update setup default branch

added logout endpoint
fixed crash on some base64 jwt secret
2026-01-11 22:30:47 +01:00 · 2024-10-31 03:07:03 +08:00 · 2024-10-31 00:58:35 +08:00 · 2024-10-30 11:09:52 +08:00 · 2024-10-30 10:19:30 +08:00 · 2024-10-30 06:52:18 +08:00
243 changed files with 10693 additions and 5932 deletions
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -11,7 +11,7 @@ env:
 jobs:
    build:
        name: Build multi-platform Docker image
-        runs-on: self-hosted
+        runs-on: ubuntu-22.04

        permissions:
            contents: read
@@ -24,8 +24,8 @@ jobs:
            matrix:
                platform:
                    - linux/amd64
-                    - linux/arm/v6
-                    - linux/arm/v7
+                    # - linux/arm/v6
+                    # - linux/arm/v7
                    - linux/arm64
        steps:
            - name: Prepare
@@ -61,6 +61,8 @@ jobs:
                  outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
                  cache-from: type=gha
                  cache-to: type=gha,mode=max
+                  build-args: |
+                      VERSION=${{ github.ref_name }}

            - name: Generate artifact attestation
              uses: actions/attest-build-provenance@v1
@@ -83,7 +85,7 @@ jobs:
                  if-no-files-found: error
                  retention-days: 1
    merge:
-        runs-on: self-hosted
+        runs-on: ubuntu-22.04
        needs:
            - build
        permissions:
@@ -124,9 +126,3 @@ jobs:
            - name: Inspect image
              run: |
                  docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
-
-            - name: Tag as latest
-              if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-')
-              run: |
-                  docker tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-                  docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,8 @@
 compose.yml
+*.compose.yml

+config
+certs
 config*/
 certs*/
 bin/
@@ -19,3 +22,6 @@ todo.md

 .*.swp
 .aider*
+mtrace.json
+.env
+test.Dockerfile
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -11,5 +11,5 @@ build-image:
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
  script:
    - echo building $CI_REGISTRY_IMAGE
-    - docker build --pull -t $CI_REGISTRY_IMAGE .
-    - docker push $CI_REGISTRY_IMAGE
+    - docker build --no-cache --build-arg VERSION=$CI_COMMIT_REF_NAME -t $CI_REGISTRY_IMAGE .
+    - docker push $CI_REGISTRY_IMAGE
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -0,0 +1,136 @@
+run:
+  timeout: 10m
+
+linters-settings:
+  govet:
+    enable-all: true
+    disable:
+      - shadow
+      - fieldalignment
+  gocyclo:
+    min-complexity: 14
+  goconst:
+    min-len: 3
+    min-occurrences: 4
+  misspell:
+    locale: US
+  funlen:
+    lines: -1
+    statements: 120
+  forbidigo:
+    forbid:
+      - ^print(ln)?$
+  godox:
+    keywords:
+      - FIXME
+  tagalign:
+    align: false
+    sort: true
+    order:
+      - description
+      - json
+      - toml
+      - yaml
+      - yml
+      - label
+      - label-slice-as-struct
+      - file
+      - kv
+      - export
+  stylecheck:
+    dot-import-whitelist:
+      - github.com/yusing/go-proxy/internal/utils/testing # go tests only
+      - github.com/yusing/go-proxy/internal/api/v1/utils # api only
+  revive:
+    rules:
+      - name: struct-tag
+      - name: blank-imports
+      - name: context-as-argument
+      - name: context-keys-type
+      - name: error-return
+      - name: error-strings
+      - name: error-naming
+      - name: exported
+        disabled: true
+      - name: if-return
+      - name: increment-decrement
+      - name: var-naming
+      - name: var-declaration
+      - name: package-comments
+        disabled: true
+      - name: range
+      - name: receiver-naming
+      - name: time-naming
+      - name: unexported-return
+      - name: indent-error-flow
+      - name: errorf
+      - name: empty-block
+      - name: superfluous-else
+      - name: unused-parameter
+        disabled: true
+      - name: unreachable-code
+      - name: redefines-builtin-id
+  gomoddirectives:
+    replace-allow-list:
+      - github.com/abbot/go-http-auth
+      - github.com/gorilla/mux
+      - github.com/mailgun/minheap
+      - github.com/mailgun/multibuf
+      - github.com/jaguilar/vt100
+      - github.com/cucumber/godog
+      - github.com/http-wasm/http-wasm-host-go
+  testifylint:
+    disable:
+      - suite-dont-use-pkg
+      - require-error
+      - go-require
+  staticcheck:
+    checks:
+      - all
+      - -SA1019
+  errcheck:
+    exclude-functions:
+      - fmt.Fprintln
+linters:
+  enable-all: true
+  disable:
+    - execinquery # deprecated
+    - gomnd # deprecated
+    - sqlclosecheck # not relevant (SQL)
+    - rowserrcheck # not relevant (SQL)
+    - cyclop # duplicate of gocyclo
+    - depguard # Not relevant
+    - nakedret # Too strict
+    - lll # Not relevant
+    - gocyclo # FIXME must be fixed
+    - gocognit # Too strict
+    - nestif # Too many false-positive.
+    - prealloc # Too many false-positive.
+    - makezero # Not relevant
+    - dupl # Too strict
+    - gosec # Too strict
+    - gochecknoinits
+    - gochecknoglobals
+    - wsl # Too strict
+    - nlreturn # Not relevant
+    - mnd # Too strict
+    - testpackage # Too strict
+    - tparallel # Not relevant
+    - paralleltest # Not relevant
+    - exhaustive # Not relevant
+    - exhaustruct # Not relevant
+    - err113 # Too strict
+    - wrapcheck # Too strict
+    - noctx # Too strict
+    - bodyclose # too many false-positive
+    - forcetypeassert # Too strict
+    - tagliatelle # Too strict
+    - varnamelen # Not relevant
+    - nilnil # Not relevant
+    - ireturn # Not relevant
+    - contextcheck # too many false-positive
+    - containedctx # too many false-positive
+    - maintidx # kind of duplicate of gocyclo
+    - nonamedreturns # Too strict
+    - gosmopolitan # not relevant
+    - exportloopref # Not relevant since go1.22
--- a/.trunk/.gitignore
+++ b/.trunk/.gitignore
@@ -0,0 +1,9 @@
+*out
+*logs
+*actions
+*notifications
+*tools
+plugins
+user_trunk.yaml
+user.yaml
+tmp
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -0,0 +1,41 @@
+# This file controls the behavior of Trunk: https://docs.trunk.io/cli
+# To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
+version: 0.1
+cli:
+  version: 1.22.6
+# Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
+plugins:
+  sources:
+    - id: trunk
+      ref: v1.6.3
+      uri: https://github.com/trunk-io/plugins
+# Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
+runtimes:
+  enabled:
+    - node@18.12.1
+    - python@3.10.8
+    - go@1.23.2
+# This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
+lint:
+  enabled:
+    - hadolint@2.12.0
+    - actionlint@1.7.3
+    - checkov@3.2.257
+    - git-diff-check
+    - gofmt@1.20.4
+    - golangci-lint@1.61.0
+    - markdownlint@0.42.0
+    - osv-scanner@1.9.0
+    - oxipng@9.1.2
+    - prettier@3.3.3
+    - shellcheck@0.10.0
+    - shfmt@3.6.0
+    - trufflehog@3.82.7
+    - yamllint@1.35.1
+actions:
+  disabled:
+    - trunk-announce
+    - trunk-check-pre-push
+    - trunk-fmt-pre-commit
+  enabled:
+    - trunk-upgrade-available
--- a/.vscode/settings.example.json
+++ b/.vscode/settings.example.json
@@ -5,9 +5,7 @@
      "config.yml"
    ],
    "https://github.com/yusing/go-proxy/raw/main/schema/providers.schema.json": [
-      "providers.example.yml",
-      "*.providers.yml",
-      "providers.yml"
+      "providers.example.yml"
    ]
  }
-}
+}
--- a/21
+++ b/21
@@ -1,25 +1,32 @@
 # Stage 1: Builder
-FROM golang:1.23.1-alpine AS builder
-RUN apk add --no-cache tzdata
+FROM golang:1.23.2-alpine AS builder
+RUN apk add --no-cache tzdata make

 WORKDIR /src

 # Only copy go.mod and go.sum initially for better caching
-COPY go.mod go.sum /src
+COPY go.mod go.sum /src/

 # Utilize build cache
 RUN --mount=type=cache,target="/go/pkg/mod" \
-    go mod graph | awk '{if ($1 !~ "@") print $2}' | xargs go get
+    go mod download -x

 ENV GOCACHE=/root/.cache/go-build

-# Build the application with better caching
+ARG VERSION
+ENV VERSION=${VERSION}
+
+COPY scripts /src/scripts
+COPY Makefile /src/
+
 RUN --mount=type=cache,target="/go/pkg/mod" \
    --mount=type=cache,target="/root/.cache/go-build" \
    --mount=type=bind,src=cmd,dst=/src/cmd \
    --mount=type=bind,src=internal,dst=/src/internal \
-    CGO_ENABLED=0 GOOS=linux go build -ldflags '-w -s' -pgo=auto -o /app/go-proxy ./cmd && \
-    mkdir /app/error_pages /app/certs
+    --mount=type=bind,src=pkg,dst=/src/pkg \
+    make build && \
+    mkdir -p /app/error_pages /app/certs && \
+    mv bin/go-proxy /app/go-proxy

 # Stage 2: Final image
 FROM scratch
--- a/41
+++ b/41
@@ -1,21 +1,19 @@
-BUILD_FLAG ?= -s -w
+VERSION ?= $(shell git describe --tags --abbrev=0)
+BUILD_FLAGS ?= -s -w -X github.com/yusing/go-proxy/pkg.version=${VERSION}
+export VERSION
+export BUILD_FLAGS
+export CGO_ENABLED = 0
+export GOOS = linux

 .PHONY: all setup build test up restart logs get debug run archive repush rapid-crash debug-list-containers

 all: debug

-setup:
-	mkdir -p config certs
-	[ -f config/config.yml ] || cp config.example.yml config/config.yml
-	[ -f config/providers.yml ] || touch config/providers.yml
-
 build:
-	mkdir -p bin
-	CGO_ENABLED=0 GOOS=linux \
-		go build -ldflags '${BUILD_FLAG}' -pgo=auto -o bin/go-proxy ./cmd
+	scripts/build.sh

 test:
-	go test ./internal/...
+	GOPROXY_TEST=1 go test ./internal/...

 up:
 	docker compose up -d
@@ -27,10 +25,22 @@ logs:
 	docker compose logs -f

 get:
-	cd cmd && go get -u && go mod tidy && cd ..
+	go get -u ./cmd && go mod tidy

 debug:
-	make BUILD_FLAG="" build && sudo GOPROXY_DEBUG=1 bin/go-proxy
+	make build
+	sudo GOPROXY_DEBUG=1 bin/go-proxy
+
+debug-trace:
+	make build
+	sudo GOPROXY_DEBUG=1 GOPROXY_TRACE=1 bin/go-proxy
+
+profile:
+	GODEBUG=gctrace=1 make build
+	sudo GOPROXY_DEBUG=1 bin/go-proxy
+
+mtrace:
+	bin/go-proxy debug-ls-mtrace > mtrace.json

 run:
 	make build && sudo bin/go-proxy
@@ -45,7 +55,7 @@ repush:
 	git push gitlab dev --force

 rapid-crash:
-	sudo docker run --restart=always --name test_crash debian:bookworm-slim /bin/cat &&\
+	sudo docker run --restart=always --name test_crash -p 80 debian:bookworm-slim /bin/cat &&\
 	sleep 3 &&\
 	sudo docker rm -f test_crash

@@ -54,4 +64,7 @@ debug-list-containers:

 ci-test:
 	mkdir -p /tmp/artifacts
-	act -n --artifact-server-path /tmp/artifacts -s GITHUB_TOKEN="$$(gh auth token)"
+	act -n --artifact-server-path /tmp/artifacts -s GITHUB_TOKEN="$$(gh auth token)"
+
+cloc:
+	cloc --not-match-f '_test.go$$' cmd internal pkg
--- a/README.md
+++ b/README.md
@@ -9,7 +9,11 @@

 [繁體中文文檔請看此](README_CHT.md)

-A lightweight, easy-to-use, and [performant](docs/benchmark_result.md) reverse proxy with a web UI.
+A lightweight, easy-to-use, and [performant](https://github.com/yusing/go-proxy/wiki/Benchmarks) reverse proxy with a Web UI and dashboard.
+
+![Screenshot](screenshots/webui.png)
+
+_Join our [Discord](https://discord.gg/umReR62nRd) for help and discussions_

 ## Table of content

@@ -17,34 +21,30 @@ A lightweight, easy-to-use, and [performant](docs/benchmark_result.md) reverse p

 - [go-proxy](#go-proxy)
  - [Table of content](#table-of-content)
-  - [Key Points](#key-points)
+  - [Key Features](#key-features)
  - [Getting Started](#getting-started)
    - [Setup](#setup)
-    - [Commands line arguments](#commands-line-arguments)
-    - [Environment variables](#environment-variables)
    - [Use JSON Schema in VSCode](#use-json-schema-in-vscode)
-    - [Config File](#config-file)
-    - [Include Files](#include-files)
-  - [Showcase](#showcase)
+  - [Screenshots](#screenshots)
    - [idlesleeper](#idlesleeper)
  - [Build it yourself](#build-it-yourself)

-## Key Points
+## Key Features

 -   Easy to use
    -   Effortless configuration
    -   Simple multi-node setup
    -   Error messages is clear and detailed, easy troubleshooting
-   Auto SSL cert management (See [Supported DNS Challenge Providers](docs/dns_providers.md)) 
+-   Auto SSL cert management (See [Supported DNS-01 Challenge Providers](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers)) 
 -   Auto configuration for docker containers
 -   Auto hot-reload on container state / config file changes
-   **idlesleeper**: stop containers on idle, wake it up on traffic _(optional, see [showcase](#idlesleeper))_
+-   **idlesleeper**: stop containers on idle, wake it up on traffic _(optional, see [screenshots](#idlesleeper))_
 -   HTTP(s) reserve proxy
-   [HTTP middleware support](docs/middlewares.md) _(experimental)_
-   [Custom error pages support](docs/middlewares.md#custom-error-pages)
+-   [HTTP middleware support](https://github.com/yusing/go-proxy/wiki/Middlewares)
+-   [Custom error pages support](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
 -   TCP and UDP port forwarding
-   Web UI for configuration and monitoring (See [screenshots](https://github.com/yusing/go-proxy-frontend?tab=readme-ov-file#screenshots))
-   Supports linux/amd64, linux/arm64, linux/arm/v7, linux/arm/v6 multi-platform
+-   **Web UI with App dashboard**
+-   Supports linux/amd64, linux/arm64
 -   Written in **[Go](https://go.dev)**

 [🔼Back to top](#table-of-content)
@@ -70,64 +70,31 @@ A lightweight, easy-to-use, and [performant](docs/benchmark_result.md) reverse p
    -   A Record: `*.y.z` -> `10.0.10.1`
    -   AAAA Record: `*.y.z` -> `::ffff:a00:a01`

-4.  Setup `docker-socket-proxy` other docker nodes _(if any)_ (see [example](docs/docker_socket_proxy.md)) and then them inside `config.yml`
+4.  Setup `docker-socket-proxy` other docker nodes _(if any)_ (see [Multi docker nodes setup](https://github.com/yusing/go-proxy/wiki/Configurations#multi-docker-nodes-setup)) and then them inside `config.yml`

-5.  Done. You may now do some extra configuration
+5.  Run go-proxy `docker compose up -d` 
+    then list all routes to see if further configurations are needed:
+    `docker exec go-proxy /app/go-proxy ls-routes`
+
+6.  You may now do some extra configuration
    -   With text editor (e.g. Visual Studio Code)
-    -   With Web UI via `gp.y.z`
-    -   For more info, [See docker.md](docs/docker.md)
+    -   With Web UI via `http://localhost:3000` or `https://gp.y.z`
+    -   For more info, [See Wiki]([wiki](https://github.com/yusing/go-proxy/wiki))

 [🔼Back to top](#table-of-content)

-### Commands line arguments
-
-| Argument    | Description                      | Example                    |
-| ----------- | -------------------------------- | -------------------------- |
-| empty       | start proxy server               |                            |
-| `validate`  | validate config and exit         |                            |
-| `reload`    | trigger a force reload of config |                            |
-| `ls-config` | list config and exit             | `go-proxy ls-config \| jq` |
-| `ls-route`  | list proxy entries and exit      | `go-proxy ls-route \| jq`  |
-
-**run with `docker exec go-proxy /app/go-proxy <command>`**
-
-### Environment variables
-
-| Environment Variable           | Description                                 | Default          | Values        |
-| ------------------------------ | ------------------------------------------- | ---------------- | ------------- |
-| `GOPROXY_NO_SCHEMA_VALIDATION` | disable schema validation                   | `false`          | boolean       |
-| `GOPROXY_DEBUG`                | enable debug behaviors                      | `false`          | boolean       |
-| `GOPROXY_HTTP_ADDR`            | http server listening address               | `:80`            | `[host]:port` |
-| `GOPROXY_HTTPS_ADDR`           | https server listening address (if enabled) | `:443`           | `[host]:port` |
-| `GOPROXY_API_ADDR`             | api server listening address                | `127.0.0.1:8888` | `[host]:port` |
-
 ### Use JSON Schema in VSCode

 Copy [`.vscode/settings.example.json`](.vscode/settings.example.json) to `.vscode/settings.json` and modify it to fit your needs

 [🔼Back to top](#table-of-content)

-### Config File
-
-See [config.example.yml](config.example.yml)
-
-[🔼Back to top](#table-of-content)
-
-### Include Files
-
-These are files that include standalone proxy entries
-
-See [Fields](docs/docker.md#fields)
-
-See [providers.example.yml](providers.example.yml) for examples
-
-[🔼Back to top](#table-of-content)
-
-## Showcase
+## Screenshots

 ### idlesleeper

-![idlesleeper](showcase/idlesleeper.webp)
+![idlesleeper](screenshots/idlesleeper.webp)
+

 [🔼Back to top](#table-of-content)

--- a/README_CHT.md
+++ b/README_CHT.md
@@ -7,7 +7,7 @@
 [![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
 [![](https://dcbadge.limes.pink/api/server/umReR62nRd)](https://discord.gg/umReR62nRd)

-一個輕量化、易用且[高效](docs/benchmark_result.md)的反向代理和端口轉發工具
+一個輕量化、易用且[高效]([docs/benchmark_result.md](https://github.com/yusing/go-proxy/wiki/Benchmarks)))的反向代理和端口轉發工具

 ## 目錄

@@ -21,8 +21,6 @@
    - [命令行參數](#命令行參數)
    - [環境變量](#環境變量)
    - [VSCode 中使用 JSON Schema](#vscode-中使用-json-schema)
-    - [配置文件](#配置文件)
-    - [透過文件配置](#透過文件配置)
  - [展示](#展示)
    - [idlesleeper](#idlesleeper)
  - [源碼編譯](#源碼編譯)
@@ -33,14 +31,16 @@
    -   不需花費太多時間就能輕鬆配置
    -   支持多個docker節點
    -   除錯簡單
-   自動配置 SSL 證書（參見[可用的 DNS 供應商](docs/dns_providers.md)）
+-   自動配置 SSL 證書（參見[可用的 DNS 供應商](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers)）
 -   透過 Docker 容器自動配置
 -   容器狀態變更時自動熱重載
-   容器閒置時自動暫停/停止，入站時自動喚醒
+-   **idlesleeper** 容器閒置時自動暫停/停止，入站時自動喚醒 (可選, 參見 [展示](#idlesleeper))
 -   HTTP(s) 反向代理
+-   [HTTP middleware](https://github.com/yusing/go-proxy/wiki/Middlewares)
+-   [自訂 error pages](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
 -   TCP/UDP 端口轉發
-   用於配置和監控的前端 Web 面板（[截圖](https://github.com/yusing/go-proxy-frontend?tab=readme-ov-file#screenshots)）
-   支持 linux/amd64、linux/arm64、linux/arm/v7、linux/arm/v6 多平台
+-   Web 面板 (內置App dashboard)
+-   支持 linux/amd64、linux/arm64 平台
 -   使用 **[Go](https://go.dev)** 編寫

 [🔼 返回頂部](#目錄)
@@ -70,20 +70,23 @@

 5. 大功告成，你可以做一些額外的配置
    - 使用文本編輯器 (推薦 Visual Studio Code [參見 VSCode 使用 schema](#vscode-中使用-json-schema))
-    - 或通過 `http://gp.y.z` 使用網頁配置編輯器
+    - 或通過 `http://localhost:3000` 使用網頁配置編輯器
    - 詳情請參閱 [docker.md](docs/docker.md)

 [🔼 返回頂部](#目錄)

 ### 命令行參數

-| 參數        | 描述           | 示例                       |
-| ----------- | -------------- | -------------------------- |
-| 空          | 啟動代理服務器 |                            |
-| `validate`  | 驗證配置並退出 |                            |
-| `reload`    | 強制刷新配置   |                            |
-| `ls-config` | 列出配置並退出 | `go-proxy ls-config \| jq` |
-| `ls-route`  | 列出路由並退出 | `go-proxy ls-route \| jq`  |
+| 參數                      | 描述                                                                                  | 示例                                |
+| ------------------------- | ------------------------------------------------------------------------------------- | ----------------------------------- |
+| 空                        | 啟動代理服務器                                                                        |                                     |
+| `validate`                | 驗證配置並退出                                                                        |                                     |
+| `reload`                  | 強制刷新配置                                                                          |                                     |
+| `ls-config`               | 列出配置並退出                                                                        | `go-proxy ls-config \| jq`          |
+| `ls-route`                | 列出路由並退出                                                                        | `go-proxy ls-route \| jq`           |
+| `go-proxy ls-route \| jq` |
+| `ls-icons`                | 列出 [dashboard-icons](https://github.com/walkxcode/dashboard-icons/tree/main) 並退出 | `go-proxy ls-icons \| grep adguard` |
+| `debug-ls-mtrace`         | 列出middleware追蹤 **(僅限於 debug 模式)**                                            | `go-proxy debug-ls-mtrace \| jq`    |

 **使用 `docker exec go-proxy /app/go-proxy <參數>` 運行**

@@ -103,25 +106,12 @@

 [🔼 返回頂部](#目錄)

-### 配置文件
-
-參見 [config.example.yml](config.example.yml)
-
-[🔼 返回頂部](#目錄)
-
-### 透過文件配置
-
-參見 [Fields](docs/docker.md#fields)
-
-參見範例 [providers.example.yml](providers.example.yml)
-
-[🔼 返回頂部](#目錄)

 ## 展示

 ### idlesleeper

-![idlesleeper](showcase/idlesleeper.webp)
+![idlesleeper](screenshots/idlesleeper.webp)

 [🔼 返回頂部](#目錄)

--- a/cmd/main.go
+++ b/cmd/main.go
@@ -1,32 +1,26 @@
 package main

 import (
-	"context"
 	"encoding/json"
-	"io"
 	"log"
 	"net/http"
 	"os"
 	"os/signal"
-	"reflect"
-	"runtime"
-	"strings"
-	"sync"
 	"syscall"
 	"time"

-	"github.com/sirupsen/logrus"
 	"github.com/yusing/go-proxy/internal"
 	"github.com/yusing/go-proxy/internal/api"
-	apiUtils "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/api/v1/query"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/config"
-	"github.com/yusing/go-proxy/internal/docker"
-	"github.com/yusing/go-proxy/internal/docker/idlewatcher"
 	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
 	R "github.com/yusing/go-proxy/internal/route"
 	"github.com/yusing/go-proxy/internal/server"
-	F "github.com/yusing/go-proxy/internal/utils/functional"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/pkg"
 )

 func main() {
@@ -37,37 +31,26 @@ func main() {
 		return
 	}

-	l := logrus.WithField("module", "main")
-	onShutdown := F.NewSlice[func()]()
-
-	if common.IsDebug {
-		logrus.SetLevel(logrus.DebugLevel)
-	}
-
-	if args.Command != common.CommandStart {
-		logrus.SetOutput(io.Discard)
-	} else {
-		logrus.SetFormatter(&logrus.TextFormatter{
-			DisableSorting:  true,
-			FullTimestamp:   true,
-			ForceColors:     true,
-			TimestampFormat: "01-02 15:04:05",
-		})
-	}
-
 	if args.Command == common.CommandReload {
-		if err := apiUtils.ReloadServer(); err.HasError() {
-			log.Fatal(err)
+		if err := query.ReloadServer(); err != nil {
+			E.LogFatal("server reload error", err)
 		}
-		log.Print("ok")
+		logging.Info().Msg("ok")
 		return
 	}

-	// exit if only validate config
+	if args.Command == common.CommandStart {
+		logging.Info().Msgf("go-proxy version %s", pkg.GetVersion())
+		logging.Trace().Msg("trace enabled")
+		// logging.AddHook(notif.GetDispatcher())
+	} else {
+		logging.DiscardLogger()
+	}
+
 	if args.Command == common.CommandValidate {
 		data, err := os.ReadFile(common.ConfigPath)
 		if err == nil {
-			err = config.Validate(data).Error()
+			err = config.Validate(data)
 		}
 		if err != nil {
 			log.Fatal("config error: ", err)
@@ -80,58 +63,72 @@ func main() {
 		prepareDirectory(dir)
 	}

-	err := config.Load()
-	if err != nil {
-		logrus.Warn(err)
+	middleware.LoadComposeFiles()
+
+	var cfg *config.Config
+	var err E.Error
+	if cfg, err = config.Load(); err != nil {
+		E.LogWarn("errors in config", err)
 	}
-	cfg := config.GetInstance()

 	switch args.Command {
 	case common.CommandListConfigs:
-		printJSON(cfg.Value())
+		printJSON(config.Value())
 		return
 	case common.CommandListRoutes:
-		printJSON(cfg.RoutesByAlias())
+		routes, err := query.ListRoutes()
+		if err != nil {
+			log.Printf("failed to connect to api server: %s", err)
+			log.Printf("falling back to config file")
+			printJSON(config.RoutesByAlias())
+		} else {
+			printJSON(routes)
+		}
+		return
+	case common.CommandListIcons:
+		icons, err := internal.ListAvailableIcons()
+		if err != nil {
+			log.Fatal(err)
+		}
+		printJSON(icons)
 		return
 	case common.CommandDebugListEntries:
-		printJSON(cfg.DumpEntries())
+		printJSON(config.DumpEntries())
 		return
 	case common.CommandDebugListProviders:
-		printJSON(cfg.DumpProviders())
+		printJSON(config.DumpProviders())
+		return
+	case common.CommandDebugListMTrace:
+		trace, err := query.ListMiddlewareTraces()
+		if err != nil {
+			log.Fatal(err)
+		}
+		printJSON(trace)
+		return
+	case common.CommandDebugListTasks:
+		tasks, err := query.DebugListTasks()
+		if err != nil {
+			log.Fatal(err)
+		}
+		printJSON(tasks)
 		return
-	}
-
-	if common.IsDebug {
-		printJSON(docker.GetRegisteredNamespaces())
 	}

 	cfg.StartProxyProviders()
-
-	if err.HasError() {
-		l.Warn(err)
-	}
-
-	cfg.WatchChanges()
-
-	onShutdown.Add(docker.CloseAllClients)
-	onShutdown.Add(cfg.Dispose)
+	config.WatchChanges()

 	sig := make(chan os.Signal, 1)
 	signal.Notify(sig, syscall.SIGINT)
 	signal.Notify(sig, syscall.SIGTERM)
 	signal.Notify(sig, syscall.SIGHUP)

-	autocert := cfg.GetAutoCertProvider()
-
+	autocert := config.GetAutoCertProvider()
 	if autocert != nil {
-		ctx, cancel := context.WithCancel(context.Background())
-		if err = autocert.Setup(ctx); err != nil {
-			l.Fatal(err)
-		} else {
-			onShutdown.Add(cancel)
+		if err := autocert.Setup(); err != nil {
+			E.LogFatal("autocert setup error", err)
 		}
 	} else {
-		l.Info("autocert not configured")
+		logging.Info().Msg("autocert not configured")
 	}

 	proxyServer := server.InitProxyServer(server.Options{
@@ -140,75 +137,40 @@ func main() {
 		HTTPAddr:        common.ProxyHTTPAddr,
 		HTTPSAddr:       common.ProxyHTTPSAddr,
 		Handler:         http.HandlerFunc(R.ProxyHandler),
-		RedirectToHTTPS: cfg.Value().RedirectToHTTPS,
+		RedirectToHTTPS: config.Value().RedirectToHTTPS,
 	})
 	apiServer := server.InitAPIServer(server.Options{
 		Name:            "api",
 		CertProvider:    autocert,
 		HTTPAddr:        common.APIHTTPAddr,
-		Handler:         api.NewHandler(cfg),
-		RedirectToHTTPS: cfg.Value().RedirectToHTTPS,
+		Handler:         api.NewHandler(),
+		RedirectToHTTPS: config.Value().RedirectToHTTPS,
 	})

 	proxyServer.Start()
 	apiServer.Start()
-	onShutdown.Add(proxyServer.Stop)
-	onShutdown.Add(apiServer.Stop)
-
-	go idlewatcher.Start()
-	onShutdown.Add(idlewatcher.Stop)

 	// wait for signal
 	<-sig

 	// grafully shutdown
-	logrus.Info("shutting down")
-	done := make(chan struct{}, 1)
-
-	var wg sync.WaitGroup
-	wg.Add(onShutdown.Size())
-	onShutdown.ForEach(func(f func()) {
-		go func() {
-			l.Debugf("waiting for %s to complete...", funcName(f))
-			f()
-			l.Debugf("%s done", funcName(f))
-			wg.Done()
-		}()
-	})
-	go func() {
-		wg.Wait()
-		close(done)
-	}()
-
-	timeout := time.After(time.Duration(cfg.Value().TimeoutShutdown) * time.Second)
-	select {
-	case <-done:
-		logrus.Info("shutdown complete")
-	case <-timeout:
-		logrus.Info("timeout waiting for shutdown")
-		onShutdown.ForEach(func(f func()) {
-			l.Warnf("%s() is still running", funcName(f))
-		})
-	}
+	logging.Info().Msg("shutting down")
+	task.CancelGlobalContext()
+	task.GlobalContextWait(time.Second * time.Duration(config.Value().TimeoutShutdown))
 }

 func prepareDirectory(dir string) {
 	if _, err := os.Stat(dir); os.IsNotExist(err) {
-		if err = os.MkdirAll(dir, 0755); err != nil {
-			logrus.Fatalf("failed to create directory %s: %v", dir, err)
+		if err = os.MkdirAll(dir, 0o755); err != nil {
+			logging.Fatal().Msgf("failed to create directory %s: %v", dir, err)
 		}
 	}
 }

-func funcName(f func()) string {
-	parts := strings.Split(runtime.FuncForPC(reflect.ValueOf(f).Pointer()).Name(), "/go-proxy/")
-	return parts[len(parts)-1]
-}
-
 func printJSON(obj any) {
-	j, err := E.Check(json.MarshalIndent(obj, "", "  "))
-	if err.HasError() {
-		logrus.Fatal(err)
+	j, err := json.MarshalIndent(obj, "", "  ")
+	if err != nil {
+		logging.Fatal().Err(err).Send()
 	}
 	rawLogger := log.New(os.Stdout, "", 0)
 	rawLogger.Printf("%s", j) // raw output for convenience using "jq"
--- a/compose.example.yml
+++ b/compose.example.yml
@@ -1,33 +1,45 @@
 services:
-  frontend:
-    image: ghcr.io/yusing/go-proxy-frontend:latest
-    container_name: go-proxy-frontend
-    restart: unless-stopped
-    network_mode: host
-    labels:
-      - proxy.aliases=gp
-      - proxy.gp.port=3000
-    depends_on:
-      - app
-  app:
-    image: ghcr.io/yusing/go-proxy:latest
-    container_name: go-proxy
-    restart: always
-    network_mode: host
-    environment:
-      # (Optional) change this to your timezone to get correct log timestamp
-      TZ: ETC/UTC
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./config:/app/config
+    frontend:
+        image: ghcr.io/yusing/go-proxy-frontend:latest
+        container_name: go-proxy-frontend
+        restart: unless-stopped
+        network_mode: host
+        depends_on:
+            - app
+        # if you also want to proxy the WebUI and access it via gp.y.z
+        # labels:
+        #   - proxy.aliases=gp
+        #   - proxy.gp.port=3000

-      # (Optional) choose one of below to enable https
-      # 1. use existing certificate
-      # if your cert is not named `cert.crt` change `cert_path` in `config/config.yml`
-      # if your cert key is not named `priv.key` change `key_path` in `config/config.yml`
+        # Make sure the value is same as `GOPROXY_API_ADDR` below (if you have changed it)
+        #
+        # environment:
+        #     GOPROXY_API_ADDR: 127.0.0.1:8888
+    app:
+        image: ghcr.io/yusing/go-proxy:latest
+        container_name: go-proxy
+        restart: always
+        network_mode: host
+        environment:
+            # (Optional) change this to your timezone to get correct log timestamp
+            TZ: ETC/UTC

-      # - /path/to/certs:/app/certs
+            # Change these if you need
+            #
+            # GOPROXY_HTTP_ADDR: :80
+            # GOPROXY_HTTPS_ADDR: :443
+            # GOPROXY_API_ADDR: 127.0.0.1:8888
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock
+            - ./config:/app/config

-      # 2. use autocert, certs will be stored in ./certs (or other path you specify)
+            # (Optional) choose one of below to enable https
+            # 1. use existing certificate
+            # if your cert is not named `cert.crt` change `cert_path` in `config/config.yml`
+            # if your cert key is not named `priv.key` change `key_path` in `config/config.yml`

