fix Makefile

deps upgrade
security: sanitize uri
2026-02-14 22:47:42 +01:00 · 2025-03-23 00:05:10 +08:00 · 2025-03-22 23:58:58 +08:00 · 2025-03-22 23:58:37 +08:00 · 2025-03-02 21:59:32 +08:00 · 2025-03-01 15:53:33 +08:00
114 changed files with 2512 additions and 1899 deletions
--- a/.github/workflows/docker-image-nightly.yml
+++ b/.github/workflows/docker-image-nightly.yml
@@ -0,0 +1,22 @@
+name: Docker Image CI (nightly)
+
+on:
+  push:
+    branches:
+      - "*" # matches every branch that doesn't contain a '/'
+      - "*/*" # matches every branch containing a single '/'
+      - "**" # matches every branch
+      - "!main" # excludes main
+
+jobs:
+  build-nightly:
+    uses: ./.github/workflows/docker-image.yml
+    with:
+      image_name: ${{ github.repository_owner }}/godoxy
+      tag: nightly
+  build-nightly-agent:
+    uses: ./.github/workflows/docker-image.yml
+    with:
+      image_name: ${{ github.repository_owner }}/godoxy-agent
+      tag: nightly
+      agent: true
--- a/.github/workflows/docker-image-prod.yml
+++ b/.github/workflows/docker-image-prod.yml
@@ -0,0 +1,20 @@
+name: Docker Image CI
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  build-prod:
+    uses: ./.github/workflows/docker-image.yml
+    with:
+      image_name: ${{ github.repository_owner }}/godoxy
+      old_image_name: ${{ github.repository_owner }}/go-proxy
+      tag: latest
+  build-prod-agent:
+    uses: ./.github/workflows/docker-image.yml
+    with:
+      image_name: ${{ github.repository_owner }}/godoxy-agent
+      tag: latest
+      agent: true
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -1,128 +1,163 @@
 name: Docker Image CI

 on:
-    push:
-        tags: ["*"]
+  workflow_call:
+    inputs:
+      tag:
+        required: true
+        type: string
+      image_name:
+        required: true
+        type: string
+      old_image_name:
+        required: false
+        type: string
+      agent:
+        required: false
+        default: false
+        type: boolean

 env:
-    REGISTRY: ghcr.io
-    IMAGE_NAME: ${{ github.repository }}
+  REGISTRY: ghcr.io
+  MAKE_ARGS: agent=${{ inputs.agent && '1' || '0' }}
+  DIGEST_PATH: /tmp/digests/${{ inputs.agent && 'agent' || 'main' }}
+  DIGEST_NAME_SUFFIX: ${{ inputs.agent && 'agent' || 'main' }}

 jobs:
-    build:
-        name: Build multi-platform Docker image
-        runs-on: ubuntu-22.04
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            platform: linux/amd64
+          - runner: ubuntu-24.04-arm
+            platform: linux/arm64

-        permissions:
-            contents: read
-            packages: write
-            id-token: write
-            attestations: write
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.runner }}

-        strategy:
-            fail-fast: false
-            matrix:
-                platform:
-                    - linux/amd64
-                    # - linux/arm/v6
-                    # - linux/arm/v7
-                    - linux/arm64
-        steps:
-            - name: Prepare
-              run: |
-                  platform=${{ matrix.platform }}
-                  echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write

-            - name: Docker meta
-              id: meta
-              uses: docker/metadata-action@v5
-              with:
-                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+    steps:
+      - name: Prepare
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

-            - name: Set up QEMU
-              uses: docker/setup-qemu-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ inputs.image_name }}
+          tags: |
+            type=raw,value=${{ inputs.tag }},event=branch
+            type=ref,event=tag

-            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          platforms: ${{ matrix.platform }}

-            - name: Login to registry
-              uses: docker/login-action@v3
-              with:
-                  registry: ${{ env.REGISTRY }}
-                  username: ${{ github.actor }}
-                  password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}

-            - name: Build and push by digest
-              id: build
-              uses: docker/build-push-action@v6
-              with:
-                  platforms: ${{ matrix.platform }}
-                  labels: ${{ steps.meta.outputs.labels }}
-                  outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
-                  cache-from: type=gha
-                  cache-to: type=gha,mode=max
-                  build-args: |
-                      VERSION=${{ github.ref_name }}
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,name=${{ env.REGISTRY }}/${{ inputs.image_name }},push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          build-args: |
+            VERSION=${{ github.ref_name }}
+            MAKE_ARGS=${{ env.MAKE_ARGS }}

-            - name: Generate artifact attestation
-              uses: actions/attest-build-provenance@v1
-              with:
-                  subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
-                  subject-digest: ${{ steps.build.outputs.digest }}
-                  push-to-registry: true
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ inputs.image_name }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true

-            - name: Export digest
-              run: |
-                  mkdir -p /tmp/digests
-                  digest="${{ steps.build.outputs.digest }}"
-                  touch "/tmp/digests/${digest#sha256:}"
+      - name: Export digest
+        run: |
+          mkdir -p ${{ env.DIGEST_PATH }}
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ env.DIGEST_PATH }}/${digest#sha256:}"

-            - name: Upload digest
-              uses: actions/upload-artifact@v4
-              with:
-                  name: digests-${{ env.PLATFORM_PAIR }}
-                  path: /tmp/digests/*
-                  if-no-files-found: error
-                  retention-days: 1
-    merge:
-        runs-on: ubuntu-22.04
-        needs:
-            - build
-        permissions:
-            contents: read
-            packages: write
-            id-token: write
-        steps:
-            - name: Download digests
-              uses: actions/download-artifact@v4
-              with:
-                  path: /tmp/digests
-                  pattern: digests-*
-                  merge-multiple: true
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ env.PLATFORM_PAIR }}-${{ env.DIGEST_NAME_SUFFIX }}
+          path: ${{ env.DIGEST_PATH }}/*
+          if-no-files-found: error
+          retention-days: 1

-            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
+  merge:
+    needs: build
+    runs-on: ubuntu-latest

-            - name: Docker meta
-              id: meta
-              uses: docker/metadata-action@v5
-              with:
-                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write

-            - name: Login to registry
-              uses: docker/login-action@v3
-              with:
-                  registry: ${{ env.REGISTRY }}
-                  username: ${{ github.actor }}
-                  password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ env.DIGEST_PATH }}
+          pattern: digests-*-${{ env.DIGEST_NAME_SUFFIX }}
+          merge-multiple: true

-            - name: Create manifest list and push
-              id: push
-              working-directory: /tmp/digests
-              run: |
-                  docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-                    $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3

-            - name: Inspect image
-              run: |
-                  docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ inputs.image_name }}
+          tags: |
+            type=raw,value=${{ inputs.tag }},event=branch
+            type=ref,event=tag
+
+      - name: Login to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create manifest list and push
+        id: push
+        working-directory: ${{ env.DIGEST_PATH }}
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.REGISTRY }}/${{ inputs.image_name }}@sha256:%s ' *)
+
+      - name: Old image name
+        if: inputs.old_image_name != ''
+        run: |
+          docker buildx imagetools create -t ${{ env.REGISTRY }}/${{ inputs.old_image_name }}:${{ steps.meta.outputs.version }}\
+            ${{ env.REGISTRY }}/${{ inputs.image_name }}:${{ steps.meta.outputs.version }}
+
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ inputs.image_name }}:${{ steps.meta.outputs.version }}
+
+      - name: Inspect image (old)
+        if: inputs.old_image_name != ''
+        run: |
+          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ inputs.old_image_name }}:${{ steps.meta.outputs.version }}
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -9,9 +9,6 @@ linters-settings:
      - fieldalignment
  gocyclo:
    min-complexity: 14
-  goconst:
-    min-len: 3
-    min-occurrences: 4
  misspell:
    locale: US
  funlen:
@@ -102,13 +99,14 @@ linters:
    - depguard # Not relevant
    - nakedret # Too strict
    - lll # Not relevant
-    - gocyclo # FIXME must be fixed
+    - gocyclo # must be fixed
    - gocognit # Too strict
    - nestif # Too many false-positive.
    - prealloc # Too many false-positive.
    - makezero # Not relevant
    - dupl # Too strict
    - gci # I don't care
+    - goconst # Too annoying
    - gosec # Too strict
    - gochecknoinits
    - gochecknoglobals
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -2,12 +2,12 @@
 # To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
 version: 0.1
 cli:
-  version: 1.22.8
+  version: 1.22.10
 # Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
 plugins:
  sources:
    - id: trunk
-      ref: v1.6.6
+      ref: v1.6.7
      uri: https://github.com/trunk-io/plugins
 # Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
 runtimes:
@@ -22,17 +22,17 @@ lint:
    - yamllint
  enabled:
    - hadolint@2.12.1-beta
-    - actionlint@1.7.6
-    - checkov@3.2.352
+    - actionlint@1.7.7
+    - checkov@3.2.370
    - git-diff-check
    - gofmt@1.20.4
-    - golangci-lint@1.63.4
+    - golangci-lint@1.64.5
    - osv-scanner@1.9.2
-    - oxipng@9.1.3
-    - prettier@3.4.2
+    - oxipng@9.1.4
+    - prettier@3.5.1
    - shellcheck@0.10.0
    - shfmt@3.6.0
-    - trufflehog@3.88.2
+    - trufflehog@3.88.9
 actions:
  disabled:
    - trunk-announce
--- a/.vscode/settings.example.json
+++ b/.vscode/settings.example.json
@@ -1,10 +1,10 @@
 {
  "yaml.schemas": {
-    "https://github.com/yusing/go-proxy/raw/v0.9/schemas/config.schema.json": [
+    "https://github.com/yusing/go-proxy/raw/main/schemas/config.schema.json": [
      "config.example.yml",
      "config.yml"
    ],
-    "https://github.com/yusing/go-proxy/raw/v0.9/schemas/routes.schema.json": [
+    "https://github.com/yusing/go-proxy/raw/main/schemas/routes.schema.json": [
      "providers.example.yml"
    ]
  }
--- a/2
+++ b/2
@@ -1,5 +1,5 @@
 # Stage 1: Builder
-FROM golang:1.23.5-alpine AS builder
+FROM golang:1.23.6-alpine AS builder
 HEALTHCHECK NONE

 # package version does not matter
--- a/61
+++ b/61
@@ -4,37 +4,53 @@ export GOOS = linux

 LDFLAGS = -X github.com/yusing/go-proxy/pkg.version=${VERSION}

+
+ifeq ($(agent), 1)
+	NAME = godoxy-agent
+	CMD_PATH = ./agent/cmd
+else
+	NAME = godoxy
+	CMD_PATH = ./cmd
+endif
+
 ifeq ($(trace), 1)
+	debug = 1
 	GODOXY_TRACE ?= 1
+	GODEBUG = gctrace=1 inittrace=1 schedtrace=3000
+endif
+
+ifeq ($(race), 1)
+	debug = 1
+  BUILD_FLAGS += -race
 endif

 ifeq ($(debug), 1)
 	CGO_ENABLED = 0
 	GODOXY_DEBUG = 1
-  BUILD_FLAGS = -tags production
-else ifeq ($(pprof), 1)
+	BUILD_FLAGS += -gcflags=all='-N -l'
+endif
+
+ifeq ($(pprof), 1)
 	CGO_ENABLED = 1
-	GODEBUG = gctrace=1 inittrace=1 schedtrace=3000
-	GORACE = log_path=logs/pprof strip_path_prefix=$(shell pwd)/
-	BUILD_FLAGS = -race -gcflags=all='-N -l' -tags pprof
-	DOCKER_TAG = pprof
-	VERSION += -pprof
+	GORACE = log_path=logs/pprof strip_path_prefix=$(shell pwd)/ halt_on_error=1
+	BUILD_FLAGS = -tags pprof
+	VERSION := ${VERSION}-pprof
 else
 	CGO_ENABLED = 0
 	LDFLAGS += -s -w
-  BUILD_FLAGS = -pgo=auto -tags production
-	DOCKER_TAG = latest
+	BUILD_FLAGS = -pgo=auto -tags production
 endif

 BUILD_FLAGS += -ldflags='$(LDFLAGS)'

+export NAME
+export CMD_PATH
 export CGO_ENABLED
 export GODOXY_DEBUG
 export GODOXY_TRACE
 export GODEBUG
 export GORACE
 export BUILD_FLAGS
-export DOCKER_TAG

 test:
 	GODOXY_TEST=1 go test ./internal/...
@@ -44,14 +60,14 @@ get:

 build:
 	mkdir -p bin
-	go build ${BUILD_FLAGS} -o bin/godoxy ./cmd
+	go build ${BUILD_FLAGS} -o bin/${NAME} ${CMD_PATH}
 	if [ $(shell id -u) -eq 0 ]; \
-		then setcap CAP_NET_BIND_SERVICE=+eip bin/godoxy; \
-		else sudo setcap CAP_NET_BIND_SERVICE=+eip bin/godoxy; \
+		then setcap CAP_NET_BIND_SERVICE=+eip bin/${NAME}; \
+		else sudo setcap CAP_NET_BIND_SERVICE=+eip bin/${NAME}; \
 	fi

 run:
-	[ -f .env ] && godotenv -f .env go run ${BUILD_FLAGS} ./cmd
+	[ -f .env ] && godotenv -f .env go run ${BUILD_FLAGS} ${CMD_PATH}

 mtrace:
 	bin/godoxy debug-ls-mtrace > mtrace.json
@@ -71,21 +87,8 @@ ci-test:
 cloc:
 	cloc --not-match-f '_test.go$$' cmd internal pkg

-push-docker-io:
-	BUILDER=build docker buildx build \
-		--platform linux/arm64,linux/amd64 \
-		-f Dockerfile \
-		-t docker.io/yusing/godoxy-nightly:${DOCKER_TAG} \
-		-t docker.io/yusing/godoxy-nightly:${VERSION}-${BUILD_DATE} \
-		--build-arg VERSION="${VERSION}-nightly-${BUILD_DATE}" \
-		--build-arg BUILD_FLAGS="${BUILD_FLAGS}" \
-		--push .
-
-build-docker:
-	docker build -t godoxy-nightly \
-		--build-arg VERSION="${VERSION}-nightly-${BUILD_DATE}" \
-		--build-arg BUILD_FLAGS="${BUILD_FLAGS}" \
-		.
+link-binary:
+	ln -s /app/${NAME} bin/run

 # To generate schema
 # comment out this part from typescript-json-schema.js#L884
--- a/README.md
+++ b/README.md
@@ -2,22 +2,24 @@

 # GoDoxy

-[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-![GitHub last commit](https://img.shields.io/github/last-commit/yusing/go-proxy)
-[![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_godoxy)
+![GitHub last commit](https://img.shields.io/github/last-commit/yusing/godoxy)
+[![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_godoxy)
 [![](https://dcbadge.limes.pink/api/server/umReR62nRd?style=flat)](https://discord.gg/umReR62nRd)

-A lightweight, simple, and [performant](https://github.com/yusing/go-proxy/wiki/Benchmarks) reverse proxy with WebUI.
+A lightweight, simple, and [performant](https://github.com/yusing/godoxy/wiki/Benchmarks) reverse proxy with WebUI.

-For full documentation, check out **[Wiki](https://github.com/yusing/go-proxy/wiki)**
+For full documentation, check out **[Wiki](https://github.com/yusing/godoxy/wiki)**

 **EN** | <a href="README_CHT.md">中文</a>

+**Currently working on [feat/godoxy-agent](https://github.com/yusing/godoxy/tree/feat/godoxy-agent).<br/>For contribution, please fork this instead of default branch.**
+
 <!-- [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
 [![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
 [![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy) -->

-<img src="https://github.com/user-attachments/assets/4bb371f4-6e4c-425c-89b2-b9e962bdd46f" style="max-width: 650">
+<img src="screenshots/webui.jpg" style="max-width: 650">

 </div>

@@ -29,30 +31,29 @@ For full documentation, check out **[Wiki](https://github.com/yusing/go-proxy/wi
  - [Table of content](#table-of-content)
  - [Key Features](#key-features)
  - [Prerequisites](#prerequisites)
+  - [How does GoDoxy work](#how-does-godoxy-work)
  - [Setup](#setup)
-    - [Manual Setup](#manual-setup)
-    - [Folder structrue](#folder-structrue)
-    - [Use JSON Schema in VSCode](#use-json-schema-in-vscode)
  - [Screenshots](#screenshots)
    - [idlesleeper](#idlesleeper)
+    - [Metrics and Logs](#metrics-and-logs)
+  - [Manual Setup](#manual-setup)
+    - [Folder structrue](#folder-structrue)
  - [Build it yourself](#build-it-yourself)

 ## Key Features

 - Easy to use
  - Effortless configuration
-  - Simple multi-node setup
+  - Simple multi-node setup with GoDoxy agents
  - Error messages is clear and detailed, easy troubleshooting
- Auto SSL cert management (See [Supported DNS-01 Challenge Providers](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers))
- Auto configuration for docker containers
+- Auto SSL with Let's Encrypt and DNS-01 (See [Supported DNS-01 Challenge Providers](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers))
 - Auto hot-reload on container state / config file changes
+- Create routes dynamically from running docker containers
 - **idlesleeper**: stop containers on idle, wake it up on traffic _(optional, see [screenshots](#idlesleeper))_
- HTTP(s) reserve proxy
- OpenID Connect support
- [HTTP middleware support](https://github.com/yusing/go-proxy/wiki/Middlewares)
- [Custom error pages support](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
- TCP and UDP port forwarding
- **Web UI with App dashboard and config editor**
+- HTTP reserve proxy and TCP/UDP port forwarding
+- OpenID Connect integration
+- [HTTP middleware](https://github.com/yusing/go-proxy/wiki/Middlewares) and [Custom error pages support](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
+- **Web UI with App dashboard, config editor, _uptime monitor_, _system monitor_, _docker logs viewer_ (available on nightly builds)**
 - Supports linux/amd64, linux/arm64
 - Written in **[Go](https://go.dev)**

@@ -60,46 +61,87 @@ For full documentation, check out **[Wiki](https://github.com/yusing/go-proxy/wi

 ## Prerequisites

-Setup DNS Records point to machine which runs `GoDoxy`, e.g.
+Setup Wildcard DNS Record(s) for machine running `GoDoxy`, e.g.

- A Record: `*.y.z` -> `10.0.10.1`
- AAAA Record: `*.y.z` -> `::ffff:a00:a01`
+- A Record: `*.domain.com` -> `10.0.10.1`
+- AAAA Record (if you use IPv6): `*.domain.com` -> `::ffff:a00:a01`
+
+## How does GoDoxy work
+
+1. List all the containers
+2. Read container name, labels and port configurations for each of them
+3. Create a route if applicable (a route is like a "Virtual Host" in NPM)
+
+GoDoxy uses the label `proxy.aliases` as the subdomain(s), if unset it defaults to `container_name`.
+
+For example, with the label `proxy.aliases: qbt` you can access your app via `qbt.domain.com`.

 ## Setup

-1.  Pull the latest docker images
+**NOTE:** GoDoxy is designed to be (and only works when) running in `host` network mode, do not change it. To change listening ports, modify `.env`.
+
+1. Prepare a new directory for docker compose and config files.
+
+2. Run setup script inside the directory, or [set up manually](#manual-setup)

    ```shell
-    docker pull ghcr.io/yusing/go-proxy:latest
+    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/godoxy/main/scripts/setup.sh)"
    ```

-2.  Create new directory, `cd` into it, then run setup, or [set up manually](#manual-setup)
+3. Start the container `docker compose up -d` and wait for it to be ready

-    ```shell
-    docker run --rm -v .:/setup ghcr.io/yusing/go-proxy /app/godoxy setup
-    ```
-
-3.  _(Optional)_ setup `docker-socket-proxy` other docker nodes (see [Multi docker nodes setup](https://github.com/yusing/go-proxy/wiki/Configurations#multi-docker-nodes-setup)) then add them inside `config.yml`
-
-4.  Start the container `docker compose up -d`
-
-5.  You may now do some extra configuration on WebUI `https://godoxy.domain.com`
+4. You may now do some extra configuration on WebUI `https://godoxy.yourdomain.com`

 [🔼Back to top](#table-of-content)

-### Manual Setup
+## Screenshots
+
+### idlesleeper
+
+![idlesleeper](screenshots/idlesleeper.webp)
+
+### Metrics and Logs
+
+_In development, available on nightly builds._
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center"><img src="screenshots/uptime.png" alt="Uptime Monitor" width="250"/></td>
+      <td align="center"><img src="screenshots/docker-logs.jpg" alt="Docker Logs" width="250"/></td>
+      <td align="center"><img src="screenshots/docker.jpg" alt="Server Overview" width="250"/></td>
+    </tr>
+    <tr>
+      <td align="center"><b>Uptime Monitor</b></td>
+      <td align="center"><b>Docker Logs</b></td>
+      <td align="center"><b>Server Overview</b></td>
+    </tr>
+        <tr>
+      <td align="center"><img src="screenshots/system-monitor.jpg" alt="System Monitor" width="250"/></td>
+      <td align="center"><img src="screenshots/system-info-graphs.jpg" alt="Graphs" width="250"/></td>
+    </tr>
+    <tr>
+      <td align="center"><b>System Monitor</b></td>
+      <td align="center"><b>Graphs</b></td>
+    </tr>
+  </table>
+</div>
+
+[🔼Back to top](#table-of-content)
+
+## Manual Setup

 1. Make `config` directory then grab `config.example.yml` into `config/config.yml`

-   `mkdir -p config && wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/config.example.yml -O config/config.yml`
+   `mkdir -p config && wget https://raw.githubusercontent.com/yusing/godoxy/main/config.example.yml -O config/config.yml`

 2. Grab `.env.example` into `.env`

-   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/.env.example -O .env`
+   `wget https://raw.githubusercontent.com/yusing/godoxy/main/.env.example -O .env`

 3. Grab `compose.example.yml` into `compose.yml`

-   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/compose.example.yml -O compose.yml`
+   `wget https://raw.githubusercontent.com/yusing/godoxy/main/compose.example.yml -O compose.yml`

 ### Folder structrue

@@ -115,26 +157,16 @@ Setup DNS Records point to machine which runs `GoDoxy`, e.g.
 │   │   ├── middleware2.yml
 │   ├── provider1.yml
 │   └── provider2.yml
+├── data
+│   ├── metrics # metrics data
+│   │   ├── uptime.json
+│   │   └── system_info.json
 └── .env
 ```

-### Use JSON Schema in VSCode
-
-Copy [`.vscode/settings.example.json`](.vscode/settings.example.json) to `.vscode/settings.json` and modify it to fit your needs
-
-[🔼Back to top](#table-of-content)
-
-## Screenshots
-
-### idlesleeper
-
-![idlesleeper](screenshots/idlesleeper.webp)
-
-[🔼Back to top](#table-of-content)
-
 ## Build it yourself

-1. Clone the repository `git clone https://github.com/yusing/go-proxy --depth=1`
+1. Clone the repository `git clone https://github.com/yusing/godoxy --depth=1`

 2. Install / Upgrade [go (>=1.22)](https://go.dev/doc/install) and `make` if not already

--- a/README_CHT.md
+++ b/README_CHT.md
@@ -32,7 +32,6 @@
  - [安裝](#安裝)
    - [手動安裝](#手動安裝)
    - [資料夾結構](#資料夾結構)
-    - [在 VSCode 中使用 JSON Schema](#在-vscode-中使用-json-schema)
  - [截圖](#截圖)
    - [閒置休眠](#閒置休眠)
  - [自行編譯](#自行編譯)
@@ -67,23 +66,19 @@

 ## 安裝

-1.  拉取最新的 Docker 映像
+**注意：** GoDoxy 設計為（且僅在）`host` 網路模式下運作，請勿更改。如需更改監聽埠，請修改 `.env`。
+
+1.  準備一個新目錄用於 docker compose 和配置文件。
+
+2.  在目錄內運行安裝腳本，或[手動安裝](#手動安裝)

    ```shell
-    docker pull ghcr.io/yusing/go-proxy:latest
+    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/go-proxy/main/scripts/setup.sh)"
    ```

-2.  建立新目錄，`cd` 進入後運行安裝，或[手動安裝](#手動安裝)
+3.  啟動容器 `docker compose up -d` 並等待就緒

-    ```shell
-    docker run --rm -v .:/setup ghcr.io/yusing/go-proxy /app/godoxy setup
-    ```
-
-3.  _（可選）_ 設置其他 Docker 節點的 `docker-socket-proxy`（參見 [多 Docker 節點設置](https://github.com/yusing/go-proxy/wiki/Configurations#multi-docker-nodes-setup)），然後在 `config.yml` 中添加它們
-
-4.  啟動容器 `docker compose up -d`
-
-5.  大功告成!可前往WebUI `https://gp.domain.com` 進行額外的配置
+4.  現在可以在 WebUI `https://godoxy.yourdomain.com` 進行額外配置

 [🔼回到頂部](#目錄)

@@ -91,15 +86,15 @@

 1. 建立 `config` 目錄，然後將 `config.example.yml` 下載到 `config/config.yml`

-   `mkdir -p config && wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/config.example.yml -O config/config.yml`
+   `mkdir -p config && wget https://raw.githubusercontent.com/yusing/go-proxy/main/config.example.yml -O config/config.yml`

 2. 將 `.env.example` 下載到 `.env`

-   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/.env.example -O .env`
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/main/.env.example -O .env`

 3. 將 `compose.example.yml` 下載到 `compose.yml`

-   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/compose.example.yml -O compose.yml`
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/main/compose.example.yml -O compose.yml`

 ### 資料夾結構

@@ -115,15 +110,13 @@
 │   │   ├── middleware2.yml
 │   ├── provider1.yml
 │   └── provider2.yml
+├── data
+│   ├── metrics # metrics data
+│   │   ├── uptime.json
+│   │   └── system_info.json
 └── .env
 ```

-### 在 VSCode 中使用 JSON Schema
-
-複製 [`.vscode/settings.example.json`](.vscode/settings.example.json) 到 `.vscode/settings.json` 並根據需要修改
-
-[🔼回到頂部](#目錄)
-
 ## 截圖

 ### 閒置休眠
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -35,9 +35,6 @@ func init() {
 	}
 	logging.InitLogger(out)
 	// logging.AddHook(v1.GetMemLogger())
-	internal.InitIconListCache()
-	homepage.InitOverridesConfig()
-	favicon.InitIconCache()
 }

 func main() {
@@ -45,9 +42,6 @@ func main() {
 	args := common.GetArgs()

 	switch args.Command {
-	case common.CommandSetup:
-		internal.Setup()
-		return
 	case common.CommandReload:
 		if err := query.ReloadServer(); err != nil {
 			E.LogFatal("server reload error", err)
@@ -120,13 +114,17 @@ func main() {
 		printJSON(cfg.Value())
 		return
 	case common.CommandDebugListEntries:
-		printJSON(cfg.DumpEntries())
+		printJSON(cfg.DumpRoutes())
 		return
 	case common.CommandDebugListProviders:
 		printJSON(cfg.DumpRouteProviders())
 		return
 	}

+	go internal.InitIconListCache()
+	go homepage.InitOverridesConfig()
+	go favicon.InitIconCache()
+
 	cfg.Start(&config.StartServersOptions{
 		Proxy: true,
 	})
--- a/compose.example.yml
+++ b/compose.example.yml
@@ -1,7 +1,7 @@
 ---
 services:
  frontend:
-    image: ghcr.io/yusing/go-proxy-frontend:latest
+    image: ghcr.io/yusing/godoxy-frontend:latest
    container_name: godoxy-frontend
    restart: unless-stopped
    network_mode: host
@@ -21,7 +21,7 @@ services:
      #     - 192.168.0.0/16
      #     - 172.16.0.0/12
  app:
-    image: ghcr.io/yusing/go-proxy:latest
+    image: ghcr.io/yusing/godoxy:latest
    container_name: godoxy
    restart: always
    network_mode: host
--- a/go.mod
+++ b/go.mod
@@ -1,32 +1,34 @@
 module github.com/yusing/go-proxy

