Merge branch 'main' into feat/custom-json-marshaling

* chore: replace gopkg.in/yaml.v3 vs goccy/go-yaml; replace encoding/json with bytedance/sonic

* fix: yaml unmarshal panic

* feat: custom json marshaler implementation

* chore: fix import and err marshal handling

---------

Co-authored-by: yusing <yusing@6uo.me>

.env.example

@@ -1,35 +1,27 @@
-# docker image tag (latest, nightly)
-TAG=latest
-
 # set timezone to get correct log timestamp
 TZ=ETC/UTC
 
-# container uid and gid (must match the owner of mounted directories)
-GODOXY_UID=1000
-GODOXY_GID=1000
-
-# Set GODOXY_API_JWT_SECURE=false to allow http
-GODOXY_API_JWT_SECURE=true
-# API JWT Configuration (common)
-# generate secret with `openssl rand -base64 32`
-GODOXY_API_JWT_SECRET=
-# the JWT token time-to-live
-# leave empty to use default (24 hours)
-# format: https://pkg.go.dev/time#Duration
-GODOXY_API_JWT_TOKEN_TTL=
-
 # API/WebUI user password login credentials (optional)
 # These fields are not required for OIDC authentication
 GODOXY_API_USER=admin
 GODOXY_API_PASSWORD=password
 
+# Enable `secure` cookie flag
+GODOXY_API_JWT_SECURE=true
+# generate secret with `openssl rand -base64 32`
+GODOXY_API_JWT_SECRET=
+# the JWT token time-to-live
+GODOXY_API_JWT_TOKEN_TTL=1h
+
 # OIDC Configuration (optional)
 # Uncomment and configure these values to enable OIDC authentication.
-#
 # GODOXY_OIDC_ISSUER_URL=https://accounts.google.com
 # GODOXY_OIDC_CLIENT_ID=your-client-id
 # GODOXY_OIDC_CLIENT_SECRET=your-client-secret
-# GODOXY_OIDC_SCOPES=openid, profile, email, groups # you may also include `offline_access` if your Idp supports it (e.g. Authentik, Pocket ID)
+# Keep /api/auth/callback as the redirect URL, change the domain to match your setup.
+# GODOXY_OIDC_REDIRECT_URL=https://your-domain/api/auth/callback
+# Comma-separated list of scopes
+# GODOXY_OIDC_SCOPES=openid, profile, email
 #
 # User definitions: Uncomment and configure these values to restrict access to specific users or groups.
 # These two fields act as a logical AND operator. For example, given the following membership:
@@ -50,26 +42,14 @@ GODOXY_API_PASSWORD=password
 GODOXY_HTTP_ADDR=:80
 GODOXY_HTTPS_ADDR=:443
 
-# Enable HTTP3
-GODOXY_HTTP3_ENABLED=true
-
 # API listening address
 GODOXY_API_ADDR=127.0.0.1:8888
 
-# Metrics
-GODOXY_METRICS_DISABLE_CPU=false
-GODOXY_METRICS_DISABLE_MEMORY=false
-GODOXY_METRICS_DISABLE_DISK=false
-GODOXY_METRICS_DISABLE_NETWORK=false
-GODOXY_METRICS_DISABLE_SENSORS=false
+# Frontend listening port
+GODOXY_FRONTEND_PORT=3000
 
-# Frontend aliases (subdomains / FQDNs, e.g. godoxy, godoxy.domain.com)
-GODOXY_FRONTEND_ALIASES=godoxy
-
-# Docker socket
-# /var/run/podman/podman.sock for podman
-DOCKER_SOCKET=/var/run/docker.sock
-SOCKET_PROXY_LISTEN_ADDR=127.0.0.1:2375
+# Prometheus Metrics
+GODOXY_PROMETHEUS_ENABLED=true
 
 # Debug mode
 GODOXY_DEBUG=false

.github/workflows/agent-binary.yml

@@ -25,8 +25,6 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
-        with:
-          submodules: 'recursive'
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
@@ -38,6 +36,9 @@ jobs:
       - name: Check binary
         run: |
           file bin/${{ matrix.binary_name }}
+      - name: Test
+        run: |
+          go test -v ./agent/...
       - name: Upload
         uses: actions/upload-artifact@v4
         with:

.github/workflows/docker-image-nightly.yml

@@ -15,10 +15,9 @@ jobs:
     with:
       image_name: ${{ github.repository_owner }}/godoxy
       tag: nightly
-      target: main
   build-nightly-agent:
     uses: ./.github/workflows/docker-image.yml
     with:
       image_name: ${{ github.repository_owner }}/godoxy-agent
       tag: nightly
-      target: agent
+      agent: true

.github/workflows/docker-image-prod.yml

@@ -10,11 +10,11 @@ jobs:
     uses: ./.github/workflows/docker-image.yml
     with:
       image_name: ${{ github.repository_owner }}/godoxy
+      old_image_name: ${{ github.repository_owner }}/go-proxy
       tag: latest
-      target: main
   build-prod-agent:
     uses: ./.github/workflows/docker-image.yml
     with:
       image_name: ${{ github.repository_owner }}/godoxy-agent
       tag: latest
-      target: agent
+      agent: true

.github/workflows/docker-image-socket-proxy.yml

@@ -1,22 +0,0 @@
-name: Docker Image CI (socket-proxy)
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - "socket-proxy/**"
-      - "socket-proxy.Dockerfile"
-      - ".github/workflows/docker-image-socket-proxy.yml"
-    tags-ignore:
-      - "**"
-  workflow_dispatch:
-
-jobs:
-  build:
-    uses: ./.github/workflows/docker-image.yml
-    with:
-      image_name: ${{ github.repository_owner }}/socket-proxy
-      tag: latest
-      target: socket-proxy
-      dockerfile: socket-proxy.Dockerfile

.github/workflows/docker-image.yml

@@ -9,20 +9,19 @@ on:
       image_name:
         required: true
         type: string
-      target:
-        required: true
-        type: string
-      dockerfile:
+      old_image_name:
         required: false
         type: string
-        default: Dockerfile
+      agent:
+        required: false
+        default: false
+        type: boolean
 
 env:
   REGISTRY: ghcr.io
-  MAKE_ARGS: ${{ inputs.target }}=1
-  DIGEST_PATH: /tmp/digests/${{ inputs.target }}
-  DIGEST_NAME_SUFFIX: ${{ inputs.target }}
-  DOCKERFILE: ${{ inputs.dockerfile }}
+  MAKE_ARGS: agent=${{ inputs.agent && '1' || '0' }}
+  DIGEST_PATH: /tmp/digests/${{ inputs.agent && 'agent' || 'main' }}
+  DIGEST_NAME_SUFFIX: ${{ inputs.agent && 'agent' || 'main' }}
 
 jobs:
   build:
@@ -77,14 +76,11 @@ jobs:
         with:
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
-          file: ${{ env.DOCKERFILE }}
           outputs: type=image,name=${{ env.REGISTRY }}/${{ inputs.image_name }},push-by-digest=true,name-canonical=true,push=true
           cache-from: |
-            type=registry,ref=${{ env.REGISTRY }}/${{ inputs.image_name }}:buildcache-${{ env.PLATFORM_PAIR }}
-          # type=gha,scope=${{ github.workflow }}-${{ env.PLATFORM_PAIR }}
+            type=registry,ref=${{ env.REGISTRY }}/${{ inputs.image_name }}:buildcache-${{ env.PLATFORM_PAIR }}-${{ inputs.tag }}
           cache-to: |
-            type=registry,ref=${{ env.REGISTRY }}/${{ inputs.image_name }}:buildcache-${{ env.PLATFORM_PAIR }},mode=max
-          # type=gha,scope=${{ github.workflow }}-${{ env.PLATFORM_PAIR }},mode=max
+            type=registry,ref=${{ env.REGISTRY }}/${{ inputs.image_name }}:buildcache-${{ env.PLATFORM_PAIR }}-${{ inputs.tag }},mode=max
           build-args: |
             VERSION=${{ github.ref_name }}
             MAKE_ARGS=${{ env.MAKE_ARGS }}
@@ -153,6 +149,17 @@ jobs:
           docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
             $(printf '${{ env.REGISTRY }}/${{ inputs.image_name }}@sha256:%s ' *)
 
+      - name: Old image name
+        if: inputs.old_image_name != ''
+        run: |
+          docker buildx imagetools create -t ${{ env.REGISTRY }}/${{ inputs.old_image_name }}:${{ steps.meta.outputs.version }}\
+            ${{ env.REGISTRY }}/${{ inputs.image_name }}:${{ steps.meta.outputs.version }}
+
       - name: Inspect image
         run: |
           docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ inputs.image_name }}:${{ steps.meta.outputs.version }}
+
+      - name: Inspect image (old)
+        if: inputs.old_image_name != ''
+        run: |
+          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ inputs.old_image_name }}:${{ steps.meta.outputs.version }}

.github/workflows/merge-main-into-compat.yml

@@ -1,39 +0,0 @@
-name: Cherry-pick into Compat
-
-on:
-  push:
-    tags:
-      - v*
-    paths:
-      - ".github/workflows/merge-main-into-compat.yml"
-
-jobs:
-  cherry-pick:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Configure git user
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-      - name: Cherry-pick commits from last tag
-        run: |
-          git fetch origin compat
-          git checkout compat
-          CURRENT_TAG=${{ github.ref_name }}
-          PREV_TAG=$(git describe --tags --abbrev=0 $CURRENT_TAG^ 2>/dev/null || echo "")
-
-          if [ -z "$PREV_TAG" ]; then
-            echo "No previous tag found. Cherry-picking all commits up to $CURRENT_TAG"
-            git rev-list --reverse --no-merges $CURRENT_TAG | xargs -r git cherry-pick
-          else
-            echo "Cherry-picking commits from $PREV_TAG to $CURRENT_TAG"
-            git rev-list --reverse --no-merges $PREV_TAG..$CURRENT_TAG | xargs -r git cherry-pick
-          fi
-      - name: Push compat
-        run: |
-          git push origin compat

.gitignore

@@ -29,15 +29,10 @@ todo.md
 .aider*
 mtrace.json
 .env
-*.env
-.cursorrules
-.cursor/
-.windsurfrules
 test.Dockerfile
 
 node_modules/
 tsconfig.tsbuildinfo
 
 !agent.compose.yml
-!agent/pkg/**
-dev-data/
+!agent/pkg/**

.gitmodules

@@ -1,9 +0,0 @@
-[submodule "internal/gopsutil"]
-	path = internal/gopsutil
-	url = https://github.com/godoxy-app/gopsutil.git
-[submodule "internal/go-oidc"]
-	path = internal/go-oidc
-	url = https://github.com/godoxy-app/go-oidc.git
-[submodule "goutils"]
-	path = goutils
-	url = https://github.com/yusing/goutils.git

.golangci.yml

@@ -1,151 +1,135 @@
-version: "2"
+run:
+  timeout: 10m
+
+linters-settings:
+  govet:
+    enable-all: true
+    disable:
+      - shadow
+      - fieldalignment
+  gocyclo:
+    min-complexity: 14
+  misspell:
+    locale: US
+  funlen:
+    lines: -1
+    statements: 120
+  forbidigo:
+    forbid:
+      - ^print(ln)?$
+  godox:
+    keywords:
+      - FIXME
+  tagalign:
+    align: false
+    sort: true
+    order:
+      - description
+      - json
+      - toml
+      - yaml
+      - yml
+      - label
+      - label-slice-as-struct
+      - file
+      - kv
+      - export
+  stylecheck:
+    dot-import-whitelist:
+      - github.com/yusing/go-proxy/internal/utils/testing # go tests only
+      - github.com/yusing/go-proxy/internal/api/v1/utils # api only
+  revive:
+    rules:
+      - name: struct-tag
+      - name: blank-imports
+      - name: context-as-argument
+      - name: context-keys-type
+      - name: error-return
+      - name: error-strings
+      - name: error-naming
+      - name: exported
+        disabled: true
+      - name: if-return
+      - name: increment-decrement
+      - name: var-naming
+      - name: var-declaration
+      - name: package-comments
+        disabled: true
+      - name: range
+      - name: receiver-naming
+      - name: time-naming
+      - name: unexported-return
+      - name: indent-error-flow
+      - name: errorf
+      - name: empty-block
+      - name: superfluous-else
+      - name: unused-parameter
+        disabled: true
+      - name: unreachable-code
+      - name: redefines-builtin-id
+  gomoddirectives:
+    replace-allow-list:
+      - github.com/abbot/go-http-auth
+      - github.com/gorilla/mux
+      - github.com/mailgun/minheap
+      - github.com/mailgun/multibuf
+      - github.com/jaguilar/vt100
+      - github.com/cucumber/godog
+      - github.com/http-wasm/http-wasm-host-go
+  testifylint:
+    disable:
+      - suite-dont-use-pkg
+      - require-error
+      - go-require
+  staticcheck:
+    checks:
+      - all
+      - -SA1019
+  errcheck:
+    exclude-functions:
+      - fmt.Fprintln
 linters:
-  default: all
+  enable-all: true
   disable:
-    # - bodyclose
-    - containedctx
-    # - contextcheck
-    - cyclop
-    - depguard
-    # - dupl
-    - err113
-    - exhaustive
-    - exhaustruct
-    - funcorder
-    - forcetypeassert
-    - gochecknoglobals
+    - execinquery # deprecated
+    - gomnd # deprecated
+    - sqlclosecheck # not relevant (SQL)
+    - rowserrcheck # not relevant (SQL)
+    - cyclop # duplicate of gocyclo
+    - depguard # Not relevant
+    - nakedret # Too strict
+    - lll # Not relevant
+    - gocyclo # must be fixed
+    - gocognit # Too strict
+    - nestif # Too many false-positive.
+    - prealloc # Too many false-positive.
+    - makezero # Not relevant
+    - dupl # Too strict
+    - gci # I don't care
+    - goconst # Too annoying
+    - gosec # Too strict
     - gochecknoinits
-    - gocognit
-    - goconst
-    - gocyclo
-    - godot
-    - gomoddirectives
-    - gosmopolitan
-    - ireturn
-    - lll
-    - maintidx
-    - makezero
-    - mnd
-    - nakedret
-    - nestif
-    - nlreturn
-    - nonamedreturns
-    - noinlineerr
-    - paralleltest
-    - revive
-    - rowserrcheck
-    - sqlclosecheck
-    - tagalign
-    - tagliatelle
-    - testpackage
-    - tparallel
-    - varnamelen
-    - wrapcheck
-    - wsl
-    - wsl_v5
-  settings:
-    errcheck:
-      exclude-functions:
-        - fmt.Fprintln
-    forbidigo:
-      forbid:
-        - pattern: ^print(ln)?$
-    funlen:
-      lines: -1
-      statements: 120
-    gocyclo:
-      min-complexity: 14
-    godox:
-      keywords:
-        - FIXME
-    gomoddirectives:
-      replace-allow-list:
-        - github.com/abbot/go-http-auth
-        - github.com/gorilla/mux
-        - github.com/mailgun/minheap
-        - github.com/mailgun/multibuf
-        - github.com/jaguilar/vt100
-        - github.com/cucumber/godog
-        - github.com/http-wasm/http-wasm-host-go
-    govet:
-      disable:
-        - shadow
-      enable-all: true
-    misspell:
-      locale: US
-    revive:
-      rules:
-        - name: struct-tag
-        - name: blank-imports
-        - name: context-as-argument
-        - name: context-keys-type
-        - name: error-return
-        - name: error-strings
-        - name: error-naming
-        - name: exported
-          disabled: true
-        - name: if-return
-        - name: increment-decrement
-        - name: var-naming
-        - name: var-declaration
-        - name: package-comments
-          disabled: true
-        - name: range
-        - name: receiver-naming
-        - name: time-naming
-        - name: unexported-return
-        - name: indent-error-flow
-        - name: errorf
-        - name: empty-block
-        - name: superfluous-else
-        - name: unused-parameter
-          disabled: true
-        - name: unreachable-code
-        - name: redefines-builtin-id
-    staticcheck:
-      checks:
-        - all
-        - -SA1019
-      dot-import-whitelist:
-        - github.com/yusing/godoxy/internal/utils/testing
-    tagalign:
-      align: false
-      sort: true
-      order:
-        - description
-        - json
-        - toml
-        - yaml
-        - yml
-        - label
-        - label-slice-as-struct
-        - file
-        - kv
-        - export
-    testifylint:
-      disable:
-        - suite-dont-use-pkg
-        - require-error
-        - go-require
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
-formatters:
-  enable:
-    - gofmt
-    - gofumpt
-    - goimports
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+    - gochecknoglobals
+    - wsl # Too strict
+    - nlreturn # Not relevant
+    - mnd # Too strict
+    - testpackage # Too strict
+    - tparallel # Not relevant
+    - paralleltest # Not relevant
+    - exhaustive # Not relevant
+    - exhaustruct # Not relevant
+    - err113 # Too strict
+    - wrapcheck # Too strict
+    - noctx # Too strict
+    - bodyclose # too many false-positive
+    - forcetypeassert # Too strict
+    - tagliatelle # Too strict
+    - varnamelen # Not relevant
+    - nilnil # Not relevant
+    - ireturn # Not relevant
+    - contextcheck # too many false-positive
+    - containedctx # too many false-positive
+    - maintidx # kind of duplicate of gocyclo
+    - nonamedreturns # Too strict
+    - gosmopolitan # not relevant
+    - exportloopref # Not relevant since go1.22

.trunk/trunk.yaml

@@ -2,37 +2,36 @@
 # To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
 version: 0.1
 cli:
-  version: 1.25.0
+  version: 1.22.10
 # Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
 plugins:
   sources:
     - id: trunk
-      ref: v1.7.2
+      ref: v1.6.7
       uri: https://github.com/trunk-io/plugins
 # Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
 runtimes:
   enabled:
-    - node@22.16.0
+    - node@18.20.5
     - python@3.10.8
-    - go@1.24.3
+    - go@1.23.2
 # This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
 lint:
   disabled:
     - markdownlint
     - yamllint
   enabled:
-    - checkov@3.2.471
-    - golangci-lint2@2.5.0
-    - hadolint@2.14.0
+    - hadolint@2.12.1-beta
     - actionlint@1.7.7
     - git-diff-check
     - gofmt@1.20.4
-    - osv-scanner@2.2.2
-    - oxipng@9.1.5
-    - prettier@3.6.2
-    - shellcheck@0.11.0
+    - golangci-lint@1.64.5
+    - osv-scanner@1.9.2
+    - oxipng@9.1.4
+    - prettier@3.5.1
+    - shellcheck@0.10.0
     - shfmt@3.6.0
-    - trufflehog@3.90.8
+    - trufflehog@3.88.9
 actions:
   disabled:
     - trunk-announce

.vscode/settings.example.json

@@ -1,10 +1,10 @@
 {
   "yaml.schemas": {
-    "https://github.com/yusing/godoxy-webui/raw/refs/heads/main/types/godoxy/config.schema.json": [
+    "https://github.com/yusing/go-proxy/raw/main/schemas/config.schema.json": [
       "config.example.yml",
       "config.yml"
     ],
-    "https://github.com/yusing/godoxy-webui/raw/refs/heads/main/types/godoxy/routes.schema.json": [
+    "https://github.com/yusing/go-proxy/raw/main/schemas/routes.schema.json": [
       "providers.example.yml"
     ]
   }

Dockerfile

@@ -1,41 +1,30 @@
 # Stage 1: deps
-FROM golang:1.25.5-alpine AS deps
+FROM golang:1.24.2-alpine AS deps
 HEALTHCHECK NONE
 
