
-	OriginHost    string                        `json:"origin_host,omitempty"`
-	Upstreams     []string                      `json:"upstreams,omitempty"`
-	Enabled       bool                          `json:"enabled"`
-	EnableHTTPS   bool                          `json:"enable_https"`
-	CertID        *uint                         `json:"cert_id,omitempty"`
-	RedirectHTTP  bool                          `json:"redirect_http"`
-	CacheEnabled  bool                          `json:"cache_enabled"`
-	CachePolicy   string                        `json:"cache_policy,omitempty"`
-	CacheRules    []string                      `json:"cache_rules,omitempty"`
-	CustomHeaders []ProxyRouteCustomHeaderInput `json:"custom_headers,omitempty"`
-	Remark        string                        `json:"remark,omitempty"`
+	SiteName           string                        `json:"site_name,omitempty"`
+	Domain             string                        `json:"domain"`
+	Domains            []string                      `json:"domains,omitempty"`
+	OriginURL          string                        `json:"origin_url"`
+	OriginHost         string                        `json:"origin_host,omitempty"`
+	Upstreams          []string                      `json:"upstreams,omitempty"`
+	Enabled            bool                          `json:"enabled"`
+	EnableHTTPS        bool                          `json:"enable_https"`
+	CertID             *uint                         `json:"cert_id,omitempty"`
+	CertIDs            []uint                        `json:"cert_ids,omitempty"`
+	DomainCertIDs      []uint                        `json:"domain_cert_ids,omitempty"`
+	RedirectHTTP       bool                          `json:"redirect_http"`
+	LimitConnPerServer int                           `json:"limit_conn_per_server,omitempty"`
+	LimitConnPerIP     int                           `json:"limit_conn_per_ip,omitempty"`
+	LimitRate          string                        `json:"limit_rate,omitempty"`
+	CacheEnabled       bool                          `json:"cache_enabled"`
+	CachePolicy        string                        `json:"cache_policy,omitempty"`
+	CacheRules         []string                      `json:"cache_rules,omitempty"`
+	CustomHeaders      []ProxyRouteCustomHeaderInput `json:"custom_headers,omitempty"`
+	Remark             string                        `json:"remark,omitempty"`
 }
 
 type routeCacheConfig struct {
@@ -79,6 +92,12 @@ type routeCacheConfig struct {
 	Rules   []string
 }
 
+type routeLimitConfig struct {
+	LimitConnPerServer int
+	LimitConnPerIP     int
+	LimitRate          string
+}
+
 type routeUpstreamConfig struct {
 	Name              string
 	Scheme            string
@@ -205,6 +224,7 @@ func PreviewConfigVersion() (*ConfigPreviewResult, error) {
 		SupportFiles:   bundle.SupportFiles,
 		Checksum:       bundle.Checksum,
 		RouteCount:     len(bundle.Routes),
+		WebsiteCount:   len(bundle.SnapshotRoutes),
 	}, nil
 }
 
@@ -214,21 +234,29 @@ func DiffConfigVersion() (*ConfigDiffResult, error) {
 		return nil, err
 	}
 	result := &ConfigDiffResult{
+		AddedSites:           []string{},
+		RemovedSites:         []string{},
+		ModifiedSites:        []string{},
 		AddedDomains:         []string{},
 		RemovedDomains:       []string{},
 		ModifiedDomains:      []string{},
 		ChangedOptionKeys:    []string{},
 		ChangedOptionDetails: []ConfigOptionDiffItem{},
+		CurrentWebsiteCount:  len(bundle.SnapshotRoutes),
 	}
 	activeVersion, err := model.GetActiveConfigVersion()
 	if err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			for _, route := range bundle.SnapshotRoutes {
-				result.AddedDomains = append(result.AddedDomains, route.Domain)
+				result.AddedSites = append(result.AddedSites, route.SiteName)
+				result.AddedDomains = append(result.AddedDomains, route.Domains...)
 			}
 			result.MainConfigChanged = true
 			result.ChangedOptionKeys = openRestyOptionKeys()
 			result.ChangedOptionDetails = buildInitialOpenRestyOptionDiffs(bundle.OpenRestyConfig)
+			sort.Strings(result.AddedSites)
+			sort.Strings(result.AddedDomains)
+			sort.Strings(result.ChangedOptionKeys)
 			return result, nil
 		}
 		return nil, err
@@ -238,14 +266,26 @@ func DiffConfigVersion() (*ConfigDiffResult, error) {
 	if err != nil {
 		return nil, err
 	}
-	currentMap := make(map[string]snapshotRoute, len(bundle.SnapshotRoutes))
-	for _, route := range bundle.SnapshotRoutes {
-		currentMap[route.Domain] = route
+	result.ActiveWebsiteCount = len(activeSnapshot.Routes)
+	currentSiteMap := flattenSnapshotRoutesBySite(bundle.SnapshotRoutes)
+	activeSiteMap := flattenSnapshotRoutesBySite(activeSnapshot.Routes)
+	for siteName, currentRoute := range currentSiteMap {
+		activeRoute, ok := activeSiteMap[siteName]
+		if !ok {
+			result.AddedSites = append(result.AddedSites, siteName)
+			continue
+		}
+		if !snapshotRouteConfigEqual(activeRoute, currentRoute) {
+			result.ModifiedSites = append(result.ModifiedSites, siteName)
+		}
 	}
-	activeMap := make(map[string]snapshotRoute, len(activeSnapshot.Routes))
-	for _, route := range activeSnapshot.Routes {
-		activeMap[route.Domain] = route
+	for siteName := range activeSiteMap {
+		if _, ok := currentSiteMap[siteName]; !ok {
+			result.RemovedSites = append(result.RemovedSites, siteName)
+		}
 	}
+	currentMap := flattenSnapshotRoutesByDomain(bundle.SnapshotRoutes)
+	activeMap := flattenSnapshotRoutesByDomain(activeSnapshot.Routes)
 	for domain, currentRoute := range currentMap {
 		activeRoute, ok := activeMap[domain]
 		if !ok {
@@ -264,6 +304,9 @@ func DiffConfigVersion() (*ConfigDiffResult, error) {
 	result.MainConfigChanged = activeVersion.MainConfig != bundle.MainConfig
 	result.ChangedOptionDetails = diffOpenRestyOptionDetails(activeSnapshot.OpenRestyConfig, bundle.OpenRestyConfig)
 	result.ChangedOptionKeys = extractOptionDiffKeys(result.ChangedOptionDetails)
+	sort.Strings(result.AddedSites)
+	sort.Strings(result.RemovedSites)
+	sort.Strings(result.ModifiedSites)
 	sort.Strings(result.AddedDomains)
 	sort.Strings(result.RemovedDomains)
 	sort.Strings(result.ModifiedDomains)
@@ -403,6 +446,10 @@ func buildCurrentConfigBundle(requireRoutes bool) (*configBundle, error) {
 func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 	items := make([]snapshotRoute, 0, len(routes))
 	for _, route := range routes {
+		domains, err := decodeStoredDomains(route.Domains, route.Domain)
+		if err != nil {
+			return nil, fmt.Errorf("route %s domains are invalid", route.Domain)
+		}
 		customHeaders, err := decodeStoredCustomHeaders(route.CustomHeaders)
 		if err != nil {
 			return nil, fmt.Errorf("路由 %s 自定义请求头无效", route.Domain)
@@ -416,24 +463,60 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 			return nil, fmt.Errorf("路由 %s 缓存规则无效", route.Domain)
 		}
 		items = append(items, snapshotRoute{
-			Domain:        route.Domain,
-			OriginURL:     route.OriginURL,
-			OriginHost:    route.OriginHost,
-			Upstreams:     upstreams,
-			Enabled:       route.Enabled,
-			EnableHTTPS:   route.EnableHTTPS,
-			CertID:        route.CertID,
-			RedirectHTTP:  route.RedirectHTTP,
-			CacheEnabled:  route.CacheEnabled,
-			CachePolicy:   route.CachePolicy,
-			CacheRules:    cacheRules,
-			CustomHeaders: customHeaders,
-			Remark:        route.Remark,
+			SiteName:           normalizeProxyRouteSiteNameInput(route, route.SiteName, domains[0]),
+			Domain:             domains[0],
+			Domains:            domains,
+			OriginURL:          route.OriginURL,
+			OriginHost:         route.OriginHost,
+			Upstreams:          upstreams,
+			Enabled:            route.Enabled,
+			EnableHTTPS:        route.EnableHTTPS,
+			CertID:             route.CertID,
+			CertIDs:            mustDecodeSnapshotCertIDs(route),
+			DomainCertIDs:      mustDecodeSnapshotDomainCertIDs(route, domains),
+			RedirectHTTP:       route.RedirectHTTP,
+			LimitConnPerServer: route.LimitConnPerServer,
+			LimitConnPerIP:     route.LimitConnPerIP,
+			LimitRate:          route.LimitRate,
+			CacheEnabled:       route.CacheEnabled,
+			CachePolicy:        route.CachePolicy,
+			CacheRules:         cacheRules,
+			CustomHeaders:      customHeaders,
+			Remark:             route.Remark,
 		})
 	}
 	return items, nil
 }
 
+func mustDecodeSnapshotCertIDs(route *model.ProxyRoute) []uint {
+	if route == nil {
+		return []uint{}
+	}
+	certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
+	if err != nil {
+		return []uint{}
+	}
+	return certIDs
+}
+
+func mustDecodeSnapshotDomainCertIDs(
+	route *model.ProxyRoute,
+	domains []string,
+) []uint {
+	if route == nil {
+		return []uint{}
+	}
+	certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
+	if err != nil {
+		return []uint{}
+	}
+	domainCertIDs, err := resolveProxyRouteDomainCertIDs(route, domains, certIDs)
+	if err != nil {
+		return []uint{}
+	}
+	return domainCertIDs
+}
+
 func parseSnapshotDocument(snapshotJSON string) (*snapshotDocument, error) {
 	text := strings.TrimSpace(snapshotJSON)
 	if text == "" {
@@ -459,10 +542,36 @@ func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
 		return []snapshotRoute{}
 	}
 	for index := range routes {
+		normalizedDomains, err := decodeStoredDomains("", routes[index].Domain)
+		if len(routes[index].Domains) > 0 {
+			normalizedDomains, err = normalizeProxyRouteDomains(routes[index].Domains)
+		}
+		if err == nil && len(normalizedDomains) > 0 {
+			routes[index].Domains = normalizedDomains
+			routes[index].Domain = normalizedDomains[0]
+			routes[index].SiteName = normalizeProxyRouteSiteNameInput(
+				&model.ProxyRoute{SiteName: routes[index].SiteName},
+				routes[index].SiteName,
+				normalizedDomains[0],
+			)
+		}
 		normalizedHeaders, err := normalizeCustomHeaders(routes[index].CustomHeaders)
 		if err == nil {
 			routes[index].CustomHeaders = normalizedHeaders
 		}
+		normalizedCertIDs, primaryCertID, err := normalizeSnapshotCertificateIDs(routes[index].CertID, routes[index].CertIDs)
+		if err == nil {
+			routes[index].CertID = primaryCertID
+			routes[index].CertIDs = normalizedCertIDs
+		}
+		normalizedDomainCertIDs, err := normalizeSnapshotDomainCertificateIDs(
+			routes[index].Domains,
+			routes[index].CertIDs,
+			routes[index].DomainCertIDs,
+		)
+		if err == nil {
+			routes[index].DomainCertIDs = normalizedDomainCertIDs
+		}
 		normalizedUpstreams, err := normalizeUpstreams(routes[index].OriginURL, routes[index].Upstreams)
 		if err == nil {
 			routes[index].OriginURL = normalizedUpstreams[0]
@@ -473,14 +582,46 @@ func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
 			routes[index].CachePolicy = normalizeCachePolicy(routes[index].CacheEnabled, routes[index].CachePolicy)
 			routes[index].CacheRules = normalizedCacheRules
 		}
+		normalizedLimitRate, err := normalizeProxyRouteLimitRate(routes[index].LimitRate)
+		if err == nil {
+			routes[index].LimitRate = normalizedLimitRate
+		}
 	}
 	return routes
 }
 
+func flattenSnapshotRoutesBySite(routes []snapshotRoute) map[string]snapshotRoute {
+	siteMap := make(map[string]snapshotRoute)
+	for _, route := range normalizeSnapshotRoutes(routes) {
+		siteMap[route.SiteName] = route
+	}
+	return siteMap
+}
+
+func flattenSnapshotRoutesByDomain(routes []snapshotRoute) map[string]snapshotRoute {
+	domainMap := make(map[string]snapshotRoute)
+	for _, route := range normalizeSnapshotRoutes(routes) {
+		for _, domain := range route.Domains {
+			item := route
+			item.Domain = domain
+			domainMap[domain] = item
+		}
+	}
+	return domainMap
+}
+
 func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
-	if left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || !uintPointerEqual(left.CertID, right.CertID) {
+	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP || left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || !uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
 		return false
 	}
+	if len(left.Domains) != len(right.Domains) {
+		return false
+	}
+	for index := range left.Domains {
+		if left.Domains[index] != right.Domains[index] {
+			return false
+		}
+	}
 	if len(left.Upstreams) != len(right.Upstreams) {
 		return false
 	}
@@ -658,6 +799,15 @@ func renderRouteConfig(routes []*model.ProxyRoute, cfg openRestyConfigSnapshot)
 	builder.WriteString("# This file is generated by OpenFlare. Do not edit manually.\n")
 	supportFiles := make([]SupportFile, 0)
 	for _, route := range routes {
+		domains, err := decodeStoredDomains(route.Domains, route.Domain)
+		if err != nil {
+			return "", nil, fmt.Errorf("route %s domains are invalid", route.Domain)
+		}
+		serverNames := renderServerNames(domains)
+		displayName := route.SiteName
+		if strings.TrimSpace(displayName) == "" {
+			displayName = domains[0]
+		}
 		customHeaders, err := decodeStoredCustomHeaders(route.CustomHeaders)
 		if err != nil {
 			return "", nil, fmt.Errorf("路由 %s 自定义请求头无效", route.Domain)
@@ -675,31 +825,96 @@ func renderRouteConfig(routes []*model.ProxyRoute, cfg openRestyConfigSnapshot)
 			Policy:  route.CachePolicy,
 			Rules:   cacheRules,
 		}
+		limitConfig := routeLimitConfig{
+			LimitConnPerServer: route.LimitConnPerServer,
+			LimitConnPerIP:     route.LimitConnPerIP,
+			LimitRate:          route.LimitRate,
+		}
 		upstreamConfig := buildRouteUpstreamConfig(route, upstreams)
 		if upstreamConfig.UsesNamedUpstream {
 			builder.WriteString(renderNamedUpstreamBlock(upstreamConfig))
 		}
 		if !route.EnableHTTPS {
-			builder.WriteString(renderHTTPProxyServer(route.Domain, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, upstreamConfig, cfg))
+			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, cfg))
 			continue
 		}
+		certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
+		if err != nil {
+			return "", nil, fmt.Errorf("route %s cert_ids are invalid: %w", route.Domain, err)
+		}
+		domainCertIDs, err := resolveProxyRouteDomainCertIDs(route, domains, certIDs)
+		if err != nil {
+			return "", nil, fmt.Errorf("route %s domain_cert_ids are invalid: %w", route.Domain, err)
+		}
 		if route.CertID == nil || *route.CertID == 0 {
 			return "", nil, fmt.Errorf("路由 %s 未配置证书", route.Domain)
 		}
-		certificate, err := model.GetTLSCertificateByID(*route.CertID)
+		if len(certIDs) == 0 {
+			return "", nil, fmt.Errorf("路由 %s 未配置证书", route.Domain)
+		}
+		certificates, err := loadTLSCertificates(certIDs)
 		if err != nil {
-			return "", nil, fmt.Errorf("路由 %s 关联证书不存在", route.Domain)
+			return "", nil, fmt.Errorf("route %s certificate lookup failed: %w", route.Domain, err)
 		}
-		supportFiles = append(supportFiles,
-			SupportFile{Path: certificateCertFileName(certificate.ID), Content: normalizePEM(certificate.CertPEM)},
-			SupportFile{Path: certificateKeyFileName(certificate.ID), Content: normalizePEM(certificate.KeyPEM)},
-		)
+		certificateByID := make(map[uint]*model.TLSCertificate, len(certificates))
+		for _, certificate := range certificates {
+			if certificate == nil {
+				continue
+			}
+			certificateByID[certificate.ID] = certificate
+			supportFiles = append(supportFiles,
+				SupportFile{Path: certificateCertFileName(certificate.ID), Content: normalizePEM(certificate.CertPEM)},
+				SupportFile{Path: certificateKeyFileName(certificate.ID), Content: normalizePEM(certificate.KeyPEM)},
+			)
+		}
+
+		httpOnlyDomains := make([]string, 0, len(domains))
+		domainsByCertID := make(map[uint][]string, len(certIDs))
+		for index, domain := range domains {
+			if index >= len(domainCertIDs) || domainCertIDs[index] == 0 {
+				httpOnlyDomains = append(httpOnlyDomains, domain)
+				continue
+			}
+			domainsByCertID[domainCertIDs[index]] = append(
+				domainsByCertID[domainCertIDs[index]],
+				domain,
+			)
+		}
+		for _, certID := range certIDs {
+			assignedDomains := domainsByCertID[certID]
+			if len(assignedDomains) == 0 {
+				continue
+			}
+			certificate := certificateByID[certID]
+			if certificate == nil {
+				return "", nil, fmt.Errorf("route %s certificate %d does not exist", route.Domain, certID)
+			}
+			if err := validateCertificateCoverage(certificate, assignedDomains); err != nil {
+				return "", nil, fmt.Errorf("site %s certificate validation failed: %w", displayName, err)
+			}
+		}
+
 		if route.RedirectHTTP {
-			builder.WriteString(renderHTTPRedirectServer(route.Domain))
+			if len(httpOnlyDomains) > 0 {
+				builder.WriteString(renderHTTPProxyServer(renderServerNames(httpOnlyDomains), route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, cfg))
+			}
+			for _, certID := range certIDs {
+				assignedDomains := domainsByCertID[certID]
+				if len(assignedDomains) == 0 {
+					continue
+				}
+				builder.WriteString(renderHTTPRedirectServer(renderServerNames(assignedDomains)))
+			}
 		} else {
-			builder.WriteString(renderHTTPProxyServer(route.Domain, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, upstreamConfig, cfg))
+			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, cfg))
+		}
+		for _, certID := range certIDs {
+			assignedDomains := domainsByCertID[certID]
+			if len(assignedDomains) == 0 {
+				continue
+			}
+			builder.WriteString(renderHTTPSServer(renderServerNames(assignedDomains), route.OriginURL, route.OriginHost, certID, customHeaders, cacheConfig, limitConfig, upstreamConfig, cfg))
 		}
-		builder.WriteString(renderHTTPSServer(route.Domain, route.OriginURL, route.OriginHost, certificate.ID, customHeaders, cacheConfig, upstreamConfig, cfg))
 	}
 	return builder.String(), dedupeSupportFiles(supportFiles), nil
 }
@@ -772,7 +987,8 @@ func renderTemplateDirective(enabled bool, statement string) string {
 }
 
 func renderOpenRestyCacheTemplateBlock(cfg openRestyConfigSnapshot) string {
-	lines := make([]string, 0, 8)
+	lines := make([]string, 0, 12)
+	lines = append(lines, renderOpenRestyLimitZoneBlock())
 	if !cfg.CacheEnabled {
 		lines = append(lines, renderOpenRestyObservabilityTemplateBlock())
 		return strings.Join(lines, "")
@@ -789,6 +1005,14 @@ func renderOpenRestyCacheTemplateBlock(cfg openRestyConfigSnapshot) string {
 	return strings.Join(lines, "")
 }
 
+func renderOpenRestyLimitZoneBlock() string {
+	return strings.Join([]string{
+		"    limit_conn_zone $server_name zone=openflare_conn_per_server:10m;",
+		"    limit_conn_zone $binary_remote_addr zone=openflare_conn_per_ip:10m;",
+		"",
+	}, "\n")
+}
+
 func onOff(value bool) string {
 	if value {
 		return "on"
@@ -796,6 +1020,64 @@ func onOff(value bool) string {
 	return "off"
 }
 
+func normalizeSnapshotCertificateIDs(primaryCertID *uint, certIDs []uint) ([]uint, *uint, error) {
+	candidates := make([]uint, 0, len(certIDs)+1)
+	if primaryCertID != nil && *primaryCertID != 0 {
+		candidates = append(candidates, *primaryCertID)
+	}
+	candidates = append(candidates, certIDs...)
+
+	normalized := make([]uint, 0, len(candidates))
+	seen := make(map[uint]struct{}, len(candidates))
+	for _, certID := range candidates {
+		if certID == 0 {
+			continue
+		}
+		if _, ok := seen[certID]; ok {
+			continue
+		}
+		seen[certID] = struct{}{}
+		normalized = append(normalized, certID)
+	}
+
+	var normalizedPrimary *uint
+	if len(normalized) > 0 {
+		normalizedPrimary = &normalized[0]
+	}
+	return normalized, normalizedPrimary, nil
+}
+
+func normalizeSnapshotDomainCertificateIDs(
+	domains []string,
+	certIDs []uint,
+	domainCertIDs []uint,
+) ([]uint, error) {
+	if len(domainCertIDs) > 0 {
+		if len(domains) > 0 && len(domainCertIDs) != len(domains) {
+			return nil, errors.New("snapshot domain_cert_ids length is invalid")
+		}
+		normalized := make([]uint, len(domainCertIDs))
+		copy(normalized, domainCertIDs)
+		return normalized, nil
+	}
+	if len(certIDs) == 0 {
+		return []uint{}, nil
+	}
+	if len(certIDs) == 1 {
+		normalized := make([]uint, len(domains))
+		for index := range normalized {
+			normalized[index] = certIDs[0]
+		}
+		return normalized, nil
+	}
+	if len(certIDs) == len(domains) {
+		normalized := make([]uint, len(certIDs))
+		copy(normalized, certIDs)
+		return normalized, nil
+	}
+	return []uint{}, nil
+}
+
 func uintPointerEqual(left *uint, right *uint) bool {
 	if left == nil || right == nil {
 		return left == nil && right == nil
@@ -803,6 +1085,18 @@ func uintPointerEqual(left *uint, right *uint) bool {
 	return *left == *right
 }
 
+func uintSliceEqual(left []uint, right []uint) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
+	return true
+}
+
 func checksum(content string) string {
 	sum := sha256.Sum256([]byte(content))
 	return hex.EncodeToString(sum[:])
@@ -836,18 +1130,91 @@ func nextVersionNumber(now time.Time) (string, error) {
 	return fmt.Sprintf("%s-%03d", prefix, count+1), nil
 }
 
-func renderHTTPProxyServer(domain string, originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, upstreamConfig routeUpstreamConfig, cfg openRestyConfigSnapshot) string {
-	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    location / {\n%s%s%s    }\n}\n\n", domain, renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig))
+func renderHTTPProxyServer(serverNames string, originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, cfg openRestyConfigSnapshot) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    location / {\n%s%s%s%s    }\n}\n\n", serverNames, renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig))
 }
 
-func renderHTTPRedirectServer(domain string) string {
-	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    return 301 https://$host$request_uri;\n}\n\n", domain)
+func renderHTTPRedirectServer(serverNames string) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    return 301 https://$host$request_uri;\n}\n\n", serverNames)
 }
 
-func renderHTTPSServer(domain string, originURL string, originHost string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, upstreamConfig routeUpstreamConfig, cfg openRestyConfigSnapshot) string {
+func renderHTTPSServer(serverNames string, originURL string, originHost string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, cfg openRestyConfigSnapshot) string {
 	certPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateCertFileName(certificateID))
 	keyPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateKeyFileName(certificateID))
-	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n\n    location / {\n%s%s%s    }\n}\n\n", domain, certPath, keyPath, renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig))
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n\n    location / {\n%s%s%s%s    }\n}\n\n", serverNames, certPath, keyPath, renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig))
+}
+
+func renderHTTPSServerWithCertificates(serverNames string, originURL string, originHost string, certificateIDs []uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, cfg openRestyConfigSnapshot) string {
+	var certificateBlock strings.Builder
+	for _, certificateID := range certificateIDs {
+		certPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateCertFileName(certificateID))
+		keyPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateKeyFileName(certificateID))
+		certificateBlock.WriteString(fmt.Sprintf("    ssl_certificate %s;\n", certPath))
+		certificateBlock.WriteString(fmt.Sprintf("    ssl_certificate_key %s;\n", keyPath))
+	}
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n%s\n    location / {\n%s%s%s%s    }\n}\n\n", serverNames, certificateBlock.String(), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig))
+}
+
+func renderServerNames(domains []string) string {
+	return strings.Join(domains, " ")
+}
+
+func validateCertificateCoverage(certificate *model.TLSCertificate, domains []string) error {
+	if certificate == nil {
+		return errors.New("certificate is nil")
+	}
+	leaf, err := parseLeafCertificate(certificate.CertPEM)
+	if err != nil {
+		return err
+	}
+	for _, domain := range domains {
+		if err := leaf.VerifyHostname(domain); err != nil {
+			return fmt.Errorf("certificate does not cover domain %s", domain)
+		}
+	}
+	return nil
+}
+
+func validateCertificateCoverageSet(certificates []*model.TLSCertificate, domains []string) error {
+	if len(certificates) == 0 {
+		return errors.New("certificate set is empty")
+	}
+	leaves := make([]interface{ VerifyHostname(string) error }, 0, len(certificates))
+	for _, certificate := range certificates {
+		if certificate == nil {
+			return errors.New("certificate is nil")
+		}
+		leaf, err := parseLeafCertificate(certificate.CertPEM)
+		if err != nil {
+			return err
+		}
+		leaves = append(leaves, leaf)
+	}
+	for _, domain := range domains {
+		covered := false
+		for _, leaf := range leaves {
+			if leaf.VerifyHostname(domain) == nil {
+				covered = true
+				break
+			}
+		}
+		if !covered {
+			return fmt.Errorf("certificate does not cover domain %s", domain)
+		}
+	}
+	return nil
+}
+
+func loadTLSCertificates(certIDs []uint) ([]*model.TLSCertificate, error) {
+	certificates := make([]*model.TLSCertificate, 0, len(certIDs))
+	for _, certID := range certIDs {
+		certificate, err := model.GetTLSCertificateByID(certID)
+		if err != nil {
+			return nil, err
+		}
+		certificates = append(certificates, certificate)
+	}
+	return certificates, nil
 }
 
 func renderConnectionUpgradeMap() string {
@@ -855,7 +1222,22 @@ func renderConnectionUpgradeMap() string {
 }
 
 func renderDefaultServerBlock() string {
-	return "    server {\n        listen 80 default_server;\n        server_name _;\n\n        return 404;\n    }\n\n"
+	return strings.Join([]string{
+		"    server {",
+		"        listen 80 default_server;",
+		"        server_name _;",
+		"",
+		"        return 404;",
+		"    }",
+		"",
+		"    server {",
+		"        listen 443 ssl default_server;",
+		"        server_name _;",
+		"",
+		"        ssl_reject_handshake on;",
+		"    }",
+		"",
+	}, "\n")
 }
 
 func renderProxyHeaderBlock(originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput, upstreamConfig routeUpstreamConfig) string {
@@ -906,6 +1288,23 @@ func renderRouteCacheBlock(cacheConfig routeCacheConfig, cfg openRestyConfigSnap
 	return builder.String()
 }
 
+func renderRouteLimitBlock(limitConfig routeLimitConfig) string {
+	if limitConfig.LimitConnPerServer <= 0 && limitConfig.LimitConnPerIP <= 0 && strings.TrimSpace(limitConfig.LimitRate) == "" {
+		return ""
+	}
+	var builder strings.Builder
+	if limitConfig.LimitConnPerServer > 0 {
+		builder.WriteString(fmt.Sprintf("        limit_conn openflare_conn_per_server %d;\n", limitConfig.LimitConnPerServer))
+	}
+	if limitConfig.LimitConnPerIP > 0 {
+		builder.WriteString(fmt.Sprintf("        limit_conn openflare_conn_per_ip %d;\n", limitConfig.LimitConnPerIP))
+	}
+	if strings.TrimSpace(limitConfig.LimitRate) != "" {
+		builder.WriteString(fmt.Sprintf("        limit_rate %s;\n", limitConfig.LimitRate))
+	}
+	return builder.String()
+}
+
 func renderRouteCachePolicyCondition(cacheConfig routeCacheConfig) string {
 	switch cacheConfig.Policy {
 	case proxyRouteCachePolicySuffix:
@@ -1022,6 +1421,10 @@ func buildUpstreamProxyPassURI(parsed *url.URL) string {
 }
 
 func buildRouteUpstreamName(route *model.ProxyRoute) string {
+	identity := strings.TrimSpace(route.SiteName)
+	if identity == "" {
+		identity = route.Domain
+	}
 	sanitized := strings.Map(func(r rune) rune {
 		switch {
 		case r >= 'a' && r <= 'z':
@@ -1033,7 +1436,7 @@ func buildRouteUpstreamName(route *model.ProxyRoute) string {
 		default:
 			return '_'
 		}
-	}, route.Domain)
+	}, identity)
 	sanitized = strings.Trim(sanitized, "_")
 	if sanitized == "" {
 		sanitized = "backend"

openflare_server/service/database_maintenance.go

@@ -0,0 +1,182 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"openflare/common"
+	"openflare/model"
+	"strings"
+	"time"
+)
+
+const (
+	DatabaseCleanupTargetAccessLogs      = "node_access_logs"
+	DatabaseCleanupTargetMetricSnapshots = "node_metric_snapshots"
+	DatabaseCleanupTargetRequestReports  = "node_request_reports"
+)
+
+var databaseCleanupTargets = map[string]string{
+	DatabaseCleanupTargetAccessLogs:      "访问日志",
+	DatabaseCleanupTargetMetricSnapshots: "性能快照",
+	DatabaseCleanupTargetRequestReports:  "请求聚合",
+}
+
+type DatabaseCleanupInput struct {
+	Target        string `json:"target"`
+	RetentionDays *int   `json:"retention_days"`
+}
+
+type DatabaseCleanupResult struct {
+	Target        string     `json:"target"`
+	TargetLabel   string     `json:"target_label"`
+	DeletedCount  int64      `json:"deleted_count"`
+	DeleteAll     bool       `json:"delete_all"`
+	RetentionDays *int       `json:"retention_days,omitempty"`
+	Cutoff        *time.Time `json:"cutoff,omitempty"`
+}
+
+type DatabaseAutoCleanupSummary struct {
+	RetentionDays int                     `json:"retention_days"`
+	ExecutedAt    time.Time               `json:"executed_at"`
+	Results       []DatabaseCleanupResult `json:"results"`
+}
+
+func CleanupDatabaseObservability(input DatabaseCleanupInput) (*DatabaseCleanupResult, error) {
+	target := strings.TrimSpace(input.Target)
+	targetLabel, ok := databaseCleanupTargets[target]
+	if !ok {
+		return nil, errors.New("unsupported cleanup target")
+	}
+	if input.RetentionDays != nil && *input.RetentionDays <= 0 {
+		return nil, errors.New("retention_days 必须为大于 0 的整数")
+	}
+
+	result := &DatabaseCleanupResult{
+		Target:      target,
+		TargetLabel: targetLabel,
+		DeleteAll:   input.RetentionDays == nil,
+	}
+
+	if input.RetentionDays == nil {
+		deleted, err := deleteAllObservabilityRows(target)
+		if err != nil {
+			return nil, err
+		}
+		result.DeletedCount = deleted
+		return result, nil
+	}
+
+	retentionDays := *input.RetentionDays
+	cutoff := time.Now().UTC().Add(-time.Duration(retentionDays) * 24 * time.Hour)
+	deleted, err := deleteObservabilityRowsBefore(target, cutoff)
+	if err != nil {
+		return nil, err
+	}
+	result.DeletedCount = deleted
+	result.RetentionDays = &retentionDays
+	result.Cutoff = &cutoff
+	return result, nil
+}
+
+func RunDatabaseAutoCleanupOnce(now time.Time) (*DatabaseAutoCleanupSummary, error) {
+	if !common.DatabaseAutoCleanupEnabled {
+		return nil, nil
+	}
+	if common.DatabaseAutoCleanupRetentionDays < 1 {
+		return nil, fmt.Errorf("database auto cleanup retention_days must be at least 1")
+	}
+
+	retentionDays := common.DatabaseAutoCleanupRetentionDays
+	results := make([]DatabaseCleanupResult, 0, len(databaseCleanupTargets))
+	for _, target := range []string{
+		DatabaseCleanupTargetAccessLogs,
+		DatabaseCleanupTargetMetricSnapshots,
+		DatabaseCleanupTargetRequestReports,
+	} {
+		result, err := CleanupDatabaseObservability(DatabaseCleanupInput{
+			Target:        target,
+			RetentionDays: &retentionDays,
+		})
+		if err != nil {
+			return nil, err
+		}
+		results = append(results, *result)
+	}
+
+	return &DatabaseAutoCleanupSummary{
+		RetentionDays: retentionDays,
+		ExecutedAt:    now.UTC(),
+		Results:       results,
+	}, nil
+}
+
+func StartDatabaseAutoCleanupScheduler(ctx context.Context) {
+	go func() {
+		for {
+			wait := time.Until(nextDatabaseAutoCleanupTime(time.Now()))
+			timer := time.NewTimer(wait)
+			select {
+			case <-ctx.Done():
+				timer.Stop()
+				return
+			case <-timer.C:
+			}
+
+			summary, err := RunDatabaseAutoCleanupOnce(time.Now())
+			if err != nil {
+				slog.Error("database auto cleanup failed", "error", err)
+				continue
+			}
+			if summary == nil {
+				continue
+			}
+			totalDeleted := int64(0)
+			for _, item := range summary.Results {
+				totalDeleted += item.DeletedCount
+			}
+			slog.Info(
+				"database auto cleanup completed",
+				"retention_days",
+				summary.RetentionDays,
+				"deleted_count",
+				totalDeleted,
+			)
+		}
+	}()
+}
+
+func nextDatabaseAutoCleanupTime(now time.Time) time.Time {
+	next := time.Date(now.Year(), now.Month(), now.Day(), 3, 0, 0, 0, now.Location())
+	if !next.After(now) {
+		next = next.Add(24 * time.Hour)
+	}
+	return next
+}
+
+func deleteAllObservabilityRows(target string) (int64, error) {
+	switch target {
+	case DatabaseCleanupTargetAccessLogs:
+		return model.DeleteAllNodeAccessLogs(nil)
+	case DatabaseCleanupTargetMetricSnapshots:
+		return model.DeleteAllNodeMetricSnapshots(nil)
+	case DatabaseCleanupTargetRequestReports:
+		return model.DeleteAllNodeRequestReports(nil)
+	default:
+		return 0, errors.New("unsupported cleanup target")
+	}
+}
+
+func deleteObservabilityRowsBefore(target string, cutoff time.Time) (int64, error) {
+	switch target {
+	case DatabaseCleanupTargetAccessLogs:
+		return model.DeleteNodeAccessLogsBefore(cutoff)
+	case DatabaseCleanupTargetMetricSnapshots:
+		return model.DeleteNodeMetricSnapshotsBefore(nil, cutoff)
+	case DatabaseCleanupTargetRequestReports:
+		return model.DeleteNodeRequestReportsBefore(nil, cutoff)
+	default:
+		return 0, errors.New("unsupported cleanup target")
+	}
+}