-      # - ./certs:/app/certs
+            # - /path/to/certs:/app/certs
+
+            # 2. use autocert, certs will be stored in ./certs (or other path you specify)
+
+            # - ./certs:/app/certs
--- a/docs/add_dns_provider.md
+++ b/docs/add_dns_provider.md
@@ -1,41 +0,0 @@
-# Adding provider support
-
-## **CloudDNS** as an example
-
-1. Fork this repo, modify [autocert.go](../src/go-proxy/autocert.go#L305)
-
-   ```go
-   var providersGenMap = map[string]ProviderGenerator{
-     "cloudflare": providerGenerator(cloudflare.NewDefaultConfig, cloudflare.NewDNSProviderConfig),
-     // add here, e.g.
-     "clouddns": providerGenerator(clouddns.NewDefaultConfig, clouddns.NewDNSProviderConfig),
-   }
-   ```
-
-2. Go to [https://go-acme.github.io/lego/dns/clouddns](https://go-acme.github.io/lego/dns/clouddns/) and check for required config
-
-3. Build `go-proxy` with `make build`
-
-4. Set required config in `config.yml` `autocert` -> `options` section
-
-   ```shell
-   # From https://go-acme.github.io/lego/dns/clouddns/
-   CLOUDDNS_CLIENT_ID=bLsdFAks23429841238feb177a572aX \
-   CLOUDDNS_EMAIL=you@example.com \
-   CLOUDDNS_PASSWORD=b9841238feb177a84330f \
-   lego --email you@example.com --dns clouddns --domains my.example.org run
-   ```
-
-   Should turn into:
-
-   ```yaml
-   autocert:
-     ...
-     options:
-       client_id: bLsdFAks23429841238feb177a572aX
-       email: you@example.com
-       password: b9841238feb177a84330f
-   ```
-
-5. Run with `GOPROXY_NO_SCHEMA_VALIDATION=1` and test if it works
-6. Commit and create pull request
--- a/docs/benchmark_result.md
+++ b/docs/benchmark_result.md
@@ -1,104 +0,0 @@
-# Benchmarks
-
-Benchmarked with `wrk` and `traefik/whoami`'s `/bench` endpoint
-
-## Remote benchmark
-
- Direct connection
-
-  ```shell
-  root@yusing-pc:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.100.3:8003/bench
-  Running 10s test @ http://10.0.100.3:8003/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency    94.75ms  199.92ms   1.68s    91.27%
-      Req/Sec     4.24k     1.79k   18.79k    72.13%
-    Latency Distribution
-      50%    1.14ms
-      75%  120.23ms
-      90%  245.63ms
-      99%    1.03s
-    423444 requests in 10.10s, 50.88MB read
-    Socket errors: connect 0, read 0, write 0, timeout 29
-  Requests/sec:  41926.32
-  Transfer/sec:      5.04MB
-  ```
-
- With reverse proxy
-
-  ```shell
-  root@yusing-pc:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.1.7/bench
-  Running 10s test @ http://10.0.1.7/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency    79.35ms  169.79ms   1.69s    92.55%
-      Req/Sec     4.27k     1.90k   19.61k    75.81%
-    Latency Distribution
-      50%    1.12ms
-      75%  105.66ms
-      90%  200.22ms
-      99%  814.59ms
-    409836 requests in 10.10s, 49.25MB read
-    Socket errors: connect 0, read 0, write 0, timeout 18
-  Requests/sec:  40581.61
-  Transfer/sec:      4.88MB
-  ```
-
-## Local benchmark (client running wrk and `go-proxy` server are under same proxmox host but different LXCs)
-
- Direct connection
-
-  ```shell
-  root@http-benchmark-client:~# wrk -t 10 -c 200 -d 10s --latency http://10.0.100.1/bench
-  Running 10s test @ http://10.0.100.1/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency   434.08us  539.35us   8.76ms   85.28%
-      Req/Sec    67.71k     6.31k   87.21k    71.20%
-    Latency Distribution
-      50%  153.00us
-      75%  646.00us
-      90%    1.18ms
-      99%    2.38ms
-    6739591 requests in 10.01s, 809.85MB read
-  Requests/sec: 673608.15
-  Transfer/sec:     80.94MB
-  ```
-
- With `go-proxy` reverse proxy
-
-  ```shell
-  root@http-benchmark-client:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.1.7/bench
-  Running 10s test @ http://10.0.1.7/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency     1.23ms    0.96ms  11.43ms   72.09%
-      Req/Sec    17.48k     1.76k   21.48k    70.20%
-    Latency Distribution
-      50%    0.98ms
-      75%    1.76ms
-      90%    2.54ms
-      99%    4.24ms
-    1739079 requests in 10.01s, 208.97MB read
-  Requests/sec: 173779.44
-  Transfer/sec:     20.88MB
-  ```
-
- With `traefik-v3`
-
-  ```shell
-  root@traefik-benchmark:~# wrk -t10 -c200 -d10s -H "Host: benchmark.whoami" --latency http://127.0.0.1:8000/bench
-  Running 10s test @ http://127.0.0.1:8000/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency     2.81ms   10.36ms 180.26ms   98.57%
-      Req/Sec    11.35k     1.74k   13.76k    85.54%
-    Latency Distribution
-      50%    1.59ms
-      75%    2.27ms
-      90%    3.17ms
-      99%   37.91ms
-    1125723 requests in 10.01s, 109.50MB read
-  Requests/sec: 112499.59
-  Transfer/sec:     10.94MB
-  ```
--- a/docs/dns_providers.md
+++ b/docs/dns_providers.md
@@ -1,81 +0,0 @@
-# Supported DNS Providers
-
-<!-- TOC -->
-
- [Supported DNS Providers](#supported-dns-providers)
-  - [Cloudflare](#cloudflare)
-  - [CloudDNS](#clouddns)
-  - [DuckDNS](#duckdns)
-  - [OVHCloud](#ovhcloud)
-  - [Implement other DNS providers](#implement-other-dns-providers)
-
-## Cloudflare
-
-```yaml
-autocert:
-    provider: cloudflare
-    options:
-        auth_token:
-```
-
-`auth_token` your zone API token
-
-Follow [this guide](https://cloudkul.com/blog/automcatic-renew-and-generate-ssl-on-your-website-using-lego-client/) to create a new token with `Zone.DNS` read and edit permissions
-
-## CloudDNS
-
-```yaml
-autocert:
-    provider: clouddns
-    options:
-        client_id:
-        email:
-        password:
-```
-
-## DuckDNS
-
-```yaml
-autocert:
-    provider: duckdns
-    options:
-        token:
-```
-
-Tested by [earvingad](https://github.com/earvingad)
-
-## OVHCloud
-
-```yaml
-autocert:
-    provider: ovh
-    options:
-        api_endpoint:
-        application_key:
-        application_secret:
-        consumer_key:
-        oauth2_config:
-            client_id:
-            client_secret:
-```
-
-_Note, `application_key` and `oauth2_config` **CANNOT** be used together_
-
-   `api_endpoint`: Endpoint URL, or one of
-    -   `ovh-eu`,
-    -   `ovh-ca`,
-    -   `ovh-us`,
-    -   `kimsufi-eu`,
-    -   `kimsufi-ca`,
-    -   `soyoustart-eu`,
-    -   `soyoustart-ca`
-   `application_secret`
-   `application_key`
-   `consumer_key`
-   `oauth2_config`: Client ID and Client Secret
-    -   `client_id`
-    -   `client_secret`
-
-## Implement other DNS providers
-
-See [add_dns_provider.md](docs/add_dns_provider.md)
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -1,296 +0,0 @@
-# Docker compose guide
-
-## Table of content
-
-<!-- TOC -->
-
- [Docker compose guide](#docker-compose-guide)
-  - [Table of content](#table-of-content)
-  - [Additional setup](#additional-setup)
-  - [Labels](#labels)
-    - [Syntax](#syntax)
-    - [Fields](#fields)
-      - [Key-value mapping example](#key-value-mapping-example)
-      - [List example](#list-example)
-  - [Troubleshooting](#troubleshooting)
-  - [Docker compose examples](#docker-compose-examples)
-    - [Services URLs for above examples](#services-urls-for-above-examples)
-
-## Additional setup
-
-1.  Enable HTTPs _(optional)_
-
-    Mount a folder to store obtained certs or to load existing cert
-
-    ```yaml
-    services:
-      go-proxy:
-        ...
-        volumes:
-          - ./certs:/app/certs
-    ```
-
-    To use **autocert**, complete that section in `config.yml`, e.g.
-
-    ```yaml
-    autocert:
-        email: john.doe@x.y.z # ACME Email
-        domains: # a list of domains for cert registration
-            - y.z
-            - *.y.z
-        provider: cloudflare
-        options:
-            auth_token: c1234565789-abcdefghijklmnopqrst # your zone API token
-    ```
-
-    To use **existing certificate**, set path for cert and key in `config.yml`, e.g.
-
-    ```yaml
-    autocert:
-        provider: local
-        cert_path: /app/certs/cert.crt
-        key_path: /app/certs/priv.key
-    ```
-
-2.  Modify `compose.yml` to fit your needs
-
-3.  Run `docker compose up -d` to start the container
-
-4.  Navigate to Web panel `http://gp.yourdomain.com` or use **Visual Studio Code (provides schema check)** to edit proxy config
-
-[🔼Back to top](#table-of-content)
-
-## Labels
-
-**Parts surrounded by `[]` are optional**
-
-### Syntax
-
-| Label                                        | Description                                                                                                                                                         | Example                                                                                                                                                                                                                     | Default                     | Accepted values                                                           |
-| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | ------------------------------------------------------------------------- |
-| `proxy.aliases`                              | comma separated aliases for subdomain and label matching                                                                                                            | `gitlab,gitlab-reg,gitlab-ssh`                                                                                                                                                                                              | `container_name`            | any                                                                       |
-| `proxy.exclude`                              | to be excluded from `go-proxy`                                                                                                                                      |                                                                                                                                                                                                                             | false                       | boolean                                                                   |
-| `proxy.idle_timeout`                         | time for idle (no traffic) before put it into sleep **(http/s only)**<br> _**NOTE: idlewatcher will only be enabled containers that has non-empty `idle_timeout`**_ | `1h`                                                                                                                                                                                                                        | empty or `0` **(disabled)** | `number[unit]...`, e.g. `1m30s`                                           |
-| `proxy.wake_timeout`                         | time to wait for target site to be ready                                                                                                                            |                                                                                                                                                                                                                             | `30s`                       | `number[unit]...`                                                         |
-| `proxy.stop_method`                          | method to stop after `idle_timeout`                                                                                                                                 |                                                                                                                                                                                                                             | `stop`                      | `stop`, `pause`, `kill`                                                   |
-| `proxy.stop_timeout`                         | time to wait for stop command                                                                                                                                       |                                                                                                                                                                                                                             | `10s`                       | `number[unit]...`                                                         |
-| `proxy.stop_signal`                          | signal sent to container for `stop` and `kill` methods                                                                                                              |                                                                                                                                                                                                                             | docker's default            | `SIGINT`, `SIGTERM`, `SIGHUP`, `SIGQUIT` and those without **SIG** prefix |
-| `proxy.<alias>.<field>`                      | set field for specific alias                                                                                                                                        | `proxy.gitlab-ssh.scheme`                                                                                                                                                                                                   | N/A                         | N/A                                                                       |
-| `proxy.#<index>.<field>`                     | set field for specific alias at index (starting from **1**)                                                                                                         | `proxy.#3.port`                                                                                                                                                                                                             | N/A                         | N/A                                                                       |
-| `proxy.*.<field>`                            | set field for all aliases                                                                                                                                           | `proxy.*.set_headers`                                                                                                                                                                                                       | N/A                         | N/A                                                                       |
-| `proxy.?.middlewares.<middleware>[.<field>]` | enable and set field for specific middleware                                                                                                                        | **?** here means `<alias>` / `$<index>` / `*` <ul><li>`proxy.#1.middlewares.modify_request.set_headers`</li><li>`proxy.*.middlewares.modify_response.hide_headers`</li><li>`proxy.app1.middlewares.redirect_http`</li></ul> | N/A                         | Middleware specific<br>See [middlewares.md](middlewares.md) for more      |
-
-### Fields
-
-| Field           | Description                                                                                    | Default                                                                          | Allowed Values / Syntax                                                                                                                                                                                                 |
-| --------------- | ---------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scheme`        | proxy protocol                                                                                 | <ul><li>`http` for numeric port</li><li>`tcp` for `x:y` port</li></ul>           | `http`, `https`, `tcp`, `udp`                                                                                                                                                                                           |
-| `host`          | proxy host                                                                                     | <ul><li>Docker: docker client IP / hostname </li><li>File: `localhost`</li></ul> | IP address, hostname                                                                                                                                                                                                    |
-| `port`          | proxy port **(http/s)**                                                                        | first port returned from docker                                                  | number in range of `1 - 65535`                                                                                                                                                                                          |
-| `port`          | proxy port **(tcp/udp)**                                                                       | `0:first_port`                                                                   | `x:y` <br><ul><li>**x**: port for `go-proxy` to listen on.<br>**x** can be 0, which means listen on a random port</li><li>**y**: port or [_service name_](../src/common/constants.go#L55) of target container</li></ul> |
-| `no_tls_verify` | whether skip tls verify **(https only)**                                                       | `false`                                                                          | boolean                                                                                                                                                                                                                 |
-| `path_patterns` | proxy path patterns **(http/s only)**<br> only requests that matched a pattern will be proxied | `/` **(proxy all requests)**                                                     | yaml style list[<sup>1</sup>](#list-example) of ([path patterns](https://pkg.go.dev/net/http#hdr-Patterns-ServeMux))                                                                                                    |
-
-
-[🔼Back to top](#table-of-content)
-
-#### Key-value mapping example
-
-Docker Compose
-
-```yaml
-services:
-  nginx:
-    ...
-    labels:
-      proxy.nginx.middlewares.modify_request.set_headers: | # remember to add the '|'
-        X-Custom-Header1: value1, value2
-        X-Custom-Header2: value3, value4
-```
-
-File Provider
-
-```yaml
-service_a:
-    host: service_a.internal
-    middlewares:
-        modify_request:
-            set_headers:
-                X-Custom-Header1: value1, value2
-                X-Custom-Header2: value3
-```
-
-[🔼Back to top](#table-of-content)
-
-#### List example
-
-Docker Compose
-
-```yaml
-services:
-  nginx:
-    ...
-    labels:
-      proxy.nginx.path_patterns: | # remember to add the '|'
-        - GET /
-        - POST /auth
-      proxy.nginx.middlewares.modify_request.hide_headers: | # remember to add the '|'
-        - X-Custom-Header1
-        - X-Custom-Header2
-```
-
-Include file
-
-```yaml
-service_a:
-    host: service_a.internal
-    path_patterns:
-        - GET /
-        - POST /auth
-    middlewares:
-        modify_request:
-            hide_headers:
-                - X-Custom-Header1
-                - X-Custom-Header2
-```
-
-[🔼Back to top](#table-of-content)
-
-## Troubleshooting
-
-   Container not showing up in proxies list
-
-    Please check that either `ports` or label `proxy.<alias>.port` is declared, e.g.
-
-    ```yaml
-    services:
-      nginx-1: # Option 1
-        ...
-        ports:
-          - 80
-      nginx-2: # Option 2
-        ...
-        container_name: nginx-2
-        network_mode: host
-        labels:
-          proxy.nginx-2.port: 80
-    ```
-
-   Firewall issues
-
-    If you are using `ufw` with vpn that drop all inbound traffic except vpn, run below:
-
-    `sudo ufw allow from 172.16.0.0/16 to 100.64.0.0/10`
-
-    Explaination:
-
-    Docker network is usually `172.16.0.0/16`
-
-    Tailscale is used as an example, `100.64.0.0/10` will be the CIDR
-
-    You can also list CIDRs of all docker bridge networks by:
-
-    `docker network inspect $(docker network ls | awk '$3 == "bridge" { print $1}') | jq -r '.[] | .Name + " " + .IPAM.Config[0].Subnet' -`
-
-[🔼Back to top](#table-of-content)
-
-## Docker compose examples
-
-More examples in [here](examples/)
-
-```yaml
-volumes:
-    adg-work:
-    adg-conf:
-    mc-data:
-    palworld:
-    nginx:
-services:
-    adg:
-        image: adguard/adguardhome
-        restart: unless-stopped
-        labels:
-            - proxy.aliases=adg,adg-dns,adg-setup
-            - proxy.#1.port=80
-            - proxy.#2.scheme=udp
-            - proxy.#2.port=20000:dns
-            - proxy.#3.port=3000
-        volumes:
-            - adg-work:/opt/adguardhome/work
-            - adg-conf:/opt/adguardhome/conf
-        ports:
-            - 80
-            - 3000
-            - 53/udp
-    mc:
-        image: itzg/minecraft-server
-        tty: true
-        stdin_open: true
-        container_name: mc
-        restart: unless-stopped
-        ports:
-            - 25565
-        labels:
-            - proxy.mc.port=20001:25565
-        environment:
-            - EULA=TRUE
-        volumes:
-            - mc-data:/data
-    palworld:
-        image: thijsvanloef/palworld-server-docker:latest
-        restart: unless-stopped
-        container_name: pal
-        stop_grace_period: 30s
-        ports:
-            - 8211/udp
-            - 27015/udp
-        labels:
-            - proxy.aliases=pal1,pal2
-            - proxy.*.scheme=udp
-            - proxy.#1.port=20002:8211
-            - proxy.#2.port=20003:27015
-        environment: ...
-        volumes:
-            - palworld:/palworld
-    nginx:
-        image: nginx
-        container_name: nginx
-        volumes:
-            - nginx:/usr/share/nginx/html
-        ports:
-            - 80
-        labels:
-            proxy.idle_timeout: 1m
-    go-proxy:
-        image: ghcr.io/yusing/go-proxy:latest
-        container_name: go-proxy
-        restart: always
-        network_mode: host
-        volumes:
-            - ./config:/app/config
-            - /var/run/docker.sock:/var/run/docker.sock
-    go-proxy-frontend:
-        image: ghcr.io/yusing/go-proxy-frontend:latest
-        container_name: go-proxy-frontend
-        restart: unless-stopped
-        network_mode: host
-        labels:
-            - proxy.aliases=gp
-            - proxy.gp.port=3000
-        depends_on:
-            - go-proxy
-```
-
-[🔼Back to top](#table-of-content)
-
-### Services URLs for above examples
-
-   `gp.yourdomain.com`: go-proxy web panel
-   `adg-setup.yourdomain.com`: adguard setup (first time setup)
-   `adg.yourdomain.com`: adguard dashboard
-   `nginx.yourdomain.com`: nginx
-   `yourdomain.com:2000`: adguard dns (udp)
-   `yourdomain.com:20001`: minecraft server
-   `yourdomain.com:20002`: palworld server
-
-[🔼Back to top](#table-of-content)
--- a/docs/docker_socket_proxy.md
+++ b/docs/docker_socket_proxy.md
@@ -1,40 +0,0 @@
-## Docker Socket Proxy
-
-For docker client on other machine, set this up, then add `name: tcp://<machine_ip>:2375` to `config.yml` under `docker` section
-
-```yml
-# compose.yml on remote machine (e.g. server1)
-docker-proxy:
-  container_name: docker-proxy
-  image: tecnativa/docker-socket-proxy
-  privileged: true
-  environment:
-    - ALLOW_START=1
-    - ALLOW_STOP=1
-    - ALLOW_RESTARTS=1
-    - CONTAINERS=1
-    - EVENTS=1
-    - PING=1
-    - POST=1
-    - VERSION=1
-  volumes:
-    - /var/run/docker.sock:/var/run/docker.sock
-  restart: always
-  ports:
-    - 2375:2375
-    # or more secure
-    - <machine_private_ip>:2375:2375
-```
-
-```yml
-# config.yml on go-proxy machine
-autocert:
-  ... # your config
-
-providers:
-  include:
-    ...
-  docker:
-    ...
-    server1: tcp://<machine_ip>:2375
-```
--- a/docs/middlewares.md
+++ b/docs/middlewares.md
@@ -1,333 +0,0 @@
-# Middlewares
-
-## Table of content
-
-<!-- TOC -->
-
- [Middlewares](#middlewares)
-  - [Table of content](#table-of-content)
-  - [Available middlewares](#available-middlewares)
-    - [Redirect http](#redirect-http)
-    - [Custom error pages](#custom-error-pages)
-    - [Modify request or response](#modify-request-or-response)
-      - [Set headers](#set-headers)
-      - [Add headers](#add-headers)
-      - [Hide headers](#hide-headers)
-    - [X-Forwarded-\* Headers](#x-forwarded--headers)
-      - [Add X-Forwarded-\*](#add-x-forwarded-)
-      - [Set X-Forwarded-\*](#set-x-forwarded-)
-    - [Forward Authorization header (experimental)](#forward-authorization-header-experimental)
-  - [Examples](#examples)
-    - [Authentik (untested, experimental)](#authentik-untested-experimental)
-
-<!-- TOC -->
-
-## Available middlewares
-
-### Redirect http
-
-Redirect http requests to https
-
-```yaml
-# docker labels
-proxy.app1.middlewares.redirect_http:
-
-# include file
-app1:
-  middlewares:
-    redirect_http:
-```
-
-nginx equivalent:
-```nginx
-server {
-    listen 80;
-    server_name domain.tld;
-    return 301 https://$host$request_uri;
-}
-```
-
-[🔼Back to top](#table-of-content)
-
-### Custom error pages
-
-To enable custom error pages, mount a folder containing your `html`, `js`, `css` files to `/app/error_pages` of _go-proxy_ container **(subfolders are ignored, please place all files in root directory)**
-
-Any path under `error_pages` directory (e.g. `href` tag), should starts with `/$gperrorpage/`
-
-Example:
-```html
-<html>
-<head>
-    <title>404 Not Found</title>
-    <link type="text/css" rel="stylesheet" href="/$gperrorpage/style.css" />
-</head>
-<body>
-    ...
-</body>
-</html>
-```
-
-Hot-reloading is **supported**, you can **edit**, **rename** or **delete** files **without restarting**. Changes will be reflected after page reload
-
-Error page will be served if:
-
- route does not exist or domain does not match any of `match_domains`
-
-or 
-
- status code is not in range of 200 to 300, and
- content type is `text/html`, `application/xhtml+xml` or `text/plain`
-
-Error page will be served:
-
- from file `<statusCode>.html` if exists
- otherwise from `404.html`
- if they don't exist, original response will be served
-
-```yaml
-# docker labels
-proxy.app1.middlewares.custom_error_page:
-
-# include file
-app1:
-  middlewares:
-    custom_error_page:
-```
-
-nginx equivalent:
-```nginx
-location / {
-    try_files $uri $uri/ /error_pages/404.html =404;
-}
-```
-
-[🔼Back to top](#table-of-content)
-
-### Modify request or response
-
-```yaml
-# docker labels
-proxy.app1.middlewares.modify_request.field:
-proxy.app1.middlewares.modify_response.field:
-
-# include file
-app1:
-  middlewares:
-    modify_request:
-      field:
-    modify_response:
-      field:
-```
-
-#### Set headers
-
-```yaml
-# docker labels
-proxy.app1.middlewares.modify_request.set_headers: |
-  X-Custom-Header1: value1, value2
-  X-Custom-Header2: value3
-
-# include file
-app1:
-  middlewares:
-    modify_request:
-      set_headers:
-        X-Custom-Header1: value1, value2
-        X-Custom-Header2: value3
-```
-
-nginx equivalent:
-```nginx
-location / {
-    add_header X-Custom-Header1 value1, value2;
-    add_header X-Custom-Header2 value3;
-}
-```
-
-[🔼Back to top](#table-of-content)
-
-#### Add headers
-
-```yaml
-# docker labels
-proxy.app1.middlewares.modify_request.add_headers: |
-  X-Custom-Header1: value1, value2
-  X-Custom-Header2: value3
-
-# include file
-app1:
-  middlewares:
-    modify_request:
-      add_headers:
-        X-Custom-Header1: value1, value2
-        X-Custom-Header2: value3
-```
-
-nginx equivalent:
-```nginx
-location / {
-    more_set_headers "X-Custom-Header1: value1, value2";
-    more_set_headers "X-Custom-Header2: value3";
-}
-```
-
-[🔼Back to top](#table-of-content)
-
-#### Hide headers
-
-```yaml
-# docker labels
-proxy.app1.middlewares.modify_request.hide_headers: |
-  - X-Custom-Header1
-  - X-Custom-Header2
-
-# include file
-app1:
-  middlewares:
-    modify_request:
-      hide_headers:
-        - X-Custom-Header1
-        - X-Custom-Header2
-```
-
-nginx equivalent:
-```nginx
-location / {
-    more_clear_headers "X-Custom-Header1";
-    more_clear_headers "X-Custom-Header2";
-}
-```
-
-### X-Forwarded-* Headers
-
-#### Add X-Forwarded-*
-
-Append `X-Forwarded-*` headers to existing headers
-
-```yaml
-# docker labels
-proxy.app1.middlewares.modify_request.add_x_forwarded:
-
-# include file
-app1:
-  middlewares:
-    modify_request:
-      add_x_forwarded:
-```
-
-#### Set X-Forwarded-*
-
-Replace existing `X-Forwarded-*` headers with `go-proxy` provided headers
-
-```yaml
-# docker labels
-proxy.app1.middlewares.modify_request.set_x_forwarded:
-
-# include file
-app1:
-  middlewares:
-    modify_request:
-      set_x_forwarded:
-```
-
-[🔼Back to top](#table-of-content)
-
-### Forward Authorization header (experimental)
-
-Fields:
- `address`: authentication provider URL _(required)_
- `trust_forward_header`: whether to trust `X-Forwarded-*` headers from upstream proxies _(default: `false`)_
- `auth_response_headers`: list of headers to copy from auth response _(default: empty)_
- `add_auth_cookies_to_response`: list of cookies to add to response _(default: empty)_
-
-```yaml
-# docker labels
-proxy.app1.middlewares.forward_auth.address: https://auth.example.com
-proxy.app1.middlewares.forward_auth.trust_forward_header: true
-proxy.app1.middlewares.forward_auth.auth_response_headers: |
-  - X-Auth-Token
-  - X-Auth-User
-proxy.app1.middlewares.forward_auth.add_auth_cookies_to_response: |
-  - uid
-  - session_id
-
-# include file
-app1:
-  middlewares:
-    forward_authorization:
-        address: https://auth.example.com
-        trust_forward_header: true
-        auth_response_headers:
-            - X-Auth-Token
-            - X-Auth-User
-        add_auth_cookies_to_response:
-            - uid
-            - session_id
-```
-
-Traefik equivalent:
-```yaml
-# docker labels
-traefik.http.middlewares.authentik.forwardauth.address: https://auth.example.com
-traefik.http.middlewares.authentik.forwardauth.trustForwardHeader: true
-traefik.http.middlewares.authentik.forwardauth.authResponseHeaders: X-Auth-Token, X-Auth-User
-traefik.http.middlewares.authentik.forwardauth.addAuthCookiesToResponse: uid, session_id
-
-# standalone
-http:
-  middlewares:
-    forwardAuth:
-        address: https://auth.example.com
-        trustForwardHeader: true
-        authResponseHeaders:
-            - X-Auth-Token
-            - X-Auth-User
-        addAuthCookiesToResponse:
-            - uid
-            - session_id
-```
-
-[🔼Back to top](#table-of-content)
-
-## Examples
-
-### Authentik (untested, experimental)
-
-```yaml
-# docker compose
-services:
-  ...
-  server:
-    ...
-    container_name: authentik
-    labels:
-      proxy.authentik.middlewares.redirect_http:
-      proxy.authentik.middlewares.set_x_forwarded:
-      proxy.authentik.middlewares.modify_request.add_headers: |
-        Strict-Transport-Security: "max-age=63072000" always
-
-  whoami:
-    image: containous/whoami
-    container_name: whoami
-    ports:
-      - 80
-    labels:
-      proxy.#1.middlewares.forward_auth.address: https://your_authentik_forward_address
-      proxy.#1.middlewares.forward_auth.trustForwardHeader: true
-      proxy.#1.middlewares.forward_auth.authResponseHeaders: |
-        - X-authentik-username
-        - X-authentik-groups
-        - X-authentik-email
-        - X-authentik-name
-        - X-authentik-uid
-        - X-authentik-jwt
-        - X-authentik-meta-jwks
-        - X-authentik-meta-outpost
-        - X-authentik-meta-provider
-        - X-authentik-meta-app
-        - X-authentik-meta-version
-    restart: unless-stopped
-```
-
-[🔼Back to top](#table-of-content)
--- a/examples/microbin.yml
+++ b/examples/microbin.yml
@@ -7,7 +7,7 @@ services:
        limits:
          memory: 256M
    env_file: .env
-    image: docker.i.sh/danielszabo99/microbin:latest
+    image: danielszabo99/microbin:latest
    ports:
      - 8080
    restart: unless-stopped
--- a/go.mod
+++ b/go.mod
@@ -1,23 +1,27 @@
 module github.com/yusing/go-proxy

-go 1.23.1
+go 1.23.2

 require (
+	github.com/coder/websocket v1.8.12
 	github.com/docker/cli v27.3.1+incompatible
 	github.com/docker/docker v27.3.1+incompatible
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/go-acme/lego/v4 v4.18.0
+	github.com/go-acme/lego/v4 v4.19.2
+	github.com/golang-jwt/jwt/v5 v5.2.1
+	github.com/gotify/server/v2 v2.5.0
 	github.com/puzpuzpuz/xsync/v3 v3.4.0
+	github.com/rs/zerolog v1.33.0
 	github.com/santhosh-tekuri/jsonschema v1.2.4
-	github.com/sirupsen/logrus v1.9.3
-	golang.org/x/net v0.29.0
+	golang.org/x/net v0.30.0
+	golang.org/x/text v0.19.0
 	gopkg.in/yaml.v3 v3.0.1
 )

 require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
-	github.com/cloudflare/cloudflare-go v0.106.0 // indirect
+	github.com/cloudflare/cloudflare-go v0.108.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
@@ -30,6 +34,8 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/miekg/dns v1.1.62 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/term v0.5.0 // indirect
@@ -38,21 +44,21 @@ require (
 	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/ovh/go-ovh v1.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/rogpeppe/go-internal v1.12.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.55.0 // indirect
-	go.opentelemetry.io/otel v1.30.0 // indirect
+	github.com/rogpeppe/go-internal v1.13.1 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 // indirect
+	go.opentelemetry.io/otel v1.31.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 // indirect
-	go.opentelemetry.io/otel/metric v1.30.0 // indirect
+	go.opentelemetry.io/otel/metric v1.31.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.30.0 // indirect
-	go.opentelemetry.io/otel/trace v1.30.0 // indirect
-	golang.org/x/crypto v0.27.0 // indirect
+	go.opentelemetry.io/otel/trace v1.31.0 // indirect
+	golang.org/x/crypto v0.28.0 // indirect
 	golang.org/x/mod v0.21.0 // indirect
 	golang.org/x/oauth2 v0.23.0 // indirect
 	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
-	golang.org/x/text v0.18.0 // indirect
-	golang.org/x/time v0.6.0 // indirect
-	golang.org/x/tools v0.25.0 // indirect
+	golang.org/x/sys v0.26.0 // indirect
+	golang.org/x/time v0.7.0 // indirect
+	golang.org/x/tools v0.26.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gotest.tools/v3 v3.5.1 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -4,14 +4,18 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/cloudflare/cloudflare-go v0.106.0 h1:q41gC5Wc1nfi0D1ZhSHokWcd9mGMbqC7RE7qiP+qE00=
-github.com/cloudflare/cloudflare-go v0.106.0/go.mod h1:pfUQ4PIG4ISI0/Mmc21Bp86UnFU0ktmPf3iTgbSL+cM=
+github.com/cloudflare/cloudflare-go v0.108.0 h1:C4Skfjd8I8X3uEOGmQUT4/iGyZcWdkIU7HwvMoLkEE0=
+github.com/cloudflare/cloudflare-go v0.108.0/go.mod h1:m492eNahT/9MsN7Ppnoge8AaI7QhVFtEgVm3I9HJFeU=
+github.com/coder/websocket v1.8.12 h1:5bUXkEPPIbewrnkU8LTCLVaxi4N4J8ahufH2vlo4NAo=
+github.com/coder/websocket v1.8.12/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/docker/cli v27.3.1+incompatible h1:qEGdFBF3Xu6SCvCYhc7CzaQTlBmqDuzxPDpigSyeKQQ=
@@ -26,8 +30,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/go-acme/lego/v4 v4.18.0 h1:2hH8KcdRBSb+p5o9VZIm61GAOXYALgILUCSs1Q+OYsk=
-github.com/go-acme/lego/v4 v4.18.0/go.mod h1:Blkg3izvXpl3zxk7WKngIuwR2I/hvYVP3vRnvgBp7m8=
+github.com/go-acme/lego/v4 v4.19.2 h1:Y8hrmMvWETdqzzkRly7m98xtPJJivWFsgWi8fcvZo+Y=
+github.com/go-acme/lego/v4 v4.19.2/go.mod h1:wtDe3dDkmV4/oI2nydpNXSJpvV10J9RCyZ6MbYxNtlQ=
 github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
 github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -37,8 +41,11 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
 github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -46,6 +53,8 @@ github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gotify/server/v2 v2.5.0 h1:tJd+a5bb17X52f0EV2KxqLuyjQFKmVK1+t/iNUkP16Y=
+github.com/gotify/server/v2 v2.5.0/go.mod h1:DKPMQI/FZ69iKbZvrOL6VWwRaoB9O+HDvJWVd/kiGbc=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1NhHmEPPzzuhWgcza5M1Ji1I=
 github.com/jarcoal/httpmock v1.3.0 h1:2RJ8GP0IIaWwcC9Fp2BmVi8Kog3v2Hn7VXM3fTd+nuc=
@@ -56,6 +65,12 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/maxatome/go-testdeep v1.12.0 h1:Ql7Go8Tg0C1D/uMMX59LAoYK7LffeJQ6X2T04nTH68g=
 github.com/maxatome/go-testdeep v1.12.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM=
 github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
@@ -75,13 +90,17 @@ github.com/ovh/go-ovh v1.6.0/go.mod h1:cTVDnl94z4tl8pP1uZ/8jlVxntjSIf09bNcQ5TJSC
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/puzpuzpuz/xsync/v3 v3.4.0 h1:DuVBAdXuGFHv8adVXjWWZ63pJq+NRXOWVXlKDBZ+mJ4=
 github.com/puzpuzpuz/xsync/v3 v3.4.0/go.mod h1:VjzYrABPabuM4KyBh1Ftq6u8nhwY5tBPKP9jpmh0nnA=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8=
+github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
 github.com/santhosh-tekuri/jsonschema v1.2.4 h1:hNhW8e7t+H1vgY+1QeEQpveR6D4+OwKPXCfD2aieJis=
 github.com/santhosh-tekuri/jsonschema v1.2.4/go.mod h1:TEAUOeZSmIxTTuHatJzrvARHiuO9LYd+cIxzgEHCQI4=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
@@ -92,27 +111,27 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.55.0 h1:ZIg3ZT/aQ7AfKqdwp7ECpOK6vHqquXXuyTjIO8ZdmPs=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.55.0/go.mod h1:DQAwmETtZV00skUwgD6+0U89g80NKsJE3DCKeLLPQMI=
-go.opentelemetry.io/otel v1.30.0 h1:F2t8sK4qf1fAmY9ua4ohFS/K+FUuOPemHUIXHtktrts=
-go.opentelemetry.io/otel v1.30.0/go.mod h1:tFw4Br9b7fOS+uEao81PJjVMjW/5fvNCbpsDIXqP0pc=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 h1:UP6IpuHFkUgOQL9FFQFrZ+5LiwhhYRbi7VZSIx6Nj5s=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0/go.mod h1:qxuZLtbq5QDtdeSHsS7bcf6EH6uO6jUAgk764zd3rhM=
+go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
+go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0 h1:lsInsfvhVIfOI6qHVyysXMNDnjO9Npvl7tlDPJFBVd4=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0/go.mod h1:KQsVNh4OjgjTG0G6EiNi1jVpnaeeKsKMRwbLN+f1+8M=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 h1:umZgi92IyxfXd/l4kaDhnKgY8rnN/cZcF1LKc6I8OQ8=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0/go.mod h1:4lVs6obhSVRb1EW5FhOuBTyiQhtRtAnnva9vD3yRfq8=
-go.opentelemetry.io/otel/metric v1.30.0 h1:4xNulvn9gjzo4hjg+wzIKG7iNFEaBMX00Qd4QIZs7+w=
-go.opentelemetry.io/otel/metric v1.30.0/go.mod h1:aXTfST94tswhWEb+5QjlSqG+cZlmyXy/u8jFpor3WqQ=
+go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
+go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
 go.opentelemetry.io/otel/sdk v1.30.0 h1:cHdik6irO49R5IysVhdn8oaiR9m8XluDaJAs4DfOrYE=
 go.opentelemetry.io/otel/sdk v1.30.0/go.mod h1:p14X4Ok8S+sygzblytT1nqG98QG2KYKv++HE0LY/mhg=
-go.opentelemetry.io/otel/trace v1.30.0 h1:7UBkkYzeg3C7kQX8VAidWh2biiQbtAKjyIML8dQ9wmc=
-go.opentelemetry.io/otel/trace v1.30.0/go.mod h1:5EyKqTzzmyqB9bwtCCq6pDLktPK6fmGf/Dph+8VI02o=
+go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
+go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
 go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
 go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
-golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
+golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
@@ -121,8 +140,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
-golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
+golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
+golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
 golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
 golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -134,25 +153,28 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
-golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
+golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
-golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
-golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
-golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
+golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
+golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.25.0 h1:oFU9pkj/iJgs+0DT+VMHrx+oBKs/LJMV+Uvg78sl+fE=
-golang.org/x/tools v0.25.0/go.mod h1:/vtpO8WL1N9cQC3FN5zPqb//fRXskFHbLKk4OW1Q7rg=
+golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
+golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de h1:F6qOa9AZTYJXOUEr4jDysRDLrm4PHePlge4v4TGAlxY=
+google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1 h1:BulPr26Jqjnd4eYDVe+YvyR7Yc2vJGkO5/0UxD0/jZU=
 google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 h1:hjSy6tcFQZ171igDaN5QHOw2n6vx40juYbC/x67CEhc=
 google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:qpvKtACPCQhAdu3PyQgV4l3LMXZEtft7y8QcarRsp9I=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1:pPJltXNxVzT4pK9yD8vR9X75DaWYYmLGMsEvBfFQZzQ=
--- a/internal/api/handler.go
+++ b/internal/api/handler.go
@@ -2,10 +2,11 @@ package api

 import (
 	"fmt"
+	"net"
 	"net/http"

 	v1 "github.com/yusing/go-proxy/internal/api/v1"
-	"github.com/yusing/go-proxy/internal/api/v1/error_page"
+	"github.com/yusing/go-proxy/internal/api/v1/auth"
 	. "github.com/yusing/go-proxy/internal/api/v1/utils"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/config"
@@ -21,30 +22,38 @@ func (mux ServeMux) HandleFunc(method, endpoint string, handler http.HandlerFunc
 	mux.ServeMux.HandleFunc(fmt.Sprintf("%s %s", method, endpoint), checkHost(handler))
 }