 # package version does not matter
 # trunk-ignore(hadolint/DL3018)
 RUN apk add --no-cache tzdata make libcap-setcap
 
-ENV GOPATH=/root/go
-ENV GOCACHE=/root/.cache/go-build
-
 WORKDIR /src
 
-COPY goutils/go.mod goutils/go.sum ./goutils/
-COPY internal/go-oidc/go.mod internal/go-oidc/go.sum ./internal/go-oidc/
-COPY internal/gopsutil/go.mod internal/gopsutil/go.sum ./internal/gopsutil/
-COPY go.mod go.sum ./
+# Only copy go.mod and go.sum initially for better caching
+COPY go.mod go.sum /src/
 
-# remove godoxy stuff from go.mod first
-RUN --mount=type=cache,target=/root/.cache/go-build \
-  --mount=type=cache,target=/root/go/pkg/mod \
-  sed -i '/^module github\.com\/yusing\/godoxy/!{/github\.com\/yusing\/godoxy/d}' go.mod && \
-  sed -i '/^module github\.com\/yusing\/goutils/!{/github\.com\/yusing\/goutils/d}' go.mod && \
-  go mod download -x
+ENV GOPATH=/root/go
+RUN go mod download -x
 
 # Stage 2: builder
 FROM deps AS builder
 
 WORKDIR /src
 
-COPY go.mod go.sum ./
 COPY Makefile ./
 COPY cmd ./cmd
 COPY internal ./internal
 COPY pkg ./pkg
 COPY agent ./agent
-COPY socket-proxy ./socket-proxy
-COPY goutils ./goutils
+COPY migrations ./migrations
 
 ARG VERSION
 ENV VERSION=${VERSION}
@@ -43,22 +32,26 @@ ENV VERSION=${VERSION}
 ARG MAKE_ARGS
 ENV MAKE_ARGS=${MAKE_ARGS}
 
-RUN --mount=type=cache,target=/root/.cache/go-build \
-  --mount=type=cache,target=/root/go/pkg/mod \
-  make ${MAKE_ARGS} docker=1 build
+ENV GOCACHE=/root/.cache/go-build
+ENV GOPATH=/root/go
+RUN make ${MAKE_ARGS} build link-binary && \
+    mv bin /app/ && \
+    mkdir -p /app/error_pages /app/certs
 
 # Stage 3: Final image
 FROM scratch
 
 LABEL maintainer="yusing@6uo.me"
 LABEL proxy.exclude=1
-LABEL proxy.#1.healthcheck.disable=true
 
 # copy timezone data
 COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
 
 # copy binary
-COPY --from=builder /app/run /app/run
+COPY --from=builder /app /app
+
+# copy example config
+COPY config.example.yml /app/config/config.yml
 
 # copy certs
 COPY --from=builder /etc/ssl/certs /etc/ssl/certs
@@ -67,4 +60,4 @@ ENV DOCKER_HOST=unix:///var/run/docker.sock
 
 WORKDIR /app
 
-CMD ["/app/run"]
+CMD ["/app/run"]

Jenkinsfile

@@ -1,11 +0,0 @@
-node {
-  stage('SCM') {
-    checkout scm
-  }
-  stage('SonarQube Analysis') {
-    def scannerHome = tool 'SonarScanner';
-    withSonarQubeEnv() {
-      sh "${scannerHome}/bin/sonar-scanner"
-    }
-  }
-}

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 - present Yusing
+Copyright (c) 2024 [fullname]
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -19,27 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
----
-
-internal/net/gphttp/reverseproxy/reverse_proxy_mod.go is copied from et/http/httputil/reverseproxy.go with modifications to adapt to this project.
-
-Copyright 2011 The Go Authors. All rights reserved.
-Use of this source code is governed by a BSD-style
-license that can be found in the LICENSE file.
-
----
-
-internal/utils/io.go has a modified version of io.Copy with context and HTTP flusher handling.
-
-Copyright 2009 The Go Authors. All rights reserved.
-Use of this source code is governed by a BSD-style
-license that can be found in the LICENSE file.
-
----
-
-internal/utils/strutils/split_join.go is copied from strings.Split and strings.Join with modifications to adapt to this project.
-
-Copyright 2009 The Go Authors. All rights reserved.
-Use of this source code is governed by a BSD-style
-license that can be found in the LICENSE file.

Makefile

@@ -1,23 +1,16 @@
-shell := /bin/sh
 export VERSION ?= $(shell git describe --tags --abbrev=0)
 export BUILD_DATE ?= $(shell date -u +'%Y%m%d-%H%M')
 export GOOS = linux
 
-WEBUI_DIR ?= ../godoxy-webui
-DOCS_DIR ?= ${WEBUI_DIR}/wiki
+LDFLAGS = -X github.com/yusing/go-proxy/pkg.version=${VERSION}
 
-GO_TAGS = sonic
-LDFLAGS = -X github.com/yusing/goutils/version.version=${VERSION} -checklinkname=0
 
 ifeq ($(agent), 1)
 	NAME = godoxy-agent
-	PWD = ${shell pwd}/agent
-else ifeq ($(socket-proxy), 1)
-	NAME = godoxy-socket-proxy
-	PWD = ${shell pwd}/socket-proxy
+	CMD_PATH = ./agent/cmd
 else
 	NAME = godoxy
-	PWD = ${shell pwd}
+	CMD_PATH = ./cmd
 endif
 
 ifeq ($(trace), 1)
@@ -27,31 +20,29 @@ ifeq ($(trace), 1)
 endif
 
 ifeq ($(race), 1)
-	CGO_ENABLED = 1
-	GODOXY_DEBUG = 1
-	GO_TAGS += debug
-	BUILD_FLAGS += -race
-else ifeq ($(debug), 1)
-	CGO_ENABLED = 1
-	GODOXY_DEBUG = 1
-	GO_TAGS += debug
-	# FIXME: BUILD_FLAGS += -asan -gcflags=all='-N -l'
-else ifeq ($(pprof), 1)
+	debug = 1
+  BUILD_FLAGS += -race
+endif
+
+ifeq ($(debug), 1)
 	CGO_ENABLED = 0
+	GODOXY_DEBUG = 1
+	BUILD_FLAGS += -gcflags=all='-N -l' -tags debug
+else ifeq ($(pprof), 1)
+	CGO_ENABLED = 1
 	GORACE = log_path=logs/pprof strip_path_prefix=$(shell pwd)/ halt_on_error=1
-	GO_TAGS += pprof
+	BUILD_FLAGS += -tags pprof
 	VERSION := ${VERSION}-pprof
 else
 	CGO_ENABLED = 0
 	LDFLAGS += -s -w
-	GO_TAGS += production
-	BUILD_FLAGS += -pgo=auto
+	BUILD_FLAGS += -pgo=auto -tags production
 endif
 
-BUILD_FLAGS += -tags '$(GO_TAGS)' -ldflags='$(LDFLAGS)'
-BIN_PATH := $(shell pwd)/bin/${NAME}
+BUILD_FLAGS += -ldflags='$(LDFLAGS)'
 
 export NAME
+export CMD_PATH
 export CGO_ENABLED
 export GODOXY_DEBUG
 export GODOXY_TRACE
@@ -59,84 +50,31 @@ export GODEBUG
 export GORACE
 export BUILD_FLAGS
 
-ifeq ($(shell id -u), 0)
-	SETCAP_CMD = setcap
-else
-	SETCAP_CMD = sudo setcap
-endif
-
-
-# CAP_NET_BIND_SERVICE: permission for binding to :80 and :443
-POST_BUILD = $(SETCAP_CMD) CAP_NET_BIND_SERVICE=+ep ${BIN_PATH};
-ifeq ($(docker), 1)
-	POST_BUILD += mkdir -p /app && mv ${BIN_PATH} /app/run;
-endif
-
 .PHONY: debug
 
 test:
-	CGO_ENABLED=1 go test -v -race ${BUILD_FLAGS} ./internal/...
+	GODOXY_TEST=1 go test ./internal/...
 
-docker-build-test:
-	docker build -t godoxy .
-	docker build --build-arg=MAKE_ARGS=agent=1 -t godoxy-agent .
-	docker build --build-arg=MAKE_ARGS=socket-proxy=1 -t godoxy-socket-proxy .
-
-go_ver := $(shell go version | cut -d' ' -f3 | cut -d'o' -f2)
-files := $(shell find . -name go.mod -type f -or -name Dockerfile -type f)
-gomod_paths := $(shell find . -name go.mod -type f | xargs dirname)
-
-update-go:
-	for file in ${files}; do \
-		echo "updating $$file"; \
-		sed -i 's|go \([0-9]\+\.[0-9]\+\.[0-9]\+\)|go ${go_ver}|g' $$file; \
-		sed -i 's|FROM golang:.*-alpine|FROM golang:${go_ver}-alpine|g' $$file; \
-	done
-	for path in ${gomod_paths}; do \
-		echo "go mod tidy $$path"; \
-		cd ${PWD}/$$path && go mod tidy; \
-	done
-
-update-deps:
-	for path in ${gomod_paths}; do \
-		echo "go get -u $$path"; \
-		cd ${PWD}/$$path && go get -u ./... && go mod tidy; \
-	done
-
-mod-tidy:
-	for path in ${gomod_paths}; do \
-		echo "go mod tidy $$path"; \
-		cd ${PWD}/$$path && go mod tidy; \
-	done
+get:
+	go get -u ./cmd && go mod tidy
 
 build:
-	mkdir -p $(shell dirname ${BIN_PATH})
-	go build -C ${PWD} ${BUILD_FLAGS} -o ${BIN_PATH} ./cmd
-	${POST_BUILD}
+	mkdir -p bin
+	go build ${BUILD_FLAGS} -o bin/${NAME} ${CMD_PATH}
+	if [ $(shell id -u) -eq 0 ]; \
+		then setcap CAP_NET_BIND_SERVICE=+eip bin/${NAME}; \
+		else sudo setcap CAP_NET_BIND_SERVICE=+eip bin/${NAME}; \
+	fi
 
 run:
-	cd ${PWD} && [ -f .env ] && godotenv -f .env go run ${BUILD_FLAGS} ./cmd
+	[ -f .env ] && godotenv -f .env go run ${BUILD_FLAGS} ${CMD_PATH}
 
-dev:
-	docker compose -f dev.compose.yml $(args)
-
-dev-build: build
-	docker compose -f dev.compose.yml up -t 0 -d app --force-recreate
-
-benchmark:
-	@if [ -z "$(TARGET)" ]; then \
-		docker compose -f dev.compose.yml up -d --force-recreate godoxy traefik caddy nginx; \
-	else \
-		docker compose -f dev.compose.yml up -d --force-recreate $(TARGET); \
-	fi
-	sleep 1
-	@./scripts/benchmark.sh
-
-dev-run: build
-	cd dev-data && ${BIN_PATH}
+debug:
+	make NAME="godoxy-test" debug=1 build
+	sh -c 'HTTP_ADDR=:81 HTTPS_ADDR=:8443 API_ADDR=:8899 DEBUG=1 bin/godoxy-test'
 
 mtrace:
-	 ${BIN_PATH} debug-ls-mtrace > mtrace.json
+	bin/godoxy debug-ls-mtrace > mtrace.json
 
 rapid-crash:
 	docker run --restart=always --name test_crash -p 80 debian:bookworm-slim /bin/cat &&\
@@ -151,28 +89,10 @@ ci-test:
 	act -n --artifact-server-path /tmp/artifacts -s GITHUB_TOKEN="$$(gh auth token)"
 
 cloc:
-	scc -w -i go --not-match '_test.go$$'
+	cloc --not-match-f '_test.go$$' cmd internal pkg
+
+link-binary:
+	ln -s /app/${NAME} bin/run
 
 push-github:
-	git push origin $(shell git rev-parse --abbrev-ref HEAD)
-
-gen-swagger:
-  # go install github.com/swaggo/swag/cmd/swag@latest
-	swag init --parseDependency --parseInternal --parseFuncBody -g handler.go -d internal/api -o internal/api/v1/docs
-	python3 scripts/fix-swagger-json.py
-	# we don't need this
-	rm internal/api/v1/docs/docs.go
-
-gen-swagger-markdown: gen-swagger
-  # brew tap go-swagger/go-swagger && brew install go-swagger
-	swagger generate markdown -f internal/api/v1/docs/swagger.yaml --skip-validation --output ${DOCS_DIR}/src/API.md
-
-gen-api-types: gen-swagger
-	# --disable-throw-on-error
-	bunx --bun swagger-typescript-api generate --sort-types --generate-union-enums --axios --add-readonly --route-types \
-		 --responses -o ${WEBUI_DIR}/lib -n api.ts -p internal/api/v1/docs/swagger.json
-	bunx --bun prettier --config ${WEBUI_DIR}/.prettierrc --write ${WEBUI_DIR}/lib/api.ts
-
-.PHONY: update-wiki
-update-wiki:
-	DOCS_DIR=${DOCS_DIR} bun --bun scripts/update-wiki/main.ts
+	git push origin $(shell git rev-parse --abbrev-ref HEAD)

README.md

@@ -1,123 +1,71 @@
 <div align="center">
 
-<img src="assets/godoxy.png" width="200">
+# GoDoxy
 
-[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_godoxy)
 ![GitHub last commit](https://img.shields.io/github/last-commit/yusing/godoxy)
-[![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=go-proxy)
-
-![Demo](https://img.shields.io/website?url=https%3A%2F%2Fdemo.godoxy.dev&label=Demo&link=https%3A%2F%2Fdemo.godoxy.dev)
+[![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_godoxy)
+![Demo](https://img.shields.io/website?url=https%3A%2F%2Fgodoxy.demo.6uo.me&label=Demo&link=https%3A%2F%2Fgodoxy.demo.6uo.me)
 [![Discord](https://dcbadge.limes.pink/api/server/umReR62nRd?style=flat)](https://discord.gg/umReR62nRd)
 
-A lightweight, simple, and performant reverse proxy with WebUI.
+A lightweight, simple, and [performant](https://github.com/yusing/godoxy/wiki/Benchmarks) reverse proxy with WebUI.
 
-<h5>
-<a href="https://docs.godoxy.dev">Website</a> | <a href="https://docs.godoxy.dev/Home.html">Wiki</a> | <a href="https://discord.gg/umReR62nRd">Discord</a>
-</h5>
+For full documentation, check out **[Wiki](https://github.com/yusing/godoxy/wiki)**
 
-<h5>EN | <a href="README_CHT.md">中文</a></h5>
+**EN** | <a href="README_CHT.md">中文</a>
 
 <img src="screenshots/webui.jpg" style="max-width: 650">
 
-Have questions? Ask [ChatGPT](https://chatgpt.com/g/g-6825390374b481919ad482f2e48936a1-godoxy-assistant)! (Thanks to [@ismesid](https://github.com/arevindh))
-
 </div>
 
 ## Table of content
 
 <!-- TOC -->
 
-- [Table of content](#table-of-content)
-- [Running demo](#running-demo)
-- [Key Features](#key-features)
-- [Prerequisites](#prerequisites)
-- [Setup](#setup)
-- [How does GoDoxy work](#how-does-godoxy-work)
-- [Update / Uninstall system agent](#update--uninstall-system-agent)
-- [Screenshots](#screenshots)
-  - [idlesleeper](#idlesleeper)
-  - [Metrics and Logs](#metrics-and-logs)
-- [Manual Setup](#manual-setup)
-  - [Folder structrue](#folder-structrue)
-- [Build it yourself](#build-it-yourself)
-- [Star History](#star-history)
+- [GoDoxy](#godoxy)
+  - [Table of content](#table-of-content)
+  - [Running demo](#running-demo)
+  - [Key Features](#key-features)
+  - [Prerequisites](#prerequisites)
+  - [How does GoDoxy work](#how-does-godoxy-work)
+  - [Setup](#setup)
+  - [Screenshots](#screenshots)
+    - [idlesleeper](#idlesleeper)
+    - [Metrics and Logs](#metrics-and-logs)
+  - [Manual Setup](#manual-setup)
+    - [Folder structrue](#folder-structrue)
+  - [Build it yourself](#build-it-yourself)
 
 ## Running demo
 
-<https://demo.godoxy.dev>
+<https://godoxy.demo.6uo.me>
 
 [![Deployed on Zeabur](https://zeabur.com/deployed-on-zeabur-dark.svg)](https://zeabur.com/referral?referralCode=yusing&utm_source=yusing&utm_campaign=oss)
 
 ## Key Features
 
-- **Simple**
-  - Effortless configuration with [simple labels](https://docs.godoxy.dev/Docker-labels-and-Route-Files) or WebUI
-  - [Simple multi-node setup](https://docs.godoxy.dev/Configurations#multi-docker-nodes-setup)
-  - Detailed error messages for easy troubleshooting.
-- **ACL**: connection / request level access control
-  - IP/CIDR
-  - Country **(Maxmind account required)**
-  - Timezone **(Maxmind account required)**
-  - **Access logging**
-  - Periodic notification of access summaries for number of allowed and blocked connections
-- **Advanced Automation**
-  - Automatic SSL certificate management with Let's Encrypt ([using DNS-01 Challenge](https://docs.godoxy.dev/DNS-01-Providers))
-  - Auto-configuration for Docker containers
-  - Hot-reloading of configurations and container state changes
-- **Container Runtime Support**
-  - Docker
-  - Podman
-- **Idle-sleep**: stop and wake containers based on traffic _(see [screenshots](#idlesleeper))_
-  - Docker containers
-  - Proxmox LXCs
-- **Traffic Management**
-  - HTTP reserve proxy
-  - TCP/UDP port forwarding
-  - **OpenID Connect support**: SSO and secure your apps easily
-  - **ForwardAuth support**: integrate with any auth provider (e.g. TinyAuth)
-- **Customization**
-  - [HTTP middlewares](https://docs.godoxy.dev/Middlewares)
-  - [Custom error pages support](https://docs.godoxy.dev/Custom-Error-Pages)
-- **Web UI**
-  - App Dashboard
-  - Config Editor
-  - Uptime and System Metrics
-  - Docker Logs Viewer
-- **Cross-Platform support**
-  - Supports **linux/amd64** and **linux/arm64**
-- **Efficient and Performant**
-  - Written in **[Go](https://go.dev)**
+- Easy to use
+  - Effortless configuration
+  - Simple multi-node setup with GoDoxy agents or Docker Socket Proxies
+  - Error messages is clear and detailed, easy troubleshooting
+- **Auto SSL** with Let's Encrypt (See [Supported DNS-01 Challenge Providers](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers))
+- **Auto hot-reload** on container state / config file changes
+- **Container aware**: create routes dynamically from running docker containers
+- **idlesleeper**: stop and wake containers based on traffic _(optional, see [screenshots](#idlesleeper))_
+- HTTP reserve proxy and TCP/UDP port forwarding
+- **OpenID Connect integration**: SSO and secure your apps easily
+- [HTTP middleware](https://github.com/yusing/go-proxy/wiki/Middlewares) and [Custom error pages support](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
+- **Web UI with App dashboard, config editor, _uptime and system metrics_, _docker logs viewer_**
+- Supports **linux/amd64** and **linux/arm64**
+- Written in **[Go](https://go.dev)**
 
 ## Prerequisites
 
-Configure Wildcard DNS Record(s) to point to machine running `GoDoxy`, e.g.
+Setup Wildcard DNS Record(s) for machine running `GoDoxy`, e.g.
 