-go 1.23.5
+go 1.23.6

 require (
-	github.com/PuerkitoBio/goquery v1.10.1
-	github.com/coder/websocket v1.8.12
-	github.com/coreos/go-oidc/v3 v3.12.0
-	github.com/docker/cli v27.5.1+incompatible
-	github.com/docker/docker v27.5.1+incompatible
-	github.com/fsnotify/fsnotify v1.8.0
-	github.com/go-acme/lego/v4 v4.21.0
-	github.com/go-playground/validator/v10 v10.24.0
-	github.com/gobwas/glob v0.2.3
-	github.com/golang-jwt/jwt/v5 v5.2.1
-	github.com/gotify/server/v2 v2.6.1
-	github.com/lithammer/fuzzysearch v1.1.8
-	github.com/prometheus/client_golang v1.20.5
-	github.com/puzpuzpuz/xsync/v3 v3.5.0
-	github.com/rs/zerolog v1.33.0
-	github.com/vincent-petithory/dataurl v1.0.0
-	golang.org/x/crypto v0.32.0
-	golang.org/x/net v0.34.0
-	golang.org/x/oauth2 v0.25.0
-	golang.org/x/text v0.21.0
-	golang.org/x/time v0.9.0
-	gopkg.in/yaml.v3 v3.0.1
+	github.com/PuerkitoBio/goquery v1.10.2 // parsing HTML for extract fav icon
+	github.com/coder/websocket v1.8.13 // websocket for API and agent
+	github.com/coreos/go-oidc/v3 v3.13.0 // oidc authentication
+	github.com/docker/cli v28.0.2+incompatible // docker CLI
+	github.com/docker/docker v28.0.2+incompatible // docker daemon
+	github.com/fsnotify/fsnotify v1.8.0 // file watcher
+	github.com/go-acme/lego/v4 v4.22.2 // acme client
+	github.com/go-playground/validator/v10 v10.25.0 // validator
+	github.com/gobwas/glob v0.2.3 // glob matcher for route rules
+	github.com/golang-jwt/jwt/v5 v5.2.2 // jwt for default auth
+	github.com/gotify/server/v2 v2.6.1 // reference the Message struct for json response
+	github.com/lithammer/fuzzysearch v1.1.8 // fuzzy search for searching icons and filtering metrics
+	github.com/prometheus/client_golang v1.21.1 // metrics
+	github.com/puzpuzpuz/xsync/v3 v3.5.1 // lock free map for concurrent operations
+	github.com/rs/zerolog v1.34.0 // logging
+	github.com/vincent-petithory/dataurl v1.0.0 // data url for fav icon
+	golang.org/x/crypto v0.36.0 // encrypting password with bcrypt
+	golang.org/x/net v0.37.0 // HTTP header utilities
+	golang.org/x/oauth2 v0.28.0 // oauth2 authentication
+	golang.org/x/text v0.23.0 // string utilities
+	golang.org/x/time v0.11.0 // time utilities
+	gopkg.in/yaml.v3 v3.0.1 // yaml parsing for different config files
 )

+require github.com/stretchr/testify v1.10.0
+
 require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/andybalholm/cascadia v1.3.3 // indirect
@@ -35,12 +37,13 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudflare/cloudflare-go v0.115.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
@@ -48,35 +51,36 @@ require (
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/miekg/dns v1.1.63 // indirect
+	github.com/miekg/dns v1.1.64 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/nrdcg/porkbun v0.4.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
-	github.com/ovh/go-ovh v1.6.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/ovh/go-ovh v1.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/common v0.63.0 // indirect
+	github.com/prometheus/procfs v0.16.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
-	go.opentelemetry.io/otel v1.34.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 // indirect
-	go.opentelemetry.io/otel/metric v1.34.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.30.0 // indirect
-	go.opentelemetry.io/otel/trace v1.34.0 // indirect
-	golang.org/x/mod v0.22.0 // indirect
-	golang.org/x/sync v0.10.0 // indirect
-	golang.org/x/sys v0.29.0 // indirect
-	golang.org/x/tools v0.29.0 // indirect
-	google.golang.org/protobuf v1.36.4 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/tools v0.31.0 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gotest.tools/v3 v3.5.1 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -2,8 +2,8 @@ github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOEl
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/PuerkitoBio/goquery v1.10.1 h1:Y8JGYUkXWTGRB6Ars3+j3kN0xg1YqqlwvdTV8WTFQcU=
-github.com/PuerkitoBio/goquery v1.10.1/go.mod h1:IYiHrOMps66ag56LEH7QYDDupKXyo5A8qrjIx3ZtujY=
+github.com/PuerkitoBio/goquery v1.10.2 h1:7fh2BdHcG6VFZsK7toXBT/Bh1z5Wmy8Q9MV9HqT2AM8=
+github.com/PuerkitoBio/goquery v1.10.2/go.mod h1:0guWGjcLu9AYC7C1GHnpysHy056u9aEkUHwhdnePMCU=
 github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
 github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -14,12 +14,12 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cloudflare/cloudflare-go v0.115.0 h1:84/dxeeXweCc0PN5Cto44iTA8AkG1fyT11yPO5ZB7sM=
 github.com/cloudflare/cloudflare-go v0.115.0/go.mod h1:Ds6urDwn/TF2uIU24mu7H91xkKP8gSAHxQ44DSZgVmU=
-github.com/coder/websocket v1.8.12 h1:5bUXkEPPIbewrnkU8LTCLVaxi4N4J8ahufH2vlo4NAo=
-github.com/coder/websocket v1.8.12/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
+github.com/coder/websocket v1.8.13 h1:f3QZdXy7uGVz+4uCJy2nTZyM0yTBj8yANEHhqlXZ9FE=
+github.com/coder/websocket v1.8.13/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/coreos/go-oidc/v3 v3.12.0 h1:sJk+8G2qq94rDI6ehZ71Bol3oUHy63qNYmkiSjrc/Jo=
-github.com/coreos/go-oidc/v3 v3.12.0/go.mod h1:gE3LgjOgFoHi9a4ce4/tJczr0Ai2/BoDhf0r5lltWI0=
+github.com/coreos/go-oidc/v3 v3.13.0 h1:M66zd0pcc5VxvBNM4pB331Wrsanby+QomQYjN8HamW8=
+github.com/coreos/go-oidc/v3 v3.13.0/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -27,10 +27,10 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v27.5.1+incompatible h1:JB9cieUT9YNiMITtIsguaN55PLOHhBSz3LKVc6cqWaY=
-github.com/docker/cli v27.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v27.5.1+incompatible h1:4PYU5dnBYqRQi0294d1FBECqT9ECWeQAIfE8q4YnPY8=
-github.com/docker/docker v27.5.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v28.0.2+incompatible h1:cRPZ77FK3/IXTAIQQj1vmhlxiLS5m+MIUDwS6f57lrE=
+github.com/docker/cli v28.0.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.0.2+incompatible h1:9BILleFwug5FSSqWBgVevgL3ewDJfWWWyZVqlDMttE8=
+github.com/docker/docker v28.0.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -41,10 +41,10 @@ github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/
 github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
 github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
-github.com/go-acme/lego/v4 v4.21.0 h1:arEW+8o5p7VI8Bk1kr/PDlgD1DrxtTH1gJ4b7mehL8o=
-github.com/go-acme/lego/v4 v4.21.0/go.mod h1:HrSWzm3Ckj45Ie3i+p1zKVobbQoMOaGu9m4up0dUeDI=
-github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
-github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
+github.com/go-acme/lego/v4 v4.22.2 h1:ck+HllWrV/rZGeYohsKQ5iKNnU/WAZxwOdiu6cxky+0=
+github.com/go-acme/lego/v4 v4.22.2/go.mod h1:E2FndyI3Ekv0usNJt46mFb9LVpV/XBYT+4E3tz02Tzo=
+github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
+github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -56,8 +56,8 @@ github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/o
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.24.0 h1:KHQckvo8G6hlWnrPX4NJJ+aBfWNAE/HH+qdL2cBpCmg=
-github.com/go-playground/validator/v10 v10.24.0/go.mod h1:GGzBIJMuE98Ic/kJsBXbz1x/7cByt++cQ+YOuDM5wus=
+github.com/go-playground/validator/v10 v10.25.0 h1:5Dh7cjvzR7BRZadnsVOzPhWsrwUr0nmsZJxEAnFLNO8=
+github.com/go-playground/validator/v10 v10.25.0/go.mod h1:GGzBIJMuE98Ic/kJsBXbz1x/7cByt++cQ+YOuDM5wus=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
@@ -65,11 +65,12 @@ github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PU
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -82,8 +83,8 @@ github.com/jarcoal/httpmock v1.3.0 h1:2RJ8GP0IIaWwcC9Fp2BmVi8Kog3v2Hn7VXM3fTd+nu
 github.com/jarcoal/httpmock v1.3.0/go.mod h1:3yb8rc4BI7TCBhFY8ng0gjuLKJNquuDNiPaZjnENuYg=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -103,8 +104,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/maxatome/go-testdeep v1.12.0 h1:Ql7Go8Tg0C1D/uMMX59LAoYK7LffeJQ6X2T04nTH68g=
 github.com/maxatome/go-testdeep v1.12.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM=
-github.com/miekg/dns v1.1.63 h1:8M5aAw6OMZfFXTT7K5V0Eu5YiiL8l7nUAkyN6C9YwaY=
-github.com/miekg/dns v1.1.63/go.mod h1:6NGHfjhpmr5lt3XPLuyfDJi5AXbNIPM9PY6H6sF1Nfs=
+github.com/miekg/dns v1.1.64 h1:wuZgD9wwCE6XMT05UU/mlSko71eRSXEAm2EbjQXLKnQ=
+github.com/miekg/dns v1.1.64/go.mod h1:Dzw9769uoKVaLuODMDZz9M6ynFU6Em65csPuoi8G0ck=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
@@ -113,32 +114,34 @@ github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/nrdcg/porkbun v0.4.0 h1:rWweKlwo1PToQ3H+tEO9gPRW0wzzgmI/Ob3n2Guticw=
+github.com/nrdcg/porkbun v0.4.0/go.mod h1:/QMskrHEIM0IhC/wY7iTCUgINsxdT2WcOphktJ9+Q54=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/ovh/go-ovh v1.6.0 h1:ixLOwxQdzYDx296sXcgS35TOPEahJkpjMGtzPadCjQI=
-github.com/ovh/go-ovh v1.6.0/go.mod h1:cTVDnl94z4tl8pP1uZ/8jlVxntjSIf09bNcQ5TJSC7c=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/ovh/go-ovh v1.7.0 h1:V14nF7FwDjQrZt9g7jzcvAAQ3HN6DNShRFRMC3jLoPw=
+github.com/ovh/go-ovh v1.7.0/go.mod h1:cTVDnl94z4tl8pP1uZ/8jlVxntjSIf09bNcQ5TJSC7c=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
-github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_golang v1.21.1 h1:DOvXXTqVzvkIewV/CDPFdejpMCGeMcbGCQ8YOmu+Ibk=
+github.com/prometheus/client_golang v1.21.1/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/puzpuzpuz/xsync/v3 v3.5.0 h1:i+cMcpEDY1BkNm7lPDkCtE4oElsYLn+EKF8kAu2vXT4=
-github.com/puzpuzpuz/xsync/v3 v3.5.0/go.mod h1:VjzYrABPabuM4KyBh1Ftq6u8nhwY5tBPKP9jpmh0nnA=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
+github.com/prometheus/procfs v0.16.0 h1:xh6oHhKwnOJKMYiYBDWmkHqQPyiY40sny36Cmx2bbsM=
+github.com/prometheus/procfs v0.16.0/go.mod h1:8veyXUu3nGP7oaCxhX6yeaM5u4stL2FeMXnCqhDthZg=
+github.com/puzpuzpuz/xsync/v3 v3.5.1 h1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=
+github.com/puzpuzpuz/xsync/v3 v3.5.1/go.mod h1:VjzYrABPabuM4KyBh1Ftq6u8nhwY5tBPKP9jpmh0nnA=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
-github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8=
-github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -152,20 +155,22 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 h1:CV7UdSGJt/Ao6Gp4CXckLxVRRsRgDHoI8XjbL3PDl8s=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0/go.mod h1:FRmFuRJfag1IZ2dPkHnEoSFVgTVPUd2qf5Vi69hLb8I=
-go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
-go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0 h1:lsInsfvhVIfOI6qHVyysXMNDnjO9Npvl7tlDPJFBVd4=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0/go.mod h1:KQsVNh4OjgjTG0G6EiNi1jVpnaeeKsKMRwbLN+f1+8M=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 h1:umZgi92IyxfXd/l4kaDhnKgY8rnN/cZcF1LKc6I8OQ8=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0/go.mod h1:4lVs6obhSVRb1EW5FhOuBTyiQhtRtAnnva9vD3yRfq8=
-go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
-go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
-go.opentelemetry.io/otel/sdk v1.30.0 h1:cHdik6irO49R5IysVhdn8oaiR9m8XluDaJAs4DfOrYE=
-go.opentelemetry.io/otel/sdk v1.30.0/go.mod h1:p14X4Ok8S+sygzblytT1nqG98QG2KYKv++HE0LY/mhg=
-go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
-go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
 go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -176,8 +181,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -185,8 +190,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -199,10 +204,10 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
-golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
+golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
+golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -211,8 +216,9 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -229,8 +235,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -248,10 +254,11 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -260,8 +267,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
-golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
+golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
+golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -273,8 +280,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
 google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
 google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
-google.golang.org/protobuf v1.36.4 h1:6A3ZDJHn/eNqc1i+IdefRzy/9PokBTPvcqMySR7NNIM=
-google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
--- a/internal/api/v1/auth/oidc_test.go
+++ b/internal/api/v1/auth/oidc_test.go
@@ -14,7 +14,6 @@ import (
 	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/yusing/go-proxy/internal/common"
-	E "github.com/yusing/go-proxy/internal/error"
 	"golang.org/x/oauth2"

 	. "github.com/yusing/go-proxy/internal/utils/testing"
@@ -227,7 +226,7 @@ func TestOIDCCallbackHandler(t *testing.T) {
 			}

 			if tt.wantStatus == http.StatusTemporaryRedirect {
-				setCookie := E.Must(http.ParseSetCookie(w.Header().Get("Set-Cookie")))
+				setCookie := Must(http.ParseSetCookie(w.Header().Get("Set-Cookie")))
 				ExpectEqual(t, setCookie.Name, defaultAuth.TokenCookieName())
 				ExpectTrue(t, setCookie.Value != "")
 				ExpectEqual(t, setCookie.Path, "/")
--- a/internal/api/v1/auth/userpass_test.go
+++ b/internal/api/v1/auth/userpass_test.go
@@ -9,7 +9,6 @@ import (
 	"testing"
 	"time"

-	E "github.com/yusing/go-proxy/internal/error"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 	"golang.org/x/crypto/bcrypt"
 )
@@ -17,7 +16,7 @@ import (
 func newMockUserPassAuth() *UserPassAuth {
 	return &UserPassAuth{
 		username: "username",
-		pwdHash:  E.Must(bcrypt.GenerateFromPassword([]byte("password"), bcrypt.DefaultCost)),
+		pwdHash:  Must(bcrypt.GenerateFromPassword([]byte("password"), bcrypt.DefaultCost)),
 		secret:   []byte("abcdefghijklmnopqrstuvwxyz"),
 		tokenTTL: time.Hour,
 	}
@@ -97,13 +96,13 @@ func TestUserPassLoginCallbackHandler(t *testing.T) {
 		w := httptest.NewRecorder()
 		req := &http.Request{
 			Host: "app.example.com",
-			Body: io.NopCloser(bytes.NewReader(E.Must(json.Marshal(tt.creds)))),
+			Body: io.NopCloser(bytes.NewReader(Must(json.Marshal(tt.creds)))),
 		}
 		auth.LoginCallbackHandler(w, req)
 		if tt.wantErr {
 			ExpectEqual(t, w.Code, http.StatusUnauthorized)
 		} else {
-			setCookie := E.Must(http.ParseSetCookie(w.Header().Get("Set-Cookie")))
+			setCookie := Must(http.ParseSetCookie(w.Header().Get("Set-Cookie")))
 			ExpectTrue(t, setCookie.Name == auth.TokenCookieName())
 			ExpectTrue(t, setCookie.Value != "")
 			ExpectEqual(t, setCookie.Domain, "example.com")
--- a/internal/api/v1/favicon/cache.go
+++ b/internal/api/v1/favicon/cache.go
@@ -29,6 +29,9 @@ const (
 )

 func InitIconCache() {
+	iconCacheMu.Lock()
+	defer iconCacheMu.Unlock()
+
 	err := utils.LoadJSONIfExist(common.IconCachePath, &iconCache)
 	if err != nil {
 		logging.Error().Err(err).Msg("failed to load icon cache")
@@ -78,7 +81,7 @@ func pruneExpiredIconCache() {
 }

 func routeKey(r route.HTTPRoute) string {
-	return r.RawEntry().Provider + ":" + r.TargetName()
+	return r.ProviderName() + ":" + r.TargetName()
 }

 func PruneRouteIconCache(route route.HTTPRoute) {
--- a/internal/api/v1/favicon/favicon.go
+++ b/internal/api/v1/favicon/favicon.go
@@ -19,6 +19,7 @@ import (
 	gphttp "github.com/yusing/go-proxy/internal/net/http"
 	"github.com/yusing/go-proxy/internal/route/routes"
 	route "github.com/yusing/go-proxy/internal/route/types"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

 type fetchResult struct {
@@ -36,9 +37,8 @@ func (res *fetchResult) ContentType() string {
 	if res.contentType == "" {
 		if bytes.HasPrefix(res.icon, []byte("<svg")) || bytes.HasPrefix(res.icon, []byte("<?xml")) {
 			return "image/svg+xml"
-		} else {
-			return "image/x-icon"
 		}
+		return "image/x-icon"
 	}
 	return res.contentType
 }
@@ -87,7 +87,7 @@ func GetFavIcon(w http.ResponseWriter, req *http.Request) {
 	}

 	var result *fetchResult
-	hp := r.RawEntry().Homepage.GetOverride()
+	hp := r.HomepageConfig().GetOverride()
 	if !hp.IsEmpty() && hp.Icon != nil {
 		if hp.Icon.IconSource == homepage.IconSourceRelative {
 			result = findIcon(r, req, hp.Icon.Value)
@@ -189,7 +189,7 @@ func findIcon(r route.HTTPRoute, req *http.Request, uri string) *fetchResult {
 	}

 	result := fetchIcon("png", sanitizeName(r.TargetName()))
-	cont := r.RawEntry().Container
+	cont := r.ContainerInfo()
 	if !result.OK() && cont != nil {
 		result = fetchIcon("png", sanitizeName(cont.ImageName))
 	}
@@ -208,10 +208,7 @@ func findIconSlow(r route.HTTPRoute, req *http.Request, uri string) *fetchResult
 	defer cancel()
 	newReq := req.WithContext(ctx)
 	newReq.Header.Set("Accept-Encoding", "identity") // disable compression
-	if !strings.HasPrefix(uri, "/") {
-		uri = "/" + uri
-	}
-	u, err := url.ParseRequestURI(uri)
+	u, err := url.ParseRequestURI(strutils.SanitizeURI(uri))
 	if err != nil {
 		logging.Error().Err(err).
 			Str("route", r.TargetName()).
@@ -232,11 +229,8 @@ func findIconSlow(r route.HTTPRoute, req *http.Request, uri string) *fetchResult
 			return &fetchResult{statusCode: http.StatusBadGateway, errMsg: "connection error"}
 		default:
 			if loc := c.Header().Get("Location"); loc != "" {
-				loc = path.Clean(loc)
-				if !strings.HasPrefix(loc, "/") {
-					loc = "/" + loc
-				}
-				if loc == newReq.URL.Path {
+				loc = strutils.SanitizeURI(loc)
+				if loc == "/" || loc == newReq.URL.Path {
 					return &fetchResult{statusCode: http.StatusBadGateway, errMsg: "circular redirect"}
 				}
 				return findIconSlow(r, req, loc)
--- a/internal/api/v1/list.go
+++ b/internal/api/v1/list.go
@@ -39,9 +39,9 @@ func List(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {

 	switch what {
 	case ListRoute:
-		if route := listRoute(which); route == nil {
+		route := listRoute(which)
+		if route == nil {
 			http.NotFound(w, r)
-			return
 		} else {
 			U.RespondJSON(w, r, route)
 		}
--- a/internal/autocert/constants.go
+++ b/internal/autocert/constants.go
@@ -5,6 +5,7 @@ import (
 	"github.com/go-acme/lego/v4/providers/dns/cloudflare"
 	"github.com/go-acme/lego/v4/providers/dns/duckdns"
 	"github.com/go-acme/lego/v4/providers/dns/ovh"
+	"github.com/go-acme/lego/v4/providers/dns/porkbun"
 )

 const (
@@ -20,6 +21,7 @@ const (
 	ProviderClouddns   = "clouddns"
 	ProviderDuckdns    = "duckdns"
 	ProviderOVH        = "ovh"
+	ProviderPorkbun    = "porkbun"
 )

 var providersGenMap = map[string]ProviderGenerator{
@@ -28,4 +30,5 @@ var providersGenMap = map[string]ProviderGenerator{
 	ProviderClouddns:   providerGenerator(clouddns.NewDefaultConfig, clouddns.NewDNSProviderConfig),
 	ProviderDuckdns:    providerGenerator(duckdns.NewDefaultConfig, duckdns.NewDNSProviderConfig),
 	ProviderOVH:        providerGenerator(ovh.NewDefaultConfig, ovh.NewDNSProviderConfig),
+	ProviderPorkbun:    providerGenerator(porkbun.NewDefaultConfig, porkbun.NewDNSProviderConfig),
 }
--- a/internal/common/args.go
+++ b/internal/common/args.go
@@ -12,7 +12,6 @@ type Args struct {

 const (
 	CommandStart              = ""
-	CommandSetup              = "setup"
 	CommandValidate           = "validate"
 	CommandListConfigs        = "ls-config"
 	CommandListRoutes         = "ls-routes"
@@ -25,7 +24,6 @@ const (

 var ValidCommands = []string{
 	CommandStart,
-	CommandSetup,
 	CommandValidate,
 	CommandListConfigs,
 	CommandListRoutes,
@@ -36,6 +34,15 @@ var ValidCommands = []string{
 	CommandDebugListMTrace,
 }

+func validateArg(arg string) error {
+	for _, v := range ValidCommands {
+		if arg == v {
+			return nil
+		}
+	}
+	return fmt.Errorf("invalid command %q", arg)
+}
+
 func GetArgs() Args {
 	var args Args
 	flag.Parse()
@@ -45,12 +52,3 @@ func GetArgs() Args {
 	}
 	return args
 }
-
-func validateArg(arg string) error {
-	for _, v := range ValidCommands {
-		if arg == v {
-			return nil
-		}
-	}
-	return fmt.Errorf("invalid command %q", arg)
-}
--- a/internal/config/query.go
+++ b/internal/config/query.go
@@ -1,16 +1,15 @@
 package config

 import (
-	route "github.com/yusing/go-proxy/internal/route"
+	"github.com/yusing/go-proxy/internal/route"
 	"github.com/yusing/go-proxy/internal/route/provider"
-	"github.com/yusing/go-proxy/internal/route/types"
 )

-func (cfg *Config) DumpEntries() map[string]*types.RawEntry {
-	entries := make(map[string]*types.RawEntry)
+func (cfg *Config) DumpRoutes() map[string]*route.Route {
+	entries := make(map[string]*route.Route)
 	cfg.providers.RangeAll(func(_ string, p *provider.Provider) {
 		p.RangeRoutes(func(alias string, r *route.Route) {
-			entries[alias] = r.Entry
+			entries[alias] = r
 		})
 	})
 	return entries
--- a/internal/docker/client.go
+++ b/internal/docker/client.go
@@ -4,14 +4,14 @@ import (
 	"errors"
 	"net/http"
 	"sync"
+	"sync/atomic"
+	"time"

 	"github.com/docker/cli/cli/connhelper"
 	"github.com/docker/docker/client"
-	"github.com/rs/zerolog"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/task"
-	U "github.com/yusing/go-proxy/internal/utils"
 )

 type (
@@ -19,15 +19,14 @@ type (
 		*client.Client

 		key      string
-		refCount *U.RefCount
-
-		l zerolog.Logger
+		refCount uint32
+		closedOn int64
 	}
 )

 var (
 	clientMap   = make(map[string]*SharedClient, 5)
-	clientMapMu sync.Mutex
+	clientMapMu sync.RWMutex

 	clientOptEnvHost = []client.Opt{
 		client.WithHostFromEnv(),
@@ -35,28 +34,61 @@ var (
 	}
 )

+const (
+	cleanInterval = 10 * time.Second
+	clientTTLSecs = int64(10)
+)
+
 func init() {
+	cleaner := task.RootTask("docker_clients_cleaner")
+	go func() {
+		ticker := time.NewTicker(cleanInterval)
+		defer ticker.Stop()
+		defer cleaner.Finish("program exit")
+
+		for {
+			select {
+			case <-ticker.C:
+				closeTimedOutClients()
+			case <-cleaner.Context().Done():
+				return
+			}
+		}
+	}()
+
 	task.OnProgramExit("docker_clients_cleanup", func() {
 		clientMapMu.Lock()
 		defer clientMapMu.Unlock()

 		for _, c := range clientMap {
-			if c.Connected() {
-				c.Client.Close()
-			}
+			delete(clientMap, c.key)
+			c.Client.Close()
 		}
 	})
 }

-func (c *SharedClient) Connected() bool {
-	return c != nil && c.Client != nil
+func closeTimedOutClients() {
+	clientMapMu.Lock()
+	defer clientMapMu.Unlock()
+
+	now := time.Now().Unix()
+
+	for _, c := range clientMap {
+		if c.closedOn == 0 {
+			continue
+		}
+		if c.refCount == 0 && now-c.closedOn > clientTTLSecs {
+			delete(clientMap, c.key)
+			c.Client.Close()
+			logging.Debug().Str("host", c.key).Msg("docker client closed")
+		}
+	}
 }

 // if the client is still referenced, this is no-op.
 func (c *SharedClient) Close() {
-	if c.Connected() {
-		c.refCount.Sub()
-	}
+	atomic.StoreInt64(&c.closedOn, time.Now().Unix())
+	atomic.AddUint32(&c.refCount, ^uint32(0))
 }

 // ConnectClient creates a new Docker client connection to the specified host.
@@ -74,7 +106,8 @@ func ConnectClient(host string) (*SharedClient, error) {
 	defer clientMapMu.Unlock()

 	if client, ok := clientMap[host]; ok {
-		client.refCount.Add()
+		atomic.StoreInt64(&client.closedOn, 0)
+		atomic.AddUint32(&client.refCount, 1)
 		return client, nil
 	}

@@ -119,23 +152,11 @@ func ConnectClient(host string) (*SharedClient, error) {
 	c := &SharedClient{
 		Client:   client,
 		key:      host,
-		refCount: U.NewRefCounter(),
-		l:        logging.With().Str("address", client.DaemonHost()).Logger(),
+		refCount: 1,
 	}
-	c.l.Trace().Msg("client connected")

-	clientMap[host] = c
+	defer logging.Debug().Str("host", host).Msg("docker client connected")

-	go func() {
-		<-c.refCount.Zero()
-		clientMapMu.Lock()
-		delete(clientMap, c.key)
-		clientMapMu.Unlock()
-
-		if c.Connected() {
-			c.Client.Close()
-			c.l.Trace().Msg("client closed")
-		}
-	}()
+	clientMap[c.key] = c
 	return c, nil
 }
--- a/internal/docker/container.go
+++ b/internal/docker/container.go
@@ -12,7 +12,7 @@ import (
 )

 type (
-	PortMapping = map[string]types.Port
+	PortMapping = map[int]types.Port
 	Container   struct {
 		_ U.NoCopy

--- a/internal/docker/container_helper.go
+++ b/internal/docker/container_helper.go
@@ -44,7 +44,7 @@ func (c containerHelper) getPublicPortMapping() PortMapping {
 		if v.PublicPort == 0 {
 			continue
 		}
-		res[strutils.PortString(v.PublicPort)] = v
+		res[int(v.PublicPort)] = v
 	}
 	return res
 }
@@ -52,7 +52,7 @@ func (c containerHelper) getPublicPortMapping() PortMapping {
 func (c containerHelper) getPrivatePortMapping() PortMapping {
 	res := make(PortMapping)
 	for _, v := range c.Ports {
-		res[strutils.PortString(v.PrivatePort)] = v
+		res[int(v.PrivatePort)] = v
 	}
 	return res
 }
@@ -66,14 +66,6 @@ var databaseMPs = map[string]struct{}{
 	"/var/lib/rabbitmq":        {},
 }

-var databasePrivPorts = map[uint16]struct{}{
-	5432:  {}, // postgres
-	3306:  {}, // mysql, mariadb
-	6379:  {}, // redis
-	11211: {}, // memcached
-	27017: {}, // mongodb
-}
-
 func (c containerHelper) isDatabase() bool {
 	for _, m := range c.Mounts {
 		if _, ok := databaseMPs[m.Destination]; ok {
@@ -82,7 +74,9 @@ func (c containerHelper) isDatabase() bool {
 	}

 	for _, v := range c.Ports {
-		if _, ok := databasePrivPorts[v.PrivatePort]; ok {
+		switch v.PrivatePort {
+		// postgres, mysql or mariadb, redis, memcached, mongodb
+		case 5432, 3306, 6379, 11211, 27017:
 			return true
 		}
 	}
--- a/internal/docker/idlewatcher/waker.go
+++ b/internal/docker/idlewatcher/waker.go
@@ -38,32 +38,32 @@ const (