-func NewHandler(cfg *config.Config) http.Handler {
+func NewHandler() http.Handler {
 	mux := NewServeMux()
 	mux.HandleFunc("GET", "/v1", v1.Index)
-	mux.HandleFunc("GET", "/v1/checkhealth", wrap(cfg, v1.CheckHealth))
-	mux.HandleFunc("HEAD", "/v1/checkhealth", wrap(cfg, v1.CheckHealth))
-	mux.HandleFunc("POST", "/v1/reload", wrap(cfg, v1.Reload))
-	mux.HandleFunc("GET", "/v1/list", wrap(cfg, v1.List))
-	mux.HandleFunc("GET", "/v1/list/{what}", wrap(cfg, v1.List))
-	mux.HandleFunc("GET", "/v1/file", v1.GetFileContent)
-	mux.HandleFunc("GET", "/v1/file/{filename}", v1.GetFileContent)
-	mux.HandleFunc("POST", "/v1/file/{filename}", v1.SetFileContent)
-	mux.HandleFunc("PUT", "/v1/file/{filename}", v1.SetFileContent)
-	mux.HandleFunc("GET", "/v1/stats", wrap(cfg, v1.Stats))
-	mux.HandleFunc("GET", "/v1/error_page", error_page.GetHandleFunc())
+	mux.HandleFunc("GET", "/v1/version", v1.GetVersion)
+	// mux.HandleFunc("GET", "/v1/checkhealth", v1.CheckHealth)
+	// mux.HandleFunc("HEAD", "/v1/checkhealth", v1.CheckHealth)
+	mux.HandleFunc("POST", "/v1/login", auth.LoginHandler)
+	mux.HandleFunc("GET", "/v1/logout", auth.LogoutHandler)
+	mux.HandleFunc("POST", "/v1/logout", auth.LogoutHandler)
+	mux.HandleFunc("POST", "/v1/reload", v1.Reload)
+	mux.HandleFunc("GET", "/v1/list", auth.RequireAuth(v1.List))
+	mux.HandleFunc("GET", "/v1/list/{what}", auth.RequireAuth(v1.List))
+	mux.HandleFunc("GET", "/v1/list/{what}/{which}", auth.RequireAuth(v1.List))
+	mux.HandleFunc("GET", "/v1/file", auth.RequireAuth(v1.GetFileContent))
+	mux.HandleFunc("GET", "/v1/file/{filename...}", auth.RequireAuth(v1.GetFileContent))
+	mux.HandleFunc("POST", "/v1/file/{filename...}", auth.RequireAuth(v1.SetFileContent))
+	mux.HandleFunc("PUT", "/v1/file/{filename...}", auth.RequireAuth(v1.SetFileContent))
+	mux.HandleFunc("GET", "/v1/stats", v1.Stats)
+	mux.HandleFunc("GET", "/v1/stats/ws", v1.StatsWS)
 	return mux
 }

-// allow only requests to API server with host matching common.APIHTTPAddr
+// allow only requests to API server with localhost.
 func checkHost(f http.HandlerFunc) http.HandlerFunc {
+	if common.IsDebug {
+		return f
+	}
 	return func(w http.ResponseWriter, r *http.Request) {
-		if r.Host != common.APIHTTPAddr {
-			Logger.Warnf("invalid request to API server with host: %s, expect %s", r.Host, common.APIHTTPAddr)
-			w.WriteHeader(http.StatusNotFound)
-			w.Write([]byte("invalid request"))
+		host, _, _ := net.SplitHostPort(r.RemoteAddr)
+		if host != "127.0.0.1" && host != "localhost" && host != "[::1]" {
+			LogWarn(r).Msgf("blocked API request from %s", host)
+			http.Error(w, "forbidden", http.StatusForbidden)
 			return
 		}
 		f(w, r)
--- a/internal/api/v1/auth/auth.go
+++ b/internal/api/v1/auth/auth.go
@@ -0,0 +1,139 @@
+package auth
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type (
+	Credentials struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	}
+	Claims struct {
+		Username string `json:"username"`
+		jwt.RegisteredClaims
+	}
+)
+
+var (
+	ErrInvalidUsername = E.New("invalid username")
+	ErrInvalidPassword = E.New("invalid password")
+)
+
+const tokenExpiration = 24 * time.Hour
+
+const jwtClaimKeyUsername = "username"
+
+func validatePassword(cred *Credentials) error {
+	if cred.Username != common.APIUser {
+		return ErrInvalidUsername.Subject(cred.Username)
+	}
+	if !bytes.Equal(common.HashPassword(cred.Password), common.APIPasswordHash) {
+		return ErrInvalidPassword.Subject(cred.Password)
+	}
+	return nil
+}
+
+func LoginHandler(w http.ResponseWriter, r *http.Request) {
+	var creds Credentials
+	err := json.NewDecoder(r.Body).Decode(&creds)
+	if err != nil {
+		U.HandleErr(w, r, err, http.StatusBadRequest)
+		return
+	}
+	if err := validatePassword(&creds); err != nil {
+		U.HandleErr(w, r, err, http.StatusUnauthorized)
+		return
+	}
+
+	expiresAt := time.Now().Add(tokenExpiration)
+	claim := &Claims{
+		Username: creds.Username,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS512, claim)
+	tokenStr, err := token.SignedString(common.APIJWTSecret)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:     "token",
+		Value:    tokenStr,
+		Expires:  expiresAt,
+		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
+		Path:     "/",
+	})
+	w.WriteHeader(http.StatusOK)
+}
+
+func LogoutHandler(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     "token",
+		Value:    "",
+		Expires:  time.Unix(0, 0),
+		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
+		Path:     "/",
+	})
+	w.Header().Set("location", "/login")
+	w.WriteHeader(http.StatusTemporaryRedirect)
+}
+
+func RequireAuth(next http.HandlerFunc) http.HandlerFunc {
+	if common.IsDebugSkipAuth {
+		return next
+	}
+
+	return func(w http.ResponseWriter, r *http.Request) {
+		if checkToken(w, r) {
+			next(w, r)
+		}
+	}
+}
+
+func checkToken(w http.ResponseWriter, r *http.Request) (ok bool) {
+	tokenCookie, err := r.Cookie("token")
+	if err != nil {
+		U.HandleErr(w, r, E.PrependSubject("token", err), http.StatusUnauthorized)
+		return false
+	}
+	var claims Claims
+	token, err := jwt.ParseWithClaims(tokenCookie.Value, &claims, func(t *jwt.Token) (interface{}, error) {
+		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("Unexpected signing method: %v", t.Header["alg"])
+		}
+		return common.APIJWTSecret, nil
+	})
+
+	switch {
+	case err != nil:
+		break
+	case !token.Valid:
+		err = E.New("invalid token")
+	case claims.Username != common.APIUser:
+		err = E.New("username mismatch").Subject(claims.Username)
+	case claims.ExpiresAt.Before(time.Now()):
+		err = E.Errorf("token expired on %s", strutils.FormatTime(claims.ExpiresAt.Time))
+	}
+
+	if err != nil {
+		U.HandleErr(w, r, err, http.StatusForbidden)
+		return false
+	}
+
+	return true
+}
--- a/internal/api/v1/checkhealth.go
+++ b/internal/api/v1/checkhealth.go
@@ -1,42 +1,28 @@
 package v1

 import (
-	"fmt"
 	"net/http"
-	"strings"

-	U "github.com/yusing/go-proxy/internal/api/v1/utils"
-	"github.com/yusing/go-proxy/internal/config"
-	R "github.com/yusing/go-proxy/internal/route"
+	. "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/watcher/health"
 )

-func CheckHealth(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
+func CheckHealth(w http.ResponseWriter, r *http.Request) {
 	target := r.FormValue("target")
 	if target == "" {
-		U.HandleErr(w, r, U.ErrMissingKey("target"), http.StatusBadRequest)
+		HandleErr(w, r, ErrMissingKey("target"), http.StatusBadRequest)
 		return
 	}

-	var ok bool
-	route := cfg.FindRoute(target)
-
-	switch {
-	case route == nil:
-		U.HandleErr(w, r, U.ErrNotFound("target", target), http.StatusNotFound)
+	result, ok := health.Inspect(target)
+	if !ok {
+		HandleErr(w, r, ErrNotFound("target", target), http.StatusNotFound)
 		return
-	case route.Type() == R.RouteTypeReverseProxy:
-		ok = U.IsSiteHealthy(route.URL().String())
-	case route.Type() == R.RouteTypeStream:
-		entry := route.Entry()
-		ok = U.IsStreamHealthy(
-			strings.Split(entry.Scheme, ":")[1], // target scheme
-			fmt.Sprintf("%s:%v", entry.Host, strings.Split(entry.Port, ":")[1]),
-		)
 	}
-
-	if ok {
-		w.WriteHeader(http.StatusOK)
-	} else {
-		w.WriteHeader(http.StatusRequestTimeout)
+	json, err := result.MarshalJSON()
+	if err != nil {
+		HandleErr(w, r, err)
+		return
 	}
+	RespondJSON(w, r, json)
 }
--- a/internal/api/v1/error_page/http_handler.go
+++ b/internal/api/v1/error_page/http_handler.go
@@ -1,25 +0,0 @@
-package error_page
-
-import "net/http"
-
-func GetHandleFunc() http.HandlerFunc {
-	setup()
-	return serveHTTP
-}
-
-func serveHTTP(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-	if r.URL.Path == "/" {
-		http.Error(w, "invalid path", http.StatusNotFound)
-		return
-	}
-	content, ok := fileContentMap.Load(r.URL.Path)
-	if !ok {
-		http.Error(w, "404 not found", http.StatusNotFound)
-		return
-	}
-	w.Write(content)
-}
--- a/internal/api/v1/file.go
+++ b/internal/api/v1/file.go
@@ -5,12 +5,13 @@ import (
 	"net/http"
 	"os"
 	"path"
+	"strings"

 	U "github.com/yusing/go-proxy/internal/api/v1/utils"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/config"
 	E "github.com/yusing/go-proxy/internal/error"
-	"github.com/yusing/go-proxy/internal/proxy/provider"
+	"github.com/yusing/go-proxy/internal/route/provider"
 )

 func GetFileContent(w http.ResponseWriter, r *http.Request) {
@@ -23,7 +24,7 @@ func GetFileContent(w http.ResponseWriter, r *http.Request) {
 		U.HandleErr(w, r, err)
 		return
 	}
-	w.Write(content)
+	U.WriteBody(w, content)
 }

 func SetFileContent(w http.ResponseWriter, r *http.Request) {
@@ -38,19 +39,20 @@ func SetFileContent(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	var validateErr E.NestedError
+	var valErr E.Error
 	if filename == common.ConfigFileName {
-		validateErr = config.Validate(content)
-	} else {
-		validateErr = provider.Validate(content)
+		valErr = config.Validate(content)
+	} else if !strings.HasPrefix(filename, path.Base(common.MiddlewareComposeBasePath)) {
+		valErr = provider.Validate(content)
 	}
+	// no validation for include files

-	if validateErr != nil {
-		U.RespondJson(w, validateErr.JSONObject(), http.StatusBadRequest)
+	if valErr != nil {
+		U.RespondJSON(w, r, valErr, http.StatusBadRequest)
 		return
 	}

-	err = os.WriteFile(path.Join(common.ConfigBasePath, filename), content, 0644)
+	err = os.WriteFile(path.Join(common.ConfigBasePath, filename), content, 0o644)
 	if err != nil {
 		U.HandleErr(w, r, err)
 		return
--- a/internal/api/v1/index.go
+++ b/internal/api/v1/index.go
@@ -1,7 +1,11 @@
 package v1

-import "net/http"
+import (
+	"net/http"
+
+	. "github.com/yusing/go-proxy/internal/api/v1/utils"
+)

 func Index(w http.ResponseWriter, r *http.Request) {
-	w.Write([]byte("API ready"))
+	WriteBody(w, []byte("API ready"))
 }
--- a/internal/api/v1/list.go
+++ b/internal/api/v1/list.go
@@ -1,61 +1,86 @@
 package v1

 import (
-	"encoding/json"
 	"net/http"
-	"os"
+	"strings"

 	U "github.com/yusing/go-proxy/internal/api/v1/utils"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/config"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
+	"github.com/yusing/go-proxy/internal/route"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/utils"
 )

-func List(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
+const (
+	ListRoute            = "route"
+	ListRoutes           = "routes"
+	ListConfigFiles      = "config_files"
+	ListMiddlewares      = "middlewares"
+	ListMiddlewareTraces = "middleware_trace"
+	ListMatchDomains     = "match_domains"
+	ListHomepageConfig   = "homepage_config"
+	ListTasks            = "tasks"
+)
+
+func List(w http.ResponseWriter, r *http.Request) {
 	what := r.PathValue("what")
 	if what == "" {
-		what = "routes"
+		what = ListRoutes
 	}
+	which := r.PathValue("which")

 	switch what {
-	case "routes":
-		listRoutes(cfg, w, r)
-	case "config_files":
+	case ListRoute:
+		if route := listRoute(which); route == nil {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		} else {
+			U.RespondJSON(w, r, route)
+		}
+	case ListRoutes:
+		U.RespondJSON(w, r, config.RoutesByAlias(route.RouteType(r.FormValue("type"))))
+	case ListConfigFiles:
 		listConfigFiles(w, r)
+	case ListMiddlewares:
+		U.RespondJSON(w, r, middleware.All())
+	case ListMiddlewareTraces:
+		U.RespondJSON(w, r, middleware.GetAllTrace())
+	case ListMatchDomains:
+		U.RespondJSON(w, r, config.Value().MatchDomains)
+	case ListHomepageConfig:
+		U.RespondJSON(w, r, config.HomepageConfig())
+	case ListTasks:
+		U.RespondJSON(w, r, task.DebugTaskMap())
 	default:
 		U.HandleErr(w, r, U.ErrInvalidKey("what"), http.StatusBadRequest)
 	}
 }

-func listRoutes(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
-	routes := cfg.RoutesByAlias()
-	typeFilter := r.FormValue("type")
-	if typeFilter != "" {
-		for k, v := range routes {
-			if v["type"] != typeFilter {
-				delete(routes, k)
-			}
-		}
+func listRoute(which string) any {
+	if which == "" {
+		which = "all"
 	}
-
-	if err := U.RespondJson(w, routes); err != nil {
-		U.HandleErr(w, r, err)
+	if which == "all" {
+		return config.RoutesByAlias()
 	}
+	routes := config.RoutesByAlias()
+	route, ok := routes[which]
+	if !ok {
+		return nil
+	}
+	return route
 }

 func listConfigFiles(w http.ResponseWriter, r *http.Request) {
-	files, err := os.ReadDir(common.ConfigBasePath)
+	files, err := utils.ListFiles(common.ConfigBasePath, 1)
 	if err != nil {
 		U.HandleErr(w, r, err)
 		return
 	}
-	filenames := make([]string, len(files))
-	for i, f := range files {
-		filenames[i] = f.Name()
+	for i := range files {
+		files[i] = strings.TrimPrefix(files[i], common.ConfigBasePath+"/")
 	}
-	resp, err := json.Marshal(filenames)
-	if err != nil {
-		U.HandleErr(w, r, err)
-		return
-	}
-	w.Write(resp)
+	U.RespondJSON(w, r, files)
 }
--- a/internal/api/v1/query/query.go
+++ b/internal/api/v1/query/query.go
@@ -0,0 +1,64 @@
+package query
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	v1 "github.com/yusing/go-proxy/internal/api/v1"
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
+)
+
+func ReloadServer() E.Error {
+	resp, err := U.Post(fmt.Sprintf("%s/v1/reload", common.APIHTTPURL), "", nil)
+	if err != nil {
+		return E.From(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		failure := E.Errorf("server reload status %v", resp.StatusCode)
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return failure.With(err)
+		}
+		reloadErr := string(body)
+		return failure.Withf(reloadErr)
+	}
+	return nil
+}
+
+func List[T any](what string) (_ T, outErr E.Error) {
+	resp, err := U.Get(fmt.Sprintf("%s/v1/list/%s", common.APIHTTPURL, what))
+	if err != nil {
+		outErr = E.From(err)
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		outErr = E.Errorf("list %s: failed, status %v", what, resp.StatusCode)
+		return
+	}
+	var res T
+	err = json.NewDecoder(resp.Body).Decode(&res)
+	if err != nil {
+		outErr = E.From(err)
+		return
+	}
+	return res, nil
+}
+
+func ListRoutes() (map[string]map[string]any, E.Error) {
+	return List[map[string]map[string]any](v1.ListRoutes)
+}
+
+func ListMiddlewareTraces() (middleware.Traces, E.Error) {
+	return List[middleware.Traces](v1.ListMiddlewareTraces)
+}
+
+func DebugListTasks() (map[string]any, E.Error) {
+	return List[map[string]any](v1.ListTasks)
+}
--- a/internal/api/v1/reload.go
+++ b/internal/api/v1/reload.go
@@ -7,10 +7,10 @@ import (
 	"github.com/yusing/go-proxy/internal/config"
 )

-func Reload(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
-	if err := cfg.Reload(); err != nil {
-		U.RespondJson(w, err.JSONObject(), http.StatusInternalServerError)
-	} else {
-		w.WriteHeader(http.StatusOK)
+func Reload(w http.ResponseWriter, r *http.Request) {
+	if err := config.Reload(); err != nil {
+		U.HandleErr(w, r, err)
+		return
 	}
+	U.WriteBody(w, []byte("OK"))
 }
--- a/internal/api/v1/stats.go
+++ b/internal/api/v1/stats.go
@@ -1,20 +1,67 @@
 package v1

 import (
+	"context"
 	"net/http"
+	"time"

+	"github.com/coder/websocket"
+	"github.com/coder/websocket/wsjson"
 	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/config"
 	"github.com/yusing/go-proxy/internal/server"
-	"github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

-func Stats(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
-	stats := map[string]any{
-		"proxies": cfg.Statistics(),
-		"uptime":  utils.FormatDuration(server.GetProxyServer().Uptime()),
+func Stats(w http.ResponseWriter, r *http.Request) {
+	U.RespondJSON(w, r, getStats())
+}
+
+func StatsWS(w http.ResponseWriter, r *http.Request) {
+	localAddresses := []string{"127.0.0.1", "10.0.*.*", "172.16.*.*", "192.168.*.*"}
+	originPats := make([]string, len(config.Value().MatchDomains)+len(localAddresses))
+
+	if len(originPats) == 0 {
+		U.LogWarn(r).Msg("no match domains configured, accepting websocket API request from all origins")
+		originPats = []string{"*"}
+	} else {
+		for i, domain := range config.Value().MatchDomains {
+			originPats[i] = "*." + domain
+		}
+		originPats = append(originPats, localAddresses...)
 	}
-	if err := U.RespondJson(w, stats); err != nil {
-		U.HandleErr(w, r, err)
+	if common.IsDebug {
+		originPats = []string{"*"}
+	}
+	conn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		OriginPatterns: originPats,
+	})
+	if err != nil {
+		U.LogError(r).Err(err).Msg("failed to upgrade websocket")
+		return
+	}
+	/* trunk-ignore(golangci-lint/errcheck) */
+	defer conn.CloseNow()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	ticker := time.NewTicker(1 * time.Second)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		stats := getStats()
+		if err := wsjson.Write(ctx, conn, stats); err != nil {
+			U.LogError(r).Msg("failed to write JSON")
+			return
+		}
+	}
+}
+
+func getStats() map[string]any {
+	return map[string]any{
+		"proxies": config.Statistics(),
+		"uptime":  strutils.FormatDuration(server.GetProxyServer().Uptime()),
 	}
 }
--- a/internal/api/v1/utils/error.go
+++ b/internal/api/v1/utils/error.go
@@ -1,34 +1,36 @@
 package utils

 import (
-	"errors"
-	"fmt"
 	"net/http"

-	"github.com/sirupsen/logrus"
 	E "github.com/yusing/go-proxy/internal/error"
 )

-var Logger = logrus.WithField("module", "api")
-
+// HandleErr logs the error and returns an HTTP error response to the client.
+// If code is specified, it will be used as the HTTP status code; otherwise,
+// http.StatusInternalServerError is used.
+//
+// The error is only logged but not returned to the client.
 func HandleErr(w http.ResponseWriter, r *http.Request, origErr error, code ...int) {
-	err := E.From(origErr).Subjectf("%s %s", r.Method, r.URL)
-	Logger.Error(err)
-	if len(code) > 0 {
-		http.Error(w, err.String(), code[0])
+	if origErr == nil {
 		return
 	}
-	http.Error(w, err.String(), http.StatusInternalServerError)
+	LogError(r).Msg(origErr.Error())
+	statusCode := http.StatusInternalServerError
+	if len(code) > 0 {
+		statusCode = code[0]
+	}
+	http.Error(w, http.StatusText(statusCode), statusCode)
 }

 func ErrMissingKey(k string) error {
-	return errors.New("missing key '" + k + "' in query or request body")
+	return E.New("missing key '" + k + "' in query or request body")
 }

 func ErrInvalidKey(k string) error {
-	return errors.New("invalid key '" + k + "' in query or request body")
+	return E.New("invalid key '" + k + "' in query or request body")
 }

 func ErrNotFound(k, v string) error {
-	return fmt.Errorf("key %q with value %q not found", k, v)
+	return E.Errorf("key %q with value %q not found", k, v)
 }
--- a/internal/api/v1/utils/health_check.go
+++ b/internal/api/v1/utils/health_check.go
@@ -1,33 +0,0 @@
-package utils
-
-import (
-	"net"
-	"net/http"
-
-	"github.com/yusing/go-proxy/internal/common"
-)
-
-func IsSiteHealthy(url string) bool {
-	// try HEAD first
-	// if HEAD is not allowed, try GET
-	resp, err := httpClient.Head(url)
-	if resp != nil {
-		resp.Body.Close()
-	}
-	if err != nil && resp != nil && resp.StatusCode == http.StatusMethodNotAllowed {
-		_, err = httpClient.Get(url)
-	}
-	if resp != nil {
-		resp.Body.Close()
-	}
-	return err == nil
-}
-
-func IsStreamHealthy(scheme, address string) bool {
-	conn, err := net.DialTimeout(scheme, address, common.DialTimeout)
-	if err != nil {
-		return false
-	}
-	conn.Close()
-	return true
-}
--- a/internal/api/v1/utils/http_client.go
+++ b/internal/api/v1/utils/http_client.go
@@ -8,16 +8,21 @@ import (
 	"github.com/yusing/go-proxy/internal/common"
 )

-var httpClient = &http.Client{
-	Timeout: common.ConnectionTimeout,
-	Transport: &http.Transport{
-		Proxy:             http.ProxyFromEnvironment,
-		DisableKeepAlives: true,
-		ForceAttemptHTTP2: true,
-		DialContext: (&net.Dialer{
-			Timeout:   common.DialTimeout,
-			KeepAlive: common.KeepAlive, // this is different from DisableKeepAlives
-		}).DialContext,
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-	},
-}
+var (
+	httpClient = &http.Client{
+		Timeout: common.ConnectionTimeout,
+		Transport: &http.Transport{
+			DisableKeepAlives: true,
+			ForceAttemptHTTP2: false,
+			DialContext: (&net.Dialer{
+				Timeout:   common.DialTimeout,
+				KeepAlive: common.KeepAlive, // this is different from DisableKeepAlives
+			}).DialContext,
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		},
+	}
+
+	Get  = httpClient.Get
+	Post = httpClient.Post
+	Head = httpClient.Head
+)
--- a/internal/api/v1/utils/localhost.go
+++ b/internal/api/v1/utils/localhost.go
@@ -1,31 +0,0 @@
-package utils
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-
-	"github.com/yusing/go-proxy/internal/common"
-	E "github.com/yusing/go-proxy/internal/error"
-)
-
-func ReloadServer() E.NestedError {
-	resp, err := httpClient.Post(fmt.Sprintf("%s/v1/reload", common.APIHTTPURL), "", nil)
-	if err != nil {
-		return E.From(err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		failure := E.Failure("server reload").Extraf("status code: %v", resp.StatusCode)
-		b, err := io.ReadAll(resp.Body)
-		if err != nil {
-			return failure.Extraf("unable to read response body: %s", err)
-		}
-		reloadErr, ok := E.FromJSON(b)
-		if ok {
-			return E.Join("reload success, but server returned error", reloadErr)
-		}
-		return failure.Extraf("unable to read response body")
-	}
-	return nil
-}
--- a/internal/api/v1/utils/logging.go
+++ b/internal/api/v1/utils/logging.go
@@ -0,0 +1,18 @@
+package utils
+
+import (
+	"net/http"
+
+	"github.com/rs/zerolog"
+	"github.com/yusing/go-proxy/internal/logging"
+)
+
+func reqLogger(r *http.Request, level zerolog.Level) *zerolog.Event {
+	return logging.WithLevel(level).Str("module", "api").
+		Str("method", r.Method).
+		Str("path", r.RequestURI)
+}
+
+func LogError(r *http.Request) *zerolog.Event { return reqLogger(r, zerolog.ErrorLevel) }
+func LogWarn(r *http.Request) *zerolog.Event  { return reqLogger(r, zerolog.WarnLevel) }
+func LogInfo(r *http.Request) *zerolog.Event  { return reqLogger(r, zerolog.InfoLevel) }
--- a/internal/api/v1/utils/utils.go
+++ b/internal/api/v1/utils/utils.go
@@ -3,18 +3,40 @@ package utils
 import (
 	"encoding/json"
 	"net/http"
+
+	"github.com/yusing/go-proxy/internal/logging"
 )

-func RespondJson(w http.ResponseWriter, data any, code ...int) error {
+func WriteBody(w http.ResponseWriter, body []byte) {
+	if _, err := w.Write(body); err != nil {
+		HandleErr(w, nil, err)
+	}
+}
+
+func RespondJSON(w http.ResponseWriter, r *http.Request, data any, code ...int) (canProceed bool) {
 	if len(code) > 0 {
 		w.WriteHeader(code[0])
 	}
 	w.Header().Set("Content-Type", "application/json")
-	j, err := json.MarshalIndent(data, "", "  ")
-	if err != nil {
-		return err
-	} else {
-		w.Write(j)
+	var j []byte
+	var err error
+
+	switch data := data.(type) {
+	case string:
+		j = []byte(`"` + data + `"`)
+	case []byte:
+		j = data
+	default:
+		j, err = json.MarshalIndent(data, "", "  ")
+		if err != nil {
+			logging.Panic().Err(err).Msg("failed to marshal json")
+			return false
+		}
 	}
-	return nil
+	_, err = w.Write(j)
+	if err != nil {
+		HandleErr(w, r, err)
+		return false
+	}
+	return true
 }
--- a/internal/api/v1/version.go
+++ b/internal/api/v1/version.go
@@ -0,0 +1,12 @@
+package v1
+
+import (
+	"net/http"
+
+	. "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/pkg"
+)
+
+func GetVersion(w http.ResponseWriter, r *http.Request) {
+	WriteBody(w, []byte(pkg.GetVersion()))
+}
--- a/internal/autocert/config.go
+++ b/internal/autocert/config.go
@@ -8,12 +8,22 @@ import (
 	"github.com/go-acme/lego/v4/certcrypto"
 	"github.com/go-acme/lego/v4/lego"
 	E "github.com/yusing/go-proxy/internal/error"
-	M "github.com/yusing/go-proxy/internal/models"
+	"github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+
+	"github.com/yusing/go-proxy/internal/config/types"
 )

-type Config M.AutoCertConfig
+type Config types.AutoCertConfig

-func NewConfig(cfg *M.AutoCertConfig) *Config {
+var (
+	ErrMissingDomain   = E.New("missing field 'domains'")
+	ErrMissingEmail    = E.New("missing field 'email'")
+	ErrMissingProvider = E.New("missing field 'provider'")
+	ErrUnknownProvider = E.New("unknown provider")
+)
+
+func NewConfig(cfg *types.AutoCertConfig) *Config {
 	if cfg.CertPath == "" {
 		cfg.CertPath = CertFileDefault
 	}
@@ -26,35 +36,36 @@ func NewConfig(cfg *M.AutoCertConfig) *Config {
 	return (*Config)(cfg)
 }

-func (cfg *Config) GetProvider() (provider *Provider, res E.NestedError) {
-	b := E.NewBuilder("unable to initialize autocert")
-	defer b.To(&res)
+func (cfg *Config) GetProvider() (*Provider, E.Error) {
+	b := E.NewBuilder("autocert errors")

 	if cfg.Provider != ProviderLocal {
 		if len(cfg.Domains) == 0 {
-			b.Addf("%s", "no domains specified")
+			b.Add(ErrMissingDomain)
 		}
 		if cfg.Provider == "" {
-			b.Addf("%s", "no provider specified")
+			b.Add(ErrMissingProvider)
 		}
 		if cfg.Email == "" {
-			b.Addf("%s", "no email specified")
+			b.Add(ErrMissingEmail)
 		}
 		// check if provider is implemented
 		_, ok := providersGenMap[cfg.Provider]
 		if !ok {
-			b.Addf("unknown provider: %q", cfg.Provider)
+			b.Add(ErrUnknownProvider.
+				Subject(cfg.Provider).
+				Withf(strutils.DoYouMean(utils.NearestField(cfg.Provider, providersGenMap))))
 		}
 	}

 	if b.HasError() {
-		return
+		return nil, b.Error()
 	}

-	privKey, err := E.Check(ecdsa.GenerateKey(elliptic.P256(), rand.Reader))
-	if err.HasError() {
-		b.Add(E.FailWith("generate private key", err))
-		return
+	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		b.Addf("generate private key: %w", err)
+		return nil, b.Error()
 	}

 	user := &User{
@@ -65,11 +76,9 @@ func (cfg *Config) GetProvider() (provider *Provider, res E.NestedError) {
 	legoCfg := lego.NewConfig(user)
 	legoCfg.Certificate.KeyType = certcrypto.RSA2048

-	provider = &Provider{
+	return &Provider{
 		cfg:     cfg,
 		user:    user,
 		legoCfg: legoCfg,
-	}
-
-	return
+	}, nil
 }
--- a/internal/autocert/constants.go
+++ b/internal/autocert/constants.go
@@ -7,7 +7,6 @@ import (
 	"github.com/go-acme/lego/v4/providers/dns/cloudflare"
 	"github.com/go-acme/lego/v4/providers/dns/duckdns"
 	"github.com/go-acme/lego/v4/providers/dns/ovh"
-	"github.com/sirupsen/logrus"
 )

 const (
@@ -36,5 +35,3 @@ var providersGenMap = map[string]ProviderGenerator{
 var (
 	ErrGetCertFailure = errors.New("get certificate failed")
 )
-
-var logger = logrus.WithField("module", "autocert")
--- a/internal/autocert/logger.go
+++ b/internal/autocert/logger.go
@@ -0,0 +1,5 @@
+package autocert
+
+import "github.com/yusing/go-proxy/internal/logging"
+
+var logger = logging.With().Str("module", "autocert").Logger()
--- a/internal/autocert/provider.go
+++ b/internal/autocert/provider.go
@@ -1,7 +1,6 @@
 package autocert

 import (
-	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"os"
@@ -14,23 +13,27 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/lego"
 	"github.com/go-acme/lego/v4/registration"
+	"github.com/yusing/go-proxy/internal/config/types"
 	E "github.com/yusing/go-proxy/internal/error"
-	M "github.com/yusing/go-proxy/internal/models"
+	"github.com/yusing/go-proxy/internal/task"
 	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

-type Provider struct {
-	cfg     *Config
-	user    *User
-	legoCfg *lego.Config
-	client  *lego.Client
+type (
+	Provider struct {
+		cfg     *Config
+		user    *User
+		legoCfg *lego.Config
+		client  *lego.Client

-	tlsCert      *tls.Certificate
-	certExpiries CertExpiries
-}
+		tlsCert      *tls.Certificate
+		certExpiries CertExpiries
+	}
+	ProviderGenerator func(types.AutocertProviderOpt) (challenge.Provider, E.Error)

-type ProviderGenerator func(M.AutocertProviderOpt) (challenge.Provider, E.NestedError)
-type CertExpiries map[string]time.Time
+	CertExpiries map[string]time.Time
+)

 func (p *Provider) GetCert(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
 	if p.tlsCert == nil {
@@ -55,25 +58,20 @@ func (p *Provider) GetExpiries() CertExpiries {
 	return p.certExpiries
 }

-func (p *Provider) ObtainCert() (res E.NestedError) {
-	b := E.NewBuilder("failed to obtain certificate")
-	defer b.To(&res)
-
+func (p *Provider) ObtainCert() E.Error {
 	if p.cfg.Provider == ProviderLocal {
 		return nil
 	}

 	if p.client == nil {
-		if err := p.initClient(); err.HasError() {
-			b.Add(E.FailWith("init autocert client", err))
-			return
+		if err := p.initClient(); err != nil {
+			return err
 		}
 	}

 	if p.user.Registration == nil {
-		if err := p.registerACME(); err.HasError() {
-			b.Add(E.FailWith("register ACME", err))
-			return
+		if err := p.registerACME(); err != nil {
+			return E.From(err)
 		}
 	}

@@ -82,27 +80,23 @@ func (p *Provider) ObtainCert() (res E.NestedError) {
 		Domains: p.cfg.Domains,
 		Bundle:  true,
 	}
-	cert, err := E.Check(client.Certificate.Obtain(req))
-	if err.HasError() {
-		b.Add(err)
-		return
+	cert, err := client.Certificate.Obtain(req)
+	if err != nil {
+		return E.From(err)
 	}