 - A Record: `*.domain.com` -> `10.0.10.1`
 - AAAA Record (if you use IPv6): `*.domain.com` -> `::ffff:a00:a01`
 
-## Setup
-
-> [!NOTE]
-> GoDoxy is designed to be running in `host` network mode, do not change it.
->
-> To change listening ports, modify `.env`.
-
-1. Prepare a new directory for docker compose and config files.
-
-2. Run setup script inside the directory, or [set up manually](#manual-setup)
-
-   ```shell
-   /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/godoxy/main/scripts/setup.sh)"
-   ```
-
-3. Start the docker compose service from generated `compose.yml`:
-
-   ```shell
-   docker compose up -d
-   ```
-
-4. You may now do some extra configuration on WebUI `https://godoxy.yourdomain.com`
-
 ## How does GoDoxy work
 
 1. List all the containers
@@ -130,19 +78,22 @@ Configure Wildcard DNS Record(s) to point to machine running `GoDoxy`, e.g.
 >
 > For example, with the label `proxy.aliases: qbt` you can access your app via `qbt.domain.com`.
 
-## Update / Uninstall system agent
+## Setup
 
-Update:
+> [!NOTE]
+> GoDoxy is designed to be running in `host` network mode, do not change it.
+>
+> To change listening ports, modify `.env`.
 
-```bash
-bash -c "$(curl -fsSL https://github.com/yusing/godoxy/raw/refs/heads/main/scripts/install-agent.sh)" -- update
-```
+1. Prepare a new directory for docker compose and config files.
 
-Uninstall:
+2. Run setup script inside the directory, or [set up manually](#manual-setup)
 
-```bash
-bash -c "$(curl -fsSL https://github.com/yusing/godoxy/raw/refs/heads/main/scripts/install-agent.sh)" -- uninstall
-```
+    ```shell
+    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/godoxy/main/scripts/setup.sh)"
+    ```
+
+3. You may now do some extra configuration on WebUI `https://godoxy.yourdomain.com`
 
 ## Screenshots
 
@@ -155,12 +106,22 @@ bash -c "$(curl -fsSL https://github.com/yusing/godoxy/raw/refs/heads/main/scrip
 <div align="center">
   <table>
     <tr>
-      <td align="center"><img src="screenshots/routes.jpg" alt="Routes" width="350"/></td>
-      <td align="center"><img src="screenshots/servers.jpg" alt="Servers" width="350"/></td>
+      <td align="center"><img src="screenshots/uptime.png" alt="Uptime Monitor" width="250"/></td>
+      <td align="center"><img src="screenshots/docker-logs.jpg" alt="Docker Logs" width="250"/></td>
+      <td align="center"><img src="screenshots/docker.jpg" alt="Server Overview" width="250"/></td>
     </tr>
     <tr>
-      <td align="center"><b>Routes</b></td>
-      <td align="center"><b>Servers</b></td>
+      <td align="center"><b>Uptime Monitor</b></td>
+      <td align="center"><b>Docker Logs</b></td>
+      <td align="center"><b>Server Overview</b></td>
+    </tr>
+        <tr>
+      <td align="center"><img src="screenshots/system-monitor.jpg" alt="System Monitor" width="250"/></td>
+      <td align="center"><img src="screenshots/system-info-graphs.jpg" alt="Graphs" width="250"/></td>
+    </tr>
+    <tr>
+      <td align="center"><b>System Monitor</b></td>
+      <td align="center"><b>Graphs</b></td>
     </tr>
   </table>
 </div>
@@ -212,8 +173,4 @@ bash -c "$(curl -fsSL https://github.com/yusing/godoxy/raw/refs/heads/main/scrip
 
 5. build binary with `make build`
 
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=yusing/godoxy&type=Date)](https://www.star-history.com/#yusing/godoxy&Date)
-
 [🔼Back to top](#table-of-content)

README_CHT.md

@@ -1,91 +1,64 @@
 <div align="center">
 
-<img src="assets/godoxy.png" width="200">
+# GoDoxy
 
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
 ![GitHub last commit](https://img.shields.io/github/last-commit/yusing/godoxy)
 [![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-
-![Demo](https://img.shields.io/website?url=https%3A%2F%2Fdemo.godoxy.dev&label=Demo&link=https%3A%2F%2Fdemo.godoxy.dev)
+![Demo](https://img.shields.io/website?url=https%3A%2F%2Fgodoxy.demo.6uo.me&label=Demo&link=https%3A%2F%2Fgodoxy.demo.6uo.me)
 [![Discord](https://dcbadge.limes.pink/api/server/umReR62nRd?style=flat)](https://discord.gg/umReR62nRd)
 
-輕量、易用、 高效能，且帶有主頁和配置面板的反向代理
+輕量、易用、 [高效能](https://github.com/yusing/godoxy/wiki/Benchmarks)，且帶有主頁和配置面板的反向代理
 
-<h5>
-<a href="https://docs.godoxy.dev">網站</a> | <a href="https://docs.godoxy.dev/Home.html">文檔</a> | <a href="https://discord.gg/umReR62nRd">Discord</a>
-</h5>
+完整文檔請查閱 **[Wiki](https://github.com/yusing/godoxy/wiki)**（暫未有中文翻譯）
 
-<h5><a href="README.md">EN</a> | 中文</h5>
+<a href="README.md">EN</a> | **中文**
 
 <img src="https://github.com/user-attachments/assets/4bb371f4-6e4c-425c-89b2-b9e962bdd46f" style="max-width: 650">
 
-有疑問? 問 [ChatGPT](https://chatgpt.com/g/g-6825390374b481919ad482f2e48936a1-godoxy-assistant)！（鳴謝 [@ismesid](https://github.com/arevindh)）
-
 </div>
 
 ## 目錄
 
 <!-- TOC -->
 
-- [目錄](#目錄)
-- [運行示例](#運行示例)
-- [主要特點](#主要特點)
-- [前置需求](#前置需求)
-- [安裝](#安裝)
-  - [手動安裝](#手動安裝)
-  - [資料夾結構](#資料夾結構)
-- [更新 / 卸載系統代理 (System Agent)](#更新--卸載系統代理-system-agent)
-- [截圖](#截圖)
-  - [閒置休眠](#閒置休眠)
-  - [監控](#監控)
-- [自行編譯](#自行編譯)
-- [Star History](#star-history)
+- [GoDoxy](#godoxy)
+  - [目錄](#目錄)
+  - [運行示例](#運行示例)
+  - [主要特點](#主要特點)
+  - [前置需求](#前置需求)
+  - [安裝](#安裝)
+    - [手動安裝](#手動安裝)
+    - [資料夾結構](#資料夾結構)
+  - [截圖](#截圖)
+    - [閒置休眠](#閒置休眠)
+    - [監控](#監控)
+  - [自行編譯](#自行編譯)
 
 ## 運行示例
 
-<https://demo.godoxy.dev>
+<https://godoxy.demo.6uo.me>
 
 [![Deployed on Zeabur](https://zeabur.com/deployed-on-zeabur-dark.svg)](https://zeabur.com/referral?referralCode=yusing&utm_source=yusing&utm_campaign=oss)
 
 ## 主要特點
 
-- **簡單易用**
-  - 透過 Docker[標籤](https://docs.godoxy.dev/Docker-labels-and-Route-Files)或 WebUI 輕鬆設定
-  - [簡單的多節點設置](https://docs.godoxy.dev/Configurations#multi-docker-nodes-setup)
-  - 詳細的錯誤訊息，便於故障排除
-- **存取控制 (ACL)**：連線/請求層級存取控制
-  - IP/CIDR
-  - 國家 **(需要 Maxmind 帳戶)**
-  - 時區 **(需要 Maxmind 帳戶)**
-  - **存取日誌記錄**
-  - 定時發送摘要 (允許和拒絕的連線次數)
-- **自動化**
-  - 使用 Let's Encrypt 自動管理 SSL 憑證 ([使用 DNS-01 驗證](https://docs.godoxy.dev/DNS-01-Providers))
-  - Docker 容器自動配置
-  - 設定檔與容器狀態變更時自動熱重載
-- **容器運行時支援**
-  - Docker
-  - Podman
-- **閒置休眠**：根據流量停止和喚醒容器 _(參見[截圖](#閒置休眠))_
-  - Docker 容器
-  - Proxmox LXC 容器
-- **流量管理**
-  - HTTP 反向代理
-  - TCP/UDP 連接埠轉送
-  - **OpenID Connect 支援**：輕鬆實現單點登入 (SSO) 並保護您的應用程式
-  - **ForwardAuth 支援**：整合任何 auth provider (例如 TinyAuth)
-- **客製化**
-  - [HTTP 中介軟體](https://docs.godoxy.dev/Middlewares)
-  - [支援自訂錯誤頁面](https://docs.godoxy.dev/Custom-Error-Pages)
-- **網頁使用者介面 (Web UI)**
-  - 應用程式一覽
-  - 設定編輯器
-  - 執行時間與系統指標
-  - Docker 日誌檢視器
-- **跨平台支援**
-  - 支援 **linux/amd64** 與 **linux/arm64**
-- **高效能**
-  - 以 **[Go](https://go.dev)** 語言編寫
+- 容易使用
+  - 輕鬆配置
+  - 簡單的多節點設置
+  - 錯誤訊息清晰詳細，易於排除故障
+- 自動 SSL 憑證管理（參見 [支援的 DNS-01 驗證提供商](https://github.com/yusing/godoxy/wiki/Supported-DNS%E2%80%9001-Providers)）
+- 自動配置 Docker 容器
+- 容器狀態/配置文件變更時自動熱重載
+- **閒置休眠**：在閒置時停止容器，有流量時喚醒（_可選，參見[截圖](#閒置休眠)_）
+- OpenID Connect：輕鬆實現單點登入
+- HTTP(s) 反向代理和TCP 和 UDP 埠轉發
+- [HTTP 中介軟體](https://github.com/yusing/godoxy/wiki/Middlewares) 和 [自定義錯誤頁面](https://github.com/yusing/godoxy/wiki/Middlewares#custom-error-pages)
+- **網頁介面，具有應用儀表板和配置編輯器**
+- 支援 linux/amd64、linux/arm64
+- 使用 **[Go](https://go.dev)** 編寫
+
+[🔼回到頂部](#目錄)
 
 ## 前置需求
 
@@ -105,12 +78,14 @@
 
 2. 在目錄內運行安裝腳本，或[手動安裝](#手動安裝)
 
-   ```shell
-   /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/godoxy/main/scripts/setup.sh)"
-   ```
+    ```shell
+    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/godoxy/main/scripts/setup.sh)"
+    ```
 