 // TODO: support stream

-func newWaker(parent task.Parent, entry route.Entry, rp *reverseproxy.ReverseProxy, stream net.Stream) (Waker, E.Error) {
-	hcCfg := entry.RawEntry().HealthCheck
+func newWaker(parent task.Parent, route route.Route, rp *reverseproxy.ReverseProxy, stream net.Stream) (Waker, E.Error) {
+	hcCfg := route.HealthCheckConfig()
 	hcCfg.Timeout = idleWakerCheckTimeout

 	waker := &waker{
 		rp:     rp,
 		stream: stream,
 	}
-	task := parent.Subtask("idlewatcher." + entry.TargetName())
-	watcher, err := registerWatcher(task, entry, waker)
+	task := parent.Subtask("idlewatcher." + route.TargetName())
+	watcher, err := registerWatcher(task, route, waker)
 	if err != nil {
 		return nil, E.Errorf("register watcher: %w", err)
 	}

 	switch {
 	case rp != nil:
-		waker.hc = monitor.NewHTTPHealthChecker(entry.TargetURL(), hcCfg)
+		waker.hc = monitor.NewHTTPHealthChecker(route.TargetURL(), hcCfg)
 	case stream != nil:
-		waker.hc = monitor.NewRawHealthChecker(entry.TargetURL(), hcCfg)
+		waker.hc = monitor.NewRawHealthChecker(route.TargetURL(), hcCfg)
 	default:
 		panic("both nil")
 	}

 	if common.PrometheusEnabled {
 		m := metrics.GetServiceMetrics()
-		fqn := parent.Name() + "/" + entry.TargetName()
+		fqn := parent.Name() + "/" + route.TargetName()
 		waker.metric = m.HealthStatus.With(metrics.HealthMetricLabels(fqn))
 		waker.metric.Set(float64(watcher.Status()))
 	}
@@ -71,12 +71,12 @@ func newWaker(parent task.Parent, entry route.Entry, rp *reverseproxy.ReversePro
 }

 // lifetime should follow route provider.
-func NewHTTPWaker(parent task.Parent, entry route.Entry, rp *reverseproxy.ReverseProxy) (Waker, E.Error) {
-	return newWaker(parent, entry, rp, nil)
+func NewHTTPWaker(parent task.Parent, route route.Route, rp *reverseproxy.ReverseProxy) (Waker, E.Error) {
+	return newWaker(parent, route, rp, nil)
 }

-func NewStreamWaker(parent task.Parent, entry route.Entry, stream net.Stream) (Waker, E.Error) {
-	return newWaker(parent, entry, nil, stream)
+func NewStreamWaker(parent task.Parent, route route.Route, stream net.Stream) (Waker, E.Error) {
+	return newWaker(parent, route, nil, stream)
 }

 // Start implements health.HealthMonitor.
@@ -155,7 +155,7 @@ func (w *Watcher) getStatusUpdateReady() health.Status {

 // MarshalJSON implements health.HealthMonitor.
 func (w *Watcher) MarshalJSON() ([]byte, error) {
-	var url net.URL
+	var url *net.URL
 	if w.hc.URL().Port() != "0" {
 		url = w.hc.URL()
 	}
--- a/internal/docker/idlewatcher/watcher.go
+++ b/internal/docker/idlewatcher/watcher.go
@@ -50,8 +50,8 @@ var (

 const dockerReqTimeout = 3 * time.Second

-func registerWatcher(watcherTask *task.Task, entry route.Entry, waker *waker) (*Watcher, error) {
-	cfg := entry.IdlewatcherConfig()
+func registerWatcher(watcherTask *task.Task, route route.Route, waker *waker) (*Watcher, error) {
+	cfg := route.IdlewatcherConfig()

 	if cfg.IdleTimeout == 0 {
 		panic(errShouldNotReachHere)
@@ -146,9 +146,6 @@ func (w *Watcher) containerStart(ctx context.Context) error {
 }

 func (w *Watcher) containerStatus() (string, error) {
-	if !w.client.Connected() {
-		return "", errors.New("docker client not connected")
-	}
 	ctx, cancel := context.WithTimeoutCause(w.task.Context(), dockerReqTimeout, errors.New("docker request timeout"))
 	defer cancel()
 	json, err := w.client.ContainerInspect(ctx, w.ContainerID)
@@ -242,7 +239,7 @@ func (w *Watcher) getEventCh(dockerWatcher watcher.DockerWatcher) (eventCh <-cha
 // it exits only if the context is canceled, the container is destroyed,
 // errors occurred on docker client, or route provider died (mainly caused by config reload).
 func (w *Watcher) watchUntilDestroy() (returnCause error) {
-	dockerWatcher := watcher.NewDockerWatcherWithClient(w.client)
+	dockerWatcher := watcher.NewDockerWatcher(w.client.DaemonHost())
 	dockerEventCh, dockerEventErrCh := w.getEventCh(dockerWatcher)

 	for {
--- a/internal/entrypoint/entrypoint_test.go
+++ b/internal/entrypoint/entrypoint_test.go
@@ -9,7 +9,7 @@ import (
 )

 var (
-	r  route.HTTPRoute
+	r  route.ReveseProxyRoute
 	ep = NewEntrypoint()
 )

--- a/internal/error/utils.go
+++ b/internal/error/utils.go
@@ -40,13 +40,6 @@ func From(err error) Error {
 	return &baseError{err}
 }

-func Must[T any](v T, err error) T {
-	if err != nil {
-		LogPanic("must failed", err)
-	}
-	return v
-}
-
 func Join(errors ...error) Error {
 	n := 0
 	for _, err := range errors {
--- a/internal/homepage/override_config.go
+++ b/internal/homepage/override_config.go
@@ -17,15 +17,17 @@ type OverrideConfig struct {
 	mu             sync.RWMutex
 }

-var overrideConfigInstance *OverrideConfig
+var overrideConfigInstance = &OverrideConfig{
+	ItemOverrides:  make(map[string]*ItemConfig),
+	DisplayOrder:   make(map[string]int),
+	CategoryOrder:  make(map[string]int),
+	ItemVisibility: make(map[string]bool),
+}

 func InitOverridesConfig() {
-	overrideConfigInstance = &OverrideConfig{
-		ItemOverrides:  make(map[string]*ItemConfig),
-		DisplayOrder:   make(map[string]int),
-		CategoryOrder:  make(map[string]int),
-		ItemVisibility: make(map[string]bool),
-	}
+	overrideConfigInstance.mu.Lock()
+	defer overrideConfigInstance.mu.Unlock()
+
 	err := utils.LoadJSONIfExist(common.HomepageJSONConfigPath, overrideConfigInstance)
 	if err != nil {
 		logging.Error().Err(err).Msg("failed to load homepage overrides config")
--- a/internal/list-icons.go
+++ b/internal/list-icons.go
@@ -52,6 +52,9 @@ const (
 )

 func InitIconListCache() {
+	iconsCahceMu.Lock()
+	defer iconsCahceMu.Unlock()
+
 	iconsCache = &Cache{
 		WalkxCode:    make(IconsMap),
 		Selfhst:      make(IconsMap),
--- a/internal/net/http/accesslog/access_logger_test.go
+++ b/internal/net/http/accesslog/access_logger_test.go
@@ -9,7 +9,6 @@ import (
 	"testing"
 	"time"

-	E "github.com/yusing/go-proxy/internal/error"
 	. "github.com/yusing/go-proxy/internal/net/http/accesslog"
 	"github.com/yusing/go-proxy/internal/task"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
@@ -30,7 +29,7 @@ const (

 var (
 	testTask = task.RootTask("test", false)
-	testURL  = E.Must(url.Parse("http://" + host + uri))
+	testURL  = Must(url.Parse("http://" + host + uri))
 	req      = &http.Request{
 		RemoteAddr: remote,
 		Method:     method,
--- a/internal/net/http/loadbalancer/types/server.go
+++ b/internal/net/http/loadbalancer/types/server.go
@@ -4,7 +4,7 @@ import (
 	"net/http"

 	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
-	"github.com/yusing/go-proxy/internal/net/types"
+	net "github.com/yusing/go-proxy/internal/net/types"
 	U "github.com/yusing/go-proxy/internal/utils"
 	F "github.com/yusing/go-proxy/internal/utils/functional"
 	"github.com/yusing/go-proxy/internal/watcher/health"
@@ -15,7 +15,7 @@ type (
 		_ U.NoCopy

 		name   string
-		url    types.URL
+		url    *net.URL
 		weight Weight

 		http.Handler `json:"-"`
@@ -26,7 +26,7 @@ type (
 		http.Handler
 		health.HealthMonitor
 		Name() string
-		URL() types.URL
+		URL() *net.URL
 		Weight() Weight
 		SetWeight(weight Weight)
 		TryWake() error
@@ -37,7 +37,7 @@ type (

 var NewServerPool = F.NewMap[Pool]

-func NewServer(name string, url types.URL, weight Weight, handler http.Handler, healthMon health.HealthMonitor) Server {
+func NewServer(name string, url *net.URL, weight Weight, handler http.Handler, healthMon health.HealthMonitor) Server {
 	srv := &server{
 		name:          name,
 		url:           url,
@@ -59,7 +59,7 @@ func (srv *server) Name() string {
 	return srv.name
 }

-func (srv *server) URL() types.URL {
+func (srv *server) URL() *net.URL {
 	return srv.url
 }

--- a/internal/net/http/middleware/cloudflare_real_ip.go
+++ b/internal/net/http/middleware/cloudflare_real_ip.go
@@ -30,6 +30,14 @@ const (
 var (
 	cfCIDRsLastUpdate time.Time
 	cfCIDRsMu         sync.Mutex
+
+	// RFC 1918.
+	localCIDRs = []*types.CIDR{
+		{IP: net.IPv4(127, 0, 0, 1), Mask: net.IPv4Mask(255, 255, 255, 255)}, // 127.0.0.1/32
+		{IP: net.IPv4(10, 0, 0, 0), Mask: net.IPv4Mask(255, 0, 0, 0)},        // 10.0.0.0/8
+		{IP: net.IPv4(172, 16, 0, 0), Mask: net.IPv4Mask(255, 240, 0, 0)},    // 172.16.0.0/12
+		{IP: net.IPv4(192, 168, 0, 0), Mask: net.IPv4Mask(255, 255, 0, 0)},   // 192.168.0.0/16
+	}
 )

 var CloudflareRealIP = NewMiddleware[cloudflareRealIP]()
@@ -37,7 +45,7 @@ var CloudflareRealIP = NewMiddleware[cloudflareRealIP]()
 // setup implements MiddlewareWithSetup.
 func (cri *cloudflareRealIP) setup() {
 	cri.realIP.RealIPOpts = RealIPOpts{
-		Header:    "Cf-Connecting-Ip",
+		Header:    "CF-Connecting-IP",
 		Recursive: cri.Recursive,
 	}
 }
@@ -72,12 +80,7 @@ func tryFetchCFCIDR() (cfCIDRs []*types.CIDR) {
 	}

 	if common.IsTest {
-		cfCIDRs = []*types.CIDR{
-			{IP: net.IPv4(127, 0, 0, 1), Mask: net.IPv4Mask(255, 0, 0, 0)},
-			{IP: net.IPv4(10, 0, 0, 0), Mask: net.IPv4Mask(255, 0, 0, 0)},
-			{IP: net.IPv4(172, 16, 0, 0), Mask: net.IPv4Mask(255, 255, 0, 0)},
-			{IP: net.IPv4(192, 168, 0, 0), Mask: net.IPv4Mask(255, 255, 255, 0)},
-		}
+		cfCIDRs = localCIDRs
 	} else {
 		cfCIDRs = make([]*types.CIDR, 0, 30)
 		err := errors.Join(
@@ -122,6 +125,6 @@ func fetchUpdateCFIPRange(endpoint string, cfCIDRs *[]*types.CIDR) error {

 		*cfCIDRs = append(*cfCIDRs, (*types.CIDR)(cidr))
 	}
-
+	*cfCIDRs = append(*cfCIDRs, localCIDRs...)
 	return nil
 }
--- a/internal/net/http/middleware/metrics_logger/metrics_logger.go
+++ b/internal/net/http/middleware/metrics_logger/metrics_logger.go
@@ -0,0 +1,44 @@
+package metricslogger
+
+import (
+	"net"
+	"net/http"
+
+	"github.com/yusing/go-proxy/internal/metrics"
+)
+
+type MetricsLogger struct {
+	ServiceName string `json:"service_name"`
+}
+
+func NewMetricsLogger(serviceName string) *MetricsLogger {
+	return &MetricsLogger{serviceName}
+}
+
+func (m *MetricsLogger) GetHandler(next http.Handler) http.HandlerFunc {
+	return func(rw http.ResponseWriter, req *http.Request) {
+		m.ServeHTTP(rw, req, next.ServeHTTP)
+	}
+}
+
+func (m *MetricsLogger) ServeHTTP(rw http.ResponseWriter, req *http.Request, next http.HandlerFunc) {
+	visitorIP, _, err := net.SplitHostPort(req.RemoteAddr)
+	if err != nil {
+		visitorIP = req.RemoteAddr
+	}
+
+	// req.RemoteAddr had been modified by middleware (if any)
+	lbls := &metrics.HTTPRouteMetricLabels{
+		Service: m.ServiceName,
+		Method:  req.Method,
+		Host:    req.Host,
+		Visitor: visitorIP,
+		Path:    req.URL.Path,
+	}
+
+	next.ServeHTTP(newHTTPMetricLogger(rw, lbls), req)
+}
+
+func (m *MetricsLogger) ResetMetrics() {
+	metrics.GetRouteMetrics().UnregisterService(m.ServiceName)
+}
--- a/internal/net/http/middleware/metrics_logger/metrics_response_writer.go
+++ b/internal/net/http/middleware/metrics_logger/metrics_response_writer.go
@@ -0,0 +1,47 @@
+package metricslogger
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/metrics"
+)
+
+type httpMetricLogger struct {
+	http.ResponseWriter
+	timestamp time.Time
+	labels    *metrics.HTTPRouteMetricLabels
+}
+
+// WriteHeader implements http.ResponseWriter.
+func (l *httpMetricLogger) WriteHeader(status int) {
+	l.ResponseWriter.WriteHeader(status)
+	duration := time.Since(l.timestamp)
+	go func() {
+		m := metrics.GetRouteMetrics()
+		m.HTTPReqTotal.Inc()
+		m.HTTPReqElapsed.With(l.labels).Set(float64(duration.Milliseconds()))
+
+		// ignore 1xx
+		switch {
+		case status >= 500:
+			m.HTTP5xx.With(l.labels).Inc()
+		case status >= 400:
+			m.HTTP4xx.With(l.labels).Inc()
+		case status >= 200:
+			m.HTTP2xx3xx.With(l.labels).Inc()
+		}
+	}()
+}
+
+func (l *httpMetricLogger) Unwrap() http.ResponseWriter {
+	return l.ResponseWriter
+}
+
+func newHTTPMetricLogger(w http.ResponseWriter, labels *metrics.HTTPRouteMetricLabels) *httpMetricLogger {
+	return &httpMetricLogger{
+		ResponseWriter: w,
+		timestamp:      time.Now(),
+		labels:         labels,
+	}
+}
--- a/internal/net/http/middleware/middleware.go
+++ b/internal/net/http/middleware/middleware.go
@@ -196,34 +196,6 @@ func (m *Middleware) ServeHTTP(next http.HandlerFunc, w http.ResponseWriter, r *
 	next(w, r)
 }

-// TODO: check conflict or duplicates.
-func compileMiddlewares(middlewaresMap map[string]OptionsRaw) ([]*Middleware, E.Error) {
-	middlewares := make([]*Middleware, 0, len(middlewaresMap))
-
-	errs := E.NewBuilder("middlewares compile error")
-	invalidOpts := E.NewBuilder("options compile error")
-
-	for name, opts := range middlewaresMap {
-		m, err := Get(name)
-		if err != nil {
-			errs.Add(err)
-			continue
-		}
-
-		m, err = m.New(opts)
-		if err != nil {
-			invalidOpts.Add(err.Subject(name))
-			continue
-		}
-		middlewares = append(middlewares, m)
-	}
-
-	if invalidOpts.HasError() {
-		errs.Add(invalidOpts.Error())
-	}
-	return middlewares, errs.Error()
-}
-
 func PatchReverseProxy(rp *ReverseProxy, middlewaresMap map[string]OptionsRaw) (err E.Error) {
 	var middlewares []*Middleware
 	middlewares, err = compileMiddlewares(middlewaresMap)
--- a/internal/net/http/middleware/middleware_builder.go
+++ b/internal/net/http/middleware/middleware_builder.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"sort"

 	E "github.com/yusing/go-proxy/internal/error"
 	"gopkg.in/yaml.v3"
@@ -39,6 +40,43 @@ func BuildMiddlewaresFromYAML(source string, data []byte, eb *E.Builder) map[str
 	return middlewares
 }

+func compileMiddlewares(middlewaresMap map[string]OptionsRaw) ([]*Middleware, E.Error) {
+	middlewares := make([]*Middleware, 0, len(middlewaresMap))
+
+	errs := E.NewBuilder("middlewares compile error")
+	invalidOpts := E.NewBuilder("options compile error")
+
+	for name, opts := range middlewaresMap {
+		m, err := Get(name)
+		if err != nil {
+			errs.Add(err)
+			continue
+		}
+
+		m, err = m.New(opts)
+		if err != nil {
+			invalidOpts.Add(err.Subject(name))
+			continue
+		}
+		middlewares = append(middlewares, m)
+	}
+
+	if invalidOpts.HasError() {
+		errs.Add(invalidOpts.Error())
+	}
+	sort.Sort(ByPriority(middlewares))
+	return middlewares, errs.Error()
+}
+
+func BuildMiddlewareFromMap(name string, middlewaresMap map[string]OptionsRaw) (*Middleware, E.Error) {
+	compiled, err := compileMiddlewares(middlewaresMap)
+	if err != nil {
+		return nil, err
+	}
+	return NewMiddlewareChain(name, compiled), nil
+}
+
+// TODO: check conflict or duplicates.
 func BuildMiddlewareFromChainRaw(name string, defs []map[string]any) (*Middleware, E.Error) {
 	chainErr := E.NewBuilder("")
 	chain := make([]*Middleware, 0, len(defs))
--- a/internal/net/http/middleware/middleware_builder_test.go
+++ b/internal/net/http/middleware/middleware_builder_test.go
@@ -16,7 +16,7 @@ func TestBuild(t *testing.T) {
 	errs := E.NewBuilder("")
 	middlewares := BuildMiddlewaresFromYAML("", testMiddlewareCompose, errs)
 	ExpectNoError(t, errs.Error())
-	E.Must(json.MarshalIndent(middlewares, "", "  "))
+	Must(json.MarshalIndent(middlewares, "", "  "))
 	// t.Log(string(data))
 	// TODO: test
 }
--- a/internal/net/http/middleware/redirect_http.go
+++ b/internal/net/http/middleware/redirect_http.go
@@ -1,6 +1,7 @@
 package middleware

 import (
+	"net"
 	"net/http"
 	"strings"

@@ -8,22 +9,43 @@ import (
 	"github.com/yusing/go-proxy/internal/logging"
 )

-type redirectHTTP struct{}
+type redirectHTTP struct {
+	Bypass struct {
+		UserAgents []string
+	}
+}

 var RedirectHTTP = NewMiddleware[redirectHTTP]()

 // before implements RequestModifier.
-func (redirectHTTP) before(w http.ResponseWriter, r *http.Request) (proceed bool) {
+func (m *redirectHTTP) before(w http.ResponseWriter, r *http.Request) (proceed bool) {
 	if r.TLS != nil {
 		return true
 	}
-	r.URL.Scheme = "https"
-	host := r.Host
-	if i := strings.Index(host, ":"); i != -1 {
-		host = host[:i] // strip port number if present
+
+	if len(m.Bypass.UserAgents) > 0 {
+		ua := r.UserAgent()
+		for _, uaBypass := range m.Bypass.UserAgents {
+			if strings.Contains(ua, uaBypass) {
+				return true
+			}
+		}
 	}
-	r.URL.Host = host + ":" + common.ProxyHTTPSPort
-	logging.Debug().Str("url", r.URL.String()).Msg("redirect to https")
-	http.Redirect(w, r, r.URL.String(), http.StatusTemporaryRedirect)
-	return true
+
+	r.URL.Scheme = "https"
+	host, _, err := net.SplitHostPort(r.Host)
+	if err != nil {
+		host = r.Host
+	}
+
+	if common.ProxyHTTPSPort != "443" {
+		r.URL.Host = host + ":" + common.ProxyHTTPSPort
+	} else {
+		r.URL.Host = host
+	}
+
+	http.Redirect(w, r, r.URL.String(), http.StatusMovedPermanently)
+
+	logging.Debug().Str("url", r.URL.String()).Str("user_agent", r.UserAgent()).Msg("redirect to https")
+	return false
 }
--- a/internal/net/http/middleware/redirect_http_test.go
+++ b/internal/net/http/middleware/redirect_http_test.go
@@ -4,7 +4,6 @@ import (
 	"net/http"
 	"testing"

-	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/net/types"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )
@@ -14,8 +13,8 @@ func TestRedirectToHTTPs(t *testing.T) {
 		reqURL: types.MustParseURL("http://example.com"),
 	})
 	ExpectNoError(t, err)
-	ExpectEqual(t, result.ResponseStatus, http.StatusTemporaryRedirect)
-	ExpectEqual(t, result.ResponseHeaders.Get("Location"), "https://example.com:"+common.ProxyHTTPSPort)
+	ExpectEqual(t, result.ResponseStatus, http.StatusMovedPermanently)
+	ExpectEqual(t, result.ResponseHeaders.Get("Location"), "https://example.com")
 }

 func TestNoRedirect(t *testing.T) {
--- a/internal/net/http/middleware/test_utils.go
+++ b/internal/net/http/middleware/test_utils.go
@@ -12,6 +12,7 @@ import (
 	E "github.com/yusing/go-proxy/internal/error"
 	"github.com/yusing/go-proxy/internal/net/http/reverseproxy"
 	"github.com/yusing/go-proxy/internal/net/types"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
 )

 //go:embed test_data/sample_headers.json
@@ -79,11 +80,11 @@ type TestResult struct {

 type testArgs struct {
 	middlewareOpt OptionsRaw
-	upstreamURL   types.URL
+	upstreamURL   *types.URL

 	realRoundTrip bool

-	reqURL    types.URL
+	reqURL    *types.URL
 	reqMethod string
 	headers   http.Header
 	body      []byte
@@ -94,14 +95,14 @@ type testArgs struct {
 }

 func (args *testArgs) setDefaults() {
-	if args.reqURL.Nil() {
-		args.reqURL = E.Must(types.ParseURL("https://example.com"))
+	if args.reqURL == nil {
+		args.reqURL = Must(types.ParseURL("https://example.com"))
 	}
 	if args.reqMethod == "" {
 		args.reqMethod = http.MethodGet
 	}
-	if args.upstreamURL.Nil() {
-		args.upstreamURL = E.Must(types.ParseURL("https://10.0.0.1:8443")) // dummy url, no actual effect
+	if args.upstreamURL == nil {
+		args.upstreamURL = Must(types.ParseURL("https://10.0.0.1:8443")) // dummy url, no actual effect
 	}
 	if args.respHeaders == nil {
 		args.respHeaders = http.Header{}
--- a/internal/net/http/reverseproxy/reverse_proxy_mod.go
+++ b/internal/net/http/reverseproxy/reverse_proxy_mod.go
@@ -23,12 +23,9 @@ import (
 	"net/url"
 	"strings"
 	"sync"
-	"time"

 	"github.com/rs/zerolog"
-	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/logging"
-	"github.com/yusing/go-proxy/internal/metrics"
 	gphttp "github.com/yusing/go-proxy/internal/net/http"
 	"github.com/yusing/go-proxy/internal/net/http/accesslog"
 	"github.com/yusing/go-proxy/internal/net/types"
@@ -96,38 +93,7 @@ type ReverseProxy struct {
 	HandlerFunc http.HandlerFunc

 	TargetName string
-	TargetURL  types.URL
-}
-
-type httpMetricLogger struct {
-	http.ResponseWriter
-	timestamp time.Time
-	labels    *metrics.HTTPRouteMetricLabels
-}
-
-// WriteHeader implements http.ResponseWriter.
-func (l *httpMetricLogger) WriteHeader(status int) {
-	l.ResponseWriter.WriteHeader(status)
-	duration := time.Since(l.timestamp)
-	go func() {
-		m := metrics.GetRouteMetrics()
-		m.HTTPReqTotal.Inc()
-		m.HTTPReqElapsed.With(l.labels).Set(float64(duration.Milliseconds()))
-
-		// ignore 1xx
-		switch {
-		case status >= 500:
-			m.HTTP5xx.With(l.labels).Inc()
-		case status >= 400:
-			m.HTTP4xx.With(l.labels).Inc()
-		case status >= 200:
-			m.HTTP2xx3xx.With(l.labels).Inc()
-		}
-	}()
-}
-
-func (l *httpMetricLogger) Unwrap() http.ResponseWriter {
-	return l.ResponseWriter
+	TargetURL  *types.URL
 }

 func singleJoiningSlash(a, b string) string {
@@ -167,7 +133,7 @@ func joinURLPath(a, b *url.URL) (path, rawpath string) {
 // URLs to the scheme, host, and base path provided in target. If the
 // target's path is "/base" and the incoming request was for "/dir",
 // the target request will be for /base/dir.
-func NewReverseProxy(name string, target types.URL, transport http.RoundTripper) *ReverseProxy {
+func NewReverseProxy(name string, target *types.URL, transport http.RoundTripper) *ReverseProxy {
 	if transport == nil {
 		panic("nil transport")
 	}
@@ -181,15 +147,11 @@ func NewReverseProxy(name string, target types.URL, transport http.RoundTripper)
 	return rp
 }

-func (p *ReverseProxy) UnregisterMetrics() {
-	metrics.GetRouteMetrics().UnregisterService(p.TargetName)
-}
-
 func (p *ReverseProxy) rewriteRequestURL(req *http.Request) {
 	targetQuery := p.TargetURL.RawQuery
 	req.URL.Scheme = p.TargetURL.Scheme
 	req.URL.Host = p.TargetURL.Host
-	req.URL.Path, req.URL.RawPath = joinURLPath(p.TargetURL.URL, req.URL)
+	req.URL.Path, req.URL.RawPath = joinURLPath(&p.TargetURL.URL, req.URL)
 	if targetQuery == "" || req.URL.RawQuery == "" {
 		req.URL.RawQuery = targetQuery + req.URL.RawQuery
 	} else {
@@ -255,28 +217,6 @@ func (p *ReverseProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 }

 func (p *ReverseProxy) handler(rw http.ResponseWriter, req *http.Request) {
-	visitorIP, _, err := net.SplitHostPort(req.RemoteAddr)
-	if err != nil {
-		visitorIP = req.RemoteAddr
-	}
-
-	if common.PrometheusEnabled {
-		t := time.Now()
-		// req.RemoteAddr had been modified by middleware (if any)
-		lbls := &metrics.HTTPRouteMetricLabels{
-			Service: p.TargetName,
-			Method:  req.Method,
-			Host:    req.Host,
-			Visitor: visitorIP,
-			Path:    req.URL.Path,
-		}
-		rw = &httpMetricLogger{
-			ResponseWriter: rw,
-			timestamp:      t,
-			labels:         lbls,
-		}
-	}
-
 	transport := p.Transport

 	ctx := req.Context()
@@ -360,7 +300,11 @@ func (p *ReverseProxy) handler(rw http.ResponseWriter, req *http.Request) {
 	// separated list and fold multiple headers into one.
 	prior, ok := outreq.Header[gphttp.HeaderXForwardedFor]
 	omit := ok && prior == nil // Issue 38079: nil now means don't populate the header
-	xff := visitorIP
+
+	xff, _, err := net.SplitHostPort(req.RemoteAddr)
+	if err != nil {
+		xff = req.RemoteAddr
+	}
 	if len(prior) > 0 {
 		xff = strings.Join(prior, ", ") + ", " + xff
 	}
--- a/internal/net/types/url.go
+++ b/internal/net/types/url.go
@@ -2,13 +2,16 @@ package types

 import (
 	urlPkg "net/url"
+
+	"github.com/yusing/go-proxy/internal/utils"
 )

 type URL struct {
-	*urlPkg.URL
+	_ utils.NoCopy
+	urlPkg.URL
 }

-func MustParseURL(url string) URL {
+func MustParseURL(url string) *URL {
 	u, err := ParseURL(url)
 	if err != nil {
 		panic(err)
@@ -16,40 +19,38 @@ func MustParseURL(url string) URL {
 	return u
 }