openflare_server/service/database_maintenance_test.go

@@ -0,0 +1,165 @@
+package service
+
+import (
+	"openflare/common"
+	"openflare/model"
+	"testing"
+	"time"
+)
+
+func TestCleanupDatabaseObservabilityDeletesTargetedRows(t *testing.T) {
+	setupServiceTestDB(t)
+
+	now := time.Now().UTC()
+	if err := model.DB.Create(&model.NodeMetricSnapshot{
+		NodeID:          "node-a",
+		CapturedAt:      now.Add(-10 * 24 * time.Hour),
+		CPUUsagePercent: 10,
+	}).Error; err != nil {
+		t.Fatalf("seed old metric snapshot: %v", err)
+	}
+	if err := model.DB.Create(&model.NodeMetricSnapshot{
+		NodeID:          "node-a",
+		CapturedAt:      now.Add(-12 * time.Hour),
+		CPUUsagePercent: 20,
+	}).Error; err != nil {
+		t.Fatalf("seed recent metric snapshot: %v", err)
+	}
+
+	retentionDays := 7
+	result, err := CleanupDatabaseObservability(DatabaseCleanupInput{
+		Target:        DatabaseCleanupTargetMetricSnapshots,
+		RetentionDays: &retentionDays,
+	})
+	if err != nil {
+		t.Fatalf("CleanupDatabaseObservability failed: %v", err)
+	}
+	if result.DeleteAll {
+		t.Fatal("expected retention cleanup instead of delete_all")
+	}
+	if result.DeletedCount != 1 {
+		t.Fatalf("expected 1 deleted row, got %+v", result)
+	}
+
+	rows, err := model.ListMetricSnapshotsSince(time.Time{})
+	if err != nil {
+		t.Fatalf("ListMetricSnapshotsSince failed: %v", err)
+	}
+	if len(rows) != 1 || rows[0].CPUUsagePercent != 20 {
+		t.Fatalf("unexpected remaining metric snapshots: %+v", rows)
+	}
+}
+
+func TestCleanupDatabaseObservabilityDeletesAllRowsWhenRetentionMissing(t *testing.T) {
+	setupServiceTestDB(t)
+
+	now := time.Now().UTC()
+	if err := model.DB.Create(&model.NodeAccessLog{
+		NodeID:     "node-a",
+		LoggedAt:   now.Add(-3 * time.Hour),
+		RemoteAddr: "203.0.113.1",
+		Host:       "example.com",
+		Path:       "/one",
+		StatusCode: 200,
+	}).Error; err != nil {
+		t.Fatalf("seed first access log: %v", err)
+	}
+	if err := model.DB.Create(&model.NodeAccessLog{
+		NodeID:     "node-a",
+		LoggedAt:   now.Add(-2 * time.Hour),
+		RemoteAddr: "203.0.113.2",
+		Host:       "example.com",
+		Path:       "/two",
+		StatusCode: 502,
+	}).Error; err != nil {
+		t.Fatalf("seed second access log: %v", err)
+	}
+
+	result, err := CleanupDatabaseObservability(DatabaseCleanupInput{
+		Target: DatabaseCleanupTargetAccessLogs,
+	})
+	if err != nil {
+		t.Fatalf("CleanupDatabaseObservability failed: %v", err)
+	}
+	if !result.DeleteAll || result.DeletedCount != 2 {
+		t.Fatalf("unexpected delete-all result: %+v", result)
+	}
+
+	rows, err := model.ListNodeAccessLogs(model.NodeAccessLogQuery{Page: 0, PageSize: 10})
+	if err != nil {
+		t.Fatalf("ListNodeAccessLogs failed: %v", err)
+	}
+	if len(rows) != 0 {
+		t.Fatalf("expected all access logs deleted, got %+v", rows)
+	}
+}
+
+func TestRunDatabaseAutoCleanupOnceDeletesAllObservabilityTargets(t *testing.T) {
+	setupServiceTestDB(t)
+
+	now := time.Now().UTC()
+	if err := model.DB.Create(&model.NodeAccessLog{
+		NodeID:     "node-a",
+		LoggedAt:   now.Add(-48 * time.Hour),
+		RemoteAddr: "203.0.113.10",
+		Host:       "example.com",
+		Path:       "/access",
+		StatusCode: 200,
+	}).Error; err != nil {
+		t.Fatalf("seed access log: %v", err)
+	}
+	if err := model.DB.Create(&model.NodeMetricSnapshot{
+		NodeID:          "node-a",
+		CapturedAt:      now.Add(-48 * time.Hour),
+		CPUUsagePercent: 10,
+	}).Error; err != nil {
+		t.Fatalf("seed metric snapshot: %v", err)
+	}
+	if err := model.DB.Create(&model.NodeRequestReport{
+		NodeID:          "node-a",
+		WindowStartedAt: now.Add(-49 * time.Hour),
+		WindowEndedAt:   now.Add(-48 * time.Hour),
+		RequestCount:    15,
+	}).Error; err != nil {
+		t.Fatalf("seed request report: %v", err)
+	}
+
+	previousEnabled := common.DatabaseAutoCleanupEnabled
+	previousRetentionDays := common.DatabaseAutoCleanupRetentionDays
+	common.DatabaseAutoCleanupEnabled = true
+	common.DatabaseAutoCleanupRetentionDays = 1
+	t.Cleanup(func() {
+		common.DatabaseAutoCleanupEnabled = previousEnabled
+		common.DatabaseAutoCleanupRetentionDays = previousRetentionDays
+	})
+
+	summary, err := RunDatabaseAutoCleanupOnce(now)
+	if err != nil {
+		t.Fatalf("RunDatabaseAutoCleanupOnce failed: %v", err)
+	}
+	if summary == nil || len(summary.Results) != 3 {
+		t.Fatalf("unexpected auto cleanup summary: %+v", summary)
+	}
+
+	accessLogs, err := model.ListNodeAccessLogs(model.NodeAccessLogQuery{Page: 0, PageSize: 10})
+	if err != nil {
+		t.Fatalf("ListNodeAccessLogs failed: %v", err)
+	}
+	if len(accessLogs) != 0 {
+		t.Fatalf("expected auto cleanup to delete access logs, got %+v", accessLogs)
+	}
+	metricSnapshots, err := model.ListMetricSnapshotsSince(time.Time{})
+	if err != nil {
+		t.Fatalf("ListMetricSnapshotsSince failed: %v", err)
+	}
+	if len(metricSnapshots) != 0 {
+		t.Fatalf("expected auto cleanup to delete metric snapshots, got %+v", metricSnapshots)
+	}
+	requestReports, err := model.ListRequestReportsSince(time.Time{})
+	if err != nil {
+		t.Fatalf("ListRequestReportsSince failed: %v", err)
+	}
+	if len(requestReports) != 0 {
+		t.Fatalf("expected auto cleanup to delete request reports, got %+v", requestReports)
+	}
+}

openflare_server/service/https_phase1_test.go

@@ -110,11 +110,34 @@ func TestCreateProxyRouteRejectsHTTPSWithoutCertificate(t *testing.T) {
 		Enabled:     true,
 		EnableHTTPS: true,
 	})
-	if err == nil || !strings.Contains(err.Error(), "必须选择证书") {
+	if err == nil || !strings.Contains(err.Error(), "must select a certificate") {
 		t.Fatalf("expected certificate validation error, got %v", err)
 	}
 }
 
+func TestCreateProxyRouteSupportsWebsiteDomains(t *testing.T) {
+	setupServiceTestDB(t)
+
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		SiteName:  "main-site",
+		Domains:   []string{"app.example.com", "www.example.com"},
+		OriginURL: "https://origin.internal",
+		Enabled:   true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if route.SiteName != "main-site" {
+		t.Fatalf("unexpected site name: %s", route.SiteName)
+	}
+	if route.Domain != "app.example.com" {
+		t.Fatalf("expected primary domain mirror, got %s", route.Domain)
+	}
+	if len(route.Domains) != 2 || route.Domains[1] != "www.example.com" {
+		t.Fatalf("expected domains payload to contain alias, got %#v", route.Domains)
+	}
+}
+
 func TestPublishConfigVersionRendersCustomHeaders(t *testing.T) {
 	setupServiceTestDB(t)
 	if err := model.UpdateOption("OpenRestyWebsocketEnabled", "true"); err != nil {
@@ -180,7 +203,7 @@ func TestCreateProxyRouteRejectsCachePolicyWithoutRules(t *testing.T) {
 		CacheEnabled: true,
 		CachePolicy:  proxyRouteCachePolicySuffix,
 	})
-	if err == nil || !strings.Contains(err.Error(), "至少填写一个后缀") {
+	if err == nil || !strings.Contains(err.Error(), "at least one suffix") {
 		t.Fatalf("expected cache rule validation error, got %v", err)
 	}
 }
@@ -300,6 +323,284 @@ func TestPublishConfigVersionRendersMultipleUpstreams(t *testing.T) {
 	}
 }
 
+func TestPublishConfigVersionRendersMultiDomainWebsite(t *testing.T) {
+	setupServiceTestDB(t)
+
+	certPEM, keyPEM := generateCertificatePair(t, []string{"app.example.com", "www.example.com"})
+	certificate, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "multi-domain",
+		CertPEM: certPEM,
+		KeyPEM:  keyPEM,
+	})
+	if err != nil {
+		t.Fatalf("CreateTLSCertificate failed: %v", err)
+	}
+
+	_, err = CreateProxyRoute(ProxyRouteInput{
+		SiteName:      "marketing-site",
+		Domains:       []string{"app.example.com", "www.example.com"},
+		OriginURL:     "https://origin.internal",
+		Enabled:       true,
+		EnableHTTPS:   true,
+		CertID:        &certificate.ID,
+		RedirectHTTP:  true,
+		CacheEnabled:  true,
+		CachePolicy:   proxyRouteCachePolicyPathPrefix,
+		CacheRules:    []string{"/assets"},
+		CustomHeaders: []ProxyRouteCustomHeaderInput{{Key: "X-Site", Value: "marketing"}},
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	result, err := PublishConfigVersion("root")
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "server_name app.example.com www.example.com;") {
+		t.Fatal("expected rendered config to include all domains in one server_name")
+	}
+	if strings.Contains(result.Version.RenderedConfig, "server_name app.example.com;") {
+		t.Fatal("expected rendered config to avoid standalone primary-domain server block")
+	}
+	if strings.Contains(result.Version.RenderedConfig, "server_name www.example.com;") {
+		t.Fatal("expected rendered config to avoid standalone alias server block")
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"site_name":"marketing-site"`) {
+		t.Fatal("expected snapshot to include site_name")
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"domains":["app.example.com","www.example.com"]`) {
+		t.Fatal("expected snapshot to include domain list")
+	}
+}
+
+func TestPublishConfigVersionRendersMultipleCertificatesForMultiDomainWebsite(t *testing.T) {
+	setupServiceTestDB(t)
+
+	appCertPEM, appKeyPEM := generateCertificatePair(t, []string{"app.example.com"})
+	appCertificate, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "app-only",
+		CertPEM: appCertPEM,
+		KeyPEM:  appKeyPEM,
+	})
+	if err != nil {
+		t.Fatalf("CreateTLSCertificate app-only failed: %v", err)
+	}
+
+	wwwCertPEM, wwwKeyPEM := generateCertificatePair(t, []string{"www.example.com"})
+	wwwCertificate, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "www-only",
+		CertPEM: wwwCertPEM,
+		KeyPEM:  wwwKeyPEM,
+	})
+	if err != nil {
+		t.Fatalf("CreateTLSCertificate www-only failed: %v", err)
+	}
+
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		SiteName:      "marketing-site",
+		Domains:       []string{"app.example.com", "www.example.com"},
+		OriginURL:     "https://origin.internal",
+		Enabled:       true,
+		EnableHTTPS:   true,
+		DomainCertIDs: []uint{appCertificate.ID, wwwCertificate.ID},
+		RedirectHTTP:  true,
+		CacheEnabled:  true,
+		CachePolicy:   proxyRouteCachePolicyPathPrefix,
+		CacheRules:    []string{"/assets"},
+		CustomHeaders: []ProxyRouteCustomHeaderInput{{Key: "X-Site", Value: "marketing"}},
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if route.CertID == nil || *route.CertID != appCertificate.ID {
+		t.Fatalf("expected primary cert mirror to point at first certificate, got %#v", route.CertID)
+	}
+	if len(route.CertIDs) != 2 || route.CertIDs[0] != appCertificate.ID || route.CertIDs[1] != wwwCertificate.ID {
+		t.Fatalf("expected cert_ids to persist in order, got %#v", route.CertIDs)
+	}
+	if len(route.DomainCertIDs) != 2 || route.DomainCertIDs[0] != appCertificate.ID || route.DomainCertIDs[1] != wwwCertificate.ID {
+		t.Fatalf("expected domain_cert_ids to persist per domain, got %#v", route.DomainCertIDs)
+	}
+
+	result, err := PublishConfigVersion("root")
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if strings.Count(result.Version.RenderedConfig, "ssl_certificate __OPENFLARE_CERT_DIR__/") != 2 {
+		t.Fatalf("expected rendered config to include two ssl_certificate directives, got %s", result.Version.RenderedConfig)
+	}
+	if strings.Count(result.Version.RenderedConfig, "ssl_certificate_key __OPENFLARE_CERT_DIR__/") != 2 {
+		t.Fatalf("expected rendered config to include two ssl_certificate_key directives, got %s", result.Version.RenderedConfig)
+	}
+	if !strings.Contains(result.Version.SupportFilesJSON, certificateCertFileName(appCertificate.ID)) {
+		t.Fatal("expected support files to include first certificate")
+	}
+	if !strings.Contains(result.Version.SupportFilesJSON, certificateCertFileName(wwwCertificate.ID)) {
+		t.Fatal("expected support files to include second certificate")
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"cert_ids":[`) {
+		t.Fatal("expected snapshot to include cert_ids")
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"domain_cert_ids":[`) {
+		t.Fatal("expected snapshot to include domain_cert_ids")
+	}
+}
+
+func TestPublishConfigVersionSkipsHTTPSForDomainsWithoutCertificate(t *testing.T) {
+	setupServiceTestDB(t)
+
+	appCertPEM, appKeyPEM := generateCertificatePair(t, []string{"app.example.com"})
+	appCertificate, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "app-only",
+		CertPEM: appCertPEM,
+		KeyPEM:  appKeyPEM,
+	})
+	if err != nil {
+		t.Fatalf("CreateTLSCertificate app-only failed: %v", err)
+	}
+
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		SiteName:      "partial-https-site",
+		Domains:       []string{"app.example.com", "www.example.com"},
+		OriginURL:     "https://origin.internal",
+		Enabled:       true,
+		EnableHTTPS:   true,
+		DomainCertIDs: []uint{appCertificate.ID, 0},
+		RedirectHTTP:  true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if len(route.CertIDs) != 1 || route.CertIDs[0] != appCertificate.ID {
+		t.Fatalf("expected website cert_ids to keep used certificates only, got %#v", route.CertIDs)
+	}
+	if len(route.DomainCertIDs) != 2 || route.DomainCertIDs[0] != appCertificate.ID || route.DomainCertIDs[1] != 0 {
+		t.Fatalf("expected domain_cert_ids to preserve unassigned domains, got %#v", route.DomainCertIDs)
+	}
+
+	result, err := PublishConfigVersion("root")
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if strings.Contains(result.Version.RenderedConfig, "listen 443 ssl;\n    http2 on;\n    server_name app.example.com www.example.com;") {
+		t.Fatal("expected https server block to exclude domains without certificate")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "listen 443 ssl;\n    http2 on;\n    server_name app.example.com;") {
+		t.Fatal("expected https server block to contain only the certified domain")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "listen 80;\n    server_name app.example.com;\n\n    return 301 https://$host$request_uri;") {
+		t.Fatal("expected certified domain to keep http redirect")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "listen 80;\n    server_name www.example.com;") {
+		t.Fatal("expected non-certified domain to stay on plain http")
+	}
+}
+
+func TestDiffConfigVersionTracksAddedDomainWithinWebsite(t *testing.T) {
+	setupServiceTestDB(t)
+
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		SiteName:  "main-site",
+		Domains:   []string{"app.example.com"},
+		OriginURL: "https://origin.internal",
+		Enabled:   true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if _, err := PublishConfigVersion("root"); err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+
+	if _, err := UpdateProxyRoute(route.ID, ProxyRouteInput{
+		SiteName:  "main-site",
+		Domains:   []string{"app.example.com", "www.example.com"},
+		OriginURL: "https://origin.internal",
+		Enabled:   true,
+	}); err != nil {
+		t.Fatalf("UpdateProxyRoute failed: %v", err)
+	}
+
+	diff, err := DiffConfigVersion()
+	if err != nil {
+		t.Fatalf("DiffConfigVersion failed: %v", err)
+	}
+	if len(diff.AddedDomains) != 1 || diff.AddedDomains[0] != "www.example.com" {
+		t.Fatalf("unexpected added domains: %#v", diff.AddedDomains)
+	}
+	if len(diff.ModifiedDomains) != 1 || diff.ModifiedDomains[0] != "app.example.com" {
+		t.Fatalf("unexpected modified domains: %#v", diff.ModifiedDomains)
+	}
+	if len(diff.ModifiedSites) != 1 || diff.ModifiedSites[0] != "main-site" {
+		t.Fatalf("unexpected modified sites: %#v", diff.ModifiedSites)
+	}
+}
+
+func TestCreateProxyRouteRejectsInvalidRateLimitFields(t *testing.T) {
+	setupServiceTestDB(t)
+
+	_, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:             "limit.example.com",
+		OriginURL:          "https://origin.internal",
+		Enabled:            true,
+		LimitConnPerServer: -1,
+	})
+	if err == nil || !strings.Contains(err.Error(), "limit_conn_per_server") {
+		t.Fatalf("expected limit_conn_per_server validation error, got %v", err)
+	}
+
+	_, err = CreateProxyRoute(ProxyRouteInput{
+		Domain:    "limit.example.com",
+		OriginURL: "https://origin.internal",
+		Enabled:   true,
+		LimitRate: "12x",
+	})
+	if err == nil || !strings.Contains(err.Error(), "limit_rate") {
+		t.Fatalf("expected limit_rate validation error, got %v", err)
+	}
+}
+
+func TestPublishConfigVersionRendersRouteRateLimits(t *testing.T) {
+	setupServiceTestDB(t)
+
+	_, err := CreateProxyRoute(ProxyRouteInput{
+		SiteName:           "limited-site",
+		Domains:            []string{"limit.example.com", "www.limit.example.com"},
+		OriginURL:          "https://origin.internal",
+		Enabled:            true,
+		LimitConnPerServer: 120,
+		LimitConnPerIP:     12,
+		LimitRate:          "512K",
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	result, err := PublishConfigVersion("root")
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(result.Version.MainConfig, "limit_conn_zone $server_name zone=openflare_conn_per_server:10m;") {
+		t.Fatal("expected main config to include server limit_conn_zone")
+	}
+	if !strings.Contains(result.Version.MainConfig, "limit_conn_zone $binary_remote_addr zone=openflare_conn_per_ip:10m;") {
+		t.Fatal("expected main config to include ip limit_conn_zone")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "limit_conn openflare_conn_per_server 120;") {
+		t.Fatal("expected rendered config to include per-server limit_conn")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "limit_conn openflare_conn_per_ip 12;") {
+		t.Fatal("expected rendered config to include per-ip limit_conn")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "limit_rate 512k;") {
+		t.Fatal("expected rendered config to include normalized limit_rate")
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"limit_rate":"512k"`) {
+		t.Fatal("expected snapshot to include normalized limit_rate")
+	}
+}
+
 func TestPublishConfigVersionRendersHostnameLoadBalancingUpstream(t *testing.T) {
 	setupServiceTestDB(t)
 
@@ -648,12 +949,18 @@ func TestRenderConfigUsesDefaultServerFallback(t *testing.T) {
 	if !strings.Contains(preview.MainConfig, "listen 80 default_server;") {
 		t.Fatal("expected preview main config to include default http server")
 	}
+	if !strings.Contains(preview.MainConfig, "listen 443 ssl default_server;") {
+		t.Fatal("expected preview main config to include default https server")
+	}
 	if !strings.Contains(preview.MainConfig, "server_name _;") {
 		t.Fatal("expected preview main config to include default server_name")
 	}
 	if !strings.Contains(preview.MainConfig, "return 404;") {
 		t.Fatal("expected preview main config to return 404 for unmatched hosts")
 	}
+	if !strings.Contains(preview.MainConfig, "ssl_reject_handshake on;") {
+		t.Fatal("expected preview main config to reject unmatched https handshakes")
+	}
 }
 
 func TestCreateTLSCertificateRejectsInvalidPEM(t *testing.T) {
@@ -706,6 +1013,12 @@ func TestOpenRestyMainConfigTemplateRenderAndValidate(t *testing.T) {
 	if !strings.Contains(preview.MainConfig, "listen 80 default_server;") {
 		t.Fatal("expected preview main config to preserve managed default server block")
 	}
+	if !strings.Contains(preview.MainConfig, "listen 443 ssl default_server;") {
+		t.Fatal("expected preview main config to preserve managed default https server block")
+	}
+	if !strings.Contains(preview.MainConfig, "ssl_reject_handshake on;") {
+		t.Fatal("expected preview main config to preserve managed https handshake rejection")
+	}
 
 	invalidTemplate := strings.ReplaceAll(
 		common.OpenRestyMainConfigTemplate,

openflare_server/service/node.go

@@ -10,6 +10,7 @@ import (
 	"openflare/common"
 	"openflare/model"
 	"openflare/utils/geoip"
+	"openflare/utils/geoip/iputil"
 	"strings"
 	"time"
 )
@@ -332,6 +333,29 @@ func cloneCoordinate(value *float64) *float64 {
 	return &cloned
 }
 
+func ResolveReportedNodeIP(reportedIP string, remoteAddr string) string {
+	reported := iputil.NormalizeIP(reportedIP)
+	remote := iputil.NormalizeRemoteAddr(remoteAddr)
+	if reported == "" {
+		return remote
+	}
+	if !shouldPreferRemoteNodeIP(reported) {
+		return reported
+	}
+	if isPublicNodeIP(remote) {
+		return remote
+	}
+	return reported
+}
+
+func shouldPreferRemoteNodeIP(ip string) bool {
+	return !isPublicNodeIP(ip)
+}
+
+func isPublicNodeIP(raw string) bool {
+	return iputil.IsPublicString(raw)
+}
+
 func buildNodeAgentReleaseView(node *model.Node, release *githubReleaseResponse, channel ReleaseChannel) *NodeAgentReleaseInfo {
 	currentVersion := strings.TrimSpace(node.AgentVersion)
 	view := &NodeAgentReleaseInfo{
@@ -428,6 +452,9 @@ func validateAgentNodePayload(payload AgentNodePayload) error {
 	if payload.IP == "" {
 		return errors.New("ip 不能为空")
 	}
+	if net.ParseIP(payload.IP) == nil {
+		return errors.New("ip 格式无效")
+	}
 	if payload.AgentVersion == "" {
 		return errors.New("agent_version 不能为空")
 	}

openflare_server/service/node_update_test.go

@@ -1,6 +1,7 @@
 package service
 
 import (
+	"encoding/json"
 	"io"
 	"net"
 	"net/http"
@@ -327,6 +328,27 @@ func TestUpdateNodeCanChangeIPAndAutoResolveGeo(t *testing.T) {
 	}
 }
 
+func TestResolveReportedNodeIPPrefersPublicRemoteAddr(t *testing.T) {
+	resolved := ResolveReportedNodeIP("10.0.0.8", "198.51.100.20:9000")
+	if resolved != "198.51.100.20" {
+		t.Fatalf("expected public remote ip to override private reported ip, got %q", resolved)
+	}
+}
+
+func TestResolveReportedNodeIPKeepsPublicReportedAddr(t *testing.T) {
+	resolved := ResolveReportedNodeIP("8.8.8.8", "198.51.100.20:9000")
+	if resolved != "8.8.8.8" {
+		t.Fatalf("expected reported public ip to be preserved, got %q", resolved)
+	}
+}
+
+func TestResolveReportedNodeIPKeepsPrivateReportedAddrWhenRemoteIsPrivate(t *testing.T) {
+	resolved := ResolveReportedNodeIP("10.0.0.8", "172.16.1.10:9000")
+	if resolved != "10.0.0.8" {
+		t.Fatalf("expected private reported ip to be preserved when remote is also private, got %q", resolved)
+	}
+}
+
 func TestHeartbeatNodeResolvesGeoMetadataFromIPWhenNotManuallyOverridden(t *testing.T) {
 	setupServiceTestDB(t)
 	withFakeGeoIPProvider(t, &geoip.GeoInfo{
@@ -677,6 +699,9 @@ func TestHeartbeatNodePersistsObservabilityPayload(t *testing.T) {
 				Severity:        NodeHealthSeverityCritical,
 				Message:         "reload failed",
 				TriggeredAtUnix: time.Now().Add(-2 * time.Minute).Unix(),
+				Metadata: map[string]string{
+					"source": "runtime",
+				},
 			},
 		},
 	})
@@ -731,6 +756,16 @@ func TestHeartbeatNodePersistsObservabilityPayload(t *testing.T) {
 	if len(events) != 1 || events[0].EventType != "openresty_unhealthy" {
 		t.Fatalf("unexpected active health events: %+v", events)
 	}
+	if events[0].MetadataJSON == "" {
+		t.Fatal("expected metadata_json to persist")
+	}
+	var metadata map[string]string
+	if err := json.Unmarshal([]byte(events[0].MetadataJSON), &metadata); err != nil {
+		t.Fatalf("expected metadata_json to be valid json: %v", err)
+	}
+	if metadata["source"] != "runtime" {
+		t.Fatalf("unexpected metadata json: %+v", metadata)
+	}
 }
 
 func TestHeartbeatNodePersistsBufferedObservabilityPayload(t *testing.T) {
@@ -868,6 +903,15 @@ func TestHeartbeatNodePersistsBufferedObservabilityPayload(t *testing.T) {
 					TopDomains:          map[string]int64{"edge.example.com": 40},
 					SourceCountries:     map[string]int64{"CN": 20},
 				},
+				AccessLogs: []AgentNodeAccessLog{
+					{
+						LoggedAtUnix: now.Add(-110 * time.Second).Unix(),
+						RemoteAddr:   "203.0.113.21",
+						Host:         "edge.example.com",
+						Path:         "/buffered",
+						StatusCode:   200,
+					},
+				},
 			},
 		},
 	})
@@ -889,6 +933,18 @@ func TestHeartbeatNodePersistsBufferedObservabilityPayload(t *testing.T) {
 	if len(reports) != 2 {
 		t.Fatalf("expected replay dedupe to keep report count stable, got %+v", reports)
 	}
+	accessLogs, err = model.ListNodeAccessLogs(model.NodeAccessLogQuery{
+		NodeID:   node.NodeID,
+		Since:    time.Time{},
+		Page:     0,
+		PageSize: 10,
+	})
+	if err != nil {
+		t.Fatalf("expected node access logs query to succeed after replay: %v", err)
+	}
+	if len(accessLogs) != 1 {
+		t.Fatalf("expected replay dedupe to keep access log count stable, got %+v", accessLogs)
+	}
 }
 
 func TestListAccessLogsUsesPagination(t *testing.T) {
@@ -908,7 +964,7 @@ func TestListAccessLogsUsesPagination(t *testing.T) {
 	}
 
 	now := time.Now().UTC()
-	if err := model.DB.Create([]*model.NodeAccessLog{
+	for _, item := range []*model.NodeAccessLog{
 		{
 			NodeID:     node.NodeID,
 			LoggedAt:   now.Add(-10 * time.Second),
@@ -936,8 +992,10 @@ func TestListAccessLogsUsesPagination(t *testing.T) {
 			Path:       "/three",
 			StatusCode: 502,
 		},
-	}).Error; err != nil {
-		t.Fatalf("failed to seed access logs: %v", err)
+	} {
+		if err := model.DB.Create(item).Error; err != nil {
+			t.Fatalf("failed to seed access logs: %v", err)
+		}
 	}
 
 	pageOne, err := ListAccessLogs(AccessLogQuery{
@@ -1404,7 +1462,7 @@ func TestGetDashboardOverview(t *testing.T) {
 	}).Insert(); err != nil {
 		t.Fatalf("failed to insert node b traffic report: %v", err)
 	}
-	if err := model.DB.Create([]*model.NodeAccessLog{
+	for _, item := range []*model.NodeAccessLog{
 		{
 			NodeID:     "node-dashboard-a",
 			LoggedAt:   now.Add(-30 * time.Minute),
@@ -1432,8 +1490,10 @@ func TestGetDashboardOverview(t *testing.T) {
 			Path:       "/edge",
 			StatusCode: 502,
 		},
-	}).Error; err != nil {
-		t.Fatalf("failed to seed dashboard access logs: %v", err)
+	} {
+		if err := model.DB.Create(item).Error; err != nil {
+			t.Fatalf("failed to seed dashboard access logs: %v", err)
+		}
 	}
 
 	if err := model.DB.Create(&model.NodeHealthEvent{

openflare_server/service/observability.go

@@ -18,6 +18,7 @@ const (
 	NodeHealthSeverityWarning     = "warning"
 	NodeHealthSeverityCritical    = "critical"
 	nodeAccessLogRetentionWindow  = nodeAccessLogRetentionDays * 24 * time.Hour
+	nodeAccessLogPathMaxLength    = 100
 )
 
 type AgentNodeSystemProfile struct {
@@ -151,7 +152,6 @@ func persistNodeSystemProfile(tx *gorm.DB, nodeID string, profile *AgentNodeSyst
 		TotalDiskBytes:   profile.TotalDiskBytes,
 		UptimeSeconds:    profile.UptimeSeconds,
 		ReportedAt:       timeFromUnix(profile.ReportedAtUnix, reportedAt),
-		RawJSON:          marshalJSON(profile),
 	}
 	return tx.Model(&model.NodeSystemProfile{}).Where("node_id = ?", nodeID).Assign(record).FirstOrCreate(record).Error
 }
@@ -175,9 +175,15 @@ func persistNodeMetricSnapshot(tx *gorm.DB, nodeID string, snapshot *AgentNodeMe
 		OpenrestyRxBytes:     snapshot.OpenrestyRxBytes,
 		OpenrestyTxBytes:     snapshot.OpenrestyTxBytes,
 		OpenrestyConnections: snapshot.OpenrestyConnections,
-		RawJSON:              marshalJSON(snapshot),
 	}
-	return tx.Where("node_id = ? AND captured_at = ?", nodeID, record.CapturedAt).Assign(record).FirstOrCreate(record).Error
+	exists, err := model.NodeMetricSnapshotExists(tx, nodeID, record.CapturedAt)
+	if err != nil {
+		return err
+	}
+	if exists {
+		return nil
+	}
+	return tx.Create(record).Error
 }
 
 func persistNodeTrafficReport(tx *gorm.DB, nodeID string, report *AgentNodeTrafficReport, reportedAt time.Time) error {
@@ -197,9 +203,15 @@ func persistNodeTrafficReport(tx *gorm.DB, nodeID string, report *AgentNodeTraff
 		StatusCodesJSON:     marshalJSON(report.StatusCodes),
 		TopDomainsJSON:      marshalJSON(report.TopDomains),
 		SourceCountriesJSON: marshalJSON(report.SourceCountries),
-		RawJSON:             marshalJSON(report),
 	}
-	return tx.Where("node_id = ? AND window_started_at = ? AND window_ended_at = ?", nodeID, record.WindowStartedAt, record.WindowEndedAt).Assign(record).FirstOrCreate(record).Error
+	exists, err := model.NodeRequestReportExists(tx, nodeID, record.WindowStartedAt, record.WindowEndedAt)
+	if err != nil {
+		return err
+	}
+	if exists {
+		return nil
+	}
+	return tx.Create(record).Error
 }
 
 func persistNodeAccessLogs(tx *gorm.DB, nodeID string, logs []AgentNodeAccessLog, reportedAt time.Time) error {
@@ -220,26 +232,25 @@ func persistNodeAccessLogs(tx *gorm.DB, nodeID string, logs []AgentNodeAccessLog
 			RemoteAddr: strings.TrimSpace(item.RemoteAddr),
 			Region:     "",
 			Host:       strings.TrimSpace(item.Host),
-			Path:       strings.TrimSpace(item.Path),
+			Path:       truncateForDatabase(strings.TrimSpace(item.Path), nodeAccessLogPathMaxLength),
 			StatusCode: item.StatusCode,
-			RawJSON:    marshalJSON(item),
 		}
 		if resolver != nil {
 			record.Region = resolver.Resolve(record.RemoteAddr)
 		}
-		if err := tx.Where(
-			"node_id = ? AND logged_at = ? AND remote_addr = ? AND host = ? AND path = ? AND status_code = ?",
-			nodeID,
-			record.LoggedAt,
-			record.RemoteAddr,
-			record.Host,
-			record.Path,
-			record.StatusCode,
-		).Assign(record).FirstOrCreate(record).Error; err != nil {
+		exists, err := model.NodeAccessLogExists(tx, record)
+		if err != nil {
+			return err
+		}
+		if exists {
+			continue
+		}
+		if err := tx.Create(record).Error; err != nil {
 			return err
 		}
 	}
-	return tx.Where("node_id = ? AND logged_at < ?", nodeID, reportedAt.Add(-nodeAccessLogRetentionWindow)).Delete(&model.NodeAccessLog{}).Error
+	_, err = model.DeleteNodeAccessLogsByNodeBefore(tx, nodeID, reportedAt.Add(-nodeAccessLogRetentionWindow))
+	return err
 }
 
 func reconcileNodeHealthEvents(tx *gorm.DB, nodeID string, events []AgentNodeHealthEvent, reportedAt time.Time) error {
@@ -274,7 +285,7 @@ func reconcileNodeHealthEvents(tx *gorm.DB, nodeID string, events []AgentNodeHea
 			existing.Message = normalizeHealthEventMessage(event.Message)
 			existing.LastTriggeredAt = triggeredAt
 			existing.ReportedAt = reportedAt
-			existing.RawJSON = marshalJSON(event)
+			existing.MetadataJSON = marshalJSON(event.Metadata)
 			existing.ResolvedAt = nil
 			if err := tx.Save(existing).Error; err != nil {
 				return err
@@ -290,7 +301,7 @@ func reconcileNodeHealthEvents(tx *gorm.DB, nodeID string, events []AgentNodeHea
 			FirstTriggeredAt: triggeredAt,
 			LastTriggeredAt:  triggeredAt,
 			ReportedAt:       reportedAt,
-			RawJSON:          marshalJSON(event),
+			MetadataJSON:     marshalJSON(event.Metadata),
 		}
 		if err := tx.Create(record).Error; err != nil {
 			return err