 3. 現在可以在 WebUI `https://godoxy.yourdomain.com` 進行額外配置
 
+[🔼回到頂部](#目錄)
+
 ### 手動安裝
 
 1. 建立 `config` 目錄，然後將 `config.example.yml` 下載到 `config/config.yml`
@@ -146,37 +121,35 @@
 └── .env
 ```
 
-## 更新 / 卸載系統代理 (System Agent)
-
-更新：
-
-```bash
-sudo /bin/bash -c "$(curl -fsSL https://github.com/yusing/godoxy/raw/refs/heads/main/scripts/install-agent.sh)" -- update
-```
-
-卸載：
-
-```bash
-sudo /bin/bash -c "$(curl -fsSL https://github.com/yusing/godoxy/raw/refs/heads/main/scripts/install-agent.sh)" -- uninstall
-```
-
 ## 截圖
 
 ### 閒置休眠
 
 ![閒置休眠](screenshots/idlesleeper.webp)
 
+[🔼回到頂部](#目錄)
+
 ### 監控
 
 <div align="center">
   <table>
     <tr>
-      <td align="center"><img src="screenshots/routes.jpg" alt="Routes" width="350"/></td>
-      <td align="center"><img src="screenshots/servers.jpg" alt="Servers" width="350"/></td>
+      <td align="center"><img src="screenshots/uptime.png" alt="Uptime Monitor" width="250"/></td>
+      <td align="center"><img src="screenshots/docker-logs.jpg" alt="Docker Logs" width="250"/></td>
+      <td align="center"><img src="screenshots/docker.jpg" alt="Server Overview" width="250"/></td>
     </tr>
     <tr>
-      <td align="center"><b>路由</b></td>
-      <td align="center"><b>伺服器</b></td>
+      <td align="center"><b>運行時間監控</b></td>
+      <td align="center"><b>Docker 日誌</b></td>
+      <td align="center"><b>伺服器概覽</b></td>
+    </tr>
+        <tr>
+      <td align="center"><img src="screenshots/system-monitor.jpg" alt="System Monitor" width="250"/></td>
+      <td align="center"><img src="screenshots/system-info-graphs.jpg" alt="Graphs" width="250"/></td>
+    </tr>
+    <tr>
+      <td align="center"><b>系統監控</b></td>
+      <td align="center"><b>圖表</b></td>
     </tr>
   </table>
 </div>
@@ -193,8 +166,4 @@ sudo /bin/bash -c "$(curl -fsSL https://github.com/yusing/godoxy/raw/refs/heads/
 
 5. 使用 `make build` 編譯二進制檔案
 
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=yusing/godoxy&type=Date)](https://www.star-history.com/#yusing/godoxy&Date)
-
-[🔼 回到頂部](#目錄)
+[🔼回到頂部](#目錄)

agent/cmd/README.md

@@ -1,52 +0,0 @@
-# agent/cmd
-
-The main entry point for the GoDoxy Agent, a secure monitoring and proxy agent that runs alongside Docker containers.
-
-## Overview
-
-This package contains the `main.go` entry point for the GoDoxy Agent. The agent is a TLS-enabled server that provides:
-
-- Secure Docker socket proxying with client certificate authentication
-- HTTP proxy capabilities for container traffic
-- System metrics collection and monitoring
-- Health check endpoints
-
-## Architecture
-
-```mermaid
-graph TD
-    A[main] --> B[Logger Init]
-    A --> C[Load CA Certificate]
-    A --> D[Load Server Certificate]
-    A --> E[Log Version Info]
-    A --> F[Start Agent Server]
-    A --> G[Start Socket Proxy]
-    A --> H[Start System Info Poller]
-    A --> I[Wait Exit]
-
-    F --> F1[TLS with mTLS]
-    F --> F2[Agent Handler]
-    G --> G1[Docker Socket Proxy]
-```
-
-## Main Function Flow
-
-1. **Logger Setup**: Configures zerolog with console output
-1. **Certificate Loading**: Loads CA and server certificates for TLS/mTLS
-1. **Version Logging**: Logs agent version and configuration
-1. **Agent Server**: Starts the main HTTPS server with agent handlers
-1. **Socket Proxy**: Starts Docker socket proxy if configured
-1. **System Monitoring**: Starts system info polling
-1. **Graceful Shutdown**: Waits for exit signal (3 second timeout)
-
-## Configuration
-
-See `agent/pkg/env/README.md` for configuration options.
-
-## Dependencies
-
-- `agent/pkg/agent` - Core agent types and constants
-- `agent/pkg/env` - Environment configuration
-- `agent/pkg/server` - Server implementation
-- `socketproxy/pkg` - Docker socket proxy
-- `internal/metrics/systeminfo` - System metrics

agent/cmd/main.go

@@ -1,158 +1,60 @@
 package main
 
 import (
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"errors"
-	"net"
-	"net/http"
 	"os"
 
-	"github.com/rs/zerolog"
-	"github.com/rs/zerolog/log"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/godoxy/agent/pkg/agent/stream"
-	"github.com/yusing/godoxy/agent/pkg/env"
-	"github.com/yusing/godoxy/agent/pkg/handler"
-	"github.com/yusing/godoxy/internal/metrics/systeminfo"
-	socketproxy "github.com/yusing/godoxy/socketproxy/pkg"
-	gperr "github.com/yusing/goutils/errs"
-	httpServer "github.com/yusing/goutils/server"
-	strutils "github.com/yusing/goutils/strings"
-	"github.com/yusing/goutils/task"
-	"github.com/yusing/goutils/version"
+	"github.com/yusing/go-proxy/agent/pkg/agent"
+	"github.com/yusing/go-proxy/agent/pkg/env"
+	"github.com/yusing/go-proxy/agent/pkg/server"
+	"github.com/yusing/go-proxy/internal/gperr"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/logging/memlogger"
+	"github.com/yusing/go-proxy/internal/metrics/systeminfo"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/pkg"
 )
 
-// TODO: support IPv6
-
 func main() {
-	writer := zerolog.ConsoleWriter{
-		Out:        os.Stderr,
-		TimeFormat: "01-02 15:04",
-	}
-	zerolog.TimeFieldFormat = writer.TimeFormat
-	log.Logger = zerolog.New(writer).Level(zerolog.InfoLevel).With().Timestamp().Logger()
+	logging.InitLogger(os.Stderr, memlogger.GetMemLogger())
+
 	ca := &agent.PEMPair{}
 	err := ca.Load(env.AgentCACert)
 	if err != nil {
-		log.Fatal().Err(err).Msg("init CA error")
+		gperr.LogFatal("init CA error", err)
 	}
 	caCert, err := ca.ToTLSCert()
 	if err != nil {
-		log.Fatal().Err(err).Msg("init CA error")
+		gperr.LogFatal("init CA error", err)
 	}
 
 	srv := &agent.PEMPair{}
 	srv.Load(env.AgentSSLCert)
 	if err != nil {
-		log.Fatal().Err(err).Msg("init SSL error")
+		gperr.LogFatal("init SSL error", err)
 	}
 	srvCert, err := srv.ToTLSCert()
 	if err != nil {
-		log.Fatal().Err(err).Msg("init SSL error")
+		gperr.LogFatal("init SSL error", err)
 	}
 
-	log.Info().Msgf("GoDoxy Agent version %s", version.Get())
-	log.Info().Msgf("Agent name: %s", env.AgentName)
-	log.Info().Msgf("Agent port: %d", env.AgentPort)
-	log.Info().Msgf("Agent runtime: %s", env.Runtime)
+	logging.Info().Msgf("GoDoxy Agent version %s", pkg.GetVersion())
+	logging.Info().Msgf("Agent name: %s", env.AgentName)
+	logging.Info().Msgf("Agent port: %d", env.AgentPort)
 
-	log.Info().Msg(`
+	logging.Info().Msg(`
 Tips:
 1. To change the agent name, you can set the AGENT_NAME environment variable.
 2. To change the agent port, you can set the AGENT_PORT environment variable.
-	`)
+`)
 
 	t := task.RootTask("agent", false)
-
-	// One TCP listener on AGENT_PORT, then multiplex by TLS ALPN:
-	// - Stream ALPN: route to TCP stream tunnel handler (via http.Server.TLSNextProto)
-	// - Otherwise: route to HTTPS API handler
-	tcpListener, err := net.ListenTCP("tcp", &net.TCPAddr{Port: env.AgentPort})
-	if err != nil {
-		gperr.LogFatal("failed to listen on port", err)
-	}
-
-	caCertPool := x509.NewCertPool()
-	caCertPool.AddCert(caCert.Leaf)
-
-	muxTLSConfig := &tls.Config{
-		Certificates: []tls.Certificate{*srvCert},
-		ClientCAs:    caCertPool,
-		ClientAuth:   tls.RequireAndVerifyClientCert,
-		MinVersion:   tls.VersionTLS12,
-		// Keep HTTP limited to HTTP/1.1 (matching current agent server behavior)
-		// and add the stream tunnel ALPN for multiplexing.
-		NextProtos: []string{"http/1.1", stream.StreamALPN},
-	}
-	if env.AgentSkipClientCertCheck {
-		muxTLSConfig.ClientAuth = tls.NoClientCert
-	}
-
-	// TLS listener feeds the HTTP server. ALPN stream connections are intercepted
-	// using http.Server.TLSNextProto.
-	tlsLn := tls.NewListener(tcpListener, muxTLSConfig)
-
-	streamSrv := stream.NewTCPServerHandler(t.Context())
-
-	httpSrv := &http.Server{
-		Handler: handler.NewAgentHandler(),
-		BaseContext: func(net.Listener) context.Context {
-			return t.Context()
-		},
-		TLSNextProto: map[string]func(*http.Server, *tls.Conn, http.Handler){
-			// When a client negotiates StreamALPN, net/http will call this hook instead
-			// of treating the connection as HTTP.
-			stream.StreamALPN: func(_ *http.Server, conn *tls.Conn, _ http.Handler) {
-				// ServeConn blocks until the tunnel finishes.
-				streamSrv.ServeConn(conn)
-			},
-		},
-	}
-	{
-		subtask := t.Subtask("agent-http", true)
-		t.OnCancel("stop_http", func() {
-			_ = streamSrv.Close()
-			_ = httpSrv.Close()
-			_ = tlsLn.Close()
-		})
-		go func() {
-			err := httpSrv.Serve(tlsLn)
-			if err != nil && !errors.Is(err, http.ErrServerClosed) {
-				log.Error().Err(err).Msg("agent HTTP server stopped with error")
-			}
-			subtask.Finish(err)
-		}()
-		log.Info().Int("port", env.AgentPort).Msg("HTTPS API server started (ALPN mux enabled)")
-	}
-	log.Info().Int("port", env.AgentPort).Msg("TCP stream handler started (via TLSNextProto)")
-
-	{
-		udpServer := stream.NewUDPServer(t.Context(), "udp", &net.UDPAddr{Port: env.AgentPort}, caCert.Leaf, srvCert)
-		subtask := t.Subtask("agent-stream-udp", true)
-		t.OnCancel("stop_stream_udp", func() {
-			_ = udpServer.Close()
-		})
-		go func() {
-			err := udpServer.Start()
-			subtask.Finish(err)
-		}()
-		log.Info().Int("port", env.AgentPort).Msg("UDP stream server started")
-	}
-
-	if socketproxy.ListenAddr != "" {
-		runtime := strutils.Title(string(env.Runtime))
-
-		log.Info().Msgf("%s socket listening on: %s", runtime, socketproxy.ListenAddr)
-		opts := httpServer.Options{
-			Name:     runtime,
-			HTTPAddr: socketproxy.ListenAddr,
-			Handler:  socketproxy.NewHandler(),
-		}
-		httpServer.StartServer(t, opts)
+	opts := server.Options{
+		CACert:     caCert,
+		ServerCert: srvCert,
+		Port:       env.AgentPort,
 	}
 
+	server.StartAgentServer(t, opts)
 	systeminfo.Poller.Start()
 
 	task.WaitExit(3)

agent/go.mod

@@ -1,114 +0,0 @@
-module github.com/yusing/godoxy/agent
-
-go 1.25.5
-
-replace (
-	github.com/shirou/gopsutil/v4 => ../internal/gopsutil
-	github.com/yusing/godoxy => ../
-	github.com/yusing/godoxy/socketproxy => ../socket-proxy
-	github.com/yusing/goutils => ../goutils
-	github.com/yusing/goutils/http/reverseproxy => ../goutils/http/reverseproxy
-	github.com/yusing/goutils/http/websocket => ../goutils/http/websocket
-	github.com/yusing/goutils/server => ../goutils/server
-)
-
-exclude github.com/containerd/nerdctl/mod/tigron v0.0.0
-
-require (
-	github.com/bytedance/sonic v1.14.2
-	github.com/gin-gonic/gin v1.11.0
-	github.com/gorilla/websocket v1.5.3
-	github.com/pion/dtls/v3 v3.0.10
-	github.com/pion/transport/v3 v3.1.1
-	github.com/rs/zerolog v1.34.0
-	github.com/stretchr/testify v1.11.1
-	github.com/yusing/godoxy v0.0.0-00010101000000-000000000000
-	github.com/yusing/godoxy/socketproxy v0.0.0-00010101000000-000000000000
-	github.com/yusing/goutils v0.7.0
-	github.com/yusing/goutils/server v0.0.0-20260103043911-785deb23bd64
-)
-
-require (
-	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/PuerkitoBio/goquery v1.11.0 // indirect
-	github.com/andybalholm/brotli v1.2.0 // indirect
-	github.com/andybalholm/cascadia v1.3.3 // indirect
-	github.com/bytedance/gopkg v0.1.3 // indirect
-	github.com/bytedance/sonic/loader v0.4.0 // indirect
-	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cloudwego/base64x v0.1.6 // indirect
-	github.com/containerd/errdefs v1.0.0 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v29.1.3+incompatible // indirect
-	github.com/docker/go-connections v0.6.0 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
-	github.com/ebitengine/purego v0.9.1 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
-	github.com/gin-contrib/sse v1.1.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-playground/locales v0.14.1 // indirect
-	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.30.1 // indirect
-	github.com/goccy/go-json v0.10.5 // indirect
-	github.com/goccy/go-yaml v1.19.1 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 // indirect
-	github.com/klauspost/compress v1.18.2 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/lithammer/fuzzysearch v1.1.8 // indirect
-	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/moby/api v1.52.0 // indirect
-	github.com/moby/moby/client v0.2.1 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
-	github.com/pion/logging v0.2.4 // indirect
-	github.com/pion/transport/v4 v4.0.1 // indirect
-	github.com/pires/go-proxyproto v0.8.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/puzpuzpuz/xsync/v4 v4.2.0 // indirect
-	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.58.0 // indirect
-	github.com/samber/lo v1.52.0 // indirect
-	github.com/samber/slog-common v0.19.0 // indirect
-	github.com/samber/slog-zerolog/v2 v2.9.0 // indirect
-	github.com/shirou/gopsutil/v4 v4.25.12 // indirect
-	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
-	github.com/tklauser/go-sysconf v0.3.16 // indirect
-	github.com/tklauser/numcpus v0.11.0 // indirect
-	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.3.1 // indirect
-	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/valyala/fasthttp v1.68.0 // indirect
-	github.com/vincent-petithory/dataurl v1.0.0 // indirect
-	github.com/yusing/ds v0.3.1 // indirect
-	github.com/yusing/gointernals v0.1.16 // indirect
-	github.com/yusing/goutils/http/reverseproxy v0.0.0-20260103043911-785deb23bd64 // indirect
-	github.com/yusing/goutils/http/websocket v0.0.0-20260103043911-785deb23bd64 // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
-	go.opentelemetry.io/otel v1.39.0 // indirect
-	go.opentelemetry.io/otel/metric v1.39.0 // indirect
-	go.opentelemetry.io/otel/trace v1.39.0 // indirect
-	golang.org/x/arch v0.23.0 // indirect
-	golang.org/x/crypto v0.46.0 // indirect
-	golang.org/x/net v0.48.0 // indirect
-	golang.org/x/sys v0.39.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-)

agent/go.sum

@@ -1,338 +0,0 @@
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/PuerkitoBio/goquery v1.11.0 h1:jZ7pwMQXIITcUXNH83LLk+txlaEy6NVOfTuP43xxfqw=
-github.com/PuerkitoBio/goquery v1.11.0/go.mod h1:wQHgxUOU3JGuj3oD/QFfxUdlzW6xPHfqyHre6VMY4DQ=
-github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
-github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
-github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
-github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
-github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY=
-github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE=
-github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
-github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
-github.com/bytedance/sonic v1.14.2 h1:k1twIoe97C1DtYUo+fZQy865IuHia4PR5RPiuGPPIIE=
-github.com/bytedance/sonic v1.14.2/go.mod h1:T80iDELeHiHKSc0C9tubFygiuXoGzrkjKzX2quAx980=
-github.com/bytedance/sonic/loader v0.4.0 h1:olZ7lEqcxtZygCK9EKYKADnpQoYkRQxaeY2NYzevs+o=
-github.com/bytedance/sonic/loader v0.4.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
-github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
-github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
-github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
-github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
-github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
-github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
-github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
-github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
-github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
-github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/diskfs/go-diskfs v1.7.0 h1:vonWmt5CMowXwUc79jWyGrf2DIMeoOjkLlMnQYGVOs8=
-github.com/diskfs/go-diskfs v1.7.0/go.mod h1:LhQyXqOugWFRahYUSw47NyZJPezFzB9UELwhpszLP/k=
-github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
-github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
-github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v29.1.3+incompatible h1:+kz9uDWgs+mAaIZojWfFt4d53/jv0ZUOOoSh5ZnH36c=
-github.com/docker/cli v29.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
-github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
-github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
-github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
-github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
-github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
-github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
-github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
-github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
-github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
-github.com/go-acme/lego/v4 v4.30.1 h1:tmb6U0lvy8Mc3lQbqKwTat7oAhE8FUYNJ3D0gSg6pJU=
-github.com/go-acme/lego/v4 v4.30.1/go.mod h1:V7m/Ip+EeFkjOe028+zeH+SwWtESxw1LHelwMIfAjm4=
-github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
-github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
-github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
-github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
-github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
-github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
-github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
-github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
-github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
-github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
-github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
-github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
-github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/goccy/go-yaml v1.19.1 h1:3rG3+v8pkhRqoQ/88NYNMHYVGYztCOCIZ7UQhu7H+NE=
-github.com/goccy/go-yaml v1.19.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
-github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
-github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
-github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
-github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gotify/server/v2 v2.8.0 h1:E3UDDn/3rFZi1sjZfbuhXNnxJP3ACZhdcw/iySegPRA=
-github.com/gotify/server/v2 v2.8.0/go.mod h1:6ci5adxcE2hf1v+2oowKiQmixOxXV8vU+CRLKP6sqZA=
-github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
-github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
-github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/Kgo2/7xNSUuC5G28VR8ljfrLKU2G4IjU=
-github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0=
-github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
-github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
-github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/lithammer/fuzzysearch v1.1.8 h1:/HIuJnjHuXS8bKaiTMeeDlW2/AyIWk2brx1V8LFgLN4=
-github.com/lithammer/fuzzysearch v1.1.8/go.mod h1:IdqeyBClc3FFqSzYq/MXESsS4S0FsZ5ajtkr5xPLts4=
-github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIiZhtifTV5OUqqiP82UAl0h87xj/l9k=
-github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/luthermonson/go-proxmox v0.3.1 h1:h64s4/zIEQ06TBo0phFKcckV441YpvUPgLfRAptYsjY=
-github.com/luthermonson/go-proxmox v0.3.1/go.mod h1:oyFgg2WwTEIF0rP6ppjiixOHa5ebK1p8OaRiFhvICBQ=
-github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
-github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/miekg/dns v1.1.69 h1:Kb7Y/1Jo+SG+a2GtfoFUfDkG//csdRPwRLkCsxDG9Sc=