-func ParseURL(url string) (URL, error) {
-	u, err := urlPkg.Parse(url)
+func ParseURL(url string) (*URL, error) {
+	u := &URL{}
+	return u, u.Parse(url)
+}
+
+func NewURL(url *urlPkg.URL) *URL {
+	return &URL{URL: *url}
+}
+
+func (u *URL) Parse(url string) error {
+	uu, err := urlPkg.Parse(url)
 	if err != nil {
-		return URL{}, err
+		return err
 	}
-	return URL{URL: u}, nil
+	u.URL = *uu
+	return nil
 }

-func NewURL(url *urlPkg.URL) URL {
-	return URL{url}
-}
-
-func (u URL) Nil() bool {
-	return u.URL == nil
-}
-
-func (u URL) String() string {
-	if u.URL == nil {
+func (u *URL) String() string {
+	if u == nil {
 		return "nil"
 	}
 	return u.URL.String()
 }

-func (u URL) MarshalJSON() (text []byte, err error) {
-	if u.URL == nil {
+func (u *URL) MarshalJSON() (text []byte, err error) {
+	if u == nil {
 		return []byte("null"), nil
 	}
 	return []byte("\"" + u.URL.String() + "\""), nil
 }

-func (u URL) Equals(other *URL) bool {
-	return u.URL == other.URL || u.String() == other.String()
-}
-
-func (u URL) JoinPath(path string) URL {
-	return URL{u.URL.JoinPath(path)}
+func (u *URL) Equals(other *URL) bool {
+	return u.String() == other.String()
 }
--- a/internal/notif/dispatcher.go
+++ b/internal/notif/dispatcher.go
@@ -83,6 +83,9 @@ func (disp *Dispatcher) start() {
 }

 func (disp *Dispatcher) dispatch(msg *LogMessage) {
+	if true {
+		return
+	}
 	task := disp.task.Subtask("dispatcher")
 	defer task.Finish("notif dispatched")

--- a/internal/route/entry/entry.go
+++ b/internal/route/entry/entry.go
@@ -1,62 +0,0 @@
-package entry
-
-import (
-	E "github.com/yusing/go-proxy/internal/error"
-	route "github.com/yusing/go-proxy/internal/route/types"
-)
-
-type Entry = route.Entry
-
-func ValidateEntry(m *route.RawEntry) (Entry, E.Error) {
-	scheme, err := route.NewScheme(m.Scheme)
-	if err != nil {
-		return nil, E.From(err)
-	}
-
-	var entry Entry
-	errs := E.NewBuilder("entry validation failed")
-	if scheme.IsStream() {
-		entry = validateStreamEntry(m, errs)
-	} else {
-		entry = validateRPEntry(m, scheme, errs)
-	}
-	if errs.HasError() {
-		return nil, errs.Error()
-	}
-	if !UseHealthCheck(entry) && (UseLoadBalance(entry) || UseIdleWatcher(entry)) {
-		return nil, E.New("healthCheck.disable cannot be true when loadbalancer or idlewatcher is enabled")
-	}
-	return entry, nil
-}
-
-func IsDocker(entry Entry) bool {
-	iw := entry.IdlewatcherConfig()
-	return iw != nil && iw.ContainerID != ""
-}
-
-func IsZeroPort(entry Entry) bool {
-	return entry.TargetURL().Port() == "0"
-}
-
-func ShouldNotServe(entry Entry) bool {
-	return IsZeroPort(entry) && !UseIdleWatcher(entry)
-}
-
-func UseLoadBalance(entry Entry) bool {
-	lb := entry.RawEntry().LoadBalance
-	return lb != nil && lb.Link != ""
-}
-
-func UseIdleWatcher(entry Entry) bool {
-	iw := entry.IdlewatcherConfig()
-	return iw != nil && iw.IdleTimeout > 0
-}
-
-func UseHealthCheck(entry Entry) bool {
-	hc := entry.RawEntry().HealthCheck
-	return hc != nil && !hc.Disable
-}
-
-func UseAccessLog(entry Entry) bool {
-	return entry.RawEntry().AccessLog != nil
-}
--- a/internal/route/entry/reverse_proxy.go
+++ b/internal/route/entry/reverse_proxy.go
@@ -1,61 +0,0 @@
-package entry
-
-import (
-	"fmt"
-	"net/url"
-
-	"github.com/yusing/go-proxy/internal/docker"
-	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
-	E "github.com/yusing/go-proxy/internal/error"
-	net "github.com/yusing/go-proxy/internal/net/types"
-	route "github.com/yusing/go-proxy/internal/route/types"
-)
-
-type ReverseProxyEntry struct { // real model after validation
-	Raw *route.RawEntry `json:"raw"`
-	URL net.URL         `json:"url"`
-
-	/* Docker only */
-	Idlewatcher *idlewatcher.Config `json:"idlewatcher,omitempty"`
-}
-
-func (rp *ReverseProxyEntry) TargetName() string {
-	return rp.Raw.Alias
-}
-
-func (rp *ReverseProxyEntry) TargetURL() net.URL {
-	return rp.URL
-}
-
-func (rp *ReverseProxyEntry) RawEntry() *route.RawEntry {
-	return rp.Raw
-}
-
-func (rp *ReverseProxyEntry) IdlewatcherConfig() *idlewatcher.Config {
-	return rp.Idlewatcher
-}
-
-func validateRPEntry(m *route.RawEntry, s route.Scheme, errs *E.Builder) *ReverseProxyEntry {
-	cont := m.Container
-	if cont == nil {
-		cont = docker.DummyContainer
-	}
-
-	if m.LoadBalance != nil && m.LoadBalance.Link == "" {
-		m.LoadBalance = nil
-	}
-
-	port := E.Collect(errs, route.ValidatePort, m.Port)
-	url := E.Collect(errs, url.Parse, fmt.Sprintf("%s://%s:%d", s, m.Host, port))
-	iwCfg := E.Collect(errs, idlewatcher.ValidateConfig, cont)
-
-	if errs.HasError() {
-		return nil
-	}
-
-	return &ReverseProxyEntry{
-		Raw:         m,
-		URL:         net.NewURL(url),
-		Idlewatcher: iwCfg,
-	}
-}
--- a/internal/route/entry/stream.go
+++ b/internal/route/entry/stream.go
@@ -1,65 +0,0 @@
-package entry
-
-import (
-	"fmt"
-
-	"github.com/yusing/go-proxy/internal/docker"
-	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
-	E "github.com/yusing/go-proxy/internal/error"
-	net "github.com/yusing/go-proxy/internal/net/types"
-	route "github.com/yusing/go-proxy/internal/route/types"
-)
-
-type StreamEntry struct {
-	Raw *route.RawEntry `json:"raw"`
-
-	Scheme    route.StreamScheme `json:"scheme"`
-	URL       net.URL            `json:"url"`
-	ListenURL net.URL            `json:"listening_url"`
-	Port      route.StreamPort   `json:"port,omitempty"`
-
-	/* Docker only */
-	Idlewatcher *idlewatcher.Config `json:"idlewatcher,omitempty"`
-}
-
-func (s *StreamEntry) TargetName() string {
-	return s.Raw.Alias
-}
-
-func (s *StreamEntry) TargetURL() net.URL {
-	return s.URL
-}
-
-func (s *StreamEntry) RawEntry() *route.RawEntry {
-	return s.Raw
-}
-
-func (s *StreamEntry) IdlewatcherConfig() *idlewatcher.Config {
-	return s.Idlewatcher
-}
-
-func validateStreamEntry(m *route.RawEntry, errs *E.Builder) *StreamEntry {
-	cont := m.Container
-	if cont == nil {
-		cont = docker.DummyContainer
-	}
-
-	port := E.Collect(errs, route.ValidateStreamPort, m.Port)
-	scheme := E.Collect(errs, route.ValidateStreamScheme, m.Scheme)
-	url := E.Collect(errs, net.ParseURL, fmt.Sprintf("%s://%s:%d", scheme.ProxyScheme, m.Host, port.ProxyPort))
-	listenURL := E.Collect(errs, net.ParseURL, fmt.Sprintf("%s://:%d", scheme.ListeningScheme, port.ListeningPort))
-	idleWatcherCfg := E.Collect(errs, idlewatcher.ValidateConfig, cont)
-
-	if errs.HasError() {
-		return nil
-	}
-
-	return &StreamEntry{
-		Raw:         m,
-		Scheme:      *scheme,
-		URL:         url,
-		ListenURL:   listenURL,
-		Port:        port,
-		Idlewatcher: idleWatcherCfg,
-	}
-}
--- a/internal/route/fileserver.go
+++ b/internal/route/fileserver.go
@@ -0,0 +1,134 @@
+package route
+
+import (
+	"net/http"
+	"path"
+	"path/filepath"
+
+	"github.com/yusing/go-proxy/internal/common"
+	gphttp "github.com/yusing/go-proxy/internal/net/http"
+	"github.com/yusing/go-proxy/internal/net/http/accesslog"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
+	metricslogger "github.com/yusing/go-proxy/internal/net/http/middleware/metrics_logger"
+	"github.com/yusing/go-proxy/internal/route/routes"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
+
+	E "github.com/yusing/go-proxy/internal/error"
+)
+
+type (
+	FileServer struct {
+		*Route
+
+		Health *monitor.FileServerHealthMonitor `json:"health"`
+
+		task         *task.Task
+		middleware   *middleware.Middleware
+		handler      http.Handler
+		accessLogger *accesslog.AccessLogger
+	}
+)
+
+func handler(root string) http.Handler {
+	return http.FileServer(http.Dir(root))
+}
+
+func NewFileServer(base *Route) (*FileServer, E.Error) {
+	s := &FileServer{Route: base}
+
+	s.Root = filepath.Clean(s.Root)
+	if !path.IsAbs(s.Root) {
+		return nil, E.New("`root` must be an absolute path")
+	}
+
+	s.handler = handler(s.Root)
+
+	if len(s.Middlewares) > 0 {
+		mid, err := middleware.BuildMiddlewareFromMap(s.Alias, s.Middlewares)
+		if err != nil {
+			return nil, err
+		}
+		s.middleware = mid
+	}
+
+	return s, nil
+}
+
+// Start implements task.TaskStarter.
+func (s *FileServer) Start(parent task.Parent) E.Error {
+	s.task = parent.Subtask("fileserver."+s.TargetName(), false)
+
+	pathPatterns := s.PathPatterns
+	switch {
+	case len(pathPatterns) == 0:
+	case len(pathPatterns) == 1 && pathPatterns[0] == "/":
+	default:
+		mux := gphttp.NewServeMux()
+		patErrs := E.NewBuilder("invalid path pattern(s)")
+		for _, p := range pathPatterns {
+			patErrs.Add(mux.Handle(p, s.handler))
+		}
+		if err := patErrs.Error(); err != nil {
+			s.task.Finish(err)
+			return err
+		}
+		s.handler = mux
+	}
+
+	if s.middleware != nil {
+		s.handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			s.middleware.ServeHTTP(s.handler.ServeHTTP, w, r)
+		})
+	}
+
+	if s.UseAccessLog() {
+		var err error
+		s.accessLogger, err = accesslog.NewFileAccessLogger(s.task, s.AccessLog)
+		if err != nil {
+			s.task.Finish(err)
+			return E.Wrap(err)
+		}
+	}
+
+	if common.PrometheusEnabled {
+		metricsLogger := metricslogger.NewMetricsLogger(s.TargetName())
+		s.handler = metricsLogger.GetHandler(s.handler)
+		s.task.OnCancel("reset_metrics", metricsLogger.ResetMetrics)
+	}
+
+	if s.UseHealthCheck() {
+		s.Health = monitor.NewFileServerHealthMonitor(s.TargetName(), s.HealthCheck, s.Root)
+		if err := s.Health.Start(s.task); err != nil {
+			return err
+		}
+	}
+
+	routes.SetHTTPRoute(s.TargetName(), s)
+	s.task.OnCancel("entrypoint_remove_route", func() {
+		routes.DeleteHTTPRoute(s.TargetName())
+	})
+	return nil
+}
+
+func (s *FileServer) Task() *task.Task {
+	return s.task
+}
+
+// Finish implements task.TaskFinisher.
+func (s *FileServer) Finish(reason any) {
+	s.task.Finish(reason)
+}
+
+// ServeHTTP implements http.Handler.
+func (s *FileServer) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	s.handler.ServeHTTP(w, req)
+	if s.accessLogger != nil {
+		s.accessLogger.Log(req, req.Response)
+	}
+}
+
+func (s *FileServer) HealthMonitor() health.HealthMonitor {
+	return s.Health
+}
--- a/internal/route/fileserver_test.go
+++ b/internal/route/fileserver_test.go
@@ -0,0 +1,122 @@
+//nolint:gofumpt
+package route
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"testing"
+
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+func TestPathTraversalAttack(t *testing.T) {
+	tmp := t.TempDir()
+	root := filepath.Join(tmp, "static")
+	if err := os.Mkdir(root, 0755); err != nil {
+		t.Fatalf("Failed to create root directory: %v", err)
+	}
+
+	// Create a file inside the root
+	validPath := "test.txt"
+	validContent := "test content"
+	if err := os.WriteFile(filepath.Join(root, validPath), []byte(validContent), 0644); err != nil {
+		t.Fatalf("Failed to create test file: %v", err)
+	}
+
+	// create one at ..
+	secretFile := "secret.txt"
+	if err := os.WriteFile(filepath.Join(tmp, secretFile), []byte(validContent), 0644); err != nil {
+		t.Fatalf("Failed to create test file: %v", err)
+	}
+
+	traversals := []string{
+		"../",
+		"./../",
+		"./.././",
+		"..%2f",
+		".%2f..%2f",
+		".%2f%2e%2e",
+		".%2e",
+		".%2e/",
+		".%2e%2f",
+		"%2e.",
+		"%2e%2e",
+	}
+
+	for _, traversal := range traversals {
+		traversals = append(traversals, "%2f"+traversal)
+		traversals = append(traversals, traversal+"%2f")
+		traversals = append(traversals, "%2f"+traversal+"%2f")
+		traversals = append(traversals, "/"+traversal)
+		traversals = append(traversals, traversal+"/")
+		traversals = append(traversals, "/"+traversal+"/")
+	}
+
+	// Setup the FileServer
+	fs, err := NewFileServer(&Route{Root: root})
+	if err != nil {
+		t.Fatalf("Failed to create FileServer: %v", err)
+	}
+
+	// Create a test server with the handler
+	ts := httptest.NewServer(fs.handler)
+	defer ts.Close()
+
+	// Test valid path
+	t.Run("valid path", func(t *testing.T) {
+		validURL := ts.URL + "/" + validPath
+		resp, err := http.Get(validURL)
+		if err != nil {
+			t.Errorf("Error making request to %s: %v", validURL, err)
+		}
+		defer resp.Body.Close()
+
+		if resp.StatusCode != http.StatusOK {
+			t.Errorf("Expected 200 OK, got %d", resp.StatusCode)
+		}
+
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			t.Errorf("Error reading response body: %v", err)
+		}
+
+		if string(body) != validContent {
+			t.Errorf("Expected %q, got %q", validContent, string(body))
+		}
+	})
+
+	// Test ../ path
+	// tsURL := Must(url.Parse(ts.URL))
+	for _, traversal := range traversals {
+		p := traversal + secretFile
+		t.Run(p, func(t *testing.T) {
+			u := &url.URL{Scheme: "http", Host: ts.Listener.Addr().String(), Path: p}
+			resp, err := http.DefaultClient.Do(&http.Request{
+				Method: http.MethodGet,
+				URL:    u,
+			})
+			if err != nil {
+				t.Errorf("Error making request to %s: %v", p, err)
+			}
+			defer resp.Body.Close()
+
+			if resp.StatusCode != http.StatusNotFound && resp.StatusCode != http.StatusBadRequest {
+				t.Errorf("Expected status 404 or 400, got %d in url %s", resp.StatusCode, u.String())
+			}
+
+			u = Must(url.Parse(ts.URL + "/" + p))
+			resp, err = http.DefaultClient.Do(&http.Request{
+				Method: http.MethodGet,
+				URL:    u,
+			})
+			if err != nil {
+				t.Errorf("Error making request to %s: %v", u.String(), err)
+			}
+			defer resp.Body.Close()
+		})
+	}
+}
--- a/internal/route/provider/docker.go
+++ b/internal/route/provider/docker.go
@@ -3,7 +3,6 @@ package provider
 import (
 	"fmt"
 	"strconv"
-	"strings"

 	"github.com/docker/docker/client"
 	"github.com/rs/zerolog"
@@ -62,15 +61,13 @@ func (p *DockerProvider) NewWatcher() watcher.Watcher {
 }

 func (p *DockerProvider) loadRoutesImpl() (route.Routes, E.Error) {
-	routes := route.NewRoutes()
-	entries := route.NewProxyEntries()
-
 	containers, err := docker.ListContainers(p.dockerHost)
 	if err != nil {
-		return routes, E.From(err)
+		return nil, E.From(err)
 	}

 	errs := E.NewBuilder("")
+	routes := make(route.Routes)

 	for _, c := range containers {
 		container := docker.FromDocker(&c, p.dockerHost)
@@ -78,47 +75,38 @@ func (p *DockerProvider) loadRoutesImpl() (route.Routes, E.Error) {
 			continue
 		}

-		newEntries, err := p.entriesFromContainerLabels(container)
+		newEntries, err := p.routesFromContainerLabels(container)
 		if err != nil {
 			errs.Add(err.Subject(container.ContainerName))
 		}
-		// although err is not nil
-		// there may be some valid entries in `en`
-		dups := entries.MergeFrom(newEntries)
-		// add the duplicate proxy entries to the error
-		dups.RangeAll(func(k string, v *route.RawEntry) {
-			errs.Addf("duplicated alias %s", k)
-		})
+		for k, v := range newEntries {
+			if routes.Contains(k) {
+				errs.Addf("duplicated alias %s", k)
+			} else {
+				routes[k] = v
+			}
+		}
 	}

-	routes, err = route.FromEntries(p.ShortName(), entries)
-	errs.Add(err)
-
 	return routes, errs.Error()
 }

-func (p *DockerProvider) shouldIgnore(container *docker.Container) bool {
-	return container.IsExcluded ||
-		!container.IsExplicit && p.IsExplicitOnly() ||
-		!container.IsExplicit && container.IsDatabase ||
-		strings.HasSuffix(container.ContainerName, "-old")
-}
-
 // Returns a list of proxy entries for a container.
 // Always non-nil.
-func (p *DockerProvider) entriesFromContainerLabels(container *docker.Container) (entries route.RawEntries, _ E.Error) {
-	entries = route.NewProxyEntries()
-
-	if p.shouldIgnore(container) {
-		return
+func (p *DockerProvider) routesFromContainerLabels(container *docker.Container) (route.Routes, E.Error) {
+	if !container.IsExplicit && p.IsExplicitOnly() {
+		return nil, nil
 	}

+	routes := make(route.Routes, len(container.Aliases))
+
 	// init entries map for all aliases
 	for _, a := range container.Aliases {
-		entries.Store(a, &route.RawEntry{
-			Alias:     a,
-			Container: container,
-		})
+		routes[a] = &route.Route{
+			Metadata: route.Metadata{
+				Container: container,
+			},
+		}
 	}

 	errs := E.NewBuilder("label errors")
@@ -170,32 +158,32 @@ func (p *DockerProvider) entriesFromContainerLabels(container *docker.Container)
 		}

 		// init entry if not exist
-		en, ok := entries.Load(alias)
+		r, ok := routes[alias]
 		if !ok {
-			en = &route.RawEntry{
-				Alias:     alias,
-				Container: container,
+			r = &route.Route{
+				Metadata: route.Metadata{
+					Container: container,
+				},
 			}
-			entries.Store(alias, en)
+			routes[alias] = r
 		}

 		// deserialize map into entry object
-		err := U.Deserialize(entryMap, en)
+		err := U.Deserialize(entryMap, r)
 		if err != nil {
 			errs.Add(err.Subject(alias))
 		} else {
-			entries.Store(alias, en)
+			routes[alias] = r
 		}
 	}
 	if wildcardProps != nil {
-		entries.Range(func(alias string, re *route.RawEntry) bool {
+		for _, re := range routes {
 			if err := U.Deserialize(wildcardProps, re); err != nil {
 				errs.Add(err.Subject(docker.WildcardAlias))
-				return false
+				break
 			}
-			return true
-		})
+		}
 	}

-	return entries, errs.Error()
+	return routes, errs.Error()
 }
--- a/internal/route/provider/docker_labels_test.go
+++ b/internal/route/provider/docker_labels_test.go
@@ -20,7 +20,7 @@ func TestParseDockerLabels(t *testing.T) {
 	labels := make(map[string]string)
 	ExpectNoError(t, yaml.Unmarshal(testDockerLabelsYAML, &labels))

-	routes, err := provider.entriesFromContainerLabels(
+	routes, err := provider.routesFromContainerLabels(
 		docker.FromDocker(&types.Container{
 			Names:  []string{"container"},
 			Labels: labels,
@@ -31,6 +31,6 @@ func TestParseDockerLabels(t *testing.T) {
 		}, "/var/run/docker.sock"),
 	)
 	ExpectNoError(t, err)
-	ExpectTrue(t, routes.Has("app"))
-	ExpectTrue(t, routes.Has("app1"))
+	ExpectTrue(t, routes.Contains("app"))
+	ExpectTrue(t, routes.Contains("app1"))
 }
--- a/internal/route/provider/docker_test.go
+++ b/internal/route/provider/docker_test.go
@@ -9,9 +9,7 @@ import (
 	"github.com/docker/docker/client"
 	"github.com/yusing/go-proxy/internal/common"
 	D "github.com/yusing/go-proxy/internal/docker"
-	E "github.com/yusing/go-proxy/internal/error"
 	"github.com/yusing/go-proxy/internal/route"
-	"github.com/yusing/go-proxy/internal/route/entry"
 	T "github.com/yusing/go-proxy/internal/route/types"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )
@@ -23,7 +21,7 @@ const (
 	testDockerIP = "172.17.0.123"
 )

-func makeEntries(cont *types.Container, dockerHostIP ...string) route.RawEntries {
+func makeRoutes(cont *types.Container, dockerHostIP ...string) route.Routes {
 	var p DockerProvider
 	var host string
 	if len(dockerHostIP) > 0 {
@@ -31,12 +29,13 @@ func makeEntries(cont *types.Container, dockerHostIP ...string) route.RawEntries
 	} else {
 		host = client.DefaultDockerHost
 	}
+	cont.ID = "test"
 	p.name = "test"
-	entries := E.Must(p.entriesFromContainerLabels(D.FromDocker(cont, host)))
-	entries.RangeAll(func(k string, v *route.RawEntry) {
-		v.Finalize()
-	})
-	return entries
+	routes := Must(p.routesFromContainerLabels(D.FromDocker(cont, host)))
+	for _, r := range routes {
+		r.Finalize()
+	}
+	return routes
 }

 func TestExplicitOnly(t *testing.T) {
@@ -57,43 +56,41 @@ func TestApplyLabel(t *testing.T) {
 		"GET /static",
 	}
 	middlewaresExpect := map[string]map[string]any{
-		"middleware1": {
-			"prop1": "value1",
-			"prop2": "value2",
-		},
-		"middleware2": {
-			"prop3": "value3",
-			"prop4": "value4",
+		"request": {
+			"set_headers": map[string]any{
+				"X-Header": "value1",
+			},
+			"add_headers": map[string]any{
+				"X-Header2": "value2",
+			},
 		},
 	}
-	entries := makeEntries(&types.Container{
+	entries := makeRoutes(&types.Container{
 		Names: dummyNames,
 		Labels: map[string]string{
-			D.LabelAliases:                          "a,b",
-			D.LabelIdleTimeout:                      "",
-			D.LabelStopMethod:                       common.StopMethodDefault,
-			D.LabelStopSignal:                       "SIGTERM",
-			D.LabelStopTimeout:                      common.StopTimeoutDefault,
-			D.LabelWakeTimeout:                      common.WakeTimeoutDefault,
-			"proxy.*.no_tls_verify":                 "true",
-			"proxy.*.scheme":                        "https",
-			"proxy.*.host":                          "app",
-			"proxy.*.port":                          "4567",
-			"proxy.a.path_patterns":                 pathPatterns,
-			"proxy.a.middlewares.middleware1.prop1": "value1",
-			"proxy.a.middlewares.middleware1.prop2": "value2",
-			"proxy.a.middlewares.middleware2.prop3": "value3",
-			"proxy.a.middlewares.middleware2.prop4": "value4",
-			"proxy.a.homepage.show":                 "true",
-			"proxy.a.homepage.icon":                 "png/adguard-home.png",
-			"proxy.a.healthcheck.path":              "/ping",
-			"proxy.a.healthcheck.interval":          "10s",
+			D.LabelAliases:          "a,b",
+			D.LabelIdleTimeout:      "",
+			D.LabelStopMethod:       common.StopMethodDefault,
+			D.LabelStopSignal:       "SIGTERM",
+			D.LabelStopTimeout:      common.StopTimeoutDefault,
+			D.LabelWakeTimeout:      common.WakeTimeoutDefault,
+			"proxy.*.no_tls_verify": "true",
+			"proxy.*.scheme":        "https",
+			"proxy.*.host":          "app",
+			"proxy.*.port":          "4567",
+			"proxy.a.path_patterns": pathPatterns,
+			"proxy.a.middlewares.request.set_headers.X-Header":  "value1",
+			"proxy.a.middlewares.request.add_headers.X-Header2": "value2",
+			"proxy.a.homepage.show":                             "true",
+			"proxy.a.homepage.icon":                             "png/adguard-home.png",
+			"proxy.a.healthcheck.path":                          "/ping",
+			"proxy.a.healthcheck.interval":                      "10s",
 		},
 	})

-	a, ok := entries.Load("a")
+	a, ok := entries["a"]
 	ExpectTrue(t, ok)
-	b, ok := entries.Load("b")
+	b, ok := entries["b"]
 	ExpectTrue(t, ok)

 	ExpectEqual(t, a.Scheme, "https")
@@ -102,8 +99,8 @@ func TestApplyLabel(t *testing.T) {
 	ExpectEqual(t, a.Host, "app")
 	ExpectEqual(t, b.Host, "app")

-	ExpectEqual(t, a.Port, "4567")
-	ExpectEqual(t, b.Port, "4567")
+	ExpectEqual(t, a.Port.Proxy, 4567)
+	ExpectEqual(t, b.Port.Proxy, 4567)

 	ExpectTrue(t, a.NoTLSVerify)
 	ExpectTrue(t, b.NoTLSVerify)
@@ -139,7 +136,7 @@ func TestApplyLabel(t *testing.T) {
 }

 func TestApplyLabelWithAlias(t *testing.T) {
-	entries := makeEntries(&types.Container{
+	entries := makeRoutes(&types.Container{
 		Names: dummyNames,
 		State: "running",
 		Labels: map[string]string{
@@ -150,23 +147,23 @@ func TestApplyLabelWithAlias(t *testing.T) {
 			"proxy.c.scheme":        "https",
 		},
 	})
-	a, ok := entries.Load("a")
+	a, ok := entries["a"]
 	ExpectTrue(t, ok)
-	b, ok := entries.Load("b")
+	b, ok := entries["b"]
 	ExpectTrue(t, ok)
-	c, ok := entries.Load("c")
+	c, ok := entries["c"]
 	ExpectTrue(t, ok)

 	ExpectEqual(t, a.Scheme, "http")
-	ExpectEqual(t, a.Port, "3333")
+	ExpectEqual(t, a.Port.Proxy, 3333)
 	ExpectEqual(t, a.NoTLSVerify, true)
 	ExpectEqual(t, b.Scheme, "http")
-	ExpectEqual(t, b.Port, "1234")
+	ExpectEqual(t, b.Port.Proxy, 1234)
 	ExpectEqual(t, c.Scheme, "https")
 }

 func TestApplyLabelWithRef(t *testing.T) {
-	entries := makeEntries(&types.Container{
+	entries := makeRoutes(&types.Container{
 		Names: dummyNames,
 		State: "running",
 		Labels: map[string]string{
@@ -178,19 +175,19 @@ func TestApplyLabelWithRef(t *testing.T) {
 			"proxy.#3.scheme": "https",
 		},
 	})
-	a, ok := entries.Load("a")
+	a, ok := entries["a"]
 	ExpectTrue(t, ok)
-	b, ok := entries.Load("b")
+	b, ok := entries["b"]
 	ExpectTrue(t, ok)
-	c, ok := entries.Load("c")
+	c, ok := entries["c"]
 	ExpectTrue(t, ok)

