Merge pull request #49 from Sagit-chu/opencode/silent-wizard

feat: 共享面板

.github/workflows/deploy-docs.yml

@@ -0,0 +1,43 @@
+name: Deploy Docs
+on:
+  push:
+    branches:
+      - main
+      - master
+      - beta
+    paths:
+      - 'doc/**'
+      - 'mkdocs.yml'
+
+permissions:
+  contents: write
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure Git Credentials
+        run: |
+          git config user.name github-actions[bot]
+          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: 3.x
+
+      - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV 
+
+      - uses: actions/cache@v4
+        with:
+          key: mkdocs-material-${{ env.cache_id }}
+          path: .cache
+          restore-keys: |
+            mkdocs-material-
+
+      - name: Install MkDocs and Material Theme
+        run: pip install mkdocs-material
+
+      - name: Build and Deploy
+        run: mkdocs gh-deploy --force

AGENTS.md

@@ -5,17 +5,15 @@
 **Branch:** beta
 
 ## OVERVIEW
-Flux Panel is a traffic forwarding management system built on a forked GOST v3 stack. It ships as Dockerized Spring Boot (admin API) + Vite/React UI + Go forwarding agent, with optional mobile WebView wrappers.
+FLVX (formerly Flux Panel) is a traffic forwarding management system built on a forked GOST v3 stack. It ships as a Go-based admin API (SQLite) + Vite/React UI + Go forwarding agent, with optional mobile WebView wrappers.
 
 ## STRUCTURE
 ```
 ./
 ├── go-gost/               # Go forwarding agent (forked gost + local x/)
 │   └── x/                 # Local fork of github.com/go-gost/x (replace => ./x)
-├── springboot-backend/    # Java/Spring Boot admin API (SQLite/MyBatis)
+├── go-backend/            # Go Admin API (SQLite, net/http)
 ├── vite-frontend/         # React/Vite dashboard (HeroUI + Tailwind)
-├── android-app/           # Android WebView wrapper (optional)
-├── ios-app/               # iOS WebView wrapper (optional)
 ├── docker-compose-v4.yml  # Panel deploy (IPv4-only bridge)
 ├── docker-compose-v6.yml  # Panel deploy (IPv6-enabled bridge)
 ├── panel_install.sh       # Panel installer/upgrader (downloads compose)
@@ -30,13 +28,19 @@ Flux Panel is a traffic forwarding management system built on a forked GOST v3 s
 | **Deploy (IPv6)** | `docker-compose-v6.yml` | Same as v4 + IPv6-enabled bridge |
 | **Panel install** | `panel_install.sh` | Picks v4/v6, generates `JWT_SECRET`, downloads compose |
 | **Node install** | `install.sh` | Installs `/etc/flux_agent/flux_agent` + writes `config.json`/`gost.json` + systemd `flux_agent.service` |
-| **Admin API entry** | `springboot-backend/src/main/java/com/admin/AdminApplication.java` | Spring Boot app |
-| **Admin API routes** | `springboot-backend/src/main/java/com/admin/controller/` | Mostly `/api/v1/*` controllers |
-| **Admin auth** | `springboot-backend/src/main/java/com/admin/common/interceptor/JwtInterceptor.java` | Checks `Authorization` header |
-| **Web UI routing** | `vite-frontend/src/App.tsx` | React Router v6 + ProtectedRoute/H5 layouts |
-| **Web UI API client** | `vite-frontend/src/api/network.ts` | Axios `baseURL` + `Authorization` header |
-| **Go agent entry** | `go-gost/main.go` | Reads panel `config.json` + starts gost services |
-| **Go x fork** | `go-gost/x/` | Handlers/listeners/dialers + management API |
+| **Admin API** | `go-backend/` | Go Admin API (SQLite) |
+| **Web UI** | `vite-frontend/` | React/Vite dashboard (HeroUI + Tailwind) |
+| **Go Agent** | `go-gost/` | Forwarding agent (forked gost + local x/) |
+| **Go Core** | `go-gost/x/` | Handlers/listeners/dialers + management API |
+
+## CODE MAP
+| Symbol | Type | Location | Role |
+|--------|------|----------|------|
+| `flvx` | Project | `.` | Root directory |
+| `main` | Func | `go-backend/cmd/paneld/main.go` | Backend Entry |
+| `App` | Component | `vite-frontend/src/App.tsx` | Frontend Entry |
+| `main` | Func | `go-gost/main.go` | Agent Entry |
+
 
 ## CONVENTIONS
 - `Authorization` header carries the raw JWT token (no `Bearer` prefix) between `vite-frontend/` and `springboot-backend/`.

README.md

@@ -1,4 +1,6 @@
-# flux-panel转发面板 哆啦A梦转发面板
+# FLVX
+
+> 📞 **联系我们**: [Telegram群组](https://t.me/flvxpanel)
 
 本项目基于 [go-gost/gost](https://github.com/go-gost/gost) 和 [go-gost/x](https://github.com/go-gost/x) 两个开源库，实现了转发面板。
 ---

doc/faq.md

@@ -0,0 +1,24 @@
+# 常见问题 (FAQ)
+
+### Q1: 安装脚本提示 "Docker command not found"？
+**A**: 请确保您的系统已安装 Docker 和 Docker Compose。
+- Ubuntu/Debian 安装 Docker: `curl -fsSL https://get.docker.com | bash`
+
+### Q2: 面板无法访问 (Connection Refused)？
+**A**:
+1. 检查防火墙是否放行了前端端口（默认 `6366`）。
+2. 检查容器是否正常运行: `docker ps`。
+3. 查看容器日志: `docker logs flux-panel-backend` 或 `docker logs vite-frontend`。
+
+### Q3: 节点显示离线？
+**A**:
+1. 检查节点服务器与面板服务器之间的网络连通性。
+2. 确认在节点端安装时输入的 **面板地址** 和 **密钥** 是否正确。
+3. 检查节点端服务状态: `systemctl status flux_agent`。
+4. 查看节点端日志: `journalctl -u flux_agent -f`。
+
+### Q4: 只有 TCP 能通，UDP 不通？
+**A**: 请检查服务器防火墙和安全组（AWS/阿里云/腾讯云等）是否同时放行了对应端口的 **TCP 和 UDP** 协议。
+
+### Q5: IPv6 无法使用？
+**A**: 面板安装脚本会自动尝试配置 Docker 的 IPv6。如果失败，请手动检查 `/etc/docker/daemon.json` 配置，确保 `ipv6: true` 且分配了正确的 `fixed-cidr-v6` 子网。

doc/index.md

@@ -0,0 +1,37 @@
+# FLVX 官方文档
+
+**FLVX** 是一个基于 [go-gost/gost](https://github.com/go-gost/gost) 和 [go-gost/x](https://github.com/go-gost/x) 开发的高性能流量转发管理系统。
+
+> 📞 **联系我们**: [Telegram群组](https://t.me/flvxpanel)
+
+## 核心特性
+
+- **多协议支持**: 完美支持 TCP 和 UDP 协议转发。
+- **灵活转发**: 支持 **端口转发** 与 **隧道转发** 两种模式。
+- **流量控制**: 支持按 **隧道账号级别** 管理流量转发数量，用于用户/隧道配额控制。
+- **限速管理**: 可针对 **指定用户的指定隧道进行限速** 设置。
+- **计费策略**: 支持配置 **单向或双向流量计费方式**，灵活适配不同计费模型。
+- **策略配置**: 提供灵活的转发策略配置，适用于多种网络场景。
+
+## 快速开始
+
+- [安装部署](./install.md)
+- [使用指南](./usage.md)
+- [常见问题](./faq.md)
+
+## 免责声明
+
+本项目仅供个人学习与研究使用，基于开源项目进行二次开发。  
+使用本项目所带来的任何风险均由使用者自行承担。本项目为开源的流量转发工具，仅限合法、合规用途。  
+**禁止将本项目用于任何违法或未经授权的行为，包括但不限于网络攻击、数据窃取、非法访问等。**
+
+## 捐赠支持
+
+如果您觉得本项目对您有帮助，欢迎请作者喝杯咖啡！
+
+| 网络       | 地址                                                                 |
+|------------|----------------------------------------------------------------------|
+| BNB(BEP20) | `0xa608708fdc6279a2433fd4b82f0b72b8cbe97ed5`                          |
+| TRC20      | `TM8VYdU3s3gSX5PC8swjAJrAzZFCHKqG2k`                                  |
+| Aptos      | `0x49427bfcba1006a346447430689b2307ac156316bb34850d1d3029ff9d118da5`  |
+| Polygon    | `0xa608708fdc6279a2433fd4b82f0b72b8cbe97ed5`                          |

doc/install.md

@@ -0,0 +1,79 @@
+# 安装部署指南
+
+本文档介绍如何部署 FLVX 面板端及节点端。
+
+## 一、面板端部署
+
+面板端负责管理用户、节点和转发规则。
+
+### 1. 环境要求
+- 操作系统：Linux (推荐 Debian 10+ / Ubuntu 20.04+)
+- 必须安装 Docker 和 Docker Compose
+
+### 2. 一键安装脚本
+
+使用以下命令即可快速安装面板：
+
+```bash
+curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
+```
+
+**安装过程中会提示输入以下信息：**
+- **前端端口**: 默认为 `6366`
+- **后端端口**: 默认为 `6365`
+
+脚本会自动检测系统是否支持 IPv6，并自动配置 Docker 的 IPv6 支持。
+
+### 3. 访问面板
+
+安装完成后，访问：
+`http://<服务器IP>:<前端端口>` (默认: `http://<服务器IP>:6366`)
+
+**默认管理员账号：**
+- 用户名: `admin_user`
+- 密码: `admin_user`
+
+> ⚠️ **注意**: 首次登录后，请务必在“个人中心”或“设置”中修改默认密码！
+
+### 4. 维护命令
+
+再次运行 `./panel_install.sh` 脚本可以看到管理菜单：
+1. 安装面板
+2. 更新面板
+3. 卸载面板
+
+---
+
+## 二、节点端部署
+
+节点端运行在实际进行流量转发的服务器上，需要连接到面板端进行管理。
+
+### 1. 获取接入密钥
+1. 登录面板端。
+2. 进入 **节点管理 (Node)** 页面。
+3. 点击 **添加节点**。
+4. 获取该节点的 **接入密钥 (Secret)**。
+
+### 2. 一键安装脚本
+
+在节点服务器上运行：
+
+```bash
+curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/install.sh -o install.sh && chmod +x install.sh && ./install.sh
+```
+
+**安装过程中会提示输入：**
+- **服务器地址**: 面板端的通信地址（通常是 `http://<面板IP>:<后端端口>`，例如 `http://1.2.3.4:6365`）。
+- **密钥**: 刚才在面板中获取的节点密钥。
+
+或者直接使用带参数的命令（适用于自动化部署）：
+
+```bash
+# 替换 <面板地址> 和 <密钥>
+./install.sh -a "http://1.2.3.4:6365" -s "your_node_secret"
+```
+
+### 3. 验证安装
+安装完成后，服务会自动启动。
+- 查看状态: `systemctl status flux_agent`
+- 回到面板 **节点管理** 页面，该节点状态应显示为 **在线**。

doc/usage.md

@@ -0,0 +1,35 @@
+# 使用指南
+
+## 1. 仪表盘 (Dashboard)
+登录系统后首先看到的是仪表盘，这里展示了系统的整体运行状态，包括：
+- 在线节点数量
+- 用户总数
+- 流量统计信息
+
+## 2. 节点管理 (Node)
+节点是实际承载流量转发的服务器。
+- **添加节点**: 点击“添加”，获取密钥用于节点端安装。
+- **管理**: 可以查看节点在线状态、版本信息，以及对节点进行编辑或删除。
+
+## 3. 用户管理 (User)
+管理员可以创建和管理普通用户。
+- **创建用户**: 设置用户名、密码、流量配额等。
+- **用户组**: 可以将用户分配到不同的组 (Group)，便于统一管理权限或策略。
+
+## 4. 转发管理 (Forward)
+这是核心功能区，用于设置端口转发规则。
+- **端口转发**: 将节点服务器的某个端口流量转发到目标地址。
+    - **协议**: 支持 TCP / UDP。
+    - **入口**: 选择入口节点和监听端口。
+    - **出口**: 设置目标 IP 和端口。
+- **隧道转发**: 用于更复杂的网络穿透场景（具体配置视业务需求而定）。
+
+## 5. 限制与策略 (Limit)
+- **限速**: 可以对指定用户或指定隧道进行带宽限制，防止资源滥用。
+- **计费模式**: 支持配置流量计算方式（单向或双向），适合运营场景。
+
+## 6. 系统配置 (Config)
+在此页面进行系统的全局设置。
+
+## 7. 个人设置 (Profile)
+- **修改密码**: 为了安全，建议定期修改管理员密码。

docker-compose-v4.yml

@@ -12,6 +12,7 @@ services:
       JWT_SECRET: ${JWT_SECRET}
       LOG_DIR: /app/logs
       SERVER_ADDR: :6365
+      TZ: Asia/Shanghai
     ports:
       - "${BACKEND_PORT}:6365"
     volumes:

docker-compose-v6.yml

@@ -12,6 +12,7 @@ services:
       JWT_SECRET: ${JWT_SECRET}
       LOG_DIR: /app/logs
       SERVER_ADDR: :6365
+      TZ: Asia/Shanghai
     ports:
       - "${BACKEND_PORT}:6365"
     volumes:

go-backend/AGENTS.md

@@ -0,0 +1,47 @@
+# GO BACKEND KNOWLEDGE BASE
+
+## OVERVIEW
+Go-based Admin API for FLVX (formerly Flux Panel). Replaces the legacy Spring Boot backend.