-github.com/miekg/dns v1.1.69/go.mod h1:7OyjD9nEba5OkqQ/hB4fy3PIoxafSZJtducccIelz3g=
-github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
-github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/moby/api v1.52.0 h1:00BtlJY4MXkkt84WhUZPRqt5TvPbgig2FZvTbe3igYg=
-github.com/moby/moby/api v1.52.0/go.mod h1:8mb+ReTlisw4pS6BRzCMts5M49W5M7bKt1cJy/YbAqc=
-github.com/moby/moby/client v0.2.1 h1:1Grh1552mvv6i+sYOdY+xKKVTvzJegcVMhuXocyDz/k=
-github.com/moby/moby/client v0.2.1/go.mod h1:O+/tw5d4a1Ha/ZA/tPxIZJapJRUS6LNZ1wiVRxYHyUE=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
-github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
-github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5MbwsmL4MRQE=
-github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
-github.com/pion/dtls/v3 v3.0.10 h1:k9ekkq1kaZoxnNEbyLKI8DI37j/Nbk1HWmMuywpQJgg=
-github.com/pion/dtls/v3 v3.0.10/go.mod h1:YEmmBYIoBsY3jmG56dsziTv/Lca9y4Om83370CXfqJ8=
-github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
-github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
-github.com/pion/transport/v3 v3.1.1 h1:Tr684+fnnKlhPceU+ICdrw6KKkTms+5qHMgw6bIkYOM=
-github.com/pion/transport/v3 v3.1.1/go.mod h1:+c2eewC5WJQHiAA46fkMMzoYZSuGzA/7E2FPrOYHctQ=
-github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o=
-github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM=
-github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
-github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
-github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
-github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
-github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.58.0 h1:ggY2pvZaVdB9EyojxL1p+5mptkuHyX5MOSv4dgWF4Ug=
-github.com/quic-go/quic-go v0.58.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
-github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
-github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
-github.com/samber/lo v1.52.0 h1:Rvi+3BFHES3A8meP33VPAxiBZX/Aws5RxrschYGjomw=
-github.com/samber/lo v1.52.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
-github.com/samber/slog-common v0.19.0 h1:fNcZb8B2uOLooeYwFpAlKjkQTUafdjfqKcwcC89G9YI=
-github.com/samber/slog-common v0.19.0/go.mod h1:dTz+YOU76aH007YUU0DffsXNsGFQRQllPQh9XyNoA3M=
-github.com/samber/slog-zerolog/v2 v2.9.0 h1:6LkOabJmZdNLaUWkTC3IVVA+dq7b/V0FM6lz6/7+THI=
-github.com/samber/slog-zerolog/v2 v2.9.0/go.mod h1:gnQW9VnCfM34v2pRMUIGMsZOVbYLqY/v0Wxu6atSVGc=
-github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
-github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
-github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
-github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
-github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
-github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
-github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
-github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
-github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
-github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
-github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
-github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.68.0 h1:v12Nx16iepr8r9ySOwqI+5RBJ/DqTxhOy1HrHoDFnok=
-github.com/valyala/fasthttp v1.68.0/go.mod h1:5EXiRfYQAoiO/khu4oU9VISC/eVY6JqmSpPJoHCKsz4=
-github.com/vincent-petithory/dataurl v1.0.0 h1:cXw+kPto8NLuJtlMsI152irrVw9fRDX8AbShPRpg2CI=
-github.com/vincent-petithory/dataurl v1.0.0/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
-github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
-github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yusing/ds v0.3.1 h1:mCqTgTQD8RhiBpcysvii5kZ7ZBmqcknVsFubNALGLbY=
-github.com/yusing/ds v0.3.1/go.mod h1:XhKV4l7cZwBbbl7lRzNC9zX27zvCM0frIwiuD40ULRk=
-github.com/yusing/gointernals v0.1.16 h1:GrhZZdxzA+jojLEqankctJrOuAYDb7kY1C93S1pVR34=
-github.com/yusing/gointernals v0.1.16/go.mod h1:B/0FVXt4WPmgzVy3ynzkqKi+BSGaJVmwCJBRXYapo34=
-github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
-github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 h1:ssfIgGNANqpVFCndZvcuyKbl0g+UAVcbBcqGkG28H0Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0/go.mod h1:GQ/474YrbE4Jx8gZ4q5I4hrhUzM6UPzyrqJYV2AqPoQ=
-go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
-go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
-go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
-go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
-go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
-go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
-go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
-go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
-go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
-go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
-go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
-golang.org/x/arch v0.23.0 h1:lKF64A2jF6Zd8L0knGltUnegD62JMFBiCPBmQpToHhg=
-golang.org/x/arch v0.23.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
-golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
-golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
-golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
-gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
-pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=

agent/pkg/agent/README.md

@@ -1,108 +0,0 @@
-# Agent Package
-
-The `agent` package provides the client-side implementation for interacting with GoDoxy agents. It handles agent configuration, secure communication via TLS, and provides utilities for agent deployment and management.
-
-## Architecture Overview
-
-```mermaid
-graph TD
-    subgraph GoDoxy Server
-        AP[Agent Pool] --> AC[AgentConfig]
-    end
-
-    subgraph Agent Communication
-        AC -->|HTTPS| AI[Agent Info API]
-        AC -->|TLS| ST[Stream Tunneling]
-    end
-
-    subgraph Deployment
-        G[Generator] --> DC[Docker Compose]
-        G --> IS[Install Script]
-    end
-
-    subgraph Security
-        NA[NewAgent] --> Certs[Certificates]
-    end
-```
-
-## File Structure
-
-| File                                                     | Purpose                                                   |
-| -------------------------------------------------------- | --------------------------------------------------------- |
-| [`config.go`](agent/pkg/agent/config.go)                 | Core configuration, initialization, and API client logic. |
-| [`new_agent.go`](agent/pkg/agent/new_agent.go)           | Agent creation and certificate generation logic.          |
-| [`docker_compose.go`](agent/pkg/agent/docker_compose.go) | Generator for agent Docker Compose configurations.        |
-| [`bare_metal.go`](agent/pkg/agent/bare_metal.go)         | Generator for bare metal installation scripts.            |
-| [`env.go`](agent/pkg/agent/env.go)                       | Environment configuration types and constants.            |
-| [`common/`](agent/pkg/agent/common)                      | Shared constants and utilities for agents.                |
-
-## Core Types
-
-### [`AgentConfig`](agent/pkg/agent/config.go:29)
-
-The primary struct used by the GoDoxy server to manage a connection to an agent. It stores the agent's address, metadata, and TLS configuration.
-
-### [`AgentInfo`](agent/pkg/agent/config.go:45)
-
-Contains basic metadata about the agent, including its version, name, and container runtime (Docker or Podman).
-
-### [`PEMPair`](agent/pkg/agent/new_agent.go:53)
-
-A utility struct for handling PEM-encoded certificate and key pairs, supporting encryption, decryption, and conversion to `tls.Certificate`.
-
-## Agent Creation and Certificate Management
-
-### Certificate Generation
-
-The [`NewAgent`](agent/pkg/agent/new_agent.go:147) function creates a complete certificate infrastructure for an agent:
-
-- **CA Certificate**: Self-signed root certificate with 1000-year validity.
-- **Server Certificate**: For the agent's HTTPS server, signed by the CA.
-- **Client Certificate**: For the GoDoxy server to authenticate with the agent.
-
-All certificates use ECDSA with P-256 curve and SHA-256 signatures.
-
-### Certificate Security
-
-- Certificates are encrypted using AES-GCM with a provided encryption key.
-- The [`PEMPair`](agent/pkg/agent/new_agent.go:53) struct provides methods for encryption, decryption, and conversion to `tls.Certificate`.
-- Base64 encoding is used for certificate storage and transmission.
-
-## Key Features
-
-### 1. Secure Communication
-
-All communication between the GoDoxy server and agents is secured using mutual TLS (mTLS). The [`AgentConfig`](agent/pkg/agent/config.go:29) handles the loading of CA and client certificates to establish secure connections.
-
-### 2. Agent Discovery and Initialization
-
-The [`Init`](agent/pkg/agent/config.go:231) and [`InitWithCerts`](agent/pkg/agent/config.go:110) methods allow the server to:
-
-- Fetch agent metadata (version, name, runtime).
-- Verify compatibility between server and agent versions.
-- Test support for TCP and UDP stream tunneling.
-
-### 3. Deployment Generators
-
-The package provides interfaces and implementations for generating deployment artifacts:
-
-- **Docker Compose**: Generates a `docker-compose.yml` for running the agent as a container via [`AgentComposeConfig.Generate()`](agent/pkg/agent/docker_compose.go:21).
-- **Bare Metal**: Generates a shell script to install and run the agent as a systemd service via [`AgentEnvConfig.Generate()`](agent/pkg/agent/bare_metal.go:27).
-
-### 4. Fake Docker Host
-
-The package supports a "fake" Docker host scheme (`agent://<addr>`) to identify containers managed by an agent, allowing the GoDoxy server to route requests appropriately. See [`IsDockerHostAgent`](agent/pkg/agent/config.go:90) and [`GetAgentAddrFromDockerHost`](agent/pkg/agent/config.go:94).
-
-## Usage Example
-
-```go
-cfg := &agent.AgentConfig{}
-cfg.Parse("192.168.1.100:8081")
-
-ctx := context.Background()
-if err := cfg.Init(ctx); err != nil {
-    log.Fatal(err)
-}
-
-fmt.Printf("Connected to agent: %s (Version: %s)\n", cfg.Name, cfg.Version)
-```

agent/pkg/agent/agents.go

@@ -0,0 +1,16 @@
+package agent
+
+import (
+	"github.com/yusing/go-proxy/internal/utils/pool"
+)
+
+type agents struct{ pool.Pool[*AgentConfig] }
+
+var Agents = agents{pool.New[*AgentConfig]("agents")}
+
+func (agents agents) Get(agentAddrOrDockerHost string) (*AgentConfig, bool) {
+	if !IsDockerHostAgent(agentAddrOrDockerHost) {
+		return agents.Base().Load(agentAddrOrDockerHost)
+	}
+	return agents.Base().Load(GetAgentAddrFromDockerHost(agentAddrOrDockerHost))
+}

agent/pkg/agent/bare_metal.go

@@ -10,17 +10,7 @@ var (
 	AGENT_PORT="{{.Port}}" \
 	AGENT_CA_CERT="{{.CACert}}" \
 	AGENT_SSL_CERT="{{.SSLCert}}" \
-	{{ if eq .ContainerRuntime "nerdctl" -}}
-	DOCKER_SOCKET="/var/run/containerd/containerd.sock" \
-	RUNTIME="nerdctl" \
-	{{ else if eq .ContainerRuntime "podman" -}}
-	DOCKER_SOCKET="/var/run/podman/podman.sock" \
-	RUNTIME="podman" \
-	{{ else -}}
-	DOCKER_SOCKET="/var/run/docker.sock" \
-	RUNTIME="docker" \
-	{{ end -}}
-	bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/godoxy/main/scripts/install-agent.sh)"`
+	bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/go-proxy/main/scripts/install-agent.sh)"`
 	installScriptTemplate = template.Must(template.New("install.sh").Parse(installScript))
 )
 

agent/pkg/agent/common/common.go

@@ -1,3 +0,0 @@
-package common
-
-const CertsDNSName = "godoxy.agent"

agent/pkg/agent/config.go

@@ -4,11 +4,6 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"encoding/json"
-	"encoding/pem"
-	"errors"
-	"fmt"
-	"io"
 	"net"
 	"net/http"
 	"net/url"
@@ -16,53 +11,29 @@ import (
 	"strings"
 	"time"
 
-	"github.com/rs/zerolog"
-	"github.com/rs/zerolog/log"
-	"github.com/yusing/godoxy/agent/pkg/agent/common"
-	agentstream "github.com/yusing/godoxy/agent/pkg/agent/stream"
-	"github.com/yusing/godoxy/agent/pkg/certs"
-	gperr "github.com/yusing/goutils/errs"
-	httputils "github.com/yusing/goutils/http"
-	"github.com/yusing/goutils/version"
+	"github.com/yusing/go-proxy/agent/pkg/certs"
+	"github.com/yusing/go-proxy/internal/gperr"
+	"github.com/yusing/go-proxy/internal/net/gphttp"
+	"github.com/yusing/go-proxy/pkg"
 )
 
 type AgentConfig struct {
-	AgentInfo
+	Addr string
 
-	Addr                 string `json:"addr"`
-	IsTCPStreamSupported bool   `json:"supports_tcp_stream"`
-	IsUDPStreamSupported bool   `json:"supports_udp_stream"`
-
-	// for stream
-	caCert     *x509.Certificate
-	clientCert *tls.Certificate
-
-	tlsConfig tls.Config
-
-	l zerolog.Logger
-} // @name Agent
-
-type AgentInfo struct {
-	Version version.Version  `json:"version" swaggertype:"string"`
-	Name    string           `json:"name"`
-	Runtime ContainerRuntime `json:"runtime"`
+	httpClient *http.Client
+	tlsConfig  *tls.Config
+	name       string
 }
 
-// Deprecated. Replaced by EndpointInfo
 const (
-	EndpointVersion = "/version"
-	EndpointName    = "/name"
-	EndpointRuntime = "/runtime"
-)
-
-const (
-	EndpointInfo       = "/info"
+	EndpointVersion    = "/version"
+	EndpointName       = "/name"
 	EndpointProxyHTTP  = "/proxy/http"
 	EndpointHealth     = "/health"
 	EndpointLogs       = "/logs"
 	EndpointSystemInfo = "/system_info"
 
-	AgentHost = common.CertsDNSName
+	AgentHost = CertsDNSName
 
 	APIEndpointBase = "/godoxy/agent"
 	APIBaseURL      = "https://" + AgentHost + APIEndpointBase
@@ -73,20 +44,21 @@ const (
 	FakeDockerHostPrefixLen = len(FakeDockerHostPrefix)
 )
 
-func mustParseURL(urlStr string) *url.URL {
-	u, err := url.Parse(urlStr)
-	if err != nil {
-		panic(err)
-	}
-	return u
-}
-
 var (
-	AgentURL              = mustParseURL(APIBaseURL)
-	HTTPProxyURL          = mustParseURL(APIBaseURL + EndpointProxyHTTP)
+	AgentURL, _           = url.Parse(APIBaseURL)
+	HTTPProxyURL, _       = url.Parse(APIBaseURL + EndpointProxyHTTP)
 	HTTPProxyURLPrefixLen = len(APIEndpointBase + EndpointProxyHTTP)
 )
 
+// TestAgentConfig is a helper function to create an AgentConfig for testing purposes.
+// Not used in production.
+func TestAgentConfig(name string, addr string) *AgentConfig {
+	return &AgentConfig{
+		name: name,
+		Addr: addr,
+	}
+}
+
 func IsDockerHostAgent(dockerHost string) bool {
 	return strings.HasPrefix(dockerHost, FakeDockerHostPrefix)
 }
@@ -95,6 +67,11 @@ func GetAgentAddrFromDockerHost(dockerHost string) string {
 	return dockerHost[FakeDockerHostPrefixLen:]
 }
 
+// Key implements pool.Object
+func (cfg *AgentConfig) Key() string {
+	return cfg.Addr
+}
+
 func (cfg *AgentConfig) FakeDockerHost() string {
 	return FakeDockerHostPrefix + cfg.Addr
 }
@@ -104,179 +81,76 @@ func (cfg *AgentConfig) Parse(addr string) error {
 	return nil
 }
 
-var serverVersion = version.Get()
-
-// InitWithCerts initializes the agent config with the given CA, certificate, and key.
 func (cfg *AgentConfig) InitWithCerts(ctx context.Context, ca, crt, key []byte) error {
 	clientCert, err := tls.X509KeyPair(crt, key)
 	if err != nil {
 		return err
 	}
-	cfg.clientCert = &clientCert
 
 	// create tls config
 	caCertPool := x509.NewCertPool()
 	ok := caCertPool.AppendCertsFromPEM(ca)
 	if !ok {
-		return errors.New("invalid ca certificate")
-	}
-	// Keep the CA leaf for stream client dialing.
-	if block, _ := pem.Decode(ca); block == nil || block.Type != "CERTIFICATE" {
-		return errors.New("invalid ca certificate")
-	} else if cert, err := x509.ParseCertificate(block.Bytes); err != nil {
-		return err
-	} else {
-		cfg.caCert = cert
+		return gperr.New("invalid ca certificate")
 	}
 
-	cfg.tlsConfig = tls.Config{
+	cfg.tlsConfig = &tls.Config{
 		Certificates: []tls.Certificate{clientCert},
 		RootCAs:      caCertPool,
-		ServerName:   common.CertsDNSName,
-		MinVersion:   tls.VersionTLS12,
+		ServerName:   CertsDNSName,
 	}
 
+	// create transport and http client
+	cfg.httpClient = cfg.NewHTTPClient()
+
 	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
 
-	status, err := cfg.fetchJSON(ctx, EndpointInfo, &cfg.AgentInfo)
+	// check agent version
+	version, _, err := cfg.Fetch(ctx, EndpointVersion)
 	if err != nil {
 		return err
 	}
 
-	var streamUnsupportedErrs gperr.Builder
-
-	if status == http.StatusOK {
-		// test stream server connection
-		const fakeAddress = "localhost:8080" // it won't be used, just for testing
-		// test TCP stream support
-		err := agentstream.TCPHealthCheck(cfg.Addr, cfg.caCert, cfg.clientCert)
-		if err != nil {
-			streamUnsupportedErrs.Addf("failed to connect to stream server via TCP: %w", err)
-		} else {
-			cfg.IsTCPStreamSupported = true
-		}
-
-		// test UDP stream support
-		err = agentstream.UDPHealthCheck(cfg.Addr, cfg.caCert, cfg.clientCert)
-		if err != nil {
-			streamUnsupportedErrs.Addf("failed to connect to stream server via UDP: %w", err)
-		} else {
-			cfg.IsUDPStreamSupported = true
-		}
-	} else {
-		// old agent does not support EndpointInfo
-		// fallback with old logic
-		cfg.IsTCPStreamSupported = false
-		cfg.IsUDPStreamSupported = false
-		streamUnsupportedErrs.Adds("agent version is too old, does not support stream tunneling")
-
-		// get agent name
-		name, _, err := cfg.fetchString(ctx, EndpointName)
-		if err != nil {
-			return err
-		}
-
-		cfg.Name = name
-
-		// check agent version
-		agentVersion, _, err := cfg.fetchString(ctx, EndpointVersion)
-		if err != nil {
-			return err
-		}
-
-		cfg.Version = version.Parse(agentVersion)
-
-		// check agent runtime
-		runtime, status, err := cfg.fetchString(ctx, EndpointRuntime)
-		if err != nil {
-			return err
-		}
-
-		switch status {
-		case http.StatusOK:
-			switch runtime {
-			case "docker":
-				cfg.Runtime = ContainerRuntimeDocker
-			// case "nerdctl":
-			// 	cfg.Runtime = ContainerRuntimeNerdctl
-			case "podman":
-				cfg.Runtime = ContainerRuntimePodman
-			default:
-				return fmt.Errorf("invalid agent runtime: %s", runtime)
-			}
-		case http.StatusNotFound:
-			// backward compatibility, old agent does not have runtime endpoint
-			cfg.Runtime = ContainerRuntimeDocker
-		default:
-			return fmt.Errorf("failed to get agent runtime: HTTP %d %s", status, runtime)
-		}
+	agentVer := pkg.ParseVersion(string(version))
+	serverVer := pkg.GetVersion()
+	if !agentVer.IsEqual(serverVer) {
+		return gperr.Errorf("agent version mismatch: server: %s, agent: %s", serverVer, agentVer)
 	}
 
-	cfg.l = log.With().Str("agent", cfg.Name).Logger()
-
-	if err := streamUnsupportedErrs.Error(); err != nil {
-		gperr.LogWarn("agent has limited/no stream tunneling support, TCP and UDP routes via agent will not work", err, &cfg.l)
+	// get agent name
+	name, _, err := cfg.Fetch(ctx, EndpointName)
+	if err != nil {
+		return err
 	}
 
-	if serverVersion.IsNewerThanMajor(cfg.Version) {
-		log.Warn().Msgf("agent %s major version mismatch: server: %s, agent: %s", cfg.Name, serverVersion, cfg.Version)
-	}
-
-	log.Info().Msgf("agent %q initialized", cfg.Name)
+	cfg.name = string(name)
 	return nil
 }
 