-	if err = p.saveCert(cert); err.HasError() {
-		b.Add(E.FailWith("save certificate", err))
-		return
+	if err = p.saveCert(cert); err != nil {
+		return E.From(err)
 	}

-	tlsCert, err := E.Check(tls.X509KeyPair(cert.Certificate, cert.PrivateKey))
-	if err.HasError() {
-		b.Add(E.FailWith("parse obtained certificate", err))
-		return
+	tlsCert, err := tls.X509KeyPair(cert.Certificate, cert.PrivateKey)
+	if err != nil {
+		return E.From(err)
 	}

 	expiries, err := getCertExpiries(&tlsCert)
-	if err.HasError() {
-		b.Add(E.FailWith("get certificate expiry", err))
-		return
+	if err != nil {
+		return E.From(err)
 	}
 	p.tlsCert = &tlsCert
 	p.certExpiries = expiries
@@ -110,22 +104,23 @@ func (p *Provider) ObtainCert() (res E.NestedError) {
 	return nil
 }

-func (p *Provider) LoadCert() E.NestedError {
-	cert, err := E.Check(tls.LoadX509KeyPair(p.cfg.CertPath, p.cfg.KeyPath))
-	if err.HasError() {
-		return err
+func (p *Provider) LoadCert() E.Error {
+	cert, err := tls.LoadX509KeyPair(p.cfg.CertPath, p.cfg.KeyPath)
+	if err != nil {
+		return E.Errorf("load SSL certificate: %w", err)
 	}
 	expiries, err := getCertExpiries(&cert)
-	if err.HasError() {
-		return err
+	if err != nil {
+		return E.Errorf("parse SSL certificate: %w", err)
 	}
 	p.tlsCert = &cert
 	p.certExpiries = expiries

-	logger.Infof("next renewal in %v", U.FormatDuration(time.Until(p.ShouldRenewOn())))
+	logger.Info().Msgf("next renewal in %v", strutils.FormatDuration(time.Until(p.ShouldRenewOn())))
 	return p.renewIfNeeded()
 }

+// ShouldRenewOn returns the time at which the certificate should be renewed.
 func (p *Provider) ShouldRenewOn() time.Time {
 	for _, expiry := range p.certExpiries {
 		return expiry.AddDate(0, -1, 0) // 1 month before
@@ -134,55 +129,55 @@ func (p *Provider) ShouldRenewOn() time.Time {
 	panic("no certificate available")
 }

-func (p *Provider) ScheduleRenewal(ctx context.Context) {
+func (p *Provider) ScheduleRenewal() {
 	if p.GetName() == ProviderLocal {
 		return
 	}
-
-	logger.Debug("started renewal scheduler")
-	defer logger.Debug("renewal scheduler stopped")
-
-	ticker := time.NewTicker(5 * time.Second)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C: // check every 5 seconds
-			if err := p.renewIfNeeded(); err.HasError() {
-				logger.Warn(err)
+	go func() {
+		task := task.GlobalTask("cert renew scheduler")
+		ticker := time.NewTicker(5 * time.Second)
+		defer ticker.Stop()
+		defer task.Finish("cert renew scheduler stopped")
+		for {
+			select {
+			case <-task.Context().Done():
+				return
+			case <-ticker.C: // check every 5 seconds
+				if err := p.renewIfNeeded(); err != nil {
+					E.LogWarn("cert renew failed", err, &logger)
+				}
 			}
 		}
-	}
+	}()
 }

-func (p *Provider) initClient() E.NestedError {
-	legoClient, err := E.Check(lego.NewClient(p.legoCfg))
-	if err.HasError() {
-		return E.FailWith("create lego client", err)
+func (p *Provider) initClient() E.Error {
+	legoClient, err := lego.NewClient(p.legoCfg)
+	if err != nil {
+		return E.From(err)
 	}

-	legoProvider, err := providersGenMap[p.cfg.Provider](p.cfg.Options)
-	if err.HasError() {
-		return E.FailWith("create lego provider", err)
+	generator := providersGenMap[p.cfg.Provider]
+	legoProvider, pErr := generator(p.cfg.Options)
+	if pErr != nil {
+		return pErr
 	}

-	err = E.From(legoClient.Challenge.SetDNS01Provider(legoProvider))
-	if err.HasError() {
-		return E.FailWith("set challenge provider", err)
+	err = legoClient.Challenge.SetDNS01Provider(legoProvider)
+	if err != nil {
+		return E.From(err)
 	}

 	p.client = legoClient
 	return nil
 }

-func (p *Provider) registerACME() E.NestedError {
+func (p *Provider) registerACME() error {
 	if p.user.Registration != nil {
 		return nil
 	}
-	reg, err := E.Check(p.client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true}))
-	if err.HasError() {
+	reg, err := p.client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
+	if err != nil {
 		return err
 	}
 	p.user.Registration = reg
@@ -190,26 +185,27 @@ func (p *Provider) registerACME() E.NestedError {
 	return nil
 }

-func (p *Provider) saveCert(cert *certificate.Resource) E.NestedError {
-	//* This should have been done in setup
-	//* but double check is always a good choice
+func (p *Provider) saveCert(cert *certificate.Resource) error {
+	/* This should have been done in setup
+	but double check is always a good choice.*/
 	_, err := os.Stat(path.Dir(p.cfg.CertPath))
 	if err != nil {
 		if os.IsNotExist(err) {
 			if err = os.MkdirAll(path.Dir(p.cfg.CertPath), 0o755); err != nil {
-				return E.FailWith("create cert directory", err)
+				return err
 			}
 		} else {
-			return E.FailWith("stat cert directory", err)
+			return err
 		}
 	}
 	err = os.WriteFile(p.cfg.KeyPath, cert.PrivateKey, 0o600) // -rw-------
 	if err != nil {
-		return E.FailWith("write key file", err)
+		return err
 	}
+
 	err = os.WriteFile(p.cfg.CertPath, cert.Certificate, 0o644) // -rw-r--r--
 	if err != nil {
-		return E.FailWith("write cert file", err)
+		return err
 	}
 	return nil
 }
@@ -231,39 +227,39 @@ func (p *Provider) certState() CertState {
 	sort.Strings(certDomains)

 	if !reflect.DeepEqual(certDomains, wantedDomains) {
-		logger.Debugf("cert domains mismatch: %v != %v", certDomains, p.cfg.Domains)
+		logger.Info().Msgf("cert domains mismatch: %v != %v", certDomains, p.cfg.Domains)
 		return CertStateMismatch
 	}

 	return CertStateValid
 }

-func (p *Provider) renewIfNeeded() E.NestedError {
+func (p *Provider) renewIfNeeded() E.Error {
 	if p.cfg.Provider == ProviderLocal {
 		return nil
 	}

 	switch p.certState() {
 	case CertStateExpired:
-		logger.Info("certs expired, renewing")
+		logger.Info().Msg("certs expired, renewing")
 	case CertStateMismatch:
-		logger.Info("cert domains mismatch with config, renewing")
+		logger.Info().Msg("cert domains mismatch with config, renewing")
 	default:
 		return nil
 	}

-	if err := p.ObtainCert(); err.HasError() {
-		return E.FailWith("renew certificate", err)
+	if err := p.ObtainCert(); err != nil {
+		return err
 	}
 	return nil
 }

-func getCertExpiries(cert *tls.Certificate) (CertExpiries, E.NestedError) {
+func getCertExpiries(cert *tls.Certificate) (CertExpiries, error) {
 	r := make(CertExpiries, len(cert.Certificate))
 	for _, cert := range cert.Certificate {
-		x509Cert, err := E.Check(x509.ParseCertificate(cert))
-		if err.HasError() {
-			return nil, E.FailWith("parse certificate", err)
+		x509Cert, err := x509.ParseCertificate(cert)
+		if err != nil {
+			return nil, err
 		}
 		if x509Cert.IsCA {
 			continue
@@ -280,16 +276,13 @@ func providerGenerator[CT any, PT challenge.Provider](
 	defaultCfg func() *CT,
 	newProvider func(*CT) (PT, error),
 ) ProviderGenerator {
-	return func(opt M.AutocertProviderOpt) (challenge.Provider, E.NestedError) {
+	return func(opt types.AutocertProviderOpt) (challenge.Provider, E.Error) {
 		cfg := defaultCfg()
 		err := U.Deserialize(opt, cfg)
-		if err.HasError() {
+		if err != nil {
 			return nil, err
 		}
-		p, err := E.Check(newProvider(cfg))
-		if err.HasError() {
-			return nil, err
-		}
-		return p, nil
+		p, pErr := newProvider(cfg)
+		return p, E.From(pErr)
 	}
 }
--- a/internal/autocert/provider_test/ovh_test.go
+++ b/internal/autocert/provider_test/ovh_test.go
@@ -45,6 +45,6 @@ oauth2_config:
 	testYaml = testYaml[1:] // remove first \n
 	opt := make(map[string]any)
 	ExpectNoError(t, yaml.Unmarshal([]byte(testYaml), opt))
-	ExpectTrue(t, U.Deserialize(opt, cfg).NoError())
+	ExpectNoError(t, U.Deserialize(opt, cfg))
 	ExpectDeepEqual(t, cfg, cfgExpected)
 }
--- a/internal/autocert/setup.go
+++ b/internal/autocert/setup.go
@@ -1,27 +1,26 @@
 package autocert

 import (
-	"context"
 	"os"

 	E "github.com/yusing/go-proxy/internal/error"
 )

-func (p *Provider) Setup(ctx context.Context) (err E.NestedError) {
+func (p *Provider) Setup() (err E.Error) {
 	if err = p.LoadCert(); err != nil {
 		if !err.Is(os.ErrNotExist) { // ignore if cert doesn't exist
 			return err
 		}
-		logger.Debug("obtaining cert due to error loading cert")
+		logger.Debug().Msg("obtaining cert due to error loading cert")
 		if err = p.ObtainCert(); err != nil {
 			return err
 		}
 	}

-	go p.ScheduleRenewal(ctx)
+	p.ScheduleRenewal()

 	for _, expiry := range p.GetExpiries() {
-		logger.Infof("certificate expire on %s", expiry)
+		logger.Info().Msg("certificate expire on " + expiry.String())
 		break
 	}

--- a/internal/autocert/user.go
+++ b/internal/autocert/user.go
@@ -1,8 +1,9 @@
 package autocert

 import (
-	"github.com/go-acme/lego/v4/registration"
 	"crypto"
+
+	"github.com/go-acme/lego/v4/registration"
 )

 type User struct {
@@ -19,4 +20,4 @@ func (u *User) GetRegistration() *registration.Resource {
 }
 func (u *User) GetPrivateKey() crypto.PrivateKey {
 	return u.key
-}
+}
--- a/internal/common/args.go
+++ b/internal/common/args.go
@@ -2,9 +2,8 @@ package common

 import (
 	"flag"
-
-	"github.com/sirupsen/logrus"
-	E "github.com/yusing/go-proxy/internal/error"
+	"fmt"
+	"log"
 )

 type Args struct {
@@ -17,9 +16,12 @@ const (
 	CommandValidate           = "validate"
 	CommandListConfigs        = "ls-config"
 	CommandListRoutes         = "ls-routes"
+	CommandListIcons          = "ls-icons"
 	CommandReload             = "reload"
 	CommandDebugListEntries   = "debug-ls-entries"
 	CommandDebugListProviders = "debug-ls-providers"
+	CommandDebugListMTrace    = "debug-ls-mtrace"
+	CommandDebugListTasks     = "debug-ls-tasks"
 )

 var ValidCommands = []string{
@@ -28,26 +30,29 @@ var ValidCommands = []string{
 	CommandValidate,
 	CommandListConfigs,
 	CommandListRoutes,
+	CommandListIcons,
 	CommandReload,
 	CommandDebugListEntries,
 	CommandDebugListProviders,
+	CommandDebugListMTrace,
+	CommandDebugListTasks,
 }

 func GetArgs() Args {
 	var args Args
 	flag.Parse()
 	args.Command = flag.Arg(0)
-	if err := validateArg(args.Command); err.HasError() {
-		logrus.Fatal(err)
+	if err := validateArg(args.Command); err != nil {
+		log.Fatalf("invalid command: %s", err)
 	}
 	return args
 }

-func validateArg(arg string) E.NestedError {
+func validateArg(arg string) error {
 	for _, v := range ValidCommands {
 		if arg == v {
 			return nil
 		}
 	}
-	return E.Invalid("argument", arg)
+	return fmt.Errorf("invalid command %q", arg)
 }
--- a/internal/common/constants.go
+++ b/internal/common/constants.go
@@ -13,40 +13,43 @@ const (
 // file, folder structure

 const (
+	DotEnvPath = ".env"
+
 	ConfigBasePath        = "config"
 	ConfigFileName        = "config.yml"
 	ConfigExampleFileName = "config.example.yml"
 	ConfigPath            = ConfigBasePath + "/" + ConfigFileName
-)

-const (
+	JWTKeyPath = ConfigBasePath + "/jwt.key"
+
+	MiddlewareComposeBasePath = ConfigBasePath + "/middlewares"
+
 	SchemaBasePath         = "schema"
 	ConfigSchemaPath       = SchemaBasePath + "/config.schema.json"
 	FileProviderSchemaPath = SchemaBasePath + "/providers.schema.json"
-)

-const (
 	ComposeFileName        = "compose.yml"
 	ComposeExampleFileName = "compose.example.yml"
-)

-const (
 	ErrorPagesBasePath = "error_pages"
 )

-var (
-	RequiredDirectories = []string{
-		ConfigBasePath,
-		SchemaBasePath,
-		ErrorPagesBasePath,
-	}
-)
+var RequiredDirectories = []string{
+	ConfigBasePath,
+	SchemaBasePath,
+	ErrorPagesBasePath,
+	MiddlewareComposeBasePath,
+}

 const DockerHostFromEnv = "$DOCKER_HOST"

 const (
-	IdleTimeoutDefault = "0"
+	HealthCheckIntervalDefault = 5 * time.Second
+	HealthCheckTimeoutDefault  = 5 * time.Second
+
 	WakeTimeoutDefault = "30s"
 	StopTimeoutDefault = "10s"
 	StopMethodDefault  = "stop"
 )
+
+const HeaderCheckRedirect = "X-Goproxy-Check-Redirect"
--- a/internal/common/crypto.go
+++ b/internal/common/crypto.go
@@ -0,0 +1,31 @@
+package common
+
+import (
+	"crypto/rand"
+	"crypto/sha512"
+	"encoding/base64"
+
+	"github.com/rs/zerolog/log"
+)
+
+func HashPassword(pwd string) []byte {
+	h := sha512.New()
+	h.Write([]byte(pwd))
+	return h.Sum(nil)
+}
+
+func generateJWTKey(size int) string {
+	bytes := make([]byte, size)
+	if _, err := rand.Read(bytes); err != nil {
+		log.Panic().Err(err).Msg("failed to generate jwt key")
+	}
+	return base64.StdEncoding.EncodeToString(bytes)
+}
+
+func decodeJWTKey(key string) []byte {
+	bytes, err := base64.StdEncoding.DecodeString(key)
+	if err != nil {
+		log.Panic().Err(err).Msg("failed to decode jwt key")
+	}
+	return bytes
+}
--- a/internal/common/env.go
+++ b/internal/common/env.go
@@ -4,14 +4,18 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"strconv"
+	"strings"

-	"github.com/sirupsen/logrus"
-	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/rs/zerolog/log"
 )

 var (
-	NoSchemaValidation = GetEnvBool("GOPROXY_NO_SCHEMA_VALIDATION", false)
-	IsDebug            = GetEnvBool("GOPROXY_DEBUG", false)
+	NoSchemaValidation = GetEnvBool("GOPROXY_NO_SCHEMA_VALIDATION", true)
+	IsTest             = GetEnvBool("GOPROXY_TEST", false) || strings.HasSuffix(os.Args[0], ".test")
+	IsDebug            = GetEnvBool("GOPROXY_DEBUG", IsTest)
+	IsDebugSkipAuth    = GetEnvBool("GOPROXY_DEBUG_SKIP_AUTH", false)
+	IsTrace            = GetEnvBool("GOPROXY_TRACE", false) && IsDebug

 	ProxyHTTPAddr,
 	ProxyHTTPHost,
@@ -27,6 +31,10 @@ var (
 	APIHTTPHost,
 	APIHTTPPort,
 	APIHTTPURL = GetAddrEnv("GOPROXY_API_ADDR", "127.0.0.1:8888", "http")
+
+	APIJWTSecret    = decodeJWTKey(GetEnv("GOPROXY_API_JWT_SECRET", generateJWTKey(32)))
+	APIUser         = GetEnv("GOPROXY_API_USER", "admin")
+	APIPasswordHash = HashPassword(GetEnv("GOPROXY_API_PASSWORD", "password"))
 )

 func GetEnvBool(key string, defaultValue bool) bool {
@@ -34,7 +42,11 @@ func GetEnvBool(key string, defaultValue bool) bool {
 	if !ok || value == "" {
 		return defaultValue
 	}
-	return U.ParseBool(value)
+	b, err := strconv.ParseBool(value)
+	if err != nil {
+		log.Fatal().Msgf("env %s: invalid boolean value: %s", key, value)
+	}
+	return b
 }

 func GetEnv(key, defaultValue string) string {
@@ -49,7 +61,7 @@ func GetAddrEnv(key, defaultValue, scheme string) (addr, host, port, fullURL str
 	addr = GetEnv(key, defaultValue)
 	host, port, err := net.SplitHostPort(addr)
 	if err != nil {
-		logrus.Fatalf("Invalid address: %s", addr)
+		log.Fatal().Msgf("env %s: invalid address: %s", key, addr)
 	}
 	if host == "" {
 		host = "localhost"
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -1,235 +1,243 @@
 package config

 import (
-	"context"
 	"os"
+	"strconv"
+	"sync"
+	"time"

-	"github.com/sirupsen/logrus"
 	"github.com/yusing/go-proxy/internal/autocert"
 	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/config/types"
 	E "github.com/yusing/go-proxy/internal/error"
-	M "github.com/yusing/go-proxy/internal/models"
-	PR "github.com/yusing/go-proxy/internal/proxy/provider"
-	R "github.com/yusing/go-proxy/internal/route"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/notif"
+	"github.com/yusing/go-proxy/internal/route"
+	proxy "github.com/yusing/go-proxy/internal/route/provider"
+	"github.com/yusing/go-proxy/internal/task"
 	U "github.com/yusing/go-proxy/internal/utils"
 	F "github.com/yusing/go-proxy/internal/utils/functional"
-	W "github.com/yusing/go-proxy/internal/watcher"
+	"github.com/yusing/go-proxy/internal/watcher"
 	"github.com/yusing/go-proxy/internal/watcher/events"
 	"gopkg.in/yaml.v3"
 )

 type Config struct {
-	value            *M.Config
-	proxyProviders   F.Map[string, *PR.Provider]
+	value            *types.Config
+	providers        F.Map[string, *proxy.Provider]
 	autocertProvider *autocert.Provider
-
-	l logrus.FieldLogger
-
-	watcher       W.Watcher
-	watcherCtx    context.Context
-	watcherCancel context.CancelFunc
-	reloadReq     chan struct{}
+	task             task.Task
 }

-var instance *Config
+var (
+	instance   *Config
+	cfgWatcher watcher.Watcher
+	logger     = logging.With().Str("module", "config").Logger()
+	reloadMu   sync.Mutex
+)
+
+const configEventFlushInterval = 500 * time.Millisecond
+
+const (
+	cfgRenameWarn = `Config file renamed, not reloading.
+Make sure you rename it back before next time you start.`
+	cfgDeleteWarn = `Config file deleted, not reloading.
+You may run "ls-config" to show or dump the current config.`
+)

 func GetInstance() *Config {
 	return instance
 }

-func Load() E.NestedError {
-	if instance != nil {
-		return nil
+func newConfig() *Config {
+	return &Config{
+		value:     types.DefaultConfig(),
+		providers: F.NewMapOf[string, *proxy.Provider](),
+		task:      task.GlobalTask("config"),
 	}
-	instance = &Config{
-		value:          M.DefaultConfig(),
-		proxyProviders: F.NewMapOf[string, *PR.Provider](),
-		l:              logrus.WithField("module", "config"),
-		watcher:        W.NewConfigFileWatcher(common.ConfigFileName),
-		reloadReq:      make(chan struct{}, 1),
-	}
-	return instance.load()
 }

-func Validate(data []byte) E.NestedError {
+func Load() (*Config, E.Error) {
+	if instance != nil {
+		return instance, nil
+	}
+	instance = newConfig()
+	cfgWatcher = watcher.NewConfigFileWatcher(common.ConfigFileName)
+	return instance, instance.load()
+}
+
+func Validate(data []byte) E.Error {
 	return U.ValidateYaml(U.GetSchema(common.ConfigSchemaPath), data)
 }

 func MatchDomains() []string {
-	if instance == nil {
-		logrus.Panic("config has not been loaded, please check if there is any errors")
-	}
 	return instance.value.MatchDomains
 }

-func (cfg *Config) Value() M.Config {
-	if cfg == nil {
-		logrus.Panic("config has not been loaded, please check if there is any errors")
-	}
-	return *cfg.value
+func WatchChanges() {
+	task := task.GlobalTask("Config watcher")
+	eventQueue := events.NewEventQueue(
+		task,
+		configEventFlushInterval,
+		OnConfigChange,
+		func(err E.Error) {
+			E.LogError("config reload error", err, &logger)
+		},
+	)
+	eventQueue.Start(cfgWatcher.Events(task.Context()))
 }

-func (cfg *Config) GetAutoCertProvider() *autocert.Provider {
-	if instance == nil {
-		logrus.Panic("config has not been loaded, please check if there is any errors")
+func OnConfigChange(flushTask task.Task, ev []events.Event) {
+	defer flushTask.Finish("config reload complete")
+
+	// no matter how many events during the interval
+	// just reload once and check the last event
+	switch ev[len(ev)-1].Action {
+	case events.ActionFileRenamed:
+		logger.Warn().Msg(cfgRenameWarn)
+		return
+	case events.ActionFileDeleted:
+		logger.Warn().Msg(cfgDeleteWarn)
+		return
+	}
+
+	if err := Reload(); err != nil {
+		// recovered in event queue
+		panic(err)
 	}
-	return cfg.autocertProvider
 }

-func (cfg *Config) Dispose() {
-	if cfg.watcherCancel != nil {
-		cfg.watcherCancel()
-		cfg.l.Debug("stopped watcher")
+func Reload() E.Error {
+	// avoid race between config change and API reload request
+	reloadMu.Lock()
+	defer reloadMu.Unlock()
+
+	newCfg := newConfig()
+	err := newCfg.load()
+	if err != nil {
+		return err
 	}
-	cfg.stopProviders()
+
+	// cancel all current subtasks -> wait
+	// -> replace config -> start new subtasks
+	instance.task.Finish("config changed")
+	instance.task.Wait()
+	*instance = *newCfg
+	instance.StartProxyProviders()
+	return nil
 }

-func (cfg *Config) Reload() (err E.NestedError) {
-	cfg.stopProviders()
-	err = cfg.load()
-	cfg.StartProxyProviders()
-	return
+func Value() types.Config {
+	return *instance.value
+}
+
+func GetAutoCertProvider() *autocert.Provider {
+	return instance.autocertProvider
+}
+
+func (cfg *Config) Task() task.Task {
+	return cfg.task
 }

 func (cfg *Config) StartProxyProviders() {
-	cfg.controlProviders("start", (*PR.Provider).StartAllRoutes)
-}
-
-func (cfg *Config) WatchChanges() {
-	cfg.watcherCtx, cfg.watcherCancel = context.WithCancel(context.Background())
-	go func() {
-		for {
-			select {
-			case <-cfg.watcherCtx.Done():
-				return
-			case <-cfg.reloadReq:
-				if err := cfg.Reload(); err.HasError() {
-					cfg.l.Error(err)
-				}
-			}
-		}
-	}()
-	go func() {
-		eventCh, errCh := cfg.watcher.Events(cfg.watcherCtx)
-		for {
-			select {
-			case <-cfg.watcherCtx.Done():
-				return
-			case event := <-eventCh:
-				if event.Action == events.ActionFileDeleted || event.Action == events.ActionFileRenamed {
-					cfg.l.Error("config file deleted or renamed, ignoring...")
-					continue
-				} else {
-					cfg.reloadReq <- struct{}{}
-				}
-			case err := <-errCh:
-				cfg.l.Error(err)
-				continue
-			}
-		}
-	}()
-}
-
-func (cfg *Config) forEachRoute(do func(alias string, r R.Route, p *PR.Provider)) {
-	cfg.proxyProviders.RangeAll(func(_ string, p *PR.Provider) {
-		p.RangeRoutes(func(a string, r R.Route) {
-			do(a, r, p)
+	errs := cfg.providers.CollectErrorsParallel(
+		func(_ string, p *proxy.Provider) error {
+			subtask := cfg.task.Subtask(p.String())
+			return p.Start(subtask)
 		})
-	})
+
+	if err := E.Join(errs...); err != nil {
+		E.LogError("route provider errors", err, &logger)
+	}
 }

-func (cfg *Config) load() (res E.NestedError) {
-	b := E.NewBuilder("errors loading config")
-	defer b.To(&res)
+func (cfg *Config) load() E.Error {
+	const errMsg = "config load error"

-	cfg.l.Debug("loading config")
-	defer cfg.l.Debug("loaded config")
-
-	data, err := E.Check(os.ReadFile(common.ConfigPath))
-	if err.HasError() {
-		b.Add(E.FailWith("read config", err))
-		logrus.Fatal(b.Build())
+	data, err := os.ReadFile(common.ConfigPath)
+	if err != nil {
+		E.LogFatal(errMsg, err, &logger)
 	}

 	if !common.NoSchemaValidation {
-		if err = Validate(data); err.HasError() {
-			b.Add(E.FailWith("schema validation", err))
-			logrus.Fatal(b.Build())
+		if err := Validate(data); err != nil {
+			E.LogFatal(errMsg, err, &logger)
 		}
 	}

-	model := M.DefaultConfig()
-	if err := E.From(yaml.Unmarshal(data, model)); err.HasError() {
-		b.Add(E.FailWith("parse config", err))
-		logrus.Fatal(b.Build())
+	model := types.DefaultConfig()
+	if err := E.From(yaml.Unmarshal(data, model)); err != nil {
+		E.LogFatal(errMsg, err, &logger)
 	}

 	// errors are non fatal below
-	b.Add(cfg.initAutoCert(&model.AutoCert))
-	b.Add(cfg.loadProviders(&model.Providers))
+	errs := E.NewBuilder(errMsg)
+	errs.Add(cfg.initNotification(model.Providers.Notification))
+	errs.Add(cfg.initAutoCert(&model.AutoCert))
+	errs.Add(cfg.loadRouteProviders(&model.Providers))

 	cfg.value = model
-	R.SetFindMuxDomains(model.MatchDomains)
-	return
+	route.SetFindMuxDomains(model.MatchDomains)
+	return errs.Error()
 }

-func (cfg *Config) initAutoCert(autocertCfg *M.AutoCertConfig) (err E.NestedError) {
+func (cfg *Config) initNotification(notifCfgMap types.NotificationConfigMap) (err E.Error) {
+	if len(notifCfgMap) == 0 {
+		return
+	}
+	errs := E.NewBuilder("notification providers load errors")
+	for name, notifCfg := range notifCfgMap {
+		_, err := notif.RegisterProvider(cfg.task.Subtask(name), notifCfg)
+		errs.Add(err)
+	}
+	return errs.Error()
+}
+
+func (cfg *Config) initAutoCert(autocertCfg *types.AutoCertConfig) (err E.Error) {
 	if cfg.autocertProvider != nil {
 		return
 	}

-	cfg.l.Debug("initializing autocert")
-	defer cfg.l.Debug("initialized autocert")
-
 	cfg.autocertProvider, err = autocert.NewConfig(autocertCfg).GetProvider()
-	if err.HasError() {
-		err = E.FailWith("autocert provider", err)
-	}
 	return
 }

-func (cfg *Config) loadProviders(providers *M.ProxyProviders) (res E.NestedError) {
-	cfg.l.Debug("loading providers")
-	defer cfg.l.Debug("loaded providers")
+func (cfg *Config) loadRouteProviders(providers *types.Providers) E.Error {
+	subtask := cfg.task.Subtask("load route providers")
+	defer subtask.Finish("done")

-	b := E.NewBuilder("errors loading providers")
-	defer b.To(&res)
+	errs := E.NewBuilder("route provider errors")
+	results := E.NewBuilder("loaded route providers")

+	lenLongestName := 0
 	for _, filename := range providers.Files {
-		p, err := PR.NewFileProvider(filename)
+		p, err := proxy.NewFileProvider(filename)
 		if err != nil {
-			b.Add(err.Subject(filename))
+			errs.Add(E.PrependSubject(filename, err))
 			continue
 		}
-		cfg.proxyProviders.Store(p.GetName(), p)
-		b.Add(p.LoadRoutes().Subject(filename))
+		cfg.providers.Store(p.GetName(), p)
+		if len(p.GetName()) > lenLongestName {
+			lenLongestName = len(p.GetName())
+		}
 	}
 	for name, dockerHost := range providers.Docker {
-		p, err := PR.NewDockerProvider(name, dockerHost)
+		p, err := proxy.NewDockerProvider(name, dockerHost)
 		if err != nil {
-			b.Add(err.Subjectf("%s (%s)", name, dockerHost))
+			errs.Add(E.PrependSubject(name, err))
 			continue
 		}
-		cfg.proxyProviders.Store(p.GetName(), p)
-		b.Add(p.LoadRoutes().Subject(dockerHost))
-	}
-	return
-}
-
-func (cfg *Config) controlProviders(action string, do func(*PR.Provider) E.NestedError) {
-	errors := E.NewBuilder("errors in %s these providers", action)
-
-	cfg.proxyProviders.RangeAll(func(name string, p *PR.Provider) {
-		if err := do(p); err.HasError() {
-			errors.Add(err.Subject(p))
+		cfg.providers.Store(p.GetName(), p)
+		if len(p.GetName()) > lenLongestName {
+			lenLongestName = len(p.GetName())
 		}
-	})
-
-	if err := errors.Build(); err.HasError() {
-		cfg.l.Error(err)
 	}
-}
-
-func (cfg *Config) stopProviders() {
-	cfg.controlProviders("stop routes", (*PR.Provider).StopAllRoutes)
+	cfg.providers.RangeAllParallel(func(_ string, p *proxy.Provider) {
+		if err := p.LoadRoutes(); err != nil {
+			errs.Add(err.Subject(p.String()))
+		}
+		results.Addf("%-"+strconv.Itoa(lenLongestName)+"s %d routes", p.GetName(), p.NumRoutes())
+	})
+	logger.Info().Msg(results.String())
+	return errs.Error()
 }
--- a/internal/config/query.go
+++ b/internal/config/query.go
@@ -1,68 +1,137 @@
 package config

 import (
-	M "github.com/yusing/go-proxy/internal/models"
-	PR "github.com/yusing/go-proxy/internal/proxy/provider"
-	R "github.com/yusing/go-proxy/internal/route"
-	U "github.com/yusing/go-proxy/internal/utils"
+	"fmt"
+	"strings"
+
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/homepage"
+	"github.com/yusing/go-proxy/internal/proxy/entry"
+	"github.com/yusing/go-proxy/internal/route"
+	proxy "github.com/yusing/go-proxy/internal/route/provider"
 	F "github.com/yusing/go-proxy/internal/utils/functional"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

-func (cfg *Config) DumpEntries() map[string]*M.RawEntry {
-	entries := make(map[string]*M.RawEntry)
-	cfg.forEachRoute(func(alias string, r R.Route, p *PR.Provider) {
-		entries[alias] = r.Entry()
+func DumpEntries() map[string]*entry.RawEntry {
+	entries := make(map[string]*entry.RawEntry)
+	instance.providers.RangeAll(func(_ string, p *proxy.Provider) {
+		p.RangeRoutes(func(alias string, r *route.Route) {
+			entries[alias] = r.Entry
+		})
 	})
 	return entries
 }

-func (cfg *Config) DumpProviders() map[string]*PR.Provider {
-	entries := make(map[string]*PR.Provider)
-	cfg.proxyProviders.RangeAll(func(name string, p *PR.Provider) {
+func DumpProviders() map[string]*proxy.Provider {
+	entries := make(map[string]*proxy.Provider)
+	instance.providers.RangeAll(func(name string, p *proxy.Provider) {
 		entries[name] = p
 	})
 	return entries
 }

-func (cfg *Config) RoutesByAlias() map[string]U.SerializedObject {
-	routes := make(map[string]U.SerializedObject)
-	cfg.forEachRoute(func(alias string, r R.Route, p *PR.Provider) {
-		obj, err := U.Serialize(r)
-		if err.HasError() {
-			cfg.l.Error(err)
+func HomepageConfig() homepage.Config {
+	var proto, port string
+	domains := instance.value.MatchDomains
+	cert, _ := instance.autocertProvider.GetCert(nil)
+	if cert != nil {
+		proto = "https"
+		port = common.ProxyHTTPSPort
+	} else {
+		proto = "http"
+		port = common.ProxyHTTPPort
+	}
+
+	hpCfg := homepage.NewHomePageConfig()
+	route.GetReverseProxies().RangeAll(func(alias string, r *route.HTTPRoute) {
+		en := r.Raw
+		item := en.Homepage
+		if item == nil {
+			item = new(homepage.Item)
+			item.Show = true
+		}
+
+		if !item.IsEmpty() {
+			item.Show = true
+		}
+
+		if !item.Show {
 			return
 		}
-		obj["provider"] = p.GetName()
-		obj["type"] = string(r.Type())
-		routes[alias] = obj
+
+		if item.Name == "" {
+			item.Name = strutils.Title(
+				strings.ReplaceAll(
+					strings.ReplaceAll(alias, "-", " "),
+					"_", " ",
+				),
+			)
+		}
+
+		if entry.IsDocker(r) {
+			if item.Category == "" {
+				item.Category = "Docker"
+			}
+			item.SourceType = string(proxy.ProviderTypeDocker)
+		} else if entry.UseLoadBalance(r) {
+			if item.Category == "" {
+				item.Category = "Load-balanced"
+			}
+			item.SourceType = "loadbalancer"
+		} else {
+			if item.Category == "" {
+				item.Category = "Others"
+			}
+			item.SourceType = string(proxy.ProviderTypeFile)
+		}
+
+		if item.URL == "" {
+			if len(domains) > 0 {
+				item.URL = fmt.Sprintf("%s://%s.%s:%s", proto, strings.ToLower(alias), domains[0], port)
+			}
+		}
+		item.AltURL = r.TargetURL().String()
+
+		hpCfg.Add(item)
 	})
+	return hpCfg
+}
+
+func RoutesByAlias(typeFilter ...route.RouteType) map[string]any {
+	routes := make(map[string]any)
+	if len(typeFilter) == 0 || typeFilter[0] == "" {
+		typeFilter = []route.RouteType{route.RouteTypeReverseProxy, route.RouteTypeStream}
+	}
+	for _, t := range typeFilter {
+		switch t {
+		case route.RouteTypeReverseProxy:
+			route.GetReverseProxies().RangeAll(func(alias string, r *route.HTTPRoute) {
+				routes[alias] = r
+			})
+		case route.RouteTypeStream:
+			route.GetStreamProxies().RangeAll(func(alias string, r *route.StreamRoute) {
+				routes[alias] = r
+			})
+		}
+	}
 	return routes
 }