+**Stack:** Go 1.23, net/http (std lib), SQLite (modernc.org/sqlite).
+
+## STRUCTURE
+```
+go-backend/
+├── cmd/paneld/main.go        # Entry point; starts HTTP server + WebSocket
+├── internal/
+│   ├── http/                 # HTTP layer
+│   │   ├── router.go         # Routes (NewServeMux) + Middleware chain
+│   │   ├── handler/          # API Handlers (User, Tunnel, Node, etc.)
+│   │   ├── middleware/       # JWT, CORS, Logging, Recover
+│   │   └── response/         # JSON response helpers
+│   ├── store/sqlite/         # Data Access Layer (Repository pattern)
+│   │   ├── repository.go     # SQL queries & Struct definitions
+│   │   └── sql/              # Embedded schema.sql & data.sql
+│   └── auth/                 # Auth logic
+├── tests/                    # Integration/Contract tests
+├── Dockerfile                # Multi-stage build (alpine)
+└── Makefile                  # Build commands
+```
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| **API Routes** | `go-backend/internal/http/router.go` | Registers handlers to `http.ServeMux` |
+| **DB Schema** | `go-backend/internal/store/sqlite/sql/schema.sql` | Embedded in binary |
+| **SQL Queries** | `go-backend/internal/store/sqlite/repository.go` | Raw SQL, no ORM |
+| **Auth Middleware** | `go-backend/internal/http/middleware/jwt.go` | Extracts `Authorization` header |
+| **WebSocket** | `go-backend/internal/ws/` | Real-time updates (traffic, status) |
+
+## CONVENTIONS
+- **No ORM**: Uses raw SQL with `database/sql` and `modernc.org/sqlite`.
+- **Standard Lib**: Uses `net/http` for routing (Go 1.22+ patterns).
+- **Auth**: Expects raw JWT in `Authorization` header (no `Bearer` prefix).
+- **Config**: Loaded from environment variables (see `cmd/paneld/main.go`).
+
+## COMMANDS
+```bash
+cd go-backend
+go run ./cmd/paneld
+go test ./...
+make build
+```

go-backend/Dockerfile

@@ -5,7 +5,9 @@ COPY go.mod ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /out/paneld ./cmd/paneld
+ARG TARGETOS
+ARG TARGETARCH
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} env ${TARGETARCH:+GOARCH=${TARGETARCH}} go build -o /out/paneld ./cmd/paneld
 
 FROM debian:bookworm-slim
 WORKDIR /app

go-backend/internal/http/client/federation.go

@@ -0,0 +1,121 @@
+package client
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+type FederationClient struct {
+	client *http.Client
+}
+
+type RemoteNodeInfo struct {
+	ShareID        int64  `json:"shareId"`
+	ShareName      string `json:"shareName"`
+	NodeID         int64  `json:"nodeId"`
+	NodeName       string `json:"nodeName"`
+	ServerIP       string `json:"serverIp"`
+	Status         int    `json:"status"`
+	MaxBandwidth   int64  `json:"maxBandwidth"`
+	ExpiryTime     int64  `json:"expiryTime"`
+	PortRangeStart int    `json:"portRangeStart"`
+	PortRangeEnd   int    `json:"portRangeEnd"`
+}
+
+type RemoteTunnelResponse struct {
+	TunnelID int64 `json:"tunnelId"`
+}
+
+func NewFederationClient() *FederationClient {
+	return &FederationClient{
+		client: &http.Client{
+			Timeout: 10 * time.Second,
+		},
+	}
+}
+
+func (c *FederationClient) Connect(url, token, localDomain string) (*RemoteNodeInfo, error) {
+	url = strings.TrimSuffix(url, "/")
+	req, err := http.NewRequest("POST", url+"/api/v1/federation/connect", nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	if localDomain != "" {
+		req.Header.Set("X-Panel-Domain", localDomain)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("remote error %d: %s", resp.StatusCode, string(body))
+	}
+
+	var res struct {
+		Code int            `json:"code"`
+		Msg  string         `json:"msg"`
+		Data RemoteNodeInfo `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
+		return nil, err
+	}
+	if res.Code != 0 {
+		return nil, fmt.Errorf("remote api error: %s", res.Msg)
+	}
+
+	return &res.Data, nil
+}
+
+func (c *FederationClient) CreateTunnel(url, token, localDomain, protocol string, remotePort int, target string) (*RemoteTunnelResponse, error) {
+	url = strings.TrimSuffix(url, "/")
+	payload := map[string]interface{}{
+		"protocol":   protocol,
+		"remotePort": remotePort,
+		"target":     target,
+	}
+	bodyBytes, _ := json.Marshal(payload)
+	req, err := http.NewRequest("POST", url+"/api/v1/federation/tunnel/create", strings.NewReader(string(bodyBytes)))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	if localDomain != "" {
+		req.Header.Set("X-Panel-Domain", localDomain)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("remote error %d: %s", resp.StatusCode, string(body))
+	}
+
+	var res struct {
+		Code int                  `json:"code"`
+		Msg  string               `json:"msg"`
+		Data RemoteTunnelResponse `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
+		return nil, err
+	}
+	if res.Code != 0 {
+		return nil, fmt.Errorf("remote api error: %s", res.Msg)
+	}
+
+	return &res.Data, nil
+}

go-backend/internal/http/handler/control_plane.go

@@ -59,6 +59,8 @@ type chainNodeRecord struct {
 	NodeID    int64
 	Port      int
 	NodeName  string
+	Protocol  string
+	Strategy  string
 }
 
 type diagnosisTarget struct {
@@ -232,9 +234,9 @@ func (h *Handler) getNodeRecord(nodeID int64) (*nodeRecord, error) {
 	return &n, nil
 }
 
-func (h *Handler) resolveUserTunnelAndLimiter(userID, tunnelID int64) (int64, *int, error) {
+func (h *Handler) resolveUserTunnelAndLimiter(userID, tunnelID int64) (int64, *int64, *int, error) {
 	row := h.repo.DB().QueryRow(`
-		SELECT ut.id, sl.speed
+		SELECT ut.id, sl.id, sl.speed
 		FROM user_tunnel ut
 		LEFT JOIN speed_limit sl ON sl.id = ut.speed_id
 		WHERE ut.user_id = ? AND ut.tunnel_id = ?
@@ -242,19 +244,21 @@ func (h *Handler) resolveUserTunnelAndLimiter(userID, tunnelID int64) (int64, *i
 		LIMIT 1
 	`, userID, tunnelID)
 	var userTunnelID int64
+	var limiterID sql.NullInt64
 	var speed sql.NullInt64
-	err := row.Scan(&userTunnelID, &speed)
+	err := row.Scan(&userTunnelID, &limiterID, &speed)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return 0, nil, nil
+			return 0, nil, nil, nil
 		}
-		return 0, nil, err
+		return 0, nil, nil, err
 	}
-	if !speed.Valid || speed.Int64 <= 0 {
-		return userTunnelID, nil, nil
+	if !limiterID.Valid || limiterID.Int64 <= 0 {
+		return userTunnelID, nil, nil, nil
 	}
-	v := int(speed.Int64)
-	return userTunnelID, &v, nil
+	v := limiterID.Int64
+	s := int(speed.Int64)
+	return userTunnelID, &v, &s, nil
 }
 
 func (h *Handler) listUserTunnelIDs(userID, tunnelID int64) ([]int64, error) {
@@ -326,18 +330,22 @@ func (h *Handler) syncForwardServices(forward *forwardRecord, method string, all
 		return errors.New("转发入口端口不存在")
 	}
 
-	userTunnelID, limiter, err := h.resolveUserTunnelAndLimiter(forward.UserID, forward.TunnelID)
+	userTunnelID, limiterID, speed, err := h.resolveUserTunnelAndLimiter(forward.UserID, forward.TunnelID)
 	if err != nil {
 		return err
 	}
 	serviceBase := buildForwardServiceBase(forward.ID, forward.UserID, userTunnelID)
 
 	for _, fp := range ports {
+		if limiterID != nil && speed != nil {
+			h.ensureLimiterOnNode(fp.NodeID, *limiterID, *speed)
+		}
+
 		node, err := h.getNodeRecord(fp.NodeID)
 		if err != nil {
 			return err
 		}
-		services := buildForwardServiceConfigs(serviceBase, forward, tunnel, node, fp.Port, limiter)
+		services := buildForwardServiceConfigs(serviceBase, forward, tunnel, node, fp.Port, limiterID)
 		_, err = h.sendNodeCommand(node.ID, method, services, true, false)
 		if err != nil && allowFallbackAdd && method == "UpdateService" {
 			_, err = h.sendNodeCommand(node.ID, "AddService", services, true, false)
@@ -360,7 +368,7 @@ func (h *Handler) controlForwardServices(forward *forwardRecord, commandType str
 	if len(ports) == 0 {
 		return nil
 	}
-	userTunnelID, _, err := h.resolveUserTunnelAndLimiter(forward.UserID, forward.TunnelID)
+	userTunnelID, _, _, err := h.resolveUserTunnelAndLimiter(forward.UserID, forward.TunnelID)
 	if err != nil {
 		return err
 	}
@@ -862,7 +870,7 @@ func firstPortFromRange(portRange string) int {
 
 func (h *Handler) listChainNodesForTunnel(tunnelID int64) ([]chainNodeRecord, error) {
 	rows, err := h.repo.DB().Query(`
-		SELECT ct.chain_type, COALESCE(ct.inx, 0), ct.node_id, COALESCE(ct.port, 0), n.name
+		SELECT ct.chain_type, COALESCE(ct.inx, 0), ct.node_id, COALESCE(ct.port, 0), n.name, ct.protocol, ct.strategy
 		FROM chain_tunnel ct
 		LEFT JOIN node n ON n.id = ct.node_id
 		WHERE ct.tunnel_id = ?