-// Init initializes the agent config with the given context.
-func (cfg *AgentConfig) Init(ctx context.Context) error {
+func (cfg *AgentConfig) Init(ctx context.Context) gperr.Error {
 	filepath, ok := certs.AgentCertsFilepath(cfg.Addr)
 	if !ok {
-		return fmt.Errorf("invalid agent host: %s", cfg.Addr)
+		return gperr.New("invalid agent host").Subject(cfg.Addr)
 	}
 
 	certData, err := os.ReadFile(filepath)
 	if err != nil {
-		return fmt.Errorf("failed to read agent certs: %w", err)
+		return gperr.Wrap(err, "failed to read agent certs")
 	}
 
 	ca, crt, key, err := certs.ExtractCert(certData)
 	if err != nil {
-		return fmt.Errorf("failed to extract agent certs: %w", err)
+		return gperr.Wrap(err, "failed to extract agent certs")
 	}
 
-	return cfg.InitWithCerts(ctx, ca, crt, key)
+	return gperr.Wrap(cfg.InitWithCerts(ctx, ca, crt, key))
 }
 
-// NewTCPClient creates a new TCP client for the agent.
-//
-// It returns an error if
-//   - the agent is not initialized
-//   - the agent does not support TCP stream tunneling
-//   - the agent stream server address is not initialized
-func (cfg *AgentConfig) NewTCPClient(targetAddress string) (net.Conn, error) {
-	if cfg.caCert == nil || cfg.clientCert == nil {
-		return nil, errors.New("agent is not initialized")
+func (cfg *AgentConfig) NewHTTPClient() *http.Client {
+	return &http.Client{
+		Transport: cfg.Transport(),
 	}
-	if !cfg.IsTCPStreamSupported {
-		return nil, errors.New("agent does not support TCP stream tunneling")
-	}
-	return agentstream.NewTCPClient(cfg.Addr, targetAddress, cfg.caCert, cfg.clientCert)
-}
-
-// NewUDPClient creates a new UDP client for the agent.
-//
-// It returns an error if
-//   - the agent is not initialized
-//   - the agent does not support UDP stream tunneling
-//   - the agent stream server address is not initialized
-func (cfg *AgentConfig) NewUDPClient(targetAddress string) (net.Conn, error) {
-	if cfg.caCert == nil || cfg.clientCert == nil {
-		return nil, errors.New("agent is not initialized")
-	}
-	if !cfg.IsUDPStreamSupported {
-		return nil, errors.New("agent does not support UDP stream tunneling")
-	}
-	return agentstream.NewUDPClient(cfg.Addr, targetAddress, cfg.caCert, cfg.clientCert)
 }
 
 func (cfg *AgentConfig) Transport() *http.Transport {
@@ -290,75 +164,30 @@ func (cfg *AgentConfig) Transport() *http.Transport {
 			}
 			return cfg.DialContext(ctx)
 		},
-		TLSClientConfig: &cfg.tlsConfig,
+		TLSClientConfig: cfg.tlsConfig,
 	}
 }
 
-func (cfg *AgentConfig) TLSConfig() *tls.Config {
-	return &cfg.tlsConfig
+func (cfg *AgentConfig) DialContext(ctx context.Context) (net.Conn, error) {
+	return gphttp.DefaultDialer.DialContext(ctx, "tcp", cfg.Addr)
 }
 
-var dialer = &net.Dialer{Timeout: 5 * time.Second}
+func (cfg *AgentConfig) IsInitialized() bool {
+	return cfg.name != ""
+}
 
-func (cfg *AgentConfig) DialContext(ctx context.Context) (net.Conn, error) {
-	return dialer.DialContext(ctx, "tcp", cfg.Addr)
+func (cfg *AgentConfig) Name() string {
+	return cfg.name
 }
 
 func (cfg *AgentConfig) String() string {
-	return cfg.Name + "@" + cfg.Addr
+	return cfg.name + "@" + cfg.Addr
 }
 
-func (cfg *AgentConfig) do(ctx context.Context, method, endpoint string, body io.Reader) (*http.Response, error) {
-	req, err := http.NewRequestWithContext(ctx, method, APIBaseURL+endpoint, body)
-	if err != nil {
-		return nil, err
+// MarshalMap implements pool.Object
+func (cfg *AgentConfig) MarshalMap() map[string]any {
+	return map[string]any{
+		"name": cfg.Name(),
+		"addr": cfg.Addr,
 	}
-	client := http.Client{
-		Transport: cfg.Transport(),
-	}
-	return client.Do(req)
-}
-
-func (cfg *AgentConfig) fetchString(ctx context.Context, endpoint string) (string, int, error) {
-	resp, err := cfg.do(ctx, "GET", endpoint, nil)
-	if err != nil {
-		return "", 0, err
-	}
-	defer resp.Body.Close()
-
-	data, release, err := httputils.ReadAllBody(resp)
-	if err != nil {
-		return "", 0, err
-	}
-	ret := string(data)
-	release(data)
-	return ret, resp.StatusCode, nil
-}
-
-// fetchJSON fetches a JSON response from the agent and unmarshals it into the provided struct
-//
-// It will return the status code of the response, and error if any.
-// If the status code is not http.StatusOK, out will be unchanged but error will still be nil.
-func (cfg *AgentConfig) fetchJSON(ctx context.Context, endpoint string, out any) (int, error) {
-	resp, err := cfg.do(ctx, "GET", endpoint, nil)
-	if err != nil {
-		return 0, err
-	}
-	defer resp.Body.Close()
-
-	data, release, err := httputils.ReadAllBody(resp)
-	if err != nil {
-		return 0, err
-	}
-
-	defer release(data)
-	if resp.StatusCode != http.StatusOK {
-		return resp.StatusCode, nil
-	}
-
-	err = json.Unmarshal(data, out)
-	if err != nil {
-		return 0, err
-	}
-	return resp.StatusCode, nil
 }

agent/pkg/agent/docker_compose.go

@@ -8,9 +8,9 @@ import (
 )
 
 var (
-	//go:embed templates/agent.compose.yml.tmpl
+	//go:embed templates/agent.compose.yml
 	agentComposeYAML         string
-	agentComposeYAMLTemplate = template.Must(template.New("agent.compose.yml.tmpl").Parse(agentComposeYAML))
+	agentComposeYAMLTemplate = template.Must(template.New("agent.compose.yml").Parse(agentComposeYAML))
 )
 
 const (
@@ -20,8 +20,7 @@ const (
 
 func (c *AgentComposeConfig) Generate() (string, error) {
 	buf := bytes.NewBuffer(make([]byte, 0, 1024))
-	err := agentComposeYAMLTemplate.Execute(buf, c)
-	if err != nil {
+	if err := agentComposeYAMLTemplate.Execute(buf, c); err != nil {
 		return "", err
 	}
 	return buf.String(), nil

agent/pkg/agent/env.go

@@ -1,13 +1,11 @@
 package agent
 
 type (
-	ContainerRuntime string
-	AgentEnvConfig   struct {
-		Name             string
-		Port             int
-		CACert           string
-		SSLCert          string
-		ContainerRuntime ContainerRuntime
+	AgentEnvConfig struct {
+		Name    string
+		Port    int
+		CACert  string
+		SSLCert string
 	}
 	AgentComposeConfig struct {
 		Image string
@@ -17,9 +15,3 @@ type (
 		Generate() (string, error)
 	}
 )
-
-const (
-	ContainerRuntimeDocker ContainerRuntime = "docker"
-	ContainerRuntimePodman ContainerRuntime = "podman"
-	// ContainerRuntimeNerdctl ContainerRuntime = "nerdctl"
-)

agent/pkg/agent/new_agent.go

@@ -1,47 +1,31 @@
 package agent
 
 import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/ecdsa"
-	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/rsa"
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/base64"
 	"encoding/pem"
 	"errors"
-	"fmt"
-	"io"
 	"math/big"
 	"strings"
 	"time"
-
-	"github.com/yusing/godoxy/agent/pkg/agent/common"
 )
 
-func toPEMPair(certDER []byte, key *ecdsa.PrivateKey) *PEMPair {
-	marshaledKey, err := marshalECPrivateKey(key)
-	if err != nil {
-		// This is a critical internal error during PEM encoding of a newly generated key.
-		// Panicking is acceptable here as it indicates a fundamental issue.
-		panic(fmt.Sprintf("failed to marshal EC private key for PEM encoding: %v", err))
-	}
+const (
+	CertsDNSName = "godoxy.agent"
+	KeySize      = 2048
+)
+
+func toPEMPair(certDER []byte, key *rsa.PrivateKey) *PEMPair {
 	return &PEMPair{
 		Cert: pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER}),
-		Key:  pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: marshaledKey}),
+		Key:  pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}),
 	}
 }
 
-func marshalECPrivateKey(key *ecdsa.PrivateKey) ([]byte, error) {
-	derBytes, err := x509.MarshalECPrivateKey(key)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal EC private key: %w", err)
-	}
-	return derBytes, nil
-}
-
 func b64Encode(data []byte) string {
 	return base64.StdEncoding.EncodeToString(data)
 }
@@ -74,99 +58,27 @@ func (p *PEMPair) Load(data string) (err error) {
 	return nil
 }
 
-func (p *PEMPair) Encrypt(encKey []byte) (PEMPair, error) {
-	cert, err := encrypt(p.Cert, encKey)
-	if err != nil {
-		return PEMPair{}, err
-	}
-	key, err := encrypt(p.Key, encKey)
-	if err != nil {
-		return PEMPair{}, err
-	}
-	return PEMPair{Cert: cert, Key: key}, nil
-}
-
-func (p *PEMPair) Decrypt(encKey []byte) (PEMPair, error) {
-	cert, err := decrypt(p.Cert, encKey)
-	if err != nil {
-		return PEMPair{}, err
-	}
-	key, err := decrypt(p.Key, encKey)
-	if err != nil {
-		return PEMPair{}, err
-	}
-	return PEMPair{Cert: cert, Key: key}, nil
-}
-
-func encrypt(data []byte, key []byte) ([]byte, error) {
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return nil, err
-	}
-
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return nil, err
-	}
-	nonce := make([]byte, gcm.NonceSize())
-	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-		return nil, err
-	}
-	return gcm.Seal(nonce, nonce, data, nil), nil
-}
-
-func decrypt(data []byte, key []byte) ([]byte, error) {
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return nil, err
-	}
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return nil, err
-	}
-
-	nonce := data[:gcm.NonceSize()]
-	ciphertext := data[gcm.NonceSize():]
-	return gcm.Open(nil, nonce, ciphertext, nil)
-}
-
 func (p *PEMPair) ToTLSCert() (*tls.Certificate, error) {
 	cert, err := tls.X509KeyPair(p.Cert, p.Key)
 	return &cert, err
 }
 
-func newSerialNumber() (*big.Int, error) {
-	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) // 128-bit random number
-	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
-	if err != nil {
-		return nil, fmt.Errorf("failed to generate serial number: %w", err)
-	}
-	return serialNumber, nil
-}
-
 func NewAgent() (ca, srv, client *PEMPair, err error) {
-	caSerialNumber, err := newSerialNumber()
-	if err != nil {
-		return nil, nil, nil, err
-	}
 	// Create the CA's certificate
 	caTemplate := &x509.Certificate{
-		SerialNumber: caSerialNumber,
+		SerialNumber: big.NewInt(1),
 		Subject: pkix.Name{
 			Organization: []string{"GoDoxy"},
-			CommonName:   common.CertsDNSName,
+			CommonName:   CertsDNSName,
 		},
 		NotBefore:             time.Now(),
 		NotAfter:              time.Now().AddDate(1000, 0, 0), // 1000 years
 		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
 		BasicConstraintsValid: true,
 		IsCA:                  true,
-		MaxPathLen:            0,
-		MaxPathLenZero:        true,
-		SignatureAlgorithm:    x509.ECDSAWithSHA256,
 	}
 
-	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	caKey, err := rsa.GenerateKey(rand.Reader, KeySize)
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -179,29 +91,20 @@ func NewAgent() (ca, srv, client *PEMPair, err error) {
 	ca = toPEMPair(caDER, caKey)
 
 	// Generate a new private key for the server certificate
-	serverKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	serverKey, err := rsa.GenerateKey(rand.Reader, KeySize)
 	if err != nil {
 		return nil, nil, nil, err
 	}
 
-	serverSerialNumber, err := newSerialNumber()
-	if err != nil {
-		return nil, nil, nil, err
-	}
 	srvTemplate := &x509.Certificate{
-		SerialNumber: serverSerialNumber,
+		SerialNumber: big.NewInt(2),
 		Issuer:       caTemplate.Subject,
-		Subject: pkix.Name{
-			Organization:       caTemplate.Subject.Organization,
-			OrganizationalUnit: []string{"Server"},
-			CommonName:         common.CertsDNSName,
-		},
-		DNSNames:           []string{common.CertsDNSName},
-		NotBefore:          time.Now(),
-		NotAfter:           time.Now().AddDate(1000, 0, 0), // Add validity period
-		KeyUsage:           x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:        []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		SignatureAlgorithm: x509.ECDSAWithSHA256,
+		Subject:      caTemplate.Subject,
+		DNSNames:     []string{CertsDNSName},
+		NotBefore:    time.Now(),
+		NotAfter:     time.Now().AddDate(1000, 0, 0), // Add validity period
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 	}
 
 	srvCertDER, err := x509.CreateCertificate(rand.Reader, srvTemplate, caTemplate, &serverKey.PublicKey, caKey)
@@ -211,29 +114,20 @@ func NewAgent() (ca, srv, client *PEMPair, err error) {
 
 	srv = toPEMPair(srvCertDER, serverKey)
 
-	clientKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	clientKey, err := rsa.GenerateKey(rand.Reader, KeySize)
 	if err != nil {
 		return nil, nil, nil, err
 	}
 
-	clientSerialNumber, err := newSerialNumber()
-	if err != nil {
-		return nil, nil, nil, err
-	}
 	clientTemplate := &x509.Certificate{
-		SerialNumber: clientSerialNumber,
+		SerialNumber: big.NewInt(3),
 		Issuer:       caTemplate.Subject,
-		Subject: pkix.Name{
-			Organization:       caTemplate.Subject.Organization,
-			OrganizationalUnit: []string{"Client"},
-			CommonName:         common.CertsDNSName,
-		},
-		DNSNames:           []string{common.CertsDNSName},
-		NotBefore:          time.Now(),
-		NotAfter:           time.Now().AddDate(1000, 0, 0),
-		KeyUsage:           x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:        []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
-		SignatureAlgorithm: x509.ECDSAWithSHA256,
+		Subject:      caTemplate.Subject,
+		DNSNames:     []string{CertsDNSName},
+		NotBefore:    time.Now(),
+		NotAfter:     time.Now().AddDate(1000, 0, 0),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 	}
 	clientCertDER, err := x509.CreateCertificate(rand.Reader, clientTemplate, caTemplate, &clientKey.PublicKey, caKey)
 	if err != nil {
@@ -241,5 +135,5 @@ func NewAgent() (ca, srv, client *PEMPair, err error) {
 	}
 
 	client = toPEMPair(clientCertDER, clientKey)
-	return ca, srv, client, err
+	return
 }

agent/pkg/agent/new_agent_test.go

@@ -1,7 +1,6 @@
 package agent
 
 import (
-	"crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
@@ -9,60 +8,59 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/stretchr/testify/require"
-	"github.com/yusing/godoxy/agent/pkg/agent/common"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
 )
 
 func TestNewAgent(t *testing.T) {
 	ca, srv, client, err := NewAgent()
-	require.NoError(t, err)
-	require.NotNil(t, ca)
-	require.NotNil(t, srv)
-	require.NotNil(t, client)
+	ExpectNoError(t, err)
+	ExpectTrue(t, ca != nil)
+	ExpectTrue(t, srv != nil)
+	ExpectTrue(t, client != nil)
 }
 
 func TestPEMPair(t *testing.T) {
 	ca, srv, client, err := NewAgent()
-	require.NoError(t, err)
+	ExpectNoError(t, err)
 
 	for i, p := range []*PEMPair{ca, srv, client} {
 		t.Run(fmt.Sprintf("load-%d", i), func(t *testing.T) {
 			var pp PEMPair
 			err := pp.Load(p.String())
-			require.NoError(t, err)
-			require.Equal(t, p.Cert, pp.Cert)
-			require.Equal(t, p.Key, pp.Key)
+			ExpectNoError(t, err)
+			ExpectEqual(t, p.Cert, pp.Cert)
+			ExpectEqual(t, p.Key, pp.Key)
 		})
 	}
 }
 
 func TestPEMPairToTLSCert(t *testing.T) {
 	ca, srv, client, err := NewAgent()
-	require.NoError(t, err)
+	ExpectNoError(t, err)
 
 	for i, p := range []*PEMPair{ca, srv, client} {
 		t.Run(fmt.Sprintf("toTLSCert-%d", i), func(t *testing.T) {
 			cert, err := p.ToTLSCert()
-			require.NoError(t, err)
-			require.NotNil(t, cert)
+			ExpectNoError(t, err)
+			ExpectTrue(t, cert != nil)
 		})
 	}
 }
 
 func TestServerClient(t *testing.T) {
 	ca, srv, client, err := NewAgent()
-	require.NoError(t, err)
+	ExpectNoError(t, err)
 
 	srvTLS, err := srv.ToTLSCert()
-	require.NoError(t, err)
-	require.NotNil(t, srvTLS)
+	ExpectNoError(t, err)
+	ExpectTrue(t, srvTLS != nil)
 
 	clientTLS, err := client.ToTLSCert()
-	require.NoError(t, err)
-	require.NotNil(t, clientTLS)
+	ExpectNoError(t, err)
+	ExpectTrue(t, clientTLS != nil)
 
 	caPool := x509.NewCertPool()
-	require.True(t, caPool.AppendCertsFromPEM(ca.Cert))
+	ExpectTrue(t, caPool.AppendCertsFromPEM(ca.Cert))
 
 	srvTLSConfig := &tls.Config{
 		Certificates: []tls.Certificate{*srvTLS},
@@ -73,7 +71,7 @@ func TestServerClient(t *testing.T) {
 	clientTLSConfig := &tls.Config{
 		Certificates: []tls.Certificate{*clientTLS},
 		RootCAs:      caPool,
-		ServerName:   common.CertsDNSName,
+		ServerName:   CertsDNSName,
 	}
 
 	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -88,26 +86,6 @@ func TestServerClient(t *testing.T) {
 	}
 
 	resp, err := httpClient.Get(server.URL)
-	require.NoError(t, err)
-	require.Equal(t, resp.StatusCode, http.StatusOK)
-}
-
-func TestPEMPairEncryptDecrypt(t *testing.T) {
-	encKey := make([]byte, 32)
-	_, err := rand.Read(encKey)
-	require.NoError(t, err)
-
-	ca, _, _, err := NewAgent()
-	require.NoError(t, err)
-
-	encCA, err := ca.Encrypt(encKey)
-	require.NoError(t, err)
-	require.NotNil(t, encCA)
-
-	decCA, err := encCA.Decrypt(encKey)
-	require.NoError(t, err)
-	require.NotNil(t, decCA)
-
-	require.Equal(t, string(ca.Cert), string(decCA.Cert))
-	require.Equal(t, string(ca.Key), string(decCA.Key))
+	ExpectNoError(t, err)
+	ExpectEqual(t, resp.StatusCode, http.StatusOK)
 }

agent/pkg/agent/requests.go

@@ -0,0 +1,49 @@
+package agent
+
+import (
+	"context"
+	"io"
+	"net/http"
+
+	"github.com/coder/websocket"
+)
+
+func (cfg *AgentConfig) Do(ctx context.Context, method, endpoint string, body io.Reader) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, method, APIBaseURL+endpoint, body)
+	if err != nil {
+		return nil, err
+	}
+	return cfg.httpClient.Do(req)
+}
+
+func (cfg *AgentConfig) Forward(req *http.Request, endpoint string) ([]byte, int, error) {
+	req = req.WithContext(req.Context())
+	req.URL.Host = AgentHost
+	req.URL.Scheme = "https"
+	req.URL.Path = APIEndpointBase + endpoint
+	req.RequestURI = ""
+	resp, err := cfg.httpClient.Do(req)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer resp.Body.Close()
+	data, _ := io.ReadAll(resp.Body)
+	return data, resp.StatusCode, nil
+}
+
+func (cfg *AgentConfig) Fetch(ctx context.Context, endpoint string) ([]byte, int, error) {
+	resp, err := cfg.Do(ctx, "GET", endpoint, nil)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer resp.Body.Close()
+	data, _ := io.ReadAll(resp.Body)
+	return data, resp.StatusCode, nil
+}
+
+func (cfg *AgentConfig) Websocket(ctx context.Context, endpoint string) (*websocket.Conn, *http.Response, error) {
+	return websocket.Dial(ctx, APIBaseURL+endpoint, &websocket.DialOptions{
+		HTTPClient: cfg.NewHTTPClient(),
+		Host:       AgentHost,
+	})
+}

agent/pkg/agent/stream/README.md

@@ -1,197 +0,0 @@
-# Stream proxy protocol
-
-This package implements a small header-based handshake that allows an authenticated client to request forwarding to a `(host, port)` destination. It supports both TCP-over-TLS and UDP-over-DTLS transports.
-
-## Overview
-
-```mermaid
-graph TD
-    subgraph Client
-        TC[TCPClient] -->|TLS| TSS[TCPServer]
-        UC[UDPClient] -->|DTLS| USS[UDPServer]
-    end
-
-    subgraph Stream Protocol
-        H[StreamRequestHeader]
-    end
-
-    TSS -->|Redirect| DST1[Destination TCP]
-    USS -->|Forward UDP| DST2[Destination UDP]
-```
-
-## Header
-
-The on-wire header is a fixed-size binary blob:
-
-- `Version` (8 bytes)
-- `HostLength` (1 byte)
-- `Host` (255 bytes, NUL padded)
-- `PortLength` (1 byte)
-- `Port` (5 bytes, NUL padded)
-- `Flag` (1 byte, protocol flags)
-- `Checksum` (4 bytes, big-endian CRC32)
-
-Total: `headerSize = 8 + 1 + 255 + 1 + 5 + 1 + 4 = 275` bytes.
-
-Checksum is `crc32.ChecksumIEEE(header[0:headerSize-4])`.
-