-func (cfg *Config) Statistics() map[string]any {
+func Statistics() map[string]any {
 	nTotalStreams := 0
 	nTotalRPs := 0
-	providerStats := make(map[string]any)
+	providerStats := make(map[string]proxy.ProviderStats)

-	cfg.forEachRoute(func(alias string, r R.Route, p *PR.Provider) {
-		s, ok := providerStats[p.GetName()]
-		if !ok {
-			s = make(map[string]int)
-		}
-
-		stats := s.(map[string]int)
-		switch r.Type() {
-		case R.RouteTypeStream:
-			stats["num_streams"]++
-			nTotalStreams++
-		case R.RouteTypeReverseProxy:
-			stats["num_reverse_proxies"]++
-			nTotalRPs++
-		default:
-			panic("bug: should not reach here")
-		}
+	instance.providers.RangeAll(func(name string, p *proxy.Provider) {
+		providerStats[name] = p.Statistics()
 	})

+	for _, stats := range providerStats {
+		nTotalRPs += stats.NumRPs
+		nTotalStreams += stats.NumStreams
+	}
+
 	return map[string]any{
 		"num_total_streams":         nTotalStreams,
 		"num_total_reverse_proxies": nTotalRPs,
@@ -70,9 +139,9 @@ func (cfg *Config) Statistics() map[string]any {
 	}
 }

-func (cfg *Config) FindRoute(alias string) R.Route {
-	return F.MapFind(cfg.proxyProviders,
-		func(p *PR.Provider) (R.Route, bool) {
+func FindRoute(alias string) *route.Route {
+	return F.MapFind(instance.providers,
+		func(p *proxy.Provider) (*route.Route, bool) {
 			if route, ok := p.GetRoute(alias); ok {
 				return route, true
 			}
--- a/internal/config/types/autocert_config.go
+++ b/internal/config/types/autocert_config.go
@@ -0,0 +1,13 @@
+package types
+
+type (
+	AutoCertConfig struct {
+		Email    string              `json:"email,omitempty" yaml:"email"`
+		Domains  []string            `json:"domains,omitempty" yaml:",flow"`
+		CertPath string              `json:"cert_path,omitempty" yaml:"cert_path"`
+		KeyPath  string              `json:"key_path,omitempty" yaml:"key_path"`
+		Provider string              `json:"provider,omitempty" yaml:"provider"`
+		Options  AutocertProviderOpt `json:"options,omitempty" yaml:",flow"`
+	}
+	AutocertProviderOpt map[string]any
+)
--- a/internal/config/types/config.go
+++ b/internal/config/types/config.go
@@ -0,0 +1,25 @@
+package types
+
+type (
+	Config struct {
+		Providers       Providers      `json:"providers" yaml:",flow"`
+		AutoCert        AutoCertConfig `json:"autocert" yaml:",flow"`
+		ExplicitOnly    bool           `json:"explicit_only" yaml:"explicit_only"`
+		MatchDomains    []string       `json:"match_domains" yaml:"match_domains"`
+		TimeoutShutdown int            `json:"timeout_shutdown" yaml:"timeout_shutdown"`
+		RedirectToHTTPS bool           `json:"redirect_to_https" yaml:"redirect_to_https"`
+	}
+	Providers struct {
+		Files        []string              `json:"include" yaml:"include"`
+		Docker       map[string]string     `json:"docker" yaml:"docker"`
+		Notification NotificationConfigMap `json:"notification" yaml:"notification"`
+	}
+)
+
+func DefaultConfig() *Config {
+	return &Config{
+		Providers:       Providers{},
+		TimeoutShutdown: 3,
+		RedirectToHTTPS: false,
+	}
+}
--- a/internal/config/types/notif_config.go
+++ b/internal/config/types/notif_config.go
@@ -0,0 +1,5 @@
+package types
+
+import "github.com/yusing/go-proxy/internal/notif"
+
+type NotificationConfigMap map[string]notif.ProviderConfig
--- a/internal/docker/client.go
+++ b/internal/docker/client.go
@@ -1,64 +1,63 @@
 package docker

 import (
+	"errors"
 	"net/http"
 	"sync"
-	"sync/atomic"

 	"github.com/docker/cli/cli/connhelper"
 	"github.com/docker/docker/client"
-	"github.com/sirupsen/logrus"
+	"github.com/rs/zerolog"
 	"github.com/yusing/go-proxy/internal/common"
-	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/task"
+	U "github.com/yusing/go-proxy/internal/utils"
 	F "github.com/yusing/go-proxy/internal/utils/functional"
 )

-type Client struct {
-	key      string
-	refCount *atomic.Int32
-	*client.Client
+type (
+	Client       = *SharedClient
+	SharedClient struct {
+		*client.Client

-	l logrus.FieldLogger
-}
+		key      string
+		refCount *U.RefCount

-func ParseDockerHostname(host string) (string, E.NestedError) {
-	switch host {
-	case common.DockerHostFromEnv, "":
-		return "localhost", nil
+		l zerolog.Logger
 	}
-	url, err := E.Check(client.ParseHostURL(host))
-	if err != nil {
-		return "", E.Invalid("host", host).With(err)
+)
+
+var (
+	clientMap   F.Map[string, Client] = F.NewMapOf[string, Client]()
+	clientMapMu sync.Mutex
+
+	clientOptEnvHost = []client.Opt{
+		client.WithHostFromEnv(),
+		client.WithAPIVersionNegotiation(),
 	}
-	return url.Hostname(), nil
+)
+
+func init() {
+	task.GlobalTask("close docker clients").OnFinished("", func() {
+		clientMap.RangeAllParallel(func(_ string, c Client) {
+			if c.Connected() {
+				c.Client.Close()
+			}
+		})
+	})
 }

-func (c Client) DaemonHostname() string {
-	// DaemonHost should always return a valid host
-	hostname, _ := ParseDockerHostname(c.DaemonHost())
-	return hostname
+func (c *SharedClient) Connected() bool {
+	return c != nil && c.Client != nil
 }

-func (c Client) Connected() bool {
-	return c.Client != nil
-}
-
-// if the client is still referenced, this is no-op
-func (c *Client) Close() error {
-	if c.refCount.Add(-1) > 0 {
+// if the client is still referenced, this is no-op.
+func (c *SharedClient) Close() error {
+	if !c.Connected() {
 		return nil
 	}

-	clientMap.Delete(c.key)
-
-	client := c.Client
-	c.Client = nil
-
-	c.l.Debugf("client closed")
-
-	if client != nil {
-		return client.Close()
-	}
+	c.refCount.Sub()
 	return nil
 }

@@ -72,13 +71,13 @@ func (c *Client) Close() error {
 // Returns:
 //   - Client: the Docker client connection.
 //   - error: an error if the connection failed.
-func ConnectClient(host string) (Client, E.NestedError) {
+func ConnectClient(host string) (Client, error) {
 	clientMapMu.Lock()
 	defer clientMapMu.Unlock()

 	// check if client exists
 	if client, ok := clientMap.Load(host); ok {
-		client.refCount.Add(1)
+		client.refCount.Add()
 		return client, nil
 	}

@@ -86,12 +85,14 @@ func ConnectClient(host string) (Client, E.NestedError) {
 	var opt []client.Opt

 	switch host {
+	case "":
+		return nil, errors.New("empty docker host")
 	case common.DockerHostFromEnv:
 		opt = clientOptEnvHost
 	default:
-		helper, err := E.Check(connhelper.GetConnectionHelper(host))
-		if err.HasError() {
-			return Client{}, E.UnexpectedError(err.Error())
+		helper, err := connhelper.GetConnectionHelper(host)
+		if err != nil {
+			logging.Panic().Err(err).Msg("failed to get connection helper")
 		}
 		if helper != nil {
 			httpClient := &http.Client{
@@ -113,41 +114,30 @@ func ConnectClient(host string) (Client, E.NestedError) {
 		}
 	}

-	client, err := E.Check(client.NewClientWithOpts(opt...))
+	client, err := client.NewClientWithOpts(opt...)

-	if err.HasError() {
-		return Client{}, err
+	if err != nil {
+		return nil, err
 	}

-	c := Client{
+	c := &SharedClient{
 		Client:   client,
 		key:      host,
-		refCount: &atomic.Int32{},
-		l:        logger.WithField("docker_client", client.DaemonHost()),
+		refCount: U.NewRefCounter(),
+		l:        logger.With().Str("address", client.DaemonHost()).Logger(),
 	}
-	c.refCount.Add(1)
-	c.l.Debugf("client connected")
+	c.l.Trace().Msg("client connected")

 	clientMap.Store(host, c)
+
+	go func() {
+		<-c.refCount.Zero()
+		clientMap.Delete(c.key)
+
+		if c.Connected() {
+			c.Client.Close()
+			c.l.Trace().Msg("client closed")
+		}
+	}()
 	return c, nil
 }
-
-func CloseAllClients() {
-	clientMap.RangeAll(func(_ string, c Client) {
-		c.Client.Close()
-	})
-	clientMap.Clear()
-	logger.Debug("closed all clients")
-}
-
-var (
-	clientMap   F.Map[string, Client] = F.NewMapOf[string, Client]()
-	clientMapMu sync.Mutex
-
-	clientOptEnvHost = []client.Opt{
-		client.WithHostFromEnv(),
-		client.WithAPIVersionNegotiation(),
-	}
-
-	logger = logrus.WithField("module", "docker")
-)
--- a/internal/docker/client_info.go
+++ b/internal/docker/client_info.go
@@ -1,54 +0,0 @@
-package docker
-
-import (
-	"context"
-	"time"
-
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/client"
-
-	E "github.com/yusing/go-proxy/internal/error"
-)
-
-type ClientInfo struct {
-	Client     Client
-	Containers []types.Container
-}
-
-var listOptions = container.ListOptions{
-	// Filters: filters.NewArgs(
-	// 	filters.Arg("health", "healthy"),
-	// 	filters.Arg("health", "none"),
-	// 	filters.Arg("health", "starting"),
-	// ),
-	All: true,
-}
-
-func GetClientInfo(clientHost string, getContainer bool) (*ClientInfo, E.NestedError) {
-	dockerClient, err := ConnectClient(clientHost)
-	if err.HasError() {
-		return nil, E.FailWith("connect to docker", err)
-	}
-	defer dockerClient.Close()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-
-	var containers []types.Container
-	if getContainer {
-		containers, err = E.Check(dockerClient.ContainerList(ctx, listOptions))
-		if err.HasError() {
-			return nil, E.FailWith("list containers", err)
-		}
-	}
-
-	return &ClientInfo{
-		Client:     dockerClient,
-		Containers: containers,
-	}, nil
-}
-
-func IsErrConnectionFailed(err error) bool {
-	return client.IsErrConnectionFailed(err)
-}
--- a/internal/docker/container.go
+++ b/internal/docker/container.go
@@ -1,109 +1,144 @@
 package docker

 import (
-	"fmt"
+	"net/url"
 	"strconv"
 	"strings"

 	"github.com/docker/docker/api/types"
 	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

-type Container struct {
-	*types.Container
-	*ProxyProperties
-}
+type (
+	PortMapping = map[string]types.Port
+	Container   struct {
+		_ U.NoCopy

-func FromDocker(c *types.Container, dockerHost string) (res Container) {
-	res.Container = c
-	isExplicit := c.Labels[LabelAliases] != ""
-	res.ProxyProperties = &ProxyProperties{
-		DockerHost:         dockerHost,
-		ContainerName:      res.getName(),
-		ImageName:          res.getImageName(),
-		PublicPortMapping:  res.getPublicPortMapping(),
-		PrivatePortMapping: res.getPrivatePortMapping(),
-		NetworkMode:        c.HostConfig.NetworkMode,
-		Aliases:            res.getAliases(),
-		IsExcluded:         U.ParseBool(res.getDeleteLabel(LabelExclude)),
-		IsExplicit:         isExplicit,
-		IdleTimeout:        res.getDeleteLabel(LabelIdleTimeout),
-		WakeTimeout:        res.getDeleteLabel(LabelWakeTimeout),
-		StopMethod:         res.getDeleteLabel(LabelStopMethod),
-		StopTimeout:        res.getDeleteLabel(LabelStopTimeout),
-		StopSignal:         res.getDeleteLabel(LabelStopSignal),
-		Running:            c.Status == "running" || c.State == "running",
+		DockerHost    string `json:"docker_host" yaml:"-"`
+		ContainerName string `json:"container_name" yaml:"-"`
+		ContainerID   string `json:"container_id" yaml:"-"`
+		ImageName     string `json:"image_name" yaml:"-"`
+
+		Labels map[string]string `json:"labels" yaml:"-"`
+
+		PublicPortMapping  PortMapping `json:"public_ports" yaml:"-"`  // non-zero publicPort:types.Port
+		PrivatePortMapping PortMapping `json:"private_ports" yaml:"-"` // privatePort:types.Port
+		PublicIP           string      `json:"public_ip" yaml:"-"`
+		PrivateIP          string      `json:"private_ip" yaml:"-"`
+		NetworkMode        string      `json:"network_mode" yaml:"-"`
+
+		Aliases     []string `json:"aliases" yaml:"-"`
+		IsExcluded  bool     `json:"is_excluded" yaml:"-"`
+		IsExplicit  bool     `json:"is_explicit" yaml:"-"`
+		IsDatabase  bool     `json:"is_database" yaml:"-"`
+		IdleTimeout string   `json:"idle_timeout,omitempty" yaml:"-"`
+		WakeTimeout string   `json:"wake_timeout,omitempty" yaml:"-"`
+		StopMethod  string   `json:"stop_method,omitempty" yaml:"-"`
+		StopTimeout string   `json:"stop_timeout,omitempty" yaml:"-"` // stop_method = "stop" only
+		StopSignal  string   `json:"stop_signal,omitempty" yaml:"-"`  // stop_method = "stop" | "kill" only
+		Running     bool     `json:"running" yaml:"-"`
 	}
+)
+
+var DummyContainer = new(Container)
+
+func FromDocker(c *types.Container, dockerHost string) (res *Container) {
+	isExplicit := c.Labels[LabelAliases] != ""
+	helper := containerHelper{c}
+	res = &Container{
+		DockerHost:    dockerHost,
+		ContainerName: helper.getName(),
+		ContainerID:   c.ID,
+		ImageName:     helper.getImageName(),
+
+		Labels: c.Labels,
+
+		PublicPortMapping:  helper.getPublicPortMapping(),
+		PrivatePortMapping: helper.getPrivatePortMapping(),
+		NetworkMode:        c.HostConfig.NetworkMode,
+
+		Aliases:     helper.getAliases(),
+		IsExcluded:  strutils.ParseBool(helper.getDeleteLabel(LabelExclude)),
+		IsExplicit:  isExplicit,
+		IsDatabase:  helper.isDatabase(),
+		IdleTimeout: helper.getDeleteLabel(LabelIdleTimeout),
+		WakeTimeout: helper.getDeleteLabel(LabelWakeTimeout),
+		StopMethod:  helper.getDeleteLabel(LabelStopMethod),
+		StopTimeout: helper.getDeleteLabel(LabelStopTimeout),
+		StopSignal:  helper.getDeleteLabel(LabelStopSignal),
+		Running:     c.Status == "running" || c.State == "running",
+	}
+	res.setPrivateIP(helper)
+	res.setPublicIP()
 	return
 }

-func FromJson(json types.ContainerJSON, dockerHost string) Container {
+func FromJSON(json types.ContainerJSON, dockerHost string) *Container {
 	ports := make([]types.Port, 0)
 	for k, bindings := range json.NetworkSettings.Ports {
+		privPortStr, proto := k.Port(), k.Proto()
+		privPort, _ := strconv.ParseUint(privPortStr, 10, 16)
+		ports = append(ports, types.Port{
+			PrivatePort: uint16(privPort),
+			Type:        proto,
+		})
 		for _, v := range bindings {
 			pubPort, _ := strconv.ParseUint(v.HostPort, 10, 16)
-			privPort, _ := strconv.ParseUint(k.Port(), 10, 16)
 			ports = append(ports, types.Port{
 				IP:          v.HostIP,
 				PublicPort:  uint16(pubPort),
 				PrivatePort: uint16(privPort),
+				Type:        proto,
 			})
 		}
 	}
 	cont := FromDocker(&types.Container{
 		ID:     json.ID,
-		Names:  []string{json.Name},
+		Names:  []string{strings.TrimPrefix(json.Name, "/")},
 		Image:  json.Image,
 		Ports:  ports,
 		Labels: json.Config.Labels,
 		State:  json.State.Status,
 		Status: json.State.Status,
+		Mounts: json.Mounts,
+		NetworkSettings: &types.SummaryNetworkSettings{
+			Networks: json.NetworkSettings.Networks,
+		},
 	}, dockerHost)
 	cont.NetworkMode = string(json.HostConfig.NetworkMode)
 	return cont
 }

-func (c Container) getDeleteLabel(label string) string {
-	if l, ok := c.Labels[label]; ok {
-		delete(c.Labels, label)
-		return l
+func (c *Container) setPublicIP() {
+	if !c.Running {
+		return
 	}
-	return ""
-}
-
-func (c Container) getAliases() []string {
-	if l := c.getDeleteLabel(LabelAliases); l != "" {
-		return U.CommaSeperatedList(l)
-	} else {
-		return []string{c.getName()}
+	if strings.HasPrefix(c.DockerHost, "unix://") {
+		c.PublicIP = "127.0.0.1"
+		return
 	}
+	url, err := url.Parse(c.DockerHost)
+	if err != nil {
+		logger.Err(err).Msgf("invalid docker host %q, falling back to 127.0.0.1", c.DockerHost)
+		c.PublicIP = "127.0.0.1"
+		return
+	}
+	c.PublicIP = url.Hostname()
 }

-func (c Container) getName() string {
-	return strings.TrimPrefix(c.Names[0], "/")
-}
-
-func (c Container) getImageName() string {
-	colonSep := strings.Split(c.Image, ":")
-	slashSep := strings.Split(colonSep[0], "/")
-	return slashSep[len(slashSep)-1]
-}
-
-func (c Container) getPublicPortMapping() PortMapping {
-	res := make(PortMapping)
-	for _, v := range c.Ports {
-		if v.PublicPort == 0 {
+func (c *Container) setPrivateIP(helper containerHelper) {
+	if !strings.HasPrefix(c.DockerHost, "unix://") {
+		return
+	}
+	if helper.NetworkSettings == nil {
+		return
+	}
+	for _, v := range helper.NetworkSettings.Networks {
+		if v.IPAddress == "" {
 			continue
 		}
-		res[fmt.Sprint(v.PublicPort)] = v
+		c.PrivateIP = v.IPAddress
+		return
 	}
-	return res
-}
-
-func (c Container) getPrivatePortMapping() PortMapping {
-	res := make(PortMapping)
-	for _, v := range c.Ports {
-		res[fmt.Sprint(v.PrivatePort)] = v
-	}
-	return res
 }
--- a/internal/docker/container_helper.go
+++ b/internal/docker/container_helper.go
@@ -0,0 +1,90 @@
+package docker
+
+import (
+	"strings"
+
+	"github.com/docker/docker/api/types"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type containerHelper struct {
+	*types.Container
+}
+
+// getDeleteLabel gets the value of a label and then deletes it from the container.
+// If the label does not exist, an empty string is returned.
+func (c containerHelper) getDeleteLabel(label string) string {
+	if l, ok := c.Labels[label]; ok {
+		delete(c.Labels, label)
+		return l
+	}
+	return ""
+}
+
+func (c containerHelper) getAliases() []string {
+	if l := c.getDeleteLabel(LabelAliases); l != "" {
+		return strutils.CommaSeperatedList(l)
+	}
+	return []string{c.getName()}
+}
+
+func (c containerHelper) getName() string {
+	return strings.TrimPrefix(c.Names[0], "/")
+}
+
+func (c containerHelper) getImageName() string {
+	colonSep := strings.Split(c.Image, ":")
+	slashSep := strings.Split(colonSep[0], "/")
+	return slashSep[len(slashSep)-1]
+}
+
+func (c containerHelper) getPublicPortMapping() PortMapping {
+	res := make(PortMapping)
+	for _, v := range c.Ports {
+		if v.PublicPort == 0 {
+			continue
+		}
+		res[strutils.PortString(v.PublicPort)] = v
+	}
+	return res
+}
+
+func (c containerHelper) getPrivatePortMapping() PortMapping {
+	res := make(PortMapping)
+	for _, v := range c.Ports {
+		res[strutils.PortString(v.PrivatePort)] = v
+	}
+	return res
+}
+
+var databaseMPs = map[string]struct{}{
+	"/var/lib/postgresql/data": {},
+	"/var/lib/mysql":           {},
+	"/var/lib/mongodb":         {},
+	"/var/lib/mariadb":         {},
+	"/var/lib/memcached":       {},
+	"/var/lib/rabbitmq":        {},
+}
+
+var databasePrivPorts = map[uint16]struct{}{
+	5432:  {}, // postgres
+	3306:  {}, // mysql, mariadb
+	6379:  {}, // redis
+	11211: {}, // memcached
+	27017: {}, // mongodb
+}
+
+func (c containerHelper) isDatabase() bool {
+	for _, m := range c.Mounts {
+		if _, ok := databaseMPs[m.Destination]; ok {
+			return true
+		}
+	}
+
+	for _, v := range c.Ports {
+		if _, ok := databasePrivPorts[v.PrivatePort]; ok {
+			return true
+		}
+	}
+	return false
+}
--- a/internal/docker/homepage_label.go
+++ b/internal/docker/homepage_label.go
@@ -1,32 +0,0 @@
-package docker
-
-type (
-	HomePageConfig   struct{ m map[string]HomePageCategory }
-	HomePageCategory []HomePageItem
-
-	HomePageItem struct {
-		Name         string
-		Icon         string
-		Category     string
-		Description  string
-		WidgetConfig map[string]any
-	}
-)
-
-func NewHomePageConfig() *HomePageConfig {
-	return &HomePageConfig{m: make(map[string]HomePageCategory)}
-}
-
-func NewHomePageItem() *HomePageItem {
-	return &HomePageItem{}
-}
-
-func (c *HomePageConfig) Clear() {
-	c.m = make(map[string]HomePageCategory)
-}
-
-func (c *HomePageConfig) Add(item HomePageItem) {
-	c.m[item.Category] = HomePageCategory{item}
-}
-
-const NSHomePage = "homepage"
--- a/internal/docker/idlewatcher/html/loading_page.html
+++ b/internal/docker/idlewatcher/html/loading_page.html
@@ -66,22 +66,23 @@
    <body>
        <script>
            window.onload = async function () {
-                let result = await fetch(window.location.href, {
+                let resp = await fetch(window.location.href, {
                    headers: {
-                        {{ range $key, $value := .RequestHeaders }}
-                        '{{ $key }}' : {{ $value }}
-                        {{ end }}
+                        "{{.CheckRedirectHeader}}": "1",
                    },
-                }).then((resp) => resp.text())
-                    .catch((err) => {
-                        document.getElementById("message").innerText = err;
-                    });
-                if (result) {
-                    document.documentElement.innerHTML = result
+                });
+                if (resp.ok) {
+                    window.location.href = resp.url;
+                } else {
+                    document.getElementById("message").innerText =
+                        await resp.text();
+                    document
+                        .getElementById("spinner")
+                        .classList.replace("spinner", "error");
                }
            };
        </script>
-        <div class="{{.SpinnerClass}}"></div>
-        <div class="message">{{.Message}}</div>
+        <div id="spinner" class="spinner"></div>
+        <div id="message" class="message">{{.Message}}</div>
    </body>
 </html>
--- a/internal/docker/idlewatcher/http.go
+++ b/internal/docker/idlewatcher/http.go
@@ -1,87 +0,0 @@
-package idlewatcher
-
-import (
-	"bytes"
-	_ "embed"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"text/template"
-)
-
-type templateData struct {
-	Title          string
-	Message        string
-	RequestHeaders http.Header
-	SpinnerClass   string
-}
-
-//go:embed html/loading_page.html
-var loadingPage []byte
-var loadingPageTmpl = template.Must(template.New("loading_page").Parse(string(loadingPage)))
-
-const (
-	htmlContentType = "text/html; charset=utf-8"
-
-	errPrefix = "\u1000"
-
-	headerGoProxyTargetURL = "X-GoProxy-Target"
-	headerContentType      = "Content-Type"
-
-	spinnerClassSpinner   = "spinner"
-	spinnerClassErrorSign = "error"
-)
-
-func (w *watcher) makeSuccResp(redirectURL string, resp *http.Response) (*http.Response, error) {
-	h := make(http.Header)
-	h.Set("Location", redirectURL)
-	h.Set("Content-Length", "0")
-	h.Set(headerContentType, htmlContentType)
-	return &http.Response{
-		StatusCode: http.StatusTemporaryRedirect,
-		Header:     h,
-		Body:       http.NoBody,
-		TLS:        resp.TLS,
-	}, nil
-}
-
-func (w *watcher) makeErrResp(errFmt string, args ...any) (*http.Response, error) {
-	return w.makeResp(errPrefix+errFmt, args...)
-}
-
-func (w *watcher) makeResp(format string, args ...any) (*http.Response, error) {
-	msg := fmt.Sprintf(format, args...)
-
-	data := new(templateData)
-	data.Title = w.ContainerName
-	data.Message = strings.ReplaceAll(msg, "\n", "<br>")
-	data.Message = strings.ReplaceAll(data.Message, " ", "&ensp;")
-	data.RequestHeaders = make(http.Header)
-	data.RequestHeaders.Add(headerGoProxyTargetURL, "window.location.href")
-	if strings.HasPrefix(data.Message, errPrefix) {
-		data.Message = strings.TrimLeft(data.Message, errPrefix)
-		data.SpinnerClass = spinnerClassErrorSign
-	} else {
-		data.SpinnerClass = spinnerClassSpinner
-	}
-
-	buf := bytes.NewBuffer(make([]byte, 128)) // more than enough
-	err := loadingPageTmpl.Execute(buf, data)
-	if err != nil { // should never happen
-		panic(err)
-	}
-	return &http.Response{
-		StatusCode: http.StatusAccepted,
-		Header: http.Header{
-			headerContentType: {htmlContentType},
-			"Cache-Control": {
-				"no-cache",
-				"no-store",
-				"must-revalidate",
-			},
-		},
-		Body:          io.NopCloser(buf),
-		ContentLength: int64(buf.Len()),
-	}, nil
-}
--- a/internal/docker/idlewatcher/loading_page.go
+++ b/internal/docker/idlewatcher/loading_page.go
@@ -0,0 +1,37 @@
+package idlewatcher
+
+import (
+	"bytes"
+	_ "embed"
+	"fmt"
+	"strings"
+	"text/template"
+
+	"github.com/yusing/go-proxy/internal/common"
+)
+
+type templateData struct {
+	CheckRedirectHeader string
+	Title               string
+	Message             string
+}
+
+//go:embed html/loading_page.html
+var loadingPage []byte
+var loadingPageTmpl = template.Must(template.New("loading_page").Parse(string(loadingPage)))
+
+func (w *Watcher) makeLoadingPageBody() []byte {
+	msg := fmt.Sprintf("%s is starting...", w.ContainerName)
+
+	data := new(templateData)
+	data.CheckRedirectHeader = common.HeaderCheckRedirect
+	data.Title = w.ContainerName
+	data.Message = strings.ReplaceAll(msg, " ", "&ensp;")
+
+	buf := bytes.NewBuffer(make([]byte, len(loadingPage)+len(data.Title)+len(data.Message)+len(common.HeaderCheckRedirect)))
+	err := loadingPageTmpl.Execute(buf, data)
+	if err != nil { // should never happen in production
+		panic(err)
+	}
+	return buf.Bytes()
+}
--- a/internal/docker/idlewatcher/round_trip.go
+++ b/internal/docker/idlewatcher/round_trip.go
@@ -1,83 +0,0 @@
-package idlewatcher
-
-import (
-	"context"
-	"net/http"
-)
-
-type (
-	roundTripper struct {
-		patched roundTripFunc
-	}
-	roundTripFunc func(*http.Request) (*http.Response, error)
-)
-
-func (rt roundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	return rt.patched(req)
-}
-
-func (w *watcher) roundTrip(origRoundTrip roundTripFunc, req *http.Request) (*http.Response, error) {
-	// wake the container
-	select {
-	case w.wakeCh <- struct{}{}:
-	default:
-	}
-
-	// target site is ready, passthrough
-	if w.ready.Load() {
-		return origRoundTrip(req)
-	}
-
-	// initial request
-	targetUrl := req.Header.Get(headerGoProxyTargetURL)
-	if targetUrl == "" {
-		return w.makeResp(
-			"%s is starting... Please wait",
-			w.ContainerName,
-		)
-	}
-
-	w.l.Debug("serving event")
-
-	// stream request
-	rtDone := make(chan *http.Response, 1)
-	ctx, cancel := context.WithTimeout(req.Context(), w.WakeTimeout)
-	defer cancel()
-
-	// loop original round trip until success in a goroutine
-	go func() {
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-w.ctx.Done():
-				return
-			default:
-				resp, err := origRoundTrip(req)
-				if err == nil {
-					w.ready.Store(true)
-					rtDone <- resp
-					return
-				}
-			}
-		}
-	}()
-
-	for {
-		select {
-		case resp := <-rtDone:
-			return w.makeSuccResp(targetUrl, resp)
-		case err := <-w.wakeDone:
-			if err != nil {
-				return w.makeErrResp("error waking up %s\n%s", w.ContainerName, err.Error())
-			}
-		case <-ctx.Done():
-			if ctx.Err() == context.DeadlineExceeded {
-				return w.makeErrResp("Timed out waiting for %s to fully wake", w.ContainerName)
-			}
-			return w.makeErrResp("idlewatcher has stopped\n%s", w.ctx.Err().Error())
-		case <-w.ctx.Done():
-			return w.makeErrResp("idlewatcher has stopped\n%s", w.ctx.Err().Error())
-		}
-	}
-}
--- a/internal/docker/idlewatcher/types/config.go
+++ b/internal/docker/idlewatcher/types/config.go
@@ -0,0 +1,103 @@
+package types
+
+import (
+	"errors"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/docker"
+	E "github.com/yusing/go-proxy/internal/error"
+)
+
+type (
+	Config struct {
+		IdleTimeout time.Duration `json:"idle_timeout,omitempty"`
+		WakeTimeout time.Duration `json:"wake_timeout,omitempty"`
+		StopTimeout int           `json:"stop_timeout,omitempty"` // docker api takes integer seconds for timeout argument
+		StopMethod  StopMethod    `json:"stop_method,omitempty"`
+		StopSignal  Signal        `json:"stop_signal,omitempty"`
+
+		DockerHost       string `json:"docker_host,omitempty"`
+		ContainerName    string `json:"container_name,omitempty"`
+		ContainerID      string `json:"container_id,omitempty"`
+		ContainerRunning bool   `json:"container_running,omitempty"`
+	}
+	StopMethod string
+	Signal     string
+)
+
+const (
+	StopMethodPause StopMethod = "pause"
+	StopMethodStop  StopMethod = "stop"
+	StopMethodKill  StopMethod = "kill"
+)
+
+func ValidateConfig(cont *docker.Container) (*Config, E.Error) {
+	if cont == nil {
+		return nil, nil
+	}
+
+	if cont.IdleTimeout == "" {
+		return &Config{
+			DockerHost:       cont.DockerHost,
+			ContainerName:    cont.ContainerName,
+			ContainerID:      cont.ContainerID,
+			ContainerRunning: cont.Running,
+		}, nil
+	}
+
+	errs := E.NewBuilder("invalid idlewatcher config")
+
+	idleTimeout := E.Collect(errs, validateDurationPostitive, cont.IdleTimeout)
+	wakeTimeout := E.Collect(errs, validateDurationPostitive, cont.WakeTimeout)
+	stopTimeout := E.Collect(errs, validateDurationPostitive, cont.StopTimeout)
+	stopMethod := E.Collect(errs, validateStopMethod, cont.StopMethod)
+	signal := E.Collect(errs, validateSignal, cont.StopSignal)
+
+	if errs.HasError() {
+		return nil, errs.Error()
+	}
+
+	return &Config{
+		IdleTimeout: idleTimeout,
+		WakeTimeout: wakeTimeout,
+		StopTimeout: int(stopTimeout.Seconds()),
+		StopMethod:  stopMethod,
+		StopSignal:  signal,
+
+		DockerHost:       cont.DockerHost,
+		ContainerName:    cont.ContainerName,
+		ContainerID:      cont.ContainerID,
+		ContainerRunning: cont.Running,
+	}, nil
+}
+
+func validateDurationPostitive(value string) (time.Duration, error) {
+	d, err := time.ParseDuration(value)
+	if err != nil {
+		return 0, err
+	}
+	if d < 0 {
+		return 0, errors.New("duration must be positive")
+	}
+	return d, nil
+}
+
+func validateSignal(s string) (Signal, error) {
+	switch s {
+	case "", "SIGINT", "SIGTERM", "SIGHUP", "SIGQUIT",
+		"INT", "TERM", "HUP", "QUIT":
+		return Signal(s), nil
+	}
+
+	return "", errors.New("invalid signal " + s)
+}
+
+func validateStopMethod(s string) (StopMethod, error) {
+	sm := StopMethod(s)
+	switch sm {
+	case StopMethodPause, StopMethodStop, StopMethodKill:
+		return sm, nil
+	default:
+		return "", errors.New("invalid stop method " + s)
+	}
+}
--- a/internal/docker/idlewatcher/types/waker.go
+++ b/internal/docker/idlewatcher/types/waker.go
@@ -0,0 +1,14 @@
+package types
+
+import (
+	"net/http"
+
+	net "github.com/yusing/go-proxy/internal/net/types"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+)
+
+type Waker interface {
+	health.HealthMonitor
+	http.Handler
+	net.Stream
+}
--- a/internal/docker/idlewatcher/waker.go
+++ b/internal/docker/idlewatcher/waker.go
@@ -0,0 +1,133 @@
+package idlewatcher
+
+import (
+	"sync/atomic"
+	"time"
+
+	. "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
+	E "github.com/yusing/go-proxy/internal/error"
+	gphttp "github.com/yusing/go-proxy/internal/net/http"
+	net "github.com/yusing/go-proxy/internal/net/types"
+	"github.com/yusing/go-proxy/internal/proxy/entry"
+	"github.com/yusing/go-proxy/internal/task"
+	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+)
+
+type waker struct {
+	_ U.NoCopy
+
+	rp     *gphttp.ReverseProxy
+	stream net.Stream
+	hc     health.HealthChecker
+
+	ready atomic.Bool
+}
+
+const (
+	idleWakerCheckInterval = 100 * time.Millisecond
+	idleWakerCheckTimeout  = time.Second
+)
+
+// TODO: support stream
+
+func newWaker(providerSubTask task.Task, entry entry.Entry, rp *gphttp.ReverseProxy, stream net.Stream) (Waker, E.Error) {
+	hcCfg := entry.HealthCheckConfig()
+	hcCfg.Timeout = idleWakerCheckTimeout
+
+	waker := &waker{
+		rp:     rp,
+		stream: stream,
+	}
+
+	watcher, err := registerWatcher(providerSubTask, entry, waker)
+	if err != nil {
+		return nil, E.Errorf("register watcher: %w", err)
+	}
+
+	if rp != nil {
+		waker.hc = health.NewHTTPHealthChecker(entry.TargetURL(), hcCfg, rp.Transport)
+	} else if stream != nil {
+		waker.hc = health.NewRawHealthChecker(entry.TargetURL(), hcCfg)
+	} else {
+		panic("both nil")
+	}
+	return watcher, nil
+}
+
+// lifetime should follow route provider
+func NewHTTPWaker(providerSubTask task.Task, entry entry.Entry, rp *gphttp.ReverseProxy) (Waker, E.Error) {
+	return newWaker(providerSubTask, entry, rp, nil)
+}
+
+func NewStreamWaker(providerSubTask task.Task, entry entry.Entry, stream net.Stream) (Waker, E.Error) {
+	return newWaker(providerSubTask, entry, nil, stream)
+}
+
+// Start implements health.HealthMonitor.
+func (w *Watcher) Start(routeSubTask task.Task) E.Error {
+	routeSubTask.Finish("ignored")
+	w.task.OnCancel("stop route", func() {
+		routeSubTask.Parent().Finish(w.task.FinishCause())
+	})
+	return nil
+}
+
+// Finish implements health.HealthMonitor.
+func (w *Watcher) Finish(reason any) {
+	if w.stream != nil {
+		w.stream.Close()
+	}
+}
+
+// Name implements health.HealthMonitor.
+func (w *Watcher) Name() string {
+	return w.String()
+}
+
+// String implements health.HealthMonitor.
+func (w *Watcher) String() string {
+	return w.ContainerName
+}
+
+// Uptime implements health.HealthMonitor.
+func (w *Watcher) Uptime() time.Duration {
+	return 0
+}
+
+// Status implements health.HealthMonitor.
+func (w *Watcher) Status() health.Status {
+	if !w.ContainerRunning {
+		return health.StatusNapping
+	}
+
+	if w.ready.Load() {
+		return health.StatusHealthy
+	}
+
+	healthy, _, err := w.hc.CheckHealth()
+	switch {
+	case err != nil:
+		w.ready.Store(false)
+		return health.StatusError
+	case healthy:
+		w.ready.Store(true)
+		return health.StatusHealthy
+	default:
+		return health.StatusStarting
+	}
+}
+
+// MarshalJSON implements health.HealthMonitor.
+func (w *Watcher) MarshalJSON() ([]byte, error) {
+	var url net.URL
+	if w.hc.URL().Port() != "0" {
+		url = w.hc.URL()
+	}
+	return (&health.JSONRepresentation{
+		Name:   w.Name(),
+		Status: w.Status(),
+		Config: w.hc.Config(),
+		URL:    url,
+	}).MarshalJSON()
+}
--- a/internal/docker/idlewatcher/waker_http.go
+++ b/internal/docker/idlewatcher/waker_http.go
@@ -0,0 +1,108 @@
+package idlewatcher
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/common"
+	gphttp "github.com/yusing/go-proxy/internal/net/http"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+)
+
+// ServeHTTP implements http.Handler
+func (w *Watcher) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	shouldNext := w.wakeFromHTTP(rw, r)
+	if !shouldNext {
+		return
+	}
+	select {
+	case <-r.Context().Done():
+		return
+	default:
+		w.rp.ServeHTTP(rw, r)
+	}
+}
+
+func (w *Watcher) wakeFromHTTP(rw http.ResponseWriter, r *http.Request) (shouldNext bool) {
+	w.resetIdleTimer()
+
+	// pass through if container is already ready
+	if w.ready.Load() {
+		return true
+	}
+
+	if r.Body != nil {
+		defer r.Body.Close()
+	}
+
+	accept := gphttp.GetAccept(r.Header)
+	acceptHTML := (r.Method == http.MethodGet && accept.AcceptHTML() || r.RequestURI == "/" && accept.IsEmpty())
+
+	isCheckRedirect := r.Header.Get(common.HeaderCheckRedirect) != ""
+	if !isCheckRedirect && acceptHTML {
+		// Send a loading response to the client
+		body := w.makeLoadingPageBody()
+		rw.Header().Set("Content-Type", "text/html; charset=utf-8")
+		rw.Header().Set("Content-Length", strconv.Itoa(len(body)))
+		rw.Header().Add("Cache-Control", "no-cache")
+		rw.Header().Add("Cache-Control", "no-store")
+		rw.Header().Add("Cache-Control", "must-revalidate")
+		rw.Header().Add("Connection", "close")
+		if _, err := rw.Write(body); err != nil {
+			w.Err(err).Msg("error writing http response")
+		}
+		return false
+	}
+
+	ctx, cancel := context.WithTimeoutCause(r.Context(), w.WakeTimeout, errors.New("wake timeout"))
+	defer cancel()
+
+	checkCanceled := func() (canceled bool) {
+		select {
+		case <-ctx.Done():
+			w.WakeDebug().Str("cause", context.Cause(ctx).Error()).Msg("canceled")
+			return true
+		case <-w.task.Context().Done():
+			w.WakeDebug().Str("cause", w.task.FinishCause().Error()).Msg("canceled")
+			http.Error(rw, "Service unavailable", http.StatusServiceUnavailable)
+			return true
+		default:
+			return false
+		}
+	}
+
+	if checkCanceled() {
+		return false
+	}
+
+	w.WakeTrace().Msg("signal received")
+	err := w.wakeIfStopped()
+	if err != nil {
+		w.WakeError(err).Send()
+		http.Error(rw, "Error waking container", http.StatusInternalServerError)
+		return false
+	}
+
+	for {
+		if checkCanceled() {
+			return false
+		}
+
+		if w.Status() == health.StatusHealthy {
+			w.resetIdleTimer()
+			if isCheckRedirect {
+				w.Debug().Msgf("redirecting to %s ...", w.hc.URL())
+				rw.WriteHeader(http.StatusOK)
+				return false
+			}
+			w.Debug().Msgf("passing through to %s ...", w.hc.URL())
+			return true
+		}
+
+		// retry until the container is ready or timeout
+		time.Sleep(idleWakerCheckInterval)
+	}
+}
--- a/internal/docker/idlewatcher/waker_stream.go
+++ b/internal/docker/idlewatcher/waker_stream.go
@@ -0,0 +1,90 @@
+package idlewatcher
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/net/types"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+)
+
+// Setup implements types.Stream.
+func (w *Watcher) Addr() net.Addr {
+	return w.stream.Addr()
+}
+
+// Setup implements types.Stream.
+func (w *Watcher) Setup() error {
+	return w.stream.Setup()
+}
+
+// Accept implements types.Stream.
+func (w *Watcher) Accept() (conn types.StreamConn, err error) {
+	conn, err = w.stream.Accept()
+	if err != nil {
+		return
+	}
+	if wakeErr := w.wakeFromStream(); wakeErr != nil {
+		w.WakeError(wakeErr).Msg("error waking from stream")
+	}
+	return
+}
+
+// Handle implements types.Stream.
+func (w *Watcher) Handle(conn types.StreamConn) error {
+	if err := w.wakeFromStream(); err != nil {
+		return err
+	}
+	return w.stream.Handle(conn)
+}
+
+// Close implements types.Stream.
+func (w *Watcher) Close() error {
+	return w.stream.Close()
+}
+
+func (w *Watcher) wakeFromStream() error {
+	w.resetIdleTimer()
+
+	// pass through if container is already ready
+	if w.ready.Load() {
+		return nil
+	}
+
+	w.WakeDebug().Msg("wake signal received")
+	wakeErr := w.wakeIfStopped()
+	if wakeErr != nil {
+		wakeErr = fmt.Errorf("%s failed: %w", w.String(), wakeErr)
+		w.WakeError(wakeErr).Msg("wake failed")
+		return wakeErr
+	}
+
+	ctx, cancel := context.WithTimeoutCause(w.task.Context(), w.WakeTimeout, errors.New("wake timeout"))
+	defer cancel()
+
+	for {
+		select {
+		case <-w.task.Context().Done():
+			cause := w.task.FinishCause()
+			w.WakeDebug().Str("cause", cause.Error()).Msg("canceled")
+			return cause
+		case <-ctx.Done():
+			cause := context.Cause(ctx)
+			w.WakeDebug().Str("cause", cause.Error()).Msg("timeout")
+			return cause
+		default:
+		}
+
+		if w.Status() == health.StatusHealthy {
+			w.resetIdleTimer()
+			w.Debug().Msg("container is ready, passing through to " + w.hc.URL().String())
+			return nil
+		}
+
+		// retry until the container is ready or timeout
+		time.Sleep(idleWakerCheckInterval)
+	}
+}
--- a/internal/docker/idlewatcher/watcher.go
+++ b/internal/docker/idlewatcher/watcher.go
@@ -2,274 +2,288 @@ package idlewatcher