 	ExpectEqual(t, a.Scheme, "http")
 	ExpectEqual(t, a.Host, "localhost")
-	ExpectEqual(t, a.Port, "4444")
-	ExpectEqual(t, b.Port, "9999")
+	ExpectEqual(t, a.Port.Proxy, 4444)
+	ExpectEqual(t, b.Port.Proxy, 9999)
 	ExpectEqual(t, c.Scheme, "https")
-	ExpectEqual(t, c.Port, "1111")
+	ExpectEqual(t, c.Port.Proxy, 1111)
 }

 func TestApplyLabelWithRefIndexError(t *testing.T) {
@@ -200,11 +197,12 @@ func TestApplyLabelWithRefIndexError(t *testing.T) {
 		Labels: map[string]string{
 			D.LabelAliases:    "a,b",
 			"proxy.#1.host":   "localhost",
+			"proxy.*.port":    "4444",
 			"proxy.#4.scheme": "https",
 		},
 	}, "")
 	var p DockerProvider
-	_, err := p.entriesFromContainerLabels(c)
+	_, err := p.routesFromContainerLabels(c)
 	ExpectError(t, ErrAliasRefIndexOutOfRange, err)

 	c = D.FromDocker(&types.Container{
@@ -215,7 +213,7 @@ func TestApplyLabelWithRefIndexError(t *testing.T) {
 			"proxy.#0.host": "localhost",
 		},
 	}, "")
-	_, err = p.entriesFromContainerLabels(c)
+	_, err = p.routesFromContainerLabels(c)
 	ExpectError(t, ErrAliasRefIndexOutOfRange, err)
 }

@@ -229,17 +227,17 @@ func TestDynamicAliases(t *testing.T) {
 		},
 	}

-	entries := makeEntries(c)
+	entries := makeRoutes(c)

-	raw, ok := entries.Load("app1")
+	r, ok := entries["app1"]
 	ExpectTrue(t, ok)
-	ExpectEqual(t, raw.Scheme, "http")
-	ExpectEqual(t, raw.Port, "1234")
+	ExpectEqual(t, r.Scheme, "http")
+	ExpectEqual(t, r.Port.Proxy, 1234)

-	raw, ok = entries.Load("app1_backend")
+	r, ok = entries["app1_backend"]
 	ExpectTrue(t, ok)
-	ExpectEqual(t, raw.Scheme, "http")
-	ExpectEqual(t, raw.Port, "5678")
+	ExpectEqual(t, r.Scheme, "http")
+	ExpectEqual(t, r.Port.Proxy, 5678)
 }

 func TestDisableHealthCheck(t *testing.T) {
@@ -251,22 +249,22 @@ func TestDisableHealthCheck(t *testing.T) {
 			"proxy.a.port":                "1234",
 		},
 	}
-	raw, ok := makeEntries(c).Load("a")
+	r, ok := makeRoutes(c)["a"]
 	ExpectTrue(t, ok)
-	ExpectEqual(t, raw.HealthCheck, nil)
+	ExpectFalse(t, r.UseHealthCheck())
 }

 func TestPublicIPLocalhost(t *testing.T) {
 	c := &types.Container{Names: dummyNames, State: "running"}
-	raw, ok := makeEntries(c).Load("a")
+	r, ok := makeRoutes(c)["a"]
 	ExpectTrue(t, ok)
-	ExpectEqual(t, raw.Container.PublicIP, "127.0.0.1")
-	ExpectEqual(t, raw.Host, raw.Container.PublicIP)
+	ExpectEqual(t, r.Container.PublicIP, "127.0.0.1")
+	ExpectEqual(t, r.Host, r.Container.PublicIP)
 }

 func TestPublicIPRemote(t *testing.T) {
 	c := &types.Container{Names: dummyNames, State: "running"}
-	raw, ok := makeEntries(c, testIP).Load("a")
+	raw, ok := makeRoutes(c, testIP)["a"]
 	ExpectTrue(t, ok)
 	ExpectEqual(t, raw.Container.PublicIP, testIP)
 	ExpectEqual(t, raw.Host, raw.Container.PublicIP)
@@ -283,10 +281,10 @@ func TestPrivateIPLocalhost(t *testing.T) {
 			},
 		},
 	}
-	raw, ok := makeEntries(c).Load("a")
+	r, ok := makeRoutes(c)["a"]
 	ExpectTrue(t, ok)
-	ExpectEqual(t, raw.Container.PrivateIP, testDockerIP)
-	ExpectEqual(t, raw.Host, raw.Container.PrivateIP)
+	ExpectEqual(t, r.Container.PrivateIP, testDockerIP)
+	ExpectEqual(t, r.Host, r.Container.PrivateIP)
 }

 func TestPrivateIPRemote(t *testing.T) {
@@ -301,11 +299,11 @@ func TestPrivateIPRemote(t *testing.T) {
 			},
 		},
 	}
-	raw, ok := makeEntries(c, testIP).Load("a")
+	r, ok := makeRoutes(c, testIP)["a"]
 	ExpectTrue(t, ok)
-	ExpectEqual(t, raw.Container.PrivateIP, "")
-	ExpectEqual(t, raw.Container.PublicIP, testIP)
-	ExpectEqual(t, raw.Host, raw.Container.PublicIP)
+	ExpectEqual(t, r.Container.PrivateIP, "")
+	ExpectEqual(t, r.Container.PublicIP, testIP)
+	ExpectEqual(t, r.Host, r.Container.PublicIP)
 }

 func TestStreamDefaultValues(t *testing.T) {
@@ -328,59 +326,58 @@ func TestStreamDefaultValues(t *testing.T) {
 	}

 	t.Run("local", func(t *testing.T) {
-		raw, ok := makeEntries(cont).Load("a")
+		r, ok := makeRoutes(cont)["a"]
 		ExpectTrue(t, ok)
-		en := E.Must(entry.ValidateEntry(raw))
-		a := ExpectType[*entry.StreamEntry](t, en)
-		ExpectEqual(t, a.Scheme.ListeningScheme, T.Scheme("udp"))
-		ExpectEqual(t, a.Scheme.ProxyScheme, T.Scheme("udp"))
-		ExpectEqual(t, a.URL.Hostname(), privIP)
-		ExpectEqual(t, a.Port.ListeningPort, 0)
-		ExpectEqual(t, a.Port.ProxyPort, T.Port(privPort))
+		ExpectNoError(t, r.Validate())
+		ExpectEqual(t, r.Scheme, T.Scheme("udp"))
+		ExpectEqual(t, r.TargetURL().Hostname(), privIP)
+		ExpectEqual(t, r.Port.Listening, 0)
+		ExpectEqual(t, r.Port.Proxy, int(privPort))
 	})

 	t.Run("remote", func(t *testing.T) {
-		raw, ok := makeEntries(cont, testIP).Load("a")
+		r, ok := makeRoutes(cont, testIP)["a"]
 		ExpectTrue(t, ok)
-		en := E.Must(entry.ValidateEntry(raw))
-		a := ExpectType[*entry.StreamEntry](t, en)
-		ExpectEqual(t, a.Scheme.ListeningScheme, T.Scheme("udp"))
-		ExpectEqual(t, a.Scheme.ProxyScheme, T.Scheme("udp"))
-		ExpectEqual(t, a.URL.Hostname(), testIP)
-		ExpectEqual(t, a.Port.ListeningPort, 0)
-		ExpectEqual(t, a.Port.ProxyPort, T.Port(pubPort))
+		ExpectNoError(t, r.Validate())
+		ExpectEqual(t, r.Scheme, T.Scheme("udp"))
+		ExpectEqual(t, r.TargetURL().Hostname(), testIP)
+		ExpectEqual(t, r.Port.Listening, 0)
+		ExpectEqual(t, r.Port.Proxy, int(pubPort))
 	})
 }

 func TestExplicitExclude(t *testing.T) {
-	_, ok := makeEntries(&types.Container{
+	r, ok := makeRoutes(&types.Container{
 		Names: dummyNames,
 		Labels: map[string]string{
 			D.LabelAliases:          "a",
 			D.LabelExclude:          "true",
 			"proxy.a.no_tls_verify": "true",
 		},
-	}, "").Load("a")
-	ExpectFalse(t, ok)
+	}, "")["a"]
+	ExpectTrue(t, ok)
+	ExpectTrue(t, r.ShouldExclude())
 }

 func TestImplicitExcludeDatabase(t *testing.T) {
 	t.Run("mount path detection", func(t *testing.T) {
-		_, ok := makeEntries(&types.Container{
+		r, ok := makeRoutes(&types.Container{
 			Names: dummyNames,
 			Mounts: []types.MountPoint{
 				{Source: "/data", Destination: "/var/lib/postgresql/data"},
 			},
-		}).Load("a")
-		ExpectFalse(t, ok)
+		})["a"]
+		ExpectTrue(t, ok)
+		ExpectTrue(t, r.ShouldExclude())
 	})
 	t.Run("exposed port detection", func(t *testing.T) {
-		_, ok := makeEntries(&types.Container{
+		r, ok := makeRoutes(&types.Container{
 			Names: dummyNames,
 			Ports: []types.Port{
 				{Type: "tcp", PrivatePort: 5432, PublicPort: 5432},
 			},
-		}).Load("a")
-		ExpectFalse(t, ok)
+		})["a"]
+		ExpectTrue(t, ok)
+		ExpectTrue(t, r.ShouldExclude())
 	})
 }
--- a/internal/route/provider/event_handler.go
+++ b/internal/route/provider/event_handler.go
@@ -4,7 +4,6 @@ import (
 	"github.com/yusing/go-proxy/internal/common"
 	E "github.com/yusing/go-proxy/internal/error"
 	"github.com/yusing/go-proxy/internal/route"
-	"github.com/yusing/go-proxy/internal/route/entry"
 	"github.com/yusing/go-proxy/internal/route/provider/types"
 	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/internal/watcher"
@@ -31,10 +30,10 @@ func (p *Provider) newEventHandler() *EventHandler {

 func (handler *EventHandler) Handle(parent task.Parent, events []watcher.Event) {
 	oldRoutes := handler.provider.routes
-	newRoutes, err := handler.provider.loadRoutesImpl()
+	newRoutes, err := handler.provider.loadRoutes()
 	if err != nil {
 		handler.errs.Add(err)
-		if newRoutes.Size() == 0 {
+		if len(newRoutes) == 0 {
 			return
 		}
 	}
@@ -47,34 +46,32 @@ func (handler *EventHandler) Handle(parent task.Parent, events []watcher.Event)
 		E.LogDebug(eventsLog.About(), eventsLog.Error(), handler.provider.Logger())

 		oldRoutesLog := E.NewBuilder("old routes")
-		oldRoutes.RangeAllParallel(func(k string, r *route.Route) {
+		for k := range oldRoutes {
 			oldRoutesLog.Adds(k)
-		})
+		}
 		E.LogDebug(oldRoutesLog.About(), oldRoutesLog.Error(), handler.provider.Logger())

 		newRoutesLog := E.NewBuilder("new routes")
-		newRoutes.RangeAllParallel(func(k string, r *route.Route) {
+		for k := range newRoutes {
 			newRoutesLog.Adds(k)
-		})
+		}
 		E.LogDebug(newRoutesLog.About(), newRoutesLog.Error(), handler.provider.Logger())
 	}

-	oldRoutes.RangeAll(func(k string, oldr *route.Route) {
-		newr, ok := newRoutes.Load(k)
+	for k, oldr := range oldRoutes {
+		newr, ok := newRoutes[k]
 		switch {
 		case !ok:
 			handler.Remove(oldr)
 		case handler.matchAny(events, newr):
 			handler.Update(parent, oldr, newr)
-		case entry.ShouldNotServe(newr):
-			handler.Remove(oldr)
 		}
-	})
-	newRoutes.RangeAll(func(k string, newr *route.Route) {
-		if !(oldRoutes.Has(k) || entry.ShouldNotServe(newr)) {
+	}
+	for k, newr := range newRoutes {
+		if _, ok := oldRoutes[k]; !ok {
 			handler.Add(parent, newr)
 		}
-	})
+	}
 }

 func (handler *EventHandler) matchAny(events []watcher.Event, route *route.Route) bool {
@@ -89,8 +86,8 @@ func (handler *EventHandler) matchAny(events []watcher.Event, route *route.Route
 func (handler *EventHandler) match(event watcher.Event, route *route.Route) bool {
 	switch handler.provider.GetType() {
 	case types.ProviderTypeDocker:
-		return route.Entry.Container.ContainerID == event.ActorID ||
-			route.Entry.Container.ContainerName == event.ActorName
+		return route.Container.ContainerID == event.ActorID ||
+			route.Container.ContainerName == event.ActorName
 	case types.ProviderTypeFile:
 		return true
 	}
@@ -103,14 +100,14 @@ func (handler *EventHandler) Add(parent task.Parent, route *route.Route) {
 	if err != nil {
 		handler.errs.Add(err.Subject("add"))
 	} else {
-		handler.added.Adds(route.Entry.Alias)
+		handler.added.Adds(route.Alias)
 	}
 }

 func (handler *EventHandler) Remove(route *route.Route) {
 	route.Finish("route removed")
-	handler.provider.routes.Delete(route.Entry.Alias)
-	handler.removed.Adds(route.Entry.Alias)
+	delete(handler.provider.routes, route.Alias)
+	handler.removed.Adds(route.Alias)
 }

 func (handler *EventHandler) Update(parent task.Parent, oldRoute *route.Route, newRoute *route.Route) {
@@ -119,7 +116,7 @@ func (handler *EventHandler) Update(parent task.Parent, oldRoute *route.Route, n
 	if err != nil {
 		handler.errs.Add(err.Subject("update"))
 	} else {
-		handler.updated.Adds(newRoute.Entry.Alias)
+		handler.updated.Adds(newRoute.Alias)
 	}
 }

--- a/internal/route/provider/file.go
+++ b/internal/route/provider/file.go
@@ -33,16 +33,13 @@ func FileProviderImpl(filename string) (ProviderImpl, error) {
 	return impl, nil
 }

-func validate(provider string, data []byte) (route.Routes, E.Error) {
-	entries, err := utils.DeserializeYAMLMap[*route.RawEntry](data)
-	if err != nil {
-		return route.NewRoutes(), err
-	}
-	return route.FromEntries(provider, entries)
+func validate(data []byte) (routes route.Routes, err E.Error) {
+	err = utils.DeserializeYAML(data, &routes)
+	return
 }

 func Validate(data []byte) (err E.Error) {
-	_, err = validate("", data)
+	_, err = validate(data)
 	return
 }

@@ -63,14 +60,15 @@ func (p *FileProvider) Logger() *zerolog.Logger {
 }

 func (p *FileProvider) loadRoutesImpl() (route.Routes, E.Error) {
-	routes := route.NewRoutes()
-
 	data, err := os.ReadFile(p.path)
 	if err != nil {
-		return routes, E.From(err)
+		return nil, E.Wrap(err)
 	}
-
-	return validate(p.ShortName(), data)
+	routes, err := validate(data)
+	if err != nil && len(routes) == 0 {
+		return nil, E.Wrap(err)
+	}
+	return routes, E.Wrap(err)
 }

 func (p *FileProvider) NewWatcher() W.Watcher {
--- a/internal/route/provider/file_test.go
+++ b/internal/route/provider/file_test.go
@@ -12,6 +12,6 @@ import (
 var testAllFieldsYAML []byte

 func TestFile(t *testing.T) {
-	_, err := validate("", testAllFieldsYAML)
+	_, err := validate(testAllFieldsYAML)
 	ExpectNoError(t, err)
 }
--- a/internal/route/provider/provider.go
+++ b/internal/route/provider/provider.go
@@ -8,7 +8,7 @@ import (

 	"github.com/rs/zerolog"
 	E "github.com/yusing/go-proxy/internal/error"
-	R "github.com/yusing/go-proxy/internal/route"
+	"github.com/yusing/go-proxy/internal/route"
 	"github.com/yusing/go-proxy/internal/route/provider/types"
 	"github.com/yusing/go-proxy/internal/task"
 	W "github.com/yusing/go-proxy/internal/watcher"
@@ -17,10 +17,10 @@ import (

 type (
 	Provider struct {
-		ProviderImpl `json:"-"`
+		ProviderImpl

 		t      types.ProviderType
-		routes R.Routes
+		routes route.Routes

 		watcher W.Watcher
 	}
@@ -28,7 +28,7 @@ type (
 		fmt.Stringer
 		ShortName() string
 		IsExplicitOnly() bool
-		loadRoutesImpl() (R.Routes, E.Error)
+		loadRoutesImpl() (route.Routes, E.Error)
 		NewWatcher() W.Watcher
 		Logger() *zerolog.Logger
 	}
@@ -41,10 +41,7 @@ const (
 var ErrEmptyProviderName = errors.New("empty provider name")

 func newProvider(t types.ProviderType) *Provider {
-	return &Provider{
-		t:      t,
-		routes: R.NewRoutes(),
-	}
+	return &Provider{t: t}
 }

 func NewFileProvider(filename string) (p *Provider, err error) {
@@ -84,13 +81,13 @@ func (p *Provider) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }

-func (p *Provider) startRoute(parent task.Parent, r *R.Route) E.Error {
+func (p *Provider) startRoute(parent task.Parent, r *route.Route) E.Error {
 	err := r.Start(parent)
 	if err != nil {
-		return err.Subject(r.Entry.Alias)
+		delete(p.routes, r.Alias)
+		return err.Subject(r.Alias)
 	}
-
-	p.routes.Store(r.Entry.Alias, r)
+	p.routes[r.Alias] = r
 	return nil
 }

@@ -98,11 +95,10 @@ func (p *Provider) startRoute(parent task.Parent, r *R.Route) E.Error {
 func (p *Provider) Start(parent task.Parent) E.Error {
 	t := parent.Subtask("provider."+p.String(), false)

-	// routes and event queue will stop on config reload
-	errs := p.routes.CollectErrorsParallel(
-		func(alias string, r *R.Route) error {
-			return p.startRoute(t, r)
-		})
+	errs := E.NewBuilder("routes error")
+	for _, r := range p.routes {
+		errs.Add(p.startRoute(t, r))
+	}

 	eventQueue := events.NewEventQueue(
 		t.Subtask("event_queue", false),
@@ -119,32 +115,52 @@ func (p *Provider) Start(parent task.Parent) E.Error {
 	)
 	eventQueue.Start(p.watcher.Events(t.Context()))

-	if err := E.Join(errs...); err != nil {
+	if err := errs.Error(); err != nil {
 		return err.Subject(p.String())
 	}
 	return nil
 }

-func (p *Provider) RangeRoutes(do func(string, *R.Route)) {
-	p.routes.RangeAll(do)
+func (p *Provider) RangeRoutes(do func(string, *route.Route)) {
+	for alias, r := range p.routes {
+		do(alias, r)
+	}
 }

-func (p *Provider) GetRoute(alias string) (*R.Route, bool) {
-	return p.routes.Load(alias)
+func (p *Provider) GetRoute(alias string) (r *route.Route, ok bool) {
+	r, ok = p.routes[alias]
+	return
 }

-func (p *Provider) LoadRoutes() E.Error {
-	var err E.Error
-	p.routes, err = p.loadRoutesImpl()
-	if p.routes.Size() > 0 {
-		return err
+func (p *Provider) loadRoutes() (routes route.Routes, err E.Error) {
+	routes, err = p.loadRoutesImpl()
+	if err != nil && len(routes) == 0 {
+		return route.Routes{}, err
 	}
-	if err == nil {
-		return nil
+	errs := E.NewBuilder("routes error")
+	errs.Add(err)
+	// check for exclusion
+	// set alias and provider, then validate
+	for alias, r := range routes {
+		r.Alias = alias
+		r.Provider = p.ShortName()
+		if err := r.Validate(); err != nil {
+			errs.Add(err.Subject(alias))
+			delete(routes, alias)
+			continue
+		}
+		if r.ShouldExclude() {
+			delete(routes, alias)
+		}
 	}
-	return err
+	return routes, errs.Error()
+}
+
+func (p *Provider) LoadRoutes() (err E.Error) {
+	p.routes, err = p.loadRoutes()
+	return
 }

 func (p *Provider) NumRoutes() int {
-	return p.routes.Size()
+	return len(p.routes)
 }
--- a/internal/route/provider/stats.go
+++ b/internal/route/provider/stats.go
@@ -56,14 +56,14 @@ func (stats *RouteStats) AddOther(other RouteStats) {

 func (p *Provider) Statistics() ProviderStats {
 	var rps, streams RouteStats
-	p.routes.RangeAll(func(_ string, r *R.Route) {
-		switch r.Type {
-		case route.RouteTypeReverseProxy:
+	for _, r := range p.routes {
+		switch r.Type() {
+		case route.RouteTypeHTTP:
 			rps.Add(r)
 		case route.RouteTypeStream:
 			streams.Add(r)
 		}
-	})
+	}
 	return ProviderStats{
 		Total:   rps.Total + streams.Total,
 		RPs:     rps,
--- a/internal/route/reverse_proxy.go
+++ b/internal/route/reverse_proxy.go
@@ -3,7 +3,6 @@ package route
 import (
 	"net/http"

-	"github.com/rs/zerolog"
 	"github.com/yusing/go-proxy/internal/api/v1/favicon"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/docker"
@@ -15,37 +14,33 @@ import (
 	"github.com/yusing/go-proxy/internal/net/http/loadbalancer"
 	loadbalance "github.com/yusing/go-proxy/internal/net/http/loadbalancer/types"
 	"github.com/yusing/go-proxy/internal/net/http/middleware"
+	metricslogger "github.com/yusing/go-proxy/internal/net/http/middleware/metrics_logger"
 	"github.com/yusing/go-proxy/internal/net/http/reverseproxy"
-	"github.com/yusing/go-proxy/internal/route/entry"
 	"github.com/yusing/go-proxy/internal/route/routes"
-	route "github.com/yusing/go-proxy/internal/route/types"
 	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/internal/watcher/health"
 	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
 )

 type (
-	HTTPRoute struct {
-		*entry.ReverseProxyEntry
+	ReveseProxyRoute struct {
+		*Route

 		HealthMon health.HealthMonitor `json:"health,omitempty"`

 		loadBalancer *loadbalancer.LoadBalancer
-		server       loadbalancer.Server
 		handler      http.Handler
 		rp           *reverseproxy.ReverseProxy

 		task *task.Task
-
-		l zerolog.Logger
 	}
 )

 // var globalMux    = http.NewServeMux() // TODO: support regex subdomain matching.

-func NewHTTPRoute(entry *entry.ReverseProxyEntry) (impl, E.Error) {
+func NewReverseProxyRoute(base *Route) (*ReveseProxyRoute, E.Error) {
 	trans := gphttp.DefaultTransport
-	httpConfig := entry.Raw.HTTPConfig
+	httpConfig := base.HTTPConfig

 	if httpConfig.NoTLSVerify {
 		trans = gphttp.DefaultTransportNoTLS
@@ -55,65 +50,57 @@ func NewHTTPRoute(entry *entry.ReverseProxyEntry) (impl, E.Error) {
 		trans.ResponseHeaderTimeout = httpConfig.ResponseHeaderTimeout
 	}

-	service := entry.TargetName()
-	rp := reverseproxy.NewReverseProxy(service, entry.URL, trans)
+	service := base.TargetName()
+	rp := reverseproxy.NewReverseProxy(service, base.ProxyURL, trans)

-	if len(entry.Raw.Middlewares) > 0 {
-		err := middleware.PatchReverseProxy(rp, entry.Raw.Middlewares)
+	if len(base.Middlewares) > 0 {
+		err := middleware.PatchReverseProxy(rp, base.Middlewares)
 		if err != nil {
 			return nil, err
 		}
 	}

-	r := &HTTPRoute{
-		ReverseProxyEntry: entry,
-		rp:                rp,
-		l: logging.With().
-			Str("type", entry.URL.Scheme).
-			Str("name", service).
-			Logger(),
+	r := &ReveseProxyRoute{
+		Route: base,
+		rp:    rp,
 	}
 	return r, nil
 }

-func (r *HTTPRoute) String() string {
+func (r *ReveseProxyRoute) String() string {
 	return r.TargetName()
 }

 // Start implements task.TaskStarter.
-func (r *HTTPRoute) Start(parent task.Parent) E.Error {
-	if entry.ShouldNotServe(r) {
-		return nil
-	}
-
+func (r *ReveseProxyRoute) Start(parent task.Parent) E.Error {
 	r.task = parent.Subtask("http."+r.TargetName(), false)

 	switch {
-	case entry.UseIdleWatcher(r):
-		waker, err := idlewatcher.NewHTTPWaker(parent, r.ReverseProxyEntry, r.rp)
+	case r.UseIdleWatcher():
+		waker, err := idlewatcher.NewHTTPWaker(parent, r, r.rp)
 		if err != nil {
 			r.task.Finish(err)
 			return err
 		}
 		r.handler = waker
 		r.HealthMon = waker
-	case entry.UseHealthCheck(r):
-		if entry.IsDocker(r) {
+	case r.UseHealthCheck():
+		if r.IsDocker() {
 			client, err := docker.ConnectClient(r.Idlewatcher.DockerHost)
 			if err == nil {
-				fallback := monitor.NewHTTPHealthChecker(r.rp.TargetURL, r.Raw.HealthCheck)
-				r.HealthMon = monitor.NewDockerHealthMonitor(client, r.Idlewatcher.ContainerID, r.TargetName(), r.Raw.HealthCheck, fallback)
+				fallback := monitor.NewHTTPHealthChecker(r.rp.TargetURL, r.HealthCheck)
+				r.HealthMon = monitor.NewDockerHealthMonitor(client, r.Idlewatcher.ContainerID, r.TargetName(), r.HealthCheck, fallback)
 				r.task.OnCancel("close_docker_client", client.Close)
 			}
 		}
 		if r.HealthMon == nil {
-			r.HealthMon = monitor.NewHTTPHealthMonitor(r.rp.TargetURL, r.Raw.HealthCheck)
+			r.HealthMon = monitor.NewHTTPHealthMonitor(r.rp.TargetURL, r.HealthCheck)
 		}
 	}

-	if entry.UseAccessLog(r) {
+	if r.UseAccessLog() {
 		var err error
-		r.rp.AccessLogger, err = accesslog.NewFileAccessLogger(r.task, r.Raw.AccessLog)
+		r.rp.AccessLogger, err = accesslog.NewFileAccessLogger(r.task, r.AccessLog)
 		if err != nil {
 			r.task.Finish(err)
 			return E.From(err)
@@ -121,7 +108,7 @@ func (r *HTTPRoute) Start(parent task.Parent) E.Error {
 	}

 	if r.handler == nil {
-		pathPatterns := r.Raw.PathPatterns
+		pathPatterns := r.PathPatterns
 		switch {
 		case len(pathPatterns) == 0:
 			r.handler = r.rp
@@ -130,7 +117,7 @@ func (r *HTTPRoute) Start(parent task.Parent) E.Error {
 		default:
 			logging.Warn().
 				Str("route", r.TargetName()).
-				Msg("`path_patterns` is deprecated. Use `rules` instead.")
+				Msg("`path_patterns` for reverse proxy is deprecated. Use `rules` instead.")
 			mux := gphttp.NewServeMux()
 			patErrs := E.NewBuilder("invalid path pattern(s)")
 			for _, p := range pathPatterns {
@@ -144,17 +131,23 @@ func (r *HTTPRoute) Start(parent task.Parent) E.Error {
 		}
 	}

-	if len(r.Raw.Rules) > 0 {
-		r.handler = r.Raw.Rules.BuildHandler(r.TargetName(), r.handler)
+	if len(r.Rules) > 0 {
+		r.handler = r.Rules.BuildHandler(r.TargetName(), r.handler)
 	}

 	if r.HealthMon != nil {
 		if err := r.HealthMon.Start(r.task); err != nil {
-			E.LogWarn("health monitor error", err, &r.l)
+			return err
 		}
 	}

-	if entry.UseLoadBalance(r) {
+	if common.PrometheusEnabled {
+		metricsLogger := metricslogger.NewMetricsLogger(r.TargetName())
+		r.handler = metricsLogger.GetHandler(r.handler)
+		r.task.OnCancel("reset_metrics", metricsLogger.ResetMetrics)
+	}
+
+	if r.UseLoadBalance() {
 		r.addToLoadBalancer(parent)
 	} else {
 		routes.SetHTTPRoute(r.TargetName(), r)
@@ -163,55 +156,47 @@ func (r *HTTPRoute) Start(parent task.Parent) E.Error {
 		})
 	}