@@ -877,7 +885,9 @@ func (h *Handler) listChainNodesForTunnel(tunnelID int64) ([]chainNodeRecord, er
 	for rows.Next() {
 		var item chainNodeRecord
 		var name sql.NullString
-		if err := rows.Scan(&item.ChainType, &item.Inx, &item.NodeID, &item.Port, &name); err != nil {
+		var protocol sql.NullString
+		var strategy sql.NullString
+		if err := rows.Scan(&item.ChainType, &item.Inx, &item.NodeID, &item.Port, &name, &protocol, &strategy); err != nil {
 			return nil, err
 		}
 		if strings.TrimSpace(name.String) == "" {
@@ -885,6 +895,8 @@ func (h *Handler) listChainNodesForTunnel(tunnelID int64) ([]chainNodeRecord, er
 		} else {
 			item.NodeName = name.String
 		}
+		item.Protocol = defaultString(protocol.String, "tls")
+		item.Strategy = defaultString(strategy.String, "round")
 		result = append(result, item)
 	}
 	if err := rows.Err(); err != nil {
@@ -997,7 +1009,7 @@ func isNotFoundError(err error) bool {
 	return strings.Contains(msg, "not found") || strings.Contains(msg, "不存在")
 }
 
-func buildForwardServiceConfigs(baseName string, forward *forwardRecord, tunnel *tunnelRecord, node *nodeRecord, port int, limiter *int) []map[string]interface{} {
+func buildForwardServiceConfigs(baseName string, forward *forwardRecord, tunnel *tunnelRecord, node *nodeRecord, port int, limiterID *int64) []map[string]interface{} {
 	protocols := []string{"tcp", "udp"}
 	services := make([]map[string]interface{}, 0, 2)
 	targets := splitRemoteTargets(forward.RemoteAddr)
@@ -1038,8 +1050,8 @@ func buildForwardServiceConfigs(baseName string, forward *forwardRecord, tunnel
 		if tunnel != nil && tunnel.Type == 1 && strings.TrimSpace(node.InterfaceName) != "" {
 			service["metadata"] = map[string]interface{}{"interface": node.InterfaceName}
 		}
-		if limiter != nil && *limiter > 0 {
-			service["limiter"] = strconv.Itoa(*limiter)
+		if limiterID != nil && *limiterID > 0 {
+			service["limiter"] = strconv.FormatInt(*limiterID, 10)
 		}
 		services = append(services, service)
 	}
@@ -1102,3 +1114,49 @@ func asBool(v interface{}, def bool) bool {
 		return def
 	}
 }
+
+func (h *Handler) sendLimiterConfig(limiterID int64, speedMbps int, tunnelID int64) error {
+	rate := float64(speedMbps) / 8.0
+	limitStr := fmt.Sprintf("$ %.1fMB %.1fMB", rate, rate)
+
+	payload := map[string]interface{}{
+		"name":   strconv.FormatInt(limiterID, 10),
+		"limits": []string{limitStr},
+	}
+
+	nodes, err := h.tunnelEntryNodeIDs(tunnelID)
+	if err != nil {
+		return err
+	}
+
+	for _, nodeID := range nodes {
+		_, _ = h.sendNodeCommand(nodeID, "AddLimiters", payload, false, false)
+	}
+	return nil
+}
+
+func (h *Handler) sendDeleteLimiterConfig(limiterID int64, tunnelID int64) error {
+	payload := map[string]interface{}{
+		"limiter": strconv.FormatInt(limiterID, 10),
+	}
+
+	nodes, err := h.tunnelEntryNodeIDs(tunnelID)
+	if err != nil {
+		return err
+	}
+
+	for _, nodeID := range nodes {
+		_, _ = h.sendNodeCommand(nodeID, "DeleteLimiters", payload, false, true)
+	}
+	return nil
+}
+
+func (h *Handler) ensureLimiterOnNode(nodeID int64, limiterID int64, speed int) {
+	rate := float64(speed) / 8.0
+	limitStr := fmt.Sprintf("$ %.1fMB %.1fMB", rate, rate)
+	payload := map[string]interface{}{
+		"name":   strconv.FormatInt(limiterID, 10),
+		"limits": []string{limitStr},
+	}
+	_, _ = h.sendNodeCommand(nodeID, "AddLimiters", payload, false, false)
+}

go-backend/internal/http/handler/federation.go

@@ -0,0 +1,396 @@
+package handler
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"go-backend/internal/http/client"
+	"go-backend/internal/http/response"
+	"go-backend/internal/store/sqlite"
+)
+
+type federationTunnelRequest struct {
+	Protocol   string `json:"protocol"`
+	RemotePort int    `json:"remotePort"`
+	Target     string `json:"target"`
+}
+
+type createPeerShareRequest struct {
+	Name           string `json:"name"`
+	NodeID         int64  `json:"nodeId"`
+	MaxBandwidth   int64  `json:"maxBandwidth"`
+	ExpiryTime     int64  `json:"expiryTime"`
+	PortRangeStart int    `json:"portRangeStart"`
+	PortRangeEnd   int    `json:"portRangeEnd"`
+	AllowedDomains string `json:"allowedDomains"`
+}
+
+type deletePeerShareRequest struct {
+	ID int64 `json:"id"`
+}
+
+type nodeImportRequest struct {
+	RemoteURL string `json:"remoteUrl"`
+	Token     string `json:"token"`
+}
+
+func (h *Handler) federationShareList(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	shares, err := h.repo.ListPeerShares()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	response.WriteJSON(w, response.OK(shares))
+}
+
+func (h *Handler) federationShareCreate(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	var req createPeerShareRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("Invalid JSON"))
+		return
+	}
+
+	if req.Name == "" || req.NodeID == 0 {
+		response.WriteJSON(w, response.ErrDefault("Name and NodeID are required"))
+		return
+	}
+
+	if req.MaxBandwidth < 0 {
+		response.WriteJSON(w, response.ErrDefault("Max bandwidth cannot be negative"))
+		return
+	}
+
+	if req.ExpiryTime < 0 {
+		response.WriteJSON(w, response.ErrDefault("Expiry time cannot be negative"))
+		return
+	}
+
+	if req.PortRangeStart < 0 || req.PortRangeStart > 65535 || req.PortRangeEnd < 0 || req.PortRangeEnd > 65535 {
+		response.WriteJSON(w, response.ErrDefault("Invalid port range"))
+		return
+	}
+
+	if req.PortRangeStart > req.PortRangeEnd {
+		response.WriteJSON(w, response.ErrDefault("Port range start cannot be greater than end"))
+		return
+	}
+
+	node, err := h.repo.GetNodeByID(req.NodeID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if node == nil {
+		response.WriteJSON(w, response.ErrDefault("Node not found"))
+		return
+	}
+
+	now := time.Now().UnixMilli()
+	token := randomToken(32)
+
+	share := &sqlite.PeerShare{
+		Name:           req.Name,
+		NodeID:         req.NodeID,
+		Token:          token,
+		MaxBandwidth:   req.MaxBandwidth,
+		ExpiryTime:     req.ExpiryTime,
+		PortRangeStart: req.PortRangeStart,
+		PortRangeEnd:   req.PortRangeEnd,
+		IsActive:       1,
+		CreatedTime:    now,
+		UpdatedTime:    now,
+		AllowedDomains: req.AllowedDomains,
+	}
+
+	if err := h.repo.CreatePeerShare(share); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	response.WriteJSON(w, response.OKEmpty())
+}
+
+func (h *Handler) federationShareDelete(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	var req deletePeerShareRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("Invalid JSON"))
+		return
+	}
+
+	if err := h.repo.DeletePeerShare(req.ID); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	response.WriteJSON(w, response.OKEmpty())
+}
+
+func (h *Handler) nodeImport(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	var req nodeImportRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("Invalid JSON"))
+		return
+	}
+
+	if req.RemoteURL == "" || req.Token == "" {
+		response.WriteJSON(w, response.ErrDefault("Remote URL and Token are required"))
+		return
+	}
+
+	domainCfg, _ := h.repo.GetConfigByName("panel_domain")
+	localDomain := ""
+	if domainCfg != nil {
+		localDomain = domainCfg.Value
+	}
+
+	fc := client.NewFederationClient()
+	info, err := fc.Connect(req.RemoteURL, req.Token, localDomain)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, "Failed to connect: "+err.Error()))
+		return
+	}
+
+	// Prepare config json for local storage (metadata about limits)
+	configData := map[string]interface{}{
+		"shareId":        info.ShareID,
+		"maxBandwidth":   info.MaxBandwidth,
+		"expiryTime":     info.ExpiryTime,
+		"portRangeStart": info.PortRangeStart,
+		"portRangeEnd":   info.PortRangeEnd,
+	}
+	configBytes, _ := json.Marshal(configData)
+
+	db := h.repo.DB()
+	inx := nextIndex(db, "node")
+	now := time.Now().UnixMilli()
+
+	_, err = db.Exec(`
+		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, 0, 0, 0, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?)