openflare_server/service/origin.go

@@ -0,0 +1,241 @@
+package service
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"openflare/model"
+	"sort"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+type OriginInput struct {
+	Name    string `json:"name"`
+	Address string `json:"address"`
+	Remark  string `json:"remark"`
+}
+
+type OriginRouteSummary struct {
+	ID        uint   `json:"id"`
+	Domain    string `json:"domain"`
+	OriginURL string `json:"origin_url"`
+	Enabled   bool   `json:"enabled"`
+	UpdatedAt string `json:"updated_at"`
+}
+
+type OriginView struct {
+	ID         uint      `json:"id"`
+	Name       string    `json:"name"`
+	Address    string    `json:"address"`
+	Remark     string    `json:"remark"`
+	RouteCount int64     `json:"route_count"`
+	CreatedAt  time.Time `json:"created_at"`
+	UpdatedAt  time.Time `json:"updated_at"`
+}
+
+type OriginDetailView struct {
+	OriginView
+	Routes []OriginRouteSummary `json:"routes"`
+}
+
+func ListOrigins() ([]OriginView, error) {
+	origins, err := model.ListOrigins()
+	if err != nil {
+		return nil, err
+	}
+	return buildOriginViews(origins)
+}
+
+func GetOriginDetail(id uint) (*OriginDetailView, error) {
+	origin, err := model.GetOriginByID(id)
+	if err != nil {
+		return nil, err
+	}
+	views, err := buildOriginViews([]*model.Origin{origin})
+	if err != nil {
+		return nil, err
+	}
+	routes, err := model.ListProxyRoutesByOriginID(id)
+	if err != nil {
+		return nil, err
+	}
+	items := make([]OriginRouteSummary, 0, len(routes))
+	for _, route := range routes {
+		items = append(items, OriginRouteSummary{
+			ID:        route.ID,
+			Domain:    route.Domain,
+			OriginURL: route.OriginURL,
+			Enabled:   route.Enabled,
+			UpdatedAt: route.UpdatedAt.Format("2006-01-02T15:04:05Z07:00"),
+		})
+	}
+	sort.Slice(items, func(i int, j int) bool {
+		return items[i].Domain < items[j].Domain
+	})
+	detail := &OriginDetailView{
+		OriginView: views[0],
+		Routes:     items,
+	}
+	return detail, nil
+}
+
+func CreateOrigin(input OriginInput) (*model.Origin, error) {
+	origin, err := buildOrigin(nil, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = origin.Insert(); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New("源站地址已存在")
+		}
+		return nil, err
+	}
+	return origin, nil
+}
+
+func UpdateOrigin(id uint, input OriginInput) (*model.Origin, error) {
+	origin, err := model.GetOriginByID(id)
+	if err != nil {
+		return nil, err
+	}
+	previousAddress := origin.Address
+	nextOrigin, err := buildOrigin(origin, input)
+	if err != nil {
+		return nil, err
+	}
+	err = model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Save(nextOrigin).Error; err != nil {
+			if isUniqueConstraintError(err) {
+				return errors.New("源站地址已存在")
+			}
+			return err
+		}
+		if previousAddress == nextOrigin.Address {
+			return nil
+		}
+		return updateRoutesForOriginAddress(tx, nextOrigin.ID, nextOrigin.Address)
+	})
+	if err != nil {
+		return nil, err
+	}
+	return nextOrigin, nil
+}
+
+func DeleteOrigin(id uint) error {
+	routes, err := model.ListProxyRoutesByOriginID(id)
+	if err != nil {
+		return err
+	}
+	if len(routes) > 0 {
+		return errors.New("该源站仍被规则引用，无法删除")
+	}
+	origin, err := model.GetOriginByID(id)
+	if err != nil {
+		return err
+	}
+	return origin.Delete()
+}
+
+func buildOrigin(existing *model.Origin, input OriginInput) (*model.Origin, error) {
+	address := normalizeOriginAddress(input.Address)
+	if err := validateOriginAddress(address); err != nil {
+		return nil, err
+	}
+	if existing == nil {
+		existing = &model.Origin{}
+	}
+	existing.Address = address
+	existing.Name = normalizeOriginName(input.Name, address)
+	existing.Remark = strings.TrimSpace(input.Remark)
+	return existing, nil
+}
+
+func getOrCreateOriginByAddress(address string) (*model.Origin, error) {
+	normalizedAddress := normalizeOriginAddress(address)
+	if err := validateOriginAddress(normalizedAddress); err != nil {
+		return nil, err
+	}
+	existing, err := model.GetOriginByAddress(normalizedAddress)
+	if err == nil {
+		return existing, nil
+	}
+	if !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+	origin := &model.Origin{
+		Name:    normalizedAddress,
+		Address: normalizedAddress,
+		Remark:  "",
+	}
+	if err := origin.Insert(); err != nil {
+		if isUniqueConstraintError(err) {
+			return model.GetOriginByAddress(normalizedAddress)
+		}
+		return nil, err
+	}
+	return origin, nil
+}
+
+func updateRoutesForOriginAddress(tx *gorm.DB, originID uint, address string) error {
+	var routes []*model.ProxyRoute
+	if err := tx.Where("origin_id = ?", originID).Order("id asc").Find(&routes).Error; err != nil {
+		return fmt.Errorf("query routes for origin update failed: %w", err)
+	}
+	for _, route := range routes {
+		rewrittenOriginURL, err := rewriteOriginURLAddress(route.OriginURL, address)
+		if err != nil {
+			return fmt.Errorf("rewrite route %d origin failed: %w", route.ID, err)
+		}
+		upstreams := make([]string, 0)
+		if strings.TrimSpace(route.Upstreams) != "" {
+			if err := json.Unmarshal([]byte(route.Upstreams), &upstreams); err != nil {
+				return fmt.Errorf("decode route %d upstreams failed: %w", route.ID, err)
+			}
+		}
+		if len(upstreams) == 0 {
+			upstreams = append(upstreams, rewrittenOriginURL)
+		} else {
+			upstreams[0] = rewrittenOriginURL
+		}
+		upstreamsJSON, err := json.Marshal(upstreams)
+		if err != nil {
+			return fmt.Errorf("encode route %d upstreams failed: %w", route.ID, err)
+		}
+		if err := tx.Model(&model.ProxyRoute{}).
+			Where("id = ?", route.ID).
+			Updates(map[string]any{
+				"origin_url": rewrittenOriginURL,
+				"upstreams":  string(upstreamsJSON),
+			}).Error; err != nil {
+			return fmt.Errorf("update route %d origin address failed: %w", route.ID, err)
+		}
+	}
+	return nil
+}
+
+func buildOriginViews(origins []*model.Origin) ([]OriginView, error) {
+	countRows, err := model.ListOriginRouteCounts()
+	if err != nil {
+		return nil, err
+	}
+	countMap := make(map[uint]int64, len(countRows))
+	for _, row := range countRows {
+		countMap[row.OriginID] = row.RouteCount
+	}
+	views := make([]OriginView, 0, len(origins))
+	for _, origin := range origins {
+		views = append(views, OriginView{
+			ID:         origin.ID,
+			Name:       origin.Name,
+			Address:    origin.Address,
+			Remark:     origin.Remark,
+			RouteCount: countMap[origin.ID],
+			CreatedAt:  origin.CreatedAt,
+			UpdatedAt:  origin.UpdatedAt,
+		})
+	}
+	return views, nil
+}

openflare_server/service/origin_helpers.go

@@ -0,0 +1,192 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"strconv"
+	"strings"
+	"unicode"
+)
+
+func normalizeOriginAddress(raw string) string {
+	return strings.ToLower(strings.TrimSpace(raw))
+}
+
+func validateOriginAddress(address string) error {
+	if address == "" {
+		return errors.New("源站地址不能为空")
+	}
+	if strings.Contains(address, "://") || strings.ContainsAny(address, "/?#") {
+		return errors.New("源站地址格式不合法")
+	}
+	if strings.HasPrefix(address, "[") || strings.HasSuffix(address, "]") {
+		return errors.New("源站地址无需包含 IPv6 方括号")
+	}
+	if ip := net.ParseIP(address); ip != nil {
+		return nil
+	}
+	if len(address) > 253 {
+		return errors.New("源站地址格式不合法")
+	}
+	labels := strings.Split(address, ".")
+	for _, label := range labels {
+		if len(label) == 0 || len(label) > 63 {
+			return errors.New("源站地址格式不合法")
+		}
+		if label[0] == '-' || label[len(label)-1] == '-' {
+			return errors.New("源站地址格式不合法")
+		}
+		for _, r := range label {
+			if unicode.IsLetter(r) || unicode.IsDigit(r) || r == '-' {
+				continue
+			}
+			return errors.New("源站地址格式不合法")
+		}
+	}
+	return nil
+}
+
+func normalizeOriginName(name string, address string) string {
+	normalized := strings.TrimSpace(name)
+	if normalized != "" {
+		return normalized
+	}
+	return address
+}
+
+func normalizeOriginPort(raw string) (string, error) {
+	port := strings.TrimSpace(raw)
+	if port == "" {
+		return "", errors.New("端口不能为空")
+	}
+	value, err := strconv.Atoi(port)
+	if err != nil || value < 1 || value > 65535 {
+		return "", errors.New("端口格式不合法")
+	}
+	return strconv.Itoa(value), nil
+}
+
+func normalizeOriginScheme(raw string) (string, error) {
+	scheme := strings.ToLower(strings.TrimSpace(raw))
+	switch scheme {
+	case "http", "https":
+		return scheme, nil
+	default:
+		return "", errors.New("源站协议仅支持 http 或 https")
+	}
+}
+
+func normalizeOriginURI(raw string) (string, error) {
+	uri := strings.TrimSpace(raw)
+	if uri == "" {
+		return "", nil
+	}
+	if strings.Contains(uri, "://") {
+		return "", errors.New("源站路径不能包含协议")
+	}
+	if !strings.HasPrefix(uri, "/") && !strings.HasPrefix(uri, "?") {
+		return "", errors.New("源站路径需以 / 或 ? 开头")
+	}
+	return uri, nil
+}
+
+func formatOriginHost(address string, port string) string {
+	if ip := net.ParseIP(address); ip != nil && strings.Contains(address, ":") {
+		return net.JoinHostPort(address, port)
+	}
+	return net.JoinHostPort(address, port)
+}
+
+func buildOriginURLFromParts(
+	scheme string,
+	address string,
+	port string,
+	uri string,
+) (string, error) {
+	normalizedScheme, err := normalizeOriginScheme(scheme)
+	if err != nil {
+		return "", err
+	}
+	normalizedAddress := normalizeOriginAddress(address)
+	if err := validateOriginAddress(normalizedAddress); err != nil {
+		return "", err
+	}
+	normalizedPort, err := normalizeOriginPort(port)
+	if err != nil {
+		return "", err
+	}
+	normalizedURI, err := normalizeOriginURI(uri)
+	if err != nil {
+		return "", err
+	}
+
+	parsed := &url.URL{
+		Scheme: normalizedScheme,
+		Host:   formatOriginHost(normalizedAddress, normalizedPort),
+	}
+	if normalizedURI != "" {
+		if strings.HasPrefix(normalizedURI, "?") {
+			parsed.RawQuery = strings.TrimPrefix(normalizedURI, "?")
+		} else {
+			pathQuery := strings.SplitN(normalizedURI, "?", 2)
+			parsed.Path = pathQuery[0]
+			if len(pathQuery) > 1 {
+				parsed.RawQuery = pathQuery[1]
+			}
+		}
+	}
+	return parsed.String(), nil
+}
+
+func extractOriginAddress(rawURL string) (string, error) {
+	parsed, err := url.ParseRequestURI(strings.TrimSpace(rawURL))
+	if err != nil {
+		return "", fmt.Errorf("源站地址格式不合法: %w", err)
+	}
+	address := normalizeOriginAddress(parsed.Hostname())
+	if err := validateOriginAddress(address); err != nil {
+		return "", err
+	}
+	return address, nil
+}
+
+func rewriteOriginURLAddress(rawURL string, newAddress string) (string, error) {
+	parsed, err := url.ParseRequestURI(strings.TrimSpace(rawURL))
+	if err != nil {
+		return "", fmt.Errorf("源站地址格式不合法: %w", err)
+	}
+	address := normalizeOriginAddress(newAddress)
+	if err := validateOriginAddress(address); err != nil {
+		return "", err
+	}
+	port := parsed.Port()
+	if port == "" {
+		return "", errors.New("源站地址缺少端口")
+	}
+	parsed.Host = formatOriginHost(address, port)
+	return parsed.String(), nil
+}
+
+func splitOriginURL(rawURL string) (scheme string, address string, port string, uri string, err error) {
+	parsed, err := url.ParseRequestURI(strings.TrimSpace(rawURL))
+	if err != nil {
+		return "", "", "", "", err
+	}
+	scheme = parsed.Scheme
+	address = normalizeOriginAddress(parsed.Hostname())
+	port = parsed.Port()
+	uri = parsed.EscapedPath()
+	if uri == "" {
+		uri = parsed.Path
+	}
+	if parsed.RawQuery != "" {
+		if uri == "" {
+			uri = "?" + parsed.RawQuery
+		} else {
+			uri = uri + "?" + parsed.RawQuery
+		}
+	}
+	return scheme, address, port, uri, nil
+}

openflare_server/service/origin_test.go

@@ -0,0 +1,105 @@
+package service
+
+import (
+	"testing"
+
+	"openflare/model"
+)
+
+func TestCreateProxyRouteStructuredOriginAutoCreatesOrigin(t *testing.T) {
+	setupServiceTestDB(t)
+
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:        "app.example.com",
+		OriginScheme:  "https",
+		OriginAddress: "origin.internal",
+		OriginPort:    "8443",
+		Enabled:       true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if route.OriginID == nil || *route.OriginID == 0 {
+		t.Fatal("expected route to be linked with an auto-created origin")
+	}
+	if route.OriginURL != "https://origin.internal:8443" {
+		t.Fatalf("unexpected route origin url: %s", route.OriginURL)
+	}
+
+	origin, err := model.GetOriginByID(*route.OriginID)
+	if err != nil {
+		t.Fatalf("GetOriginByID failed: %v", err)
+	}
+	if origin.Address != "origin.internal" {
+		t.Fatalf("unexpected origin address: %s", origin.Address)
+	}
+}
+
+func TestUpdateOriginRewritesLinkedRouteOriginURL(t *testing.T) {
+	setupServiceTestDB(t)
+
+	origin, err := CreateOrigin(OriginInput{
+		Name:    "primary-origin",
+		Address: "origin-a.internal",
+	})
+	if err != nil {
+		t.Fatalf("CreateOrigin failed: %v", err)
+	}
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:       "app.example.com",
+		OriginID:     &origin.ID,
+		OriginScheme: "https",
+		OriginPort:   "8443",
+		OriginURI:    "/api",
+		Enabled:      true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	updatedOrigin, err := UpdateOrigin(origin.ID, OriginInput{
+		Name:    origin.Name,
+		Address: "origin-c.internal",
+	})
+	if err != nil {
+		t.Fatalf("UpdateOrigin failed: %v", err)
+	}
+	if updatedOrigin.Address != "origin-c.internal" {
+		t.Fatalf("unexpected updated origin address: %s", updatedOrigin.Address)
+	}
+
+	reloadedRoute, err := model.GetProxyRouteByID(route.ID)
+	if err != nil {
+		t.Fatalf("GetProxyRouteByID failed: %v", err)
+	}
+	if reloadedRoute.OriginURL != "https://origin-c.internal:8443/api" {
+		t.Fatalf("expected route origin url to be rewritten, got %s", reloadedRoute.OriginURL)
+	}
+	if reloadedRoute.Upstreams == "" || reloadedRoute.Upstreams == "[]" {
+		t.Fatalf("expected route upstreams to be preserved, got %s", reloadedRoute.Upstreams)
+	}
+}
+
+func TestDeleteOriginRejectsReferencedOrigin(t *testing.T) {
+	setupServiceTestDB(t)
+
+	origin, err := CreateOrigin(OriginInput{
+		Address: "origin-a.internal",
+	})
+	if err != nil {
+		t.Fatalf("CreateOrigin failed: %v", err)
+	}
+	if _, err = CreateProxyRoute(ProxyRouteInput{
+		Domain:       "app.example.com",
+		OriginID:     &origin.ID,
+		OriginScheme: "https",
+		OriginPort:   "443",
+		Enabled:      true,
+	}); err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	if err = DeleteOrigin(origin.ID); err == nil {
+		t.Fatal("expected referenced origin deletion to fail")
+	}
+}

openflare_server/service/proxy_route.go

@@ -3,13 +3,18 @@ package service
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/url"
 	"openflare/model"
 	"regexp"
 	"strings"
+	"time"
+
+	"gorm.io/gorm"
 )
 
 var proxyHeaderKeyPattern = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
+var proxyRouteLimitRatePattern = regexp.MustCompile(`^\d+(?:[kKmM])?$`)
 
 const (
 	proxyRouteCachePolicyURL        = "url"
@@ -24,40 +29,96 @@ type ProxyRouteCustomHeaderInput struct {
 }
 
 type ProxyRouteInput struct {
-	Domain        string                        `json:"domain"`
-	OriginURL     string                        `json:"origin_url"`
-	OriginHost    string                        `json:"origin_host"`
-	Upstreams     []string                      `json:"upstreams"`
-	Enabled       bool                          `json:"enabled"`
-	EnableHTTPS   bool                          `json:"enable_https"`
-	CertID        *uint                         `json:"cert_id"`
-	RedirectHTTP  bool                          `json:"redirect_http"`
-	CacheEnabled  bool                          `json:"cache_enabled"`
-	CachePolicy   string                        `json:"cache_policy"`
-	CacheRules    []string                      `json:"cache_rules"`
-	CustomHeaders []ProxyRouteCustomHeaderInput `json:"custom_headers"`
-	Remark        string                        `json:"remark"`
+	SiteName           string                        `json:"site_name"`
+	Domain             string                        `json:"domain"`
+	Domains            []string                      `json:"domains"`
+	OriginID           *uint                         `json:"origin_id"`
+	OriginURL          string                        `json:"origin_url"`
+	OriginScheme       string                        `json:"origin_scheme"`
+	OriginAddress      string                        `json:"origin_address"`
+	OriginPort         string                        `json:"origin_port"`
+	OriginURI          string                        `json:"origin_uri"`
+	OriginHost         string                        `json:"origin_host"`
+	Upstreams          []string                      `json:"upstreams"`
+	Enabled            bool                          `json:"enabled"`
+	EnableHTTPS        bool                          `json:"enable_https"`
+	CertID             *uint                         `json:"cert_id"`
+	CertIDs            []uint                        `json:"cert_ids"`
+	DomainCertIDs      []uint                        `json:"domain_cert_ids"`
+	RedirectHTTP       bool                          `json:"redirect_http"`
+	LimitConnPerServer int                           `json:"limit_conn_per_server"`
+	LimitConnPerIP     int                           `json:"limit_conn_per_ip"`
+	LimitRate          string                        `json:"limit_rate"`
+	CacheEnabled       bool                          `json:"cache_enabled"`
+	CachePolicy        string                        `json:"cache_policy"`
+	CacheRules         []string                      `json:"cache_rules"`
+	CustomHeaders      []ProxyRouteCustomHeaderInput `json:"custom_headers"`
+	Remark             string                        `json:"remark"`
 }
 
-func ListProxyRoutes() ([]*model.ProxyRoute, error) {
-	return model.ListProxyRoutes()
+type ProxyRouteView struct {
+	ID                 uint                          `json:"id"`
+	SiteName           string                        `json:"site_name"`
+	Domain             string                        `json:"domain"`
+	Domains            []string                      `json:"domains"`
+	PrimaryDomain      string                        `json:"primary_domain"`
+	DomainCount        int                           `json:"domain_count"`
+	OriginID           *uint                         `json:"origin_id"`
+	OriginURL          string                        `json:"origin_url"`
+	OriginHost         string                        `json:"origin_host"`
+	Upstreams          string                        `json:"upstreams"`
+	UpstreamList       []string                      `json:"upstream_list"`
+	Enabled            bool                          `json:"enabled"`
+	EnableHTTPS        bool                          `json:"enable_https"`
+	CertID             *uint                         `json:"cert_id"`
+	CertIDs            []uint                        `json:"cert_ids"`
+	DomainCertIDs      []uint                        `json:"domain_cert_ids"`
+	RedirectHTTP       bool                          `json:"redirect_http"`
+	LimitConnPerServer int                           `json:"limit_conn_per_server"`
+	LimitConnPerIP     int                           `json:"limit_conn_per_ip"`
+	LimitRate          string                        `json:"limit_rate"`
+	CacheEnabled       bool                          `json:"cache_enabled"`
+	CachePolicy        string                        `json:"cache_policy"`
+	CacheRules         string                        `json:"cache_rules"`
+	CacheRuleList      []string                      `json:"cache_rule_list"`
+	CustomHeaders      string                        `json:"custom_headers"`
+	CustomHeaderList   []ProxyRouteCustomHeaderInput `json:"custom_header_list"`
+	Remark             string                        `json:"remark"`
+	CreatedAt          time.Time                     `json:"created_at"`
+	UpdatedAt          time.Time                     `json:"updated_at"`
 }
 
-func CreateProxyRoute(input ProxyRouteInput) (*model.ProxyRoute, error) {
+func ListProxyRoutes() ([]*ProxyRouteView, error) {
+	routes, err := model.ListProxyRoutes()
+	if err != nil {
+		return nil, err
+	}
+	return buildProxyRouteViews(routes)
+}
+
+func GetProxyRoute(id uint) (*ProxyRouteView, error) {
+	route, err := model.GetProxyRouteByID(id)
+	if err != nil {
+		return nil, err
+	}
+	return buildProxyRouteView(route)
+}
+
+func CreateProxyRoute(input ProxyRouteInput) (*ProxyRouteView, error) {
 	route, err := buildProxyRoute(nil, input)
 	if err != nil {
 		return nil, err
 	}
 	if err = route.Insert(); err != nil {
 		if isUniqueConstraintError(err) {
-			return nil, errors.New("域名已存在")
+			return nil, errors.New("proxy route identity already exists")
 		}
 		return nil, err
 	}
-	return route, nil
+	return buildProxyRouteView(route)
 }
 
-func UpdateProxyRoute(id uint, input ProxyRouteInput) (*model.ProxyRoute, error) {
+func UpdateProxyRoute(id uint, input ProxyRouteInput) (*ProxyRouteView, error) {
 	route, err := model.GetProxyRouteByID(id)
 	if err != nil {
 		return nil, err
@@ -68,11 +129,11 @@ func UpdateProxyRoute(id uint, input ProxyRouteInput) (*model.ProxyRoute, error)
 	}
 	if err = route.Update(); err != nil {
 		if isUniqueConstraintError(err) {
-			return nil, errors.New("域名已存在")
+			return nil, errors.New("proxy route identity already exists")
 		}
 		return nil, err
 	}
-	return route, nil
+	return buildProxyRouteView(route)
 }
 
 func DeleteProxyRoute(id uint) error {
@@ -84,8 +145,17 @@ func DeleteProxyRoute(id uint) error {
 }
 
 func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.ProxyRoute, error) {
-	domain := strings.ToLower(strings.TrimSpace(input.Domain))
-	originURL := strings.TrimSpace(input.OriginURL)
+	domains, err := normalizeProxyRouteDomainsInput(route, input.Domain, input.Domains)
+	if err != nil {
+		return nil, err
+	}
+	domain := domains[0]
+	siteName := normalizeProxyRouteSiteNameInput(route, input.SiteName, domain)
+
+	originURL, originID, err := resolveProxyRoutePrimaryOrigin(input)
+	if err != nil {
+		return nil, err
+	}
 	originHost := strings.TrimSpace(input.OriginHost)
 	remark := strings.TrimSpace(input.Remark)
 	upstreams, err := normalizeUpstreams(originURL, input.Upstreams)
@@ -101,6 +171,19 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 	if err != nil {
 		return nil, err
 	}
+	limitConnPerServer, err := normalizeProxyRouteLimitConnValue(input.LimitConnPerServer, "limit_conn_per_server")
+	if err != nil {
+		return nil, err
+	}
+	limitConnPerIP, err := normalizeProxyRouteLimitConnValue(input.LimitConnPerIP, "limit_conn_per_ip")
+	if err != nil {
+		return nil, err
+	}
+	limitRate, err := normalizeProxyRouteLimitRate(input.LimitRate)
+	if err != nil {
+		return nil, err
+	}
+
 	cacheRulesJSON, err := json.Marshal(cacheRules)
 	if err != nil {
 		return nil, err
@@ -113,41 +196,73 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 	if err != nil {
 		return nil, err
 	}
-	if domain == "" {
-		return nil, errors.New("域名不能为空")
+	if !input.EnableHTTPS {
+		input.RedirectHTTP = false
+		input.CertID = nil
+		input.CertIDs = nil
+		input.DomainCertIDs = nil
 	}
-	if strings.Contains(domain, "://") || strings.Contains(domain, "/") {
-		return nil, errors.New("域名格式不合法")
+	domainCertIDs, certIDs, primaryCertID, err := normalizeProxyRouteDomainCertificateIDs(
+		domains,
+		input.EnableHTTPS,
+		input.DomainCertIDs,
+		input.CertID,
+		input.CertIDs,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if err := validateProxyRouteDomainCertificateCoverage(domains, domainCertIDs); err != nil {
+		return nil, err
+	}
+	certIDsJSON, err := json.Marshal(certIDs)
+	if err != nil {
+		return nil, err
+	}
+	domainCertIDsJSON, err := json.Marshal(domainCertIDs)
+	if err != nil {
+		return nil, err
+	}
+	domainsJSON, err := json.Marshal(domains)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := validateProxyRouteSiteName(siteName); err != nil {
+		return nil, err
+	}
+	if err := validateProxyRouteIdentityUniqueness(route, siteName, domains); err != nil {
+		return nil, err
 	}
 	if err := validateOriginHost(originHost); err != nil {
 		return nil, err
 	}
-	if !input.EnableHTTPS {
-		input.RedirectHTTP = false
-		input.CertID = nil
-	}
-	if input.EnableHTTPS {
-		if input.CertID == nil || *input.CertID == 0 {
-			return nil, errors.New("启用 HTTPS 时必须选择证书")
-		}
-		if _, err := model.GetTLSCertificateByID(*input.CertID); err != nil {
-			return nil, errors.New("所选证书不存在")
-		}
-	}
+	input.DomainCertIDs = domainCertIDs
+	input.CertIDs = certIDs
+	input.CertID = primaryCertID
 	if input.RedirectHTTP && !input.EnableHTTPS {
-		return nil, errors.New("仅启用 HTTPS 后才能开启 HTTP 重定向")
+		return nil, errors.New("redirect_http requires enable_https")
 	}
+
 	if route == nil {
 		route = &model.ProxyRoute{}
 	}
+	route.SiteName = siteName
 	route.Domain = domain
+	route.Domains = string(domainsJSON)
+	route.OriginID = originID
 	route.OriginURL = upstreams[0]
 	route.OriginHost = originHost
 	route.Upstreams = string(upstreamsJSON)
 	route.Enabled = input.Enabled
 	route.EnableHTTPS = input.EnableHTTPS
 	route.CertID = input.CertID
+	route.CertIDs = string(certIDsJSON)
+	route.DomainCertIDs = string(domainCertIDsJSON)
 	route.RedirectHTTP = input.RedirectHTTP
+	route.LimitConnPerServer = limitConnPerServer
+	route.LimitConnPerIP = limitConnPerIP
+	route.LimitRate = limitRate
 	route.CacheEnabled = input.CacheEnabled
 	route.CachePolicy = normalizeCachePolicy(input.CacheEnabled, cachePolicy)
 	route.CacheRules = string(cacheRulesJSON)
@@ -156,6 +271,497 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 	return route, nil
 }
 
+func buildProxyRouteViews(routes []*model.ProxyRoute) ([]*ProxyRouteView, error) {
+	views := make([]*ProxyRouteView, 0, len(routes))
+	for _, route := range routes {
+		view, err := buildProxyRouteView(route)
+		if err != nil {
+			return nil, err
+		}
+		views = append(views, view)
+	}
+	return views, nil
+}
+
+func buildProxyRouteView(route *model.ProxyRoute) (*ProxyRouteView, error) {
+	if route == nil {
+		return nil, errors.New("proxy route is nil")
+	}
+	domains, err := decodeStoredDomains(route.Domains, route.Domain)
+	if err != nil {
+		return nil, err
+	}
+	upstreams, err := decodeStoredUpstreams(route.Upstreams, route.OriginURL)
+	if err != nil {
+		return nil, err
+	}
+	cacheRules, err := decodeStoredCacheRules(route.CacheRules)
+	if err != nil {
+		return nil, err
+	}
+	customHeaders, err := decodeStoredCustomHeaders(route.CustomHeaders)
+	if err != nil {
+		return nil, err
+	}
+	certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
+	if err != nil {
+		return nil, err
+	}
+	domainCertIDs, err := resolveProxyRouteDomainCertIDs(route, domains, certIDs)
+	if err != nil {
+		return nil, err
+	}
+	var certID *uint
+	if len(certIDs) > 0 {
+		certID = &certIDs[0]
+	}
+	primaryDomain := domains[0]
+	return &ProxyRouteView{
+		ID:                 route.ID,
+		SiteName:           normalizeProxyRouteSiteNameInput(route, route.SiteName, primaryDomain),
+		Domain:             primaryDomain,
+		Domains:            domains,
+		PrimaryDomain:      primaryDomain,
+		DomainCount:        len(domains),
+		OriginID:           route.OriginID,
+		OriginURL:          route.OriginURL,
+		OriginHost:         route.OriginHost,
+		Upstreams:          route.Upstreams,
+		UpstreamList:       upstreams,
+		Enabled:            route.Enabled,
+		EnableHTTPS:        route.EnableHTTPS,
+		CertID:             certID,
+		CertIDs:            certIDs,
+		DomainCertIDs:      domainCertIDs,
+		RedirectHTTP:       route.RedirectHTTP,
+		LimitConnPerServer: route.LimitConnPerServer,
+		LimitConnPerIP:     route.LimitConnPerIP,
+		LimitRate:          route.LimitRate,
+		CacheEnabled:       route.CacheEnabled,
+		CachePolicy:        route.CachePolicy,
+		CacheRules:         route.CacheRules,
+		CacheRuleList:      cacheRules,
+		CustomHeaders:      route.CustomHeaders,
+		CustomHeaderList:   customHeaders,
+		Remark:             route.Remark,
+		CreatedAt:          route.CreatedAt,
+		UpdatedAt:          route.UpdatedAt,
+	}, nil
+}
+
+func normalizeProxyRouteSiteNameInput(route *model.ProxyRoute, raw string, primaryDomain string) string {
+	siteName := strings.TrimSpace(raw)
+	if siteName != "" {
+		return siteName
+	}
+	if route != nil && strings.TrimSpace(route.SiteName) != "" {
+		return strings.TrimSpace(route.SiteName)
+	}
+	return primaryDomain
+}
+
+func normalizeProxyRouteDomainValue(raw string) string {
+	return strings.ToLower(strings.TrimSpace(raw))
+}
+
+func normalizeProxyRouteDomainsInput(route *model.ProxyRoute, rawDomain string, rawDomains []string) ([]string, error) {
+	if len(rawDomains) > 0 {
+		domains, err := normalizeProxyRouteDomains(rawDomains)
+		if err != nil {
+			return nil, err
+		}
+		domain := normalizeProxyRouteDomainValue(rawDomain)
+		if domain != "" && domain != domains[0] {
+			return nil, errors.New("domain must match domains[0]")
+		}
+		return domains, nil
+	}
+
+	if route != nil {
+		existingDomains, err := decodeStoredDomains(route.Domains, route.Domain)
+		if err == nil && len(existingDomains) > 0 {
+			domain := normalizeProxyRouteDomainValue(rawDomain)
+			if domain == "" || domain == existingDomains[0] {
+				return existingDomains, nil
+			}
+		}
+	}
+
+	return normalizeProxyRouteDomains([]string{rawDomain})
+}
+
+func normalizeProxyRouteDomains(rawDomains []string) ([]string, error) {
+	normalized := make([]string, 0, len(rawDomains))
+	seen := make(map[string]struct{}, len(rawDomains))
+	for _, rawDomain := range rawDomains {
+		domain := normalizeProxyRouteDomainValue(rawDomain)
+		if domain == "" {
+			continue
+		}
+		if strings.Contains(domain, "://") || strings.Contains(domain, "/") {
+			return nil, errors.New("domain format is invalid")
+		}
+		if _, ok := seen[domain]; ok {
+			continue
+		}
+		seen[domain] = struct{}{}
+		normalized = append(normalized, domain)
+	}
+	if len(normalized) == 0 {
+		return nil, errors.New("at least one domain is required")
+	}
+	return normalized, nil
+}
+
+func validateProxyRouteSiteName(siteName string) error {
+	if strings.TrimSpace(siteName) == "" {
+		return errors.New("site_name cannot be empty")
+	}
+	return nil
+}
+
+func validateProxyRouteIdentityUniqueness(route *model.ProxyRoute, siteName string, domains []string) error {
+	routes, err := model.ListProxyRoutes()
+	if err != nil {
+		return err
+	}
+
+	currentID := uint(0)
+	if route != nil {
+		currentID = route.ID
+	}
+
+	for _, item := range routes {
+		if item == nil || item.ID == currentID {
+			continue
+		}
+		existingSiteName := normalizeProxyRouteSiteNameInput(item, item.SiteName, item.Domain)
+		if existingSiteName == siteName {
+			return errors.New("site_name already exists")
+		}
+
+		existingDomains, err := decodeStoredDomains(item.Domains, item.Domain)
+		if err != nil {
+			return fmt.Errorf("existing route %d domains are invalid: %w", item.ID, err)
+		}
+		existingSet := make(map[string]struct{}, len(existingDomains))
+		for _, existingDomain := range existingDomains {
+			existingSet[existingDomain] = struct{}{}
+		}
+		for _, domain := range domains {
+			if _, ok := existingSet[domain]; ok {
+				return fmt.Errorf("domain %s already exists", domain)
+			}
+		}
+	}
+
+	return nil
+}
+
+func normalizeProxyRouteLimitConnValue(value int, field string) (int, error) {
+	if value < 0 {
+		return 0, fmt.Errorf("%s must be greater than or equal to 0", field)
+	}
+	return value, nil
+}
+
+func normalizeProxyRouteCertificateIDs(enableHTTPS bool, certID *uint, certIDs []uint) ([]uint, error) {
+	if !enableHTTPS {
+		return []uint{}, nil
+	}
+
+	candidates := make([]uint, 0, len(certIDs)+1)
+	if certID != nil && *certID != 0 {
+		candidates = append(candidates, *certID)
+	}
+	candidates = append(candidates, certIDs...)
+
+	normalized := make([]uint, 0, len(candidates))
+	seen := make(map[uint]struct{}, len(candidates))
+	for _, item := range candidates {
+		if item == 0 {
+			continue
+		}
+		if _, ok := seen[item]; ok {
+			continue
+		}
+		if _, err := model.GetTLSCertificateByID(item); err != nil {
+			return nil, errors.New("selected certificate does not exist")
+		}
+		seen[item] = struct{}{}
+		normalized = append(normalized, item)
+	}
+	if len(normalized) == 0 {
+		return nil, errors.New("must select a certificate when HTTPS is enabled")
+	}
+	return normalized, nil
+}
+
+func normalizeProxyRouteDomainCertificateIDs(
+	domains []string,
+	enableHTTPS bool,
+	rawDomainCertIDs []uint,
+	certID *uint,
+	certIDs []uint,
+) ([]uint, []uint, *uint, error) {
+	if !enableHTTPS {
+		return []uint{}, []uint{}, nil, nil
+	}
+
+	if len(rawDomainCertIDs) > 0 {
+		if len(rawDomainCertIDs) != len(domains) {
+			return nil, nil, nil, errors.New("domain_cert_ids must match domains length")
+		}
+
+		normalizedDomainCertIDs := make([]uint, len(rawDomainCertIDs))
+		uniqueCertIDs := make([]uint, 0, len(rawDomainCertIDs))
+		seen := make(map[uint]struct{}, len(rawDomainCertIDs))
+		hasAssignedCertificate := false
+		for index, item := range rawDomainCertIDs {
+			if item == 0 {
+				continue
+			}
+			if _, err := model.GetTLSCertificateByID(item); err != nil {
+				return nil, nil, nil, errors.New("selected certificate does not exist")
+			}
+			normalizedDomainCertIDs[index] = item
+			hasAssignedCertificate = true
+			if _, ok := seen[item]; ok {
+				continue
+			}
+			seen[item] = struct{}{}
+			uniqueCertIDs = append(uniqueCertIDs, item)
+		}
+		if !hasAssignedCertificate {
+			return nil, nil, nil, errors.New("must select a certificate when HTTPS is enabled")
+		}
+
+		primaryCertID := &uniqueCertIDs[0]
+		return normalizedDomainCertIDs, uniqueCertIDs, primaryCertID, nil
+	}
+
+	normalizedCertIDs, err := normalizeProxyRouteCertificateIDs(
+		enableHTTPS,
+		certID,
+		certIDs,
+	)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	switch {
+	case len(normalizedCertIDs) == 0:
+		return nil, nil, nil, errors.New("must select a certificate when HTTPS is enabled")
+	case len(normalizedCertIDs) == 1:
+		domainCertIDs := make([]uint, len(domains))
+		for index := range domainCertIDs {
+			domainCertIDs[index] = normalizedCertIDs[0]
+		}
+		primaryCertID := &normalizedCertIDs[0]
+		return domainCertIDs, normalizedCertIDs, primaryCertID, nil
+	case len(normalizedCertIDs) == len(domains):
+		domainCertIDs := make([]uint, len(normalizedCertIDs))
+		copy(domainCertIDs, normalizedCertIDs)
+		primaryCertID := &normalizedCertIDs[0]
+		return domainCertIDs, normalizedCertIDs, primaryCertID, nil
+	default:
+		domainCertIDs, err := deriveDomainCertIDsFromCertificateSet(
+			domains,
+			normalizedCertIDs,
+		)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		primaryCertID := &normalizedCertIDs[0]
+		return domainCertIDs, normalizedCertIDs, primaryCertID, nil
+	}
+}
+
+func validateProxyRouteDomainCertificateCoverage(
+	domains []string,
+	domainCertIDs []uint,
+) error {
+	if len(domainCertIDs) == 0 {
+		return nil
+	}
+
+	domainsByCertID := make(map[uint][]string)
+	for index, certID := range domainCertIDs {
+		if certID == 0 {
+			continue
+		}
+		domainsByCertID[certID] = append(domainsByCertID[certID], domains[index])
+	}
+
+	for certID, assignedDomains := range domainsByCertID {
+		certificate, err := model.GetTLSCertificateByID(certID)
+		if err != nil {
+			return errors.New("selected certificate does not exist")
+		}
+		if err := validateCertificateCoverage(certificate, assignedDomains); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func deriveDomainCertIDsFromCertificateSet(
+	domains []string,
+	certIDs []uint,
+) ([]uint, error) {
+	certificates, err := loadTLSCertificates(certIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	result := make([]uint, len(domains))
+	for domainIndex, domain := range domains {
+		if domainIndex < len(certificates) &&
+			certificates[domainIndex] != nil &&
+			validateCertificateCoverage(certificates[domainIndex], []string{domain}) == nil {
+			result[domainIndex] = certificates[domainIndex].ID
+			continue
+		}
+
+		assigned := uint(0)
+		for _, certificate := range certificates {
+			if certificate != nil &&
+				validateCertificateCoverage(certificate, []string{domain}) == nil {
+				assigned = certificate.ID
+				break
+			}
+		}
+		if assigned == 0 {
+			return nil, fmt.Errorf("certificate does not cover domain %s", domain)
+		}
+		result[domainIndex] = assigned
+	}
+	return result, nil
+}
+
+func decodeStoredDomainCertIDs(raw string, domainCount int) ([]uint, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return []uint{}, nil
+	}
+
+	var domainCertIDs []uint
+	if err := json.Unmarshal([]byte(text), &domainCertIDs); err != nil {
+		return nil, errors.New("domain_cert_ids payload is invalid")
+	}
+	if len(domainCertIDs) == 0 {
+		return []uint{}, nil
+	}
+	if domainCount > 0 && len(domainCertIDs) != domainCount {
+		return nil, errors.New("domain_cert_ids length does not match domains")
+	}
+
+	normalized := make([]uint, len(domainCertIDs))
+	copy(normalized, domainCertIDs)
+	return normalized, nil
+}
+
+func resolveProxyRouteDomainCertIDs(
+	route *model.ProxyRoute,
+	domains []string,
+	certIDs []uint,
+) ([]uint, error) {
+	domainCertIDs, err := decodeStoredDomainCertIDs(route.DomainCertIDs, len(domains))
+	if err != nil {
+		return nil, err
+	}
+	if len(domainCertIDs) > 0 || len(certIDs) == 0 {
+		return domainCertIDs, nil
+	}
+	return deriveDomainCertIDsFromCertificateSet(domains, certIDs)
+}
+
+func normalizeProxyRouteLimitRate(raw string) (string, error) {
+	normalized := strings.ToLower(strings.TrimSpace(raw))
+	if normalized == "" || normalized == "0" {
+		return "", nil
+	}
+	if !proxyRouteLimitRatePattern.MatchString(normalized) {
+		return "", errors.New("limit_rate must be a number or use the 512k / 1m format")
+	}
+	if strings.TrimRight(normalized, "km") == "" {
+		return "", nil
+	}
+	return normalized, nil
+}
+
+func resolveProxyRoutePrimaryOrigin(input ProxyRouteInput) (string, *uint, error) {
+	if hasStructuredOriginInput(input) {
+		scheme, err := normalizeOriginScheme(input.OriginScheme)
+		if err != nil {
+			return "", nil, err
+		}
+		port, err := normalizeOriginPort(input.OriginPort)
+		if err != nil {
+			return "", nil, err
+		}
+		uri, err := normalizeOriginURI(input.OriginURI)
+		if err != nil {
+			return "", nil, err
+		}
+		if input.OriginID != nil && *input.OriginID != 0 {
+			origin, err := model.GetOriginByID(*input.OriginID)
+			if err != nil {
+				return "", nil, errors.New("selected origin does not exist")
+			}
+			originURL, err := buildOriginURLFromParts(
+				scheme,
+				origin.Address,
+				port,
+				uri,
+			)
+			if err != nil {
+				return "", nil, err
+			}
+			return originURL, &origin.ID, nil
+		}
+
+		address := normalizeOriginAddress(input.OriginAddress)
+		if err := validateOriginAddress(address); err != nil {
+			return "", nil, err
+		}
+		originURL, err := buildOriginURLFromParts(scheme, address, port, uri)
+		if err != nil {
+			return "", nil, err
+		}
+		origin, err := getOrCreateOriginByAddress(address)
+		if err != nil {
+			return "", nil, err
+		}
+		return originURL, &origin.ID, nil
+	}
+
+	originURL := strings.TrimSpace(input.OriginURL)
+	if originURL == "" {
+		return "", nil, errors.New("origin_url cannot be empty")
+	}
+	address, err := extractOriginAddress(originURL)
+	if err != nil {
+		return "", nil, err
+	}
+	origin, findErr := model.GetOriginByAddress(address)
+	if findErr == nil {
+		return originURL, &origin.ID, nil
+	}
+	if !errors.Is(findErr, gorm.ErrRecordNotFound) {
+		return "", nil, findErr
+	}
+	return originURL, nil, nil
+}
+
+func hasStructuredOriginInput(input ProxyRouteInput) bool {
+	return (input.OriginID != nil && *input.OriginID != 0) ||
+		strings.TrimSpace(input.OriginScheme) != "" ||
+		strings.TrimSpace(input.OriginAddress) != "" ||
+		strings.TrimSpace(input.OriginPort) != "" ||
+		strings.TrimSpace(input.OriginURI) != ""
+}
+
 func normalizeCustomHeaders(headers []ProxyRouteCustomHeaderInput) ([]ProxyRouteCustomHeaderInput, error) {
 	if len(headers) == 0 {
 		return []ProxyRouteCustomHeaderInput{}, nil
@@ -168,13 +774,13 @@ func normalizeCustomHeaders(headers []ProxyRouteCustomHeaderInput) ([]ProxyRoute
 			continue
 		}
 		if key == "" {
-			return nil, errors.New("自定义请求头名称不能为空")
+			return nil, errors.New("custom header key cannot be empty")
 		}
 		if !proxyHeaderKeyPattern.MatchString(key) {
-			return nil, errors.New("自定义请求头名称格式不合法")
+			return nil, errors.New("custom header key format is invalid")
 		}
 		if strings.ContainsAny(key, "\r\n") || strings.ContainsAny(value, "\r\n") {
-			return nil, errors.New("自定义请求头不能包含换行")
+			return nil, errors.New("custom headers cannot contain newlines")
 		}
 		normalized = append(normalized, ProxyRouteCustomHeaderInput{
 			Key:   key,
@@ -216,23 +822,23 @@ func normalizeUpstreams(originURL string, upstreams []string) ([]string, error)
 		}
 		parsed, err := url.ParseRequestURI(item)
 		if err != nil {
-			return nil, errors.New("源站地址格式不合法")
+			return nil, errors.New("origin URL format is invalid")
 		}
 		if multiUpstream && parsed.Path != "" && parsed.Path != "/" {
-			return nil, errors.New("多上游模式暂不支持带路径的源站地址")
+			return nil, errors.New("multi-upstream mode does not support origin paths")
 		}
 		if multiUpstream && parsed.RawQuery != "" {
-			return nil, errors.New("多上游模式暂不支持带查询参数的源站地址")
+			return nil, errors.New("multi-upstream mode does not support origin query strings")
 		}
 		if scheme == "" {
 			scheme = parsed.Scheme
 		} else if scheme != parsed.Scheme {
-			return nil, errors.New("同一规则的多个上游必须使用相同协议")
+			return nil, errors.New("all upstreams must use the same scheme")
 		}
 		normalized = append(normalized, item)
 	}
 	if len(normalized) == 0 {
-		return nil, errors.New("至少填写一个上游地址")
+		return nil, errors.New("at least one upstream is required")
 	}
 	return normalized, nil
 }
@@ -244,7 +850,7 @@ func decodeStoredCustomHeaders(raw string) ([]ProxyRouteCustomHeaderInput, error
 	}
 	var headers []ProxyRouteCustomHeaderInput
 	if err := json.Unmarshal([]byte(text), &headers); err != nil {
-		return nil, errors.New("自定义请求头配置格式不合法")
+		return nil, errors.New("custom_headers payload is invalid")
 	}
 	return normalizeCustomHeaders(headers)
 }
@@ -275,7 +881,7 @@ func normalizeCacheRules(enabled bool, rawPolicy string, rules []string) ([]stri
 	case proxyRouteCachePolicyPathExact:
 		return normalizeCachePathRules(rules, false)
 	default:
-		return nil, errors.New("缓存策略不支持")
+		return nil, errors.New("cache policy is not supported")
 	}
 }
 