-### Flags
-
-The `Flag` field is a bitmask of protocol flags defined by `FlagType`:
-
-| Flag                   | Value | Purpose                                                                |
-| ---------------------- | ----- | ---------------------------------------------------------------------- |
-| `FlagCloseImmediately` | `1`   | Health check probe - server closes immediately after validating header |
-
-See [`FlagType`](header.go:26) and [`FlagCloseImmediately`](header.go:28).
-
-See [`StreamRequestHeader`](header.go:30).
-
-## File Structure
-
-| File                                | Purpose                                                      |
-| ----------------------------------- | ------------------------------------------------------------ |
-| [`header.go`](header.go)            | Stream request header structure and validation.              |
-| [`tcp_client.go`](tcp_client.go:12) | TCP client implementation with TLS transport.                |
-| [`tcp_server.go`](tcp_server.go:13) | TCP server implementation for handling stream requests.      |
-| [`udp_client.go`](udp_client.go:13) | UDP client implementation with DTLS transport.               |
-| [`udp_server.go`](udp_server.go:17) | UDP server implementation for handling DTLS stream requests. |
-| [`common.go`](common.go:11)         | Connection manager and shared constants.                     |
-
-## Constants
-
-| Constant               | Value                     | Purpose                                                 |
-| ---------------------- | ------------------------- | ------------------------------------------------------- |
-| `StreamALPN`           | `"godoxy-agent-stream/1"` | TLS ALPN protocol for stream multiplexing.              |
-| `headerSize`           | `275` bytes               | Total size of the stream request header.                |
-| `dialTimeout`          | `10s`                     | Timeout for establishing destination connections.       |
-| `readDeadline`         | `10s`                     | Read timeout for UDP destination sockets.               |
-| `FlagCloseImmediately` | `1`                       | Flag for health check probe - server closes immediately |
-
-See [`common.go`](common.go:11).
-
-## Public API
-
-### Types
-
-#### `StreamRequestHeader`
-
-Represents the on-wire protocol header used to negotiate a stream tunnel.
-
-```go
-type StreamRequestHeader struct {
-    Version     [8]byte  // Fixed to "0.1.0" with NUL padding
-    HostLength  byte     // Actual host name length (0-255)
-    Host        [255]byte // NUL-padded host name
-    PortLength  byte     // Actual port string length (0-5)
-    Port        [5]byte  // NUL-padded port string
-    Flag        FlagType // Protocol flags (e.g., FlagCloseImmediately)
-    Checksum    [4]byte  // CRC32 checksum of header without checksum
-}
-```
-
-**Methods:**
-
-- `NewStreamRequestHeader(host, port string) (*StreamRequestHeader, error)` - Creates a header for the given host and port. Returns error if host exceeds 255 bytes or port exceeds 5 bytes.
-- `NewStreamHealthCheckHeader() *StreamRequestHeader` - Creates a header with `FlagCloseImmediately` set for health check probes.
-- `Validate() bool` - Validates the version and checksum.
-- `GetHostPort() (string, string)` - Extracts the host and port from the header.
-- `ShouldCloseImmediately() bool` - Returns true if `FlagCloseImmediately` is set.
-
-### TCP Functions
-
-- [`NewTCPClient()`](tcp_client.go:26) - Creates a TLS client connection and sends the stream header.
-- [`NewTCPServerHandler()`](tcp_server.go:24) - Creates a handler for ALPN-multiplexed connections (no listener).
-- [`NewTCPServerFromListener()`](tcp_server.go:36) - Wraps an existing TLS listener.
-- [`NewTCPServer()`](tcp_server.go:45) - Creates a fully-configured TCP server with TLS listener.
-
-### UDP Functions
-
-- [`NewUDPClient()`](udp_client.go:27) - Creates a DTLS client connection and sends the stream header.
-- [`NewUDPServer()`](udp_server.go:26) - Creates a DTLS server listening on the given UDP address.
-
-## Health Check Probes
-
-The protocol supports health check probes using the `FlagCloseImmediately` flag. When a client sends a header with this flag set, the server validates the header and immediately closes the connection without establishing a destination tunnel.
-
-This is useful for:
-
-- Connectivity testing between agent and server
-- Verifying TLS/DTLS handshake and mTLS authentication
-- Monitoring stream protocol availability
-
-**Usage:**
-
-```go
-header := stream.NewStreamHealthCheckHeader()
-// Send header over TLS/DTLS connection
-// Server will validate and close immediately
-```
-
-Both TCP and UDP servers silently handle health check probes without logging errors.
-
-See [`NewStreamHealthCheckHeader()`](header.go:66) and [`FlagCloseImmediately`](header.go:28).
-
-## TCP behavior
-
-1. Client establishes a TLS connection to the stream server.
-2. Client sends exactly one header as a handshake.
-3. After the handshake, both sides proxy raw TCP bytes between client and destination.
-
-Server reads the header using `io.ReadFull` to avoid dropping bytes.
-
-See [`NewTCPClient()`](tcp_client.go:26) and [`(*TCPServer).redirect()`](tcp_server.go:116).
-
-## UDP-over-DTLS behavior
-
-1. Client establishes a DTLS connection to the stream server.
-2. Client sends exactly one header as a handshake.
-3. After the handshake, both sides proxy raw UDP datagrams:
-   - client -> destination: DTLS payload is written to destination `UDPConn`
-   - destination -> client: destination payload is written back to the DTLS connection
-
-Responses do **not** include a header.
-
-The UDP server uses a bidirectional forwarding model:
-
-- One goroutine forwards from client to destination
-- Another goroutine forwards from destination to client
-
-The destination reader uses `readDeadline` to periodically wake up and check for context cancellation. Timeouts do not terminate the session.
-
-See [`NewUDPClient()`](udp_client.go:27) and [`(*UDPServer).handleDTLSConnection()`](udp_server.go:89).
-
-## Connection Management
-
-Both `TCPServer` and `UDPServer` create a dedicated destination connection per incoming stream session and close it when the session ends (no destination connection reuse).
-
-## Error Handling
-
-| Error                 | Description                                     |
-| --------------------- | ----------------------------------------------- |
-| `ErrInvalidHeader`    | Header validation failed (version or checksum). |
-| `ErrCloseImmediately` | Health check probe - server closed immediately. |
-
-Errors from connection creation are propagated to the caller.
-
-See [`header.go`](header.go:23).
-
-## Integration
-
-This package is used by the agent to provide stream tunneling capabilities. See the parent [`agent`](../README.md) package for integration details with the GoDoxy server.
-
-### Certificate Requirements
-
-Both TCP and UDP servers require:
-
-- CA certificate for client verification
-- Server certificate for TLS/DTLS termination
-
-Both clients require:
-
-- CA certificate for server verification
-- Client certificate for mTLS authentication
-
-### ALPN Protocol
-
-The `StreamALPN` constant (`"godoxy-agent-stream/1"`) is used to multiplex stream tunnel traffic and HTTPS API traffic on the same port. Connections negotiating this ALPN are routed to the stream handler.

agent/pkg/agent/stream/common.go

@@ -1,24 +0,0 @@
-package stream
-
-import (
-	"time"
-
-	"github.com/pion/dtls/v3"
-	"github.com/yusing/goutils/synk"
-)
-
-const (
-	dialTimeout  = 10 * time.Second
-	readDeadline = 10 * time.Second
-)
-
-// StreamALPN is the TLS ALPN protocol id used to multiplex the TCP stream tunnel
-// and the HTTPS API on the same TCP port.
-//
-// When a client negotiates this ALPN, the agent will route the connection to the
-// stream tunnel handler instead of the HTTP handler.
-const StreamALPN = "godoxy-agent-stream/1"
-
-var dTLSCipherSuites = []dtls.CipherSuiteID{dtls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}
-
-var sizedPool = synk.GetSizedBytesPool()

agent/pkg/agent/stream/header.go

@@ -1,117 +0,0 @@
-package stream
-
-import (
-	"encoding/binary"
-	"errors"
-	"fmt"
-	"hash/crc32"
-	"reflect"
-	"unsafe"
-)
-
-const (
-	versionSize  = 8
-	hostSize     = 255
-	portSize     = 5
-	flagSize     = 1
-	checksumSize = 4 // crc32 checksum
-
-	headerSize = versionSize + 1 + hostSize + 1 + portSize + flagSize + checksumSize
-)
-
-var version = [versionSize]byte{'0', '.', '1', '.', '0', 0, 0, 0}
-
-var ErrInvalidHeader = errors.New("invalid header")
-var ErrCloseImmediately = errors.New("close immediately")
-
-type FlagType uint8
-
-const FlagCloseImmediately FlagType = 1 << iota
-
-type StreamRequestHeader struct {
-	Version [versionSize]byte
-
-	HostLength byte
-	Host       [hostSize]byte
-
-	PortLength byte
-	Port       [portSize]byte
-
-	Flag     FlagType
-	Checksum [checksumSize]byte
-}
-
-func init() {
-	if headerSize != reflect.TypeFor[StreamRequestHeader]().Size() {
-		panic("headerSize does not match the size of StreamRequestHeader")
-	}
-}
-
-func NewStreamRequestHeader(host, port string) (*StreamRequestHeader, error) {
-	if len(host) > hostSize {
-		return nil, fmt.Errorf("host is too long: max %d characters, got %d", hostSize, len(host))
-	}
-	if len(port) > portSize {
-		return nil, fmt.Errorf("port is too long: max %d characters, got %d", portSize, len(port))
-	}
-	header := &StreamRequestHeader{}
-	copy(header.Version[:], version[:])
-	header.HostLength = byte(len(host))
-	copy(header.Host[:], host)
-	header.PortLength = byte(len(port))
-	copy(header.Port[:], port)
-	header.updateChecksum()
-	return header, nil
-}
-
-func NewStreamHealthCheckHeader() *StreamRequestHeader {
-	header := &StreamRequestHeader{}
-	copy(header.Version[:], version[:])
-	header.Flag |= FlagCloseImmediately
-	header.updateChecksum()
-	return header
-}
-
-// ToHeader converts header byte array to a copy of itself as a StreamRequestHeader.
-func ToHeader(buf *[headerSize]byte) StreamRequestHeader {
-	return *(*StreamRequestHeader)(unsafe.Pointer(buf))
-}
-
-func (h *StreamRequestHeader) GetHostPort() (string, string) {
-	return string(h.Host[:h.HostLength]), string(h.Port[:h.PortLength])
-}
-
-func (h *StreamRequestHeader) Validate() bool {
-	if h.Version != version {
-		return false
-	}
-	if h.HostLength > hostSize {
-		return false
-	}
-	if h.PortLength > portSize {
-		return false
-	}
-	return h.validateChecksum()
-}
-
-func (h *StreamRequestHeader) ShouldCloseImmediately() bool {
-	return h.Flag&FlagCloseImmediately != 0
-}
-
-func (h *StreamRequestHeader) updateChecksum() {
-	checksum := crc32.ChecksumIEEE(h.BytesWithoutChecksum())
-	binary.BigEndian.PutUint32(h.Checksum[:], checksum)
-}
-
-func (h *StreamRequestHeader) validateChecksum() bool {
-	checksum := crc32.ChecksumIEEE(h.BytesWithoutChecksum())
-	return checksum == binary.BigEndian.Uint32(h.Checksum[:])
-}
-
-func (h *StreamRequestHeader) BytesWithoutChecksum() []byte {
-	return (*[headerSize - checksumSize]byte)(unsafe.Pointer(h))[:]
-}
-
-func (h *StreamRequestHeader) Bytes() []byte {
-	return (*[headerSize]byte)(unsafe.Pointer(h))[:]
-}

agent/pkg/agent/stream/payload_test.go

@@ -1,26 +0,0 @@
-package stream
-
-import (
-	"testing"
-)
-
-func TestStreamRequestHeader_RoundTripAndChecksum(t *testing.T) {
-	h, err := NewStreamRequestHeader("example.com", "443")
-	if err != nil {
-		t.Fatalf("NewStreamRequestHeader: %v", err)
-	}
-	if !h.Validate() {
-		t.Fatalf("expected header to validate")
-	}
-
-	var buf [headerSize]byte
-	copy(buf[:], h.Bytes())
-	h2 := ToHeader(&buf)
-	if !h2.Validate() {
-		t.Fatalf("expected round-tripped header to validate")
-	}
-	host, port := h2.GetHostPort()
-	if host != "example.com" || port != "443" {
-		t.Fatalf("unexpected host/port: %q:%q", host, port)
-	}
-}

agent/pkg/agent/stream/tcp_client.go

@@ -1,122 +0,0 @@
-package stream
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"net"
-	"time"
-
-	"github.com/yusing/godoxy/agent/pkg/agent/common"
-)
-
-type TCPClient struct {
-	conn net.Conn
-}
-
-// NewTCPClient creates a new TCP client for the agent.
-//
-// It will establish a TLS connection and send a stream request header to the server.
-//
-// It returns an error if
-//   - the target address is invalid
-//   - the stream request header is invalid
-//   - the TLS configuration is invalid
-//   - the TLS connection fails
-//   - the stream request header is not sent
-func NewTCPClient(serverAddr, targetAddress string, caCert *x509.Certificate, clientCert *tls.Certificate) (net.Conn, error) {
-	host, port, err := net.SplitHostPort(targetAddress)
-	if err != nil {
-		return nil, err
-	}
-
-	header, err := NewStreamRequestHeader(host, port)
-	if err != nil {
-		return nil, err
-	}
-
-	return newTCPClientWIthHeader(serverAddr, header, caCert, clientCert)
-}
-
-func TCPHealthCheck(serverAddr string, caCert *x509.Certificate, clientCert *tls.Certificate) error {
-	header := NewStreamHealthCheckHeader()
-
-	conn, err := newTCPClientWIthHeader(serverAddr, header, caCert, clientCert)
-	if err != nil {
-		return err
-	}
-
-	conn.Close()
-	return nil
-}
-
-func newTCPClientWIthHeader(serverAddr string, header *StreamRequestHeader, caCert *x509.Certificate, clientCert *tls.Certificate) (net.Conn, error) {
-	// Setup TLS configuration
-	caCertPool := x509.NewCertPool()
-	caCertPool.AddCert(caCert)
-
-	tlsConfig := &tls.Config{
-		Certificates: []tls.Certificate{*clientCert},
-		RootCAs:      caCertPool,
-		MinVersion:   tls.VersionTLS12,
-		NextProtos:   []string{StreamALPN},
-		ServerName:   common.CertsDNSName,
-	}
-
-	// Establish TLS connection
-	conn, err := tls.DialWithDialer(&net.Dialer{Timeout: dialTimeout}, "tcp", serverAddr, tlsConfig)
-	if err != nil {
-		return nil, err
-	}
-	// Send the stream header once as a handshake.
-	if _, err := conn.Write(header.Bytes()); err != nil {
-		_ = conn.Close()
-		return nil, err
-	}
-
-	return &TCPClient{
-		conn: conn,
-	}, nil
-}
-
-func (c *TCPClient) Read(p []byte) (n int, err error) {
-	return c.conn.Read(p)
-}
-
-func (c *TCPClient) Write(p []byte) (n int, err error) {
-	return c.conn.Write(p)
-}
-
-func (c *TCPClient) LocalAddr() net.Addr {
-	return c.conn.LocalAddr()
-}
-
-func (c *TCPClient) RemoteAddr() net.Addr {
-	return c.conn.RemoteAddr()
-}
-
-func (c *TCPClient) SetDeadline(t time.Time) error {
-	return c.conn.SetDeadline(t)
-}
-
-func (c *TCPClient) SetReadDeadline(t time.Time) error {
-	return c.conn.SetReadDeadline(t)
-}
-
-func (c *TCPClient) SetWriteDeadline(t time.Time) error {
-	return c.conn.SetWriteDeadline(t)
-}
-
-func (c *TCPClient) Close() error {
-	return c.conn.Close()
-}
-
-// ConnectionState exposes the underlying TLS connection state when the client is
-// backed by *tls.Conn.
-//
-// This is primarily used by tests and diagnostics.
-func (c *TCPClient) ConnectionState() tls.ConnectionState {
-	if tc, ok := c.conn.(*tls.Conn); ok {
-		return tc.ConnectionState()
-	}
-	return tls.ConnectionState{}
-}

agent/pkg/agent/stream/tcp_server.go

@@ -1,176 +0,0 @@
-package stream
-
-import (
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"errors"
-	"io"
-	"net"
-
-	"github.com/rs/zerolog"
-	"github.com/rs/zerolog/log"
-	ioutils "github.com/yusing/goutils/io"
-)
-
-type TCPServer struct {
-	ctx      context.Context
-	listener net.Listener
-}
-
-// NewTCPServerHandler creates a TCP stream server that can serve already-accepted
-// connections (e.g. handed off by an ALPN multiplexer).
-//
-// This variant does not require a listener. Use TCPServer.ServeConn to handle
-// each incoming stream connection.
-func NewTCPServerHandler(ctx context.Context) *TCPServer {
-	s := &TCPServer{ctx: ctx}
-	return s
-}
-
-// NewTCPServerFromListener creates a TCP stream server from an already-prepared
-// listener.
-//
-// The listener is expected to yield connections that are already secured (e.g.
-// a TLS/mTLS listener, or pre-handshaked *tls.Conn). This is used when the agent
-// multiplexes HTTPS and stream-tunnel traffic on the same port.
-func NewTCPServerFromListener(ctx context.Context, listener net.Listener) *TCPServer {
-	s := &TCPServer{
-		ctx:      ctx,
-		listener: listener,
-	}
-	return s
-}
-
-func NewTCPServer(ctx context.Context, listener *net.TCPListener, caCert *x509.Certificate, serverCert *tls.Certificate) *TCPServer {
-	caCertPool := x509.NewCertPool()
-	caCertPool.AddCert(caCert)
-
-	tlsConfig := &tls.Config{
-		Certificates: []tls.Certificate{*serverCert},
-		ClientCAs:    caCertPool,
-		ClientAuth:   tls.RequireAndVerifyClientCert,
-		MinVersion:   tls.VersionTLS12,
-		NextProtos:   []string{StreamALPN},
-	}
-
-	tcpListener := tls.NewListener(listener, tlsConfig)
-	return NewTCPServerFromListener(ctx, tcpListener)
-}
-
-func (s *TCPServer) Start() error {
-	if s.listener == nil {
-		return net.ErrClosed
-	}
-	context.AfterFunc(s.ctx, func() {
-		_ = s.listener.Close()
-	})
-	for {
-		conn, err := s.listener.Accept()
-		if err != nil {
-			if errors.Is(err, net.ErrClosed) && s.ctx.Err() != nil {
-				return s.ctx.Err()
-			}
-			return err
-		}
-		go s.handle(conn)
-	}
-}
-
-// ServeConn serves a single stream connection.
-//
-// The provided connection is expected to be already secured (TLS/mTLS) and to
-// speak the stream protocol (i.e. the client will send the stream header first).
-//
-// This method blocks until the stream finishes.
-func (s *TCPServer) ServeConn(conn net.Conn) {
-	s.handle(conn)
-}
-
-func (s *TCPServer) Addr() net.Addr {
-	if s.listener == nil {
-		return nil
-	}
-	return s.listener.Addr()
-}
-
-func (s *TCPServer) Close() error {
-	if s.listener == nil {
-		return nil
-	}
-	return s.listener.Close()
-}
-
-func (s *TCPServer) logger(clientConn net.Conn) *zerolog.Logger {
-	ev := log.With().Str("protocol", "tcp").
-		Str("remote", clientConn.RemoteAddr().String())
-	if s.listener != nil {
-		ev = ev.Str("addr", s.listener.Addr().String())
-	}
-	l := ev.Logger()
-	return &l
-}
-
-func (s *TCPServer) loggerWithDst(dstConn net.Conn, clientConn net.Conn) *zerolog.Logger {
-	ev := log.With().Str("protocol", "tcp").
-		Str("remote", clientConn.RemoteAddr().String()).
-		Str("dst", dstConn.RemoteAddr().String())
-	if s.listener != nil {
-		ev = ev.Str("addr", s.listener.Addr().String())
-	}
-	l := ev.Logger()
-	return &l
-}
-
-func (s *TCPServer) handle(conn net.Conn) {
-	defer conn.Close()
-	dst, err := s.redirect(conn)
-	if err != nil {
-		// Health check probe: close connection
-		if errors.Is(err, ErrCloseImmediately) {
-			s.logger(conn).Info().Msg("Health check received")
-			return
-		}
-		s.logger(conn).Err(err).Msg("failed to redirect connection")
-		return
-	}
-
-	defer dst.Close()
-	pipe := ioutils.NewBidirectionalPipe(s.ctx, conn, dst)
-	err = pipe.Start()
-	if err != nil {
-		s.loggerWithDst(dst, conn).Err(err).Msg("failed to start bidirectional pipe")
-		return
-	}
-}
-
-func (s *TCPServer) redirect(conn net.Conn) (net.Conn, error) {