+	`,
+		fmt.Sprintf("%s (Remote)", info.NodeName),
+		randomToken(16), // Dummy secret
+		info.ServerIP,
+		"", "", // v4/v6 unknown, use server_ip
+		"0", // port range not applicable for remote
+		"",
+		"",
+		now, now,
+		info.Status,
+		"[::]", "[::]",
+		inx,
+		req.RemoteURL,
+		req.Token,
+		string(configBytes),
+	)
+
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, "Database error: "+err.Error()))
+		return
+	}
+
+	response.WriteJSON(w, response.OKEmpty())
+}
+
+func (h *Handler) authPeer(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		authHeader := r.Header.Get("Authorization")
+		if authHeader == "" {
+			response.WriteJSON(w, response.Err(401, "Missing Authorization header"))
+			return
+		}
+
+		parts := strings.Split(authHeader, " ")
+		if len(parts) != 2 || parts[0] != "Bearer" {
+			response.WriteJSON(w, response.Err(401, "Invalid Authorization format"))
+			return
+		}
+
+		token := parts[1]
+		share, err := h.repo.GetPeerShareByToken(token)
+		if err != nil {
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}
+		if share == nil {
+			response.WriteJSON(w, response.Err(401, "Invalid token"))
+			return
+		}
+
+		if share.IsActive == 0 {
+			response.WriteJSON(w, response.Err(403, "Share is disabled"))
+			return
+		}
+
+		if share.ExpiryTime > 0 && share.ExpiryTime < time.Now().UnixMilli() {
+			response.WriteJSON(w, response.Err(403, "Share expired"))
+			return
+		}
+
+		if share.AllowedDomains != "" {
+			clientDomain := r.Header.Get("X-Panel-Domain")
+			if clientDomain == "" {
+				response.WriteJSON(w, response.Err(403, "Domain verification required"))
+				return
+			}
+			allowed := false
+			domains := strings.Split(share.AllowedDomains, ",")
+			for _, d := range domains {
+				if strings.TrimSpace(d) == clientDomain {
+					allowed = true
+					break
+				}
+			}
+			if !allowed {
+				response.WriteJSON(w, response.Err(403, "Domain not allowed"))
+				return
+			}
+		}
+
+		next(w, r)
+	}
+}
+
+func (h *Handler) federationConnect(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	token := extractBearerToken(r)
+	share, err := h.repo.GetPeerShareByToken(token)
+	if err != nil || share == nil {
+		response.WriteJSON(w, response.Err(401, "Unauthorized"))
+		return
+	}
+
+	var nodeName string
+	var serverIP string
+	var status int
+
+	err = h.repo.DB().QueryRow("SELECT name, server_ip, status FROM node WHERE id = ?", share.NodeID).Scan(&nodeName, &serverIP, &status)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, "Node not found"))
+		return
+	}
+
+	response.WriteJSON(w, response.OK(map[string]interface{}{
+		"shareId":        share.ID,
+		"shareName":      share.Name,
+		"nodeId":         share.NodeID,
+		"nodeName":       nodeName,
+		"serverIp":       serverIP,
+		"status":         status,
+		"maxBandwidth":   share.MaxBandwidth,
+		"expiryTime":     share.ExpiryTime,
+		"portRangeStart": share.PortRangeStart,
+		"portRangeEnd":   share.PortRangeEnd,
+	}))
+}
+
+func (h *Handler) federationTunnelCreate(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		response.WriteJSON(w, response.ErrDefault("Invalid method"))
+		return
+	}
+
+	token := extractBearerToken(r)
+	share, err := h.repo.GetPeerShareByToken(token)
+	if err != nil || share == nil {
+		response.WriteJSON(w, response.Err(401, "Unauthorized"))
+		return
+	}
+
+	var req federationTunnelRequest
+	if err := decodeJSON(r.Body, &req); err != nil {
+		response.WriteJSON(w, response.ErrDefault("Invalid JSON"))
+		return
+	}
+
+	if req.RemotePort < share.PortRangeStart || req.RemotePort > share.PortRangeEnd {
+		response.WriteJSON(w, response.Err(403, "Port out of range"))
+		return
+	}
+
+	tunnelType := 1
+	if strings.ToLower(req.Protocol) == "udp" {
+		tunnelType = 2
+	}
+
+	tx, err := h.repo.DB().Begin()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	defer tx.Rollback()
+
+	now := time.Now().UnixMilli()
+	res, err := tx.Exec(`INSERT INTO tunnel (name, type, protocol, flow, created_time, updated_time, status, in_ip) VALUES (?, ?, ?, 0, ?, ?, 1, ?)`,
+		fmt.Sprintf("Share-%d-Port-%d", share.ID, req.RemotePort),
+		tunnelType,
+		req.Protocol,
+		now,
+		now,
+		"",
+	)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	tunnelID, _ := res.LastInsertId()
+
+	_, err = tx.Exec(`INSERT INTO chain_tunnel (tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES (?, 1, ?, ?, 'fifo', 0, ?)`,
+		tunnelID,
+		share.NodeID,
+		req.RemotePort,
+		req.Protocol,
+	)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	if err := tx.Commit(); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	h.wsServer.SendCommand(share.NodeID, "reload", nil, time.Second*5)
+
+	response.WriteJSON(w, response.OK(map[string]interface{}{
+		"tunnelId": tunnelID,
+	}))
+}
+
+func extractBearerToken(r *http.Request) string {
+	authHeader := r.Header.Get("Authorization")
+	parts := strings.Split(authHeader, " ")
+	if len(parts) == 2 && parts[0] == "Bearer" {
+		return parts[1]
+	}
+	return ""
+}

go-backend/internal/http/handler/handler.go

@@ -143,6 +143,12 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/group/permission/assign", h.groupPermissionAssign)
 	mux.HandleFunc("/api/v1/group/permission/remove", h.groupPermissionRemove)
 	mux.HandleFunc("/api/v1/open_api/sub_store", h.openAPISubStore)
+	mux.HandleFunc("/api/v1/federation/share/list", h.federationShareList)
+	mux.HandleFunc("/api/v1/federation/share/create", h.federationShareCreate)
+	mux.HandleFunc("/api/v1/federation/share/delete", h.federationShareDelete)
+	mux.HandleFunc("/api/v1/federation/connect", h.authPeer(h.federationConnect))
+	mux.HandleFunc("/api/v1/federation/tunnel/create", h.authPeer(h.federationTunnelCreate))
+	mux.HandleFunc("/api/v1/federation/node/import", h.nodeImport)
 
 	mux.HandleFunc("/flow/test", h.flowTest)
 	mux.HandleFunc("/flow/config", h.flowConfig)

go-backend/internal/http/handler/mutations.go

@@ -15,6 +15,7 @@ import (
 	"strings"
 	"time"
 
+	"go-backend/internal/http/client"
 	"go-backend/internal/http/response"
 	"go-backend/internal/security"
 )
@@ -273,8 +274,8 @@ func (h *Handler) nodeCreate(w http.ResponseWriter, r *http.Request) {
 	now := time.Now().UnixMilli()
 	inx := nextIndex(db, "node")
 	_, err := db.Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 	`,
 		name,
 		randomToken(16),
@@ -293,6 +294,10 @@ func (h *Handler) nodeCreate(w http.ResponseWriter, r *http.Request) {
 		defaultString(asString(req["tcpListenAddr"]), "[::]"),
 		defaultString(asString(req["udpListenAddr"]), "[::]"),
 		inx,
+		asInt(req["isRemote"], 0),
+		nullableText(asString(req["remoteUrl"])),
+		nullableText(asString(req["remoteToken"])),
+		nullableText(asString(req["remoteConfig"])),
 	)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
@@ -509,6 +514,50 @@ func (h *Handler) tunnelCreate(w http.ResponseWriter, r *http.Request) {
 		inIP = buildTunnelInIP(runtimeState.InNodes, runtimeState.Nodes)
 	}
 
+	if len(runtimeState.InNodes) > 0 {
+		firstNodeID := runtimeState.InNodes[0].NodeID
+		var isRemote int
+		var rUrl, rToken sql.NullString
+		if err := h.repo.DB().QueryRow("SELECT is_remote, remote_url, remote_token FROM node WHERE id = ?", firstNodeID).Scan(&isRemote, &rUrl, &rToken); err == nil && isRemote == 1 {
+			fc := client.NewFederationClient()
+
+			targetProto := "tcp"
+			targetPort := 0
+			targetAddr := ""
+
+			if typeVal == 1 {
+				if len(runtimeState.OutNodes) > 0 {
+					outNode := runtimeState.OutNodes[0]
+					outNodeRec := runtimeState.Nodes[outNode.NodeID]
+					targetAddr = processServerAddress(outNodeRec.ServerIP)
+					if outNode.Port > 0 {
+						targetAddr = fmt.Sprintf("%s:%d", targetAddr, outNode.Port)
+					}
+				}
+				if len(runtimeState.InNodes) > 0 {
+					inNodesRaw := asMapSlice(req["inNodeId"])
+					if len(inNodesRaw) > 0 {
+						targetPort = asInt(inNodesRaw[0]["port"], 0)
+						targetProto = defaultString(asString(inNodesRaw[0]["protocol"]), "tcp")
+					}
+				}
+
+				if targetPort > 0 && targetAddr != "" {
+					domainCfg, _ := h.repo.GetConfigByName("panel_domain")
+					localDomain := ""
+					if domainCfg != nil {
+						localDomain = domainCfg.Value
+					}
+					_, err := fc.CreateTunnel(rUrl.String, rToken.String, localDomain, targetProto, targetPort, targetAddr)
+					if err != nil {
+						response.WriteJSON(w, response.ErrDefault("Remote tunnel creation failed: "+err.Error()))
+						return
+					}
+				}
+			}
+		}
+	}
+
 	res, err := tx.Exec(`INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		name, trafficRatio, typeVal, "tls", flow, now, now, status, nullableText(inIP), inx)
 	if err != nil {
@@ -731,6 +780,82 @@ func (h *Handler) tunnelBatchDelete(w http.ResponseWriter, r *http.Request) {
 	response.WriteJSON(w, response.OK(map[string]interface{}{"successCount": success, "failCount": fail}))
 }
 
+func (h *Handler) reconstructTunnelState(tunnelID int64) (*tunnelCreateState, error) {
+	tunnel, err := h.getTunnelRecord(tunnelID)
+	if err != nil {
+		return nil, err
+	}
+
+	chainRows, err := h.listChainNodesForTunnel(tunnelID)
+	if err != nil {
+		return nil, err
+	}
+
+	state := &tunnelCreateState{
+		TunnelID:   tunnelID,
+		Type:       tunnel.Type,
+		InNodes:    make([]tunnelRuntimeNode, 0),
+		ChainHops:  make([][]tunnelRuntimeNode, 0),
+		OutNodes:   make([]tunnelRuntimeNode, 0),
+		Nodes:      make(map[int64]*nodeRecord),
+		NodeIDList: make([]int64, 0),
+	}
+
+	inNodes, chainHops, outNodes := splitChainNodeGroups(chainRows)
+
+	for _, r := range inNodes {
+		state.InNodes = append(state.InNodes, tunnelRuntimeNode{
+			NodeID:    r.NodeID,
+			Protocol:  r.Protocol,
+			Strategy:  r.Strategy,
+			ChainType: 1,
+		})
+		state.NodeIDList = append(state.NodeIDList, r.NodeID)
+	}
+
+	for _, r := range outNodes {
+		state.OutNodes = append(state.OutNodes, tunnelRuntimeNode{
+			NodeID:    r.NodeID,
+			Protocol:  r.Protocol,
+			Strategy:  r.Strategy,
+			ChainType: 3,
+			Port:      r.Port,
+		})
+		state.NodeIDList = append(state.NodeIDList, r.NodeID)
+	}
+
+	for _, hop := range chainHops {
+		stateHop := make([]tunnelRuntimeNode, 0)
+		for _, r := range hop {
+			stateHop = append(stateHop, tunnelRuntimeNode{
+				NodeID:    r.NodeID,
+				Protocol:  r.Protocol,
+				Strategy:  r.Strategy,
+				ChainType: 2,
+				Inx:       int(r.Inx),
+				Port:      r.Port,
+			})
+			state.NodeIDList = append(state.NodeIDList, r.NodeID)
+		}
+		state.ChainHops = append(state.ChainHops, stateHop)
+	}
+
+	seen := make(map[int64]struct{})
+	for _, id := range state.NodeIDList {
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		node, err := h.getNodeRecord(id)
+		if err != nil {
+			return nil, err
+		}
+		state.Nodes[id] = node
+	}
+
+	return state, nil
+}
+
 func (h *Handler) tunnelBatchRedeploy(w http.ResponseWriter, r *http.Request) {
 	ids := idsFromBody(r, w)
 	if ids == nil {
@@ -739,6 +864,26 @@ func (h *Handler) tunnelBatchRedeploy(w http.ResponseWriter, r *http.Request) {