 import (
 	"context"
-	"net/http"
+	"errors"
 	"sync"
-	"sync/atomic"
 	"time"

 	"github.com/docker/docker/api/types/container"
-	"github.com/sirupsen/logrus"
+	"github.com/rs/zerolog"
 	D "github.com/yusing/go-proxy/internal/docker"
+	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
 	E "github.com/yusing/go-proxy/internal/error"
-	P "github.com/yusing/go-proxy/internal/proxy"
-	PT "github.com/yusing/go-proxy/internal/proxy/fields"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/proxy/entry"
+	"github.com/yusing/go-proxy/internal/task"
+	U "github.com/yusing/go-proxy/internal/utils"
+	F "github.com/yusing/go-proxy/internal/utils/functional"
+	"github.com/yusing/go-proxy/internal/watcher"
 	W "github.com/yusing/go-proxy/internal/watcher"
+	"github.com/yusing/go-proxy/internal/watcher/events"
 )

 type (
-	watcher struct {
-		*P.ReverseProxyEntry
+	Watcher struct {
+		_ U.NoCopy

-		client D.Client
+		zerolog.Logger

-		ready        atomic.Bool  // whether the site is ready to accept connection
+		*idlewatcher.Config
+		*waker
+
+		client       D.Client
 		stopByMethod StopCallback // send a docker command w.r.t. `stop_method`
-
-		wakeCh   chan struct{}
-		wakeDone chan E.NestedError
-
-		ctx      context.Context
-		cancel   context.CancelFunc
-		refCount *sync.WaitGroup
-
-		l logrus.FieldLogger
+		ticker       *time.Ticker
+		task         task.Task
 	}

 	WakeDone     <-chan error
 	WakeFunc     func() WakeDone
-	StopCallback func() E.NestedError
+	StopCallback func() error
 )

 var (
-	mainLoopCtx    context.Context
-	mainLoopCancel context.CancelFunc
-	mainLoopWg     sync.WaitGroup
-
-	watcherMap   = make(map[string]*watcher)
+	watcherMap   = F.NewMapOf[string, *Watcher]()
 	watcherMapMu sync.Mutex

-	newWatcherCh = make(chan *watcher)
-
-	logger = logrus.WithField("module", "idle_watcher")
+	logger = logging.With().Str("module", "idle_watcher").Logger()
 )

-func Register(entry *P.ReverseProxyEntry) (*watcher, E.NestedError) {
-	failure := E.Failure("idle_watcher register")
+const dockerReqTimeout = 3 * time.Second

-	if entry.IdleTimeout == 0 {
-		return nil, failure.With(E.Invalid("idle_timeout", 0))
+func registerWatcher(providerSubtask task.Task, entry entry.Entry, waker *waker) (*Watcher, error) {
+	cfg := entry.IdlewatcherConfig()
+
+	if cfg.IdleTimeout == 0 {
+		panic("should not reach here")
 	}

 	watcherMapMu.Lock()
 	defer watcherMapMu.Unlock()

-	if w, ok := watcherMap[entry.ContainerName]; ok {
-		w.refCount.Add(1)
-		w.ReverseProxyEntry = entry
+	key := cfg.ContainerID
+
+	if w, ok := watcherMap.Load(key); ok {
+		w.Config = cfg
+		w.waker = waker
+		w.resetIdleTimer()
+		providerSubtask.Finish("used existing watcher")
 		return w, nil
 	}

-	client, err := D.ConnectClient(entry.DockerHost)
-	if err.HasError() {
-		return nil, failure.With(err)
+	client, err := D.ConnectClient(cfg.DockerHost)
+	if err != nil {
+		return nil, err
 	}

-	w := &watcher{
-		ReverseProxyEntry: entry,
-		client:            client,
-		refCount:          &sync.WaitGroup{},
-		wakeCh:            make(chan struct{}),
-		wakeDone:          make(chan E.NestedError),
-		l:                 logger.WithField("container", entry.ContainerName),
+	w := &Watcher{
+		Logger: logger.With().Str("name", cfg.ContainerName).Logger(),
+		Config: cfg,
+		waker:  waker,
+		client: client,
+		task:   providerSubtask,
+		ticker: time.NewTicker(cfg.IdleTimeout),
 	}
-	w.refCount.Add(1)
 	w.stopByMethod = w.getStopCallback()
-
-	watcherMap[w.ContainerName] = w
+	watcherMap.Store(key, w)

 	go func() {
-		newWatcherCh <- w
+		cause := w.watchUntilDestroy()
+
+		watcherMap.Delete(w.ContainerID)
+
+		w.ticker.Stop()
+		w.client.Close()
+		w.task.Finish(cause)
 	}()

 	return w, nil
 }

-func Unregister(containerName string) {
-	if w, ok := watcherMap[containerName]; ok {
-		w.refCount.Add(-1)
-	}
+// WakeDebug logs a debug message related to waking the container.
+func (w *Watcher) WakeDebug() *zerolog.Event {
+	return w.Debug().Str("action", "wake")
 }

-func Start() {
-	logger.Debug("started")
-	defer logger.Debug("stopped")
-
-	mainLoopCtx, mainLoopCancel = context.WithCancel(context.Background())
-
-	for {
-		select {
-		case <-mainLoopCtx.Done():
-			return
-		case w := <-newWatcherCh:
-			w.l.Debug("registered")
-			mainLoopWg.Add(1)
-			go func() {
-				w.watchUntilCancel()
-				w.refCount.Wait() // wait for 0 ref count
-
-				w.client.Close()
-				delete(watcherMap, w.ContainerName)
-				w.l.Debug("unregistered")
-				mainLoopWg.Done()
-			}()
-		}
-	}
+func (w *Watcher) WakeTrace() *zerolog.Event {
+	return w.Trace().Str("action", "wake")
 }

-func Stop() {
-	mainLoopCancel()
-	mainLoopWg.Wait()
+func (w *Watcher) WakeError(err error) *zerolog.Event {
+	return w.Err(err).Str("action", "wake")
 }

-func (w *watcher) PatchRoundTripper(rtp http.RoundTripper) roundTripper {
-	return roundTripper{patched: func(r *http.Request) (*http.Response, error) {
-		return w.roundTrip(rtp.RoundTrip, r)
-	}}
+func (w *Watcher) LogReason(action, reason string) {
+	w.Info().Str("reason", reason).Msg(action)
 }

-func (w *watcher) containerStop() error {
-	return w.client.ContainerStop(w.ctx, w.ContainerName, container.StopOptions{
+func (w *Watcher) containerStop(ctx context.Context) error {
+	return w.client.ContainerStop(ctx, w.ContainerID, container.StopOptions{
 		Signal:  string(w.StopSignal),
-		Timeout: &w.StopTimeout})
+		Timeout: &w.StopTimeout,
+	})
 }

-func (w *watcher) containerPause() error {
-	return w.client.ContainerPause(w.ctx, w.ContainerName)
+func (w *Watcher) containerPause(ctx context.Context) error {
+	return w.client.ContainerPause(ctx, w.ContainerID)
 }

-func (w *watcher) containerKill() error {
-	return w.client.ContainerKill(w.ctx, w.ContainerName, string(w.StopSignal))
+func (w *Watcher) containerKill(ctx context.Context) error {
+	return w.client.ContainerKill(ctx, w.ContainerID, string(w.StopSignal))
 }

-func (w *watcher) containerUnpause() error {
-	return w.client.ContainerUnpause(w.ctx, w.ContainerName)
+func (w *Watcher) containerUnpause(ctx context.Context) error {
+	return w.client.ContainerUnpause(ctx, w.ContainerID)
 }

-func (w *watcher) containerStart() error {
-	return w.client.ContainerStart(w.ctx, w.ContainerName, container.StartOptions{})
+func (w *Watcher) containerStart(ctx context.Context) error {
+	return w.client.ContainerStart(ctx, w.ContainerID, container.StartOptions{})
 }

-func (w *watcher) containerStatus() (string, E.NestedError) {
-	json, err := w.client.ContainerInspect(w.ctx, w.ContainerName)
+func (w *Watcher) containerStatus() (string, error) {
+	if !w.client.Connected() {
+		return "", errors.New("docker client not connected")
+	}
+	ctx, cancel := context.WithTimeoutCause(w.task.Context(), dockerReqTimeout, errors.New("docker request timeout"))
+	defer cancel()
+	json, err := w.client.ContainerInspect(ctx, w.ContainerID)
 	if err != nil {
-		return "", E.FailWith("inspect container", err)
+		return "", err
 	}
 	return json.State.Status, nil
 }

-func (w *watcher) wakeIfStopped() E.NestedError {
-	status, err := w.containerStatus()
+func (w *Watcher) wakeIfStopped() error {
+	if w.ContainerRunning {
+		return nil
+	}

-	if err.HasError() {
+	status, err := w.containerStatus()
+	if err != nil {
 		return err
 	}
-	// "created", "running", "paused", "restarting", "removing", "exited", or "dead"
+
+	ctx, cancel := context.WithTimeout(w.task.Context(), w.WakeTimeout)
+	defer cancel()
+
+	// !Hard coded here since theres no constants from Docker API
 	switch status {
 	case "exited", "dead":
-		return E.From(w.containerStart())
+		return w.containerStart(ctx)
 	case "paused":
-		return E.From(w.containerUnpause())
+		return w.containerUnpause(ctx)
 	case "running":
 		return nil
 	default:
-		return E.Unexpected("container state", status)
+		panic("should not reach here")
 	}
 }

-func (w *watcher) getStopCallback() StopCallback {
-	var cb func() error
+func (w *Watcher) getStopCallback() StopCallback {
+	var cb func(context.Context) error
 	switch w.StopMethod {
-	case PT.StopMethodPause:
+	case idlewatcher.StopMethodPause:
 		cb = w.containerPause
-	case PT.StopMethodStop:
+	case idlewatcher.StopMethodStop:
 		cb = w.containerStop
-	case PT.StopMethodKill:
+	case idlewatcher.StopMethodKill:
 		cb = w.containerKill
 	default:
 		panic("should not reach here")
 	}
-	return func() E.NestedError {
-		status, err := w.containerStatus()
-		if err.HasError() {
-			return err
-		}
-		if status != "running" {
-			return nil
-		}
-		return E.From(cb())
+	return func() error {
+		ctx, cancel := context.WithTimeout(w.task.Context(), time.Duration(w.StopTimeout)*time.Second)
+		defer cancel()
+		return cb(ctx)
 	}
 }

-func (w *watcher) watchUntilCancel() {
-	defer close(w.wakeCh)
+func (w *Watcher) resetIdleTimer() {
+	w.Trace().Msg("reset idle timer")
+	w.ticker.Reset(w.IdleTimeout)
+}

-	w.ctx, w.cancel = context.WithCancel(context.Background())
-
-	dockerWatcher := W.NewDockerWatcherWithClient(w.client)
-	dockerEventCh, dockerEventErrCh := dockerWatcher.EventsWithOptions(w.ctx, W.DockerListOptions{
+func (w *Watcher) getEventCh(dockerWatcher watcher.DockerWatcher) (eventTask task.Task, eventCh <-chan events.Event, errCh <-chan E.Error) {
+	eventTask = w.task.Subtask("docker event watcher")
+	eventCh, errCh = dockerWatcher.EventsWithOptions(eventTask.Context(), W.DockerListOptions{
 		Filters: W.NewDockerFilter(
 			W.DockerFilterContainer,
-			W.DockerrFilterContainerName(w.ContainerName),
+			W.DockerFilterContainerNameID(w.ContainerID),
 			W.DockerFilterStart,
 			W.DockerFilterStop,
 			W.DockerFilterDie,
 			W.DockerFilterKill,
+			W.DockerFilterDestroy,
 			W.DockerFilterPause,
 			W.DockerFilterUnpause,
 		),
 	})
+	return
+}

-	ticker := time.NewTicker(w.IdleTimeout)
-	defer ticker.Stop()
+// watchUntilDestroy waits for the container to be created, started, or unpaused,
+// and then reset the idle timer.
+//
+// When the container is stopped, paused,
+// or killed, the idle timer is stopped and the ContainerRunning flag is set to false.
+//
+// When the idle timer fires, the container is stopped according to the
+// stop method.
+//
+// it exits only if the context is canceled, the container is destroyed,
+// errors occured on docker client, or route provider died (mainly caused by config reload).
+func (w *Watcher) watchUntilDestroy() (returnCause error) {
+	dockerWatcher := W.NewDockerWatcherWithClient(w.client)
+	eventTask, dockerEventCh, dockerEventErrCh := w.getEventCh(dockerWatcher)
+	defer eventTask.Finish("stopped")

 	for {
 		select {
-		case <-mainLoopCtx.Done():
-			w.cancel()
-		case <-w.ctx.Done():
-			w.l.Debug("stopped")
-			return
+		case <-w.task.Context().Done():
+			return w.task.FinishCause()
 		case err := <-dockerEventErrCh:
-			if err != nil && err.IsNot(context.Canceled) {
-				w.l.Error(E.FailWith("docker watcher", err))
+			if !err.Is(context.Canceled) {
+				E.LogError("idlewatcher error", err, &w.Logger)
 			}
+			return err
 		case e := <-dockerEventCh:
 			switch {
+			case e.Action == events.ActionContainerDestroy:
+				w.ContainerRunning = false
+				w.ready.Store(false)
+				w.LogReason("watcher stopped", "container destroyed")
+				return errors.New("container destroyed")
 			// create / start / unpause
 			case e.Action.IsContainerWake():
-				ticker.Reset(w.IdleTimeout)
-				w.l.Info(e)
-			default: // stop / pause / kill
-				ticker.Stop()
+				w.ContainerRunning = true
+				w.resetIdleTimer()
+				w.Info().Msg("awaken")
+			case e.Action.IsContainerSleep(): // stop / pause / kil
+				w.ContainerRunning = false
 				w.ready.Store(false)
-				w.l.Info(e)
-			}
-		case <-ticker.C:
-			w.l.Debug("idle timeout")
-			ticker.Stop()
-			if err := w.stopByMethod(); err != nil && err.IsNot(context.Canceled) {
-				w.l.Error(E.FailWith("stop", err).Extraf("stop method: %s", w.StopMethod))
-			}
-		case <-w.wakeCh:
-			w.l.Debug("wake signal received")
-			ticker.Reset(w.IdleTimeout)
-			err := w.wakeIfStopped()
-			if err != nil && err.IsNot(context.Canceled) {
-				w.l.Error(E.FailWith("wake", err))
-			}
-			select {
-			case w.wakeDone <- err: // this is passed to roundtrip
+				w.ticker.Stop()
 			default:
+				w.Error().Msg("unexpected docker event: " + e.String())
+			}
+			// container name changed should also change the container id
+			if w.ContainerName != e.ActorName {
+				w.Debug().Msgf("renamed %s -> %s", w.ContainerName, e.ActorName)
+				w.ContainerName = e.ActorName
+			}
+			if w.ContainerID != e.ActorID {
+				w.Debug().Msgf("id changed %s -> %s", w.ContainerID, e.ActorID)
+				w.ContainerID = e.ActorID
+				// recreate event stream
+				eventTask.Finish("recreate event stream")
+				eventTask, dockerEventCh, dockerEventErrCh = w.getEventCh(dockerWatcher)
+			}
+		case <-w.ticker.C:
+			w.ticker.Stop()
+			if w.ContainerRunning {
+				if err := w.stopByMethod(); err != nil && !errors.Is(err, context.Canceled) {
+					w.Err(err).Msgf("container stop with method %q failed", w.StopMethod)
+				} else {
+					w.LogReason("container stopped", "idle timeout")
+				}
 			}
 		}
 	}
--- a/internal/docker/inspect.go
+++ b/internal/docker/inspect.go
@@ -2,18 +2,28 @@ package docker

 import (
 	"context"
+	"errors"
 	"time"
-
-	E "github.com/yusing/go-proxy/internal/error"
 )

-func (c Client) Inspect(containerID string) (Container, E.NestedError) {
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+func Inspect(dockerHost string, containerID string) (*Container, error) {
+	client, err := ConnectClient(dockerHost)
+	defer client.Close()
+
+	if err != nil {
+		return nil, err
+	}
+
+	return client.Inspect(containerID)
+}
+
+func (c Client) Inspect(containerID string) (*Container, error) {
+	ctx, cancel := context.WithTimeoutCause(context.Background(), 3*time.Second, errors.New("docker container inspect timeout"))
 	defer cancel()

 	json, err := c.ContainerInspect(ctx, containerID)
 	if err != nil {
-		return Container{}, E.From(err)
+		return nil, err
 	}
-	return FromJson(json, c.key), nil
+	return FromJSON(json, c.key), nil
 }
--- a/internal/docker/label.go
+++ b/internal/docker/label.go
@@ -6,7 +6,6 @@ import (

 	E "github.com/yusing/go-proxy/internal/error"
 	U "github.com/yusing/go-proxy/internal/utils"
-	F "github.com/yusing/go-proxy/internal/utils/functional"
 )

 /*
@@ -23,8 +22,11 @@ type (
 		Value     any
 	}
 	NestedLabelMap map[string]U.SerializedObject
-	ValueParser    func(string) (any, E.NestedError)
-	ValueParserMap map[string]ValueParser
+)
+
+var (
+	ErrApplyToNil    = E.New("label value is nil")
+	ErrFieldNotExist = E.New("field does not exist")
 )

 func (l *Label) String() string {
@@ -42,26 +44,37 @@ func (l *Label) String() string {
 //
 // Returns:
 //   - error: an error if the field does not exist.
-func ApplyLabel[T any](obj *T, l *Label) E.NestedError {
+func ApplyLabel[T any](obj *T, l *Label) E.Error {
 	if obj == nil {
-		return E.Invalid("nil object", l)
+		return ErrApplyToNil.Subject(l.String())
 	}
 	switch nestedLabel := l.Value.(type) {
 	case *Label:
 		var field reflect.Value
 		objType := reflect.TypeFor[T]()
-		for i := 0; i < reflect.TypeFor[T]().NumField(); i++ {
+		for i := range reflect.TypeFor[T]().NumField() {
 			if objType.Field(i).Tag.Get("yaml") == l.Attribute {
 				field = reflect.ValueOf(obj).Elem().Field(i)
 				break
 			}
 		}
 		if !field.IsValid() {
-			return E.NotExist("field", l.Attribute)
+			return ErrFieldNotExist.Subject(l.Attribute).Subject(l.String())
 		}
 		dst, ok := field.Interface().(NestedLabelMap)
 		if !ok {
-			return E.Invalid("type", field.Type())
+			if field.Kind() == reflect.Ptr {
+				if field.IsNil() {
+					field.Set(reflect.New(field.Type().Elem()))
+				}
+			} else {
+				field = field.Addr()
+			}
+			err := U.Deserialize(U.SerializedObject{nestedLabel.Namespace: nestedLabel.Value}, field.Interface())
+			if err != nil {
+				return err.Subject(l.String())
+			}
+			return nil
 		}
 		if dst == nil {
 			field.Set(reflect.MakeMap(reflect.TypeFor[NestedLabelMap]()))
@@ -73,18 +86,22 @@ func ApplyLabel[T any](obj *T, l *Label) E.NestedError {
 		dst[nestedLabel.Namespace][nestedLabel.Attribute] = nestedLabel.Value
 		return nil
 	default:
-		return U.Deserialize(U.SerializedObject{l.Attribute: l.Value}, obj)
+		err := U.Deserialize(U.SerializedObject{l.Attribute: l.Value}, obj)
+		if err != nil {
+			return err.Subject(l.String())
+		}
+		return nil
 	}
 }

-func ParseLabel(label string, value string) (*Label, E.NestedError) {
+func ParseLabel(label string, value string) *Label {
 	parts := strings.Split(label, ".")

 	if len(parts) < 2 {
 		return &Label{
 			Namespace: label,
 			Value:     value,
-		}, nil
+		}
 	}

 	l := &Label{
@@ -100,52 +117,9 @@ func ParseLabel(label string, value string) (*Label, E.NestedError) {
 		l.Attribute = parts[2]
 	default:
 		l.Attribute = parts[2]
-		nestedLabel, err := ParseLabel(strings.Join(parts[3:], "."), value)
-		if err.HasError() {
-			return nil, err
-		}
+		nestedLabel := ParseLabel(strings.Join(parts[3:], "."), value)
 		l.Value = nestedLabel
 	}

-	// find if namespace has value parser
-	pm, ok := valueParserMap.Load(U.ToLowerNoSnake(l.Namespace))
-	if !ok {
-		return l, nil
-	}
-	// find if attribute has value parser
-	p, ok := pm[U.ToLowerNoSnake(l.Attribute)]
-	if !ok {
-		return l, nil
-	}
-	// try to parse value
-	v, err := p(value)
-	if err.HasError() {
-		return nil, err.Subject(label)
-	}
-	l.Value = v
-	return l, nil
+	return l
 }
-
-func RegisterNamespace(namespace string, pm ValueParserMap) {
-	pmCleaned := make(ValueParserMap, len(pm))
-	for k, v := range pm {
-		pmCleaned[U.ToLowerNoSnake(k)] = v
-	}
-	valueParserMap.Store(U.ToLowerNoSnake(namespace), pmCleaned)
-}
-
-func GetRegisteredNamespaces() map[string][]string {
-	r := make(map[string][]string)
-
-	valueParserMap.RangeAll(func(ns string, vpm ValueParserMap) {
-		r[ns] = make([]string, 0, len(vpm))
-		for attr := range vpm {
-			r[ns] = append(r[ns], attr)
-		}
-	})
-
-	return r
-}
-
-// namespace:target.attribute -> func(string) (any, error)
-var valueParserMap = F.NewMapOf[string, ValueParserMap]()
--- a/internal/docker/label_parser.go
+++ b/internal/docker/label_parser.go
@@ -1,78 +0,0 @@
-package docker
-
-import (
-	"strings"
-
-	E "github.com/yusing/go-proxy/internal/error"
-	"gopkg.in/yaml.v3"
-)
-
-const (
-	NSProxy                    = "proxy"
-	ProxyAttributePathPatterns = "path_patterns"
-	ProxyAttributeNoTLSVerify  = "no_tls_verify"
-	ProxyAttributeMiddlewares  = "middlewares"
-)
-
-var _ = func() int {
-	RegisterNamespace(NSProxy, ValueParserMap{
-		ProxyAttributePathPatterns: YamlStringListParser,
-		ProxyAttributeNoTLSVerify:  BoolParser,
-	})
-	return 0
-}()
-
-func YamlStringListParser(value string) (any, E.NestedError) {
-	/*
-		- foo
-		- bar
-		- baz
-	*/
-	value = strings.TrimSpace(value)
-	if value == "" {
-		return []string{}, nil
-	}
-	var data []string
-	err := E.From(yaml.Unmarshal([]byte(value), &data))
-	return data, err
-}
-
-func YamlLikeMappingParser(allowDuplicate bool) func(string) (any, E.NestedError) {
-	return func(value string) (any, E.NestedError) {
-		/*
-			foo: bar
-			boo: baz
-		*/
-		value = strings.TrimSpace(value)
-		lines := strings.Split(value, "\n")
-		h := make(map[string]string)
-		for _, line := range lines {
-			parts := strings.SplitN(line, ":", 2)
-			if len(parts) != 2 {
-				return nil, E.Invalid("syntax", line).With("too many colons")
-			}
-			key := strings.TrimSpace(parts[0])
-			val := strings.TrimSpace(parts[1])
-			if existing, ok := h[key]; ok {
-				if !allowDuplicate {
-					return nil, E.Duplicated("key", key)
-				}
-				h[key] = existing + ", " + val
-			} else {
-				h[key] = val
-			}
-		}
-		return h, nil
-	}
-}
-
-func BoolParser(value string) (any, E.NestedError) {
-	switch strings.ToLower(value) {
-	case "true", "yes", "1":
-		return true, nil
-	case "false", "no", "0":
-		return false, nil
-	default:
-		return nil, E.Invalid("boolean value", value)
-	}
-}
--- a/internal/docker/label_parser_test.go
+++ b/internal/docker/label_parser_test.go
@@ -1,106 +0,0 @@
-package docker
-
-import (
-	"fmt"
-	"testing"
-
-	E "github.com/yusing/go-proxy/internal/error"
-	. "github.com/yusing/go-proxy/internal/utils/testing"
-)
-
-func makeLabel(namespace string, alias string, field string) string {
-	return fmt.Sprintf("%s.%s.%s", namespace, alias, field)
-}
-
-func TestParseLabel(t *testing.T) {
-	alias := "foo"
-	field := "ip"
-	v := "bar"
-	pl, err := ParseLabel(makeLabel(NSHomePage, alias, field), v)
-	ExpectNoError(t, err.Error())
-	ExpectEqual(t, pl.Namespace, NSHomePage)
-	ExpectEqual(t, pl.Target, alias)
-	ExpectEqual(t, pl.Attribute, field)
-	ExpectEqual(t, pl.Value.(string), v)
-}
-
-func TestStringProxyLabel(t *testing.T) {
-	v := "bar"
-	pl, err := ParseLabel(makeLabel(NSProxy, "foo", "ip"), v)
-	ExpectNoError(t, err.Error())
-	ExpectEqual(t, pl.Value.(string), v)
-}
-
-func TestBoolProxyLabelValid(t *testing.T) {
-	tests := map[string]bool{
-		"true":  true,
-		"TRUE":  true,
-		"yes":   true,
-		"1":     true,
-		"false": false,
-		"FALSE": false,
-		"no":    false,
-		"0":     false,
-	}
-
-	for k, v := range tests {
-		pl, err := ParseLabel(makeLabel(NSProxy, "foo", ProxyAttributeNoTLSVerify), k)
-		ExpectNoError(t, err.Error())
-		ExpectEqual(t, pl.Value.(bool), v)
-	}
-}
-
-func TestBoolProxyLabelInvalid(t *testing.T) {
-	_, err := ParseLabel(makeLabel(NSProxy, "foo", ProxyAttributeNoTLSVerify), "invalid")
-	if !err.Is(E.ErrInvalid) {
-		t.Errorf("Expected err InvalidProxyLabel, got %s", err.Error())
-	}
-}
-
-// func TestSetHeaderProxyLabelValid(t *testing.T) {
-// 	v := `
-// X-Custom-Header1: foo, bar
-// X-Custom-Header1: baz
-// X-Custom-Header2: boo`
-// 	v = strings.TrimPrefix(v, "\n")
-// 	h := map[string]string{
-// 		"X-Custom-Header1": "foo, bar, baz",
-// 		"X-Custom-Header2": "boo",
-// 	}
-
-// 	pl, err := ParseLabel(makeLabel(NSProxy, "foo", ProxyAttributeSetHeaders), v)
-// 	ExpectNoError(t, err.Error())
-// 	hGot := ExpectType[map[string]string](t, pl.Value)
-// 	ExpectFalse(t, hGot == nil)
-// 	ExpectDeepEqual(t, h, hGot)
-// }
-
-// func TestSetHeaderProxyLabelInvalid(t *testing.T) {
-// 	tests := []string{
-// 		"X-Custom-Header1 = bar",
-// 		"X-Custom-Header1",
-// 		"- X-Custom-Header1",
-// 	}
-
-// 	for _, v := range tests {
-// 		_, err := ParseLabel(makeLabel(NSProxy, "foo", ProxyAttributeSetHeaders), v)
-// 		if !err.Is(E.ErrInvalid) {
-// 			t.Errorf("Expected invalid err for %q, got %s", v, err.Error())
-// 		}
-// 	}
-// }
-
-// func TestHideHeadersProxyLabel(t *testing.T) {
-// 	v := `
-// - X-Custom-Header1
-// - X-Custom-Header2
-// - X-Custom-Header3
-// `
-// 	v = strings.TrimPrefix(v, "\n")
-// 	pl, err := ParseLabel(makeLabel(NSProxy, "foo", ProxyAttributeHideHeaders), v)
-// 	ExpectNoError(t, err.Error())
-// 	sGot := ExpectType[[]string](t, pl.Value)
-// 	sWant := []string{"X-Custom-Header1", "X-Custom-Header2", "X-Custom-Header3"}
-// 	ExpectFalse(t, sGot == nil)
-// 	ExpectDeepEqual(t, sGot, sWant)
-// }
--- a/internal/docker/label_test.go
+++ b/internal/docker/label_test.go
@@ -8,13 +8,20 @@ import (
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )

+const (
+	mName = "middleware1"
+	mAttr = "prop1"
+	v     = "value1"
+)
+
+func makeLabel(ns, name, attr string) string {
+	return fmt.Sprintf("%s.%s.%s", ns, name, attr)
+}
+
 func TestNestedLabel(t *testing.T) {
-	mName := "middleware1"
 	mAttr := "prop1"
-	v := "value1"
-	pl, err := ParseLabel(makeLabel(NSProxy, "foo", fmt.Sprintf("%s.%s.%s", ProxyAttributeMiddlewares, mName, mAttr)), v)
-	ExpectNoError(t, err.Error())
-	sGot := ExpectType[*Label](t, pl.Value)
+	lbl := ParseLabel(makeLabel(NSProxy, "foo", makeLabel("middlewares", mName, mAttr)), v)
+	sGot := ExpectType[*Label](t, lbl.Value)
 	ExpectFalse(t, sGot == nil)
 	ExpectEqual(t, sGot.Namespace, mName)
 	ExpectEqual(t, sGot.Attribute, mAttr)
@@ -24,13 +31,9 @@ func TestApplyNestedLabel(t *testing.T) {
 	entry := new(struct {
 		Middlewares NestedLabelMap `yaml:"middlewares"`
 	})
-	mName := "middleware1"
-	mAttr := "prop1"
-	v := "value1"
-	pl, err := ParseLabel(makeLabel(NSProxy, "foo", fmt.Sprintf("%s.%s.%s", ProxyAttributeMiddlewares, mName, mAttr)), v)
-	ExpectNoError(t, err.Error())
-	err = ApplyLabel(entry, pl)
-	ExpectNoError(t, err.Error())
+	lbl := ParseLabel(makeLabel(NSProxy, "foo", makeLabel("middlewares", mName, mAttr)), v)
+	err := ApplyLabel(entry, lbl)
+	ExpectNoError(t, err)
 	middleware1, ok := entry.Middlewares[mName]
 	ExpectTrue(t, ok)
 	got := ExpectType[string](t, middleware1[mAttr])
@@ -38,10 +41,6 @@ func TestApplyNestedLabel(t *testing.T) {
 }

 func TestApplyNestedLabelExisting(t *testing.T) {
-	mName := "middleware1"
-	mAttr := "prop1"
-	v := "value1"
-
 	checkAttr := "prop2"
 	checkV := "value2"
 	entry := new(struct {
@@ -51,10 +50,9 @@ func TestApplyNestedLabelExisting(t *testing.T) {
 	entry.Middlewares[mName] = make(U.SerializedObject)
 	entry.Middlewares[mName][checkAttr] = checkV

-	pl, err := ParseLabel(makeLabel(NSProxy, "foo", fmt.Sprintf("%s.%s.%s", ProxyAttributeMiddlewares, mName, mAttr)), v)
-	ExpectNoError(t, err.Error())
-	err = ApplyLabel(entry, pl)
-	ExpectNoError(t, err.Error())
+	lbl := ParseLabel(makeLabel(NSProxy, "foo", makeLabel("middlewares", mName, mAttr)), v)
+	err := ApplyLabel(entry, lbl)
+	ExpectNoError(t, err)
 	middleware1, ok := entry.Middlewares[mName]
 	ExpectTrue(t, ok)
 	got := ExpectType[string](t, middleware1[mAttr])
@@ -67,19 +65,15 @@ func TestApplyNestedLabelExisting(t *testing.T) {
 }

 func TestApplyNestedLabelNoAttr(t *testing.T) {
-	mName := "middleware1"
-	v := "value1"
-
 	entry := new(struct {
 		Middlewares NestedLabelMap `yaml:"middlewares"`
 	})
 	entry.Middlewares = make(NestedLabelMap)
 	entry.Middlewares[mName] = make(U.SerializedObject)

-	pl, err := ParseLabel(makeLabel(NSProxy, "foo", fmt.Sprintf("%s.%s", ProxyAttributeMiddlewares, mName)), v)
-	ExpectNoError(t, err.Error())
-	err = ApplyLabel(entry, pl)
-	ExpectNoError(t, err.Error())
+	lbl := ParseLabel(makeLabel(NSProxy, "foo", fmt.Sprintf("%s.%s", "middlewares", mName)), v)
+	err := ApplyLabel(entry, lbl)
+	ExpectNoError(t, err)
 	_, ok := entry.Middlewares[mName]
 	ExpectTrue(t, ok)
 }
--- a/internal/docker/labels.go
+++ b/internal/docker/labels.go
@@ -3,6 +3,9 @@ package docker
 const (
 	WildcardAlias = "*"

+	NSProxy    = "proxy"
+	NSHomePage = "homepage"
+
 	LabelAliases     = NSProxy + ".aliases"
 	LabelExclude     = NSProxy + ".exclude"
 	LabelIdleTimeout = NSProxy + ".idle_timeout"
--- a/internal/docker/list_containers.go
+++ b/internal/docker/list_containers.go
@@ -0,0 +1,44 @@
+package docker
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/client"
+)
+
+var listOptions = container.ListOptions{
+	// created|restarting|running|removing|paused|exited|dead
+	// Filters: filters.NewArgs(
+	// 	filters.Arg("status", "created"),
+	// 	filters.Arg("status", "restarting"),
+	// 	filters.Arg("status", "running"),
+	// 	filters.Arg("status", "paused"),
+	// 	filters.Arg("status", "exited"),
+	// ),
+	All: true,
+}
+
+func ListContainers(clientHost string) ([]types.Container, error) {
+	dockerClient, err := ConnectClient(clientHost)
+	if err != nil {
+		return nil, err
+	}
+	defer dockerClient.Close()
+
+	ctx, cancel := context.WithTimeoutCause(context.Background(), 3*time.Second, errors.New("list containers timeout"))
+	defer cancel()
+
+	containers, err := dockerClient.ContainerList(ctx, listOptions)
+	if err != nil {
+		return nil, err
+	}
+	return containers, nil
+}
+
+func IsErrConnectionFailed(err error) bool {
+	return client.IsErrConnectionFailed(err)
+}
--- a/internal/docker/logger.go
+++ b/internal/docker/logger.go
@@ -0,0 +1,7 @@
+package docker
+
+import (
+	"github.com/yusing/go-proxy/internal/logging"
+)
+
+var logger = logging.With().Str("module", "docker").Logger()
--- a/internal/docker/proxy_properties.go
+++ b/internal/docker/proxy_properties.go
@@ -1,23 +0,0 @@
-package docker
-
-import "github.com/docker/docker/api/types"
-
-type PortMapping = map[string]types.Port
-type ProxyProperties struct {
-	DockerHost         string      `yaml:"-" json:"docker_host"`
-	ContainerName      string      `yaml:"-" json:"container_name"`
-	ImageName          string      `yaml:"-" json:"image_name"`
-	PublicPortMapping  PortMapping `yaml:"-" json:"public_port_mapping"`  // non-zero publicPort:types.Port
-	PrivatePortMapping PortMapping `yaml:"-" json:"private_port_mapping"` // privatePort:types.Port
-	NetworkMode        string      `yaml:"-" json:"network_mode"`
-
-	Aliases     []string `yaml:"-" json:"aliases"`
-	IsExcluded  bool     `yaml:"-" json:"is_excluded"`
-	IsExplicit  bool     `yaml:"-" json:"is_explicit"`
-	IdleTimeout string   `yaml:"-" json:"idle_timeout"`
-	WakeTimeout string   `yaml:"-" json:"wake_timeout"`
-	StopMethod  string   `yaml:"-" json:"stop_method"`
-	StopTimeout string   `yaml:"-" json:"stop_timeout"` // stop_method = "stop" only
-	StopSignal  string   `yaml:"-" json:"stop_signal"`  // stop_method = "stop" | "kill" only
-	Running     bool     `yaml:"-" json:"running"`
-}
--- a/internal/error/base.go
+++ b/internal/error/base.go
@@ -0,0 +1,46 @@
+package error
+
+import (
+	"errors"
+	"fmt"
+)
+
+// baseError is an immutable wrapper around an error.
+type baseError struct {
+	Err error `json:"err"`
+}
+
+func (err *baseError) Unwrap() error {
+	return err.Err
+}
+
+func (err *baseError) Is(other error) bool {
+	if other, ok := other.(*baseError); ok {
+		return errors.Is(err.Err, other.Err)
+	}
+	return errors.Is(err.Err, other)
+}
+
+func (err baseError) Subject(subject string) Error {
+	err.Err = PrependSubject(subject, err.Err)
+	return &err
+}
+
+func (err *baseError) Subjectf(format string, args ...any) Error {
+	if len(args) > 0 {
+		return err.Subject(fmt.Sprintf(format, args...))
+	}
+	return err.Subject(format)
+}
+
+func (err baseError) With(extra error) Error {
+	return &nestedError{&err, []error{extra}}
+}
+
+func (err baseError) Withf(format string, args ...any) Error {
+	return &nestedError{&err, []error{fmt.Errorf(format, args...)}}
+}
+
+func (err *baseError) Error() string {
+	return err.Err.Error()
+}
--- a/internal/error/builder.go
+++ b/internal/error/builder.go
@@ -6,65 +6,99 @@ import (
 )

 type Builder struct {
-	*builder
-}
-
-type builder struct {
-	message string
-	errors  []NestedError
+	about string
+	errs  []error
 	sync.Mutex
 }

-func NewBuilder(format string, args ...any) Builder {
-	return Builder{&builder{message: fmt.Sprintf(format, args...)}}
+func NewBuilder(about string) *Builder {
+	return &Builder{about: about}
 }

-// adding nil / nil is no-op,
-// you may safely pass expressions returning error to it
-func (b Builder) Add(err NestedError) Builder {
-	if err != nil {
-		b.Lock()
-		// TODO: if err severity is higher than b.severity, update b.severity
-		b.errors = append(b.errors, err)
-		b.Unlock()
+func (b *Builder) About() string {
+	if !b.HasError() {
+		return ""
 	}
+	return b.about
+}
+
+//go:inline
+func (b *Builder) HasError() bool {
+	return len(b.errs) > 0
+}
+
+func (b *Builder) Error() Error {
+	if !b.HasError() {
+		return nil
+	}
+	if len(b.errs) == 1 {
+		return From(b.errs[0])
+	}
+	return &nestedError{Err: New(b.about), Extras: b.errs}
+}
+
+func (b *Builder) String() string {
+	if !b.HasError() {
+		return ""
+	}
+	return (&nestedError{Err: New(b.about), Extras: b.errs}).Error()
+}
+
+// Add adds an error to the Builder.
+//
+// adding nil is no-op,
+func (b *Builder) Add(err error) *Builder {
+	if err == nil {
+		return b
+	}
+
+	b.Lock()
+	defer b.Unlock()
+
+	switch err := err.(type) {
+	case *baseError:
+		b.errs = append(b.errs, err.Err)
+	case *nestedError:
+		if err.Err == nil {
+			b.errs = append(b.errs, err.Extras...)
+		} else {
+			b.errs = append(b.errs, err)
+		}
+	default:
+		b.errs = append(b.errs, err)
+	}
+
 	return b
 }

-func (b Builder) AddE(err error) Builder {
-	return b.Add(From(err))
+func (b *Builder) Adds(err string) *Builder {
+	b.Lock()
+	defer b.Unlock()
+	b.errs = append(b.errs, newError(err))
+	return b
 }

-func (b Builder) Addf(format string, args ...any) Builder {
-	return b.Add(errorf(format, args...))
-}
-
-// Build builds a NestedError based on the errors collected in the Builder.
-//
-// If there are no errors in the Builder, it returns a Nil() NestedError.
-// Otherwise, it returns a NestedError with the message and the errors collected.
-//
-// Returns:
-//   - NestedError: the built NestedError.
-func (b Builder) Build() NestedError {
-	if len(b.errors) == 0 {
-		return nil
-	} else if len(b.errors) == 1 {
-		return b.errors[0]
-	}
-	return Join(b.message, b.errors...)
-}
-
-func (b Builder) To(ptr *NestedError) {
-	if ptr == nil {
-		return
-	} else if *ptr == nil {
-		*ptr = b.Build()
+func (b *Builder) Addf(format string, args ...any) *Builder {
+	if len(args) > 0 {
+		b.Lock()
+		defer b.Unlock()
+		b.errs = append(b.errs, fmt.Errorf(format, args...))
 	} else {
-		(*ptr).With(b.Build())
+		b.Adds(format)
 	}
+
+	return b
 }

-func (b Builder) HasError() bool {
-	return len(b.errors) > 0
+func (b *Builder) AddRange(errs ...error) *Builder {
+	b.Lock()
+	defer b.Unlock()
+
+	for _, err := range errs {
+		if err != nil {
+			b.errs = append(b.errs, err)
+		}
+	}
+
+	return b
 }
--- a/internal/error/builder_test.go
+++ b/internal/error/builder_test.go
@@ -1,53 +1,55 @@
-package error
+package error_test

 import (
+	"context"
+	"errors"
+	"io"
 	"testing"

+	. "github.com/yusing/go-proxy/internal/error"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )

 func TestBuilderEmpty(t *testing.T) {
-	eb := NewBuilder("qwer")
-	ExpectTrue(t, eb.Build() == nil)
-	ExpectTrue(t, eb.Build().NoError())
+	eb := NewBuilder("foo")
+	ExpectTrue(t, errors.Is(eb.Error(), nil))
 	ExpectFalse(t, eb.HasError())
 }

 func TestBuilderAddNil(t *testing.T) {
-	eb := NewBuilder("asdf")
-	var err NestedError
+	eb := NewBuilder("foo")
+	var err Error
 	for range 3 {
 		eb.Add(nil)
 	}
 	for range 3 {
 		eb.Add(err)
 	}
-	ExpectTrue(t, eb.Build() == nil)
-	ExpectTrue(t, eb.Build().NoError())
+	eb.AddRange(nil, nil, err)
 	ExpectFalse(t, eb.HasError())
+	ExpectTrue(t, eb.Error() == nil)
+}
+
+func TestBuilderIs(t *testing.T) {
+	eb := NewBuilder("foo")
+	eb.Add(context.Canceled)
+	eb.Add(io.ErrShortBuffer)
+	ExpectTrue(t, eb.HasError())
+	ExpectError(t, io.ErrShortBuffer, eb.Error())
+	ExpectError(t, context.Canceled, eb.Error())
 }

 func TestBuilderNested(t *testing.T) {
-	eb := NewBuilder("error occurred")
-	eb.Add(Failure("Action 1").With(Invalid("Inner", "1")).With(Invalid("Inner", "2")))
-	eb.Add(Failure("Action 2").With(Invalid("Inner", "3")))
+	eb := NewBuilder("action failed")
+	eb.Add(New("Action 1").Withf("Inner: 1").Withf("Inner: 2"))
+	eb.Add(New("Action 2").Withf("Inner: 3"))

-	got := eb.Build().String()
-	expected1 :=
-		(`error occurred:
-  - Action 1 failed:
-    - invalid Inner: 1
-    - invalid Inner: 2
-  - Action 2 failed:
-    - invalid Inner: 3`)
-	expected2 :=
-		(`error occurred:
-  - Action 1 failed:
-    - invalid Inner: "1"
-    - invalid Inner: "2"
-  - Action 2 failed:
-    - invalid Inner: "3"`)
-	if got != expected1 && got != expected2 {
-		t.Errorf("expected \n%s, got \n%s", expected1, got)
-	}
+	got := eb.String()
+	expected := `action failed
+  • Action 1
+    • Inner: 1
+    • Inner: 2
+  • Action 2
+    • Inner: 3`
+	ExpectEqual(t, got, expected)
 }
--- a/internal/error/error.go
+++ b/internal/error/error.go
@@ -1,295 +1,31 @@
 package error

-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-)
+type Error interface {
+	error

-type (
-	NestedError = *nestedError
-	nestedError struct {
-		subject string
-		err     error
-		extras  []nestedError
-	}
-	jsonNestedError struct {
-		Subject string
-		Err     string
-		Extras  []jsonNestedError
-	}
-)
-
-func From(err error) NestedError {
-	if IsNil(err) {
-		return nil
-	}
-	return &nestedError{err: err}
+	// Is is a wrapper for errors.Is when there is no sub-error.
+	//
+	// When there are sub-errors, they will also be checked.
+	Is(other error) bool
+	// With appends a sub-error to the error.
+	With(extra error) Error
+	// Withf is a wrapper for With(fmt.Errorf(format, args...)).
+	Withf(format string, args ...any) Error
+	// Subject prepends the given subject with a colon and space to the error message.
+	//
+	// If there is already a subject in the error message, the subject will be
+	// prepended to the existing subject with " > ".
+	//
+	// Subject empty string is ignored.
+	Subject(subject string) Error
+	// Subjectf is a wrapper for Subject(fmt.Sprintf(format, args...)).
+	Subjectf(format string, args ...any) Error
 }

-func FromJSON(data []byte) (NestedError, bool) {
-	var j jsonNestedError
-	if err := json.Unmarshal(data, &j); err != nil {
-		return nil, false
-	}
-	if j.Err == "" {
-		return nil, false
-	}
-	extras := make([]nestedError, len(j.Extras))
-	for i, e := range j.Extras {
-		extra, ok := fromJSONObject(e)
-		if !ok {
-			return nil, false
-		}
-		extras[i] = *extra
-	}
-	return &nestedError{
-		subject: j.Subject,
-		err:     errors.New(j.Err),
-		extras:  extras,
-	}, true
-}
-
-// Check is a helper function that
-// convert (T, error) to (T, NestedError).
-func Check[T any](obj T, err error) (T, NestedError) {
-	return obj, From(err)
-}
-
-func Join(message string, err ...NestedError) NestedError {
-	extras := make([]nestedError, len(err))
-	nErr := 0
-	for i, e := range err {
-		if e == nil {
-			continue
-		}
-		extras[i] = *e
-		nErr += 1
-	}
-	if nErr == 0 {
-		return nil
-	}
-	return &nestedError{
-		err:    errors.New(message),
-		extras: extras,
-	}
-}
-
-func JoinE(message string, err ...error) NestedError {
-	b := NewBuilder(message)
-	for _, e := range err {
-		b.AddE(e)
-	}
-	return b.Build()
-}
-
-func IsNil(err error) bool {
-	return err == nil
-}
-
-func IsNotNil(err error) bool {
-	return err != nil
-}
-
-func (ne NestedError) String() string {
-	var buf strings.Builder
-	ne.writeToSB(&buf, 0, "")
-	return buf.String()
-}
-
-func (ne NestedError) Is(err error) bool {
-	if ne == nil {
-		return err == nil
-	}
-	// return errors.Is(ne.err, err)
-	if errors.Is(ne.err, err) {
-		return true
-	}
-	for _, e := range ne.extras {
-		if e.Is(err) {
-			return true
-		}
-	}
-	return false
-}
-
-func (ne NestedError) IsNot(err error) bool {
-	return !ne.Is(err)
-}
-
-func (ne NestedError) Error() error {
-	if ne == nil {
-		return nil
-	}
-	return ne.buildError(0, "")
-}
-
-func (ne NestedError) With(s any) NestedError {
-	if ne == nil {
-		return ne
-	}
-	var msg string
-	switch ss := s.(type) {
-	case nil:
-		return ne
-	case NestedError:
-		return ne.withError(ss)
-	case error:
-		return ne.withError(From(ss))
-	case string:
-		msg = ss
-	case fmt.Stringer:
-		return ne.appendMsg(ss.String())
-	default:
-		return ne.appendMsg(fmt.Sprint(s))
-	}
-	return ne.withError(From(errors.New(msg)))
-}
-
-func (ne NestedError) Extraf(format string, args ...any) NestedError {
-	return ne.With(errorf(format, args...))
-}
-
-func (ne NestedError) Subject(s any) NestedError {
-	if ne == nil {
-		return ne
-	}
-	var subject string
-	switch ss := s.(type) {
-	case string:
-		subject = ss
-	case fmt.Stringer:
-		subject = ss.String()
-	default:
-		subject = fmt.Sprint(s)
-	}
-	if ne.subject == "" {
-		ne.subject = subject
-	} else {
-		ne.subject = fmt.Sprintf("%s > %s", subject, ne.subject)
-	}
-	return ne
-}
-
-func (ne NestedError) Subjectf(format string, args ...any) NestedError {
-	if ne == nil {
-		return ne
-	}
-	if strings.Contains(format, "%q") {
-		panic("Subjectf format should not contain %q")
-	}
-	if strings.Contains(format, "%w") {
-		panic("Subjectf format should not contain %w")
-	}
-	ne.subject = fmt.Sprintf(format, args...)
-	return ne
-}
-
-func (ne NestedError) JSONObject() jsonNestedError {
-	extras := make([]jsonNestedError, len(ne.extras))
-	for i, e := range ne.extras {
-		extras[i] = e.JSONObject()
-	}
-	return jsonNestedError{
-		Subject: ne.subject,
-		Err:     ne.err.Error(),
-		Extras:  extras,
-	}
-}
-
-func (ne NestedError) JSON() []byte {
-	b, _ := json.MarshalIndent(ne.JSONObject(), "", "  ")
-	return b
-}
-
-func (ne NestedError) NoError() bool {
-	return ne == nil
-}
-
-func (ne NestedError) HasError() bool {
-	return ne != nil
-}
-
-func errorf(format string, args ...any) NestedError {
-	return From(fmt.Errorf(format, args...))
-}
-
-func fromJSONObject(obj jsonNestedError) (NestedError, bool) {
-	data, err := json.Marshal(obj)
-	if err != nil {
-		return nil, false
-	}
-	return FromJSON(data)
-}
-
-func (ne NestedError) withError(err NestedError) NestedError {
-	if ne != nil && err != nil {
-		ne.extras = append(ne.extras, *err)
-	}
-	return ne
-}
-
-func (ne NestedError) appendMsg(msg string) NestedError {
-	if ne == nil {
-		return nil
-	}
-	ne.err = fmt.Errorf("%w %s", ne.err, msg)
-	return ne
-}
-
-func (ne NestedError) writeToSB(sb *strings.Builder, level int, prefix string) {
-	for i := 0; i < level; i++ {
-		sb.WriteString("  ")
-	}
-	sb.WriteString(prefix)
-
-	if ne.NoError() {
-		sb.WriteString("nil")
-		return
-	}
-
-	sb.WriteString(ne.err.Error())
-	if ne.subject != "" {
-		sb.WriteString(fmt.Sprintf(" for %q", ne.subject))
-	}
-	if len(ne.extras) > 0 {
-		sb.WriteRune(':')
-		for _, extra := range ne.extras {
-			sb.WriteRune('\n')
-			extra.writeToSB(sb, level+1, "- ")
-		}
-	}
-}
-
-func (ne NestedError) buildError(level int, prefix string) error {
-	var res error
-	var sb strings.Builder
-
-	for i := 0; i < level; i++ {
-		sb.WriteString("  ")
-	}
-	sb.WriteString(prefix)
-
-	if ne.NoError() {
-		sb.WriteString("nil")
-		return errors.New(sb.String())
-	}
-
-	res = fmt.Errorf("%s%w", sb.String(), ne.err)
-	sb.Reset()
-
-	if ne.subject != "" {
-		sb.WriteString(fmt.Sprintf(" for %q", ne.subject))
-	}
-	if len(ne.extras) > 0 {
-		sb.WriteRune(':')
-		res = fmt.Errorf("%w%s", res, sb.String())
-		for _, extra := range ne.extras {
-			res = errors.Join(res, extra.buildError(level+1, "- "))
-		}
-	} else {
-		res = fmt.Errorf("%w%s", res, sb.String())
-	}
-	return res
+// this makes JSON marshalling work,
+// as the builtin one doesn't.
+type errStr string
+
+func (err errStr) Error() string {
+	return string(err)
 }
--- a/internal/error/error_test.go
+++ b/internal/error/error_test.go
@@ -1,109 +1,157 @@
-package error_test
+package error

 import (
 	"errors"
+	"strings"
 	"testing"

-	. "github.com/yusing/go-proxy/internal/error"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )

+func TestBaseString(t *testing.T) {
+	ExpectEqual(t, New("error").Error(), "error")
+}
+
+func TestBaseWithSubject(t *testing.T) {
+	err := New("error")
+	withSubject := err.Subject("foo")
+	withSubjectf := err.Subjectf("%s %s", "foo", "bar")
+
+	ExpectError(t, err, withSubject)
+	ExpectStrEqual(t, withSubject.Error(), "foo: error")
+	ExpectTrue(t, withSubject.Is(err))
+
+	ExpectError(t, err, withSubjectf)
+	ExpectStrEqual(t, withSubjectf.Error(), "foo bar: error")
+	ExpectTrue(t, withSubjectf.Is(err))
+}
+
+func TestBaseWithExtra(t *testing.T) {
+	err := New("error")
+	extra := New("bar").Subject("baz")
+	withExtra := err.With(extra)
+
+	ExpectTrue(t, withExtra.Is(extra))
+	ExpectTrue(t, withExtra.Is(err))
+
+	ExpectTrue(t, errors.Is(withExtra, extra))
+	ExpectTrue(t, errors.Is(withExtra, err))
+
+	ExpectTrue(t, strings.Contains(withExtra.Error(), err.Error()))
+	ExpectTrue(t, strings.Contains(withExtra.Error(), extra.Error()))
+	ExpectTrue(t, strings.Contains(withExtra.Error(), "baz"))
+}
+
+func TestBaseUnwrap(t *testing.T) {
+	err := errors.New("err")
+	wrapped := From(err)
+
+	ExpectError(t, err, errors.Unwrap(wrapped))
+}
+
+func TestNestedUnwrap(t *testing.T) {
+	err := errors.New("err")
+	err2 := New("err2")
+	wrapped := From(err).Subject("foo").With(err2.Subject("bar"))
+
+	unwrapper, ok := wrapped.(interface{ Unwrap() []error })
+	ExpectTrue(t, ok)
+
+	ExpectError(t, err, wrapped)
+	ExpectError(t, err2, wrapped)
+	ExpectEqual(t, len(unwrapper.Unwrap()), 2)
+}
+
 func TestErrorIs(t *testing.T) {
-	ExpectTrue(t, Failure("foo").Is(ErrFailure))
-	ExpectTrue(t, Failure("foo").With("bar").Is(ErrFailure))
-	ExpectFalse(t, Failure("foo").With("bar").Is(ErrInvalid))
-	ExpectFalse(t, Failure("foo").With("bar").With("baz").Is(ErrInvalid))
+	from := errors.New("error")
+	err := From(from)
+	ExpectError(t, from, err)

-	ExpectTrue(t, Invalid("foo", "bar").Is(ErrInvalid))
-	ExpectFalse(t, Invalid("foo", "bar").Is(ErrFailure))
+	ExpectTrue(t, err.Is(from))
+	ExpectFalse(t, err.Is(New("error")))

-	ExpectFalse(t, Invalid("foo", "bar").Is(nil))
-
-	ExpectTrue(t, errors.Is(Failure("foo").Error(), ErrFailure))
-	ExpectTrue(t, errors.Is(Failure("foo").With(Invalid("bar", "baz")).Error(), ErrInvalid))
-	ExpectTrue(t, errors.Is(Failure("foo").With(Invalid("bar", "baz")).Error(), ErrFailure))
-	ExpectFalse(t, errors.Is(Failure("foo").With(Invalid("bar", "baz")).Error(), ErrNotExists))
+	ExpectTrue(t, errors.Is(err.Subject("foo"), from))
+	ExpectTrue(t, errors.Is(err.Withf("foo"), from))
+	ExpectTrue(t, errors.Is(err.Subject("foo").Withf("bar"), from))
 }

-func TestErrorNestedIs(t *testing.T) {
-	var err NestedError
-	ExpectTrue(t, err.Is(nil))
+func TestErrorImmutability(t *testing.T) {
+	err := New("err")
+	err2 := New("err2")

-	err = Failure("some reason")
-	ExpectTrue(t, err.Is(ErrFailure))
-	ExpectFalse(t, err.Is(ErrDuplicated))
+	for range 3 {
+		// t.Logf("%d: %v %T %s", i, errors.Unwrap(err), err, err)
+		err.Subject("foo")
+		ExpectFalse(t, strings.Contains(err.Error(), "foo"))

-	err.With(Duplicated("something", ""))
-	ExpectTrue(t, err.Is(ErrFailure))
-	ExpectTrue(t, err.Is(ErrDuplicated))
-	ExpectFalse(t, err.Is(ErrInvalid))
-}
+		err.With(err2)
+		ExpectFalse(t, strings.Contains(err.Error(), "extra"))
+		ExpectFalse(t, err.Is(err2))

-func TestIsNil(t *testing.T) {
-	var err NestedError
-	ExpectTrue(t, err.Is(nil))
-	ExpectFalse(t, err.HasError())
-	ExpectTrue(t, err == nil)
-	ExpectTrue(t, err.NoError())
-
-	eb := NewBuilder("")
-	returnNil := func() error {
-		return eb.Build().Error()
+		err = err.Subject("bar").Withf("baz")
+		ExpectTrue(t, err != nil)
 	}
-	ExpectTrue(t, IsNil(returnNil()))
-	ExpectTrue(t, returnNil() == nil)
-
-	ExpectTrue(t, (err.
-		Subject("any").
-		With("something").
-		Extraf("foo %s", "bar")) == nil)
-}
-
-func TestErrorSimple(t *testing.T) {
-	ne := Failure("foo bar")
-	ExpectEqual(t, ne.String(), "foo bar failed")
-	ne = ne.Subject("baz")
-	ExpectEqual(t, ne.String(), "foo bar failed for \"baz\"")
 }

 func TestErrorWith(t *testing.T) {
-	ne := Failure("foo").With("bar").With("baz")
-	ExpectEqual(t, ne.String(), "foo failed:\n  - bar\n  - baz")
+	err1 := New("err1")
+	err2 := New("err2")
+
+	err3 := err1.With(err2)
+
+	ExpectTrue(t, err3.Is(err1))
+	ExpectTrue(t, err3.Is(err2))
+
+	err2.Subject("foo")
+
+	ExpectTrue(t, err3.Is(err1))
+	ExpectTrue(t, err3.Is(err2))
+
+	// check if err3 is affected by err2.Subject
+	ExpectFalse(t, strings.Contains(err3.Error(), "foo"))
 }