@@ -288,7 +894,7 @@ func normalizeCacheSuffixRules(rules []string) ([]string, error) {
 			continue
 		}
 		if strings.ContainsAny(item, "/\\ \t\r\n") {
-			return nil, errors.New("缓存后缀格式不合法")
+			return nil, errors.New("cache suffix format is invalid")
 		}
 		if _, ok := seen[item]; ok {
 			continue
@@ -297,7 +903,7 @@ func normalizeCacheSuffixRules(rules []string) ([]string, error) {
 		normalized = append(normalized, item)
 	}
 	if len(normalized) == 0 {
-		return nil, errors.New("按后缀缓存时至少填写一个后缀")
+		return nil, errors.New("at least one suffix is required")
 	}
 	return normalized, nil
 }
@@ -311,7 +917,7 @@ func normalizeCachePathRules(rules []string, allowPrefix bool) ([]string, error)
 			continue
 		}
 		if !strings.HasPrefix(item, "/") || strings.Contains(item, "://") || strings.ContainsAny(item, " \t\r\n") {
-			return nil, errors.New("缓存路径规则格式不合法")
+			return nil, errors.New("cache path rule format is invalid")
 		}
 		if !allowPrefix && strings.HasSuffix(item, "/") && len(item) > 1 {
 			item = strings.TrimRight(item, "/")
@@ -324,9 +930,9 @@ func normalizeCachePathRules(rules []string, allowPrefix bool) ([]string, error)
 	}
 	if len(normalized) == 0 {
 		if allowPrefix {
-			return nil, errors.New("按路径前缀缓存时至少填写一个路径")
+			return nil, errors.New("at least one path prefix is required")
 		}
-		return nil, errors.New("按精确路径缓存时至少填写一个路径")
+		return nil, errors.New("at least one exact path is required")
 	}
 	return normalized, nil
 }
@@ -338,7 +944,7 @@ func decodeStoredCacheRules(raw string) ([]string, error) {
 	}
 	var rules []string
 	if err := json.Unmarshal([]byte(text), &rules); err != nil {
-		return nil, errors.New("缓存规则格式不合法")
+		return nil, errors.New("cache_rules payload is invalid")
 	}
 	normalized := make([]string, 0, len(rules))
 	for _, rule := range rules {
@@ -358,24 +964,66 @@ func decodeStoredUpstreams(raw string, fallbackOriginURL string) ([]string, erro
 	}
 	var upstreams []string
 	if err := json.Unmarshal([]byte(text), &upstreams); err != nil {
-		return nil, errors.New("上游配置格式不合法")
+		return nil, errors.New("upstreams payload is invalid")
 	}
 	return normalizeUpstreams(fallbackOriginURL, upstreams)
 }
 
+func decodeStoredDomains(raw string, fallbackDomain string) ([]string, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return normalizeProxyRouteDomains([]string{fallbackDomain})
+	}
+	var domains []string
+	if err := json.Unmarshal([]byte(text), &domains); err != nil {
+		return nil, errors.New("domains payload is invalid")
+	}
+	return normalizeProxyRouteDomains(domains)
+}
+
+func decodeStoredCertIDs(raw string, fallbackCertID *uint) ([]uint, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		if fallbackCertID == nil || *fallbackCertID == 0 {
+			return []uint{}, nil
+		}
+		return []uint{*fallbackCertID}, nil
+	}
+	var certIDs []uint
+	if err := json.Unmarshal([]byte(text), &certIDs); err != nil {
+		return nil, errors.New("cert_ids payload is invalid")
+	}
+	normalized := make([]uint, 0, len(certIDs))
+	seen := make(map[uint]struct{}, len(certIDs))
+	for _, certID := range certIDs {
+		if certID == 0 {
+			continue
+		}
+		if _, ok := seen[certID]; ok {
+			continue
+		}
+		seen[certID] = struct{}{}
+		normalized = append(normalized, certID)
+	}
+	if len(normalized) == 0 && fallbackCertID != nil && *fallbackCertID != 0 {
+		return []uint{*fallbackCertID}, nil
+	}
+	return normalized, nil
+}
+
 func validateOriginURL(raw string) error {
 	if raw == "" {
-		return errors.New("源站地址不能为空")
+		return errors.New("origin URL cannot be empty")
 	}
 	parsed, err := url.ParseRequestURI(raw)
 	if err != nil {
-		return errors.New("源站地址格式不合法")
+		return errors.New("origin URL format is invalid")
 	}
 	if parsed.Scheme != "http" && parsed.Scheme != "https" {
-		return errors.New("源站地址必须以 http:// 或 https:// 开头")
+		return errors.New("origin URL must start with http:// or https://")
 	}
 	if parsed.Host == "" {
-		return errors.New("源站地址格式不合法")
+		return errors.New("origin URL format is invalid")
 	}
 	return nil
 }
@@ -385,14 +1033,14 @@ func validateOriginHost(raw string) error {
 		return nil
 	}
 	if strings.ContainsAny(raw, "/\\ \t\r\n") || strings.Contains(raw, "://") {
-		return errors.New("回源主机名格式不合法")
+		return errors.New("origin_host format is invalid")
 	}
 	parsed, err := url.Parse("//" + raw)
 	if err != nil || parsed.Host == "" || parsed.Host != raw {
-		return errors.New("回源主机名格式不合法")
+		return errors.New("origin_host format is invalid")
 	}
 	if parsed.Hostname() == "" {
-		return errors.New("回源主机名格式不合法")
+		return errors.New("origin_host format is invalid")
 	}
 	return nil
 }

openflare_server/service/tls_certificate.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"crypto/tls"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"mime/multipart"
@@ -54,7 +55,7 @@ func CreateTLSCertificate(input TLSCertificateInput) (*model.TLSCertificate, err
 	}
 	if err = certificate.Insert(); err != nil {
 		if isUniqueConstraintError(err) {
-			return nil, errors.New("证书名称已存在")
+			return nil, errors.New("certificate name already exists")
 		}
 		return nil, err
 	}
@@ -63,7 +64,7 @@ func CreateTLSCertificate(input TLSCertificateInput) (*model.TLSCertificate, err
 
 func CreateTLSCertificateFromFiles(name string, certFile *multipart.FileHeader, keyFile *multipart.FileHeader, remark string) (*model.TLSCertificate, error) {
 	if certFile == nil || keyFile == nil {
-		return nil, errors.New("证书文件和私钥文件不能为空")
+		return nil, errors.New("certificate file and key file cannot be empty")
 	}
 	certContent, err := readMultipartFile(certFile)
 	if err != nil {
@@ -101,13 +102,40 @@ func UpdateTLSCertificate(id uint, input TLSCertificateInput) (*model.TLSCertifi
 }
 
 func DeleteTLSCertificate(id uint) error {
-	var routeCount int64
-	if err := model.DB.Model(&model.ProxyRoute{}).Where("cert_id = ?", id).Count(&routeCount).Error; err != nil {
+	routes, err := model.ListProxyRoutes()
+	if err != nil {
 		return err
 	}
-	if routeCount > 0 {
-		return errors.New("证书仍被反代规则引用，无法删除")
+	for _, route := range routes {
+		if route == nil {
+			continue
+		}
+		if route.CertID != nil && *route.CertID == id {
+			return errors.New("certificate is still referenced by proxy routes")
+		}
+		if strings.TrimSpace(route.CertIDs) == "" {
+			continue
+		}
+		var certIDs []uint
+		if err := json.Unmarshal([]byte(route.CertIDs), &certIDs); err != nil {
+			return fmt.Errorf("proxy route %d cert_ids payload is invalid: %w", route.ID, err)
+		}
+		for _, certID := range certIDs {
+			if certID == id {
+				return errors.New("certificate is still referenced by proxy routes")
+			}
+		}
+		domainCertIDs, err := decodeStoredDomainCertIDs(route.DomainCertIDs, 0)
+		if err != nil {
+			return fmt.Errorf("proxy route %d domain_cert_ids payload is invalid: %w", route.ID, err)
+		}
+		for _, certID := range domainCertIDs {
+			if certID == id {
+				return errors.New("certificate is still referenced by proxy routes")
+			}
+		}
 	}
+
 	certificate, err := model.GetTLSCertificateByID(id)
 	if err != nil {
 		return err
@@ -121,17 +149,17 @@ func buildTLSCertificate(existing *model.TLSCertificate, input TLSCertificateInp
 	keyPEM := strings.TrimSpace(input.KeyPEM)
 	remark := strings.TrimSpace(input.Remark)
 	if name == "" {
-		return nil, errors.New("证书名称不能为空")
+		return nil, errors.New("certificate name cannot be empty")
 	}
 	if certPEM == "" || keyPEM == "" {
-		return nil, errors.New("证书内容和私钥内容不能为空")
+		return nil, errors.New("certificate content and key content cannot be empty")
 	}
 	parsed, err := tls.X509KeyPair([]byte(certPEM), []byte(keyPEM))
 	if err != nil {
-		return nil, fmt.Errorf("证书或私钥格式不合法: %w", err)
+		return nil, fmt.Errorf("certificate or key format is invalid: %w", err)
 	}
 	if len(parsed.Certificate) == 0 {
-		return nil, errors.New("证书内容不合法")
+		return nil, errors.New("certificate content is invalid")
 	}
 	leaf, err := parseLeafCertificate(certPEM)
 	if err != nil {

openflare_server/utils/geoip/iputil/iputil.go

@@ -0,0 +1,66 @@
+package iputil
+
+import (
+	"net"
+	"strings"
+)
+
+func NormalizeIP(raw string) string {
+	trimmed := strings.TrimSpace(raw)
+	if trimmed == "" {
+		return ""
+	}
+	ip := net.ParseIP(trimmed)
+	if ip == nil {
+		return ""
+	}
+	if ipv4 := ip.To4(); ipv4 != nil {
+		return ipv4.String()
+	}
+	return ip.String()
+}
+
+func NormalizeRemoteAddr(remoteAddr string) string {
+	trimmed := strings.TrimSpace(remoteAddr)
+	if trimmed == "" {
+		return ""
+	}
+	if host, _, err := net.SplitHostPort(trimmed); err == nil {
+		return NormalizeIP(host)
+	}
+	return NormalizeIP(trimmed)
+}
+
+func IsPublic(ip net.IP) bool {
+	if ip == nil {
+		return false
+	}
+	if ipv4 := ip.To4(); ipv4 != nil {
+		ip = ipv4
+	}
+	if !ip.IsGlobalUnicast() || ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsMulticast() || ip.IsUnspecified() {
+		return false
+	}
+	return true
+}
+
+func IsPublicString(raw string) bool {
+	ip := net.ParseIP(strings.TrimSpace(raw))
+	return IsPublic(ip)
+}
+
+func Score(ip net.IP) int {
+	if ip == nil {
+		return -1
+	}
+	if ipv4 := ip.To4(); ipv4 != nil {
+		ip = ipv4
+	}
+	if !ip.IsGlobalUnicast() || ip.IsLoopback() || ip.IsMulticast() || ip.IsUnspecified() {
+		return -1
+	}
+	if IsPublic(ip) {
+		return 2
+	}
+	return 1
+}

openflare_server/utils/geoip/iputil/iputil_test.go

@@ -0,0 +1,45 @@
+package iputil
+
+import (
+	"net"
+	"testing"
+)
+
+func TestNormalizeIP(t *testing.T) {
+	if got := NormalizeIP(" 8.8.8.8 "); got != "8.8.8.8" {
+		t.Fatalf("unexpected normalized ipv4: %q", got)
+	}
+	if got := NormalizeIP("[::1]"); got != "" {
+		t.Fatalf("expected invalid bracketed host to be rejected, got %q", got)
+	}
+}
+
+func TestNormalizeRemoteAddr(t *testing.T) {
+	if got := NormalizeRemoteAddr("203.0.113.10:8443"); got != "203.0.113.10" {
+		t.Fatalf("unexpected remote addr normalization: %q", got)
+	}
+}
+
+func TestIsPublic(t *testing.T) {
+	if !IsPublic(net.ParseIP("8.8.8.8")) {
+		t.Fatal("expected public ip to be detected")
+	}
+	if IsPublic(net.ParseIP("10.0.0.8")) {
+		t.Fatal("expected private ip to be rejected")
+	}
+	if IsPublic(net.ParseIP("127.0.0.1")) {
+		t.Fatal("expected loopback ip to be rejected")
+	}
+}
+
+func TestScore(t *testing.T) {
+	if got := Score(net.ParseIP("8.8.8.8")); got != 2 {
+		t.Fatalf("unexpected score for public ip: %d", got)
+	}
+	if got := Score(net.ParseIP("10.0.0.8")); got != 1 {
+		t.Fatalf("unexpected score for private ip: %d", got)
+	}
+	if got := Score(net.ParseIP("127.0.0.1")); got != -1 {
+		t.Fatalf("unexpected score for loopback ip: %d", got)
+	}
+}

openflare_server/web/app/(dashboard)/origin/detail/page.tsx

@@ -0,0 +1,11 @@
+'use client';
+
+import { useSearchParams } from 'next/navigation';
+
+import { OriginDetailPage } from '@/features/origins/components/origin-detail-page';
+
+export default function OriginDetailRoute() {
+  const searchParams = useSearchParams();
+
+  return <OriginDetailPage originId={searchParams.get('id') ?? ''} />;
+}

openflare_server/web/app/(dashboard)/origin/page.tsx

@@ -0,0 +1,5 @@
+import { OriginsPage } from '@/features/origins/components/origins-page';
+
+export default function OriginRoute() {
+  return <OriginsPage />;
+}

openflare_server/web/app/(dashboard)/proxy-route/detail/page.tsx

@@ -0,0 +1,16 @@
+'use client';
+
+import { useSearchParams } from 'next/navigation';
+
+import { ProxyRouteConfigPage } from '@/features/proxy-routes/components/proxy-route-config-page';
+
+export default function ProxyRouteDetailRoute() {
+  const searchParams = useSearchParams();
+
+  return (
+    <ProxyRouteConfigPage
+      routeId={searchParams.get('id') ?? ''}
+      initialSection={searchParams.get('section') ?? 'domains'}
+    />
+  );
+}

openflare_server/web/app/globals.css

@@ -1,22 +1,27 @@
-@import '../styles/tokens.css';
-@import 'tailwindcss';
-
+@import '../styles/tokens.css';
+@import 'tailwindcss';
+@import '@heroui/styles';
+@import "tw-animate-css";
+@import "shadcn/tailwind.css";
+
+@custom-variant dark (&:is(.dark *));
+
 * {
   box-sizing: border-box;
 }
-
+
 html {
   background: var(--surface-canvas);
 }
-
+
 html[data-theme='light'] {
   color-scheme: light;
 }
-
+
 html[data-theme='dark'] {
   color-scheme: dark;
 }
-
+
 body {
   min-height: 100vh;
   background: var(--body-background);
@@ -28,17 +33,141 @@ body {
     background 0.2s ease,
     color 0.2s ease;
 }
-
+
 a {
   color: inherit;
   text-decoration: none;
 }
-
+
 button {
   cursor: pointer;
 }
-
+
 ::selection {
   background: var(--selection-background);
   color: var(--selection-foreground);
 }
+
+@theme inline {
+  --font-heading: var(--font-sans);
+  --font-sans: var(--font-sans);
+  --color-sidebar-ring: var(--sidebar-ring);
+  --color-sidebar-border: var(--sidebar-border);
+  --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
+  --color-sidebar-accent: var(--sidebar-accent);
+  --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
+  --color-sidebar-primary: var(--sidebar-primary);
+  --color-sidebar-foreground: var(--sidebar-foreground);
+  --color-sidebar: var(--sidebar);
+  --color-chart-5: var(--chart-5);
+  --color-chart-4: var(--chart-4);
+  --color-chart-3: var(--chart-3);
+  --color-chart-2: var(--chart-2);
+  --color-chart-1: var(--chart-1);
+  --color-ring: var(--ring);
+  --color-input: var(--input);
+  --color-border: var(--border);
+  --color-destructive: var(--destructive);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-accent: var(--accent);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-muted: var(--muted);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-secondary: var(--secondary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-primary: var(--primary);
+  --color-popover-foreground: var(--popover-foreground);
+  --color-popover: var(--popover);
+  --color-card-foreground: var(--card-foreground);
+  --color-card: var(--card);
+  --color-foreground: var(--foreground);
+  --color-background: var(--background);
+  --radius-sm: calc(var(--radius) * 0.6);
+  --radius-md: calc(var(--radius) * 0.8);
+  --radius-lg: var(--radius);
+  --radius-xl: calc(var(--radius) * 1.4);
+  --radius-2xl: calc(var(--radius) * 1.8);
+  --radius-3xl: calc(var(--radius) * 2.2);
+  --radius-4xl: calc(var(--radius) * 2.6);
+}
+
+:root {
+  --background: oklch(1 0 0);
+  --foreground: oklch(0.145 0 0);
+  --card: oklch(1 0 0);
+  --card-foreground: oklch(0.145 0 0);
+  --popover: oklch(1 0 0);
+  --popover-foreground: oklch(0.145 0 0);
+  --primary: oklch(0.205 0 0);
+  --primary-foreground: oklch(0.985 0 0);
+  --secondary: oklch(0.97 0 0);
+  --secondary-foreground: oklch(0.205 0 0);
+  --muted: oklch(0.97 0 0);
+  --muted-foreground: oklch(0.556 0 0);
+  --accent: oklch(0.97 0 0);
+  --accent-foreground: oklch(0.205 0 0);
+  --destructive: oklch(0.577 0.245 27.325);
+  --border: oklch(0.922 0 0);
+  --input: oklch(0.922 0 0);
+  --ring: oklch(0.708 0 0);
+  --chart-1: oklch(0.87 0 0);
+  --chart-2: oklch(0.556 0 0);
+  --chart-3: oklch(0.439 0 0);
+  --chart-4: oklch(0.371 0 0);
+  --chart-5: oklch(0.269 0 0);
+  --radius: 0.625rem;
+  --sidebar: oklch(0.985 0 0);
+  --sidebar-foreground: oklch(0.145 0 0);
+  --sidebar-primary: oklch(0.205 0 0);
+  --sidebar-primary-foreground: oklch(0.985 0 0);
+  --sidebar-accent: oklch(0.97 0 0);
+  --sidebar-accent-foreground: oklch(0.205 0 0);
+  --sidebar-border: oklch(0.922 0 0);
+  --sidebar-ring: oklch(0.708 0 0);
+}
+
+.dark {
+  --background: oklch(0.145 0 0);
+  --foreground: oklch(0.985 0 0);
+  --card: oklch(0.205 0 0);
+  --card-foreground: oklch(0.985 0 0);
+  --popover: oklch(0.205 0 0);
+  --popover-foreground: oklch(0.985 0 0);
+  --primary: oklch(0.922 0 0);
+  --primary-foreground: oklch(0.205 0 0);
+  --secondary: oklch(0.269 0 0);
+  --secondary-foreground: oklch(0.985 0 0);
+  --muted: oklch(0.269 0 0);
+  --muted-foreground: oklch(0.708 0 0);
+  --accent: oklch(0.269 0 0);
+  --accent-foreground: oklch(0.985 0 0);
+  --destructive: oklch(0.704 0.191 22.216);
+  --border: oklch(1 0 0 / 10%);
+  --input: oklch(1 0 0 / 15%);
+  --ring: oklch(0.556 0 0);
+  --chart-1: oklch(0.87 0 0);
+  --chart-2: oklch(0.556 0 0);
+  --chart-3: oklch(0.439 0 0);
+  --chart-4: oklch(0.371 0 0);
+  --chart-5: oklch(0.269 0 0);
+  --sidebar: oklch(0.205 0 0);
+  --sidebar-foreground: oklch(0.985 0 0);
+  --sidebar-primary: oklch(0.488 0.243 264.376);
+  --sidebar-primary-foreground: oklch(0.985 0 0);
+  --sidebar-accent: oklch(0.269 0 0);
+  --sidebar-accent-foreground: oklch(0.985 0 0);
+  --sidebar-border: oklch(1 0 0 / 10%);
+  --sidebar-ring: oklch(0.556 0 0);
+}
+
+@layer base {
+  * {
+    @apply border-border outline-ring/50;
+  }
+  body {
+    @apply bg-background text-foreground;
+  }
+  html {
+    @apply font-sans;
+  }
+}

openflare_server/web/app/layout.tsx

@@ -5,8 +5,12 @@ import type { ReactNode } from 'react';
 import { AppProviders } from '@/components/providers/app-providers';
 import { getThemeInitScript } from '@/lib/theme/theme';
 
-import './globals.css';
-
+import './globals.css';
+import { Geist } from "next/font/google";
+import { cn } from "@/lib/utils";
+
+const geist = Geist({subsets:['latin'],variable:'--font-sans'});
+
 export const metadata: Metadata = {
   title: {
     default: 'OpenFlare 控制台',
@@ -22,7 +26,7 @@ interface RootLayoutProps {
 
 export default function RootLayout({ children }: RootLayoutProps) {
   return (
-    <html lang='zh-CN' suppressHydrationWarning>
+    <html lang='zh-CN' suppressHydrationWarning className={cn("font-sans", geist.variable)}>
       <body>
         <Script id='theme-init' strategy='beforeInteractive'>
           {getThemeInitScript()}

openflare_server/web/components.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "radix-nova",
+  "rsc": true,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "app/globals.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "iconLibrary": "lucide",
+  "rtl": false,
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  },
+  "menuColor": "default",
+  "menuAccent": "subtle",
+  "registries": {}
+}

openflare_server/web/components/layout/dashboard-sidebar.tsx

@@ -47,6 +47,13 @@ function SidebarIcon({ icon }: { icon: NavigationIconKey }) {
           <path d="M12 3.5c2.4 2.2 3.8 5.2 3.8 8.5S14.4 18.3 12 20.5C9.6 18.3 8.2 15.3 8.2 12S9.6 5.7 12 3.5Z" />
         </svg>
       );
+    case 'origin':
+      return (
+        <svg {...commonProps}>
+          <path d="M12 4.5c3.3 0 6 2.5 6 5.6 0 4.4-6 9.4-6 9.4s-6-5-6-9.4c0-3.1 2.7-5.6 6-5.6Z" />
+          <circle cx="12" cy="10.1" r="1.9" />
+        </svg>
+      );
     case 'domain':
       return (
         <svg {...commonProps}>

openflare_server/web/components/ui/drawer.tsx

@@ -0,0 +1,312 @@
+'use client';
+
+import {
+  cloneElement,
+  createContext,
+  isValidElement,
+  useContext,
+  useEffect,
+  useId,
+  useMemo,
+  useState,
+  type HTMLAttributes,
+  type ReactElement,
+  type ReactNode,
+} from 'react';
+import { createPortal } from 'react-dom';
+
+import { cn } from '@/lib/utils/cn';
+
+type DrawerDirection = 'top' | 'right' | 'bottom' | 'left';
+
+type DrawerContextValue = {
+  open: boolean;
+  setOpen: (open: boolean) => void;
+  direction: DrawerDirection;
+};
+
+const DrawerContext = createContext<DrawerContextValue | null>(null);
+
+function useDrawerContext() {
+  const context = useContext(DrawerContext);
+
+  if (!context) {
+    throw new Error('Drawer components must be used within Drawer.');
+  }
+
+  return context;
+}
+
+function renderWithOptionalChild(
+  child: ReactNode,
+  props: Record<string, unknown>,
+  fallback: ReactNode,
+) {
+  if (isValidElement(child)) {
+    return cloneElement(child as ReactElement, props);
+  }
+
+  return fallback;
+}
+
+export function Drawer({
+  children,
+  open,
+  defaultOpen = false,
+  onOpenChange,
+  direction = 'bottom',
+  title,
+  description,
+  footer,
+}: {
+  children: ReactNode;
+  open?: boolean;
+  defaultOpen?: boolean;
+  onOpenChange?: (open: boolean) => void;
+  direction?: DrawerDirection;
+  title?: string;
+  description?: string;
+  footer?: ReactNode;
+  size?: 'md' | 'lg' | 'xl';
+}) {
+  const [internalOpen, setInternalOpen] = useState(defaultOpen);
+  const isControlled = open !== undefined;
+  const resolvedOpen = isControlled ? open : internalOpen;
+
+  const value = useMemo<DrawerContextValue>(
+    () => ({
+      open: resolvedOpen,
+      direction,
+      setOpen: (nextOpen) => {
+        if (!isControlled) {
+          setInternalOpen(nextOpen);
+        }
+        onOpenChange?.(nextOpen);
+      },
+    }),
+    [direction, isControlled, onOpenChange, resolvedOpen],
+  );
+
+  return (
+    <DrawerContext.Provider value={value}>
+      {title || description || footer ? (
+        <DrawerContent
+          aria-label={title}
+          className={cn(
+            'w-full md:w-[50vw] md:max-w-none',
+            direction === 'right' || direction === 'left' ? '' : 'max-h-[85vh]',
+          )}
+        >
+          <DrawerHeader className="flex items-start justify-between gap-4">
+            <div className="min-w-0">
+              {title ? <DrawerTitle>{title}</DrawerTitle> : null}
+              {description ? (
+                <DrawerDescription>{description}</DrawerDescription>
+              ) : null}
+            </div>
+            <button
+              type="button"
+              onClick={() => value.setOpen(false)}
+              className="inline-flex h-10 w-10 items-center justify-center rounded-2xl border border-[var(--border-default)] bg-[var(--control-background)] text-lg text-[var(--foreground-primary)] transition hover:bg-[var(--control-background-hover)]"
+              aria-label="关闭抽屉"
+            >
+              ×
+            </button>
+          </DrawerHeader>
+          <div className="min-h-0 flex-1 overflow-y-auto px-6 py-6">
+            {children}
+          </div>
+          {footer ? <DrawerFooter>{footer}</DrawerFooter> : null}
+        </DrawerContent>
+      ) : (
+        children
+      )}
+    </DrawerContext.Provider>
+  );
+}
+
+export function DrawerTrigger({
+  children,
+  asChild = false,
+}: {
+  children: ReactNode;
+  asChild?: boolean;
+}) {
+  const { setOpen } = useDrawerContext();
+
+  if (asChild) {
+    return renderWithOptionalChild(
+      children,
+      {
+        onClick: () => setOpen(true),
+      },
+      children,
+    );
+  }
+
+  return (
+    <button type="button" onClick={() => setOpen(true)}>
+      {children}
+    </button>
+  );
+}
+
+export function DrawerClose({
+  children,
+  asChild = false,
+}: {
+  children: ReactNode;
+  asChild?: boolean;
+}) {
+  const { setOpen } = useDrawerContext();
+
+  if (asChild) {
+    return renderWithOptionalChild(
+      children,
+      {
+        onClick: () => setOpen(false),
+      },
+      children,
+    );
+  }
+
+  return (
+    <button type="button" onClick={() => setOpen(false)}>
+      {children}
+    </button>
+  );
+}
+
+export function DrawerContent({
+  children,
+  className,
+  'aria-label': ariaLabel,
+}: HTMLAttributes<HTMLDivElement>) {
+  const { open, setOpen, direction } = useDrawerContext();
+  const titleId = useId();
+  const descriptionId = useId();
+
+  useEffect(() => {
+    if (!open) {
+      return;
+    }
+
+    const previousOverflow = document.body.style.overflow;
+    document.body.style.overflow = 'hidden';
+
+    const handleKeyDown = (event: KeyboardEvent) => {
+      if (event.key === 'Escape') {
+        setOpen(false);
+      }
+    };
+
+    window.addEventListener('keydown', handleKeyDown);
+
+    return () => {
+      document.body.style.overflow = previousOverflow;
+      window.removeEventListener('keydown', handleKeyDown);
+    };
+  }, [open, setOpen]);
+
+  if (!open || typeof document === 'undefined') {
+    return null;
+  }
+
+  const positionClassName =
+    direction === 'right'
+      ? 'inset-y-0 right-0 h-full border-l'
+      : direction === 'left'
+        ? 'inset-y-0 left-0 h-full border-r'
+        : direction === 'top'
+          ? 'inset-x-0 top-0 border-b'
+          : 'inset-x-0 bottom-0 border-t';
+
+  return createPortal(
+    <div className="fixed inset-0 z-50">
+      <button
+        type="button"
+        className="absolute inset-0 bg-slate-950/45 backdrop-blur-[2px]"
+        onClick={() => setOpen(false)}
+        aria-label="关闭抽屉"
+      />
+      <div
+        role="dialog"
+        aria-modal="true"
+        aria-label={ariaLabel}
+        aria-labelledby={ariaLabel ? undefined : titleId}
+        aria-describedby={descriptionId}
+        className={cn(
+          'absolute flex w-full flex-col overflow-hidden border-[var(--border-default)] bg-[var(--surface-panel)] shadow-2xl',
+          positionClassName,
+          className,
+        )}
+      >
+        <DrawerMetaContext.Provider value={{ titleId, descriptionId }}>
+          {children}
+        </DrawerMetaContext.Provider>
+      </div>
+    </div>,
+    document.body,
+  );
+}
+
+type DrawerMetaContextValue = {
+  titleId: string;
+  descriptionId: string;
+};
+
+const DrawerMetaContext = createContext<DrawerMetaContextValue | null>(null);
+
+function useDrawerMetaContext() {
+  const context = useContext(DrawerMetaContext);
+
+  if (!context) {
+    throw new Error('Drawer title and description must be used within DrawerContent.');
+  }
+
+  return context;
+}
+
+export function DrawerHeader({
+  className,
+  ...props
+}: HTMLAttributes<HTMLDivElement>) {
+  return <div className={cn('border-b border-[var(--border-default)] px-6 py-5', className)} {...props} />;
+}
+
+export function DrawerFooter({
+  className,
+  ...props
+}: HTMLAttributes<HTMLDivElement>) {
+  return <div className={cn('border-t border-[var(--border-default)] px-6 py-4', className)} {...props} />;
+}
+
+export function DrawerTitle({
+  className,
+  ...props
+}: HTMLAttributes<HTMLHeadingElement>) {
+  const { titleId } = useDrawerMetaContext();
+
+  return (
+    <h2
+      id={titleId}
+      className={cn('text-xl font-semibold text-[var(--foreground-primary)]', className)}
+      {...props}
+    />
+  );
+}
+
+export function DrawerDescription({
+  className,
+  ...props
+}: HTMLAttributes<HTMLParagraphElement>) {
+  const { descriptionId } = useDrawerMetaContext();
+
+  return (
+    <p
+      id={descriptionId}
+      className={cn('mt-2 text-sm leading-6 text-[var(--foreground-secondary)]', className)}
+      {...props}
+    />
+  );
+}