 	success := 0
 	fail := 0
 	for _, tunnelID := range ids {
+		tunnel, err := h.getTunnelRecord(tunnelID)
+		if err != nil {
+			fail++
+			continue
+		}
+
+		if tunnel.Type == 2 {
+			h.cleanupTunnelRuntime(tunnelID)
+			state, err := h.reconstructTunnelState(tunnelID)
+			if err != nil {
+				fail++
+				continue
+			}
+			_, _, applyErr := h.applyTunnelRuntime(state)
+			if applyErr != nil {
+				fail++
+				continue
+			}
+		}
+
 		forwards, err := h.listForwardsByTunnel(tunnelID)
 		if err != nil {
 			fail++
@@ -1373,12 +1518,15 @@ func (h *Handler) speedLimitCreate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	now := time.Now().UnixMilli()
-	_, err := h.repo.DB().Exec(`INSERT INTO speed_limit(name, speed, tunnel_id, tunnel_name, created_time, updated_time, status) VALUES(?, ?, ?, ?, ?, ?, ?)`,
-		name, asInt(req["speed"], 100), tunnelID, tunnelName, now, now, asInt(req["status"], 1))
+	speed := asInt(req["speed"], 100)
+	res, err := h.repo.DB().Exec(`INSERT INTO speed_limit(name, speed, tunnel_id, tunnel_name, created_time, updated_time, status) VALUES(?, ?, ?, ?, ?, ?, ?)`,
+		name, speed, tunnelID, tunnelName, now, now, asInt(req["status"], 1))
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
+	id, _ := res.LastInsertId()
+	_ = h.sendLimiterConfig(id, speed, tunnelID)
 	response.WriteJSON(w, response.OKEmpty())
 }
 
@@ -1400,12 +1548,14 @@ func (h *Handler) speedLimitUpdate(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("隧道不存在"))
 		return
 	}
+	speed := asInt(req["speed"], 100)
 	_, err := h.repo.DB().Exec(`UPDATE speed_limit SET name=?, speed=?, tunnel_id=?, tunnel_name=?, status=?, updated_time=? WHERE id=?`,
-		asString(req["name"]), asInt(req["speed"], 100), tunnelID, tunnelName, asInt(req["status"], 1), time.Now().UnixMilli(), id)
+		asString(req["name"]), speed, tunnelID, tunnelName, asInt(req["status"], 1), time.Now().UnixMilli(), id)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
+	_ = h.sendLimiterConfig(id, speed, tunnelID)
 	response.WriteJSON(w, response.OKEmpty())
 }
 
@@ -1414,11 +1564,17 @@ func (h *Handler) speedLimitDelete(w http.ResponseWriter, r *http.Request) {
 	if id <= 0 {
 		return
 	}
+	var tunnelID int64
+	_ = h.repo.DB().QueryRow(`SELECT tunnel_id FROM speed_limit WHERE id = ?`, id).Scan(&tunnelID)
+
 	_, err := h.repo.DB().Exec(`DELETE FROM speed_limit WHERE id = ?`, id)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
+	if tunnelID > 0 {
+		_ = h.sendDeleteLimiterConfig(id, tunnelID)
+	}
 	response.WriteJSON(w, response.OKEmpty())
 }
 

go-backend/internal/http/middleware/auth.go

@@ -81,6 +81,10 @@ func shouldSkip(path string) bool {
 		return true
 	case path == "/api/v1/user/login":
 		return true
+	case path == "/api/v1/federation/connect":
+		return true
+	case path == "/api/v1/federation/tunnel/create":
+		return true
 	default:
 		return false
 	}
@@ -91,6 +95,10 @@ func requiresAdmin(path string) bool {
 		return true
 	}
 
+	if strings.HasPrefix(path, "/api/v1/federation/share/") {
+		return true
+	}
+
 	if strings.HasPrefix(path, "/api/v1/node/") {
 		return true
 	}

go-backend/internal/store/sqlite/repository.go

@@ -95,13 +95,33 @@ type StatisticsFlow struct {
 }
 
 type Node struct {
-	ID      int64
-	Secret  string
-	Version sql.NullString
-	HTTP    int
-	TLS     int
-	Socks   int
-	Status  int
+	ID           int64
+	Secret       string
+	Version      sql.NullString
+	HTTP         int
+	TLS          int
+	Socks        int
+	Status       int
+	IsRemote     int
+	RemoteURL    sql.NullString
+	RemoteToken  sql.NullString
+	RemoteConfig sql.NullString
+}
+
+type PeerShare struct {
+	ID             int64  `json:"id"`
+	Name           string `json:"name"`
+	NodeID         int64  `json:"nodeId"`
+	Token          string `json:"token"`
+	MaxBandwidth   int64  `json:"maxBandwidth"`
+	ExpiryTime     int64  `json:"expiryTime"`
+	PortRangeStart int    `json:"portRangeStart"`
+	PortRangeEnd   int    `json:"portRangeEnd"`
+	CurrentFlow    int64  `json:"currentFlow"`
+	IsActive       int    `json:"isActive"`
+	CreatedTime    int64  `json:"createdTime"`
+	UpdatedTime    int64  `json:"updatedTime"`
+	AllowedDomains string `json:"allowedDomains"`
 }
 
 func Open(path string) (*Repository, error) {
@@ -124,6 +144,11 @@ func Open(path string) (*Repository, error) {
 		return nil, err
 	}
 
+	if err := ensurePeerSchema(db); err != nil {
+		_ = db.Close()
+		return nil, err
+	}
+
 	return &Repository{db: db}, nil
 }
 
@@ -389,9 +414,25 @@ func (r *Repository) GetNodeBySecret(secret string) (*Node, error) {
 		return nil, errors.New("repository not initialized")
 	}
 
-	row := r.db.QueryRow(`SELECT id, secret, version, http, tls, socks, status FROM node WHERE secret = ? LIMIT 1`, secret)
+	row := r.db.QueryRow(`SELECT id, secret, version, http, tls, socks, status, is_remote, remote_url, remote_token, remote_config FROM node WHERE secret = ? LIMIT 1`, secret)
 	var n Node
-	if err := row.Scan(&n.ID, &n.Secret, &n.Version, &n.HTTP, &n.TLS, &n.Socks, &n.Status); err != nil {
+	if err := row.Scan(&n.ID, &n.Secret, &n.Version, &n.HTTP, &n.TLS, &n.Socks, &n.Status, &n.IsRemote, &n.RemoteURL, &n.RemoteToken, &n.RemoteConfig); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &n, nil
+}
+
+func (r *Repository) GetNodeByID(id int64) (*Node, error) {
+	if r == nil || r.db == nil {
+		return nil, errors.New("repository not initialized")
+	}
+
+	row := r.db.QueryRow(`SELECT id, secret, version, http, tls, socks, status, is_remote, remote_url, remote_token, remote_config FROM node WHERE id = ? LIMIT 1`, id)
+	var n Node
+	if err := row.Scan(&n.ID, &n.Secret, &n.Version, &n.HTTP, &n.TLS, &n.Socks, &n.Status, &n.IsRemote, &n.RemoteURL, &n.RemoteToken, &n.RemoteConfig); err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			return nil, nil
 		}
@@ -454,7 +495,7 @@ func (r *Repository) ListNodes() ([]map[string]interface{}, error) {
 	}
 
 	rows, err := r.db.Query(`
-		SELECT id, inx, name, server_ip, server_ip_v4, server_ip_v6, port, tcp_listen_addr, udp_listen_addr, version, http, tls, socks, status
+		SELECT id, inx, name, server_ip, server_ip_v4, server_ip_v6, port, tcp_listen_addr, udp_listen_addr, version, http, tls, socks, status, is_remote, remote_url, remote_token, remote_config
 		FROM node
 		ORDER BY inx ASC, id ASC
 	`)
@@ -467,10 +508,10 @@ func (r *Repository) ListNodes() ([]map[string]interface{}, error) {
 	for rows.Next() {
 		var id, inx int64
 		var name, serverIP, port string
-		var serverIPV4, serverIPV6, tcpListen, udpListen, version sql.NullString
-		var httpVal, tlsVal, socksVal, status int
+		var serverIPV4, serverIPV6, tcpListen, udpListen, version, remoteURL, remoteToken, remoteConfig sql.NullString
+		var httpVal, tlsVal, socksVal, status, isRemote int
 
-		if err := rows.Scan(&id, &inx, &name, &serverIP, &serverIPV4, &serverIPV6, &port, &tcpListen, &udpListen, &version, &httpVal, &tlsVal, &socksVal, &status); err != nil {
+		if err := rows.Scan(&id, &inx, &name, &serverIP, &serverIPV4, &serverIPV6, &port, &tcpListen, &udpListen, &version, &httpVal, &tlsVal, &socksVal, &status, &isRemote, &remoteURL, &remoteToken, &remoteConfig); err != nil {
 			return nil, err
 		}
 
@@ -490,6 +531,10 @@ func (r *Repository) ListNodes() ([]map[string]interface{}, error) {
 			"tls":           tlsVal,
 			"socks":         socksVal,
 			"status":        status,
+			"isRemote":      isRemote,
+			"remoteUrl":     nullableString(remoteURL),
+			"remoteToken":   nullableString(remoteToken),
+			"remoteConfig":  nullableString(remoteConfig),
 		})
 	}
 
@@ -1167,25 +1212,155 @@ func bootstrapSchema(db *sql.DB) error {
 		return errors.New("nil db")
 	}
 
-	var exists int
-	err := db.QueryRow(`SELECT COUNT(1) FROM sqlite_master WHERE type='table' AND name='user'`).Scan(&exists)
-	if err != nil {
-		return fmt.Errorf("check schema: %w", err)
-	}
-	if exists > 0 {
-		return nil
-	}
-
-	log.Printf("sqlite schema not found, bootstrapping embedded schema")
 	if _, err := db.Exec(embeddedSchema); err != nil {
 		return fmt.Errorf("apply schema.sql: %w", err)
 	}
+
 	if _, err := db.Exec(embeddedSeedData); err != nil {
 		return fmt.Errorf("apply data.sql: %w", err)
 	}
 	return nil
 }
 
+func ensurePeerSchema(db *sql.DB) error {
+	if db == nil {
+		return errors.New("nil db")
+	}
+
+	_, err := db.Exec(`CREATE TABLE IF NOT EXISTS peer_share (
+		id INTEGER PRIMARY KEY AUTOINCREMENT,
+		name TEXT NOT NULL,
+		node_id INTEGER NOT NULL,
+		token TEXT NOT NULL UNIQUE,
+		max_bandwidth INTEGER DEFAULT 0,
+		expiry_time INTEGER DEFAULT 0,
+		port_range_start INTEGER DEFAULT 0,
+		port_range_end INTEGER DEFAULT 0,
+		current_flow INTEGER DEFAULT 0,
+		is_active INTEGER DEFAULT 1,
+		created_time INTEGER NOT NULL,
+		updated_time INTEGER NOT NULL,
+		allowed_domains TEXT DEFAULT ''
+	)`)
+	if err != nil {
+		return fmt.Errorf("create peer_share: %w", err)
+	}
+
+	// Add allowed_domains column if it doesn't exist (for existing tables)
+	var dummy interface{}
+	err = db.QueryRow("SELECT allowed_domains FROM peer_share LIMIT 1").Scan(&dummy)
+	if err != nil {
+		if strings.Contains(err.Error(), "no such column") {
+			_, err = db.Exec("ALTER TABLE peer_share ADD COLUMN allowed_domains TEXT DEFAULT ''")
+			if err != nil {
+				log.Printf("failed to add column allowed_domains to peer_share: %v", err)
+			}
+		}
+	}
+
+	columns := map[string]string{
+		"is_remote":     "INTEGER DEFAULT 0",
+		"remote_url":    "TEXT",
+		"remote_token":  "TEXT",
+		"remote_config": "TEXT",
+	}
+
+	for col, typ := range columns {
+		var dummy interface{}
+		err := db.QueryRow(fmt.Sprintf("SELECT %s FROM node LIMIT 1", col)).Scan(&dummy)
+		if err != nil {
+			if strings.Contains(err.Error(), "no such column") {
+				_, err = db.Exec(fmt.Sprintf("ALTER TABLE node ADD COLUMN %s %s", col, typ))
+				if err != nil {
+					log.Printf("failed to add column %s: %v", col, err)
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func (r *Repository) CreatePeerShare(share *PeerShare) error {
+	if r == nil || r.db == nil {
+		return errors.New("repository not initialized")
+	}
+	_, err := r.db.Exec(`
+		INSERT INTO peer_share(name, node_id, token, max_bandwidth, expiry_time, port_range_start, port_range_end, current_flow, is_active, created_time, updated_time, allowed_domains)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, share.Name, share.NodeID, share.Token, share.MaxBandwidth, share.ExpiryTime, share.PortRangeStart, share.PortRangeEnd, share.CurrentFlow, share.IsActive, share.CreatedTime, share.UpdatedTime, share.AllowedDomains)
+	return err
+}
+
+func (r *Repository) UpdatePeerShare(share *PeerShare) error {
+	if r == nil || r.db == nil {
+		return errors.New("repository not initialized")
+	}
+	_, err := r.db.Exec(`
+		UPDATE peer_share SET name=?, max_bandwidth=?, expiry_time=?, port_range_start=?, port_range_end=?, is_active=?, updated_time=?, allowed_domains=?