-func TestErrorNested(t *testing.T) {
-	inner := Failure("inner").
-		With("1").
-		With("1")
-	inner2 := Failure("inner2").
+func TestErrorStringSimple(t *testing.T) {
+	errFailure := New("generic failure")
+	ne := errFailure.Subject("foo bar")
+	ExpectStrEqual(t, ne.Error(), "foo bar: generic failure")
+	ne = ne.Subject("baz")
+	ExpectStrEqual(t, ne.Error(), "baz > foo bar: generic failure")
+}
+
+func TestErrorStringNested(t *testing.T) {
+	errFailure := New("generic failure")
+	inner := errFailure.Subject("inner").
+		Withf("1").
+		Withf("1")
+	inner2 := errFailure.Subject("inner2").
 		Subject("action 2").
-		With("2").
-		With("2")
-	inner3 := Failure("inner3").
+		Withf("2").
+		Withf("2")
+	inner3 := errFailure.Subject("inner3").
 		Subject("action 3").
-		With("3").
-		With("3")
-	ne := Failure("foo").
-		With("bar").
-		With("baz").
+		Withf("3").
+		Withf("3")
+	ne := errFailure.
+		Subject("foo").
+		Withf("bar").
+		Withf("baz").
 		With(inner).
 		With(inner.With(inner2.With(inner3)))
-	want :=
-		`foo failed:
-  - bar
-  - baz
-  - inner failed:
-    - 1
-    - 1
-  - inner failed:
-    - 1
-    - 1
-    - inner2 failed for "action 2":
-      - 2
-      - 2
-      - inner3 failed for "action 3":
-        - 3
-        - 3`
-	ExpectEqual(t, ne.String(), want)
-	ExpectEqual(t, ne.Error().Error(), want)
+	want := `foo: generic failure
+  • bar
+  • baz
+  • inner: generic failure
+    • 1
+    • 1
+  • inner: generic failure
+    • 1
+    • 1
+    • action 2 > inner2: generic failure
+      • 2
+      • 2
+      • action 3 > inner3: generic failure
+        • 3
+        • 3`
+	ExpectStrEqual(t, ne.Error(), want)
 }
--- a/internal/error/errors.go
+++ b/internal/error/errors.go
@@ -1,62 +0,0 @@
-package error
-
-import (
-	stderrors "errors"
-)
-
-var (
-	ErrFailure     = stderrors.New("failed")
-	ErrInvalid     = stderrors.New("invalid")
-	ErrUnsupported = stderrors.New("unsupported")
-	ErrUnexpected  = stderrors.New("unexpected")
-	ErrNotExists   = stderrors.New("does not exist")
-	ErrMissing     = stderrors.New("missing")
-	ErrDuplicated  = stderrors.New("duplicated")
-	ErrOutOfRange  = stderrors.New("out of range")
-)
-
-const fmtSubjectWhat = "%w %v: %q"
-
-func Failure(what string) NestedError {
-	return errorf("%s %w", what, ErrFailure)
-}
-
-func FailedWhy(what string, why string) NestedError {
-	return Failure(what).With(why)
-}
-
-func FailWith(what string, err any) NestedError {
-	return Failure(what).With(err)
-}
-
-func Invalid(subject, what any) NestedError {
-	return errorf(fmtSubjectWhat, ErrInvalid, subject, what)
-}
-
-func Unsupported(subject, what any) NestedError {
-	return errorf(fmtSubjectWhat, ErrUnsupported, subject, what)
-}
-
-func Unexpected(subject, what any) NestedError {
-	return errorf(fmtSubjectWhat, ErrUnexpected, subject, what)
-}
-
-func UnexpectedError(err error) NestedError {
-	return errorf("%w error: %w", ErrUnexpected, err)
-}
-
-func NotExist(subject, what any) NestedError {
-	return errorf("%v %w: %v", subject, ErrNotExists, what)
-}
-
-func Missing(subject any) NestedError {
-	return errorf("%w %v", ErrMissing, subject)
-}
-
-func Duplicated(subject, what any) NestedError {
-	return errorf("%w %v: %v", ErrDuplicated, subject, what)
-}
-
-func OutOfRange(subject string, value any) NestedError {
-	return errorf("%v %w: %v", subject, ErrOutOfRange, value)
-}
--- a/internal/error/log.go
+++ b/internal/error/log.go
@@ -0,0 +1,43 @@
+package error
+
+import (
+	"github.com/rs/zerolog"
+	"github.com/yusing/go-proxy/internal/logging"
+)
+
+func getLogger(logger ...*zerolog.Logger) *zerolog.Logger {
+	if len(logger) > 0 {
+		return logger[0]
+	}
+	return logging.GetLogger()
+}
+
+//go:inline
+func LogFatal(msg string, err error, logger ...*zerolog.Logger) {
+	getLogger(logger...).Fatal().Msg(err.Error())
+}
+
+//go:inline
+func LogError(msg string, err error, logger ...*zerolog.Logger) {
+	getLogger(logger...).Error().Msg(err.Error())
+}
+
+//go:inline
+func LogWarn(msg string, err error, logger ...*zerolog.Logger) {
+	getLogger(logger...).Warn().Msg(err.Error())
+}
+
+//go:inline
+func LogPanic(msg string, err error, logger ...*zerolog.Logger) {
+	getLogger(logger...).Panic().Msg(err.Error())
+}
+
+//go:inline
+func LogInfo(msg string, err error, logger ...*zerolog.Logger) {
+	getLogger(logger...).Info().Msg(err.Error())
+}
+
+//go:inline
+func LogDebug(msg string, err error, logger ...*zerolog.Logger) {
+	getLogger(logger...).Debug().Msg(err.Error())
+}
--- a/internal/error/nested_error.go
+++ b/internal/error/nested_error.go
@@ -0,0 +1,120 @@
+package error
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+type nestedError struct {
+	Err    error   `json:"err"`
+	Extras []error `json:"extras"`
+}
+
+func (err nestedError) Subject(subject string) Error {
+	if err.Err == nil {
+		err.Err = newError(subject)
+	} else {
+		err.Err = PrependSubject(subject, err.Err)
+	}
+	return &err
+}
+
+func (err *nestedError) Subjectf(format string, args ...any) Error {
+	if len(args) > 0 {
+		return err.Subject(fmt.Sprintf(format, args...))
+	}
+	return err.Subject(format)
+}
+
+func (err nestedError) With(extra error) Error {
+	if extra != nil {
+		err.Extras = append(err.Extras, extra)
+	}
+	return &err
+}
+
+func (err nestedError) Withf(format string, args ...any) Error {
+	if len(args) > 0 {
+		err.Extras = append(err.Extras, fmt.Errorf(format, args...))
+	} else {
+		err.Extras = append(err.Extras, newError(format))
+	}
+	return &err
+}
+
+func (err *nestedError) Unwrap() []error {
+	if err.Err == nil {
+		if len(err.Extras) == 0 {
+			return nil
+		}
+		return err.Extras
+	}
+	return append([]error{err.Err}, err.Extras...)
+}
+
+func (err *nestedError) Is(other error) bool {
+	if errors.Is(err.Err, other) {
+		return true
+	}
+	for _, e := range err.Extras {
+		if errors.Is(e, other) {
+			return true
+		}
+	}
+	return false
+}
+
+func (err *nestedError) Error() string {
+	return buildError(err, 0)
+}
+
+//go:inline
+func makeLine(err string, level int) string {
+	const bulletPrefix = "• "
+	const spaces = "                "
+
+	if level == 0 {
+		return err
+	}
+	return spaces[:2*level] + bulletPrefix + err
+}
+
+func makeLines(errs []error, level int) []string {
+	if len(errs) == 0 {
+		return nil
+	}
+	lines := make([]string, 0, len(errs))
+	for _, err := range errs {
+		switch err := err.(type) {
+		case *nestedError:
+			if err.Err != nil {
+				lines = append(lines, makeLine(err.Err.Error(), level))
+			}
+			if extras := makeLines(err.Extras, level+1); len(extras) > 0 {
+				lines = append(lines, extras...)
+			}
+		default:
+			lines = append(lines, makeLine(err.Error(), level))
+		}
+	}
+	return lines
+}
+
+func buildError(err error, level int) string {
+	switch err := err.(type) {
+	case nil:
+		return makeLine("<nil>", level)
+	case *nestedError:
+		lines := make([]string, 0, 1+len(err.Extras))
+		if err.Err != nil {
+			lines = append(lines, makeLine(err.Err.Error(), level))
+		}
+		if extras := makeLines(err.Extras, level+1); len(extras) > 0 {
+			lines = append(lines, extras...)
+		}
+		return strings.Join(lines, "\n")
+	default:
+		return makeLine(err.Error(), level)
+	}
+}
--- a/internal/error/subject.go
+++ b/internal/error/subject.go
@@ -0,0 +1,52 @@
+package error
+
+import (
+	"strings"
+
+	"github.com/yusing/go-proxy/internal/utils/strutils/ansi"
+)
+
+type withSubject struct {
+	Subject string `json:"subject"`
+	Err     error  `json:"err"`
+}
+
+const subjectSep = " > "
+
+func highlight(subject string) string {
+	return ansi.HighlightRed + subject + ansi.Reset
+}
+
+func PrependSubject(subject string, err error) error {
+	switch err := err.(type) {
+	case nil:
+		return nil
+	case *withSubject:
+		return err.Prepend(subject)
+	case Error:
+		return err.Subject(subject)
+	default:
+		return &withSubject{subject, err}
+	}
+}
+
+func (err withSubject) Prepend(subject string) *withSubject {
+	if subject != "" {
+		err.Subject = subject + subjectSep + err.Subject
+	}
+	return &err
+}
+
+func (err *withSubject) Is(other error) bool {
+	return err.Err == other
+}
+
+func (err *withSubject) Unwrap() error {
+	return err.Err
+}
+
+func (err *withSubject) Error() string {
+	subjects := strings.Split(err.Subject, subjectSep)
+	subjects[len(subjects)-1] = highlight(subjects[len(subjects)-1])
+	return strings.Join(subjects, subjectSep) + ": " + err.Err.Error()
+}
--- a/internal/error/utils.go
+++ b/internal/error/utils.go
@@ -0,0 +1,71 @@
+package error
+
+import (
+	"errors"
+	"fmt"
+)
+
+var ErrInvalidErrorJson = errors.New("invalid error json")
+
+func newError(message string) error {
+	return errStr(message)
+}
+
+func New(message string) Error {
+	if message == "" {
+		return nil
+	}
+	return &baseError{newError(message)}
+}
+
+func Errorf(format string, args ...any) Error {
+	return &baseError{fmt.Errorf(format, args...)}
+}
+
+func From(err error) Error {
+	if err == nil {
+		return nil
+	}
+	if err, ok := err.(Error); ok {
+		return err
+	}
+	return &baseError{err}
+}
+
+func Must[T any](v T, err error) T {
+	if err != nil {
+		LogPanic("must failed", err)
+	}
+	return v
+}
+
+func Join(errors ...error) Error {
+	n := 0
+	for _, err := range errors {
+		if err != nil {
+			n++
+		}
+	}
+	if n == 0 {
+		return nil
+	}
+	errs := make([]error, 0, n)
+	for _, err := range errors {
+		if err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return &nestedError{Extras: errs}
+}
+
+func Collect[T any, Err error, Arg any, Func func(Arg) (T, Err)](eb *Builder, fn Func, arg Arg) T {
+	result, err := fn(arg)
+	eb.Add(err)
+	return result
+}
+
+func Collect2[T any, Err error, Arg1 any, Arg2 any, Func func(Arg1, Arg2) (T, Err)](eb *Builder, fn Func, arg1 Arg1, arg2 Arg2) T {
+	result, err := fn(arg1, arg2)
+	eb.Add(err)
+	return result
+}
--- a/internal/homepage/homepage.go
+++ b/internal/homepage/homepage.go
@@ -0,0 +1,43 @@
+package homepage
+
+type (
+	Config   map[string]Category
+	Category []*Item
+
+	Item struct {
+		Show         bool           `json:"show" yaml:"show"`
+		Name         string         `json:"name" yaml:"name"`
+		Icon         string         `json:"icon" yaml:"icon"`
+		URL          string         `json:"url" yaml:"url"` // alias + domain
+		Category     string         `json:"category" yaml:"category"`
+		Description  string         `json:"description" yaml:"description"`
+		WidgetConfig map[string]any `json:"widget_config" yaml:",flow"`
+
+		SourceType string `json:"source_type" yaml:"-"`
+		AltURL     string `json:"alt_url" yaml:"-"` // original proxy target
+	}
+)
+
+func (item *Item) IsEmpty() bool {
+	return item == nil || (item.Name == "" &&
+		item.Icon == "" &&
+		item.URL == "" &&
+		item.Category == "" &&
+		item.Description == "" &&
+		len(item.WidgetConfig) == 0)
+}
+
+func NewHomePageConfig() Config {
+	return Config(make(map[string]Category))
+}
+
+func (c *Config) Clear() {
+	*c = make(Config)
+}
+
+func (c Config) Add(item *Item) {
+	if c[item.Category] == nil {
+		c[item.Category] = make(Category, 0)
+	}
+	c[item.Category] = append(c[item.Category], item)
+}
--- a/internal/http/content_type.go
+++ b/internal/http/content_type.go
@@ -1,32 +0,0 @@
-package http
-
-import (
-	"mime"
-	"net/http"
-)
-
-type ContentType string
-
-func GetContentType(h http.Header) ContentType {
-	ct := h.Get("Content-Type")
-	if ct == "" {
-		return ""
-	}
-	ct, _, err := mime.ParseMediaType(ct)
-	if err != nil {
-		return ""
-	}
-	return ContentType(ct)
-}
-
-func (ct ContentType) IsHTML() bool {
-	return ct == "text/html" || ct == "application/xhtml+xml"
-}
-
-func (ct ContentType) IsJSON() bool {
-	return ct == "application/json"
-}
-
-func (ct ContentType) IsPlainText() bool {
-	return ct == "text/plain"
-}
--- a/internal/http/header_utils.go
+++ b/internal/http/header_utils.go
@@ -1,42 +0,0 @@
-package http
-
-import (
-	"net/http"
-	"slices"
-)
-
-func RemoveHop(h http.Header) {
-	reqUpType := UpgradeType(h)
-	RemoveHopByHopHeaders(h)
-
-	if reqUpType != "" {
-		h.Set("Connection", "Upgrade")
-		h.Set("Upgrade", reqUpType)
-	} else {
-		h.Del("Connection")
-	}
-}
-
-func CopyHeader(dst, src http.Header) {
-	for k, vv := range src {
-		for _, v := range vv {
-			dst.Add(k, v)
-		}
-	}
-}
-
-func FilterHeaders(h http.Header, allowed []string) {
-	if allowed == nil {
-		return
-	}
-
-	for i := range allowed {
-		allowed[i] = http.CanonicalHeaderKey(allowed[i])
-	}
-
-	for key := range h {
-		if !slices.Contains(allowed, key) {
-			h.Del(key)
-		}
-	}
-}
--- a/internal/list-icons.go
+++ b/internal/list-icons.go
@@ -0,0 +1,101 @@
+package internal
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/utils"
+)
+
+type GitHubContents struct { //! keep this, may reuse in future
+	Type string `json:"type"`
+	Path string `json:"path"`
+	Name string `json:"name"`
+	Sha  string `json:"sha"`
+	Size int    `json:"size"`
+}
+
+const (
+	iconsCachePath = "/tmp/icons_cache.json"
+	updateInterval = 1 * time.Hour
+)
+
+func ListAvailableIcons() ([]string, error) {
+	owner := "walkxcode"
+	repo := "dashboard-icons"
+	ref := "main"
+
+	var lastUpdate time.Time
+
+	icons := make([]string, 0)
+	info, err := os.Stat(iconsCachePath)
+	if err == nil {
+		lastUpdate = info.ModTime().Local()
+	}
+	if time.Since(lastUpdate) < updateInterval {
+		err := utils.LoadJSON(iconsCachePath, &icons)
+		if err == nil {
+			return icons, nil
+		}
+	}
+
+	contents, err := getRepoContents(http.DefaultClient, owner, repo, ref, "")
+	if err != nil {
+		return nil, err
+	}
+	for _, content := range contents {
+		if content.Type != "dir" {
+			icons = append(icons, content.Path)
+		}
+	}
+	err = utils.SaveJSON(iconsCachePath, &icons, 0o644)
+	if err != nil {
+		log.Print("error saving cache", err)
+	}
+	return icons, nil
+}
+
+func getRepoContents(client *http.Client, owner string, repo string, ref string, path string) ([]GitHubContents, error) {
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://api.github.com/repos/%s/%s/contents/%s?ref=%s", owner, repo, path, ref), nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	var contents []GitHubContents
+	err = json.Unmarshal(body, &contents)
+	if err != nil {
+		return nil, err
+	}
+
+	filesAndDirs := make([]GitHubContents, 0)
+	for _, content := range contents {
+		if content.Type == "dir" {
+			subContents, err := getRepoContents(client, owner, repo, ref, content.Path)
+			if err != nil {
+				return nil, err
+			}
+			filesAndDirs = append(filesAndDirs, subContents...)
+		} else {
+			filesAndDirs = append(filesAndDirs, content)
+		}
+	}
+
+	return filesAndDirs, nil
+}
--- a/internal/logging/logging.go
+++ b/internal/logging/logging.go
@@ -0,0 +1,69 @@
+package logging
+
+import (
+	"os"
+	"strings"
+
+	"github.com/rs/zerolog"
+	"github.com/yusing/go-proxy/internal/common"
+)
+
+var logger zerolog.Logger
+
+func init() {
+	var timeFmt string
+	var level zerolog.Level
+	var exclude []string
+
+	if common.IsTrace {
+		timeFmt = "04:05"
+		level = zerolog.TraceLevel
+	} else if common.IsDebug {
+		timeFmt = "01-02 15:04"
+		level = zerolog.DebugLevel
+	} else {
+		timeFmt = "01-02 15:04"
+		level = zerolog.InfoLevel
+		exclude = []string{"module"}
+	}
+
+	prefixLength := len(timeFmt) + 5 // level takes 3 + 2 spaces
+	prefix := strings.Repeat(" ", prefixLength)
+
+	logger = zerolog.New(
+		zerolog.ConsoleWriter{
+			Out:           os.Stderr,
+			TimeFormat:    timeFmt,
+			FieldsExclude: exclude,
+			FormatMessage: func(msgI interface{}) string { // pad spaces for each line
+				msg := msgI.(string)
+				lines := strings.Split(msg, "\n")
+				if len(lines) == 1 {
+					return msg
+				}
+				for i := 1; i < len(lines); i++ {
+					lines[i] = prefix + lines[i]
+				}
+				return strings.Join(lines, "\n")
+			},
+		},
+	).Level(level).With().Timestamp().Logger()
+}
+
+func DiscardLogger() { logger = zerolog.Nop() }
+
+func AddHook(h zerolog.Hook) { logger = logger.Hook(h) }
+
+func GetLogger() *zerolog.Logger { return &logger }
+func With() zerolog.Context      { return logger.With() }
+
+func WithLevel(level zerolog.Level) *zerolog.Event { return logger.WithLevel(level) }
+
+func Info() *zerolog.Event         { return logger.Info() }
+func Warn() *zerolog.Event         { return logger.Warn() }
+func Error() *zerolog.Event        { return logger.Error() }
+func Err(err error) *zerolog.Event { return logger.Err(err) }
+func Debug() *zerolog.Event        { return logger.Debug() }
+func Fatal() *zerolog.Event        { return logger.Fatal() }
+func Panic() *zerolog.Event        { return logger.Panic() }
+func Trace() *zerolog.Event        { return logger.Trace() }
--- a/internal/models/autocert_config.go
+++ b/internal/models/autocert_config.go
@@ -1,13 +0,0 @@
-package model
-
-type (
-	AutoCertConfig struct {
-		Email    string              `json:"email"`
-		Domains  []string            `yaml:",flow" json:"domains"`
-		CertPath string              `yaml:"cert_path" json:"cert_path"`
-		KeyPath  string              `yaml:"key_path" json:"key_path"`
-		Provider string              `json:"provider"`
-		Options  AutocertProviderOpt `yaml:",flow" json:"options"`
-	}
-	AutocertProviderOpt map[string]any
-)
--- a/internal/models/config.go
+++ b/internal/models/config.go
@@ -1,18 +0,0 @@
-package model
-
-type Config struct {
-	Providers       ProxyProviders `yaml:",flow" json:"providers"`
-	AutoCert        AutoCertConfig `yaml:",flow" json:"autocert"`
-	ExplicitOnly    bool           `yaml:"explicit_only" json:"explicit_only"`
-	MatchDomains    []string       `yaml:"match_domains" json:"match_domains"`
-	TimeoutShutdown int            `yaml:"timeout_shutdown" json:"timeout_shutdown"`
-	RedirectToHTTPS bool           `yaml:"redirect_to_https" json:"redirect_to_https"`
-}
-
-func DefaultConfig() *Config {
-	return &Config{
-		Providers:       ProxyProviders{},
-		TimeoutShutdown: 3,
-		RedirectToHTTPS: false,
-	}
-}
--- a/internal/models/proxy_providers.go
+++ b/internal/models/proxy_providers.go
@@ -1,6 +0,0 @@
-package model
-
-type ProxyProviders struct {
-	Files  []string          `yaml:"include" json:"include"` // docker, file
-	Docker map[string]string `yaml:"docker" json:"docker"`
-}
--- a/internal/models/raw_entry.go
+++ b/internal/models/raw_entry.go
@@ -1,151 +0,0 @@
-package model
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	. "github.com/yusing/go-proxy/internal/common"
-	D "github.com/yusing/go-proxy/internal/docker"
-	F "github.com/yusing/go-proxy/internal/utils/functional"
-)
-
-type (
-	RawEntry struct {
-		// raw entry object before validation
-		// loaded from docker labels or yaml file
-		Alias        string           `yaml:"-" json:"-"`
-		Scheme       string           `yaml:"scheme" json:"scheme"`
-		Host         string           `yaml:"host" json:"host"`
-		Port         string           `yaml:"port" json:"port"`
-		NoTLSVerify  bool             `yaml:"no_tls_verify" json:"no_tls_verify"` // https proxy only
-		PathPatterns []string         `yaml:"path_patterns" json:"path_patterns"` // http(s) proxy only
-		Middlewares  D.NestedLabelMap `yaml:"middlewares" json:"middlewares"`
-
-		/* Docker only */
-		*D.ProxyProperties `yaml:"-" json:"proxy_properties"`
-	}
-
-	RawEntries = F.Map[string, *RawEntry]
-)
-
-var NewProxyEntries = F.NewMapOf[string, *RawEntry]
-
-func (e *RawEntry) FillMissingFields() bool {
-	isDocker := e.ProxyProperties != nil
-	if !isDocker {
-		e.ProxyProperties = &D.ProxyProperties{}
-	}
-
-	lp, pp, extra := e.splitPorts()
-
-	if port, ok := ServiceNamePortMapTCP[e.ImageName]; ok {
-		if pp == "" {
-			pp = strconv.Itoa(port)
-		}
-		if e.Scheme == "" {
-			e.Scheme = "tcp"
-		}
-	} else if port, ok := ImageNamePortMap[e.ImageName]; ok {
-		if pp == "" {
-			pp = strconv.Itoa(port)
-		}
-		if e.Scheme == "" {
-			e.Scheme = "http"
-		}
-	} else if pp == "" && e.Scheme == "https" {
-		pp = "443"
-	} else if pp == "" {
-		if p, ok := F.FirstValueOf(e.PrivatePortMapping); ok {
-			pp = fmt.Sprint(p.PrivatePort)
-		} else {
-			pp = "80"
-		}
-	}
-
-	// replace private port with public port (if any)
-	if isDocker && e.NetworkMode != "host" {
-		if p, ok := e.PrivatePortMapping[pp]; ok {
-			pp = fmt.Sprint(p.PublicPort)
-		}
-		if _, ok := e.PublicPortMapping[pp]; !ok { // port is not exposed, but specified
-			// try to fallback to first public port
-			if p, ok := F.FirstValueOf(e.PublicPortMapping); ok {
-				pp = fmt.Sprint(p.PublicPort)
-			}
-			// ignore only if it is NOT RUNNING
-			// because stopped containers
-			// will have empty port mapping got from docker
-			if e.Running {
-				return false
-			}
-		}
-	}
-
-	if e.Scheme == "" && isDocker {
-		if p, ok := e.PublicPortMapping[pp]; ok && p.Type == "udp" {
-			e.Scheme = "udp"
-		}
-	}
-
-	if e.Scheme == "" {
-		if lp != "" {
-			e.Scheme = "tcp"
-		} else if strings.HasSuffix(pp, "443") {
-			e.Scheme = "https"
-		} else if _, ok := WellKnownHTTPPorts[pp]; ok {
-			e.Scheme = "http"
-		} else {
-			// assume its http
-			e.Scheme = "http"
-		}
-	}
-
-	if e.Host == "" {
-		e.Host = "localhost"
-	}
-	if e.IdleTimeout == "" {
-		e.IdleTimeout = IdleTimeoutDefault
-	}
-	if e.WakeTimeout == "" {
-		e.WakeTimeout = WakeTimeoutDefault
-	}
-	if e.StopTimeout == "" {
-		e.StopTimeout = StopTimeoutDefault
-	}
-	if e.StopMethod == "" {
-		e.StopMethod = StopMethodDefault
-	}
-
-	e.Port = joinPorts(lp, pp, extra)
-
-	return true
-}
-
-func (e *RawEntry) splitPorts() (lp string, pp string, extra string) {
-	portSplit := strings.Split(e.Port, ":")
-	if len(portSplit) == 1 {
-		pp = portSplit[0]
-	} else {
-		lp = portSplit[0]
-		pp = portSplit[1]
-	}
-	if len(portSplit) > 2 {
-		extra = strings.Join(portSplit[2:], ":")
-	}
-	return
-}
-
-func joinPorts(lp string, pp string, extra string) string {
-	s := make([]string, 0, 3)
-	if lp != "" {
-		s = append(s, lp)
-	}
-	if pp != "" {
-		s = append(s, pp)
-	}
-	if extra != "" {
-		s = append(s, extra)
-	}
-	return strings.Join(s, ":")
-}
--- a/internal/net/http/common.go
+++ b/internal/net/http/common.go
@@ -1,4 +1,4 @@
-package common
+package http

 import (
 	"crypto/tls"
@@ -13,9 +13,13 @@ var (
 		KeepAlive: 60 * time.Second,
 	}
 	DefaultTransport = &http.Transport{
-		Proxy:               http.ProxyFromEnvironment,
-		DialContext:         defaultDialer.DialContext,
-		MaxIdleConnsPerHost: 1000,
+		Proxy:                 http.ProxyFromEnvironment,
+		DialContext:           defaultDialer.DialContext,
+		ForceAttemptHTTP2:     true,
+		MaxIdleConns:          100,
+		MaxIdleConnsPerHost:   10,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
 	}
 	DefaultTransportNoTLS = func() *http.Transport {
 		var clone = DefaultTransport.Clone()
--- a/internal/net/http/content_type.go
+++ b/internal/net/http/content_type.go
@@ -0,0 +1,76 @@
+package http
+
+import (
+	"mime"
+	"net/http"
+)
+
+type ContentType string
+type AcceptContentType []ContentType
+
+func GetContentType(h http.Header) ContentType {
+	ct := h.Get("Content-Type")
+	if ct == "" {
+		return ""
+	}
+	ct, _, err := mime.ParseMediaType(ct)
+	if err != nil {
+		return ""
+	}
+	return ContentType(ct)
+}
+
+func GetAccept(h http.Header) AcceptContentType {
+	var accepts []ContentType
+	for _, v := range h["Accept"] {
+		ct, _, err := mime.ParseMediaType(v)
+		if err != nil {
+			continue
+		}
+		accepts = append(accepts, ContentType(ct))
+	}
+	return accepts
+}
+
+func (ct ContentType) IsHTML() bool {
+	return ct == "text/html" || ct == "application/xhtml+xml"
+}
+
+func (ct ContentType) IsJSON() bool {
+	return ct == "application/json"
+}
+
+func (ct ContentType) IsPlainText() bool {
+	return ct == "text/plain"
+}
+
+func (act AcceptContentType) IsEmpty() bool {
+	return len(act) == 0
+}
+
+func (act AcceptContentType) AcceptHTML() bool {
+	for _, v := range act {
+		if v.IsHTML() || v == "text/*" || v == "*/*" {
+			return true
+		}
+	}
+	return false
+}
+
+func (act AcceptContentType) AcceptJSON() bool {
+	for _, v := range act {
+		if v.IsJSON() || v == "*/*" {
+			return true
+		}
+	}
+	return false
+}
+
+func (act AcceptContentType) AcceptPlainText() bool {
+	for _, v := range act {
+		if v.IsPlainText() || v == "text/*" || v == "*/*" {
+			return true
+		}
+	}
+	return false
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
yusing	00fc75b61b	update setup default branch	2024-10-31 03:07:03 +08:00
yusing	4ee93a1351	added logout endpoint	2024-10-31 00:58:35 +08:00
yusing	669d13b89a	fixed crash on some base64 jwt secret	2024-10-30 11:09:52 +08:00
yusing	5fa86b5eb7	fixed auth internal server error	2024-10-30 10:19:30 +08:00
yusing	369cdf8c4f	fixed config reload	2024-10-30 06:52:18 +08:00
yusing	0397f69853	fixed notification not being sent	2024-10-30 06:44:10 +08:00
yusing	81177926ff	implemented login and jwt auth	2024-10-30 06:25:32 +08:00
yusing	e5bbb18414	migrated from logrus to zerolog, improved error formatting, fixed concurrent map write, fixed crash on rapid page refresh for idle containers, fixed infinite recursion on gotfiy error, fixed websocket connection problem when using idlewatcher	2024-10-29 11:34:58 +08:00
yusing	cfa74d69ae	fixed out of range error on gotify message being sent	2024-10-22 16:46:12 +08:00
yusing	bee26f43d4	initial gotify support	2024-10-22 05:38:09 +08:00
yusing	a3ab32e9ab	reload no longer be skipped when there're errors	2024-10-20 15:05:04 +08:00
yusing	c847fe4747	fixed schema and json tag, hide http://:0	2024-10-20 11:04:44 +08:00
yusing	a278711421	fixed loadbalancer with idlewatcher, fixed reload issue	2024-10-20 09:46:02 +08:00
yusing	01ffe0d97c	simplified error messages	2024-10-19 14:25:28 +08:00
yusing	bd732dfa0a	fixed homepage item not showing	2024-10-19 01:30:34 +08:00
yusing	8b8e1773e8	fixed loadbalanced routes with same alias cause conflict	2024-10-19 01:20:08 +08:00
yusing	b296fb2965	fixed healthcheck failed to disable and nil dereference	2024-10-19 00:13:55 +08:00
yusing	53557e38b6	Fixed a few issues: - Incorrect name being shown on dashboard "Proxies page" - Apps being shown when homepage.show is false - Load balanced routes are shown on homepage instead of the load balancer - Route with idlewatcher will now be removed on container destroy - Idlewatcher panic - Performance improvement - Idlewatcher infinitely loading - Reload stucked / not working properly - Streams stuck on shutdown / reload - etc... Added: - support idlewatcher for loadbalanced routes - partial implementation for stream type idlewatcher Issues: - graceful shutdown	2024-10-18 16:47:01 +08:00
yusing	c0c61709ca	fixed idlewatcher panic, dashboard app name, route not removing on container destroy	2024-10-16 00:57:10 +08:00
yusing	56b778f19c	fixed json output for ls-routes and its API and homepage api	2024-10-15 16:23:46 +08:00
yusing	f4d532598c	Improved healthcheck, idlewatcher support for loadbalanced routes, bug fixes	2024-10-15 15:34:27 +08:00
yusing	53fa28ae77	graceful shutdown and ref count related	2024-10-14 10:31:27 +08:00
yusing	f38b3abdbc	improved health check	2024-10-14 10:02:53 +08:00
yusing	99207ae606	routes in loadbalance pool no longer listed in ls-route and its API, the loadbalancer is listed instead. improved context handling and grateful shutdown	2024-10-14 09:28:54 +08:00
yusing	d3b8cb8cba	fixed possible memory leak for UDP stream	2024-10-14 08:57:46 +08:00
yusing	51c6eb4597	fixed problems related to reload and port selection	2024-10-14 08:55:49 +08:00
yusing	d47b672aa5	refactored some stuff, added healthcheck support, fixed 'include file' reload not showing in log	2024-10-12 13:56:38 +08:00
yusing	64e30f59e8	added missing json tags	2024-10-11 10:38:38 +08:00
yusing	cef7b3d396	updated tests for new behavior	2024-10-11 10:00:10 +08:00
yusing	7184c9cfe9	correcting some behaviors for $DOCKER_HOST, now uses container's private IP instead of localhost	2024-10-11 09:13:38 +08:00
yusing	da04a0dff4	added golangci-linting, refactor, simplified error msgs and fixed some error handling	2024-10-10 11:52:09 +08:00
yusing	d91b66ae87	performance improvement and small fix on loadbalancer	2024-10-09 18:10:51 +08:00
yusing	5c40f4aa84	added round_robin, least_conn and ip_hash load balance support, small refactoring	2024-10-09 10:39:07 +08:00
yusing	1797896fa6	fixed typos and formatting, fixed loading page not being shown (idlewaker)	2024-10-08 13:15:23 +08:00
yusing	d1c9e18c97	improved idlewatcher support for API-like services, fixed idlewaker proxying to zero port	2024-10-07 18:50:51 +08:00
yusing	ef83ed0596	improved idlewatcher and content type matching, update CI	2024-10-07 17:41:08 +08:00
yusing	d89155a6ee	idlewatcher fixed idlewatcher incorrect respond haviour, keep url path	2024-10-07 16:44:18 +08:00
yusing	921ce23dde	refactored http import name, fixed and simplified idlewatcher/idlewaker implementation, dependencies update	2024-10-07 12:45:07 +08:00
yusing	929b7f7059	get back `aa6fafd5`, accidentally reverted in `03cad9f3`	2024-10-07 00:06:29 +08:00
yusing	de7805f281	fixed idlewatcher panics and incorrect behavior, update screenshot	2024-10-06 16:17:52 +08:00
yusing	03cad9f315	added package version api, dependencies upgrade	2024-10-06 09:23:41 +08:00
yusing	aa6fafd52f	improved tracing for debug	2024-10-06 06:06:29 +08:00
yusing	01ff63a007	fix forward auth attempt#1	2024-10-06 03:18:06 +08:00
yusing	99746bad8e	fix attempt#1: int64 not assignable to int	2024-10-06 02:02:13 +08:00
yusing	21b67e97af	websocket fix attempt#2	2024-10-06 01:21:35 +08:00
yusing	668639e484	websocket fix attempt	2024-10-06 00:09:14 +08:00
yusing	e9b2079599	duration formatting update	2024-10-05 09:58:56 +08:00
yusing	5fb7d21c80	fixed that error message with sensitive info shouldn't be shown to end user	2024-10-05 03:42:09 +08:00
yusing	f5e00a6ef4	oops, adding back proxy.exclude=1	2024-10-04 19:07:48 +08:00
yusing	b06cbc0fee	fixed dashboard stats update	2024-10-04 18:52:31 +08:00
yusing	abbcbad5e9	readme updates, docs moved to wiki	2024-10-04 11:27:11 +08:00
yusing	fab39a461f	added ls-icons command	2024-10-04 10:04:18 +08:00
yusing	9c3edff92b	databases without explicit alias(es) are now excluded by default	2024-10-04 09:17:45 +08:00
yusing	e8f4cd18a4	refactor: moved models/ to types/	2024-10-04 08:47:53 +08:00
yusing	e566fd9b57	fixed homepage not respecting homepage.show field, disabled schema validation for included file	2024-10-04 08:36:32 +08:00
yusing	6211ddcdf0	show docker provider name instead of address in log	2024-10-04 07:21:49 +08:00
yusing	245f073350	tuned some http settings, refactor	2024-10-04 07:13:52 +08:00
yusing	dd629f516b	omit EOF and contextCanceled error on non-debug mode	2024-10-04 06:55:43 +08:00
yusing	31080edd59	fixed event name missing	2024-10-04 06:51:26 +08:00
yusing	b679655cd5	fixed dashboard incorrect stats	2024-10-04 06:38:27 +08:00
yusing	ca3b062f89	updated schema for homepage fields	2024-10-04 01:00:06 +08:00
yusing	de6c1be51b	improved homepage support, memory leak partial fix	2024-10-03 20:02:43 +08:00
yusing	4f09dbf044	replace - _ with whitespace for default homepage.name	2024-10-03 10:19:31 +08:00
yusing	e6b4630ce9	experimental homepage labels support	2024-10-03 10:10:14 +08:00
yusing	90bababd38	improved homepage labels	2024-10-03 04:00:02 +08:00
yusing	90130411f9	initial support of homepage labels	2024-10-03 02:53:05 +08:00
yusing	ae61a2335d	added v1/list/match_domains	2024-10-03 02:13:34 +08:00
yusing	8329a8ea9c	replacing label parser map with improved deserialization implementation, API host check now disabled when in debug mode	2024-10-03 01:50:49 +08:00
yusing	ef52ccb929	fixed api, fixed ListFiles function	2024-10-02 17:34:35 +08:00
yusing	ed9d8aab6f	fixed docs	2024-10-02 17:33:41 +08:00
yusing	aa16287447	fixed route gone after container restart / Brename	2024-10-02 15:38:36 +08:00
yusing	a7a922308e	fixed streams with zero port being served	2024-10-02 14:01:36 +08:00
yusing	ba13b81b0e	fixed middleware implementation, added middleware tracing for easier debug	2024-10-02 13:55:41 +08:00
yusing	d172552fb0	fixed docs	2024-10-02 01:33:52 +08:00
yusing	2a8ab27fc1	fixed docs	2024-10-02 01:28:55 +08:00
yusing	e8c3e4c75f	added cidr_whitelist middleware	2024-10-02 01:20:25 +08:00
yusing	ed887a5cfc	fixed serialization and middleware compose	2024-10-02 01:04:34 +08:00
yusing	1bac96dc2a	update docker test	2024-10-02 01:02:59 +08:00
yusing	c3b779a810	containers without port mapped will no longer be served	2024-10-01 17:18:17 +08:00
yusing	44cfd65f6c	implement middleware compose	2024-10-01 16:38:07 +08:00
yusing	f5a36f94bb	fixed error subject missing in some cases	2024-10-01 05:14:56 +08:00
yusing	e951194bee	fixed route not being updated on restart, added experimental middleware compose support	2024-09-30 19:00:27 +08:00
yusing	478311fe9e	fixed container routes not being loaded, added X-Forwarded-{Scheme,Proto,Host}, fixed containers with no mapping being served	2024-09-30 18:04:47 +08:00
yusing	48dd1397e8	remove sensitive info from debug logging	2024-09-30 16:32:58 +08:00
yusing	ebedbc931f	enables add-x-forwarded by default, added hide-x-forwarded	2024-09-30 16:16:56 +08:00
yusing	9065d990e5	go-proxy ls-route now query api server first, then fallback to read from config file	2024-09-30 15:56:03 +08:00
yusing	b38d7595a7	fixed issue for container not being excluded on restart	2024-09-30 15:19:59 +08:00
yusing	860e914b90	added real_ip and cloudflare_real_ip middlewares, fixed that some middlewares does not work properly	2024-09-30 04:03:48 +08:00
yusing	ac3af49aa7	update compose example	2024-09-29 11:46:54 +08:00