openflare_server/web/components/ui/input.tsx

@@ -0,0 +1,22 @@
+import * as React from 'react';
+
+import { cn } from '@/lib/utils/cn';
+
+const Input = React.forwardRef<HTMLInputElement, React.ComponentProps<'input'>>(
+  ({ className, type, ...props }, ref) => {
+    return (
+      <input
+        type={type}
+        className={cn(
+          'flex h-10 w-full rounded-xl border border-[var(--border-default)] bg-[var(--surface-elevated)] px-3 py-2 text-sm text-[var(--foreground-primary)] shadow-none outline-none transition placeholder:text-[var(--foreground-muted)] focus-visible:border-[var(--border-strong)] focus-visible:ring-2 focus-visible:ring-[var(--accent-soft)] disabled:cursor-not-allowed disabled:opacity-50',
+          className,
+        )}
+        ref={ref}
+        {...props}
+      />
+    );
+  },
+);
+Input.displayName = 'Input';
+
+export { Input };

openflare_server/web/components/ui/label.tsx

@@ -0,0 +1,21 @@
+import * as React from 'react';
+
+import { cn } from '@/lib/utils/cn';
+
+const Label = React.forwardRef<
+  HTMLLabelElement,
+  React.ComponentProps<'label'>
+>(({ className, ...props }, ref) => (
+  <label
+    ref={ref}
+    className={cn(
+      'text-sm font-medium leading-none text-[var(--foreground-primary)] peer-disabled:cursor-not-allowed peer-disabled:opacity-70',
+      className,
+    )}
+    {...props}
+  />
+));
+
+Label.displayName = 'Label';
+
+export { Label };

openflare_server/web/components/ui/separator.tsx

@@ -0,0 +1,28 @@
+"use client"
+
+import * as React from "react"
+import { Separator as SeparatorPrimitive } from "radix-ui"
+
+import { cn } from "@/lib/utils"
+
+function Separator({
+  className,
+  orientation = "horizontal",
+  decorative = true,
+  ...props
+}: React.ComponentProps<typeof SeparatorPrimitive.Root>) {
+  return (
+    <SeparatorPrimitive.Root
+      data-slot="separator"
+      decorative={decorative}
+      orientation={orientation}
+      className={cn(
+        "shrink-0 bg-border data-horizontal:h-px data-horizontal:w-full data-vertical:w-px data-vertical:self-stretch",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Separator }

openflare_server/web/components/ui/switch.tsx

@@ -0,0 +1,70 @@
+import * as React from 'react';
+
+import { cn } from '@/lib/utils/cn';
+
+type SwitchProps = Omit<React.ComponentProps<'button'>, 'onChange'> & {
+  checked?: boolean;
+  defaultChecked?: boolean;
+  disabled?: boolean;
+  onCheckedChange?: (checked: boolean) => void;
+};
+
+const Switch = React.forwardRef<HTMLButtonElement, SwitchProps>(
+  (
+    {
+      className,
+      checked,
+      defaultChecked = false,
+      disabled,
+      onCheckedChange,
+      ...props
+    },
+    ref,
+  ) => {
+    const [internalChecked, setInternalChecked] = React.useState(defaultChecked);
+    const isControlled = checked !== undefined;
+    const isChecked = isControlled ? checked : internalChecked;
+
+    const updateChecked = React.useCallback(
+      (nextChecked: boolean) => {
+        if (!isControlled) {
+          setInternalChecked(nextChecked);
+        }
+        onCheckedChange?.(nextChecked);
+      },
+      [isControlled, onCheckedChange],
+    );
+
+    return (
+      <button
+        ref={ref}
+        type="button"
+        role="switch"
+        aria-checked={isChecked}
+        data-state={isChecked ? 'checked' : 'unchecked'}
+        disabled={disabled}
+        className={cn(
+          'peer inline-flex h-6 w-11 shrink-0 items-center rounded-full border border-transparent bg-[var(--control-background-hover)] transition-colors outline-none focus-visible:ring-2 focus-visible:ring-[var(--accent-soft)] focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-[var(--brand-primary)]',
+          className,
+        )}
+        onClick={() => updateChecked(!isChecked)}
+        onKeyDown={(event) => {
+          if (event.key === 'Enter' || event.key === ' ') {
+            event.preventDefault();
+            updateChecked(!isChecked);
+          }
+        }}
+        {...props}
+      >
+        <span
+          data-state={isChecked ? 'checked' : 'unchecked'}
+          className="pointer-events-none block h-5 w-5 translate-x-0.5 rounded-full bg-white shadow-sm transition-transform data-[state=checked]:translate-x-5"
+        />
+      </button>
+    );
+  },
+);
+
+Switch.displayName = 'Switch';
+
+export { Switch };

openflare_server/web/components/ui/textarea.tsx

@@ -0,0 +1,22 @@
+import * as React from 'react';
+
+import { cn } from '@/lib/utils/cn';
+
+const Textarea = React.forwardRef<
+  HTMLTextAreaElement,
+  React.ComponentProps<'textarea'>
+>(({ className, ...props }, ref) => {
+  return (
+    <textarea
+      className={cn(
+        'flex min-h-28 w-full rounded-xl border border-[var(--border-default)] bg-[var(--surface-elevated)] px-3 py-2 text-sm text-[var(--foreground-primary)] shadow-none outline-none transition placeholder:text-[var(--foreground-muted)] focus-visible:border-[var(--border-strong)] focus-visible:ring-2 focus-visible:ring-[var(--accent-soft)] disabled:cursor-not-allowed disabled:opacity-50',
+        className,
+      )}
+      ref={ref}
+      {...props}
+    />
+  );
+});
+Textarea.displayName = 'Textarea';
+
+export { Textarea };

openflare_server/web/features/auth/components/github-oauth-callback.tsx

@@ -2,7 +2,7 @@
 
 import { useMutation } from '@tanstack/react-query';
 import { useRouter, useSearchParams } from 'next/navigation';
-import { useEffect, useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 
 import { InlineMessage } from '@/components/feedback/inline-message';
 import { LoadingState } from '@/components/feedback/loading-state';
@@ -13,9 +13,11 @@ import { exchangeGitHubCode } from '@/features/auth/api/auth';
 export function GitHubOAuthCallback() {
   const router = useRouter();
   const searchParams = useSearchParams();
-  const { setUser } = useAuth();
+  const { setUser } = useAuth();
+  const handledCodeRef = useRef<string | null>(null);
   const [prompt, setPrompt] = useState('正在处理 GitHub 授权结果...');
-  const [message, setMessage] = useState<{ tone: 'danger' | 'success'; text: string } | null>(null);
+  const [message, setMessage] = useState<{ tone: 'danger' | 'success'; text: string } | null>(null);
+  const code = searchParams?.get('code')?.trim() ?? '';
 
   const mutation = useMutation({
     mutationFn: exchangeGitHubCode,
@@ -31,15 +33,19 @@ export function GitHubOAuthCallback() {
   });
 
   useEffect(() => {
-    const code = searchParams?.get('code');
-    if (!code) {
+    if (!code) {
       setPrompt('缺少授权 code');
       setMessage({ tone: 'danger', text: '未收到 GitHub 授权参数，请返回登录页重试。' });
       return;
     }
 
-    mutation.mutate(code);
-  }, [mutation, searchParams]);
+    if (handledCodeRef.current === code) {
+      return;
+    }
+
+    handledCodeRef.current = code;
+    mutation.mutate(code);
+  }, [code, mutation]);
 
   return (
     <AppCard title='GitHub OAuth 回调' description={prompt}>

openflare_server/web/features/auth/components/login-form.tsx

@@ -1,128 +1,170 @@
-'use client';
-
-import { zodResolver } from '@hookform/resolvers/zod';
-import { useMutation, useQuery } from '@tanstack/react-query';
-import Link from 'next/link';
-import { useRouter, useSearchParams } from 'next/navigation';
-import { useState } from 'react';
-import { useForm } from 'react-hook-form';
-import { z } from 'zod';
-
-import { InlineMessage } from '@/components/feedback/inline-message';
-import { useAuth } from '@/components/providers/auth-provider';
-import { AppCard } from '@/components/ui/app-card';
-import { login } from '@/features/auth/api/auth';
-import { getPublicStatus } from '@/features/auth/api/public';
-import {
-  AuthButton,
-  AuthFormField,
-  AuthInput,
-  SecondaryButton,
-} from '@/features/auth/components/auth-form-primitives';
-import { PublicAuthGuard } from '@/features/auth/components/public-auth-guard';
-
-const loginSchema = z.object({
-  username: z.string().min(1, '请输入用户名'),
-  password: z.string().min(1, '请输入密码'),
-});
-
-type LoginFormValues = z.infer<typeof loginSchema>;
-
-export function LoginForm() {
-  const router = useRouter();
-  const searchParams = useSearchParams();
-  const { setUser } = useAuth();
-  const [errorMessage, setErrorMessage] = useState('');
-  const redirect = searchParams?.get('redirect') || '/';
-
-  const form = useForm<LoginFormValues>({
-    resolver: zodResolver(loginSchema),
-    defaultValues: {
-      username: '',
-      password: '',
-    },
-  });
-
-  const statusQuery = useQuery({
-    queryKey: ['public-status'],
-    queryFn: getPublicStatus,
-  });
-
-  const loginMutation = useMutation({
-    mutationFn: login,
-    onSuccess: (user) => {
-      setUser(user);
-      router.replace(redirect);
-    },
-    onError: (error: Error) => {
-      setErrorMessage(error.message || '登录失败，请稍后重试。');
-    },
-  });
-
-  const handleSubmit = form.handleSubmit((values) => {
-    setErrorMessage('');
-    loginMutation.mutate(values);
-  });
-
-  const handleGitHubLogin = () => {
-    const clientId = statusQuery.data?.github_client_id;
-    if (!clientId) {
-      setErrorMessage('GitHub 登录当前不可用。');
-      return;
-    }
-
-    const authorizeUrl = new URL('https://github.com/login/oauth/authorize');
-    authorizeUrl.searchParams.set('client_id', clientId);
-    authorizeUrl.searchParams.set('scope', 'user:email');
-    window.location.href = authorizeUrl.toString();
-  };
-
-  return (
-    <PublicAuthGuard>
-      <AppCard title='用户登录'>
-        <form className='space-y-4' onSubmit={handleSubmit}>
-          <AuthFormField label='用户名'>
-            <AuthInput placeholder='请输入用户名' {...form.register('username')} />
-            {form.formState.errors.username ? (
-              <span className='text-xs text-[var(--status-danger-foreground)]'>
-                {form.formState.errors.username.message}
-              </span>
-            ) : null}
-          </AuthFormField>
-
-          <AuthFormField label='密码'>
-            <AuthInput type='password' placeholder='请输入密码' {...form.register('password')} />
-            {form.formState.errors.password ? (
-              <span className='text-xs text-[var(--status-danger-foreground)]'>
-                {form.formState.errors.password.message}
-              </span>
-            ) : null}
-          </AuthFormField>
-
-          {errorMessage ? <InlineMessage tone='danger' message={errorMessage} /> : null}
-
-          <div className='flex flex-col gap-3 sm:flex-row'>
-            <AuthButton type='submit' disabled={loginMutation.isPending}>
-              {loginMutation.isPending ? '登录中...' : '登录'}
-            </AuthButton>
-            {statusQuery.data?.github_oauth ? (
-              <SecondaryButton type='button' onClick={handleGitHubLogin} className='w-full sm:w-auto'>
-                GitHub 登录
-              </SecondaryButton>
-            ) : null}
-          </div>
-        </form>
-
-        <div className='mt-6 flex flex-wrap gap-3 text-sm text-[var(--foreground-secondary)]'>
-          <Link href='/reset' className='text-[var(--brand-primary)] transition hover:opacity-80'>
-            忘记密码？
-          </Link>
-          <span>·</span>
-          <Link href='/register' className='text-[var(--brand-primary)] transition hover:opacity-80'>
-            注册
-          </Link>
-        </div>
-      </AppCard>
-    </PublicAuthGuard>
-  );
-}
+'use client';
+
+import { zodResolver } from '@hookform/resolvers/zod';
+import { useMutation, useQuery } from '@tanstack/react-query';
+import Link from 'next/link';
+import { useRouter, useSearchParams } from 'next/navigation';
+import { useState } from 'react';
+import { useForm } from 'react-hook-form';
+import { z } from 'zod';
+
+import { InlineMessage } from '@/components/feedback/inline-message';
+import { useAuth } from '@/components/providers/auth-provider';
+import { AppCard } from '@/components/ui/app-card';
+import { login } from '@/features/auth/api/auth';
+import { getPublicStatus } from '@/features/auth/api/public';
+import {
+  AuthButton,
+  AuthFormField,
+  AuthInput,
+  SecondaryButton,
+} from '@/features/auth/components/auth-form-primitives';
+import { PublicAuthGuard } from '@/features/auth/components/public-auth-guard';
+
+const TEXT = {
+  usernameRequired: '\u8bf7\u8f93\u5165\u7528\u6237\u540d',
+  passwordRequired: '\u8bf7\u8f93\u5165\u5bc6\u7801',
+  loginFailed: '\u767b\u5f55\u5931\u8d25\uff0c\u8bf7\u7a0d\u540e\u91cd\u8bd5\u3002',
+  githubUnavailable: 'GitHub \u767b\u5f55\u5f53\u524d\u4e0d\u53ef\u7528\u3002',
+  title: '\u7528\u6237\u767b\u5f55',
+  username: '\u7528\u6237\u540d',
+  password: '\u5bc6\u7801',
+  loginPending: '\u767b\u5f55\u4e2d...',
+  login: '\u767b\u5f55',
+  githubLogin: 'GitHub \u767b\u5f55',
+  forgotPassword: '\u5fd8\u8bb0\u5bc6\u7801\uff1f',
+  register: '\u6ce8\u518c',
+};
+
+const loginSchema = z.object({
+  username: z.string().min(1, TEXT.usernameRequired),
+  password: z.string().min(1, TEXT.passwordRequired),
+});
+
+type LoginFormValues = z.infer<typeof loginSchema>;
+
+export function LoginForm() {
+  const router = useRouter();
+  const searchParams = useSearchParams();
+  const { setUser } = useAuth();
+  const [errorMessage, setErrorMessage] = useState('');
+  const redirect = searchParams?.get('redirect') || '/';
+
+  const form = useForm<LoginFormValues>({
+    resolver: zodResolver(loginSchema),
+    defaultValues: {
+      username: '',
+      password: '',
+    },
+  });
+
+  const statusQuery = useQuery({
+    queryKey: ['public-status'],
+    queryFn: getPublicStatus,
+  });
+
+  const canUsePasswordRegister =
+    (statusQuery.data?.register_enabled ?? false) &&
+    (statusQuery.data?.password_register_enabled ?? false);
+
+  const loginMutation = useMutation({
+    mutationFn: login,
+    onSuccess: (user) => {
+      setUser(user);
+      router.replace(redirect);
+    },
+    onError: (error: Error) => {
+      setErrorMessage(error.message || TEXT.loginFailed);
+    },
+  });
+
+  const handleSubmit = form.handleSubmit((values) => {
+    setErrorMessage('');
+    loginMutation.mutate(values);
+  });
+
+  const handleGitHubLogin = () => {
+    const clientId = statusQuery.data?.github_client_id;
+    if (!clientId) {
+      setErrorMessage(TEXT.githubUnavailable);
+      return;
+    }
+
+    const authorizeUrl = new URL('https://github.com/login/oauth/authorize');
+    authorizeUrl.searchParams.set('client_id', clientId);
+    authorizeUrl.searchParams.set('scope', 'user:email');
+    window.location.href = authorizeUrl.toString();
+  };
+
+  return (
+    <PublicAuthGuard>
+      <AppCard title={TEXT.title}>
+        <form className='space-y-4' onSubmit={handleSubmit}>
+          <AuthFormField label={TEXT.username}>
+            <AuthInput
+              placeholder={TEXT.username}
+              {...form.register('username')}
+            />
+            {form.formState.errors.username ? (
+              <span className='text-xs text-[var(--status-danger-foreground)]'>
+                {form.formState.errors.username.message}
+              </span>
+            ) : null}
+          </AuthFormField>
+
+          <AuthFormField label={TEXT.password}>
+            <AuthInput
+              type='password'
+              placeholder={TEXT.password}
+              {...form.register('password')}
+            />
+            {form.formState.errors.password ? (
+              <span className='text-xs text-[var(--status-danger-foreground)]'>
+                {form.formState.errors.password.message}
+              </span>
+            ) : null}
+          </AuthFormField>
+
+          {errorMessage ? (
+            <InlineMessage tone='danger' message={errorMessage} />
+          ) : null}
+
+          <div className='flex flex-col gap-3 sm:flex-row'>
+            <AuthButton type='submit' disabled={loginMutation.isPending}>
+              {loginMutation.isPending ? TEXT.loginPending : TEXT.login}
+            </AuthButton>
+            {statusQuery.data?.github_oauth ? (
+              <SecondaryButton
+                type='button'
+                onClick={handleGitHubLogin}
+                className='w-full sm:w-auto'
+              >
+                {TEXT.githubLogin}
+              </SecondaryButton>
+            ) : null}
+          </div>
+        </form>
+
+        <div className='mt-6 flex flex-wrap gap-3 text-sm text-[var(--foreground-secondary)]'>
+          <Link
+            href='/reset'
+            className='text-[var(--brand-primary)] transition hover:opacity-80'
+          >
+            {TEXT.forgotPassword}
+          </Link>
+          {canUsePasswordRegister ? (
+            <>
+              <span>|</span>
+              <Link
+                href='/register'
+                className='text-[var(--brand-primary)] transition hover:opacity-80'
+              >
+                {TEXT.register}
+              </Link>
+            </>
+          ) : null}
+        </div>
+      </AppCard>
+    </PublicAuthGuard>
+  );
+}

openflare_server/web/features/auth/components/register-form.tsx

@@ -1,225 +1,332 @@
-'use client';
-
-import { zodResolver } from '@hookform/resolvers/zod';
-import { useMutation, useQuery } from '@tanstack/react-query';
-import Link from 'next/link';
-import { useRouter } from 'next/navigation';
-import { useMemo, useState } from 'react';
-import { useForm } from 'react-hook-form';
-import { z } from 'zod';
-
-import { InlineMessage } from '@/components/feedback/inline-message';
-import { TurnstileWidget } from '@/components/forms/turnstile-widget';
-import { AppCard } from '@/components/ui/app-card';
-import {
-  register as registerUser,
-  sendEmailVerification,
-} from '@/features/auth/api/auth';
-import { getPublicStatus } from '@/features/auth/api/public';
-import {
-  AuthButton,
-  AuthFormField,
-  AuthInput,
-  SecondaryButton,
-} from '@/features/auth/components/auth-form-primitives';
-import { PublicAuthGuard } from '@/features/auth/components/public-auth-guard';
-
-const baseSchemaObject = z.object({
-  username: z.string().min(1, '请输入用户名').max(12, '用户名最长 12 位'),
-  password: z.string().min(8, '密码至少 8 位').max(20, '密码最长 20 位'),
-  password2: z.string().min(8, '请再次输入密码'),
-  email: z.string().optional(),
-  verification_code: z.string().optional(),
-});
-
-const baseSchema = baseSchemaObject.refine((data) => data.password === data.password2, {
-  message: '两次输入的密码不一致',
-  path: ['password2'],
-});
-
-type RegisterFormValues = z.infer<typeof baseSchema>;
-
-export function RegisterForm() {
-  const router = useRouter();
-  const [turnstileToken, setTurnstileToken] = useState('');
-  const [message, setMessage] = useState<{ tone: 'success' | 'danger' | 'info'; text: string } | null>(null);
-
-  const statusQuery = useQuery({
-    queryKey: ['public-status'],
-    queryFn: getPublicStatus,
-  });
-
-  const needsEmailVerification = statusQuery.data?.email_verification ?? false;
-  const needsTurnstile = statusQuery.data?.turnstile_check ?? false;
-
-  const schema = useMemo(() => {
-    if (!needsEmailVerification) {
-      return baseSchema;
-    }
-
-    return baseSchemaObject
-      .extend({
-        email: z.string().email('请输入有效邮箱地址'),
-        verification_code: z.string().min(1, '请输入验证码'),
-      })
-      .refine((data) => data.password === data.password2, {
-        message: '两次输入的密码不一致',
-        path: ['password2'],
-      });
-  }, [needsEmailVerification]);
-
-  const form = useForm<RegisterFormValues>({
-    resolver: zodResolver(schema),
-    defaultValues: {
-      username: '',
-      password: '',
-      password2: '',
-      email: '',
-      verification_code: '',
-    },
-  });
-
-  const registerMutation = useMutation({
-    mutationFn: (values: RegisterFormValues) =>
-      registerUser(
-        {
-          username: values.username,
-          password: values.password,
-          email: values.email,
-          verification_code: values.verification_code,
-        },
-        turnstileToken || undefined,
-      ),
-    onSuccess: () => {
-      router.replace('/login');
-    },
-    onError: (error: Error) => {
-      setMessage({ tone: 'danger', text: error.message || '注册失败，请稍后重试。' });
-    },
-  });
-
-  const verificationMutation = useMutation({
-    mutationFn: async () => {
-      const email = form.getValues('email');
-      if (!email) {
-        form.setError('email', { message: '请输入邮箱地址' });
-        return;
-      }
-      await sendEmailVerification(email, turnstileToken || undefined);
-    },
-    onSuccess: () => {
-      setMessage({ tone: 'success', text: '验证码发送成功，请检查邮箱。' });
-    },
-    onError: (error: Error) => {
-      setMessage({ tone: 'danger', text: error.message || '验证码发送失败，请稍后重试。' });
-    },
-  });
-
-  const handleSubmit = form.handleSubmit((values) => {
-    setMessage(null);
-    if (needsTurnstile && !turnstileToken) {
-      setMessage({ tone: 'info', text: '请先完成人机验证。' });
-      return;
-    }
-    registerMutation.mutate(values);
-  });
-
-  return (
-    <PublicAuthGuard>
-      <AppCard title='新用户注册' description='兼容现有密码注册链路，后续可继续扩展第三方注册。'>
-        <form className='space-y-4' onSubmit={handleSubmit}>
-          <AuthFormField label='用户名' hint='最长 12 位'>
-            <AuthInput placeholder='请输入用户名' {...form.register('username')} />
-            {form.formState.errors.username ? (
-              <span className='text-xs text-[var(--status-danger-foreground)]'>
-                {form.formState.errors.username.message}
-              </span>
-            ) : null}
-          </AuthFormField>
-
-          <AuthFormField label='密码' hint='最短 8 位，最长 20 位'>
-            <AuthInput type='password' placeholder='请输入密码' {...form.register('password')} />
-            {form.formState.errors.password ? (
-              <span className='text-xs text-[var(--status-danger-foreground)]'>
-                {form.formState.errors.password.message}
-              </span>
-            ) : null}
-          </AuthFormField>
-
-          <AuthFormField label='确认密码'>
-            <AuthInput type='password' placeholder='请再次输入密码' {...form.register('password2')} />
-            {form.formState.errors.password2 ? (
-              <span className='text-xs text-[var(--status-danger-foreground)]'>
-                {form.formState.errors.password2.message}
-              </span>
-            ) : null}
-          </AuthFormField>
-
-          {needsEmailVerification ? (
-            <>
-              <AuthFormField label='邮箱地址'>
-                <AuthInput type='email' placeholder='请输入邮箱地址' {...form.register('email')} />
-                {form.formState.errors.email ? (
-                  <span className='text-xs text-[var(--status-danger-foreground)]'>
-                    {form.formState.errors.email.message}
-                  </span>
-                ) : null}
-              </AuthFormField>
-
-              <AuthFormField label='邮箱验证码'>
-                <div className='flex flex-col gap-3 sm:flex-row'>
-                  <AuthInput
-                    placeholder='请输入验证码'
-                    className='flex-1'
-                    {...form.register('verification_code')}
-                  />
-                  <SecondaryButton
-                    type='button'
-                    onClick={() => {
-                      if (needsTurnstile && !turnstileToken) {
-                        setMessage({ tone: 'info', text: '请先完成人机验证。' });
-                        return;
-                      }
-                      setMessage(null);
-                      verificationMutation.mutate();
-                    }}
-                    disabled={verificationMutation.isPending}
-                  >
-                    {verificationMutation.isPending ? '发送中...' : '获取验证码'}
-                  </SecondaryButton>
-                </div>
-                {form.formState.errors.verification_code ? (
-                  <span className='text-xs text-[var(--status-danger-foreground)]'>
-                    {form.formState.errors.verification_code.message}
-                  </span>
-                ) : null}
-              </AuthFormField>
-            </>
-          ) : null}
-
-          {needsTurnstile && statusQuery.data?.turnstile_site_key ? (
-            <TurnstileWidget
-              siteKey={statusQuery.data.turnstile_site_key}
-              onVerify={(token) => setTurnstileToken(token)}
-              onExpire={() => setTurnstileToken('')}
-              onError={() => setTurnstileToken('')}
-            />
-          ) : null}
-
-          {message ? <InlineMessage tone={message.tone} message={message.text} /> : null}
-
-          <AuthButton type='submit' disabled={registerMutation.isPending}>
-            {registerMutation.isPending ? '注册中...' : '注册'}
-          </AuthButton>
-        </form>
-
-        <div className='mt-6 text-sm text-[var(--foreground-secondary)]'>
-          已有账户？
-          <Link href='/login' className='ml-2 text-[var(--brand-primary)] transition hover:opacity-80'>
-            点击登录
-          </Link>
-        </div>
-      </AppCard>
-    </PublicAuthGuard>
-  );
-}
+'use client';
+
+import { zodResolver } from '@hookform/resolvers/zod';
+import { useMutation, useQuery } from '@tanstack/react-query';
+import Link from 'next/link';
+import { useRouter } from 'next/navigation';
+import { useMemo, useState } from 'react';
+import { useForm } from 'react-hook-form';
+import { z } from 'zod';
+
+import { InlineMessage } from '@/components/feedback/inline-message';
+import { TurnstileWidget } from '@/components/forms/turnstile-widget';
+import { AppCard } from '@/components/ui/app-card';
+import {
+  register as registerUser,
+  sendEmailVerification,
+} from '@/features/auth/api/auth';
+import { getPublicStatus } from '@/features/auth/api/public';
+import {
+  AuthButton,
+  AuthFormField,
+  AuthInput,
+  SecondaryButton,
+} from '@/features/auth/components/auth-form-primitives';
+import { PublicAuthGuard } from '@/features/auth/components/public-auth-guard';
+
+const TEXT = {
+  title: '\u65b0\u7528\u6237\u6ce8\u518c',
+  description:
+    '\u517c\u5bb9\u73b0\u6709\u5bc6\u7801\u6ce8\u518c\u94fe\u8def\uff0c\u540e\u7eed\u53ef\u7ee7\u7eed\u6269\u5c55\u7b2c\u4e09\u65b9\u6ce8\u518c\u3002',
+  usernameRequired: '\u8bf7\u8f93\u5165\u7528\u6237\u540d',
+  usernameTooLong: '\u7528\u6237\u540d\u6700\u957f 12 \u4f4d',
+  passwordTooShort: '\u5bc6\u7801\u81f3\u5c11 8 \u4f4d',
+  passwordTooLong: '\u5bc6\u7801\u6700\u957f 20 \u4f4d',
+  passwordRepeatRequired: '\u8bf7\u518d\u6b21\u8f93\u5165\u5bc6\u7801',
+  passwordMismatch: '\u4e24\u6b21\u8f93\u5165\u7684\u5bc6\u7801\u4e0d\u4e00\u81f4',
+  emailInvalid: '\u8bf7\u8f93\u5165\u6709\u6548\u90ae\u7bb1\u5730\u5740',
+  codeRequired: '\u8bf7\u8f93\u5165\u9a8c\u8bc1\u7801',
+  registerFailed: '\u6ce8\u518c\u5931\u8d25\uff0c\u8bf7\u7a0d\u540e\u91cd\u8bd5\u3002',
+  emailRequired: '\u8bf7\u8f93\u5165\u90ae\u7bb1\u5730\u5740',
+  verificationSent:
+    '\u9a8c\u8bc1\u7801\u53d1\u9001\u6210\u529f\uff0c\u8bf7\u68c0\u67e5\u90ae\u7bb1\u3002',
+  verificationFailed:
+    '\u9a8c\u8bc1\u7801\u53d1\u9001\u5931\u8d25\uff0c\u8bf7\u7a0d\u540e\u91cd\u8bd5\u3002',
+  turnstileRequired: '\u8bf7\u5148\u5b8c\u6210\u4eba\u673a\u9a8c\u8bc1\u3002',
+  registerClosed:
+    '\u7ba1\u7406\u5458\u5df2\u5173\u95ed\u65b0\u7528\u6237\u6ce8\u518c\u3002',
+  passwordRegisterClosed:
+    '\u7ba1\u7406\u5458\u5df2\u5173\u95ed\u5bc6\u7801\u6ce8\u518c\uff0c\u8bf7\u4f7f\u7528\u7b2c\u4e09\u65b9\u767b\u5f55\u5165\u53e3\u5b8c\u6210\u6ce8\u518c\u3002',
+  hasAccount: '\u5df2\u6709\u8d26\u53f7\uff1f',
+  backToLogin:
+    '\u8fd4\u56de\u767b\u5f55\u9875\u67e5\u770b\u53ef\u7528\u5165\u53e3\uff1a',
+  clickLogin: '\u70b9\u51fb\u767b\u5f55',
+  username: '\u7528\u6237\u540d',
+  usernameHint: '\u6700\u957f 12 \u4f4d',
+  password: '\u5bc6\u7801',
+  passwordHint: '\u6700\u77ed 8 \u4f4d\uff0c\u6700\u957f 20 \u4f4d',
+  passwordConfirm: '\u786e\u8ba4\u5bc6\u7801',
+  email: '\u90ae\u7bb1\u5730\u5740',
+  emailCode: '\u90ae\u7bb1\u9a8c\u8bc1\u7801',
+  getCode: '\u83b7\u53d6\u9a8c\u8bc1\u7801',
+  gettingCode: '\u53d1\u9001\u4e2d...',
+  register: '\u6ce8\u518c',
+  registering: '\u6ce8\u518c\u4e2d...',
+};
+
+const baseSchemaObject = z.object({
+  username: z.string().min(1, TEXT.usernameRequired).max(12, TEXT.usernameTooLong),
+  password: z.string().min(8, TEXT.passwordTooShort).max(20, TEXT.passwordTooLong),
+  password2: z.string().min(8, TEXT.passwordRepeatRequired),
+  email: z.string().optional(),
+  verification_code: z.string().optional(),
+});
+
+const baseSchema = baseSchemaObject.refine(
+  (data) => data.password === data.password2,
+  {
+    message: TEXT.passwordMismatch,
+    path: ['password2'],
+  },
+);
+
+type RegisterFormValues = z.infer<typeof baseSchema>;
+
+export function RegisterForm() {
+  const router = useRouter();
+  const [turnstileToken, setTurnstileToken] = useState('');
+  const [message, setMessage] = useState<{
+    tone: 'success' | 'danger' | 'info';
+    text: string;
+  } | null>(null);
+
+  const statusQuery = useQuery({
+    queryKey: ['public-status'],
+    queryFn: getPublicStatus,
+  });
+
+  const needsEmailVerification = statusQuery.data?.email_verification ?? false;
+  const needsTurnstile = statusQuery.data?.turnstile_check ?? false;
+  const registerEnabled = statusQuery.data?.register_enabled ?? false;
+  const passwordRegisterEnabled =
+    statusQuery.data?.password_register_enabled ?? false;
+
+  const schema = useMemo(() => {
+    if (!needsEmailVerification) {
+      return baseSchema;
+    }
+
+    return baseSchemaObject
+      .extend({
+        email: z.string().email(TEXT.emailInvalid),
+        verification_code: z.string().min(1, TEXT.codeRequired),
+      })
+      .refine((data) => data.password === data.password2, {
+        message: TEXT.passwordMismatch,
+        path: ['password2'],
+      });
+  }, [needsEmailVerification]);
+
+  const form = useForm<RegisterFormValues>({
+    resolver: zodResolver(schema),
+    defaultValues: {
+      username: '',
+      password: '',
+      password2: '',
+      email: '',
+      verification_code: '',
+    },
+  });
+
+  const registerMutation = useMutation({
+    mutationFn: (values: RegisterFormValues) =>
+      registerUser(
+        {
+          username: values.username,
+          password: values.password,
+          email: values.email,
+          verification_code: values.verification_code,
+        },
+        turnstileToken || undefined,
+      ),
+    onSuccess: () => {
+      router.replace('/login');
+    },
+    onError: (error: Error) => {
+      setMessage({ tone: 'danger', text: error.message || TEXT.registerFailed });
+    },
+  });
+
+  const verificationMutation = useMutation({
+    mutationFn: async () => {
+      const email = form.getValues('email');
+      if (!email) {
+        form.setError('email', { message: TEXT.emailRequired });
+        return;
+      }
+      await sendEmailVerification(email, turnstileToken || undefined);
+    },
+    onSuccess: () => {
+      setMessage({ tone: 'success', text: TEXT.verificationSent });
+    },
+    onError: (error: Error) => {
+      setMessage({
+        tone: 'danger',
+        text: error.message || TEXT.verificationFailed,
+      });
+    },
+  });
+
+  const handleSubmit = form.handleSubmit((values) => {
+    setMessage(null);
+    if (needsTurnstile && !turnstileToken) {
+      setMessage({ tone: 'info', text: TEXT.turnstileRequired });
+      return;
+    }
+    registerMutation.mutate(values);
+  });
+
+  return (
+    <PublicAuthGuard>
+      <AppCard title={TEXT.title} description={TEXT.description}>
+        {!registerEnabled ? (
+          <div className='space-y-4'>
+            <InlineMessage tone='info' message={TEXT.registerClosed} />
+            <div className='text-sm text-[var(--foreground-secondary)]'>
+              {TEXT.hasAccount}
+              <Link
+                href='/login'
+                className='ml-2 text-[var(--brand-primary)] transition hover:opacity-80'
+              >
+                {TEXT.clickLogin}
+              </Link>
+            </div>
+          </div>
+        ) : !passwordRegisterEnabled ? (
+          <div className='space-y-4'>
+            <InlineMessage tone='info' message={TEXT.passwordRegisterClosed} />
+            <div className='text-sm text-[var(--foreground-secondary)]'>
+              {TEXT.backToLogin}
+              <Link
+                href='/login'
+                className='ml-2 text-[var(--brand-primary)] transition hover:opacity-80'
+              >
+                {TEXT.clickLogin}
+              </Link>
+            </div>
+          </div>
+        ) : (
+          <>
+            <form className='space-y-4' onSubmit={handleSubmit}>
+              <AuthFormField label={TEXT.username} hint={TEXT.usernameHint}>
+                <AuthInput
+                  placeholder={TEXT.username}
+                  {...form.register('username')}
+                />
+                {form.formState.errors.username ? (
+                  <span className='text-xs text-[var(--status-danger-foreground)]'>
+                    {form.formState.errors.username.message}
+                  </span>
+                ) : null}
+              </AuthFormField>
+
+              <AuthFormField label={TEXT.password} hint={TEXT.passwordHint}>
+                <AuthInput
+                  type='password'
+                  placeholder={TEXT.password}
+                  {...form.register('password')}
+                />
+                {form.formState.errors.password ? (
+                  <span className='text-xs text-[var(--status-danger-foreground)]'>
+                    {form.formState.errors.password.message}
+                  </span>
+                ) : null}
+              </AuthFormField>
+
+              <AuthFormField label={TEXT.passwordConfirm}>
+                <AuthInput
+                  type='password'
+                  placeholder={TEXT.passwordConfirm}
+                  {...form.register('password2')}
+                />
+                {form.formState.errors.password2 ? (
+                  <span className='text-xs text-[var(--status-danger-foreground)]'>
+                    {form.formState.errors.password2.message}
+                  </span>
+                ) : null}
+              </AuthFormField>
+
+              {needsEmailVerification ? (
+                <>
+                  <AuthFormField label={TEXT.email}>
+                    <AuthInput
+                      type='email'
+                      placeholder={TEXT.email}
+                      {...form.register('email')}
+                    />
+                    {form.formState.errors.email ? (
+                      <span className='text-xs text-[var(--status-danger-foreground)]'>
+                        {form.formState.errors.email.message}
+                      </span>
+                    ) : null}
+                  </AuthFormField>
+
+                  <AuthFormField label={TEXT.emailCode}>
+                    <div className='flex flex-col gap-3 sm:flex-row'>
+                      <AuthInput
+                        placeholder={TEXT.emailCode}
+                        className='flex-1'
+                        {...form.register('verification_code')}
+                      />
+                      <SecondaryButton
+                        type='button'
+                        onClick={() => {
+                          if (needsTurnstile && !turnstileToken) {
+                            setMessage({
+                              tone: 'info',
+                              text: TEXT.turnstileRequired,
+                            });
+                            return;
+                          }
+                          setMessage(null);
+                          verificationMutation.mutate();
+                        }}
+                        disabled={verificationMutation.isPending}
+                      >
+                        {verificationMutation.isPending
+                          ? TEXT.gettingCode
+                          : TEXT.getCode}
+                      </SecondaryButton>
+                    </div>
+                    {form.formState.errors.verification_code ? (
+                      <span className='text-xs text-[var(--status-danger-foreground)]'>
+                        {form.formState.errors.verification_code.message}
+                      </span>
+                    ) : null}
+                  </AuthFormField>
+                </>
+              ) : null}
+
+              {needsTurnstile && statusQuery.data?.turnstile_site_key ? (
+                <TurnstileWidget
+                  siteKey={statusQuery.data.turnstile_site_key}
+                  onVerify={(token) => setTurnstileToken(token)}
+                  onExpire={() => setTurnstileToken('')}
+                  onError={() => setTurnstileToken('')}
+                />
+              ) : null}
+
+              {message ? (
+                <InlineMessage tone={message.tone} message={message.text} />
+              ) : null}
+
+              <AuthButton type='submit' disabled={registerMutation.isPending}>
+                {registerMutation.isPending ? TEXT.registering : TEXT.register}
+              </AuthButton>
+            </form>
+
+            <div className='mt-6 text-sm text-[var(--foreground-secondary)]'>
+              {TEXT.hasAccount}
+              <Link
+                href='/login'
+                className='ml-2 text-[var(--brand-primary)] transition hover:opacity-80'
+              >
+                {TEXT.clickLogin}
+              </Link>
+            </div>
+          </>
+        )}
+      </AppCard>
+    </PublicAuthGuard>
+  );
+}

openflare_server/web/features/config-versions/components/config-versions-page.tsx