+		WHERE id=?
+	`, share.Name, share.MaxBandwidth, share.ExpiryTime, share.PortRangeStart, share.PortRangeEnd, share.IsActive, share.UpdatedTime, share.AllowedDomains, share.ID)
+	return err
+}
+
+func (r *Repository) DeletePeerShare(id int64) error {
+	if r == nil || r.db == nil {
+		return errors.New("repository not initialized")
+	}
+	_, err := r.db.Exec(`DELETE FROM peer_share WHERE id=?`, id)
+	return err
+}
+
+func (r *Repository) GetPeerShare(id int64) (*PeerShare, error) {
+	if r == nil || r.db == nil {
+		return nil, errors.New("repository not initialized")
+	}
+	row := r.db.QueryRow(`SELECT id, name, node_id, token, max_bandwidth, expiry_time, port_range_start, port_range_end, current_flow, is_active, created_time, updated_time, allowed_domains FROM peer_share WHERE id = ?`, id)
+	var s PeerShare
+	if err := row.Scan(&s.ID, &s.Name, &s.NodeID, &s.Token, &s.MaxBandwidth, &s.ExpiryTime, &s.PortRangeStart, &s.PortRangeEnd, &s.CurrentFlow, &s.IsActive, &s.CreatedTime, &s.UpdatedTime, &s.AllowedDomains); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &s, nil
+}
+
+func (r *Repository) GetPeerShareByToken(token string) (*PeerShare, error) {
+	if r == nil || r.db == nil {
+		return nil, errors.New("repository not initialized")
+	}
+	row := r.db.QueryRow(`SELECT id, name, node_id, token, max_bandwidth, expiry_time, port_range_start, port_range_end, current_flow, is_active, created_time, updated_time, allowed_domains FROM peer_share WHERE token = ?`, token)
+	var s PeerShare
+	if err := row.Scan(&s.ID, &s.Name, &s.NodeID, &s.Token, &s.MaxBandwidth, &s.ExpiryTime, &s.PortRangeStart, &s.PortRangeEnd, &s.CurrentFlow, &s.IsActive, &s.CreatedTime, &s.UpdatedTime, &s.AllowedDomains); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &s, nil
+}
+
+func (r *Repository) ListPeerShares() ([]PeerShare, error) {
+	if r == nil || r.db == nil {
+		return nil, errors.New("repository not initialized")
+	}
+	rows, err := r.db.Query(`SELECT id, name, node_id, token, max_bandwidth, expiry_time, port_range_start, port_range_end, current_flow, is_active, created_time, updated_time, allowed_domains FROM peer_share ORDER BY id DESC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var shares []PeerShare
+	for rows.Next() {
+		var s PeerShare
+		if err := rows.Scan(&s.ID, &s.Name, &s.NodeID, &s.Token, &s.MaxBandwidth, &s.ExpiryTime, &s.PortRangeStart, &s.PortRangeEnd, &s.CurrentFlow, &s.IsActive, &s.CreatedTime, &s.UpdatedTime, &s.AllowedDomains); err != nil {
+			return nil, err
+		}
+		shares = append(shares, s)
+	}
+	return shares, nil
+}
+
 var osMkdirAll = func(path string) error {
 	return os.MkdirAll(path, 0o755)
 }

go-gost/x/config/parsing/service/parse.go

@@ -3,6 +3,7 @@ package service
 import (
 	"fmt"
 	"runtime"
+	"strconv"
 	"strings"
 	"time"
 
@@ -30,6 +31,7 @@ import (
 	logger_parser "github.com/go-gost/x/config/parsing/logger"
 	selector_parser "github.com/go-gost/x/config/parsing/selector"
 	tls_util "github.com/go-gost/x/internal/util/tls"
+	xtraffic "github.com/go-gost/x/limiter/traffic"
 	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
 	"github.com/go-gost/x/metadata"
 	mdutil "github.com/go-gost/x/metadata/util"
@@ -181,6 +183,32 @@ func ParseService(cfg *config.ServiceConfig) (service.Service, error) {
 		)
 	}
 
+	var trafficLimiter listener.Option
+	if cfg.Limiter != "" {
+		lim := registry.TrafficLimiterRegistry().Get(cfg.Limiter)
+		if lim == nil {
+			// Try to parse as simple number (bandwidth in bytes/sec)
+			if val, err := strconv.Atoi(cfg.Limiter); err == nil && val > 0 {
+				lim = xtraffic.NewTrafficLimiter(
+					xtraffic.LimitsOption(fmt.Sprintf("%s %dB %dB", xtraffic.ServiceLimitKey, val, val)),
+				)
+			}
+			if lim == nil {
+				lim = xtraffic.NewTrafficLimiter(
+					xtraffic.LimitsOption(fmt.Sprintf("%s %s %s", xtraffic.ServiceLimitKey, cfg.Limiter, cfg.Limiter)),
+				)
+			}
+		}
+		trafficLimiter = listener.TrafficLimiterOption(
+			cache_limiter.NewCachedTrafficLimiter(
+				lim,
+				cache_limiter.RefreshIntervalOption(limiterRefreshInterval),
+				cache_limiter.CleanupIntervalOption(limiterCleanupInterval),
+				cache_limiter.ScopeOption(limiterScope),
+			),
+		)
+	}
+
 	listenOpts := []listener.Option{
 		listener.AddrOption(cfg.Addr),
 		listener.RouterOption(xchain.NewRouter(routerOpts...)),
@@ -188,14 +216,6 @@ func ParseService(cfg *config.ServiceConfig) (service.Service, error) {
 		listener.AuthOption(auth_parser.Info(cfg.Listener.Auth)),
 		listener.TLSConfigOption(tlsConfig),
 		listener.AdmissionOption(xadmission.AdmissionGroup(admissions...)),
-		listener.TrafficLimiterOption(
-			cache_limiter.NewCachedTrafficLimiter(
-				registry.TrafficLimiterRegistry().Get(cfg.Limiter),
-				cache_limiter.RefreshIntervalOption(limiterRefreshInterval),
-				cache_limiter.CleanupIntervalOption(limiterCleanupInterval),
-				cache_limiter.ScopeOption(limiterScope),
-			),
-		),
 		listener.ConnLimiterOption(registry.ConnLimiterRegistry().Get(cfg.CLimiter)),
 		listener.ServiceOption(cfg.Name),
 		listener.ProxyProtocolOption(ppv),
@@ -203,6 +223,9 @@ func ParseService(cfg *config.ServiceConfig) (service.Service, error) {
 		listener.NetnsOption(netnsIn),
 		listener.LoggerOption(listenerLogger),
 	}
+	if trafficLimiter != nil {
+		listenOpts = append(listenOpts, trafficLimiter)
+	}
 
 	if netnsIn != "" {
 		runtime.LockOSThread()

go-gost/x/go.mod

@@ -4,9 +4,7 @@ go 1.22.0
 
 toolchain go1.23.4
 
-require (
-	github.com/shirou/gopsutil/v3 v3.24.5
-)
+require github.com/shirou/gopsutil/v3 v3.24.5
 
 require (
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137
@@ -76,6 +74,7 @@ require (
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.20.0 // indirect
@@ -91,6 +90,7 @@ require (
 	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
 	github.com/klauspost/reedsolomon v1.11.8 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
@@ -103,6 +103,7 @@ require (
 	github.com/pion/udp/v2 v2.0.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/prometheus/client_model v0.6.0 // indirect
 	github.com/prometheus/common v0.48.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
@@ -110,6 +111,7 @@ require (
 	github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3 // indirect
 	github.com/sagikazarmark/locafero v0.4.0 // indirect
 	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+	github.com/shoenig/go-m1cpu v0.1.6 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/afero v1.11.0 // indirect
 	github.com/spf13/cast v1.6.0 // indirect
@@ -118,8 +120,11 @@ require (
 	github.com/templexxx/cpu v0.1.0 // indirect
 	github.com/templexxx/xorsimd v0.4.2 // indirect
 	github.com/tjfoc/gmsm v1.4.1 // indirect
+	github.com/tklauser/go-sysconf v0.3.12 // indirect
+	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
+	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.uber.org/mock v0.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/arch v0.8.0 // indirect

go-gost/x/go.sum

@@ -65,6 +65,8 @@ github.com/go-gost/tls-dissector v0.1.1 h1:2zUOTPzCQAUQ54Rpy0UEi3JPMQSYsIFSeFeKr
 github.com/go-gost/tls-dissector v0.1.1/go.mod h1:/9QfdewqmHdaE362Hv5nDaSWLx3pCmtD870d6GaquXs=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
+github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
@@ -102,6 +104,7 @@ github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5a
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -133,6 +136,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -175,6 +180,8 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE=
 github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -204,7 +211,12 @@ github.com/shadowsocks/go-shadowsocks2 v0.1.5 h1:PDSQv9y2S85Fl7VBeOMF9StzeXZyK1H
 github.com/shadowsocks/go-shadowsocks2 v0.1.5/go.mod h1:AGGpIoek4HRno4xzyFiAtLHkOpcoznZEkAccaI/rplM=
 github.com/shadowsocks/shadowsocks-go v0.0.0-20200409064450-3e585ff90601 h1:XU9hik0exChEmY92ALW4l9WnDodxLVS9yOSNh2SizaQ=
 github.com/shadowsocks/shadowsocks-go v0.0.0-20200409064450-3e585ff90601/go.mod h1:mttDPaeLm87u74HMrP+n2tugXvIKWcwff/cqSX0lehY=
+github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
 github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
+github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
+github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
+github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
+github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
@@ -244,6 +256,10 @@ github.com/templexxx/xorsimd v0.4.2 h1:ocZZ+Nvu65LGHmCLZ7OoCtg8Fx8jnHKK37SjvngUo
 github.com/templexxx/xorsimd v0.4.2/go.mod h1:HgwaPoDREdi6OnULpSfxhzaiiSUY4Fi3JPn1wpt28NI=
 github.com/tjfoc/gmsm v1.4.1 h1:aMe1GlZb+0bLjn+cKTPEvvn9oUEBlJitaZiiBwsbgho=
 github.com/tjfoc/gmsm v1.4.1/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE=
+github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
+github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
+github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
+github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
@@ -266,6 +282,8 @@ github.com/xtaci/tcpraw v1.2.25/go.mod h1:dKyZ2V75s0cZ7cbgJYdxPvms7af0joIeOyx1Gg
 github.com/yl2chen/cidranger v1.0.2 h1:lbOWZVCG1tCRX4u24kuM1Tb4nHqWkDxwLdoS+SevawU=
 github.com/yl2chen/cidranger v1.0.2/go.mod h1:9U1yz7WPYDwf0vpNWFaeRh0bjwz5RVgRy/9UEQfHl0g=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
+github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zalando/go-keyring v0.2.4 h1:wi2xxTqdiwMKbM6TWwi+uJCG/Tum2UV0jqaQhCa9/68=
 github.com/zalando/go-keyring v0.2.4/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
 go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
@@ -321,15 +339,19 @@ golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=

go-gost/x/limiter/traffic/traffic.go

@@ -136,6 +136,9 @@ func (l *trafficLimiter) In(ctx context.Context, key string, opts ...limiter.Opt
 		return nil
 
 	case limiter.ScopeClient:
+		if lim, ok := l.inLimits.Get(key); ok && lim != nil {
+			return lim.(traffic.Limiter)
+		}
 		return nil
 
 	case limiter.ScopeConn:
@@ -215,6 +218,9 @@ func (l *trafficLimiter) Out(ctx context.Context, key string, opts ...limiter.Op
 		return nil
 
 	case limiter.ScopeClient:
+		if lim, ok := l.outLimits.Get(key); ok && lim != nil {
+			return lim.(traffic.Limiter)
+		}
 		return nil
 
 	case limiter.ScopeConn:

go-gost/x/socket/config.go

@@ -10,7 +10,7 @@ import (
 // configMutex 保护配置文件的并发写入
 var configMutex sync.Mutex
 
-func saveConfig() {
+func saveConfig() error {
 	configMutex.Lock()
 	defer configMutex.Unlock()
 
@@ -18,14 +18,13 @@ func saveConfig() {
 
 	f, err := os.Create(file)
 	if err != nil {
-		return
+		return err
 	}
 	defer f.Close()
 
 	if err := config.Global().Write(f, "json"); err != nil {
-
-		return
+		return err
 	}
 
-	return
+	return nil
 }

go-gost/x/socket/websocket_reporter.go

@@ -586,7 +586,16 @@ func (w *WebSocketReporter) routeCommand(cmd CommandMessage) {
 
 	// 只有状态变更命令才保存配置
 	if needSaveConfig {
-		saveConfig()
+		if saveErr := saveConfig(); saveErr != nil {
+			fmt.Printf("❌ 保存配置失败: %v\n", saveErr)
+			if err == nil {
+				err = fmt.Errorf("保存配置失败: %v", saveErr)
+			} else {
+				err = fmt.Errorf("%v; 保存配置失败: %v", err, saveErr)
+			}
+		} else {
+			fmt.Println("✅ 配置已保存到 gost.json")
+		}
 	}
 
 	// 发送响应

install.sh

@@ -28,7 +28,7 @@ COUNTRY=$(curl -s https://ipinfo.io/country)
 maybe_proxy_url() {
   local url="$1"
   if [ "$COUNTRY" = "CN" ]; then
-    echo "https://ghfast.top/${url}"
+    echo "https://gcode.hostcentral.cc/${url}"
   else
     echo "$url"
   fi

mkdocs.yml

@@ -0,0 +1,40 @@
+site_name: FLVX 文档
+site_url: https://sagit-chu.github.io/flux-panel/
+site_description: FLVX官方文档
+site_author: Sagit-chu
+
+theme:
+  name: material
+  language: zh
+  palette:
+    - scheme: default
+      primary: indigo
+      accent: indigo
+    - scheme: slate
+      primary: indigo
+      accent: indigo
+      toggle:
+        icon: material/brightness-4
+        name: Switch to dark mode
+  features:
+    - navigation.tabs
+    - navigation.sections
+    - navigation.top
+    - search.suggest
+    - search.highlight
+    - content.code.copy
+
+docs_dir: doc
+
+nav:
+  - 首页: index.md
+  - 安装部署: install.md
+  - 使用指南: usage.md
+  - 常见问题: faq.md
+
+markdown_extensions:
+  - admonition
+  - pymdownx.details
+  - pymdownx.superfences
+  - pymdownx.tabbed:
+      alternate_style: true

panel_install.sh

@@ -15,7 +15,7 @@ COUNTRY=$(curl -s https://ipinfo.io/country)
 maybe_proxy_url() {
   local url="$1"
   if [ "$COUNTRY" = "CN" ]; then
-    echo "https://ghfast.top/${url}"
+    echo "https://gcode.hostcentral.cc/${url}"
   else
     echo "$url"
   fi

vite-frontend/AGENTS.md

@@ -3,7 +3,7 @@
 **Generated:** Mon Feb 02 2026
 
 ## OVERVIEW
-Web management console for Flux Panel.