-	if common.PrometheusEnabled {
-		r.task.OnCancel("metrics_cleanup", r.rp.UnregisterMetrics)
-	}
-
 	r.task.OnCancel("reset_favicon", func() { favicon.PruneRouteIconCache(r) })
 	return nil
 }

 // Task implements task.TaskStarter.
-func (r *HTTPRoute) Task() *task.Task {
+func (r *ReveseProxyRoute) Task() *task.Task {
 	return r.task
 }

 // Finish implements task.TaskFinisher.
-func (r *HTTPRoute) Finish(reason any) {
+func (r *ReveseProxyRoute) Finish(reason any) {
 	r.task.Finish(reason)
 }

-func (r *HTTPRoute) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+func (r *ReveseProxyRoute) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	r.handler.ServeHTTP(w, req)
 }

-func (r *HTTPRoute) HealthMonitor() health.HealthMonitor {
+func (r *ReveseProxyRoute) HealthMonitor() health.HealthMonitor {
 	return r.HealthMon
 }

-func (r *HTTPRoute) addToLoadBalancer(parent task.Parent) {
+func (r *ReveseProxyRoute) addToLoadBalancer(parent task.Parent) {
 	var lb *loadbalancer.LoadBalancer
-	cfg := r.Raw.LoadBalance
+	cfg := r.LoadBalance
 	l, ok := routes.GetHTTPRoute(cfg.Link)
-	var linked *HTTPRoute
+	var linked *ReveseProxyRoute
 	if ok {
-		linked = l.(*HTTPRoute)
+		linked = l.(*ReveseProxyRoute)
 		lb = linked.loadBalancer
 		lb.UpdateConfigIfNeeded(cfg)
-		if linked.Raw.Homepage.IsEmpty() && !r.Raw.Homepage.IsEmpty() {
-			linked.Raw.Homepage = r.Raw.Homepage
+		if linked.Homepage.IsEmpty() && !r.Homepage.IsEmpty() {
+			linked.Homepage = r.Homepage
 		}
 	} else {
 		lb = loadbalancer.New(cfg)
-		if err := lb.Start(parent); err != nil {
-			panic(err) // should always return nil
-		}
-		linked = &HTTPRoute{
-			ReverseProxyEntry: &entry.ReverseProxyEntry{
-				Raw: &route.RawEntry{
-					Alias:    cfg.Link,
-					Homepage: r.Raw.Homepage,
-				},
+		_ = lb.Start(parent) // always return nil
+		linked = &ReveseProxyRoute{
+			Route: &Route{
+				Alias:    cfg.Link,
+				Homepage: r.Homepage,
 			},
 			HealthMon:    lb,
 			loadBalancer: lb,
@@ -220,9 +205,10 @@ func (r *HTTPRoute) addToLoadBalancer(parent task.Parent) {
 		routes.SetHTTPRoute(cfg.Link, linked)
 	}
 	r.loadBalancer = lb
-	r.server = loadbalance.NewServer(r.task.Name(), r.rp.TargetURL, r.Raw.LoadBalance.Weight, r.handler, r.HealthMon)
-	lb.AddServer(r.server)
+
+	server := loadbalance.NewServer(r.task.Name(), r.rp.TargetURL, r.LoadBalance.Weight, r.handler, r.HealthMon)
+	lb.AddServer(server)
 	r.task.OnCancel("lb_remove_server", func() {
-		lb.RemoveServer(r.server)
+		lb.RemoveServer(server)
 	})
 }
--- a/internal/route/route.go
+++ b/internal/route/route.go
@@ -1,104 +1,363 @@
 package route

 import (
+	"fmt"
+	"strconv"
 	"strings"

 	"github.com/yusing/go-proxy/internal/docker"
-	E "github.com/yusing/go-proxy/internal/error"
-	url "github.com/yusing/go-proxy/internal/net/types"
-	"github.com/yusing/go-proxy/internal/route/entry"
-	"github.com/yusing/go-proxy/internal/route/types"
+	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
+	"github.com/yusing/go-proxy/internal/homepage"
+	net "github.com/yusing/go-proxy/internal/net/types"
 	"github.com/yusing/go-proxy/internal/task"
-	U "github.com/yusing/go-proxy/internal/utils"
-	F "github.com/yusing/go-proxy/internal/utils/functional"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+
+	dockertypes "github.com/docker/docker/api/types"
+	"github.com/yusing/go-proxy/internal/common"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/net/http/accesslog"
+	loadbalance "github.com/yusing/go-proxy/internal/net/http/loadbalancer/types"
+	"github.com/yusing/go-proxy/internal/route/rules"
+	"github.com/yusing/go-proxy/internal/route/types"
+	"github.com/yusing/go-proxy/internal/utils"
 )

 type (
 	Route struct {
-		_ U.NoCopy
-		impl
-		Type  types.RouteType
-		Entry *RawEntry
-	}
-	Routes = F.Map[string, *Route]
+		_ utils.NoCopy

-	impl interface {
-		types.Route
-		task.TaskStarter
-		task.TaskFinisher
-		String() string
-		TargetURL() url.URL
+		Alias  string       `json:"alias"`
+		Scheme types.Scheme `json:"scheme,omitempty"`
+		Host   string       `json:"host,omitempty"`
+		Port   types.Port   `json:"port,omitempty"`
+		Root   string       `json:"root,omitempty"`
+
+		types.HTTPConfig
+		PathPatterns []string                   `json:"path_patterns,omitempty"`
+		Rules        rules.Rules                `json:"rules,omitempty" validate:"omitempty,unique=Name"`
+		HealthCheck  *health.HealthCheckConfig  `json:"healthcheck,omitempty"`
+		LoadBalance  *loadbalance.Config        `json:"load_balance,omitempty"`
+		Middlewares  map[string]docker.LabelMap `json:"middlewares,omitempty"`
+		Homepage     *homepage.Item             `json:"homepage,omitempty"`
+		AccessLog    *accesslog.Config          `json:"access_log,omitempty"`
+
+		Metadata `deserialize:"-"`
 	}
-	RawEntry   = types.RawEntry
-	RawEntries = types.RawEntries
+
+	Metadata struct {
+		/* Docker only */
+		Container *docker.Container `json:"container,omitempty"`
+		Provider  string            `json:"provider,omitempty"`
+
+		// private fields
+		LisURL      *net.URL            `json:"lurl,omitempty"`
+		ProxyURL    *net.URL            `json:"purl,omitempty"`
+		Idlewatcher *idlewatcher.Config `json:"idlewatcher,omitempty"`
+
+		impl        types.Route
+		isValidated bool
+	}
+	Routes map[string]*Route
 )

-// function alias.
-var (
-	NewRoutes       = F.NewMap[Routes]
-	NewProxyEntries = types.NewProxyEntries
-)
-
-func (rt *Route) Container() *docker.Container {
-	if rt.Entry.Container == nil {
-		return docker.DummyContainer
-	}
-	return rt.Entry.Container
+func (r Routes) Contains(alias string) bool {
+	_, ok := r[alias]
+	return ok
 }

-func NewRoute(raw *RawEntry) (*Route, E.Error) {
-	raw.Finalize()
-	en, err := entry.ValidateEntry(raw)
-	if err != nil {
-		return nil, err
+func (r *Route) Validate() (err E.Error) {
+	if r.isValidated {
+		return nil
 	}
+	r.isValidated = true
+	r.Finalize()

-	var t types.RouteType
-	var rt impl
+	errs := E.NewBuilder("entry validation failed")

-	switch e := en.(type) {
-	case *entry.StreamEntry:
-		t = types.RouteTypeStream
-		rt, err = NewStreamRoute(e)
-	case *entry.ReverseProxyEntry:
-		t = types.RouteTypeReverseProxy
-		rt, err = NewHTTPRoute(e)
+	switch r.Scheme {
+	case types.SchemeFileServer:
+		r.impl, err = NewFileServer(r)
+		if err != nil {
+			errs.Add(err)
+		}
+	case types.SchemeHTTP, types.SchemeHTTPS:
+		if r.Port.Listening != 0 {
+			errs.Addf("unexpected listening port for %s scheme", r.Scheme)
+		}
+		fallthrough
+	case types.SchemeTCP, types.SchemeUDP:
+		r.LisURL = E.Collect(errs, net.ParseURL, fmt.Sprintf("%s://%s:%d", r.Scheme, r.Host, r.Port.Listening))
+		fallthrough
 	default:
-		panic("bug: should not reach here")
+		if r.LoadBalance != nil && r.LoadBalance.Link == "" {
+			r.LoadBalance = nil
+		}
+		r.ProxyURL = E.Collect(errs, net.ParseURL, fmt.Sprintf("%s://%s:%d", r.Scheme, r.Host, r.Port.Proxy))
+		r.Idlewatcher = E.Collect(errs, idlewatcher.ValidateConfig, r.Container)
 	}
-	if err != nil {
-		return nil, err
+
+	if !r.UseHealthCheck() && (r.UseLoadBalance() || r.UseIdleWatcher()) {
+		errs.Adds("healthCheck.disable cannot be true when loadbalancer or idlewatcher is enabled")
 	}
-	return &Route{
-		impl:  rt,
-		Type:  t,
-		Entry: raw,
-	}, nil
+
+	if errs.HasError() {
+		return errs.Error()
+	}
+
+	switch r.Scheme {
+	case types.SchemeFileServer:
+		r.impl, err = NewFileServer(r)
+	case types.SchemeHTTP, types.SchemeHTTPS:
+		r.impl, err = NewReverseProxyRoute(r)
+	case types.SchemeTCP, types.SchemeUDP:
+		r.impl, err = NewStreamRoute(r)
+	default:
+		panic(fmt.Errorf("unexpected scheme %s for alias %s", r.Scheme, r.Alias))
+	}
+
+	return err
 }

-func FromEntries(provider string, entries RawEntries) (Routes, E.Error) {
-	b := E.NewBuilder("errors in routes")
+func (r *Route) Start(parent task.Parent) (err E.Error) {
+	if r.impl == nil {
+		return E.New("route not initialized")
+	}
+	return r.impl.Start(parent)
+}

-	routes := NewRoutes()
-	entries.RangeAllParallel(func(alias string, en *RawEntry) {
-		if en == nil {
-			en = new(RawEntry)
-		}
-		en.Alias = alias
-		en.Provider = provider
-		if strings.HasPrefix(alias, "x-") { // x properties
-			return
-		}
-		r, err := NewRoute(en)
+func (r *Route) Finish(reason any) {
+	if r.impl == nil {
+		return
+	}
+	r.impl.Finish(reason)
+	r.impl = nil
+}
+
+func (r *Route) Started() bool {
+	return r.impl != nil
+}
+
+func (r *Route) ProviderName() string {
+	return r.Provider
+}
+
+func (r *Route) TargetName() string {
+	return r.Alias
+}
+
+func (r *Route) TargetURL() *net.URL {
+	return r.ProxyURL
+}
+
+func (r *Route) Type() types.RouteType {
+	switch r.Scheme {
+	case types.SchemeHTTP, types.SchemeHTTPS, types.SchemeFileServer:
+		return types.RouteTypeHTTP
+	case types.SchemeTCP, types.SchemeUDP:
+		return types.RouteTypeStream
+	}
+	panic(fmt.Errorf("unexpected scheme %s for alias %s", r.Scheme, r.Alias))
+}
+
+func (r *Route) HealthMonitor() health.HealthMonitor {
+	return r.impl.HealthMonitor()
+}
+
+func (r *Route) IdlewatcherConfig() *idlewatcher.Config {
+	return r.Idlewatcher
+}
+
+func (r *Route) HealthCheckConfig() *health.HealthCheckConfig {
+	return r.HealthCheck
+}
+
+func (r *Route) LoadBalanceConfig() *loadbalance.Config {
+	return r.LoadBalance
+}
+
+func (r *Route) HomepageConfig() *homepage.Item {
+	return r.Homepage
+}
+
+func (r *Route) ContainerInfo() *docker.Container {
+	return r.Container
+}
+
+func (r *Route) IsDocker() bool {
+	if r.Container == nil {
+		return false
+	}
+	return r.Container.ContainerID != ""
+}
+
+func (r *Route) IsZeroPort() bool {
+	return r.Port.Proxy == 0
+}
+
+func (r *Route) ShouldExclude() bool {
+	if r.Container != nil {
 		switch {
-		case err != nil:
-			b.Add(err.Subject(alias))
-		case entry.ShouldNotServe(r):
-			return
-		default:
-			routes.Store(alias, r)
+		case r.Container.IsExcluded:
+			return true
+		case r.IsZeroPort() && !r.UseIdleWatcher():
+			return true
+		case r.Container.IsDatabase && !r.Container.IsExplicit:
+			return true
+		case strings.HasPrefix(r.Container.ContainerName, "buildx_"):
+			return true
 		}
-	})
-
-	return routes, b.Error()
+	} else if r.IsZeroPort() {
+		return true
+	}
+	if strings.HasPrefix(r.Alias, "x-") ||
+		strings.HasSuffix(r.Alias, "-old") {
+		return true
+	}
+	return false
+}
+
+func (r *Route) UseLoadBalance() bool {
+	return r.LoadBalance != nil && r.LoadBalance.Link != ""
+}
+
+func (r *Route) UseIdleWatcher() bool {
+	return r.Idlewatcher != nil && r.Idlewatcher.IdleTimeout > 0
+}
+
+func (r *Route) UseHealthCheck() bool {
+	return !r.HealthCheck.Disable
+}
+
+func (r *Route) UseAccessLog() bool {
+	return r.AccessLog != nil
+}
+
+func (r *Route) Finalize() {
+	r.Alias = strings.ToLower(strings.TrimSpace(r.Alias))
+	r.Host = strings.ToLower(strings.TrimSpace(r.Host))
+
+	isDocker := r.Container != nil
+	cont := r.Container
+
+	if r.Host == "" {
+		switch {
+		case !isDocker:
+			r.Host = "localhost"
+		case cont.PrivateIP != "":
+			r.Host = cont.PrivateIP
+		case cont.PublicIP != "":
+			r.Host = cont.PublicIP
+		}
+	}
+
+	lp, pp := r.Port.Listening, r.Port.Proxy
+
+	if isDocker {
+		if port, ok := common.ServiceNamePortMapTCP[cont.ImageName]; ok {
+			if pp == 0 {
+				pp = port
+			}
+			if r.Scheme == "" {
+				r.Scheme = "tcp"
+			}
+		} else if port, ok := common.ImageNamePortMap[cont.ImageName]; ok {
+			if pp == 0 {
+				pp = port
+			}
+			if r.Scheme == "" {
+				r.Scheme = "http"
+			}
+		}
+	}
+
+	if pp == 0 {
+		switch {
+		case r.Scheme == "https":
+			pp = 443
+		case !isDocker:
+			pp = 80
+		default:
+			pp = lowestPort(cont.PrivatePortMapping)
+			if pp == 0 {
+				pp = lowestPort(cont.PublicPortMapping)
+			}
+		}
+	}
+
+	if isDocker {
+		// replace private port with public port if using public IP.
+		if r.Host == cont.PublicIP {
+			if p, ok := cont.PrivatePortMapping[pp]; ok {
+				pp = int(p.PublicPort)
+			}
+		}
+		// replace public port with private port if using private IP.
+		if r.Host == cont.PrivateIP {
+			if p, ok := cont.PublicPortMapping[pp]; ok {
+				pp = int(p.PrivatePort)
+			}
+		}
+
+		if r.Scheme == "" {
+			switch {
+			case r.Host == cont.PublicIP && cont.PublicPortMapping[pp].Type == "udp":
+				r.Scheme = "udp"
+			case r.Host == cont.PrivateIP && cont.PrivatePortMapping[pp].Type == "udp":
+				r.Scheme = "udp"
+			}
+		}
+	}
+
+	if r.Scheme == "" {
+		switch {
+		case lp != 0:
+			r.Scheme = "tcp"
+		case strings.HasSuffix(strconv.Itoa(pp), "443"):
+			r.Scheme = "https"
+		default: // assume its http
+			r.Scheme = "http"
+		}
+	}
+
+	r.Port.Listening, r.Port.Proxy = lp, pp
+
+	if r.HealthCheck == nil {
+		r.HealthCheck = health.DefaultHealthConfig
+	}
+
+	if !r.HealthCheck.Disable {
+		if r.HealthCheck.Interval == 0 {
+			r.HealthCheck.Interval = common.HealthCheckIntervalDefault
+		}
+		if r.HealthCheck.Timeout == 0 {
+			r.HealthCheck.Timeout = common.HealthCheckTimeoutDefault
+		}
+	}
+
+	if isDocker && cont.IdleTimeout != "" {
+		if cont.WakeTimeout == "" {
+			cont.WakeTimeout = common.WakeTimeoutDefault
+		}
+		if cont.StopTimeout == "" {
+			cont.StopTimeout = common.StopTimeoutDefault
+		}
+		if cont.StopMethod == "" {
+			cont.StopMethod = common.StopMethodDefault
+		}
+	}
+
+	if r.Homepage.IsEmpty() {
+		r.Homepage = homepage.NewItem(r.Alias)
+	}
+}
+
+func lowestPort(ports map[int]dockertypes.Port) (res int) {
+	cmp := (uint16)(65535)
+	for port, v := range ports {
+		if v.PrivatePort < cmp {
+			cmp = v.PrivatePort
+			res = port
+		}
+	}
+	return
 }
--- a/internal/route/routes/routequery/query.go
+++ b/internal/route/routes/routequery/query.go
@@ -6,7 +6,6 @@ import (

 	"github.com/yusing/go-proxy/internal"
 	"github.com/yusing/go-proxy/internal/homepage"
-	"github.com/yusing/go-proxy/internal/route/entry"
 	provider "github.com/yusing/go-proxy/internal/route/provider/types"
 	"github.com/yusing/go-proxy/internal/route/routes"
 	route "github.com/yusing/go-proxy/internal/route/types"
@@ -44,15 +43,15 @@ func HomepageCategories() []string {
 	check := make(map[string]struct{})
 	categories := make([]string, 0)
 	routes.GetHTTPRoutes().RangeAll(func(alias string, r route.HTTPRoute) {
-		en := r.RawEntry()
-		if en.Homepage.IsEmpty() || en.Homepage.Category == "" {
+		homepage := r.HomepageConfig()
+		if homepage.IsEmpty() || homepage.Category == "" {
 			return
 		}
-		if _, ok := check[en.Homepage.Category]; ok {
+		if _, ok := check[homepage.Category]; ok {
 			return
 		}
-		check[en.Homepage.Category] = struct{}{}
-		categories = append(categories, en.Homepage.Category)
+		check[homepage.Category] = struct{}{}
+		categories = append(categories, homepage.Category)
 	})
 	return categories
 }
@@ -61,8 +60,7 @@ func HomepageConfig(useDefaultCategories bool, categoryFilter, providerFilter st
 	hpCfg := homepage.NewHomePageConfig()

 	routes.GetHTTPRoutes().RangeAll(func(alias string, r route.HTTPRoute) {
-		en := r.RawEntry()
-		item := en.Homepage
+		item := r.HomepageConfig()

 		if item.IsEmpty() {
 			item = homepage.NewItem(alias)
@@ -78,7 +76,7 @@ func HomepageConfig(useDefaultCategories bool, categoryFilter, providerFilter st
 		}

 		item.Alias = alias
-		item.Provider = r.RawEntry().Provider
+		item.Provider = r.ProviderName()

 		if providerFilter != "" && item.Provider != providerFilter {
 			return
@@ -86,7 +84,7 @@ func HomepageConfig(useDefaultCategories bool, categoryFilter, providerFilter st

 		if item.Name == "" {
 			reference := r.TargetName()
-			cont := r.RawEntry().Container
+			cont := r.ContainerInfo()
 			if cont != nil {
 				reference = cont.ImageName
 			}
@@ -104,8 +102,9 @@ func HomepageConfig(useDefaultCategories bool, categoryFilter, providerFilter st
 		}

 		if useDefaultCategories {
-			if en.Container != nil && item.Category == "" {
-				if category, ok := homepage.PredefinedCategories[en.Container.ImageName]; ok {
+			container := r.ContainerInfo()
+			if container != nil && item.Category == "" {
+				if category, ok := homepage.PredefinedCategories[container.ImageName]; ok {
 					item.Category = category
 				}
 			}
@@ -122,12 +121,12 @@ func HomepageConfig(useDefaultCategories bool, categoryFilter, providerFilter st
 		}

 		switch {
-		case entry.IsDocker(r):
+		case r.IsDocker():
 			if item.Category == "" {
 				item.Category = "Docker"
 			}
 			item.SourceType = string(provider.ProviderTypeDocker)
-		case entry.UseLoadBalance(r):
+		case r.UseLoadBalance():
 			if item.Category == "" {
 				item.Category = "Load-balanced"
 			}
@@ -148,11 +147,11 @@ func HomepageConfig(useDefaultCategories bool, categoryFilter, providerFilter st
 func RoutesByAlias(typeFilter ...route.RouteType) map[string]route.Route {
 	rts := make(map[string]route.Route)
 	if len(typeFilter) == 0 || typeFilter[0] == "" {
-		typeFilter = []route.RouteType{route.RouteTypeReverseProxy, route.RouteTypeStream}
+		typeFilter = []route.RouteType{route.RouteTypeHTTP, route.RouteTypeStream}
 	}
 	for _, t := range typeFilter {
 		switch t {
-		case route.RouteTypeReverseProxy:
+		case route.RouteTypeHTTP:
 			routes.GetHTTPRoutes().RangeAll(func(alias string, r route.HTTPRoute) {
 				rts[alias] = r
 			})
--- a/internal/route/rules/do.go
+++ b/internal/route/rules/do.go
@@ -30,7 +30,8 @@ const (
 	CommandSet              = "set"
 	CommandAdd              = "add"
 	CommandRemove           = "remove"
-	CommandBypass           = "bypass"
+	CommandPass             = "pass"
+	CommandPassAlt          = "bypass"
 )

 var commands = map[string]struct {
@@ -94,7 +95,7 @@ var commands = map[string]struct {
 		},
 		validate: validateURL,
 		build: func(args any) CommandHandler {
-			target := args.(types.URL).String()
+			target := args.(*types.URL).String()
 			return ReturningCommand(func(w http.ResponseWriter, r *http.Request) {
 				http.Redirect(w, r, target, http.StatusTemporaryRedirect)
 			})
@@ -159,7 +160,7 @@ var commands = map[string]struct {
 		},
 		validate: validateAbsoluteURL,
 		build: func(args any) CommandHandler {
-			target := args.(types.URL)
+			target := args.(*types.URL)
 			if target.Scheme == "" {
 				target.Scheme = "http"
 			}
@@ -231,7 +232,7 @@ func (cmd *Command) Parse(v string) error {
 			return err
 		}

-		if directive == CommandBypass {
+		if directive == CommandPass || directive == CommandPassAlt {
 			if len(args) != 0 {
 				return ErrInvalidArguments.Subject(directive)
 			}
--- a/internal/route/rules/errors.go
+++ b/internal/route/rules/errors.go
@@ -11,8 +11,8 @@ var (
 	ErrInvalidCommandSequence = E.New("invalid command sequence")
 	ErrInvalidSetTarget       = E.New("invalid `rule.set` target")

-	ErrExpectNoArg       = E.New("expect no arg")
-	ErrExpectOneArg      = E.New("expect 1 arg")
-	ErrExpectTwoArgs     = E.New("expect 2 args")
-	ErrExpectKVOptionalV = E.New("expect 'key' or 'key value'")
+	ErrExpectNoArg       = E.Wrap(ErrInvalidArguments, "expect no arg")
+	ErrExpectOneArg      = E.Wrap(ErrInvalidArguments, "expect 1 arg")
+	ErrExpectTwoArgs     = E.Wrap(ErrInvalidArguments, "expect 2 args")
+	ErrExpectKVOptionalV = E.Wrap(ErrInvalidArguments, "expect 'key' or 'key value'")
 )
--- a/internal/route/rules/on_test.go
+++ b/internal/route/rules/on_test.go
@@ -212,7 +212,7 @@ func TestOnCorrectness(t *testing.T) {
 		},
 		{
 			name:    "basic_auth_correct",
-			checker: "basic_auth user " + string(E.Must(bcrypt.GenerateFromPassword([]byte("password"), bcrypt.DefaultCost))),
+			checker: "basic_auth user " + string(Must(bcrypt.GenerateFromPassword([]byte("password"), bcrypt.DefaultCost))),
 			input: &http.Request{
 				Header: http.Header{
 					"Authorization": {"Basic " + base64.StdEncoding.EncodeToString([]byte("user:password"))}, // "user:password"
@@ -222,7 +222,7 @@ func TestOnCorrectness(t *testing.T) {
 		},
 		{
 			name:    "basic_auth_incorrect",
-			checker: "basic_auth user " + string(E.Must(bcrypt.GenerateFromPassword([]byte("password"), bcrypt.DefaultCost))),
+			checker: "basic_auth user " + string(Must(bcrypt.GenerateFromPassword([]byte("password"), bcrypt.DefaultCost))),
 			input: &http.Request{
 				Header: http.Header{
 					"Authorization": {"Basic " + base64.StdEncoding.EncodeToString([]byte("user:incorrect"))}, // "user:wrong"
@@ -234,7 +234,8 @@ func TestOnCorrectness(t *testing.T) {

 	tests = append(tests, genCorrectnessTestCases("header", func(k, v string) *http.Request {
 		return &http.Request{
-			Header: http.Header{k: []string{v}}}
+			Header: http.Header{k: []string{v}},
+		}
 	})...)
 	tests = append(tests, genCorrectnessTestCases("query", func(k, v string) *http.Request {
 		return &http.Request{
--- a/internal/route/rules/rules.go
+++ b/internal/route/rules/rules.go
@@ -39,7 +39,7 @@ type (
 		one match means this line is matched.
 	*/
 	Rule struct {
-		Name string  `json:"name" validate:"required"`
+		Name string  `json:"name"`
 		On   RuleOn  `json:"on"`
 		Do   Command `json:"do"`
 	}
--- a/internal/route/stream.go
+++ b/internal/route/stream.go
@@ -10,8 +10,8 @@ import (
 	E "github.com/yusing/go-proxy/internal/error"
 	"github.com/yusing/go-proxy/internal/logging"
 	net "github.com/yusing/go-proxy/internal/net/types"
-	"github.com/yusing/go-proxy/internal/route/entry"
 	"github.com/yusing/go-proxy/internal/route/routes"
+	route "github.com/yusing/go-proxy/internal/route/types"
 	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/internal/watcher/health"
 	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
@@ -19,7 +19,7 @@ import (

 // TODO: support stream load balance.
 type StreamRoute struct {
-	*entry.StreamEntry
+	*Route

 	net.Stream `json:"-"`

@@ -30,16 +30,13 @@ type StreamRoute struct {
 	l zerolog.Logger
 }

-func NewStreamRoute(entry *entry.StreamEntry) (impl, E.Error) {
+func NewStreamRoute(base *Route) (route.Route, E.Error) {
 	// TODO: support non-coherent scheme
-	if !entry.Scheme.IsCoherent() {
-		return nil, E.Errorf("unsupported scheme: %v -> %v", entry.Scheme.ListeningScheme, entry.Scheme.ProxyScheme)
-	}
 	return &StreamRoute{
-		StreamEntry: entry,
+		Route: base,
 		l: logging.With().
-			Str("type", string(entry.Scheme.ListeningScheme)).
-			Str("name", entry.TargetName()).
+			Str("type", string(base.Scheme)).
+			Str("name", base.TargetName()).
 			Logger(),
 	}, nil
 }
@@ -50,10 +47,6 @@ func (r *StreamRoute) String() string {

 // Start implements task.TaskStarter.
 func (r *StreamRoute) Start(parent task.Parent) E.Error {
-	if entry.ShouldNotServe(r) {
-		return nil
-	}
-
 	r.task = parent.Subtask("stream." + r.TargetName())
 	r.Stream = NewStream(r)
 	parent.OnCancel("finish", func() {
@@ -61,25 +54,25 @@ func (r *StreamRoute) Start(parent task.Parent) E.Error {
 	})

 	switch {
-	case entry.UseIdleWatcher(r):
-		waker, err := idlewatcher.NewStreamWaker(parent, r.StreamEntry, r.Stream)
+	case r.UseIdleWatcher():
+		waker, err := idlewatcher.NewStreamWaker(parent, r, r.Stream)
 		if err != nil {
 			r.task.Finish(err)
 			return err
 		}
 		r.Stream = waker
 		r.HealthMon = waker
-	case entry.UseHealthCheck(r):
-		if entry.IsDocker(r) {
-			client, err := docker.ConnectClient(r.Idlewatcher.DockerHost)
+	case r.UseHealthCheck():
+		if r.IsDocker() {
+			client, err := docker.ConnectClient(r.IdlewatcherConfig().DockerHost)
 			if err == nil {
-				fallback := monitor.NewRawHealthChecker(r.TargetURL(), r.Raw.HealthCheck)
-				r.HealthMon = monitor.NewDockerHealthMonitor(client, r.Idlewatcher.ContainerID, r.TargetName(), r.Raw.HealthCheck, fallback)
+				fallback := monitor.NewRawHealthChecker(r.TargetURL(), r.HealthCheck)
+				r.HealthMon = monitor.NewDockerHealthMonitor(client, r.IdlewatcherConfig().ContainerID, r.TargetName(), r.HealthCheck, fallback)
 				r.task.OnCancel("close_docker_client", client.Close)
 			}
 		}
 		if r.HealthMon == nil {
-			r.HealthMon = monitor.NewRawHealthMonitor(r.TargetURL(), r.Raw.HealthCheck)
+			r.HealthMon = monitor.NewRawHealthMonitor(r.TargetURL(), r.HealthCheck)
 		}
 	}