@@ -300,9 +300,6 @@ function PublishPreviewCard({
                 <p className="text-sm font-semibold text-[var(--foreground-primary)]">
                   Pending Main Config
                 </p>
-                <p className="text-xs text-[var(--foreground-secondary)]">
-                  {`Checksum: ${preview.checksum}`}
-                </p>
               </div>
               <CodeBlock className="max-h-[32rem] whitespace-pre-wrap">
                 {preview.main_config}

openflare_server/web/features/config-versions/types.ts

@@ -27,16 +27,22 @@ export interface ConfigPreviewResult {
   support_files: SupportFile[];
   checksum: string;
   route_count: number;
+  website_count: number;
 }
 
 export interface ConfigDiffResult {
   active_version?: string;
+  added_sites: string[];
+  removed_sites: string[];
+  modified_sites: string[];
   added_domains: string[];
   removed_domains: string[];
   modified_domains: string[];
   main_config_changed: boolean;
   changed_option_keys: string[];
   changed_option_details: ConfigOptionDiffItem[];
+  current_website_count: number;
+  active_website_count: number;
 }
 
 export interface ConfigOptionDiffItem {

openflare_server/web/features/nodes/types.ts

@@ -183,16 +183,17 @@ export interface NodeObservabilityTrends {
   disk_io_24h: NodeDiskIOTrendPoint[];
 }
 
-export interface NodeHealthEvent {
-  event_type: string;
-  severity: string;
-  status: string;
-  message: string;
-  first_triggered_at: string;
-  last_triggered_at: string;
-  reported_at: string;
-  resolved_at?: string | null;
-}
+export interface NodeHealthEvent {
+  event_type: string;
+  severity: string;
+  status: string;
+  message: string;
+  metadata_json?: string;
+  first_triggered_at: string;
+  last_triggered_at: string;
+  reported_at: string;
+  resolved_at?: string | null;
+}
 
 export interface NodeObservability {
   node_id: string;

openflare_server/web/features/origins/api/origins.ts

@@ -0,0 +1,35 @@
+import { apiRequest } from '@/lib/api/client';
+
+import type {
+  OriginDetail,
+  OriginItem,
+  OriginMutationPayload,
+} from '@/features/origins/types';
+
+export function getOrigins() {
+  return apiRequest<OriginItem[]>('/origins/');
+}
+
+export function getOrigin(id: number) {
+  return apiRequest<OriginDetail>(`/origins/${id}`);
+}
+
+export function createOrigin(payload: OriginMutationPayload) {
+  return apiRequest<OriginItem>('/origins/', {
+    method: 'POST',
+    body: JSON.stringify(payload),
+  });
+}
+
+export function updateOrigin(id: number, payload: OriginMutationPayload) {
+  return apiRequest<OriginItem>(`/origins/${id}/update`, {
+    method: 'POST',
+    body: JSON.stringify(payload),
+  });
+}
+
+export function deleteOrigin(id: number) {
+  return apiRequest<void>(`/origins/${id}/delete`, {
+    method: 'POST',
+  });
+}

openflare_server/web/features/origins/components/origin-detail-page.tsx

@@ -0,0 +1,220 @@
+'use client';
+
+import Link from 'next/link';
+import { useRouter } from 'next/navigation';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useState } from 'react';
+
+import { EmptyState } from '@/components/feedback/empty-state';
+import { ErrorState } from '@/components/feedback/error-state';
+import { InlineMessage } from '@/components/feedback/inline-message';
+import { LoadingState } from '@/components/feedback/loading-state';
+import { PageHeader } from '@/components/layout/page-header';
+import { AppCard } from '@/components/ui/app-card';
+import { StatusBadge } from '@/components/ui/status-badge';
+import { deleteOrigin, getOrigin } from '@/features/origins/api/origins';
+import { OriginEditorModal } from '@/features/origins/components/origin-editor-modal';
+import {
+  DangerButton,
+  SecondaryButton,
+} from '@/features/shared/components/resource-primitives';
+import { formatDateTime } from '@/lib/utils/date';
+
+export function OriginDetailPage({ originId }: { originId: string }) {
+  const router = useRouter();
+  const queryClient = useQueryClient();
+  const [feedback, setFeedback] = useState<{
+    tone: 'success' | 'danger';
+    message: string;
+  } | null>(null);
+  const [isEditorOpen, setIsEditorOpen] = useState(false);
+
+  const originQuery = useQuery({
+    queryKey: ['origins', originId],
+    queryFn: () => getOrigin(Number(originId)),
+    enabled: originId !== '',
+  });
+
+  const deleteMutation = useMutation({
+    mutationFn: deleteOrigin,
+    onSuccess: async () => {
+      await queryClient.invalidateQueries({ queryKey: ['origins'] });
+      router.push('/origin');
+    },
+    onError: (error) => {
+      setFeedback({
+        tone: 'danger',
+        message:
+          error instanceof Error ? error.message : '请求失败，请稍后重试。',
+      });
+    },
+  });
+
+  if (originQuery.isLoading) {
+    return <LoadingState />;
+  }
+
+  if (originQuery.isError) {
+    return (
+      <ErrorState
+        title="源站详情加载失败"
+        description={
+          originQuery.error instanceof Error
+            ? originQuery.error.message
+            : '请求失败，请稍后重试。'
+        }
+      />
+    );
+  }
+
+  const origin = originQuery.data;
+  if (!origin) {
+    return (
+      <EmptyState
+        title="源站不存在"
+        description="该源站可能已被删除，或当前 ID 无法匹配到源站记录。"
+      />
+    );
+  }
+
+  const handleDelete = () => {
+    if (!window.confirm(`确认删除源站 ${origin.name} 吗？`)) {
+      return;
+    }
+    deleteMutation.mutate(origin.id);
+  };
+
+  return (
+    <>
+      <div className="space-y-6">
+        <PageHeader
+          title={origin.name}
+          description="源站详情"
+          action={
+            <>
+              <Link
+                href="/origin"
+                className="inline-flex items-center justify-center rounded-2xl border border-[var(--border-default)] bg-[var(--control-background)] px-4 py-3 text-sm font-medium text-[var(--foreground-primary)] transition hover:bg-[var(--control-background-hover)]"
+              >
+                返回
+              </Link>
+              <SecondaryButton
+                type="button"
+                onClick={() => setIsEditorOpen(true)}
+              >
+                编辑源站
+              </SecondaryButton>
+              <DangerButton
+                type="button"
+                onClick={handleDelete}
+                disabled={deleteMutation.isPending}
+              >
+                删除源站
+              </DangerButton>
+            </>
+          }
+        />
+
+        {feedback ? (
+          <InlineMessage tone={feedback.tone} message={feedback.message} />
+        ) : null}
+
+        <div className="grid gap-4 xl:grid-cols-4">
+          <AppCard title="源站地址">
+            <p className="text-sm text-[var(--foreground-primary)]">
+              {origin.address}
+            </p>
+          </AppCard>
+          <AppCard title="绑定规则">
+            <div className="space-y-3">
+              <StatusBadge
+                label={`${origin.route_count} 条规则`}
+                variant={origin.route_count > 0 ? 'success' : 'warning'}
+              />
+              <p className="text-sm text-[var(--foreground-secondary)]">
+                编辑地址后，绑定规则的主源站地址会一起更新。
+              </p>
+            </div>
+          </AppCard>
+          <AppCard title="创建时间">
+            <p className="text-sm text-[var(--foreground-secondary)]">
+              {formatDateTime(origin.created_at)}
+            </p>
+          </AppCard>
+          <AppCard title="更新时间">
+            <p className="text-sm text-[var(--foreground-secondary)]">
+              {formatDateTime(origin.updated_at)}
+            </p>
+          </AppCard>
+        </div>
+
+        <AppCard title="备注">
+          <p className="text-sm text-[var(--foreground-secondary)]">
+            {origin.remark || '暂无备注'}
+          </p>
+        </AppCard>
+
+        <AppCard
+          title="关联规则"
+          description="展示当前源站作为主源站绑定的规则。"
+        >
+          {origin.routes.length === 0 ? (
+            <EmptyState
+              title="暂无关联规则"
+              description="当前源站还没有被任何规则引用。"
+            />
+          ) : (
+            <div className="overflow-x-auto">
+              <table className="min-w-full divide-y divide-[var(--border-default)] text-left text-sm">
+                <thead>
+                  <tr className="text-[var(--foreground-secondary)]">
+                    <th className="px-3 py-3 font-medium">域名</th>
+                    <th className="px-3 py-3 font-medium">源站地址</th>
+                    <th className="px-3 py-3 font-medium">状态</th>
+                    <th className="px-3 py-3 font-medium">更新时间</th>
+                  </tr>
+                </thead>
+                <tbody className="divide-y divide-[var(--border-default)]">
+                  {origin.routes.map((route) => (
+                    <tr key={route.id}>
+                      <td className="px-3 py-4 font-medium text-[var(--foreground-primary)]">
+                        {route.domain}
+                      </td>
+                      <td className="px-3 py-4 text-[var(--foreground-secondary)]">
+                        {route.origin_url}
+                      </td>
+                      <td className="px-3 py-4">
+                        <StatusBadge
+                          label={route.enabled ? '启用' : '停用'}
+                          variant={route.enabled ? 'success' : 'warning'}
+                        />
+                      </td>
+                      <td className="px-3 py-4 text-[var(--foreground-secondary)]">
+                        {formatDateTime(route.updated_at)}
+                      </td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+            </div>
+          )}
+        </AppCard>
+      </div>
+
+      {isEditorOpen ? (
+        <OriginEditorModal
+          isOpen={isEditorOpen}
+          origin={origin}
+          onClose={() => setIsEditorOpen(false)}
+          onSaved={() => {
+            setFeedback({ tone: 'success', message: '源站已更新。' });
+            void queryClient.invalidateQueries({
+              queryKey: ['origins', origin.id],
+            });
+            void queryClient.invalidateQueries({ queryKey: ['origins'] });
+          }}
+        />
+      ) : null}
+    </>
+  );
+}

openflare_server/web/features/origins/components/origin-editor-modal.tsx

@@ -0,0 +1,171 @@
+'use client';
+
+import { zodResolver } from '@hookform/resolvers/zod';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { useEffect } from 'react';
+import { useForm } from 'react-hook-form';
+import { z } from 'zod';
+
+import { AppModal } from '@/components/ui/app-modal';
+import { createOrigin, updateOrigin } from '@/features/origins/api/origins';
+import type {
+  OriginItem,
+  OriginMutationPayload,
+} from '@/features/origins/types';
+import {
+  PrimaryButton,
+  ResourceField,
+  ResourceInput,
+  ResourceTextarea,
+  SecondaryButton,
+} from '@/features/shared/components/resource-primitives';
+
+const originSchema = z.object({
+  name: z.string().max(255, '源站名不能超过 255 个字符'),
+  address: z
+    .string()
+    .trim()
+    .min(1, '请输入源站地址')
+    .refine(
+      (value) => !/[/?#]/.test(value) && !value.includes('://'),
+      '源站地址格式不合法',
+    ),
+  remark: z.string().max(255, '备注不能超过 255 个字符'),
+});
+
+type OriginFormValues = z.infer<typeof originSchema>;
+
+function toPayload(values: OriginFormValues): OriginMutationPayload {
+  return {
+    name: values.name.trim(),
+    address: values.address.trim(),
+    remark: values.remark.trim(),
+  };
+}
+
+function toFormValues(origin?: OriginItem | null): OriginFormValues {
+  if (!origin) {
+    return {
+      name: '',
+      address: '',
+      remark: '',
+    };
+  }
+  return {
+    name: origin.name,
+    address: origin.address,
+    remark: origin.remark || '',
+  };
+}
+
+export function OriginEditorModal({
+  isOpen,
+  onClose,
+  origin,
+  onSaved,
+}: {
+  isOpen: boolean;
+  onClose: () => void;
+  origin?: OriginItem | null;
+  onSaved?: (origin: OriginItem, mode: 'create' | 'update') => void;
+}) {
+  const queryClient = useQueryClient();
+  const form = useForm<OriginFormValues>({
+    resolver: zodResolver(originSchema),
+    defaultValues: toFormValues(origin),
+  });
+
+  useEffect(() => {
+    form.reset(toFormValues(origin));
+  }, [form, origin, isOpen]);
+
+  const mutation = useMutation({
+    mutationFn: async (values: OriginFormValues) => {
+      const payload = toPayload(values);
+      return origin ? updateOrigin(origin.id, payload) : createOrigin(payload);
+    },
+    onSuccess: async (savedOrigin) => {
+      await Promise.all([
+        queryClient.invalidateQueries({ queryKey: ['origins'] }),
+        queryClient.invalidateQueries({ queryKey: ['proxy-routes'] }),
+      ]);
+      onSaved?.(savedOrigin, origin ? 'update' : 'create');
+      onClose();
+    },
+  });
+
+  const handleSubmit = form.handleSubmit((values) => {
+    mutation.mutate(values);
+  });
+
+  return (
+    <AppModal
+      isOpen={isOpen}
+      onClose={onClose}
+      title={origin ? '编辑源站' : '新增源站'}
+      description="源站会作为规则里的可复用地址目录，协议和端口仍由规则决定。"
+      footer={
+        <div className="flex flex-wrap justify-end gap-3">
+          <SecondaryButton type="button" onClick={onClose}>
+            取消
+          </SecondaryButton>
+          <PrimaryButton
+            type="submit"
+            form="origin-editor-form"
+            disabled={mutation.isPending}
+          >
+            {mutation.isPending
+              ? '保存中...'
+              : origin
+                ? '保存修改'
+                : '新增源站'}
+          </PrimaryButton>
+        </div>
+      }
+    >
+      <form
+        id="origin-editor-form"
+        className="space-y-5"
+        onSubmit={handleSubmit}
+      >
+        <div className="grid gap-4 md:grid-cols-2">
+          <ResourceField
+            label="源站地址"
+            hint="支持 IP、域名或主机名，例如 10.0.0.10、origin.internal。"
+            error={form.formState.errors.address?.message}
+          >
+            <ResourceInput
+              placeholder="origin.internal"
+              {...form.register('address')}
+            />
+          </ResourceField>
+          <ResourceField
+            label="源站名"
+            hint="可选，留空时默认使用源站地址。"
+            error={form.formState.errors.name?.message}
+          >
+            <ResourceInput placeholder="主站源站" {...form.register('name')} />
+          </ResourceField>
+        </div>
+
+        <ResourceField
+          label="备注"
+          error={form.formState.errors.remark?.message}
+        >
+          <ResourceTextarea
+            placeholder="例如：主站内网入口"
+            {...form.register('remark')}
+          />
+        </ResourceField>
+
+        {mutation.isError ? (
+          <p className="text-sm text-[var(--status-danger-foreground)]">
+            {mutation.error instanceof Error
+              ? mutation.error.message
+              : '请求失败，请稍后重试。'}
+          </p>
+        ) : null}
+      </form>
+    </AppModal>
+  );
+}

openflare_server/web/features/origins/components/origins-page.tsx

@@ -0,0 +1,192 @@
+'use client';
+
+import Link from 'next/link';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useMemo, useState } from 'react';
+
+import { EmptyState } from '@/components/feedback/empty-state';
+import { ErrorState } from '@/components/feedback/error-state';
+import { InlineMessage } from '@/components/feedback/inline-message';
+import { LoadingState } from '@/components/feedback/loading-state';
+import { PageHeader } from '@/components/layout/page-header';
+import { AppCard } from '@/components/ui/app-card';
+import { StatusBadge } from '@/components/ui/status-badge';
+import { deleteOrigin, getOrigins } from '@/features/origins/api/origins';
+import { OriginEditorModal } from '@/features/origins/components/origin-editor-modal';
+import type { OriginItem } from '@/features/origins/types';
+import {
+  DangerButton,
+  PrimaryButton,
+  SecondaryButton,
+} from '@/features/shared/components/resource-primitives';
+import { formatDateTime } from '@/lib/utils/date';
+
+type FeedbackState = {
+  tone: 'success' | 'danger';
+  message: string;
+};
+
+export function OriginsPage() {
+  const queryClient = useQueryClient();
+  const [feedback, setFeedback] = useState<FeedbackState | null>(null);
+  const [editingOrigin, setEditingOrigin] = useState<OriginItem | null>(null);
+  const [isEditorOpen, setIsEditorOpen] = useState(false);
+
+  const originsQuery = useQuery({
+    queryKey: ['origins'],
+    queryFn: getOrigins,
+  });
+
+  const deleteMutation = useMutation({
+    mutationFn: deleteOrigin,
+    onSuccess: async () => {
+      setFeedback({ tone: 'success', message: '源站已删除。' });
+      await queryClient.invalidateQueries({ queryKey: ['origins'] });
+    },
+    onError: (error) => {
+      setFeedback({
+        tone: 'danger',
+        message:
+          error instanceof Error ? error.message : '请求失败，请稍后重试。',
+      });
+    },
+  });
+
+  const origins = useMemo(() => originsQuery.data ?? [], [originsQuery.data]);
+
+  const handleDelete = (origin: OriginItem) => {
+    if (!window.confirm(`确认删除源站 ${origin.name} 吗？`)) {
+      return;
+    }
+    setFeedback(null);
+    deleteMutation.mutate(origin.id);
+  };
+
+  return (
+    <>
+      <div className="space-y-6">
+        <PageHeader
+          title="源站"
+          description="集中维护规则复用的源站地址，减少批量改地址时的重复操作。"
+          action={
+            <PrimaryButton
+              type="button"
+              onClick={() => {
+                setEditingOrigin(null);
+                setFeedback(null);
+                setIsEditorOpen(true);
+              }}
+            >
+              新增源站
+            </PrimaryButton>
+          }
+        />
+
+        {feedback ? (
+          <InlineMessage tone={feedback.tone} message={feedback.message} />
+        ) : null}
+
+        <AppCard
+          title="源站列表"
+          description="编辑源站地址后，所有引用该源站的规则会同步更新。"
+        >
+          {originsQuery.isLoading ? (
+            <LoadingState />
+          ) : originsQuery.isError ? (
+            <ErrorState
+              title="源站列表加载失败"
+              description={
+                originsQuery.error instanceof Error
+                  ? originsQuery.error.message
+                  : '请求失败，请稍后重试。'
+              }
+            />
+          ) : origins.length === 0 ? (
+            <EmptyState
+              title="暂无源站"
+              description="点击右上角“新增源站”开始录入。后续规则可直接复用这些地址。"
+            />
+          ) : (
+            <div className="grid gap-4 lg:grid-cols-2">
+              {origins.map((origin) => (
+                <article
+                  key={origin.id}
+                  className="rounded-[28px] border border-[var(--border-default)] bg-[var(--surface-elevated)] p-5"
+                >
+                  <div className="flex items-start justify-between gap-4">
+                    <div className="space-y-4">
+                      <div className="space-y-2">
+                        <div className="flex flex-wrap items-center gap-2">
+                          <h2 className="text-lg font-semibold text-[var(--foreground-primary)]">
+                            {origin.name}
+                          </h2>
+                          <StatusBadge
+                            label={`${origin.route_count} 条规则`}
+                            variant={
+                              origin.route_count > 0 ? 'success' : 'warning'
+                            }
+                          />
+                        </div>
+                        <p className="text-sm text-[var(--foreground-primary)]">
+                          {origin.address}
+                        </p>
+                        <p className="text-sm text-[var(--foreground-secondary)]">
+                          {origin.remark || '暂无备注'}
+                        </p>
+                      </div>
+
+                      <div className="rounded-2xl border border-[var(--border-default)] bg-[var(--surface-panel)] px-4 py-3 text-sm text-[var(--foreground-secondary)]">
+                        最后更新：{formatDateTime(origin.updated_at)}
+                      </div>
+                    </div>
+
+                    <div className="flex flex-row gap-2">
+                      <Link
+                        href={`/origin/detail?id=${origin.id}`}
+                        className="inline-flex items-center justify-center rounded-2xl border border-[var(--border-default)] bg-[var(--control-background)] px-4 py-3 text-sm font-medium text-[var(--foreground-primary)] transition hover:bg-[var(--control-background-hover)]"
+                      >
+                        详情
+                      </Link>
+                      <SecondaryButton
+                        type="button"
+                        onClick={() => {
+                          setEditingOrigin(origin);
+                          setFeedback(null);
+                          setIsEditorOpen(true);
+                        }}
+                      >
+                        编辑
+                      </SecondaryButton>
+                      <DangerButton
+                        type="button"
+                        onClick={() => handleDelete(origin)}
+                        disabled={deleteMutation.isPending}
+                      >
+                        删除
+                      </DangerButton>
+                    </div>
+                  </div>
+                </article>
+              ))}
+            </div>
+          )}
+        </AppCard>
+      </div>
+
+      {isEditorOpen ? (
+        <OriginEditorModal
+          isOpen={isEditorOpen}
+          origin={editingOrigin}
+          onClose={() => setIsEditorOpen(false)}
+          onSaved={(origin, mode) => {
+            setFeedback({
+              tone: 'success',
+              message: mode === 'create' ? '源站已创建。' : '源站已更新。',
+            });
+            setEditingOrigin(origin);
+          }}
+        />
+      ) : null}
+    </>
+  );
+}

openflare_server/web/features/origins/types.ts

@@ -0,0 +1,27 @@
+export interface OriginItem {
+  id: number;
+  name: string;
+  address: string;
+  remark: string;
+  route_count: number;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface OriginRouteSummary {
+  id: number;
+  domain: string;
+  origin_url: string;
+  enabled: boolean;
+  updated_at: string;
+}
+
+export interface OriginDetail extends OriginItem {
+  routes: OriginRouteSummary[];
+}
+
+export interface OriginMutationPayload {
+  name: string;
+  address: string;
+  remark: string;
+}

openflare_server/web/features/performance/components/performance-page.tsx

@@ -12,7 +12,7 @@ import {useAuth} from '@/components/providers/auth-provider';
 import {AppCard} from '@/components/ui/app-card';
 import {StatusBadge} from '@/components/ui/status-badge';
 import {getConfigVersionPreview} from '@/features/config-versions/api/config-versions';
-import {getOptions, updateOption} from '@/features/settings/api/settings';
+import {getOptions, updateOptions} from '@/features/settings/api/settings';
 import type {OptionItem} from '@/features/settings/types';
 import {
     CodeBlock,
@@ -277,9 +277,7 @@ export function PerformancePage() {
         entries: Array<[string, string]>,
         successMessage: string,
     ) => {
-        for (const [key, value] of entries) {
-            await updateOption(key, value);
-        }
+        await updateOptions(entries.map(([key, value]) => ({key, value})));
 
         await Promise.all([
             queryClient.invalidateQueries({queryKey: settingsQueryKey}),

openflare_server/web/features/proxy-routes/api/proxy-routes.ts

@@ -7,12 +7,16 @@ import type {
   TlsCertificateItem,
 } from '@/features/proxy-routes/types';
 
-export function getProxyRoutes() {
-  return apiRequest<ProxyRouteItem[]>('/proxy-routes/');
-}
-
-export function createProxyRoute(payload: ProxyRouteMutationPayload) {
-  return apiRequest<ProxyRouteItem>('/proxy-routes/', {
+export function getProxyRoutes() {
+  return apiRequest<ProxyRouteItem[]>('/proxy-routes/');
+}
+
+export function getProxyRoute(id: number) {
+  return apiRequest<ProxyRouteItem>(`/proxy-routes/${id}`);
+}
+
+export function createProxyRoute(payload: ProxyRouteMutationPayload) {
+  return apiRequest<ProxyRouteItem>('/proxy-routes/', {
     method: 'POST',
     body: JSON.stringify(payload),
   });

openflare_server/web/features/proxy-routes/components/domain-list-input.tsx

@@ -0,0 +1,268 @@
+'use client';
+
+import { useId, useMemo } from 'react';
+import { Minus, Plus } from 'lucide-react';
+
+import type { TlsCertificateItem } from '@/features/tls-certificates/types';
+import {
+  ResourceInput,
+  ResourceSelect,
+  SecondaryButton,
+} from '@/features/shared/components/resource-primitives';
+export type DomainListRow = {
+  domain: string;
+  certificateId: string;
+};
+
+const actionButtonBaseClassName = 'h-11 w-11 shrink-0 rounded-2xl px-0';
+const removeButtonClassName =
+  'border-[var(--border-default)] bg-[var(--surface-elevated)] text-[var(--foreground-secondary)] hover:border-[var(--status-danger-border)] hover:bg-[var(--status-danger-soft)] hover:text-[var(--status-danger-foreground)] disabled:border-[var(--border-default)] disabled:bg-[var(--surface-muted)] disabled:text-[var(--foreground-muted)]';
+const addButtonClassName =
+  'border-dashed border-[var(--border-default)] bg-[var(--surface-muted)] text-[var(--foreground-secondary)] hover:border-[var(--brand-primary)] hover:bg-[var(--brand-primary-soft)] hover:text-[var(--brand-primary)]';
+
+function ensureRows(rows: DomainListRow[]) {
+  return rows.length > 0 ? rows : [{ domain: '', certificateId: '' }];
+}
+
+function buildSuggestionSources(domains: string[]) {
+  const values = new Set<string>();
+
+  for (const domain of domains) {
+    const normalized = domain.trim().toLowerCase().replace(/^\*\./, '');
+    if (!normalized) {
+      continue;
+    }
+
+    values.add(normalized);
+
+    const segments = normalized.split('.');
+    for (let index = 1; index < segments.length - 1; index += 1) {
+      values.add(segments.slice(index).join('.'));
+    }
+  }
+
+  return Array.from(values);
+}
+
+function buildDomainSuggestions(
+  input: string,
+  sources: string[],
+  rows: DomainListRow[],
+) {
+  const normalizedInput = input.trim().toLowerCase();
+  if (!normalizedInput) {
+    return [];
+  }
+
+  const existingDomains = new Set(
+    rows
+      .map((row) => row.domain.trim().toLowerCase())
+      .filter((row) => row && row !== normalizedInput),
+  );
+  const suggestions: string[] = [];
+
+  for (const source of sources) {
+    if (source.startsWith(normalizedInput) && source !== normalizedInput) {
+      suggestions.push(source);
+    }
+
+    const separatorIndex = normalizedInput.lastIndexOf('.');
+    if (separatorIndex <= 0) {
+      continue;
+    }
+
+    const prefix = normalizedInput.slice(0, separatorIndex);
+    const suffixInput = normalizedInput.slice(separatorIndex + 1);
+
+    if (!suffixInput || source.startsWith(suffixInput)) {
+      suggestions.push(`${prefix}.${source}`);
+    }
+  }
+
+  return suggestions.filter((suggestion, index) => {
+    return (
+      suggestion !== normalizedInput &&
+      !existingDomains.has(suggestion) &&
+      suggestions.indexOf(suggestion) === index
+    );
+  });
+}
+
+export function buildDomainRowsFromRoute(
+  domains: string[],
+  domainCertIDs: number[],
+  certIDs: number[],
+): DomainListRow[] {
+  if (domains.length === 0) {
+    return ensureRows([]);
+  }
+
+  if (domainCertIDs.length === domains.length) {
+    return domains.map((domain, index) => ({
+      domain,
+      certificateId: domainCertIDs[index]
+        ? String(domainCertIDs[index])
+        : '',
+    }));
+  }
+
+  if (certIDs.length === 0) {
+    return domains.map((domain) => ({ domain, certificateId: '' }));
+  }
+
+  if (certIDs.length === 1) {
+    return domains.map((domain) => ({
+      domain,
+      certificateId: String(certIDs[0]),
+    }));
+  }
+
+  return domains.map((domain, index) => ({
+    domain,
+    certificateId: certIDs[index] ? String(certIDs[index]) : '',
+  }));
+}
+
+export function DomainListInput({
+  rows,
+  onChange,
+  onBlur,
+  suggestionSources = [],
+  certificates = [],
+  domainPlaceholder = 'app.example.com',
+}: {
+  rows: DomainListRow[];
+  onChange: (rows: DomainListRow[]) => void;
+  onBlur?: () => void;
+  suggestionSources?: string[];
+  certificates?: TlsCertificateItem[];
+  domainPlaceholder?: string;
+}) {
+  const listId = useId();
+  const safeRows = ensureRows(rows);
+  const normalizedSources = useMemo(
+    () => buildSuggestionSources(suggestionSources),
+    [suggestionSources],
+  );
+
+  const updateRows = (nextRows: DomainListRow[]) => {
+    onChange(ensureRows(nextRows));
+  };
+
+  return (
+    <div className="space-y-4">
+      {safeRows.map((row, index) => {
+        const suggestions = buildDomainSuggestions(
+          row.domain,
+          normalizedSources,
+          safeRows,
+        ).slice(0, 4);
+
+        return (
+          <div key={`${index}-${safeRows.length}`} className="space-y-2">
+            <div className="grid gap-3 md:grid-cols-[44px_minmax(0,1fr)_280px] md:items-start">
+              <SecondaryButton
+                type="button"
+                aria-label={`删除域名输入框 ${index + 1}`}
+                className={`${actionButtonBaseClassName} ${removeButtonClassName}`}
+                disabled={safeRows.length === 1}
+                onClick={() => {
+                  if (safeRows.length === 1) {
+                    updateRows([{ domain: '', certificateId: '' }]);
+                    return;
+                  }
+
+                  updateRows(
+                    safeRows.filter((_, rowIndex) => rowIndex !== index),
+                  );
+                }}
+              >
+                <Minus aria-hidden="true" className="h-[14px] w-[14px]" />
+              </SecondaryButton>
+
+              <div className="min-w-0 space-y-2">
+                <ResourceInput
+                  value={row.domain}
+                  list={`${listId}-${index}`}
+                  aria-label={`域名 ${index + 1}`}
+                  placeholder={index === 0 ? domainPlaceholder : 'www.example.com'}
+                  onBlur={onBlur}
+                  onChange={(event) => {
+                    const nextRows = safeRows.slice();
+                    nextRows[index] = {
+                      ...nextRows[index],
+                      domain: event.target.value,
+                    };
+                    updateRows(nextRows);
+                  }}
+                  className="h-12"
+                />
+                <datalist id={`${listId}-${index}`}>
+                  {suggestions.map((suggestion) => (
+                    <option key={suggestion} value={suggestion} />
+                  ))}
+                </datalist>
+
+                {suggestions.length > 0 ? (
+                  <div className="flex flex-wrap gap-2">
+                    {suggestions.map((suggestion) => (
+                      <button
+                        key={suggestion}
+                        type="button"
+                        className="inline-flex items-center rounded-full border border-[var(--border-default)] bg-[var(--surface-panel)] px-3 py-1 text-xs text-[var(--foreground-secondary)] transition hover:border-[var(--border-strong)] hover:text-[var(--foreground-primary)]"
+                        onClick={() => {
+                          const nextRows = safeRows.slice();
+                          nextRows[index] = {
+                            ...nextRows[index],
+                            domain: suggestion,
+                          };
+                          updateRows(nextRows);
+                        }}
+                      >
+                        {suggestion}
+                      </button>
+                    ))}
+                  </div>
+                ) : null}
+              </div>
+
+              <ResourceSelect
+                aria-label={`证书 ${index + 1}`}
+                value={row.certificateId}
+                onChange={(event) => {
+                  const nextRows = safeRows.slice();
+                  nextRows[index] = {
+                    ...nextRows[index],
+                    certificateId: event.target.value,
+                  };
+                  updateRows(nextRows);
+                }}
+                className="h-12"
+              >
+                <option value="">
+                  {certificates.length === 0 ? '暂无可选证书' : '选择证书'}
+                </option>
+                {certificates.map((certificate) => (
+                  <option key={certificate.id} value={certificate.id}>
+                    {certificate.name}
+                  </option>
+                ))}
+              </ResourceSelect>
+            </div>
+          </div>
+        );
+      })}
+
+      <SecondaryButton
+        type="button"
+        aria-label="新增域名输入框"
+        className={`${actionButtonBaseClassName} ${addButtonClassName}`}
+        onClick={() => {
+          updateRows([...safeRows, { domain: '', certificateId: '' }]);
+        }}
+      >
+        <Plus aria-hidden="true" className="h-[14px] w-[14px]" />
+      </SecondaryButton>
+    </div>
+  );
+}

openflare_server/web/features/proxy-routes/components/proxy-route-config-page.tsx