+Web management console for FLVX (formerly Flux Panel).
 **Stack:** React 18, Vite 5, TypeScript, TailwindCSS 4, HeroUI.
 
 ## STRUCTURE

vite-frontend/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     
-    <title>flux-panel</title>
+    <title>FLVX</title>
     <script>
       // 防止暗黑模式闪烁：在页面加载前立即应用系统主题
       (function() {
@@ -137,13 +137,13 @@
         }
       }
     </style>
-    <meta key="title" content="flux-panel" property="og:title" />
+    <meta key="title" content="FLVX" property="og:title" />
     <meta
-      content="flux-panel"
+      content="FLVX"
       property="og:description"
     />
     <meta
-      content="flux-panel"
+      content="FLVX"
       name="description"
     />
     <meta

vite-frontend/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "flux-panel",
+  "name": "flvx",
   "private": true,
   "version": "0.0.0",
   "type": "module",
@@ -39,8 +39,10 @@
     "@heroui/switch": "^2.2.21",
     "@heroui/system": "2.4.19",
     "@heroui/table": "^2.2.24",
+    "@heroui/tabs": "^2.2.27",
     "@heroui/theme": "2.4.19",
     "@heroui/use-theme": "2.1.10",
+    "@marsidev/react-turnstile": "^1.1.0",
     "@nextui-org/system": "^2.4.6",
     "@react-aria/visually-hidden": "3.8.25",
     "@react-types/shared": "3.30.0",
@@ -56,7 +58,6 @@
     "react-hot-toast": "^2.5.2",
     "react-is": "^19.2.4",
     "react-router-dom": "6.30.3",
-    "@marsidev/react-turnstile": "^1.1.0",
     "recharts": "^3.1.1",
     "sonner": "^2.0.6",
     "tailwind-variants": "1.0.0",

vite-frontend/src/App.tsx

@@ -12,6 +12,7 @@ import GroupPage from "@/pages/group";
 import ProfilePage from "@/pages/profile";
 import LimitPage from "@/pages/limit";
 import ConfigPage from "@/pages/config";
+import PanelSharingPage from "@/pages/panel-sharing";
 import { SettingsPage } from "@/pages/settings";
 import AdminLayout from "@/layouts/admin";
 import H5Layout from "@/layouts/h5";
@@ -235,12 +236,20 @@ function App() {
       />
       <Route
         element={
-          <ProtectedRoute useSimpleLayout={true}>
+          <ProtectedRoute>
             <ConfigPage />
           </ProtectedRoute>
         }
         path="/config"
       />
+      <Route
+        element={
+          <ProtectedRoute>
+            <PanelSharingPage />
+          </ProtectedRoute>
+        }
+        path="/panel-sharing"
+      />
       <Route element={<SettingsPage />} path="/settings" />
     </Routes>
   );

vite-frontend/src/api/index.ts

@@ -187,3 +187,21 @@ export const assignGroupPermission = (data: {
 }) => Network.post("/group/permission/assign", data);
 export const removeGroupPermission = (id: number) =>
   Network.post("/group/permission/remove", { id });
+
+// 面板共享 (Federation) 接口
+export const getPeerShareList = () => Network.post("/federation/share/list");
+export const createPeerShare = (data: {
+  name: string;
+  nodeId: number;
+  maxBandwidth?: number;
+  expiryTime?: number;
+  portRangeStart?: number;
+  portRangeEnd?: number;
+  allowedDomains?: string;
+}) => Network.post("/federation/share/create", data);
+export const deletePeerShare = (id: number) =>
+  Network.post("/federation/share/delete", { id });
+export const importRemoteNode = (data: {
+  remoteUrl: string;
+  token: string;
+}) => Network.post("/federation/node/import", data);

vite-frontend/src/config/site.ts

@@ -12,7 +12,7 @@ const GITHUB_REPO =
 const getInitialConfig = () => {
   if (typeof window === "undefined") {
     return {
-      name: "flux",
+      name: "FLVX",
       version: VERSION,
       app_version: APP_VERSION,
       github_repo: GITHUB_REPO,
@@ -31,7 +31,7 @@ const getInitialConfig = () => {
   }
 
   return {
-    name: "flux",
+    name: "FLVX",
     version: VERSION,
     app_version: APP_VERSION,
   };

vite-frontend/src/layouts/admin.tsx

@@ -144,6 +144,16 @@ export default function AdminLayout({
       ),
       adminOnly: true,
     },
+    {
+      path: "/panel-sharing",
+      label: "共享",
+      icon: (
+        <svg className="w-5 h-5" fill="currentColor" viewBox="0 0 20 20">
+          <path d="M15 8a3 3 0 10-2.977-2.63l-4.94 2.47a3 3 0 100 4.319l4.94 2.47a3 3 0 10.895-1.789l-4.94-2.47a3.027 3.027 0 000-.74l4.94-2.47C13.456 7.68 14.19 8 15 8z" />
+        </svg>
+      ),
+      adminOnly: true,
+    },
     {
       path: "/config",
       label: "设置",
@@ -375,7 +385,7 @@ export default function AdminLayout({
                 rel="noopener noreferrer"
                 target="_blank"
               >
-                flux-panel
+                FLVX
               </a>
             </p>
           </div>

vite-frontend/src/pages/config.tsx

@@ -56,6 +56,13 @@ const CONFIG_ITEMS: ConfigItem[] = [
       "格式“ip:port”,用于对接节点时使用,ip是你安装面板服务器的公网ip,端口是安装脚本内输入的后端端口。不要套CDN,不支持https,通讯数据有加密",
     type: "input",
   },
+  {
+    key: "panel_domain",
+    label: "面板域名",
+    placeholder: "请输入面板域名",
+    description: "当前面板的域名，用于与其他面板进行联邦共享时验证身份",
+    type: "input",
+  },
   {
     key: "app_name",
     label: "应用名称",
@@ -99,6 +106,7 @@ const getInitialConfigs = (): Record<string, string> => {
     "cloudflare_site_key",
     "cloudflare_secret_key",
     "ip",
+    "panel_domain",
   ];
   const initialConfigs: Record<string, string> = {};
 

vite-frontend/src/pages/index.tsx

@@ -229,7 +229,7 @@ export default function IndexPage() {
               rel="noopener noreferrer"
               target="_blank"
             >
-              flux-panel
+              FLVX
             </a>
           </p>
           <p className="text-xs text-gray-400 dark:text-gray-500 mt-1">

vite-frontend/src/pages/node.tsx

@@ -62,7 +62,9 @@ interface Node {
   http?: number; // 0 关 1 开
   tls?: number; // 0 关 1 开
   socks?: number; // 0 关 1 开
-  status: number; // 1: 在线, 0: 离线
+  status: number;
+  isRemote?: number;
+  remoteUrl?: string;
   connectionStatus: "online" | "offline";
   systemInfo?: {
     cpuUsage: number;
@@ -1133,6 +1135,16 @@ export default function NodePage() {
                             </h3>
                           </div>
                           <div className="flex items-center gap-1.5 ml-2">
+                            {node.isRemote === 1 && (
+                              <Chip
+                                className="text-xs"
+                                color="secondary"
+                                size="sm"
+                                variant="flat"
+                              >
+                                远程
+                              </Chip>
+                            )}
                             <div
                               className="cursor-grab active:cursor-grabbing p-2 text-default-400 hover:text-default-600 transition-colors touch-manipulation opacity-100 sm:opacity-0 sm:group-hover:opacity-100"
                               {...listeners}
@@ -1341,6 +1353,7 @@ export default function NodePage() {
                             <Button
                               className="flex-1 min-h-8"
                               color="success"
+                              isDisabled={node.isRemote === 1}
                               isLoading={node.copyLoading}
                               size="sm"
                               variant="flat"
@@ -1351,6 +1364,7 @@ export default function NodePage() {
                             <Button
                               className="flex-1 min-h-8"
                               color="primary"
+                              isDisabled={node.isRemote === 1}
                               size="sm"
                               variant="flat"
                               onPress={() => handleEdit(node)}

vite-frontend/src/pages/panel-sharing.tsx

@@ -0,0 +1,324 @@
+import { useState, useEffect } from "react";
+import { Button } from "@heroui/button";
+import { Card, CardBody, CardHeader } from "@heroui/card";
+import { Tabs, Tab } from "@heroui/tabs";
+import { Input } from "@heroui/input";
+import {
+  Modal,
+  ModalContent,
+  ModalHeader,
+  ModalBody,
+  ModalFooter,
+} from "@heroui/modal";
+import { Select, SelectItem } from "@heroui/select";
+import { toast } from "react-hot-toast";
+import {
+  getNodeList,
+  createPeerShare,
+  getPeerShareList,
+  deletePeerShare,
+  importRemoteNode,
+} from "@/api";
+
+interface Node {
+  id: number;
+  name: string;
+}
+
+interface PeerShare {
+  id: number;
+  name: string;
+  token: string;
+  maxBandwidth: number;
+  expiryTime: number;
+  portRangeStart: number;
+  portRangeEnd: number;
+  isActive: number;
+  allowedDomains?: string;
+}
+
+export default function PanelSharingPage() {
+  const [selectedTab, setSelectedTab] = useState("my-shares");
+  const [shares, setShares] = useState<PeerShare[]>([]);
+  const [nodes, setNodes] = useState<Node[]>([]);
+  const [loading, setLoading] = useState(false);
+
+  // Modals
+  const [createShareOpen, setCreateShareOpen] = useState(false);
+  const [importNodeOpen, setImportNodeOpen] = useState(false);
+
+  // Forms
+  const [shareForm, setShareForm] = useState({
+    name: "",
+    nodeId: "",
+    maxBandwidth: 0,
+    expiryDays: 30,
+    portRangeStart: 10000,
+    portRangeEnd: 20000,
+    allowedDomains: "",
+  });
+
+  const [importForm, setImportForm] = useState({
+    remoteUrl: "",
+    token: "",
+  });
+
+  useEffect(() => {
+    if (selectedTab === "my-shares") {
+      loadShares();
+      loadNodes();
+    }
+  }, [selectedTab]);
+
+  const loadShares = async () => {
+    setLoading(true);
+    try {
+      const res = await getPeerShareList();
+      if (res.code === 0) {
+        setShares(res.data || []);
+      } else {