@@ -88,9 +81,7 @@ func (r *StreamRoute) Start(parent task.Parent) E.Error {
 		return E.From(err)
 	}

-	r.l.Info().
-		Int("port", int(r.Port.ListeningPort)).
-		Msg("listening")
+	r.l.Info().Int("port", r.Port.Listening).Msg("listening")

 	if r.HealthMon != nil {
 		if err := r.HealthMon.Start(r.task); err != nil {
--- a/internal/route/stream_impl.go
+++ b/internal/route/stream_impl.go
@@ -8,7 +8,6 @@ import (
 	"time"

 	"github.com/yusing/go-proxy/internal/net/types"
-	T "github.com/yusing/go-proxy/internal/route/types"
 	U "github.com/yusing/go-proxy/internal/utils"
 )

@@ -45,25 +44,25 @@ func (stream *Stream) Setup() error {

 	ctx := stream.task.Context()

-	switch stream.Scheme.ListeningScheme {
+	switch stream.Scheme {
 	case "tcp":
-		stream.targetAddr, err = net.ResolveTCPAddr("tcp", stream.URL.Host)
+		stream.targetAddr, err = net.ResolveTCPAddr("tcp", stream.ProxyURL.Host)
 		if err != nil {
 			return err
 		}
-		tcpListener, err := lcfg.Listen(ctx, "tcp", stream.ListenURL.Host)
+		tcpListener, err := lcfg.Listen(ctx, "tcp", stream.LisURL.Host)
 		if err != nil {
 			return err
 		}
 		// in case ListeningPort was zero, get the actual port
-		stream.Port.ListeningPort = T.Port(tcpListener.Addr().(*net.TCPAddr).Port)
+		stream.Port.Listening = tcpListener.Addr().(*net.TCPAddr).Port
 		stream.listener = types.NetListener(tcpListener)
 	case "udp":
-		stream.targetAddr, err = net.ResolveUDPAddr("udp", stream.URL.Host)
+		stream.targetAddr, err = net.ResolveUDPAddr("udp", stream.ProxyURL.Host)
 		if err != nil {
 			return err
 		}
-		udpListener, err := lcfg.ListenPacket(ctx, "udp", stream.ListenURL.Host)
+		udpListener, err := lcfg.ListenPacket(ctx, "udp", stream.LisURL.Host)
 		if err != nil {
 			return err
 		}
@@ -72,7 +71,7 @@ func (stream *Stream) Setup() error {
 			udpListener.Close()
 			return errors.New("udp listener is not *net.UDPConn")
 		}
-		stream.Port.ListeningPort = T.Port(udpConn.LocalAddr().(*net.UDPAddr).Port)
+		stream.Port.Listening = udpConn.LocalAddr().(*net.UDPAddr).Port
 		stream.listener = NewUDPForwarder(ctx, udpConn, stream.targetAddr)
 	default:
 		panic("should not reach here")
--- a/internal/route/types/entry.go
+++ b/internal/route/types/entry.go
@@ -1,13 +0,0 @@
-package types
-
-import (
-	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
-	net "github.com/yusing/go-proxy/internal/net/types"
-)
-
-type Entry interface {
-	TargetName() string
-	TargetURL() net.URL
-	RawEntry() *RawEntry
-	IdlewatcherConfig() *idlewatcher.Config
-}
--- a/internal/route/types/headers.go
+++ b/internal/route/types/headers.go
@@ -1,19 +0,0 @@
-package types
-
-import (
-	"net/http"
-
-	E "github.com/yusing/go-proxy/internal/error"
-	"github.com/yusing/go-proxy/internal/utils/strutils"
-)
-
-func ValidateHTTPHeaders(headers map[string]string) (http.Header, E.Error) {
-	h := make(http.Header)
-	for k, v := range headers {
-		vSplit := strutils.CommaSeperatedList(v)
-		for _, header := range vSplit {
-			h.Add(k, header)
-		}
-	}
-	return h, nil
-}
--- a/internal/route/types/http_config_test.go
+++ b/internal/route/types/http_config_test.go
@@ -1,9 +1,11 @@
-package types
+package types_test

 import (
 	"testing"
 	"time"

+	. "github.com/yusing/go-proxy/internal/route"
+	"github.com/yusing/go-proxy/internal/route/types"
 	"github.com/yusing/go-proxy/internal/utils"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )
@@ -12,14 +14,14 @@ func TestHTTPConfigDeserialize(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    map[string]any
-		expected HTTPConfig
+		expected types.HTTPConfig
 	}{
 		{
 			name: "no_tls_verify",
 			input: map[string]any{
 				"no_tls_verify": "true",
 			},
-			expected: HTTPConfig{
+			expected: types.HTTPConfig{
 				NoTLSVerify: true,
 			},
 		},
@@ -28,7 +30,7 @@ func TestHTTPConfigDeserialize(t *testing.T) {
 			input: map[string]any{
 				"response_header_timeout": "1s",
 			},
-			expected: HTTPConfig{
+			expected: types.HTTPConfig{
 				ResponseHeaderTimeout: 1 * time.Second,
 			},
 		},
@@ -36,7 +38,7 @@ func TestHTTPConfigDeserialize(t *testing.T) {

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			cfg := RawEntry{}
+			cfg := Route{}
 			err := utils.Deserialize(tt.input, &cfg)
 			if err != nil {
 				ExpectNoError(t, err)
--- a/internal/route/types/port.go
+++ b/internal/route/types/port.go
@@ -7,37 +7,55 @@ import (
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

-type Port int
+type Port struct {
+	Listening int `json:"listening"`
+	Proxy     int `json:"proxy"`
+}

-var ErrPortOutOfRange = E.New("port out of range")
+var (
+	ErrInvalidPortSyntax = E.New("invalid port syntax, expect [listening_port:]target_port")
+	ErrPortOutOfRange    = E.New("port out of range")
+)
+
+// Parse implements strutils.Parser.
+func (p *Port) Parse(v string) (err error) {
+	parts := strutils.SplitRune(v, ':')
+	switch len(parts) {
+	case 1:
+		p.Listening = 0
+		p.Proxy, err = strconv.Atoi(v)
+	case 2:
+		var err2 error
+		p.Listening, err = strconv.Atoi(parts[0])
+		p.Proxy, err2 = strconv.Atoi(parts[1])
+		err = E.Join(err, err2)
+	default:
+		return ErrInvalidPortSyntax.Subject(v)
+	}

-func ValidatePort[String ~string](v String) (Port, error) {
-	p, err := strutils.Atoi(string(v))
 	if err != nil {
-		return ErrPort, err
+		return err
 	}
-	return ValidatePortInt(p)
-}

-func ValidatePortInt[Int int | uint16](v Int) (Port, error) {
-	p := Port(v)
-	if !p.inBound() {
-		return ErrPort, ErrPortOutOfRange.Subject(strconv.Itoa(int(p)))
+	if p.Listening < MinPort || p.Listening > MaxPort {
+		return ErrPortOutOfRange.Subjectf("%d", p.Listening)
 	}
-	return p, nil
+
+	if p.Proxy < MinPort || p.Proxy > MaxPort {
+		return ErrPortOutOfRange.Subjectf("%d", p.Proxy)
+	}
+
+	return nil
 }

-func (p Port) inBound() bool {
-	return p >= MinPort && p <= MaxPort
-}
-
-func (p Port) String() string {
-	return strconv.Itoa(int(p))
+func (p *Port) String() string {
+	if p.Listening == 0 {
+		return strconv.Itoa(p.Proxy)
+	}
+	return strconv.Itoa(p.Listening) + ":" + strconv.Itoa(p.Proxy)
 }

 const (
 	MinPort = 0
 	MaxPort = 65535
-	ErrPort = Port(-1)
-	NoPort  = Port(0)
 )
--- a/internal/route/types/port_test.go
+++ b/internal/route/types/port_test.go
@@ -0,0 +1,106 @@
+package types
+
+import (
+	"errors"
+	"strconv"
+	"testing"
+)
+
+var invalidPorts = []string{
+	"",
+	"123:",
+	"0:",
+	":1234",
+	"qwerty",
+	"asdfgh:asdfgh",
+	"1234:asdfgh",
+}
+
+var tooManyColonsPorts = []string{
+	"1234:1234:1234",
+}
+
+var outOfRangePorts = []string{
+	"-1:1234",
+	"1234:-1",
+	"65536",
+	"0:65536",
+}
+
+func TestPortInvalid(t *testing.T) {
+	tests := []struct {
+		name    string
+		inputs  []string
+		wantErr error
+	}{
+		{
+			name:    "invalid",
+			inputs:  invalidPorts,
+			wantErr: strconv.ErrSyntax,
+		},
+
+		{
+			name:    "too many colons",
+			inputs:  tooManyColonsPorts,
+			wantErr: ErrInvalidPortSyntax,
+		},
+		{
+			name:    "out of range",
+			inputs:  outOfRangePorts,
+			wantErr: ErrPortOutOfRange,
+		},
+	}
+
+	for _, tc := range tests {
+		for _, input := range tc.inputs {
+			t.Run(tc.name, func(t *testing.T) {
+				p := &Port{}
+				err := p.Parse(input)
+				if !errors.Is(err, tc.wantErr) {
+					t.Errorf("expected error %v, got %v", tc.wantErr, err)
+				}
+			})
+		}
+	}
+}
+
+func TestPortValid(t *testing.T) {
+	tests := []struct {
+		name   string
+		inputs string
+		expect Port
+	}{
+		{
+			name:   "valid_lp",
+			inputs: "1234:5678",
+			expect: Port{
+				Listening: 1234,
+				Proxy:     5678,
+			},
+		},
+		{
+			name:   "valid_p",
+			inputs: "5678",
+			expect: Port{
+				Listening: 0,
+				Proxy:     5678,
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			p := &Port{}
+			err := p.Parse(tc.inputs)
+			if err != nil {
+				t.Errorf("expected no error, got %v", err)
+			}
+			if p.Listening != tc.expect.Listening {
+				t.Errorf("expected listening port %d, got %d", tc.expect.Listening, p.Listening)
+			}
+			if p.Proxy != tc.expect.Proxy {
+				t.Errorf("expected proxy port %d, got %d", tc.expect.Proxy, p.Proxy)
+			}
+		})
+	}
+}
--- a/internal/route/types/raw_entry.go
+++ b/internal/route/types/raw_entry.go
@@ -1,221 +0,0 @@
-//nolint:goconst
-package types
-
-import (
-	"strconv"
-	"strings"
-
-	"github.com/docker/docker/api/types"
-	"github.com/yusing/go-proxy/internal/common"
-	"github.com/yusing/go-proxy/internal/docker"
-	"github.com/yusing/go-proxy/internal/homepage"
-	"github.com/yusing/go-proxy/internal/logging"
-	"github.com/yusing/go-proxy/internal/net/http/accesslog"
-	loadbalance "github.com/yusing/go-proxy/internal/net/http/loadbalancer/types"
-	"github.com/yusing/go-proxy/internal/route/rules"
-	U "github.com/yusing/go-proxy/internal/utils"
-	F "github.com/yusing/go-proxy/internal/utils/functional"
-	"github.com/yusing/go-proxy/internal/utils/strutils"
-	"github.com/yusing/go-proxy/internal/watcher/health"
-)
-
-type (
-	RawEntry struct {
-		_ U.NoCopy
-
-		// raw entry object before validation
-		// loaded from docker labels or yaml file
-		Alias  string `json:"alias"`
-		Scheme string `json:"scheme,omitempty"`
-		Host   string `json:"host,omitempty"`
-		Port   string `json:"port,omitempty"`
-
-		HTTPConfig
-		PathPatterns []string                   `json:"path_patterns,omitempty"`
-		Rules        rules.Rules                `json:"rules,omitempty" validate:"omitempty,unique=Name"`
-		HealthCheck  *health.HealthCheckConfig  `json:"healthcheck,omitempty"`
-		LoadBalance  *loadbalance.Config        `json:"load_balance,omitempty"`
-		Middlewares  map[string]docker.LabelMap `json:"middlewares,omitempty"`
-		Homepage     *homepage.Item             `json:"homepage,omitempty"`
-		AccessLog    *accesslog.Config          `json:"access_log,omitempty"`
-
-		/* Docker only */
-		Container *docker.Container `json:"container,omitempty"`
-		Provider  string            `json:"provider,omitempty"`
-
-		finalized bool
-	}
-
-	RawEntries = F.Map[string, *RawEntry]
-)
-
-var NewProxyEntries = F.NewMapOf[string, *RawEntry]
-
-func (e *RawEntry) Finalize() {
-	if e.finalized {
-		return
-	}
-
-	isDocker := e.Container != nil
-	cont := e.Container
-	if !isDocker {
-		cont = docker.DummyContainer
-	}
-
-	if e.Host == "" {
-		switch {
-		case cont.PrivateIP != "":
-			e.Host = cont.PrivateIP
-		case cont.PublicIP != "":
-			e.Host = cont.PublicIP
-		case !isDocker:
-			e.Host = "localhost"
-		}
-	}
-
-	lp, pp, extra := e.splitPorts()
-
-	if port, ok := common.ServiceNamePortMapTCP[cont.ImageName]; ok {
-		if pp == "" {
-			pp = strconv.Itoa(port)
-		}
-		if e.Scheme == "" {
-			e.Scheme = "tcp"
-		}
-	} else if port, ok := common.ImageNamePortMap[cont.ImageName]; ok {
-		if pp == "" {
-			pp = strconv.Itoa(port)
-		}
-		if e.Scheme == "" {
-			e.Scheme = "http"
-		}
-	} else if pp == "" && e.Scheme == "https" {
-		pp = "443"
-	} else if pp == "" {
-		if p := lowestPort(cont.PrivatePortMapping); p != "" {
-			pp = p
-		} else if p := lowestPort(cont.PublicPortMapping); p != "" {
-			pp = p
-		} else if !isDocker {
-			pp = "80"
-		} else {
-			logging.Debug().Msg("no port found for " + e.Alias)
-		}
-	}
-
-	// replace private port with public port if using public IP.
-	if e.Host == cont.PublicIP {
-		if p, ok := cont.PrivatePortMapping[pp]; ok {
-			pp = strutils.PortString(p.PublicPort)
-		}
-	}
-	// replace public port with private port if using private IP.
-	if e.Host == cont.PrivateIP {
-		if p, ok := cont.PublicPortMapping[pp]; ok {
-			pp = strutils.PortString(p.PrivatePort)
-		}
-	}
-
-	if e.Scheme == "" && isDocker {
-		switch {
-		case e.Host == cont.PublicIP && cont.PublicPortMapping[pp].Type == "udp":
-			e.Scheme = "udp"
-		case e.Host == cont.PrivateIP && cont.PrivatePortMapping[pp].Type == "udp":
-			e.Scheme = "udp"
-		}
-	}
-
-	if e.Scheme == "" {
-		switch {
-		case lp != "":
-			e.Scheme = "tcp"
-		case strings.HasSuffix(pp, "443"):
-			e.Scheme = "https"
-		default: // assume its http
-			e.Scheme = "http"
-		}
-	}
-
-	if e.HealthCheck == nil {
-		e.HealthCheck = new(health.HealthCheckConfig)
-	}
-
-	if e.HealthCheck.Disable {
-		e.HealthCheck = nil
-	} else {
-		if e.HealthCheck.Interval == 0 {
-			e.HealthCheck.Interval = common.HealthCheckIntervalDefault
-		}
-		if e.HealthCheck.Timeout == 0 {
-			e.HealthCheck.Timeout = common.HealthCheckTimeoutDefault
-		}
-	}
-
-	if cont.IdleTimeout != "" {
-		if cont.WakeTimeout == "" {
-			cont.WakeTimeout = common.WakeTimeoutDefault
-		}
-		if cont.StopTimeout == "" {
-			cont.StopTimeout = common.StopTimeoutDefault
-		}
-		if cont.StopMethod == "" {
-			cont.StopMethod = common.StopMethodDefault
-		}
-	}
-
-	e.Port = joinPorts(lp, pp, extra)
-
-	if e.Port == "" || e.Host == "" {
-		if lp != "" {
-			e.Port = lp + ":0"
-		} else {
-			e.Port = "0"
-		}
-	}
-
-	if e.Homepage.IsEmpty() {
-		e.Homepage = homepage.NewItem(e.Alias)
-	}
-
-	e.finalized = true
-}
-
-func (e *RawEntry) splitPorts() (lp string, pp string, extra string) {
-	portSplit := strutils.SplitRune(e.Port, ':')
-	if len(portSplit) == 1 {
-		pp = portSplit[0]
-	} else {
-		lp = portSplit[0]
-		pp = portSplit[1]
-		if len(portSplit) > 2 {
-			extra = strutils.JoinRune(portSplit[2:], ':')
-		}
-	}
-	return
-}
-
-func joinPorts(lp string, pp string, extra string) string {
-	s := make([]string, 0, 3)
-	if lp != "" {
-		s = append(s, lp)
-	}
-	if pp != "" {
-		s = append(s, pp)
-	}
-	if extra != "" {
-		s = append(s, extra)
-	}
-	return strutils.JoinRune(s, ':')
-}
-
-func lowestPort(ports map[string]types.Port) string {
-	var cmp uint16
-	var res string
-	for port, v := range ports {
-		if v.PrivatePort < cmp || cmp == 0 {
-			cmp = v.PrivatePort
-			res = port
-		}
-	}
-	return res
-}
--- a/internal/route/types/route.go
+++ b/internal/route/types/route.go
@@ -3,14 +3,39 @@ package types
 import (
 	"net/http"

+	"github.com/yusing/go-proxy/internal/docker"
+	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
+	"github.com/yusing/go-proxy/internal/homepage"
 	net "github.com/yusing/go-proxy/internal/net/types"
+	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/internal/watcher/health"
+
+	loadbalance "github.com/yusing/go-proxy/internal/net/http/loadbalancer/types"
 )

 type (
+	//nolint:interfacebloat // this is for avoiding circular imports
 	Route interface {
-		Entry
+		task.TaskStarter
+		task.TaskFinisher
+		ProviderName() string
+		TargetName() string
+		TargetURL() *net.URL
 		HealthMonitor() health.HealthMonitor
+
+		Started() bool
+
+		IdlewatcherConfig() *idlewatcher.Config
+		HealthCheckConfig() *health.HealthCheckConfig
+		LoadBalanceConfig() *loadbalance.Config
+		HomepageConfig() *homepage.Item
+		ContainerInfo() *docker.Container
+
+		IsDocker() bool
+		UseLoadBalance() bool
+		UseIdleWatcher() bool
+		UseHealthCheck() bool
+		UseAccessLog() bool
 	}
 	HTTPRoute interface {
 		Route
--- a/internal/route/types/route_type.go
+++ b/internal/route/types/route_type.go
@@ -3,6 +3,6 @@ package types
 type RouteType string

 const (
-	RouteTypeStream       RouteType = "stream"
-	RouteTypeReverseProxy RouteType = "reverse_proxy"
+	RouteTypeStream RouteType = "stream"
+	RouteTypeHTTP   RouteType = "http"
 )
--- a/internal/route/types/scheme.go
+++ b/internal/route/types/scheme.go
@@ -8,16 +8,22 @@ type Scheme string

 var ErrInvalidScheme = E.New("invalid scheme")

-func NewScheme(s string) (Scheme, error) {
+const (
+	SchemeHTTP       Scheme = "http"
+	SchemeHTTPS      Scheme = "https"
+	SchemeTCP        Scheme = "tcp"
+	SchemeUDP        Scheme = "udp"
+	SchemeFileServer Scheme = "fileserver"
+)
+
+func (s Scheme) Validate() E.Error {
 	switch s {
-	case "http", "https", "tcp", "udp":
-		return Scheme(s), nil
+	case SchemeHTTP, SchemeHTTPS,
+		SchemeTCP, SchemeUDP, SchemeFileServer:
+		return nil
 	}
-	return "", ErrInvalidScheme.Subject(s)
+	return ErrInvalidScheme.Subject(string(s))
 }

-func (s Scheme) IsHTTP() bool   { return s == "http" }
-func (s Scheme) IsHTTPS() bool  { return s == "https" }
-func (s Scheme) IsTCP() bool    { return s == "tcp" }
-func (s Scheme) IsUDP() bool    { return s == "udp" }
-func (s Scheme) IsStream() bool { return s.IsTCP() || s.IsUDP() }
+func (s Scheme) IsReverseProxy() bool { return s == SchemeHTTP || s == SchemeHTTPS }
+func (s Scheme) IsStream() bool       { return s == SchemeTCP || s == SchemeUDP }
--- a/internal/route/types/stream_port.go
+++ b/internal/route/types/stream_port.go
@@ -1,34 +0,0 @@
-package types
-
-import (
-	E "github.com/yusing/go-proxy/internal/error"
-	"github.com/yusing/go-proxy/internal/utils/strutils"
-)
-
-type StreamPort struct {
-	ListeningPort Port `json:"listening"`
-	ProxyPort     Port `json:"proxy"`
-}
-
-var ErrStreamPortTooManyColons = E.New("too many colons")
-
-func ValidateStreamPort(p string) (StreamPort, error) {
-	split := strutils.SplitRune(p, ':')
-
-	switch len(split) {
-	case 1:
-		split = []string{"0", split[0]}
-	case 2:
-		break
-	default:
-		return StreamPort{}, ErrStreamPortTooManyColons.Subject(p)
-	}
-
-	listeningPort, lErr := ValidatePort(split[0])
-	proxyPort, pErr := ValidatePort(split[1])
-	if err := E.Join(lErr, pErr); err != nil {
-		return StreamPort{}, err
-	}
-
-	return StreamPort{listeningPort, proxyPort}, nil
-}
--- a/internal/route/types/stream_port_test.go
+++ b/internal/route/types/stream_port_test.go
@@ -1,54 +0,0 @@
-package types
-
-import (
-	"strconv"
-	"testing"
-
-	. "github.com/yusing/go-proxy/internal/utils/testing"
-)
-
-var validPorts = []string{
-	"1234:5678",
-	"0:2345",
-	"2345",
-}
-
-var invalidPorts = []string{
-	"",
-	"123:",
-	"0:",
-	":1234",
-	"qwerty",
-	"asdfgh:asdfgh",
-	"1234:asdfgh",
-}
-
-var outOfRangePorts = []string{
-	"-1:1234",
-	"1234:-1",
-	"65536",
-	"0:65536",
-}
-
-var tooManyColonsPorts = []string{
-	"1234:1234:1234",
-}
-
-func TestStreamPort(t *testing.T) {
-	for _, port := range validPorts {
-		_, err := ValidateStreamPort(port)
-		ExpectNoError(t, err)
-	}
-	for _, port := range invalidPorts {
-		_, err := ValidateStreamPort(port)
-		ExpectError2(t, port, strconv.ErrSyntax, err)
-	}
-	for _, port := range outOfRangePorts {
-		_, err := ValidateStreamPort(port)
-		ExpectError2(t, port, ErrPortOutOfRange, err)
-	}
-	for _, port := range tooManyColonsPorts {
-		_, err := ValidateStreamPort(port)
-		ExpectError2(t, port, ErrStreamPortTooManyColons, err)
-	}
-}
--- a/internal/route/types/stream_scheme.go
+++ b/internal/route/types/stream_scheme.go
@@ -1,42 +0,0 @@
-package types
-
-import (
-	E "github.com/yusing/go-proxy/internal/error"
-	"github.com/yusing/go-proxy/internal/utils/strutils"
-)
-
-type StreamScheme struct {
-	ListeningScheme Scheme `json:"listening"`
-	ProxyScheme     Scheme `json:"proxy"`
-}
-
-func ValidateStreamScheme(s string) (*StreamScheme, error) {
-	ss := &StreamScheme{}
-	parts := strutils.SplitRune(s, ':')
-	if len(parts) == 1 {
-		parts = []string{s, s}
-	} else if len(parts) != 2 {
-		return nil, ErrInvalidScheme.Subject(s)
-	}
-
-	var lErr, pErr error
-	ss.ListeningScheme, lErr = NewScheme(parts[0])
-	ss.ProxyScheme, pErr = NewScheme(parts[1])
-
-	if err := E.Join(lErr, pErr); err != nil {
-		return nil, err
-	}
-
-	return ss, nil
-}
-
-func (s StreamScheme) String() string {
-	return string(s.ListeningScheme) + " -> " + string(s.ProxyScheme)
-}
-
-// IsCoherent checks if the ListeningScheme and ProxyScheme of the StreamScheme are equal.
-//
-// It returns a boolean value indicating whether the ListeningScheme and ProxyScheme are equal.
-func (s StreamScheme) IsCoherent() bool {
-	return s.ListeningScheme == s.ProxyScheme
-}
--- a/internal/route/types/stream_scheme_test.go
+++ b/internal/route/types/stream_scheme_test.go
@@ -1,37 +0,0 @@
-package types
-
-import (
-	"testing"
-
-	. "github.com/yusing/go-proxy/internal/utils/testing"
-)
-
-var (
-	validStreamSchemes = []string{
-		"tcp:tcp",
-		"tcp:udp",
-		"udp:tcp",
-		"udp:udp",
-		"tcp",
-		"udp",
-	}
-
-	invalidStreamSchemes = []string{
-		"tcp:tcp:",
-		"tcp:",
-		":udp:",
-		":udp",
-		"top",
-	}
-)
-
-func TestNewStreamScheme(t *testing.T) {
-	for _, s := range validStreamSchemes {
-		_, err := ValidateStreamScheme(s)
-		ExpectNoError(t, err)
-	}
-	for _, s := range invalidStreamSchemes {
-		_, err := ValidateStreamScheme(s)
-		ExpectError(t, ErrInvalidScheme, err)
-	}
-}
--- a/internal/setup.go
+++ b/internal/setup.go
@@ -1,127 +0,0 @@
-package internal
-
-import (
-	"io"
-	"log"
-	"net/http"
-	"net/url"
-	"os"
-	"path"
-
-	"github.com/yusing/go-proxy/internal/common"
-)
-
-var (
-	branch          = common.GetEnvString("BRANCH", "v0.9")
-	baseURL         = "https://github.com/yusing/go-proxy/raw/" + branch
-	requiredConfigs = []Config{
-		{common.ConfigBasePath, true, false, ""},
-		{common.DotEnvPath, false, true, common.DotEnvExamplePath},
-		{common.ComposeFileName, false, true, common.ComposeExampleFileName},
-		{path.Join(common.ConfigBasePath, common.ConfigFileName), false, true, common.ConfigExampleFileName},
-	}
-)
-
-type Config struct {
-	Pathname         string
-	IsDir            bool
-	NeedDownload     bool
-	DownloadFileName string
-}
-
-func Setup() {
-	log.Println("setting up go-proxy")
-	log.Println("branch:", branch)
-
-	if err := os.Chdir("/setup"); err != nil {
-		log.Fatalf("failed: %s\n", err)
-	}
-
-	for _, config := range requiredConfigs {
-		config.setup()
-	}
-
-	log.Println("setup finished")
-}
-
-func (c *Config) setup() {
-	if c.IsDir {
-		mkdir(c.Pathname)
-		return
-	}
-	if !c.NeedDownload {
-		touch(c.Pathname)
-		return
-	}
-
-	fetch(c.DownloadFileName, c.Pathname)
-}
-
-func hasFileOrDir(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}
-
-func mkdir(pathname string) {
-	_, err := os.Stat(pathname)
-	if err != nil && os.IsNotExist(err) {
-		log.Printf("creating directory %q\n", pathname)
-		err := os.MkdirAll(pathname, 0o755)
-		if err != nil {
-			log.Fatalf("failed: %s\n", err)
-		}
-		return
-	}
-	if err != nil {
-		log.Fatalf("failed: %s\n", err)
-	}
-}
-
-func touch(pathname string) {
-	if hasFileOrDir(pathname) {
-		return
-	}
-	log.Printf("creating file %q\n", pathname)
-	_, err := os.Create(pathname)
-	if err != nil {
-		log.Fatalf("failed: %s\n", err)
-	}
-}
-
-func fetch(remoteFilename string, outFileName string) {
-	if hasFileOrDir(outFileName) {
-		if remoteFilename == outFileName {
-			log.Printf("%q already exists, not overwriting\n", outFileName)
-			return
-		}
-		log.Printf("%q already exists, downloading to %q\n", outFileName, remoteFilename)
-		outFileName = remoteFilename
-	}
-	log.Printf("downloading %q to %q\n", remoteFilename, outFileName)
-
-	url, err := url.JoinPath(baseURL, remoteFilename)
-	if err != nil {
-		log.Fatalf("unexpected error: %s\n", err)
-	}
-
-	resp, err := http.Get(url)
-	if err != nil {
-		log.Fatalf("http request failed: %s\n", err)
-	}
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		resp.Body.Close()
-		log.Fatalf("error reading response body: %s\n", err)
-	}
-
-	err = os.WriteFile(outFileName, body, 0o644)
-	if err != nil {
-		resp.Body.Close()
-		log.Fatalf("failed to write to file: %s\n", err)
-	}
-
-	log.Print("done")
-
-	resp.Body.Close()
-}
--- a/internal/utils/serialization.go
+++ b/internal/utils/serialization.go
@@ -31,6 +31,13 @@ var (
 	ErrUnknownField          = E.New("unknown field")
 )