@@ -0,0 +1,927 @@
+'use client';
+
+import Link from 'next/link';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useEffect, useMemo, useState } from 'react';
+import type { ReactNode } from 'react';
+import { Controller, useForm } from 'react-hook-form';
+import { z } from 'zod';
+
+import { EmptyState } from '@/components/feedback/empty-state';
+import { ErrorState } from '@/components/feedback/error-state';
+import { InlineMessage } from '@/components/feedback/inline-message';
+import { LoadingState } from '@/components/feedback/loading-state';
+import { PageHeader } from '@/components/layout/page-header';
+import { AppCard } from '@/components/ui/app-card';
+import { getManagedDomains } from '@/features/managed-domains/api/managed-domains';
+import {
+  getProxyRoute,
+  updateProxyRoute,
+} from '@/features/proxy-routes/api/proxy-routes';
+import {
+  buildDomainRowsFromRoute,
+  DomainListInput,
+  type DomainListRow,
+} from '@/features/proxy-routes/components/domain-list-input';
+import {
+  buildPayloadFromRoute,
+  customHeadersToText,
+  getErrorMessage,
+  getWebsiteConfigSection,
+  linesFromTextarea,
+  normalizeLimitRate,
+  parseCustomHeadersText,
+  parseOriginUrl,
+  parseOriginUrls,
+  validateCacheRules,
+  validateDomains,
+  validateLimitRate,
+  validateOriginHost,
+  websiteConfigSections,
+} from '@/features/proxy-routes/helpers';
+import type {
+  ProxyRouteItem,
+  ProxyRouteMutationPayload,
+} from '@/features/proxy-routes/types';
+import { getTlsCertificates } from '@/features/tls-certificates/api/tls-certificates';
+import type { TlsCertificateItem } from '@/features/tls-certificates/types';
+import {
+  PrimaryButton,
+  ResourceField,
+  ResourceInput,
+  ResourceSelect,
+  ResourceTextarea,
+  SecondaryButton,
+  ToggleField,
+} from '@/features/shared/components/resource-primitives';
+import { cn } from '@/lib/utils/cn';
+
+type FeedbackState = {
+  tone: 'success' | 'danger';
+  message: string;
+};
+
+type SaveContext = {
+  message: string;
+};
+
+type SaveHandler = (
+  payload: ProxyRouteMutationPayload,
+  context: SaveContext,
+) => void;
+
+const domainSettingsSchema = z
+  .object({
+    site_name: z
+      .string()
+      .trim()
+      .min(1, '请输入站点标识')
+      .max(255, '站点标识不能超过 255 个字符'),
+    domain_rows: z
+      .array(
+        z.object({
+          domain: z.string(),
+          certificateId: z.string(),
+        }),
+      )
+      .min(1),
+    enabled: z.boolean(),
+    redirect_http: z.boolean(),
+  })
+  .superRefine((value, context) => {
+    const domains = value.domain_rows
+      .map((item) => item.domain.trim().toLowerCase())
+      .filter(Boolean);
+    const error = validateDomains(domains);
+    if (error) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['domain_rows'],
+        message: error,
+      });
+    }
+
+    const selectedCertificateCount = new Set(
+      value.domain_rows
+        .map((item) => Number(item.certificateId))
+        .filter((item) => Number.isFinite(item) && item > 0),
+    ).size;
+    if (value.redirect_http && selectedCertificateCount === 0) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['redirect_http'],
+        message: '启用 HTTP 跳转前，请先为域名选择证书',
+      });
+    }
+  });
+
+const rateLimitSchema = z
+  .object({
+    limit_conn_per_server: z.string(),
+    limit_conn_per_ip: z.string(),
+    limit_rate: z.string(),
+  })
+  .superRefine((value, context) => {
+    for (const field of ['limit_conn_per_server', 'limit_conn_per_ip'] as const) {
+      const rawValue = value[field].trim();
+      if (!rawValue) {
+        continue;
+      }
+      if (!/^\d+$/.test(rawValue)) {
+        context.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [field],
+          message: '请输入大于等于 0 的整数',
+        });
+      }
+    }
+
+    const limitRateError = validateLimitRate(value.limit_rate);
+    if (limitRateError) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['limit_rate'],
+        message: limitRateError,
+      });
+    }
+  });
+
+const reverseProxySchema = z
+  .object({
+    origin_urls_text: z.string().trim().min(1, '请至少填写一个上游地址'),
+    origin_host: z.string(),
+    custom_headers_text: z.string(),
+    remark: z.string().max(255, '备注不能超过 255 个字符'),
+  })
+  .superRefine((value, context) => {
+    const { error } = parseOriginUrls(value.origin_urls_text);
+    if (error) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['origin_urls_text'],
+        message: error,
+      });
+    }
+
+    const originHostError = validateOriginHost(value.origin_host);
+    if (originHostError) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['origin_host'],
+        message: originHostError,
+      });
+    }
+
+    const { error: headerError } = parseCustomHeadersText(
+      value.custom_headers_text,
+    );
+    if (headerError) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['custom_headers_text'],
+        message: headerError,
+      });
+    }
+  });
+
+const cacheSchema = z
+  .object({
+    cache_enabled: z.boolean(),
+    cache_policy: z.enum(['url', 'suffix', 'path_prefix', 'path_exact']),
+    cache_rules_text: z.string(),
+  })
+  .superRefine((value, context) => {
+    if (!value.cache_enabled) {
+      return;
+    }
+
+    const rules = linesFromTextarea(value.cache_rules_text);
+    const error = validateCacheRules(value.cache_policy, rules);
+    if (error) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['cache_rules_text'],
+        message: error,
+      });
+    }
+  });
+
+type DomainSettingsValues = z.infer<typeof domainSettingsSchema>;
+type RateLimitValues = z.infer<typeof rateLimitSchema>;
+type ReverseProxyValues = z.infer<typeof reverseProxySchema>;
+type CacheValues = z.infer<typeof cacheSchema>;
+
+function normalizeSelectedCertificateIDs(rows: DomainListRow[]) {
+  return Array.from(
+    new Set(
+      rows
+        .filter((item) => item.domain.trim() !== '')
+        .map((item) => Number(item.certificateId))
+        .filter((item) => Number.isFinite(item) && item > 0),
+    ),
+  );
+}
+
+function buildDomainCertificateIDs(rows: DomainListRow[]) {
+  return rows
+    .filter((item) => item.domain.trim() !== '')
+    .map((item) => {
+      const certificateID = Number(item.certificateId);
+      return Number.isFinite(certificateID) && certificateID > 0
+        ? certificateID
+        : 0;
+    });
+}
+
+function buildDomainRows(route: ProxyRouteItem) {
+  const selectedCertIDs =
+    route.cert_ids.length > 0
+      ? route.cert_ids
+      : route.cert_id
+        ? [route.cert_id]
+        : [];
+
+  return buildDomainRowsFromRoute(
+    route.domains,
+    route.domain_cert_ids,
+    selectedCertIDs,
+  );
+}
+
+function ConfigSectionShell({
+  title,
+  description,
+  formId,
+  saving,
+  children,
+}: {
+  title: string;
+  description: string;
+  formId: string;
+  saving: boolean;
+  children: ReactNode;
+}) {
+  return (
+    <AppCard
+      title={title}
+      description={description}
+      action={
+        <PrimaryButton type="submit" form={formId} disabled={saving}>
+          {saving ? '保存中...' : '保存'}
+        </PrimaryButton>
+      }
+    >
+      {children}
+    </AppCard>
+  );
+}
+
+function DomainSettingsSection({
+  route,
+  certificates,
+  saving,
+  onSave,
+  suggestionSources,
+}: {
+  route: ProxyRouteItem;
+  certificates: TlsCertificateItem[];
+  saving: boolean;
+  onSave: SaveHandler;
+  suggestionSources: string[];
+}) {
+  const form = useForm<DomainSettingsValues>({
+    resolver: zodResolver(domainSettingsSchema),
+    defaultValues: {
+      site_name: route.site_name,
+      domain_rows: buildDomainRows(route),
+      enabled: route.enabled,
+      redirect_http: route.redirect_http,
+    },
+  });
+
+  useEffect(() => {
+    form.reset({
+      site_name: route.site_name,
+      domain_rows: buildDomainRows(route),
+      enabled: route.enabled,
+      redirect_http: route.redirect_http,
+    });
+  }, [form, route]);
+
+  const selectedCertificateIDs = normalizeSelectedCertificateIDs(
+    form.watch('domain_rows'),
+  );
+
+  return (
+    <ConfigSectionShell
+      title="域名设置"
+      description="在一个列表里同时维护域名、证书和 HTTPS 跳转。保存时会自动汇总站点证书集合。"
+      formId="proxy-route-domains-form"
+      saving={saving}
+    >
+      <form
+        id="proxy-route-domains-form"
+        className="space-y-5"
+        onSubmit={form.handleSubmit((values) => {
+          const domains = values.domain_rows
+            .map((item) => item.domain.trim().toLowerCase())
+            .filter(Boolean);
+          const domainCertIDs = buildDomainCertificateIDs(values.domain_rows);
+          const certIDs = normalizeSelectedCertificateIDs(values.domain_rows);
+
+          onSave(
+            buildPayloadFromRoute(route, {
+              site_name: values.site_name.trim(),
+              domain: domains[0],
+              domains,
+              enabled: values.enabled,
+              enable_https: certIDs.length > 0,
+              cert_id: certIDs[0] ?? null,
+              cert_ids: certIDs,
+              domain_cert_ids: domainCertIDs,
+              redirect_http: certIDs.length > 0 ? values.redirect_http : false,
+            }),
+            { message: '域名设置已保存。' },
+          );
+        })}
+      >
+        <ToggleField
+          label="启用站点"
+          description="关闭后会保留配置，但不会参与发布。"
+          checked={form.watch('enabled')}
+          onChange={(checked) =>
+            form.setValue('enabled', checked, { shouldDirty: true })
+          }
+        />
+
+        <ResourceField
+          label="站点标识"
+          hint="建议使用稳定、可读的业务标识，不必与域名完全一致。"
+          error={form.formState.errors.site_name?.message}
+        >
+          <ResourceInput
+            placeholder="marketing-site"
+            {...form.register('site_name')}
+          />
+        </ResourceField>
+
+        <ResourceField
+          label="域名列表"
+          hint="每行配置一个域名。可为不同域名选择不同证书，相同证书也可以重复选择。"
+          error={form.formState.errors.domain_rows?.message as string | undefined}
+          container="div"
+        >
+          <Controller
+            control={form.control}
+            name="domain_rows"
+            render={({ field }) => (
+              <DomainListInput
+                rows={field.value}
+                onChange={field.onChange}
+                onBlur={field.onBlur}
+                suggestionSources={suggestionSources}
+                certificates={certificates}
+              />
+            )}
+          />
+        </ResourceField>
+
+        <ToggleField
+          label="HTTP 自动跳转到 HTTPS"
+          description={
+            selectedCertificateIDs.length > 0
+              ? '开启后会额外生成 80 端口重定向规则。'
+              : '至少为一个域名选择证书后才能启用。'
+          }
+          checked={form.watch('redirect_http')}
+          disabled={selectedCertificateIDs.length === 0}
+          onChange={(checked) =>
+            form.setValue('redirect_http', checked, { shouldDirty: true })
+          }
+        />
+      </form>
+    </ConfigSectionShell>
+  );
+}
+
+function RateLimitSection({
+  route,
+  saving,
+  onSave,
+}: {
+  route: ProxyRouteItem;
+  saving: boolean;
+  onSave: SaveHandler;
+}) {
+  const form = useForm<RateLimitValues>({
+    resolver: zodResolver(rateLimitSchema),
+    defaultValues: {
+      limit_conn_per_server: route.limit_conn_per_server
+        ? String(route.limit_conn_per_server)
+        : '',
+      limit_conn_per_ip: route.limit_conn_per_ip
+        ? String(route.limit_conn_per_ip)
+        : '',
+      limit_rate: route.limit_rate || '',
+    },
+  });
+
+  useEffect(() => {
+    form.reset({
+      limit_conn_per_server: route.limit_conn_per_server
+        ? String(route.limit_conn_per_server)
+        : '',
+      limit_conn_per_ip: route.limit_conn_per_ip
+        ? String(route.limit_conn_per_ip)
+        : '',
+      limit_rate: route.limit_rate || '',
+    });
+  }, [form, route]);
+
+  return (
+    <ConfigSectionShell
+      title="流量限制"
+      description="站点限流，空值或 0 表示关闭。"
+      formId="proxy-route-limits-form"
+      saving={saving}
+    >
+      <form
+        id="proxy-route-limits-form"
+        className="grid gap-5 md:grid-cols-2"
+        onSubmit={form.handleSubmit((values) => {
+          onSave(
+            buildPayloadFromRoute(route, {
+              limit_conn_per_server: Number(
+                values.limit_conn_per_server.trim() || '0',
+              ),
+              limit_conn_per_ip: Number(values.limit_conn_per_ip.trim() || '0'),
+              limit_rate: normalizeLimitRate(values.limit_rate),
+            }),
+            { message: '流量限制已保存。' },
+          );
+        })}
+      >
+        <ResourceField
+          label="并发限制"
+          hint="限制当前站点最大并发连接数。"
+          error={form.formState.errors.limit_conn_per_server?.message}
+        >
+          <ResourceInput
+            placeholder="120"
+            {...form.register('limit_conn_per_server')}
+          />
+        </ResourceField>
+
+        <ResourceField
+          label="单 IP 限制"
+          hint="限制单个 IP 的最大并发数。"
+          error={form.formState.errors.limit_conn_per_ip?.message}
+        >
+          <ResourceInput
+            placeholder="12"
+            {...form.register('limit_conn_per_ip')}
+          />
+        </ResourceField>
+
+        <ResourceField
+          label="限速"
+          hint="限制单请求带宽，例如 512k 或 1m。"
+          error={form.formState.errors.limit_rate?.message}
+          className="md:col-span-2"
+        >
+          <ResourceInput placeholder="512k/1m" {...form.register('limit_rate')} />
+        </ResourceField>
+      </form>
+    </ConfigSectionShell>
+  );
+}
+
+function ReverseProxySection({
+  route,
+  saving,
+  onSave,
+}: {
+  route: ProxyRouteItem;
+  saving: boolean;
+  onSave: SaveHandler;
+}) {
+  const form = useForm<ReverseProxyValues>({
+    resolver: zodResolver(reverseProxySchema),
+    defaultValues: {
+      origin_urls_text: route.upstream_list.join('\n'),
+      origin_host: route.origin_host || '',
+      custom_headers_text: customHeadersToText(route.custom_header_list),
+      remark: route.remark || '',
+    },
+  });
+
+  useEffect(() => {
+    form.reset({
+      origin_urls_text: route.upstream_list.join('\n'),
+      origin_host: route.origin_host || '',
+      custom_headers_text: customHeadersToText(route.custom_header_list),
+      remark: route.remark || '',
+    });
+  }, [form, route]);
+
+  return (
+    <ConfigSectionShell
+      title="反向代理"
+      description="第一行作为主回源；填写多行时会自动进入多上游负载均衡模式。"
+      formId="proxy-route-proxy-form"
+      saving={saving}
+    >
+      <form
+        id="proxy-route-proxy-form"
+        className="space-y-5"
+        onSubmit={form.handleSubmit((values) => {
+          const { urls } = parseOriginUrls(values.origin_urls_text);
+          const primaryOrigin = parseOriginUrl(urls[0]);
+          const { headers } = parseCustomHeadersText(values.custom_headers_text);
+
+          onSave(
+            buildPayloadFromRoute(route, {
+              origin_id: null,
+              origin_url: urls[0],
+              origin_scheme: primaryOrigin.scheme,
+              origin_address: primaryOrigin.address,
+              origin_port: primaryOrigin.port,
+              origin_uri: primaryOrigin.uri,
+              origin_host: values.origin_host.trim(),
+              upstreams: urls.slice(1),
+              custom_headers: headers,
+              remark: values.remark.trim(),
+            }),
+            { message: '反向代理设置已保存。' },
+          );
+        })}
+      >
+        <ResourceField
+          label="上游地址"
+          hint="每行一个完整 URL。多上游模式下不要带 path 或 query。"
+          error={form.formState.errors.origin_urls_text?.message}
+        >
+          <ResourceTextarea
+            aria-label="上游地址"
+            className="min-h-40"
+            placeholder={'https://origin-a.internal:443\nhttps://origin-b.internal:443'}
+            {...form.register('origin_urls_text')}
+          />
+        </ResourceField>
+
+        <ResourceField
+          label="Origin Host Header"
+          hint="留空时默认透传访问域名 $host。"
+          error={form.formState.errors.origin_host?.message}
+        >
+          <ResourceInput
+            placeholder="origin.example.internal"
+            {...form.register('origin_host')}
+          />
+        </ResourceField>
+
+        <ResourceField
+          label="自定义请求头"
+          hint="每行一条，格式为 Key: Value。"
+          error={form.formState.errors.custom_headers_text?.message}
+        >
+          <ResourceTextarea
+            className="min-h-32"
+            placeholder={'X-Trace-Id: $request_id\nX-Site: marketing'}
+            {...form.register('custom_headers_text')}
+          />
+        </ResourceField>
+
+        <ResourceField label="备注" error={form.formState.errors.remark?.message}>
+          <ResourceTextarea
+            placeholder="例如：多活回源，优先使用上海入口"
+            {...form.register('remark')}
+          />
+        </ResourceField>
+      </form>
+    </ConfigSectionShell>
+  );
+}
+
+function CacheSection({
+  route,
+  saving,
+  onSave,
+}: {
+  route: ProxyRouteItem;
+  saving: boolean;
+  onSave: SaveHandler;
+}) {
+  const form = useForm<CacheValues>({
+    resolver: zodResolver(cacheSchema),
+    defaultValues: {
+      cache_enabled: route.cache_enabled,
+      cache_policy: (route.cache_policy || 'url') as CacheValues['cache_policy'],
+      cache_rules_text: route.cache_rule_list.join('\n'),
+    },
+  });
+
+  useEffect(() => {
+    form.reset({
+      cache_enabled: route.cache_enabled,
+      cache_policy: (route.cache_policy || 'url') as CacheValues['cache_policy'],
+      cache_rules_text: route.cache_rule_list.join('\n'),
+    });
+  }, [form, route]);
+
+  const watchedEnabled = form.watch('cache_enabled');
+  const watchedPolicy = form.watch('cache_policy');
+
+  return (
+    <ConfigSectionShell
+      title="缓存"
+      description="保留现有安全绕过逻辑，只对当前站点生效。"
+      formId="proxy-route-cache-form"
+      saving={saving}
+    >
+      <form
+        id="proxy-route-cache-form"
+        className="space-y-5"
+        onSubmit={form.handleSubmit((values) => {
+          const rules = linesFromTextarea(values.cache_rules_text);
+          onSave(
+            buildPayloadFromRoute(route, {
+              cache_enabled: values.cache_enabled,
+              cache_policy: values.cache_enabled ? values.cache_policy : 'url',
+              cache_rules:
+                values.cache_enabled && values.cache_policy !== 'url' ? rules : [],
+            }),
+            { message: '缓存设置已保存。' },
+          );
+        })}
+      >
+        <ToggleField
+          label="启用站点缓存"
+          description="系统仍会自动绕过非 GET、带 Authorization 或常见登录态 Cookie 的请求。"
+          checked={watchedEnabled}
+          onChange={(checked) =>
+            form.setValue('cache_enabled', checked, { shouldDirty: true })
+          }
+        />
+
+        <ResourceField label="缓存策略">
+          <ResourceSelect
+            disabled={!watchedEnabled}
+            {...form.register('cache_policy')}
+          >
+            <option value="url">按 URL 缓存</option>
+            <option value="suffix">按后缀缓存</option>
+            <option value="path_prefix">按路径前缀缓存</option>
+            <option value="path_exact">按精确路径缓存</option>
+          </ResourceSelect>
+        </ResourceField>
+
+        <ResourceField
+          label="缓存规则"
+          error={form.formState.errors.cache_rules_text?.message}
+          hint={
+            watchedPolicy === 'suffix'
+              ? '每行一个后缀，例如 jpg、css、js。'
+              : watchedPolicy === 'path_prefix'
+                ? '每行一个路径前缀，例如 /assets、/static。'
+                : watchedPolicy === 'path_exact'
+                  ? '每行一个精确路径，例如 /robots.txt。'
+                  : '按 URL 缓存时无需额外规则。'
+          }
+        >
+          <ResourceTextarea
+            disabled={!watchedEnabled || watchedPolicy === 'url'}
+            className="min-h-32"
+            placeholder={
+              watchedPolicy === 'suffix'
+                ? 'jpg\ncss\njs'
+                : watchedPolicy === 'path_prefix'
+                  ? '/assets\n/static'
+                  : watchedPolicy === 'path_exact'
+                    ? '/robots.txt\n/manifest.json'
+                    : '按 URL 缓存时无需额外规则'
+            }
+            {...form.register('cache_rules_text')}
+          />
+        </ResourceField>
+      </form>
+    </ConfigSectionShell>
+  );
+}
+
+export function ProxyRouteConfigPage({
+  routeId,
+  initialSection,
+}: {
+  routeId: string;
+  initialSection?: string;
+}) {
+  const queryClient = useQueryClient();
+  const [feedback, setFeedback] = useState<FeedbackState | null>(null);
+
+  const numericRouteID = Number(routeId);
+  const currentSection = getWebsiteConfigSection(initialSection);
+
+  const routeQuery = useQuery({
+    queryKey: ['proxy-routes', 'detail', numericRouteID],
+    queryFn: () => getProxyRoute(numericRouteID),
+    enabled: Number.isFinite(numericRouteID) && numericRouteID > 0,
+  });
+  const certificatesQuery = useQuery({
+    queryKey: ['tls-certificates', 'list'],
+    queryFn: getTlsCertificates,
+  });
+  const managedDomainsQuery = useQuery({
+    queryKey: ['managed-domains'],
+    queryFn: getManagedDomains,
+  });
+
+  const saveMutation = useMutation({
+    mutationFn: async ({
+      payload,
+      context,
+    }: {
+      payload: Parameters<typeof updateProxyRoute>[1];
+      context: SaveContext;
+    }) => {
+      const updatedRoute = await updateProxyRoute(numericRouteID, payload);
+      return { updatedRoute, context };
+    },
+    onSuccess: async ({ updatedRoute, context }) => {
+      queryClient.setQueryData(
+        ['proxy-routes', 'detail', numericRouteID],
+        updatedRoute,
+      );
+      setFeedback({ tone: 'success', message: context.message });
+      await Promise.all([
+        queryClient.invalidateQueries({ queryKey: ['proxy-routes'] }),
+        queryClient.invalidateQueries({ queryKey: ['config-versions', 'diff'] }),
+      ]);
+    },
+    onError: (error) => {
+      setFeedback({ tone: 'danger', message: getErrorMessage(error) });
+    },
+  });
+
+  const route = routeQuery.data;
+  const certificates = useMemo(
+    () => certificatesQuery.data ?? [],
+    [certificatesQuery.data],
+  );
+  const domainSuggestionSources = useMemo(
+    () => [
+      ...(route?.domains ?? []),
+      ...(managedDomainsQuery.data?.map((item) => item.domain) ?? []),
+    ],
+    [managedDomainsQuery.data, route?.domains],
+  );
+
+  if (!Number.isFinite(numericRouteID) || numericRouteID <= 0) {
+    return (
+      <EmptyState
+        title="缺少站点 ID"
+        description="请从站点列表进入配置页面。"
+      />
+    );
+  }
+
+  if (routeQuery.isLoading || certificatesQuery.isLoading) {
+    return <LoadingState />;
+  }
+
+  if (routeQuery.isError) {
+    return (
+      <ErrorState
+        title="站点详情加载失败"
+        description={getErrorMessage(routeQuery.error)}
+      />
+    );
+  }
+
+  if (certificatesQuery.isError) {
+    return (
+      <ErrorState
+        title="证书列表加载失败"
+        description={getErrorMessage(certificatesQuery.error)}
+      />
+    );
+  }
+
+  if (!route) {
+    return (
+      <EmptyState
+        title="站点不存在"
+        description="该站点可能已被删除，或当前 ID 无法匹配到记录。"
+      />
+    );
+  }
+
+  return (
+    <div className="space-y-6">
+      <PageHeader
+        title={route.site_name}
+        description={`主域名 ${route.primary_domain}，共 ${route.domain_count} 个域名`}
+        action={
+          <div className="flex flex-wrap gap-3">
+            <Link
+              href="/proxy-route"
+              className="inline-flex items-center justify-center rounded-2xl border border-[var(--border-default)] bg-[var(--control-background)] px-4 py-3 text-sm font-medium text-[var(--foreground-primary)] transition hover:bg-[var(--control-background-hover)]"
+            >
+              返回列表
+            </Link>
+            <SecondaryButton
+              type="button"
+              onClick={() =>
+                queryClient.invalidateQueries({
+                  queryKey: ['proxy-routes', 'detail', numericRouteID],
+                })
+              }
+            >
+              刷新详情
+            </SecondaryButton>
+          </div>
+        }
+      />
+
+      {feedback ? (
+        <InlineMessage tone={feedback.tone} message={feedback.message} />
+      ) : null}
+
+      <div className="grid gap-6 xl:grid-cols-[280px_minmax(0,1fr)]">
+        <aside className="space-y-4">
+          <AppCard title="配置分区">
+            <div className="space-y-2">
+              {websiteConfigSections.map((section) => {
+                const active = section.key === currentSection;
+                return (
+                  <Link
+                    key={section.key}
+                    href={`/proxy-route/detail?id=${route.id}&section=${section.key}`}
+                    className={cn(
+                      'block rounded-2xl border px-4 py-3 transition',
+                      active
+                        ? 'border-[var(--border-strong)] bg-[var(--accent-soft)]'
+                        : 'border-[var(--border-default)] bg-[var(--surface-elevated)] hover:border-[var(--border-strong)]',
+                    )}
+                  >
+                    <p className="text-sm font-medium text-[var(--foreground-primary)]">
+                      {section.label}
+                    </p>
+                    <p className="mt-1 text-xs leading-5 text-[var(--foreground-secondary)]">
+                      {section.description}
+                    </p>
+                  </Link>
+                );
+              })}
+            </div>
+          </AppCard>
+        </aside>
+
+        <div className="min-w-0 space-y-6">
+          {currentSection === 'domains' ? (
+            <DomainSettingsSection
+              route={route}
+              certificates={certificates}
+              saving={saveMutation.isPending}
+              suggestionSources={domainSuggestionSources}
+              onSave={(payload, context) =>
+                saveMutation.mutate({ payload, context })
+              }
+            />
+          ) : null}
+
+          {currentSection === 'limits' ? (
+            <RateLimitSection
+              route={route}
+              saving={saveMutation.isPending}
+              onSave={(payload, context) =>
+                saveMutation.mutate({ payload, context })
+              }
+            />
+          ) : null}
+
+          {currentSection === 'proxy' ? (
+            <ReverseProxySection
+              route={route}
+              saving={saveMutation.isPending}
+              onSave={(payload, context) =>
+                saveMutation.mutate({ payload, context })
+              }
+            />
+          ) : null}
+
+          {currentSection === 'cache' ? (
+            <CacheSection
+              route={route}
+              saving={saveMutation.isPending}
+              onSave={(payload, context) =>
+                saveMutation.mutate({ payload, context })
+              }
+            />
+          ) : null}
+        </div>
+      </div>
+    </div>
+  );
+}

openflare_server/web/features/proxy-routes/components/proxy-route-create-drawer.tsx

@@ -0,0 +1,314 @@
+'use client';
+
+import { zodResolver } from '@hookform/resolvers/zod';
+import { useMutation, useQuery } from '@tanstack/react-query';
+import { useEffect, useMemo } from 'react';
+import { Controller, useForm } from 'react-hook-form';
+import { z } from 'zod';
+
+import { Drawer } from '@/components/ui/drawer';
+import { getManagedDomains } from '@/features/managed-domains/api/managed-domains';
+import { createProxyRoute } from '@/features/proxy-routes/api/proxy-routes';
+import {
+  DomainListInput,
+  type DomainListRow,
+} from '@/features/proxy-routes/components/domain-list-input';
+import {
+  buildOriginUrl,
+  getErrorMessage,
+  parseOriginUrl,
+  parseOriginUrls,
+  validateDomains,
+} from '@/features/proxy-routes/helpers';
+import type { ProxyRouteItem } from '@/features/proxy-routes/types';
+import { getTlsCertificates } from '@/features/tls-certificates/api/tls-certificates';
+import {
+  PrimaryButton,
+  ResourceField,
+  ResourceInput,
+  ResourceTextarea,
+  ToggleField,
+} from '@/features/shared/components/resource-primitives';
+
+const domainRowSchema = z.object({
+  domain: z.string(),
+  certificateId: z.string(),
+});
+
+const createWebsiteSchema = z
+  .object({
+    site_name: z.string().trim().max(255, '站点标识不能超过 255 个字符'),
+    domain_rows: z.array(domainRowSchema).min(1),
+    origin_urls_text: z.string().trim().min(1, '请至少填写一个上游地址'),
+    enabled: z.boolean(),
+    redirect_http: z.boolean(),
+    remark: z.string().max(255, '备注不能超过 255 个字符'),
+  })
+  .superRefine((value, context) => {
+    const domains = value.domain_rows
+      .map((item) => item.domain.trim().toLowerCase())
+      .filter(Boolean);
+    const domainError = validateDomains(domains);
+    if (domainError) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['domain_rows'],
+        message: domainError,
+      });
+    }
+
+    const { error } = parseOriginUrls(value.origin_urls_text);
+    if (error) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['origin_urls_text'],
+        message: error,
+      });
+    }
+
+    const selectedCertificateCount = new Set(
+      value.domain_rows
+        .map((item) => Number(item.certificateId))
+        .filter((item) => Number.isFinite(item) && item > 0),
+    ).size;
+    if (value.redirect_http && selectedCertificateCount === 0) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['redirect_http'],
+        message: '启用 HTTP 跳转前，请先为域名选择证书',
+      });
+    }
+  });
+
+type CreateWebsiteFormValues = z.infer<typeof createWebsiteSchema>;
+
+const defaultValues: CreateWebsiteFormValues = {
+  site_name: '',
+  domain_rows: [{ domain: '', certificateId: '' }],
+  origin_urls_text: '',
+  enabled: true,
+  redirect_http: false,
+  remark: '',
+};
+
+function normalizeSelectedCertificateIDs(rows: DomainListRow[]) {
+  return Array.from(
+    new Set(
+      rows
+        .filter((item) => item.domain.trim() !== '')
+        .map((item) => Number(item.certificateId))
+        .filter((item) => Number.isFinite(item) && item > 0),
+    ),
+  );
+}
+
+function buildDomainCertificateIDs(rows: DomainListRow[]) {
+  return rows
+    .filter((item) => item.domain.trim() !== '')
+    .map((item) => {
+      const certificateID = Number(item.certificateId);
+      return Number.isFinite(certificateID) && certificateID > 0
+        ? certificateID
+        : 0;
+    });
+}
+
+export function ProxyRouteCreateDrawer({
+  open,
+  onOpenChange,
+  onCreated,
+  domainSuggestionSources = [],
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onCreated: (route: ProxyRouteItem) => void;
+  domainSuggestionSources?: string[];
+}) {
+  const form = useForm<CreateWebsiteFormValues>({
+    resolver: zodResolver(createWebsiteSchema),
+    defaultValues,
+  });
+  const managedDomainsQuery = useQuery({
+    queryKey: ['managed-domains'],
+    queryFn: getManagedDomains,
+    enabled: open,
+  });
+  const certificatesQuery = useQuery({
+    queryKey: ['tls-certificates', 'list'],
+    queryFn: getTlsCertificates,
+    enabled: open,
+  });
+
+  const combinedDomainSuggestions = useMemo(
+    () => [
+      ...domainSuggestionSources,
+      ...(managedDomainsQuery.data?.map((item) => item.domain) ?? []),
+    ],
+    [domainSuggestionSources, managedDomainsQuery.data],
+  );
+  const selectedCertificateIDs = normalizeSelectedCertificateIDs(
+    form.watch('domain_rows'),
+  );
+
+  const createMutation = useMutation({
+    mutationFn: async (values: CreateWebsiteFormValues) => {
+      const domains = values.domain_rows
+        .map((item) => item.domain.trim().toLowerCase())
+        .filter(Boolean);
+      const domainCertIDs = buildDomainCertificateIDs(values.domain_rows);
+      const selectedCertIDs = normalizeSelectedCertificateIDs(values.domain_rows);
+      const { urls } = parseOriginUrls(values.origin_urls_text);
+      const primaryOrigin = parseOriginUrl(urls[0]);
+
+      return createProxyRoute({
+        site_name: values.site_name.trim() || domains[0],
+        domain: domains[0],
+        domains,
+        origin_id: null,
+        origin_url: buildOriginUrl(
+          primaryOrigin.scheme,
+          primaryOrigin.address,
+          primaryOrigin.port,
+          primaryOrigin.uri,
+        ),
+        origin_scheme: primaryOrigin.scheme,
+        origin_address: primaryOrigin.address,
+        origin_port: primaryOrigin.port,
+        origin_uri: primaryOrigin.uri,
+        origin_host: '',
+        upstreams: urls.slice(1),
+        enabled: values.enabled,
+        enable_https: selectedCertIDs.length > 0,
+        cert_id: selectedCertIDs[0] ?? null,
+        cert_ids: selectedCertIDs,
+        domain_cert_ids: domainCertIDs,
+        redirect_http: selectedCertIDs.length > 0 ? values.redirect_http : false,
+        limit_conn_per_server: 0,
+        limit_conn_per_ip: 0,
+        limit_rate: '',
+        cache_enabled: false,
+        cache_policy: 'url',
+        cache_rules: [],
+        custom_headers: [],
+        remark: values.remark.trim(),
+      });
+    },
+    onSuccess: (route) => {
+      form.reset(defaultValues);
+      onOpenChange(false);
+      onCreated(route);
+    },
+  });
+
+  useEffect(() => {
+    if (!open) {
+      form.reset(defaultValues);
+    }
+  }, [form, open]);
+
+  return (
+    <Drawer
+      open={open}
+      onOpenChange={onOpenChange}
+      direction="right"
+      title="新建规则"
+      footer={
+        <div className="flex items-center justify-end gap-3">
+          <PrimaryButton
+            type="submit"
+            form="create-website-form"
+            disabled={createMutation.isPending}
+          >
+            {createMutation.isPending ? '创建中...' : '创建'}
+          </PrimaryButton>
+        </div>
+      }
+    >
+      <form
+        id="create-website-form"
+        className="space-y-5"
+        onSubmit={form.handleSubmit((values) => createMutation.mutate(values))}
+      >
+        <ResourceField
+          label="站点标识"
+          hint="可选，留空时会自动使用第一个域名。"
+          error={form.formState.errors.site_name?.message}
+        >
+          <ResourceInput
+            {...form.register('site_name')}
+            placeholder="marketing-site"
+          />
+        </ResourceField>
+
+        <ResourceField
+          label="域名列表"
+          hint="每行配置一个域名，可按需为该行选择证书。保存时会自动汇总站点证书集合。"
+          error={form.formState.errors.domain_rows?.message as string | undefined}
+          container="div"
+        >
+          <Controller
+            control={form.control}
+            name="domain_rows"
+            render={({ field }) => (
+              <DomainListInput
+                rows={field.value}
+                onChange={field.onChange}
+                onBlur={field.onBlur}
+                suggestionSources={combinedDomainSuggestions}
+                certificates={certificatesQuery.data ?? []}
+              />
+            )}
+          />
+        </ResourceField>
+
+        <ToggleField
+          label="HTTP 自动跳转到 HTTPS"
+          description={
+            selectedCertificateIDs.length > 0
+              ? '勾选后会额外生成 80 端口重定向规则。'
+              : '至少为一个域名选择证书后才能启用。'
+          }
+          checked={form.watch('redirect_http')}
+          disabled={selectedCertificateIDs.length === 0}
+          onChange={(checked) =>
+            form.setValue('redirect_http', checked, { shouldDirty: true })
+          }
+        />
+
+        <ResourceField
+          label="上游地址"
+          hint="每行一个完整 URL。第一行作为主回源，多上游模式请保持相同协议且不要包含 path 或 query。"
+          error={form.formState.errors.origin_urls_text?.message}
+        >
+          <ResourceTextarea
+            aria-label="上游地址"
+            placeholder={'https://origin-a.internal:443\nhttps://origin-b.internal:443'}
+            {...form.register('origin_urls_text')}
+          />
+        </ResourceField>
+
+        <ToggleField
+          label="创建后立即启用"
+          description="关闭后站点会以草稿保存，后续仍可继续编辑。"
+          checked={form.watch('enabled')}
+          onChange={(checked) =>
+            form.setValue('enabled', checked, { shouldDirty: true })
+          }
+        />
+
+        <ResourceField
+          label="备注"
+          error={form.formState.errors.remark?.message}
+        >
+          <ResourceTextarea {...form.register('remark')} />
+        </ResourceField>
+
+        {createMutation.isError ? (
+          <p className="text-sm text-[var(--status-danger-foreground)]">
+            {getErrorMessage(createMutation.error)}
+          </p>
+        ) : null}
+      </form>
+    </Drawer>
+  );
+}