+        toast.error(res.msg || "加载分享列表失败");
+      }
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const loadNodes = async () => {
+    try {
+      const res = await getNodeList();
+      if (res.code === 0) {
+        setNodes(res.data || []);
+      }
+    } catch {
+      // ignore
+    }
+  };
+
+  const handleCreateShare = async () => {
+    if (!shareForm.name || !shareForm.nodeId) {
+      toast.error("请填写必要信息");
+      return;
+    }
+    try {
+      const expiryTime =
+        Date.now() + shareForm.expiryDays * 24 * 60 * 60 * 1000;
+      const res = await createPeerShare({
+        name: shareForm.name,
+        nodeId: parseInt(shareForm.nodeId),
+        maxBandwidth: shareForm.maxBandwidth * 1024 * 1024 * 1024,
+        expiryTime: shareForm.expiryDays === 0 ? 0 : expiryTime,
+        portRangeStart: shareForm.portRangeStart,
+        portRangeEnd: shareForm.portRangeEnd,
+        allowedDomains: shareForm.allowedDomains,
+      });
+      if (res.code === 0) {
+        toast.success("创建成功");
+        setCreateShareOpen(false);
+        loadShares();
+      } else {
+        toast.error(res.msg || "创建失败");
+      }
+    } catch {
+      toast.error("网络错误");
+    }
+  };
+
+  const handleDeleteShare = async (id: number) => {
+    try {
+      const res = await deletePeerShare(id);
+      if (res.code === 0) {
+        toast.success("删除成功");
+        loadShares();
+      } else {
+        toast.error(res.msg || "删除失败");
+      }
+    } catch {
+      toast.error("网络错误");
+    }
+  };
+
+  const handleImportNode = async () => {
+    if (!importForm.remoteUrl || !importForm.token) {
+      toast.error("请填写完整信息");
+      return;
+    }
+    try {
+      // Automatically add http/https if missing
+      let url = importForm.remoteUrl.trim();
+      if (!url.startsWith("http")) {
+        url = "http://" + url;
+      }
+      
+      const res = await importRemoteNode({
+        remoteUrl: url,
+        token: importForm.token.trim(),
+      });
+      if (res.code === 0) {
+        toast.success("导入成功，请前往节点列表查看");
+        setImportNodeOpen(false);
+        setImportForm({ remoteUrl: "", token: "" });
+      } else {
+        toast.error(res.msg || "导入失败");
+      }
+    } catch {
+      toast.error("网络错误");
+    }
+  };
+
+  const copyToken = (token: string) => {
+    navigator.clipboard.writeText(token);
+    toast.success("Token已复制");
+  };
+
+  return (
+    <div className="p-4 md:p-6 space-y-6">
+      <div className="flex justify-between items-center">
+        <h1 className="text-2xl font-bold">面板共享 (Panel Peering)</h1>
+      </div>
+
+      <Tabs
+        aria-label="Options"
+        selectedKey={selectedTab}
+        onSelectionChange={(k) => setSelectedTab(k as string)}
+      >
+        <Tab key="my-shares" title="我分享的 (Provider)">
+          <Card>
+            <CardBody>
+              <div className="mb-4">
+                <Button color="primary" onPress={() => setCreateShareOpen(true)}>
+                  创建分享
+                </Button>
+              </div>
+              
+              {loading ? (
+                <div className="text-center py-10 text-gray-500">加载中...</div>
+              ) : shares.length === 0 ? (
+                <div className="text-center py-10 text-gray-500">暂无分享</div>
+              ) : (
+                <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
+                  {shares.map((share) => (
+                    <Card key={share.id} className="border border-divider shadow-sm">
+                      <CardHeader className="flex justify-between">
+                        <h3 className="font-bold">{share.name}</h3>
+                        <Button size="sm" color="danger" variant="flat" onPress={() => handleDeleteShare(share.id)}>删除</Button>
+                      </CardHeader>
+                      <CardBody className="text-sm space-y-2">
+                        <p>端口范围: {share.portRangeStart} - {share.portRangeEnd}</p>
+                        {share.allowedDomains && <p>允许域名: {share.allowedDomains}</p>}
+                        <p>过期时间: {share.expiryTime === 0 ? "永久" : new Date(share.expiryTime).toLocaleDateString()}</p>
+                        <div className="flex gap-2">
+                          <Input readOnly size="sm" value={share.token} />
+                          <Button size="sm" onPress={() => copyToken(share.token)}>复制</Button>
+                        </div>
+                      </CardBody>
+                    </Card>
+                  ))}
+                </div>
+              )}
+            </CardBody>
+          </Card>
+        </Tab>
+        <Tab key="remote-nodes" title="远程节点 (Consumer)">
+          <Card>
+            <CardBody>
+              <div className="mb-4">
+                <Button color="secondary" onPress={() => setImportNodeOpen(true)}>
+                  导入远程节点
+                </Button>
+              </div>
+              <div className="text-center py-10 text-gray-500">
+                <p>已导入的节点将显示在“节点管理”页面，带有“远程”标记。</p>
+                <p className="mt-2">请使用其创建隧道。</p>
+              </div>
+            </CardBody>
+          </Card>
+        </Tab>
+      </Tabs>
+
+      {/* Create Share Modal */}
+      <Modal isOpen={createShareOpen} onClose={() => setCreateShareOpen(false)}>
+        <ModalContent>
+          <ModalHeader>创建分享</ModalHeader>
+          <ModalBody>
+            <Input
+              label="名称"
+              placeholder="备注名称"
+              value={shareForm.name}
+              onChange={(e) => setShareForm({ ...shareForm, name: e.target.value })}
+            />
+            <Select
+              label="选择节点"
+              placeholder="选择要分享的节点"
+              selectedKeys={shareForm.nodeId ? [shareForm.nodeId] : []}
+              onChange={(e) => setShareForm({ ...shareForm, nodeId: e.target.value })}
+            >
+              {nodes.map((node) => (
+                <SelectItem key={node.id} textValue={node.name}>
+                  {node.name}
+                </SelectItem>
+              ))}
+            </Select>
+            <div className="flex gap-4">
+              <Input
+                label="起始端口"
+                type="number"
+                value={shareForm.portRangeStart.toString()}
+                onChange={(e) => setShareForm({ ...shareForm, portRangeStart: parseInt(e.target.value) })}
+              />
+              <Input
+                label="结束端口"
+                type="number"
+                value={shareForm.portRangeEnd.toString()}
+                onChange={(e) => setShareForm({ ...shareForm, portRangeEnd: parseInt(e.target.value) })}
+              />
+            </div>
+            <Input
+              label="有效期 (天)"
+              type="number"
+              description="0 表示永久"
+              value={shareForm.expiryDays.toString()}
+              onChange={(e) => setShareForm({ ...shareForm, expiryDays: parseInt(e.target.value) })}
+            />
+            <Input
+              label="允许的域名 (可选)"
+              placeholder="example.com, panel.test.com"
+              description="限制使用此Token的来源面板域名，多个域名用逗号分隔，留空不限制"
+              value={shareForm.allowedDomains}
+              onChange={(e) => setShareForm({ ...shareForm, allowedDomains: e.target.value })}
+            />
+          </ModalBody>
+          <ModalFooter>
+            <Button onPress={() => setCreateShareOpen(false)}>取消</Button>
+            <Button color="primary" onPress={handleCreateShare}>创建</Button>
+          </ModalFooter>
+        </ModalContent>
+      </Modal>
+
+      {/* Import Node Modal */}
+      <Modal isOpen={importNodeOpen} onClose={() => setImportNodeOpen(false)}>
+        <ModalContent>
+          <ModalHeader>导入远程节点</ModalHeader>
+          <ModalBody>
+            <Input
+              label="远程面板地址"
+              placeholder="http://panel.example.com:8088"
+              value={importForm.remoteUrl}
+              onChange={(e) => setImportForm({ ...importForm, remoteUrl: e.target.value })}
+            />
+            <Input
+              label="Token"
+              placeholder="Bearer Token"
+              value={importForm.token}
+              onChange={(e) => setImportForm({ ...importForm, token: e.target.value })}
+            />
+          </ModalBody>
+          <ModalFooter>
+            <Button onPress={() => setImportNodeOpen(false)}>取消</Button>
+            <Button color="secondary" onPress={handleImportNode}>导入</Button>
+          </ModalFooter>
+        </ModalContent>
+      </Modal>
+    </div>
+  );
+}

vite-frontend/src/pages/profile.tsx

@@ -82,6 +82,18 @@ export default function ProfilePage() {
         "bg-orange-100 dark:bg-orange-500/20 text-orange-600 dark:text-orange-400",
       description: "管理用户限速策略",
     },
+    {
+      path: "/group",
+      label: "分组管理",
+      icon: (
+        <svg className="w-5 h-5" fill="currentColor" viewBox="0 0 20 20">
+          <path d="M10 2a3 3 0 100 6 3 3 0 000-6zM4 9a3 3 0 100 6 3 3 0 000-6zm12 0a3 3 0 100 6 3 3 0 000-6M4 16a2 2 0 00-2 2h4a2 2 0 00-2-2zm12 0a2 2 0 00-2 2h4a2 2 0 00-2-2zm-6 0a2 2 0 00-2 2h4a2 2 0 00-2-2z" />
+        </svg>
+      ),
+      color:
+        "bg-green-100 dark:bg-green-500/20 text-green-600 dark:text-green-400",
+      description: "管理用户和隧道分组",
+    },
     {
       path: "/user",
       label: "用户管理",
@@ -309,7 +321,7 @@ export default function ProfilePage() {
               rel="noopener noreferrer"
               target="_blank"
             >
-              flux-panel
+              FLVX
             </a>
           </p>
           <p className="text-xs text-gray-400 dark:text-gray-500 mt-1">