+var (
+	tagDeserialize = "deserialize" // `deserialize:"-"` to exclude from deserialization
+	tagJSON        = "json"        // share between Deserialize and json.Marshal
+	tagValidate    = "validate"    // uses go-playground/validator
+	tagAliases     = "aliases"     // declare aliases for fields
+)
+
 var mapUnmarshalerType = reflect.TypeFor[MapUnmarshaller]()

 var defaultValues = functional.NewMapOf[reflect.Type, func() any]()
@@ -67,6 +74,9 @@ func extractFields(t reflect.Type) (all, anonymous []reflect.StructField) {
 		if !field.IsExported() {
 			continue
 		}
+		if field.Tag.Get(tagDeserialize) == "-" {
+			continue
+		}
 		if field.Anonymous {
 			f1, f2 := extractFields(field.Type)
 			fields = append(fields, f1...)
@@ -97,6 +107,33 @@ func ValidateWithFieldTags(s any) E.Error {
 	return errs.Error()
 }

+func ValidateWithCustomValidator(v reflect.Value) E.Error {
+	isStruct := false
+	for {
+		switch v.Kind() {
+		case reflect.Pointer, reflect.Interface:
+			if v.IsNil() {
+				return E.Errorf("validate: v is %w", ErrNilValue)
+			}
+			if validate, ok := v.Interface().(CustomValidator); ok {
+				return validate.Validate()
+			}
+			if isStruct {
+				return nil
+			}
+			v = v.Elem()
+		case reflect.Struct:
+			if !v.CanAddr() {
+				return nil
+			}
+			v = v.Addr()
+			isStruct = true
+		default:
+			return nil
+		}
+	}
+}
+
 func dive(dst reflect.Value) (v reflect.Value, t reflect.Type, err E.Error) {
 	dstT := dst.Type()
 	for {
@@ -186,7 +223,7 @@ func Deserialize(src SerializedObject, dst any) (err E.Error) {
 		}
 		for _, field := range fields {
 			var key string
-			if jsonTag, ok := field.Tag.Lookup("json"); ok {
+			if jsonTag, ok := field.Tag.Lookup(tagJSON); ok {
 				if jsonTag == "-" {
 					continue
 				}
@@ -198,10 +235,10 @@ func Deserialize(src SerializedObject, dst any) (err E.Error) {
 			mapping[key] = dstV.FieldByName(field.Name)

 			if !hasValidateTag {
-				_, hasValidateTag = field.Tag.Lookup("validate")
+				_, hasValidateTag = field.Tag.Lookup(tagValidate)
 			}

-			aliases, ok := field.Tag.Lookup("aliases")
+			aliases, ok := field.Tag.Lookup(tagAliases)
 			if ok {
 				for _, alias := range strutils.CommaSeperatedList(aliases) {
 					mapping[alias] = dstV.FieldByName(field.Name)
@@ -220,34 +257,28 @@ func Deserialize(src SerializedObject, dst any) (err E.Error) {
 		}
 		if hasValidateTag {
 			errs.Add(ValidateWithFieldTags(dstV.Interface()))
-		} else {
-			if dstV.CanAddr() {
-				dstV = dstV.Addr()
-			}
-			if validator, ok := dstV.Interface().(CustomValidator); ok {
-				errs.Add(validator.Validate())
-			}
+		}
+		if err := ValidateWithCustomValidator(dstV); err != nil {
+			errs.Add(err)
 		}
 		return errs.Error()
 	case reflect.Map:
-		if dstV.IsNil() {
-			dstV.Set(reflect.MakeMap(dstT))
-		}
-		for k := range src {
+		for k, v := range src {
 			mapVT := dstT.Elem()
 			tmp := New(mapVT).Elem()
-			err := Convert(reflect.ValueOf(src[k]), tmp)
-			if err == nil {
-				dstV.SetMapIndex(reflect.ValueOf(k), tmp)
-			} else {
+			err := Convert(reflect.ValueOf(v), tmp)
+			if err != nil {
 				errs.Add(err.Subject(k))
+				continue
+			}
+			if err := ValidateWithCustomValidator(tmp.Addr()); err != nil {
+				errs.Add(err.Subject(k))
+			} else {
+				dstV.SetMapIndex(reflect.ValueOf(k), tmp)
 			}
 		}
-		if dstV.CanAddr() {
-			dstV = dstV.Addr()
-		}
-		if validator, ok := dstV.Interface().(CustomValidator); ok {
-			errs.Add(validator.Validate())
+		if err := ValidateWithCustomValidator(dstV); err != nil {
+			errs.Add(err)
 		}
 		return errs.Error()
 	default:
--- a/internal/utils/strutils/url.go
+++ b/internal/utils/strutils/url.go
@@ -0,0 +1,20 @@
+package strutils
+
+import "path"
+
+// SanitizeURI sanitizes a URI reference to ensure it is safe
+// It disallows URLs beginning with // or /\ as absolute URLs,
+// cleans the URL path to remove any .. or . path elements,
+// and ensures the URL starts with a / if it doesn't already
+func SanitizeURI(uri string) string {
+	if uri == "" {
+		return "/"
+	}
+	if uri[0] != '/' {
+		uri = "/" + uri
+	}
+	if len(uri) > 1 && uri[0] == '/' && uri[1] != '/' && uri[1] != '\\' {
+		return path.Clean(uri)
+	}
+	return "/"
+}
--- a/internal/utils/strutils/url_test.go
+++ b/internal/utils/strutils/url_test.go
@@ -0,0 +1,63 @@
+package strutils
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSanitizeURI(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "empty string",
+			input:    "",
+			expected: "/",
+		},
+		{
+			name:     "single slash",
+			input:    "/",
+			expected: "/",
+		},
+		{
+			name:     "normal path",
+			input:    "/path/to/resource",
+			expected: "/path/to/resource",
+		},
+		{
+			name:     "path without leading slash",
+			input:    "path/to/resource",
+			expected: "/path/to/resource",
+		},
+		{
+			name:     "path with dot segments",
+			input:    "/path/./to/../resource",
+			expected: "/path/resource",
+		},
+		{
+			name:     "double slash prefix",
+			input:    "//path/to/resource",
+			expected: "/",
+		},
+		{
+			name:     "backslash prefix",
+			input:    "/\\path/to/resource",
+			expected: "/",
+		},
+		{
+			name:     "path with multiple slashes",
+			input:    "/path//to///resource",
+			expected: "/path/to/resource",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := SanitizeURI(tt.input)
+			require.Equal(t, tt.expected, result)
+		})
+	}
+}
--- a/internal/utils/testing/testing.go
+++ b/internal/utils/testing/testing.go
@@ -16,7 +16,10 @@ func init() {
 	}
 }

-func IgnoreError[Result any](r Result, _ error) Result {
+func Must[Result any](r Result, err error) Result {
+	if err != nil {
+		panic(err)
+	}
 	return r
 }

--- a/internal/watcher/docker_watcher.go
+++ b/internal/watcher/docker_watcher.go
@@ -6,20 +6,15 @@ import (

 	docker_events "github.com/docker/docker/api/types/events"
 	"github.com/docker/docker/api/types/filters"
-	"github.com/rs/zerolog"
-	D "github.com/yusing/go-proxy/internal/docker"
+	"github.com/yusing/go-proxy/internal/docker"
 	E "github.com/yusing/go-proxy/internal/error"
-	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/watcher/events"
 )

 type (
 	DockerWatcher struct {
-		zerolog.Logger
-
-		host        string
-		client      *D.SharedClient
-		clientOwned bool
+		host   string
+		client *docker.SharedClient
 	}
 	DockerListOptions = docker_events.ListOptions
 )
@@ -53,24 +48,7 @@ func DockerFilterContainerNameID(nameOrID string) filters.KeyValuePair {
 }

 func NewDockerWatcher(host string) DockerWatcher {
-	return DockerWatcher{
-		host:        host,
-		clientOwned: true,
-		Logger: logging.With().
-			Str("type", "docker").
-			Str("host", host).
-			Logger(),
-	}
-}
-
-func NewDockerWatcherWithClient(client *D.SharedClient) DockerWatcher {
-	return DockerWatcher{
-		client: client,
-		Logger: logging.With().
-			Str("type", "docker").
-			Str("host", client.DaemonHost()).
-			Logger(),
-	}
+	return DockerWatcher{host: host}
 }

 func (w DockerWatcher) Events(ctx context.Context) (<-chan Event, <-chan E.Error) {
@@ -82,35 +60,18 @@ func (w DockerWatcher) EventsWithOptions(ctx context.Context, options DockerList
 	errCh := make(chan E.Error)

 	go func() {
-		defer close(eventCh)
-		defer close(errCh)
-
 		defer func() {
-			if w.clientOwned && w.client.Connected() {
-				w.client.Close()
-			}
+			defer close(eventCh)
+			defer close(errCh)
+			w.client.Close()
 		}()

-		if !w.client.Connected() {
-			var err error
-			attempts := 0
-			for {
-				w.client, err = D.ConnectClient(w.host)
-				if err == nil {
-					break
-				}
-				attempts++
-				errCh <- E.Errorf("docker connection attempt #%d: %w", attempts, err)
-				select {
-				case <-ctx.Done():
-					return
-				default:
-					time.Sleep(dockerWatcherRetryInterval)
-				}
-			}
+		client, err := docker.ConnectClient(w.host)
+		if err != nil {
+			errCh <- E.From(err)
+			return
 		}
-
-		defer w.client.Close()
+		w.client = client

 		cEventCh, cErrCh := w.client.Events(ctx, options)

@@ -124,7 +85,6 @@ func (w DockerWatcher) EventsWithOptions(ctx context.Context, options DockerList
 			case msg := <-cEventCh:
 				action, ok := events.DockerEventMap[msg.Action]
 				if !ok {
-					w.Debug().Msgf("ignored unknown docker event: %s for container %s", msg.Action, msg.Actor.Attributes["name"])
 					continue
 				}
 				event := Event{
--- a/internal/watcher/health/config.go
+++ b/internal/watcher/health/config.go
@@ -2,6 +2,8 @@ package health

 import (
 	"time"
+
+	"github.com/yusing/go-proxy/internal/common"
 )

 type HealthCheckConfig struct {
@@ -11,3 +13,8 @@ type HealthCheckConfig struct {
 	Interval time.Duration `json:"interval" validate:"omitempty,min=1s"`
 	Timeout  time.Duration `json:"timeout" validate:"omitempty,min=1s"`
 }
+
+var DefaultHealthConfig = &HealthCheckConfig{
+	Interval: common.HealthCheckIntervalDefault,
+	Timeout:  common.HealthCheckTimeoutDefault,
+}
--- a/internal/watcher/health/monitor/fileserver.go
+++ b/internal/watcher/health/monitor/fileserver.go
@@ -0,0 +1,36 @@
+package monitor
+
+import (
+	"os"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/watcher/health"
+)
+
+type FileServerHealthMonitor struct {
+	*monitor
+	path string
+}
+
+func NewFileServerHealthMonitor(alias string, config *health.HealthCheckConfig, path string) *FileServerHealthMonitor {
+	mon := &FileServerHealthMonitor{path: path}
+	mon.monitor = newMonitor(nil, config, mon.CheckHealth)
+	mon.service = alias
+	return mon
+}
+
+func (s *FileServerHealthMonitor) CheckHealth() (*health.HealthCheckResult, error) {
+	start := time.Now()
+	_, err := os.Stat(s.path)
+
+	detail := ""
+	if err != nil {
+		detail = err.Error()
+	}
+
+	return &health.HealthCheckResult{
+		Healthy: err == nil,
+		Latency: time.Since(start),
+		Detail:  detail,
+	}, nil
+}
--- a/internal/watcher/health/monitor/http.go
+++ b/internal/watcher/health/monitor/http.go
@@ -26,7 +26,7 @@ var pinger = &http.Client{
 	},
 }

-func NewHTTPHealthMonitor(url types.URL, config *health.HealthCheckConfig) *HTTPHealthMonitor {
+func NewHTTPHealthMonitor(url *types.URL, config *health.HealthCheckConfig) *HTTPHealthMonitor {
 	mon := new(HTTPHealthMonitor)
 	mon.monitor = newMonitor(url, config, mon.CheckHealth)
 	if config.UseGet {
@@ -37,7 +37,7 @@ func NewHTTPHealthMonitor(url types.URL, config *health.HealthCheckConfig) *HTTP
 	return mon
 }

-func NewHTTPHealthChecker(url types.URL, config *health.HealthCheckConfig) health.HealthChecker {
+func NewHTTPHealthChecker(url *types.URL, config *health.HealthCheckConfig) health.HealthChecker {
 	return NewHTTPHealthMonitor(url, config)
 }

--- a/internal/watcher/health/monitor/json.go
+++ b/internal/watcher/health/monitor/json.go
@@ -5,7 +5,7 @@ import (
 	"strconv"
 	"time"

-	"github.com/yusing/go-proxy/internal/net/types"
+	net "github.com/yusing/go-proxy/internal/net/types"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 	"github.com/yusing/go-proxy/internal/watcher/health"
 )
@@ -19,7 +19,7 @@ type JSONRepresentation struct {
 	Latency  time.Duration
 	LastSeen time.Time
 	Detail   string
-	URL      types.URL
+	URL      *net.URL
 	Extra    map[string]any
 }

--- a/internal/watcher/health/monitor/monitor.go
+++ b/internal/watcher/health/monitor/monitor.go
@@ -23,7 +23,7 @@ type (
 	monitor         struct {
 		service string
 		config  *health.HealthCheckConfig
-		url     atomic.Value[types.URL]
+		url     atomic.Value[*types.URL]

 		status     atomic.Value[health.Status]
 		lastResult *health.HealthCheckResult
@@ -39,7 +39,7 @@ type (

 var ErrNegativeInterval = errors.New("negative interval")

-func newMonitor(url types.URL, config *health.HealthCheckConfig, healthCheckFunc HealthCheckFunc) *monitor {
+func newMonitor(url *types.URL, config *health.HealthCheckConfig, healthCheckFunc HealthCheckFunc) *monitor {
 	mon := &monitor{
 		config:      config,
 		checkHealth: healthCheckFunc,
@@ -118,12 +118,12 @@ func (mon *monitor) Finish(reason any) {
 }

 // UpdateURL implements HealthChecker.
-func (mon *monitor) UpdateURL(url types.URL) {
+func (mon *monitor) UpdateURL(url *types.URL) {
 	mon.url.Store(url)
 }

 // URL implements HealthChecker.
-func (mon *monitor) URL() types.URL {
+func (mon *monitor) URL() *types.URL {
 	return mon.url.Load()
 }

@@ -205,7 +205,7 @@ func (mon *monitor) checkUpdateHealth() error {
 		if !result.Healthy {
 			extras.Add("Last Seen", strutils.FormatLastSeen(GetLastSeen(mon.service)))
 		}
-		if !mon.url.Load().Nil() {
+		if mon.url.Load() != nil {
 			extras.Add("Service URL", mon.url.Load().String())
 		}
 		if result.Detail != "" {
--- a/internal/watcher/health/monitor/raw.go
+++ b/internal/watcher/health/monitor/raw.go
@@ -15,7 +15,7 @@ type (
 	}
 )

-func NewRawHealthMonitor(url types.URL, config *health.HealthCheckConfig) *RawHealthMonitor {
+func NewRawHealthMonitor(url *types.URL, config *health.HealthCheckConfig) *RawHealthMonitor {
 	mon := new(RawHealthMonitor)
 	mon.monitor = newMonitor(url, config, mon.CheckHealth)
 	mon.dialer = &net.Dialer{
@@ -25,7 +25,7 @@ func NewRawHealthMonitor(url types.URL, config *health.HealthCheckConfig) *RawHe
 	return mon
 }

-func NewRawHealthChecker(url types.URL, config *health.HealthCheckConfig) health.HealthChecker {
+func NewRawHealthChecker(url *types.URL, config *health.HealthCheckConfig) health.HealthChecker {
 	return NewRawHealthMonitor(url, config)
 }

--- a/internal/watcher/health/health_checker.go
+++ b/internal/watcher/health/health_checker.go
@@ -30,8 +30,8 @@ type (
 	}
 	HealthChecker interface {
 		CheckHealth() (result *HealthCheckResult, err error)
-		URL() types.URL
+		URL() *types.URL
 		Config() *HealthCheckConfig
-		UpdateURL(url types.URL)
+		UpdateURL(url *types.URL)
 	}
 )
--- a/next-release.md
+++ b/next-release.md
@@ -1,6 +1,84 @@
-GoDoxy v0.9.1 expected changes
+## GoDoxy v0.10.0

- Support Ntfy notifications
- Prometheus metrics server now inside API server under `/v1/metrics`
-  - `GODOXY_PROMETHEUS_ADDR` removed
-  - `GODOXY_PROMETHEUS_ENABLED` added, default `false`
+### GoDoxy Agent
+
+Maintain secure connection between main server and agent server by authenticating and encrypting connection with mTLS.
+
+Main benefits:
+
+- No more exposing docker socket: drops the need of `docker-socket-proxy`
+- No more exposing app ports: fewer attack surface
+  ```yaml
+  services:
+    app:
+      ...
+      # ports: # this part is not needed on agent server
+      #  - 6789
+  ```
+- Secure: no one can connect to it except GoDoxy main server because of mTLS, plus connection is encrypted
+- Fetch info from agent server, e.g. CPU usage, Memory usage, container list, container logs, etc... (to be ready for beszel and dockge like features in WebUI)
+
+#### How to setup
+
+Prerequisites:
+
+- GoDoxy main server must be running
+
+1. Create a directory for agent server, cd into it
+2. Copy `agent.compose.yml` into the directory
+3. Modify `agent.compose.yml` to set `REGISTRATION_ALLOWED_HOSTS`
+4. Run `docker-compose up -d` to start agent
+5. Follow instructions on screen to run command on GoDoxy main server
+6. Add config output to GoDoxy main server in `config.yml` under `providers.agents`
+   ```yaml
+   providers:
+     agents:
+       - 12.34.5.6:8889
+   ```
+
+### How does it work
+
+Setup flow:
+
+```mermaid
+flowchart TD
+    subgraph Agent Server
+        A[Create a directory] -->
+        B[Setup agent.compose.yml] -->
+        C[Set REGISTRATION_ALLOWED_HOSTS] -->
+        D[Run agent] -->
+        E[Wait for main server to register]
+
+        F[Respond to main server]
+        G[Agent now run in agent mode]
+    end
+    subgraph Main Server
+      E -->
+      H[Run register command] -->
+      I[Send registration request] --> F -->
+      J[Store client certs] -->
+      K[Send done request] --> G -->
+      L[Add agent to config.yml]
+    end
+```
+
+Run flow:
+
+```mermaid
+flowchart TD
+    subgraph Agent HTTPS Server
+        aa[Load CA and SSL certs] -->
+        ab[Start HTTPS server] -->
+
+        ac[Receive request] -->
+        ad[Verify client cert] -->
+        ae[Handle request] --> ac
+    end
+    subgraph Main Server
+        ma[Load client certs] -->
+        mb[Query agent version] --> ac
+        mb --> mc[Check if agent version matches] -->
+        md[Query agent info] --> ac
+        md --> ae --> me[Store agent info]
+    end
+```
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "godoxy-schemas",
-	"version": "0.9.1-1",
+	"version": "0.9.6",
 	"description": "JSON Schema and typescript types for GoDoxy configuration",
 	"license": "MIT",
 	"repository": {
--- a/schemas/config.schema.json
+++ b/schemas/config.schema.json
--- a/schemas/config/autocert.d.ts
+++ b/schemas/config/autocert.d.ts
@@ -1,7 +1,7 @@
 import { DomainOrWildcard, Email } from "../types";
-export declare const AUTOCERT_PROVIDERS: readonly ["local", "cloudflare", "clouddns", "duckdns", "ovh"];
+export declare const AUTOCERT_PROVIDERS: readonly ["local", "cloudflare", "clouddns", "duckdns", "ovh", "porkbun"];
 export type AutocertProvider = (typeof AUTOCERT_PROVIDERS)[number];
-export type AutocertConfig = LocalOptions | CloudflareOptions | CloudDNSOptions | DuckDNSOptions | OVHOptionsWithAppKey | OVHOptionsWithOAuth2Config;
+export type AutocertConfig = LocalOptions | CloudflareOptions | CloudDNSOptions | DuckDNSOptions | OVHOptionsWithAppKey | OVHOptionsWithOAuth2Config | PorkbunOptions;
 export interface AutocertConfigBase {
    email: Email;
    domains: DomainOrWildcard[];
@@ -34,6 +34,13 @@ export interface DuckDNSOptions extends AutocertConfigBase {
        token: string;
    };
 }
+export interface PorkbunOptions extends AutocertConfigBase {
+    provider: "porkbun";
+    options: {
+        api_key: string;
+        secret_api_key: string;
+    };
+}
 export declare const OVH_ENDPOINTS: readonly ["ovh-eu", "ovh-ca", "ovh-us", "kimsufi-eu", "kimsufi-ca", "soyoustart-eu", "soyoustart-ca"];
 export type OVHEndpoint = (typeof OVH_ENDPOINTS)[number];
 export interface OVHOptionsWithAppKey extends AutocertConfigBase {
--- a/schemas/config/autocert.js
+++ b/schemas/config/autocert.js
@@ -4,6 +4,7 @@ export const AUTOCERT_PROVIDERS = [
    "clouddns",
    "duckdns",
    "ovh",
+    "porkbun",
 ];
 export const OVH_ENDPOINTS = [
    "ovh-eu",
--- a/schemas/config/autocert.ts
+++ b/schemas/config/autocert.ts
@@ -6,6 +6,7 @@ export const AUTOCERT_PROVIDERS = [
  "clouddns",
  "duckdns",
  "ovh",
+  "porkbun",
 ] as const;

 export type AutocertProvider = (typeof AUTOCERT_PROVIDERS)[number];
@@ -16,7 +17,8 @@ export type AutocertConfig =
  | CloudDNSOptions
  | DuckDNSOptions
  | OVHOptionsWithAppKey
-  | OVHOptionsWithOAuth2Config;
+  | OVHOptionsWithOAuth2Config
+  | PorkbunOptions;

 export interface AutocertConfigBase {
  /* ACME email */
@@ -59,6 +61,13 @@ export interface DuckDNSOptions extends AutocertConfigBase {
  };
 }

+export interface PorkbunOptions extends AutocertConfigBase {
+  provider: "porkbun";
+  options: {
+    api_key: string;
+    secret_api_key: string;
+  };
+}
 export const OVH_ENDPOINTS = [
  "ovh-eu",
  "ovh-ca",
--- a/schemas/docker_routes.schema.json
+++ b/schemas/docker_routes.schema.json
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
yusing	e7ff7402b4	fix Makefile	2025-03-23 00:05:10 +08:00
yusing	91f6369ba9	deps upgrade	2025-03-22 23:58:58 +08:00
yusing	17ef5cb9a5	security: sanitize uri	2025-03-22 23:58:37 +08:00
yusing	189c870630	fix docker client panic introduced in last patch	2025-03-02 21:59:32 +08:00
yusing	7bb34b8788	fix redirectHTTP middleware test	2025-03-01 15:53:33 +08:00
yusing	f6dc432419	refactor: fix code formatting and return flow	2025-03-01 15:50:50 +08:00
yusing	9b2ee628aa	fix docker client data race on Close(), remove SharedClient.IsConnected	2025-03-01 15:47:08 +08:00
yusing	357ad26a0e	reduce docker client initiation	2025-03-01 15:39:25 +08:00
yusing	a3e705373c	deps upgrade	2025-03-01 15:34:53 +08:00
yusing	71ad13256e	fix redirectHTTP middleware, add bypass.user_agents option	2025-03-01 15:29:33 +08:00
dependabot[bot]	07511281b8	Bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#67 ) Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.0.4 to 4.0.5. - [Release notes](https://github.com/go-jose/go-jose/releases) - [Changelog](https://github.com/go-jose/go-jose/blob/main/CHANGELOG.md) - [Commits](https://github.com/go-jose/go-jose/compare/v4.0.4...v4.0.5) --- updated-dependencies: - dependency-name: github.com/go-jose/go-jose/v4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-02-25 10:23:42 +08:00
yusing	7c11c9c91a	update webui screenshot	2025-02-25 06:06:06 +08:00
yusing	2cabe4c416	update README and screenshots	2025-02-25 06:01:44 +08:00
Yuzerion	588dd41244	Update README.md	2025-02-25 00:03:20 +08:00
yusing	7b86bb262c	fix setup script	2025-02-24 00:02:50 +08:00
yusing	97fa648b2f	fix setup script	2025-02-23 13:47:30 +08:00
yusing	c5cf867cd9	update default repo to main	2025-02-23 13:31:27 +08:00
yusing	03ea9bb760	update default image name	2025-02-23 13:28:35 +08:00
yusing	a1a5bf921e	workflow update	2025-02-23 13:27:47 +08:00
yusing	f1bfd13da3	fix cloudflare real ip middleware resolving local addresses	2025-02-19 00:36:44 +08:00
yusing	b8900999a4	deps upgrade	2025-02-18 16:39:25 +08:00
yusing	e6f77376b9	fix args.go affected from cherry-pick	2025-02-18 16:35:23 +08:00
yusing	b2a6a20f10	simplify setup with script	2025-02-18 05:43:33 +08:00
yusing	05cbf99237	trim and convert alias and host to lowercase	2025-02-18 02:32:31 +08:00
yusing	d5c0e62be1	autocert: add porkbun cert provider	2025-02-13 23:48:35 +08:00
yusing	a21bdedbc1	go.modL add comments explaining dependencies usage	2025-02-13 19:40:15 +08:00
yusing	797ebd7771	update next release md	2025-02-13 19:30:23 +08:00
yusing	04e9ecbc76	README.md: Update README.md	2025-02-13 19:26:23 +08:00
yusing	9626b65593	deps upgrade	2025-02-11 00:56:17 +08:00
yusing	c9b5516330	fix wildcard alias and some tests	2025-02-11 00:47:43 +08:00
yusing	4363ca88aa	fix file server validation	2025-02-11 00:47:43 +08:00
Yuzerion	3353060ad4	Update README.md	2025-02-07 15:58:51 +08:00
yusing	ddc3b8575e	fix startup panic when no notification provider is set	2025-02-07 03:07:21 +08:00
yusing	136a2ec89f	remove some debug logging	2025-02-07 01:08:42 +08:00
yusing	021c68f2a7	update README	2025-02-06 18:31:49 +08:00
yusing	989a09274f	restore notification	2025-02-06 18:25:39 +08:00
yusing	39c5886d7a	make `rules.name` optional	2025-02-06 18:25:39 +08:00
Yuzerion	1a5f3735cf	Feat/fileserver (#60 ) * cleanup code for URL type * fix makefile for trace mode * refactor, merge Entry, RawEntry and Route into one. * Implement fileserver. * refactor: rename HTTPRoute to ReverseProxyRoute to avoid confusion * refactor: move metrics logger to middleware package - fix prometheus metrics for load balanced routes - route will now fail when health monitor fail to start * fix extra output of ls-* commands by defer initializaing stuff, speed up start time * add test for path traversal attack, small fix on FileServer.Start method * rename rule.on.bypass to pass * refactor and fixed map-to-map deserialization * updated route loading logic * schemas: add "add_prefix" option to modify_request middleware * updated route JSONMarshalling --------- Co-authored-by: yusing <yusing@6uo.me>	2025-02-06 18:23:10 +08:00