openflare_server/web/features/proxy-routes/helpers.ts

@@ -0,0 +1,308 @@
+import type {
+  ProxyRouteCustomHeader,
+  ProxyRouteItem,
+  ProxyRouteMutationPayload,
+} from '@/features/proxy-routes/types';
+
+export const websiteConfigSections = [
+  {
+    key: 'domains',
+    label: '域名设置',
+    description: '维护站点标识、域名列表和证书绑定。',
+  },
+  {
+    key: 'limits',
+    label: '流量限制',
+    description: '设置连接数和限速。',
+  },
+  {
+    key: 'proxy',
+    label: '反向代理',
+    description: '配置主回源和上游地址。',
+  },
+  {
+    key: 'cache',
+    label: '缓存',
+    description: '配置站点缓存策略。',
+  },
+] as const;
+
+export type WebsiteConfigSectionKey =
+  (typeof websiteConfigSections)[number]['key'];
+
+const domainPattern =
+  /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+const originHostPattern =
+  /^(?:(?:[a-z0-9-]+\.)*[a-z0-9-]+|\[[0-9a-f:.]+\]|[0-9.]+)(?::\d{1,5})?$/i;
+const headerKeyPattern = /^[A-Za-z0-9_-]+$/;
+const limitRatePattern = /^\d+(?:[kKmM])?$/;
+
+export function getErrorMessage(error: unknown) {
+  return error instanceof Error ? error.message : '请求失败，请稍后重试。';
+}
+
+export function getWebsiteConfigSection(
+  value: string | null | undefined,
+): WebsiteConfigSectionKey {
+  return websiteConfigSections.some((section) => section.key === value)
+    ? (value as WebsiteConfigSectionKey)
+    : 'domains';
+}
+
+export function linesFromTextarea(value: string) {
+  return value
+    .split(/\r?\n/)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+export function validateDomains(domains: string[]) {
+  if (domains.length === 0) {
+    return '请至少填写一个域名';
+  }
+
+  const seen = new Set<string>();
+  for (const domain of domains) {
+    const normalized = domain.trim().toLowerCase();
+    if (!domainPattern.test(normalized)) {
+      return `域名格式不合法：${domain}`;
+    }
+    if (seen.has(normalized)) {
+      return `域名重复：${domain}`;
+    }
+    seen.add(normalized);
+  }
+
+  return null;
+}
+
+export function parseOriginUrls(value: string) {
+  const urls = linesFromTextarea(value);
+  if (urls.length === 0) {
+    return { urls: [], error: '请至少填写一个上游地址' };
+  }
+
+  let sharedScheme = '';
+  for (const originUrl of urls) {
+    let parsed: URL;
+    try {
+      parsed = new URL(originUrl);
+    } catch {
+      return { urls: [], error: `上游地址格式不合法：${originUrl}` };
+    }
+
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      return {
+        urls: [],
+        error: `上游地址必须以 http:// 或 https:// 开头：${originUrl}`,
+      };
+    }
+
+    if (!parsed.hostname) {
+      return { urls: [], error: `上游地址缺少主机名：${originUrl}` };
+    }
+
+    if (urls.length > 1) {
+      if ((parsed.pathname && parsed.pathname !== '/') || parsed.search) {
+        return {
+          urls: [],
+          error: '多上游模式暂不支持带路径或查询参数的地址',
+        };
+      }
+
+      if (!sharedScheme) {
+        sharedScheme = parsed.protocol;
+      } else if (sharedScheme !== parsed.protocol) {
+        return {
+          urls: [],
+          error: '同一站点的多个上游必须使用相同协议',
+        };
+      }
+    }
+  }
+
+  return { urls, error: null };
+}
+
+export function parseOriginUrl(originUrl: string) {
+  const parsed = new URL(originUrl);
+  const port = parsed.port || (parsed.protocol === 'http:' ? '80' : '443');
+  const path = parsed.pathname === '/' ? '' : parsed.pathname;
+
+  return {
+    scheme: parsed.protocol.replace(':', '') as 'http' | 'https',
+    address: parsed.hostname,
+    port,
+    uri: parsed.search ? `${path}${parsed.search}` || parsed.search : path,
+  };
+}
+
+export function buildOriginUrl(
+  scheme: 'http' | 'https',
+  address: string,
+  port: string,
+  uri: string,
+) {
+  const normalizedAddress = address.trim();
+  const normalizedPort = port.trim();
+  const normalizedURI = uri.trim();
+  if (!normalizedAddress || !normalizedPort) {
+    return '';
+  }
+
+  const host =
+    normalizedAddress.includes(':') && !normalizedAddress.startsWith('[')
+      ? `[${normalizedAddress}]`
+      : normalizedAddress;
+
+  return `${scheme}://${host}:${normalizedPort}${normalizedURI}`;
+}
+
+export function validateOriginHost(value: string) {
+  const normalized = value.trim();
+  if (!normalized) {
+    return null;
+  }
+  if (
+    normalized.includes('://') ||
+    /[\/\\\s]/.test(normalized) ||
+    !originHostPattern.test(normalized)
+  ) {
+    return '回源 Host 格式不合法';
+  }
+  return null;
+}
+
+export function parseCustomHeadersText(value: string) {
+  const lines = linesFromTextarea(value);
+  const headers: ProxyRouteCustomHeader[] = [];
+
+  for (const line of lines) {
+    const separatorIndex = line.indexOf(':');
+    if (separatorIndex <= 0) {
+      return {
+        headers: [],
+        error: `自定义请求头格式不合法：${line}`,
+      };
+    }
+
+    const key = line.slice(0, separatorIndex).trim();
+    const headerValue = line.slice(separatorIndex + 1).trim();
+
+    if (!headerKeyPattern.test(key)) {
+      return {
+        headers: [],
+        error: `自定义请求头名称不合法：${key}`,
+      };
+    }
+
+    headers.push({ key, value: headerValue });
+  }
+
+  return { headers, error: null };
+}
+
+export function customHeadersToText(headers: ProxyRouteCustomHeader[]) {
+  return headers.map((header) => `${header.key}: ${header.value}`).join('\n');
+}
+
+export function validateLimitRate(value: string) {
+  const normalized = value.trim();
+  if (!normalized || normalized === '0') {
+    return null;
+  }
+  if (!limitRatePattern.test(normalized)) {
+    return '限速格式不合法，请使用 512k、1m 或纯数字';
+  }
+  return null;
+}
+
+export function normalizeLimitRate(value: string) {
+  const normalized = value.trim().toLowerCase();
+  return normalized === '0' ? '' : normalized;
+}
+
+export function validateCacheRules(
+  policy: 'url' | 'suffix' | 'path_prefix' | 'path_exact',
+  rules: string[],
+) {
+  if (policy === 'url') {
+    return null;
+  }
+
+  if (rules.length === 0) {
+    return '当前缓存策略至少需要一条规则';
+  }
+
+  if (policy === 'suffix') {
+    for (const rule of rules) {
+      const normalized = rule.replace(/^\./, '');
+      if (!normalized || /[\/\\\s]/.test(normalized)) {
+        return `缓存后缀格式不合法：${rule}`;
+      }
+    }
+    return null;
+  }
+
+  for (const rule of rules) {
+    if (!rule.startsWith('/') || rule.includes('://') || /[\s]/.test(rule)) {
+      return `缓存路径规则格式不合法：${rule}`;
+    }
+  }
+
+  return null;
+}
+
+export function buildPayloadFromRoute(
+  route: ProxyRouteItem,
+  overrides: Partial<ProxyRouteMutationPayload>,
+): ProxyRouteMutationPayload {
+  const primaryOrigin = parseOriginUrl(route.origin_url);
+
+  return {
+    site_name: route.site_name,
+    domain: route.primary_domain,
+    domains: route.domains,
+    origin_id: null,
+    origin_url: route.origin_url,
+    origin_scheme: primaryOrigin.scheme,
+    origin_address: primaryOrigin.address,
+    origin_port: primaryOrigin.port,
+    origin_uri: primaryOrigin.uri,
+    origin_host: route.origin_host || '',
+    upstreams: route.upstream_list.slice(1),
+    enabled: route.enabled,
+    enable_https: route.enable_https,
+    cert_id: route.cert_id,
+    cert_ids: route.cert_ids,
+    domain_cert_ids: route.domain_cert_ids,
+    redirect_http: route.redirect_http,
+    limit_conn_per_server: route.limit_conn_per_server,
+    limit_conn_per_ip: route.limit_conn_per_ip,
+    limit_rate: route.limit_rate,
+    cache_enabled: route.cache_enabled,
+    cache_policy: route.cache_policy || 'url',
+    cache_rules: route.cache_rule_list,
+    custom_headers: route.custom_header_list,
+    remark: route.remark || '',
+    ...overrides,
+  };
+}
+
+export function getUpstreamSummary(route: ProxyRouteItem) {
+  if (route.upstream_list.length <= 1) {
+    return route.origin_url;
+  }
+  return `${route.upstream_list.length} 个上游，主上游 ${route.origin_url}`;
+}
+
+export function getWebsiteStatusBadges(route: ProxyRouteItem) {
+  return [
+    route.enabled
+      ? { label: '已启用', variant: 'success' as const }
+      : { label: '已停用', variant: 'warning' as const },
+    route.enable_https
+      ? { label: 'HTTPS', variant: 'info' as const }
+      : { label: 'HTTP', variant: 'warning' as const },
+  ];
+}

openflare_server/web/features/proxy-routes/types.ts

@@ -1,60 +1,85 @@
-export interface ProxyRouteCustomHeader {
-  key: string;
-  value: string;
-}
-
+export interface ProxyRouteCustomHeader {
+  key: string;
+  value: string;
+}
+
 export interface ProxyRouteItem {
   id: number;
+  site_name: string;
   domain: string;
+  domains: string[];
+  primary_domain: string;
+  domain_count: number;
+  origin_id: number | null;
   origin_url: string;
   origin_host: string;
   upstreams: string;
+  upstream_list: string[];
   enabled: boolean;
   enable_https: boolean;
   cert_id: number | null;
+  cert_ids: number[];
+  domain_cert_ids: number[];
   redirect_http: boolean;
+  limit_conn_per_server: number;
+  limit_conn_per_ip: number;
+  limit_rate: string;
   cache_enabled: boolean;
   cache_policy: string;
   cache_rules: string;
+  cache_rule_list: string[];
   custom_headers: string;
+  custom_header_list: ProxyRouteCustomHeader[];
   remark: string;
   created_at: string;
   updated_at: string;
 }
-
-export interface ProxyRouteMutationPayload {
-  domain: string;
+
+export interface ProxyRouteMutationPayload {
+  site_name?: string;
+  domain: string;
+  domains?: string[];
+  origin_id: number | null;
   origin_url: string;
+  origin_scheme: 'http' | 'https';
+  origin_address: string;
+  origin_port: string;
+  origin_uri: string;
   origin_host: string;
   upstreams: string[];
   enabled: boolean;
   enable_https: boolean;
   cert_id: number | null;
+  cert_ids?: number[];
+  domain_cert_ids?: number[];
   redirect_http: boolean;
+  limit_conn_per_server?: number;
+  limit_conn_per_ip?: number;
+  limit_rate?: string;
   cache_enabled: boolean;
   cache_policy: string;
   cache_rules: string[];
   custom_headers: ProxyRouteCustomHeader[];
   remark: string;
 }
-
-export interface TlsCertificateItem {
-  id: number;
-  name: string;
-  not_after?: string | null;
-}
-
-export interface ManagedDomainMatchCandidate {
-  managed_domain_id: number;
-  domain: string;
-  match_type: 'exact' | 'wildcard';
-  certificate_id: number;
-  certificate_name: string;
-}
-
-export interface ManagedDomainMatchResult {
-  domain: string;
-  matched: boolean;
-  candidate?: ManagedDomainMatchCandidate;
-  candidates: ManagedDomainMatchCandidate[];
-}
+
+export interface TlsCertificateItem {
+  id: number;
+  name: string;
+  not_after?: string | null;
+}
+
+export interface ManagedDomainMatchCandidate {
+  managed_domain_id: number;
+  domain: string;
+  match_type: 'exact' | 'wildcard';
+  certificate_id: number;
+  certificate_name: string;
+}
+
+export interface ManagedDomainMatchResult {
+  domain: string;
+  matched: boolean;
+  candidate?: ManagedDomainMatchCandidate;
+  candidates: ManagedDomainMatchCandidate[];
+}

openflare_server/web/features/proxy-routes/utils.ts

@@ -0,0 +1,73 @@
+import type { ManagedDomainItem } from '@/features/managed-domains/types';
+
+export function isWildcardManagedDomain(domain: string) {
+  return domain.startsWith('*.');
+}
+
+export function buildRouteDomain(
+  managedDomain: string | undefined,
+  subdomainLabel: string,
+) {
+  if (!managedDomain) {
+    return '';
+  }
+
+  if (!isWildcardManagedDomain(managedDomain)) {
+    return managedDomain.toLowerCase();
+  }
+
+  const normalizedLabel = subdomainLabel.trim().toLowerCase();
+  if (!normalizedLabel) {
+    return '';
+  }
+
+  return `${normalizedLabel}.${managedDomain.slice(2).toLowerCase()}`;
+}
+
+export function findManagedDomainForRoute(
+  routeDomain: string,
+  managedDomains: ManagedDomainItem[],
+) {
+  const normalizedRouteDomain = routeDomain.trim().toLowerCase();
+  const exactMatch = managedDomains.find(
+    (item) => item.domain.toLowerCase() === normalizedRouteDomain,
+  );
+
+  if (exactMatch) {
+    return {
+      managedDomainId: exactMatch.domain,
+      subdomainLabel: '',
+    };
+  }
+
+  const wildcardMatch = managedDomains.find((item) => {
+    if (!isWildcardManagedDomain(item.domain)) {
+      return false;
+    }
+
+    const suffix = item.domain.slice(2).toLowerCase();
+    const suffixWithDot = `.${suffix}`;
+    if (!normalizedRouteDomain.endsWith(suffixWithDot)) {
+      return false;
+    }
+
+    const label = normalizedRouteDomain.slice(
+      0,
+      normalizedRouteDomain.length - suffixWithDot.length,
+    );
+
+    return Boolean(label) && !label.includes('.');
+  });
+
+  if (!wildcardMatch) {
+    return null;
+  }
+
+  return {
+    managedDomainId: wildcardMatch.domain,
+    subdomainLabel: normalizedRouteDomain.slice(
+      0,
+      normalizedRouteDomain.length - wildcardMatch.domain.slice(1).length,
+    ),
+  };
+}

openflare_server/web/features/settings/api/settings.ts

@@ -2,7 +2,10 @@ import { apiRequest } from '@/lib/api/client';
 
 import type {
   BootstrapTokenPayload,
+  DatabaseCleanupPayload,
+  DatabaseCleanupResult,
   GeoIPLookupResult,
+  OptionBatchPayload,
   OptionItem,
   SettingsProfile,
   UpdateSelfPayload,
@@ -19,6 +22,13 @@ export function updateOption(key: string, value: string) {
   });
 }
 
+export function updateOptions(options: OptionBatchPayload['options']) {
+  return apiRequest<void>('/option/update-batch', {
+    method: 'POST',
+    body: JSON.stringify({ options }),
+  });
+}
+
 export function lookupGeoIP(provider: string, ip: string) {
   return apiRequest<GeoIPLookupResult>('/option/geoip/lookup', {
     method: 'POST',
@@ -26,6 +36,13 @@ export function lookupGeoIP(provider: string, ip: string) {
   });
 }
 
+export function cleanupDatabaseObservability(payload: DatabaseCleanupPayload) {
+  return apiRequest<DatabaseCleanupResult>('/option/database/cleanup', {
+    method: 'POST',
+    body: JSON.stringify(payload),
+  });
+}
+
 export function getBootstrapToken() {
   return apiRequest<BootstrapTokenPayload>('/nodes/bootstrap-token');
 }

openflare_server/web/features/settings/components/settings-page.tsx

@@ -7,6 +7,7 @@ import { EmptyState } from '@/components/feedback/empty-state';
 import { ErrorState } from '@/components/feedback/error-state';
 import { InlineMessage } from '@/components/feedback/inline-message';
 import { LoadingState } from '@/components/feedback/loading-state';
+import { AppModal } from '@/components/ui/app-modal';
 import { TurnstileWidget } from '@/components/forms/turnstile-widget';
 import { useAuth } from '@/components/providers/auth-provider';
 import { PageHeader } from '@/components/layout/page-header';
@@ -17,23 +18,27 @@ import { getPublicStatus } from '@/features/auth/api/public';
 import {
   bindEmail,
   bindWeChat,
+  cleanupDatabaseObservability,
   generateAccessToken,
   getBootstrapToken,
   getOptions,
   getSettingsProfile,
   lookupGeoIP,
   rotateBootstrapToken,
-  updateOption,
+  updateOptions,
   updateSelf,
 } from '@/features/settings/api/settings';
 import type {
   BootstrapTokenPayload,
+  DatabaseCleanupResult,
+  DatabaseCleanupTarget,
   GeoIPLookupResult,
   OptionItem,
   UpdateSelfPayload,
 } from '@/features/settings/types';
 import {
   CodeBlock,
+  DangerButton,
   PrimaryButton,
   ResourceField,
   ResourceInput,
@@ -56,7 +61,7 @@ const defaultSystemFields = {
   GitHubOAuthEnabled: false,
   WeChatAuthEnabled: false,
   TurnstileCheckEnabled: false,
-  RegisterEnabled: true,
+  RegisterEnabled: false,
   SMTPServer: '',
   SMTPPort: '587',
   SMTPAccount: '',
@@ -126,6 +131,11 @@ const defaultOtherFields = {
   Footer: '',
 };
 
+const defaultDatabaseFields = {
+  DatabaseAutoCleanupEnabled: false,
+  DatabaseAutoCleanupRetentionDays: '30',
+};
+
 const defaultProfileFields: UpdateSelfPayload = {
   username: '',
   display_name: '',
@@ -137,7 +147,17 @@ type FeedbackState = {
   message: string;
 };
 
-type SettingsTab = 'personal' | 'operation' | 'system' | 'other';
+type CleanupModalState = {
+  target: DatabaseCleanupTarget;
+  label: string;
+};
+
+type SettingsTab =
+  | 'personal'
+  | 'operation'
+  | 'database'
+  | 'system'
+  | 'other';
 
 function getErrorMessage(error: unknown) {
   return error instanceof Error ? error.message : '请求失败，请稍后重试。';
@@ -227,12 +247,16 @@ export function SettingsPage() {
     defaultOperationFields,
   );
   const [otherFields, setOtherFields] = useState(defaultOtherFields);
+  const [databaseFields, setDatabaseFields] = useState(defaultDatabaseFields);
   const [accessToken, setAccessToken] = useState('');
   const [wechatCode, setWeChatCode] = useState('');
   const [emailAddress, setEmailAddress] = useState('');
   const [emailCode, setEmailCode] = useState('');
   const [emailTurnstileToken, setEmailTurnstileToken] = useState('');
   const [geoIPTestIP, setGeoIPTestIP] = useState('8.8.8.8');
+  const [cleanupModalState, setCleanupModalState] =
+    useState<CleanupModalState | null>(null);
+  const [cleanupRetentionDays, setCleanupRetentionDays] = useState('');
 
   const isRoot = (user?.role ?? 0) >= 100;
 
@@ -324,7 +348,7 @@ export function SettingsPage() {
       GitHubOAuthEnabled: toBoolean(optionMap.GitHubOAuthEnabled, false),
       WeChatAuthEnabled: toBoolean(optionMap.WeChatAuthEnabled, false),
       TurnstileCheckEnabled: toBoolean(optionMap.TurnstileCheckEnabled, false),
-      RegisterEnabled: toBoolean(optionMap.RegisterEnabled, true),
+      RegisterEnabled: toBoolean(optionMap.RegisterEnabled, false),
       SMTPServer: optionMap.SMTPServer ?? '',
       SMTPPort: optionMap.SMTPPort ?? '587',
       SMTPAccount: optionMap.SMTPAccount ?? '',
@@ -410,6 +434,14 @@ export function SettingsPage() {
       About: optionMap.About ?? '',
       Footer: optionMap.Footer ?? '',
     });
+    setDatabaseFields({
+      DatabaseAutoCleanupEnabled: toBoolean(
+        optionMap.DatabaseAutoCleanupEnabled,
+        false,
+      ),
+      DatabaseAutoCleanupRetentionDays:
+        optionMap.DatabaseAutoCleanupRetentionDays ?? '30',
+    });
   }, [optionsQuery.data, publicStatusQuery.data?.server_address]);
 
   const rotateTokenMutation = useMutation({
@@ -451,6 +483,23 @@ export function SettingsPage() {
       lookupGeoIP(provider, ip),
   });
 
+  const databaseCleanupMutation = useMutation({
+    mutationFn: cleanupDatabaseObservability,
+    onSuccess: (result: DatabaseCleanupResult) => {
+      setCleanupModalState(null);
+      setCleanupRetentionDays('');
+      setFeedback({
+        tone: 'success',
+        message: result.delete_all
+          ? `已清空${result.target_label}数据，共删除 ${result.deleted_count} 条。`
+          : `已清理${result.target_label}中超出保留期的数据，共删除 ${result.deleted_count} 条。`,
+      });
+    },
+    onError: (error) => {
+      setFeedback({ tone: 'danger', message: getErrorMessage(error) });
+    },
+  });
+
   const discoveryToken = bootstrapQuery.data?.discovery_token ?? '';
   const discoveryCommand =
     isRoot && operationFields.ServerAddress && discoveryToken
@@ -476,6 +525,11 @@ export function SettingsPage() {
               label: '系统设置',
               description: '登录注册、SMTP、OAuth、限流与风控开关。',
             },
+            {
+              key: 'database' as const,
+              label: '数据库',
+              description: '观测数据清理与每日自动保留策略。',
+            },
             {
               key: 'other' as const,
               label: '其他设置',
@@ -504,9 +558,7 @@ export function SettingsPage() {
     entries: Array<[string, string]>,
     successMessage: string,
   ) => {
-    for (const [key, value] of entries) {
-      await updateOption(key, value);
-    }
+    await updateOptions(entries.map(([key, value]) => ({ key, value })));
 
     await queryClient.invalidateQueries({ queryKey: settingsQueryKey });
     await queryClient.invalidateQueries({ queryKey: ['public-status'] });
@@ -1270,6 +1322,168 @@ export function SettingsPage() {
       );
     }
 
+    if (activeTab === 'database') {
+      return (
+        <div className="grid gap-6 xl:grid-cols-2 xl:items-start">
+          <AppCard
+            title="自动数据清理"
+            description="每天凌晨 3 点自动清理超出保留期的观测数据，统一作用于访问日志、性能快照和请求聚合。"
+            action={
+              <PrimaryButton
+                type="button"
+                onClick={() =>
+                  void runBusyAction('database-auto-cleanup', async () => {
+                    const retentionDays = Number.parseInt(
+                      databaseFields.DatabaseAutoCleanupRetentionDays,
+                      10,
+                    );
+                    if (Number.isNaN(retentionDays) || retentionDays < 1) {
+                      throw new Error('自动清理保留天数至少为 1 天。');
+                    }
+                    await saveOptionEntries(
+                      [
+                        [
+                          'DatabaseAutoCleanupEnabled',
+                          String(databaseFields.DatabaseAutoCleanupEnabled),
+                        ],
+                        [
+                          'DatabaseAutoCleanupRetentionDays',
+                          String(retentionDays),
+                        ],
+                      ],
+                      '数据库自动清理设置已保存。',
+                    );
+                  })
+                }
+                disabled={busyKey === 'database-auto-cleanup'}
+              >
+                {busyKey === 'database-auto-cleanup'
+                  ? '保存中...'
+                  : '保存自动清理'}
+              </PrimaryButton>
+            }
+          >
+            <div className="rounded-2xl border border-[var(--border-default)] bg-[var(--surface-elevated)] p-5">
+              <div className="space-y-5">
+                <ToggleField
+                  label="启用每日自动清理"
+                  description="开启后，服务端每天自动删除保留天数之外的观测数据。"
+                  checked={databaseFields.DatabaseAutoCleanupEnabled}
+                  onChange={(checked) =>
+                    setDatabaseFields((previous) => ({
+                      ...previous,
+                      DatabaseAutoCleanupEnabled: checked,
+                    }))
+                  }
+                />
+                <div className="border-t border-[var(--border-default)] pt-5">
+                  <ResourceField
+                    label="自动清理保留天数"
+                    hint="必须至少保留 1 天，服务端不允许配置为 24 小时以内。"
+                  >
+                    <ResourceInput
+                      type="number"
+                      min={1}
+                      value={databaseFields.DatabaseAutoCleanupRetentionDays}
+                      onChange={(event) =>
+                        setDatabaseFields((previous) => ({
+                          ...previous,
+                          DatabaseAutoCleanupRetentionDays: event.target.value,
+                        }))
+                      }
+                      placeholder="例如 30"
+                    />
+                  </ResourceField>
+                  <div className="mt-4 grid gap-4 md:grid-cols-3">
+                    <div className="rounded-2xl border border-[var(--border-default)] bg-[var(--surface-base)] px-4 py-4">
+                      <p className="text-xs tracking-[0.2em] uppercase text-[var(--foreground-muted)]">
+                        触发频率
+                      </p>
+                      <p className="mt-2 text-sm font-semibold text-[var(--foreground-primary)]">
+                        每天一次
+                      </p>
+                    </div>
+                    <div className="rounded-2xl border border-[var(--border-default)] bg-[var(--surface-base)] px-4 py-4">
+                      <p className="text-xs tracking-[0.2em] uppercase text-[var(--foreground-muted)]">
+                        默认执行时间
+                      </p>
+                      <p className="mt-2 text-sm font-semibold text-[var(--foreground-primary)]">
+                        凌晨 3:00
+                      </p>
+                    </div>
+                    <div className="rounded-2xl border border-[var(--border-default)] bg-[var(--surface-base)] px-4 py-4">
+                      <p className="text-xs tracking-[0.2em] uppercase text-[var(--foreground-muted)]">
+                        生效范围
+                      </p>
+                      <p className="mt-2 text-sm font-semibold text-[var(--foreground-primary)]">
+                        三类观测表
+                      </p>
+                    </div>
+                  </div>
+                </div>
+              </div>
+            </div>
+          </AppCard>
+
+          <AppCard
+            title="数据清理"
+            description="用于手动清理单类观测数据。保留天数留空时会直接删除该类数据的全部历史记录。"
+          >
+            <div className="grid gap-5 xl:grid-cols-3">
+              {[
+                {
+                  target: 'node_access_logs' as const,
+                  label: '访问日志',
+                  description:
+                    '清理 node_access_logs，影响访问明细、IP 汇总与相关趋势查询。',
+                },
+                {
+                  target: 'node_metric_snapshots' as const,
+                  label: '性能快照',
+                  description:
+                    '清理 node_metric_snapshots，影响节点资源趋势和总览资源统计。',
+                },
+                {
+                  target: 'node_request_reports' as const,
+                  label: '请求聚合',
+                  description:
+                    '清理 node_request_reports，影响请求量、错误量与来源聚合展示。',
+                },
+              ].map((item) => (
+                <div
+                  key={item.target}
+                  className="rounded-[28px] border border-[var(--border-default)] bg-[var(--surface-elevated)] p-5"
+                >
+                  <div className="space-y-3">
+                    <div>
+                      <p className="text-lg font-semibold text-[var(--foreground-primary)]">
+                        {item.label}
+                      </p>
+                      <p className="mt-2 text-sm leading-6 text-[var(--foreground-secondary)]">
+                        {item.description}
+                      </p>
+                    </div>
+                    <DangerButton
+                      type="button"
+                      onClick={() => {
+                        setCleanupRetentionDays('');
+                        setCleanupModalState({
+                          target: item.target,
+                          label: item.label,
+                        });
+                      }}
+                    >
+                      清理数据
+                    </DangerButton>
+                  </div>
+                </div>
+              ))}
+            </div>
+          </AppCard>
+        </div>
+      );
+    }
+
     if (activeTab === 'system') {
       return (
         <div className="space-y-6">
@@ -2032,6 +2246,83 @@ export function SettingsPage() {
       </div>
 
       {renderTabContent()}
+
+      <AppModal
+        isOpen={cleanupModalState !== null}
+        title={`清理${cleanupModalState?.label ?? ''}`}
+        description="输入保留天数后，将只保留该天数范围内的数据；如果留空，则会直接删除该类数据的全部历史记录。"
+        onClose={() => {
+          if (databaseCleanupMutation.isPending) {
+            return;
+          }
+          setCleanupModalState(null);
+        }}
+        footer={
+          <div className="flex flex-wrap justify-end gap-2">
+            <SecondaryButton
+              type="button"
+              onClick={() => setCleanupModalState(null)}
+              disabled={databaseCleanupMutation.isPending}
+            >
+              取消
+            </SecondaryButton>
+            <DangerButton
+              type="button"
+              disabled={databaseCleanupMutation.isPending}
+              onClick={() => {
+                if (!cleanupModalState) {
+                  return;
+                }
+                const trimmed = cleanupRetentionDays.trim();
+                if (trimmed !== '') {
+                  const retentionDays = Number.parseInt(trimmed, 10);
+                  if (Number.isNaN(retentionDays) || retentionDays < 1) {
+                    setFeedback({
+                      tone: 'danger',
+                      message: '手动清理保留天数至少为 1 天。',
+                    });
+                    return;
+                  }
+                  databaseCleanupMutation.mutate({
+                    target: cleanupModalState.target,
+                    retention_days: retentionDays,
+                  });
+                  return;
+                }
+                databaseCleanupMutation.mutate({
+                  target: cleanupModalState.target,
+                });
+              }}
+            >
+              {databaseCleanupMutation.isPending ? '清理中...' : '确认清理'}
+            </DangerButton>
+          </div>
+        }
+      >
+        <div className="space-y-5">
+          <div className="rounded-2xl border border-[var(--status-danger-border)] bg-[var(--status-danger-soft)] px-4 py-4 text-sm leading-6 text-[var(--status-danger-foreground)]">
+            该操作会直接删除数据库中的历史观测数据，删除后无法恢复，请确认当前选择的数据类型和保留范围无误。
+          </div>
+          <ResourceField
+            label="保留天数"
+            hint="留空表示全部删除；填写时必须为大于等于 1 的整数。"
+          >
+            <ResourceInput
+              type="number"
+              min={1}
+              value={cleanupRetentionDays}
+              onChange={(event) => setCleanupRetentionDays(event.target.value)}
+              placeholder="例如 30；留空则全部删除"
+            />
+          </ResourceField>
+          {databaseCleanupMutation.isError ? (
+            <ErrorState
+              title="数据库清理失败"
+              description={getErrorMessage(databaseCleanupMutation.error)}
+            />
+          ) : null}
+        </div>
+      </AppModal>
     </div>
   );
 }

openflare_server/web/features/settings/types.ts

@@ -5,6 +5,10 @@ export interface OptionItem {
   value: string;
 }
 
+export interface OptionBatchPayload {
+  options: OptionItem[];
+}
+
 export interface BootstrapTokenPayload {
   discovery_token: string;
 }
@@ -18,6 +22,25 @@ export interface GeoIPLookupResult {
   longitude?: number | null;
 }
 
+export type DatabaseCleanupTarget =
+  | 'node_access_logs'
+  | 'node_metric_snapshots'
+  | 'node_request_reports';
+
+export interface DatabaseCleanupPayload {
+  target: DatabaseCleanupTarget;
+  retention_days?: number;
+}
+
+export interface DatabaseCleanupResult {
+  target: DatabaseCleanupTarget;
+  target_label: string;
+  deleted_count: number;
+  delete_all: boolean;
+  retention_days?: number;
+  cutoff?: string;
+}
+
 export interface UpdateSelfPayload {
   username: string;
   display_name: string;

openflare_server/web/features/shared/components/resource-primitives.tsx

@@ -14,6 +14,7 @@ interface ResourceFieldProps {
   error?: string;
   className?: string;
   tooltip?: string;
+  container?: 'label' | 'div';
   children: ReactNode;
 }
 
@@ -36,10 +37,13 @@ export function ResourceField({
   error,
   className,
   tooltip,
+  container = 'label',
   children,
 }: ResourceFieldProps) {
+  const Container = container;
+
   return (
-    <label className={cn('block space-y-2', className)}>
+    <Container className={cn('block space-y-2', className)}>
       <span className="flex items-center gap-2 text-sm font-medium text-[var(--foreground-primary)]">
         <span>{label}</span>
         {tooltip ? <FieldTooltip content={tooltip} /> : null}
@@ -54,7 +58,7 @@ export function ResourceField({
           {hint}
         </span>
       ) : null}
-    </label>
+    </Container>
   );
 }
 

openflare_server/web/lib/constants/navigation.ts

@@ -1,51 +1,56 @@
-import type {NavigationItem} from '@/types/navigation';
+import type { NavigationItem } from '@/types/navigation';
 
 export const dashboardNavigation: NavigationItem[] = [
-    {
-        href: '/',
-        label: '总览',
-        icon: 'home',
-    },
-    {
-        href: '/node',
-        label: '节点',
-        icon: 'node',
-    },
-    {
-        href: '/website',
-        label: '网站',
-        icon: 'website',
-    },
-    {
-        href: '/proxy-route',
-        label: '规则',
-        icon: 'proxy',
-    },
-    {
-        href: '/config-version',
-        label: '发布',
-        icon: 'release',
-    },
-    {
-        href: '/access-log',
-        label: '日志',
-        icon: 'log',
-    },
+  {
+    href: '/',
+    label: '总览',
+    icon: 'home',
+  },
+  {
+    href: '/node',
+    label: '节点',
+    icon: 'node',
+  },
+  {
+    href: '/website',
+    label: '网站',
+    icon: 'website',
+  },
+  {
+    href: '/origin',
+    label: '源站',
+    icon: 'origin',
+  },
+  {
+    href: '/proxy-route',
+    label: '规则',
+    icon: 'proxy',
+  },
+  {
+    href: '/config-version',
+    label: '发布',
+    icon: 'release',
+  },
+  {
+    href: '/access-log',
+    label: '日志',
+    icon: 'log',
+  },
 
-    {
-        href: '/performance',
-        label: '性能',
-        icon: 'performance',
-    },
-    {
-        href: '/user',
-        label: '用户',
-        icon: 'user',
-    },
+  {
+    href: '/performance',
+    label: '性能',
+    icon: 'performance',
+  },
+  {
+    href: '/user',
+    label: '用户',
+    icon: 'user',
+  },
 
-    {
-        href: '/setting',
-        label: '设置',
-        icon: 'setting',
-    },
+  {
+    href: '/setting',
+    label: '设置',
+    icon: 'setting',
+  },
 ];

openflare_server/web/lib/utils.ts

@@ -0,0 +1,6 @@
+import { clsx, type ClassValue } from "clsx"
+import { twMerge } from "tailwind-merge"
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs))
+}

openflare_server/web/package.json

@@ -5,7 +5,7 @@
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.6.2",
   "scripts": {
-    "dev": "NEXT_DEV_BACKEND_URL=${NEXT_DEV_BACKEND_URL:-http://127.0.0.1:3000} node scripts/dev-server.mjs",
+    "dev": "node scripts/dev-server.mjs",
     "build": "next build",
     "postbuild": "node scripts/prepare-static-export.mjs",
     "start": "next start",
@@ -18,17 +18,24 @@
     "format:check": "prettier --check ."
   },
   "dependencies": {
+    "@heroui/react": "^3.0.1",
+    "@heroui/styles": "^3.0.1",
     "@hookform/resolvers": "^4.1.3",
     "@tanstack/react-query": "^5.66.8",
+    "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "echarts": "^6.0.0",
     "echarts-for-react": "^3.0.6",
+    "lucide-react": "^0.577.0",
     "marked": "^17.0.4",
     "next": "15.2.2",
+    "radix-ui": "^1.4.3",
     "react": "19.0.0",
     "react-dom": "19.0.0",
     "react-hook-form": "^7.54.2",
-    "tailwind-merge": "^3.0.2",
+    "shadcn": "^4.1.0",
+    "tailwind-merge": "^3.5.0",
+    "tw-animate-css": "^1.4.0",
     "zod": "^3.24.2",
     "zustand": "^5.0.3"
   },