-	// Read the stream header once as a handshake.
-	var headerBuf [headerSize]byte
-	if _, err := io.ReadFull(conn, headerBuf[:]); err != nil {
-		return nil, err
-	}
-
-	header := ToHeader(&headerBuf)
-	if !header.Validate() {
-		return nil, ErrInvalidHeader
-	}
-
-	// Health check: close immediately if FlagCloseImmediately is set
-	if header.ShouldCloseImmediately() {
-		return nil, ErrCloseImmediately
-	}
-
-	// get destination connection
-	host, port := header.GetHostPort()
-	return s.createDestConnection(host, port)
-}
-
-func (s *TCPServer) createDestConnection(host, port string) (net.Conn, error) {
-	addr := net.JoinHostPort(host, port)
-	conn, err := net.DialTimeout("tcp", addr, dialTimeout)
-	if err != nil {
-		return nil, err
-	}
-	return conn, nil
-}

agent/pkg/agent/stream/tests/healthcheck_test.go

@@ -1,26 +0,0 @@
-package stream_test
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"github.com/yusing/godoxy/agent/pkg/agent/stream"
-)
-
-func TestTCPHealthCheck(t *testing.T) {
-	certs := genTestCerts(t)
-
-	srv := startTCPServer(t, certs)
-
-	err := stream.TCPHealthCheck(srv.Addr.String(), certs.CaCert, certs.ClientCert)
-	require.NoError(t, err, "health check")
-}
-
-func TestUDPHealthCheck(t *testing.T) {
-	certs := genTestCerts(t)
-
-	srv := startUDPServer(t, certs)
-
-	err := stream.UDPHealthCheck(srv.Addr.String(), certs.CaCert, certs.ClientCert)
-	require.NoError(t, err, "health check")
-}

agent/pkg/agent/stream/tests/mux_test.go

@@ -1,94 +0,0 @@
-package stream_test
-
-import (
-	"bufio"
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"io"
-	"net"
-	"net/http"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"github.com/yusing/godoxy/agent/pkg/agent/common"
-	"github.com/yusing/godoxy/agent/pkg/agent/stream"
-)
-
-func TestTLSALPNMux_HTTPAndStreamShareOnePort(t *testing.T) {
-	certs := genTestCerts(t)
-
-	baseLn, err := net.ListenTCP("tcp", &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 0})
-	require.NoError(t, err, "listen tcp")
-	defer baseLn.Close()
-	baseAddr := baseLn.Addr().String()
-
-	caCertPool := x509.NewCertPool()
-	caCertPool.AddCert(certs.CaCert)
-
-	serverTLS := &tls.Config{
-		Certificates: []tls.Certificate{*certs.SrvCert},
-		ClientCAs:    caCertPool,
-		ClientAuth:   tls.RequireAndVerifyClientCert,
-		MinVersion:   tls.VersionTLS12,
-		NextProtos:   []string{"http/1.1", stream.StreamALPN},
-	}
-
-	ctx, cancel := context.WithCancel(t.Context())
-	defer cancel()
-
-	streamSrv := stream.NewTCPServerHandler(ctx)
-	defer func() { _ = streamSrv.Close() }()
-
-	tlsLn := tls.NewListener(baseLn, serverTLS)
-	defer func() { _ = tlsLn.Close() }()
-
-	// HTTP server
-	httpSrv := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		_, _ = w.Write([]byte("ok"))
-	}),
-		TLSNextProto: map[string]func(*http.Server, *tls.Conn, http.Handler){
-			stream.StreamALPN: func(_ *http.Server, conn *tls.Conn, _ http.Handler) {
-				streamSrv.ServeConn(conn)
-			},
-		},
-	}
-	go func() { _ = httpSrv.Serve(tlsLn) }()
-	defer func() { _ = httpSrv.Close() }()
-
-	// Stream destination
-	dstAddr, closeDst := startTCPEcho(t)
-	defer closeDst()
-
-	// HTTP client over the same port
-	clientTLS := &tls.Config{
-		Certificates: []tls.Certificate{*certs.ClientCert},
-		RootCAs:      caCertPool,
-		MinVersion:   tls.VersionTLS12,
-		NextProtos:   []string{"http/1.1"},
-		ServerName:   common.CertsDNSName,
-	}
-	hc, err := tls.Dial("tcp", baseAddr, clientTLS)
-	require.NoError(t, err, "dial https")
-	defer hc.Close()
-	_ = hc.SetDeadline(time.Now().Add(2 * time.Second))
-	_, err = hc.Write([]byte("GET / HTTP/1.1\r\nHost: godoxy-agent\r\n\r\n"))
-	require.NoError(t, err, "write http request")
-	r := bufio.NewReader(hc)
-	statusLine, err := r.ReadString('\n')
-	require.NoError(t, err, "read status line")
-	require.Contains(t, statusLine, "200", "expected 200")
-
-	// Stream client over the same port
-	client := NewTCPClient(t, baseAddr, dstAddr, certs)
-	defer client.Close()
-	_ = client.SetDeadline(time.Now().Add(2 * time.Second))
-	msg := []byte("ping over mux")
-	_, err = client.Write(msg)
-	require.NoError(t, err, "write stream payload")
-	buf := make([]byte, len(msg))
-	_, err = io.ReadFull(client, buf)
-	require.NoError(t, err, "read stream payload")
-	require.Equal(t, msg, buf)
-}

agent/pkg/agent/stream/tests/server_flow_test.go

@@ -1,201 +0,0 @@
-package stream_test
-
-import (
-	"crypto/tls"
-	"fmt"
-	"io"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/pion/dtls/v3"
-	"github.com/stretchr/testify/require"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/godoxy/agent/pkg/agent/stream"
-)
-
-func TestTCPServer_FullFlow(t *testing.T) {
-	certs := genTestCerts(t)
-
-	dstAddr, closeDst := startTCPEcho(t)
-	defer closeDst()
-
-	srv := startTCPServer(t, certs)
-
-	client := NewTCPClient(t, srv.Addr.String(), dstAddr, certs)
-	defer client.Close()
-
-	// Ensure ALPN is negotiated as expected (required for multiplexing).
-	withState, ok := client.(interface{ ConnectionState() tls.ConnectionState })
-	require.True(t, ok, "tcp client should expose TLS connection state")
-	require.Equal(t, stream.StreamALPN, withState.ConnectionState().NegotiatedProtocol)
-
-	_ = client.SetDeadline(time.Now().Add(2 * time.Second))
-	msg := []byte("ping over tcp")
-	_, err := client.Write(msg)
-	require.NoError(t, err, "write to client")
-
-	buf := make([]byte, len(msg))
-	_, err = io.ReadFull(client, buf)
-	require.NoError(t, err, "read from client")
-	require.Equal(t, string(msg), string(buf), "unexpected echo")
-}
-
-func TestTCPServer_ConcurrentConnections(t *testing.T) {
-	certs := genTestCerts(t)
-
-	dstAddr, closeDst := startTCPEcho(t)
-	defer closeDst()
-
-	srv := startTCPServer(t, certs)
-
-	const nClients = 25
-
-	errs := make(chan error, nClients)
-	var wg sync.WaitGroup
-	wg.Add(nClients)
-
-	for i := range nClients {
-		go func() {
-			defer wg.Done()
-
-			client := NewTCPClient(t, srv.Addr.String(), dstAddr, certs)
-			defer client.Close()
-
-			_ = client.SetDeadline(time.Now().Add(2 * time.Second))
-			msg := fmt.Appendf(nil, "ping over tcp %d", i)
-			if _, err := client.Write(msg); err != nil {
-				errs <- fmt.Errorf("write to client: %w", err)
-				return
-			}
-
-			buf := make([]byte, len(msg))
-			if _, err := io.ReadFull(client, buf); err != nil {
-				errs <- fmt.Errorf("read from client: %w", err)
-				return
-			}
-			if string(msg) != string(buf) {
-				errs <- fmt.Errorf("unexpected echo: got=%q want=%q", string(buf), string(msg))
-				return
-			}
-		}()
-	}
-
-	wg.Wait()
-	close(errs)
-	for err := range errs {
-		require.NoError(t, err)
-	}
-}
-
-func TestUDPServer_RejectInvalidClient(t *testing.T) {
-	certs := genTestCerts(t)
-
-	// Generate a self-signed client cert that is NOT signed by the CA
-	_, _, invalidClientPEM, err := agent.NewAgent()
-	require.NoError(t, err, "generate invalid client certs")
-	invalidClientCert, err := invalidClientPEM.ToTLSCert()
-	require.NoError(t, err, "parse invalid client cert")
-
-	dstAddr, closeDst := startUDPEcho(t)
-	defer closeDst()
-
-	srv := startUDPServer(t, certs)
-
-
-	// Try to connect with a client cert from a different CA
-	_, err = stream.NewUDPClient(srv.Addr.String(), dstAddr, certs.CaCert, invalidClientCert)
-	require.Error(t, err, "expected error when connecting with client cert from different CA")
-
-	var handshakeErr *dtls.HandshakeError
-	require.ErrorAs(t, err, &handshakeErr, "expected handshake error")
-}
-
-func TestUDPServer_RejectClientWithoutCert(t *testing.T) {
-	certs := genTestCerts(t)
-
-	dstAddr, closeDst := startUDPEcho(t)
-	defer closeDst()
-
-	srv := startUDPServer(t, certs)
-
-	time.Sleep(time.Second)
-
-	// Try to connect without any client certificate
-	// Create a TLS cert without a private key to simulate no client cert
-	emptyCert := &tls.Certificate{}
-	_, err := stream.NewUDPClient(srv.Addr.String(), dstAddr, certs.CaCert, emptyCert)
-	require.Error(t, err, "expected error when connecting without client cert")
-
-	require.ErrorContains(t, err, "no certificate provided", "expected no cert error")
-}
-
-func TestUDPServer_FullFlow(t *testing.T) {
-	certs := genTestCerts(t)
-
-	dstAddr, closeDst := startUDPEcho(t)
-	defer closeDst()
-
-	srv := startUDPServer(t, certs)
-
-	client := NewUDPClient(t, srv.Addr.String(), dstAddr, certs)
-	defer client.Close()
-
-	_ = client.SetDeadline(time.Now().Add(2 * time.Second))
-	msg := []byte("ping over udp")
-	_, err := client.Write(msg)
-	require.NoError(t, err, "write to client")
-
-	buf := make([]byte, 2048)
-	n, err := client.Read(buf)
-	require.NoError(t, err, "read from client")
-	require.Equal(t, string(msg), string(buf[:n]), "unexpected echo")
-}
-
-func TestUDPServer_ConcurrentConnections(t *testing.T) {
-	certs := genTestCerts(t)
-
-	dstAddr, closeDst := startUDPEcho(t)
-	defer closeDst()
-
-	srv := startUDPServer(t, certs)
-
-	const nClients = 25
-
-	errs := make(chan error, nClients)
-	var wg sync.WaitGroup
-	wg.Add(nClients)
-
-	for i := range nClients {
-		go func() {
-			defer wg.Done()
-
-			client := NewUDPClient(t, srv.Addr.String(), dstAddr, certs)
-			defer client.Close()
-
-			_ = client.SetDeadline(time.Now().Add(5 * time.Second))
-			msg := fmt.Appendf(nil, "ping over udp %d", i)
-			if _, err := client.Write(msg); err != nil {
-				errs <- fmt.Errorf("write to client: %w", err)
-				return
-			}
-
-			buf := make([]byte, 2048)
-			n, err := client.Read(buf)
-			if err != nil {
-				errs <- fmt.Errorf("read from client: %w", err)
-				return
-			}
-			if string(msg) != string(buf[:n]) {
-				errs <- fmt.Errorf("unexpected echo: got=%q want=%q", string(buf[:n]), string(msg))
-				return
-			}
-		}()
-	}
-
-	wg.Wait()
-	close(errs)
-	for err := range errs {
-		require.NoError(t, err)
-	}
-}

agent/pkg/agent/stream/tests/testutils_test.go

@@ -1,177 +0,0 @@
-package stream_test
-
-import (
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"errors"
-	"io"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/pion/transport/v3/udp"
-	"github.com/stretchr/testify/require"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/godoxy/agent/pkg/agent/stream"
-)
-
-// CertBundle holds all certificates needed for testing.
-type CertBundle struct {
-	CaCert     *x509.Certificate
-	SrvCert    *tls.Certificate
-	ClientCert *tls.Certificate
-}
-
-// genTestCerts generates certificates for testing and returns them as a CertBundle.
-func genTestCerts(t *testing.T) CertBundle {
-	t.Helper()
-
-	caPEM, srvPEM, clientPEM, err := agent.NewAgent()
-	require.NoError(t, err, "generate agent certs")
-
-	caCert, err := caPEM.ToTLSCert()
-	require.NoError(t, err, "parse CA cert")
-	srvCert, err := srvPEM.ToTLSCert()
-	require.NoError(t, err, "parse server cert")
-	clientCert, err := clientPEM.ToTLSCert()
-	require.NoError(t, err, "parse client cert")
-
-	return CertBundle{
-		CaCert:     caCert.Leaf,
-		SrvCert:    srvCert,
-		ClientCert: clientCert,
-	}
-}
-
-// startTCPEcho starts a TCP echo server and returns its address and close function.
-func startTCPEcho(t *testing.T) (addr string, closeFn func()) {
-	t.Helper()
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err, "listen tcp")
-
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		for {
-			c, err := ln.Accept()
-			if err != nil {
-				return
-			}
-			go func(conn net.Conn) {
-				defer conn.Close()
-				_, _ = io.Copy(conn, conn)
-			}(c)
-		}
-	}()
-
-	return ln.Addr().String(), func() {
-		_ = ln.Close()
-		<-done
-	}
-}
-
-// startUDPEcho starts a UDP echo server and returns its address and close function.
-func startUDPEcho(t *testing.T) (addr string, closeFn func()) {
-	t.Helper()
-	pc, err := net.ListenPacket("udp", "127.0.0.1:0")
-	require.NoError(t, err, "listen udp")
-	uc := pc.(*net.UDPConn)
-
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		buf := make([]byte, 65535)
-		for {
-			n, raddr, err := uc.ReadFromUDP(buf)
-			if err != nil {
-				return
-			}
-			_, _ = uc.WriteToUDP(buf[:n], raddr)
-		}
-	}()
-
-	return uc.LocalAddr().String(), func() {
-		_ = uc.Close()
-		<-done
-	}
-}
-
-// TestServer wraps a server with its startup goroutine for cleanup.
-type TestServer struct {
-	Server interface{ Close() error }
-	Addr   net.Addr
-}
-
-// startTCPServer starts a TCP server and returns a TestServer for cleanup.
-func startTCPServer(t *testing.T, certs CertBundle) TestServer {
-	t.Helper()
-
-	tcpLn, err := net.ListenTCP("tcp", &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 0})
-	require.NoError(t, err, "listen tcp")
-
-	ctx, cancel := context.WithCancel(t.Context())
-
-	srv := stream.NewTCPServer(ctx, tcpLn, certs.CaCert, certs.SrvCert)
-
-	errCh := make(chan error, 1)
-	go func() { errCh <- srv.Start() }()
-
-	t.Cleanup(func() {
-		cancel()
-		_ = srv.Close()
-		err := <-errCh
-		if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, net.ErrClosed) {
-			t.Logf("tcp server exit: %v", err)
-		}
-	})
-
-	return TestServer{
-		Server: srv,
-		Addr:   srv.Addr(),
-	}
-}
-
-// startUDPServer starts a UDP server and returns a TestServer for cleanup.
-func startUDPServer(t *testing.T, certs CertBundle) TestServer {
-	t.Helper()
-
-	ctx, cancel := context.WithCancel(t.Context())
-
-	srv := stream.NewUDPServer(ctx, "udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 0}, certs.CaCert, certs.SrvCert)
-
-	errCh := make(chan error, 1)
-	go func() { errCh <- srv.Start() }()
-
-	time.Sleep(100 * time.Millisecond)
-
-	t.Cleanup(func() {
-		cancel()
-		_ = srv.Close()
-		err := <-errCh
-		if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, net.ErrClosed) && !errors.Is(err, udp.ErrClosedListener) {
-			t.Logf("udp server exit: %v", err)
-		}
-	})
-
-	return TestServer{
-		Server: srv,
-		Addr:   srv.Addr(),
-	}
-}
-
-// NewTCPClient creates a TCP client connected to the server with test certificates.
-func NewTCPClient(t *testing.T, serverAddr, targetAddress string, certs CertBundle) net.Conn {
-	t.Helper()
-	client, err := stream.NewTCPClient(serverAddr, targetAddress, certs.CaCert, certs.ClientCert)
-	require.NoError(t, err, "create tcp client")
-	return client
-}
-
-// NewUDPClient creates a UDP client connected to the server with test certificates.
-func NewUDPClient(t *testing.T, serverAddr, targetAddress string, certs CertBundle) net.Conn {
-	t.Helper()
-	client, err := stream.NewUDPClient(serverAddr, targetAddress, certs.CaCert, certs.ClientCert)
-	require.NoError(t, err, "create udp client")
-	return client
-}

agent/pkg/agent/stream/udp_client.go

@@ -1,118 +0,0 @@
-package stream
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"net"
-	"time"
-
-	"github.com/pion/dtls/v3"
-	"github.com/yusing/godoxy/agent/pkg/agent/common"
-)
-
-type UDPClient struct {
-	conn net.Conn
-}
-
-// NewUDPClient creates a new UDP client for the agent.
-//
-// It will establish a DTLS connection and send a stream request header to the server.
-//
-// It returns an error if
-//   - the target address is invalid
-//   - the stream request header is invalid
-//   - the DTLS configuration is invalid
-//   - the DTLS connection fails
-//   - the stream request header is not sent
-func NewUDPClient(serverAddr, targetAddress string, caCert *x509.Certificate, clientCert *tls.Certificate) (net.Conn, error) {
-	host, port, err := net.SplitHostPort(targetAddress)
-	if err != nil {
-		return nil, err
-	}
-
-	header, err := NewStreamRequestHeader(host, port)
-	if err != nil {
-		return nil, err
-	}
-
-	return newUDPClientWIthHeader(serverAddr, header, caCert, clientCert)
-}
-
-func newUDPClientWIthHeader(serverAddr string, header *StreamRequestHeader, caCert *x509.Certificate, clientCert *tls.Certificate) (net.Conn, error) {
-	// Setup DTLS configuration
-	caCertPool := x509.NewCertPool()
-	caCertPool.AddCert(caCert)
-
-	dtlsConfig := &dtls.Config{
-		Certificates:         []tls.Certificate{*clientCert},
-		RootCAs:              caCertPool,
-		InsecureSkipVerify:   false,
-		ExtendedMasterSecret: dtls.RequireExtendedMasterSecret,
-		ServerName:           common.CertsDNSName,
-		CipherSuites:         dTLSCipherSuites,
-	}
-
-	raddr, err := net.ResolveUDPAddr("udp", serverAddr)
-	if err != nil {
-		return nil, err
-	}
-
-	// Establish DTLS connection
-	conn, err := dtls.Dial("udp", raddr, dtlsConfig)
-	if err != nil {
-		return nil, err
-	}
-	// Send the stream header once as a handshake.
-	if _, err := conn.Write(header.Bytes()); err != nil {
-		_ = conn.Close()
-		return nil, err
-	}
-
-	return &UDPClient{
-		conn: conn,
-	}, nil
-}
-
-func UDPHealthCheck(serverAddr string, caCert *x509.Certificate, clientCert *tls.Certificate) error {
-	header := NewStreamHealthCheckHeader()
-
-	conn, err := newUDPClientWIthHeader(serverAddr, header, caCert, clientCert)
-	if err != nil {
-		return err
-	}
-
-	conn.Close()
-	return nil
-}
-
-func (c *UDPClient) Read(p []byte) (n int, err error) {
-	return c.conn.Read(p)
-}
-
-func (c *UDPClient) Write(p []byte) (n int, err error) {
-	return c.conn.Write(p)
-}
-
-func (c *UDPClient) LocalAddr() net.Addr {
-	return c.conn.LocalAddr()
-}
-
-func (c *UDPClient) RemoteAddr() net.Addr {
-	return c.conn.RemoteAddr()
-}
-
-func (c *UDPClient) SetDeadline(t time.Time) error {
-	return c.conn.SetDeadline(t)
-}
-
-func (c *UDPClient) SetReadDeadline(t time.Time) error {
-	return c.conn.SetReadDeadline(t)
-}
-
-func (c *UDPClient) SetWriteDeadline(t time.Time) error {
-	return c.conn.SetWriteDeadline(t)
-}
-
-func (c *UDPClient) Close() error {
-	return c.conn.Close()
-}

agent/pkg/agent/stream/udp_server.go

@@ -1,205 +0,0 @@
-package stream
-
-import (
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"errors"
-	"io"
-	"net"
-	"time"
-
-	"github.com/pion/dtls/v3"
-	"github.com/rs/zerolog"
-	"github.com/rs/zerolog/log"
-)
-
-type UDPServer struct {
-	ctx      context.Context
-	network  string
-	laddr    *net.UDPAddr
-	listener net.Listener
-
-	dtlsConfig *dtls.Config
-}
-
-func NewUDPServer(ctx context.Context, network string, laddr *net.UDPAddr, caCert *x509.Certificate, serverCert *tls.Certificate) *UDPServer {
-	caCertPool := x509.NewCertPool()
-	caCertPool.AddCert(caCert)
-
-	dtlsConfig := &dtls.Config{
-		Certificates:         []tls.Certificate{*serverCert},
-		ClientCAs:            caCertPool,
-		ClientAuth:           dtls.RequireAndVerifyClientCert,
-		ExtendedMasterSecret: dtls.RequireExtendedMasterSecret,
-		CipherSuites:         dTLSCipherSuites,
-	}
-
-	s := &UDPServer{
-		ctx:        ctx,
-		network:    network,
-		laddr:      laddr,
-		dtlsConfig: dtlsConfig,
-	}
-	return s
-}
-
-func (s *UDPServer) Start() error {
-	listener, err := dtls.Listen(s.network, s.laddr, s.dtlsConfig)
-	if err != nil {
-		return err
-	}
-	s.listener = listener
-
-	context.AfterFunc(s.ctx, func() {
-		_ = s.listener.Close()
-	})
-
-	for {
-		conn, err := s.listener.Accept()
-		if err != nil {
-			// Expected error when context cancelled
-			if errors.Is(err, net.ErrClosed) && s.ctx.Err() != nil {
-				return s.ctx.Err()
-			}
-			return err
-		}
-		go s.handleDTLSConnection(conn)
-	}
-}
-
-func (s *UDPServer) Addr() net.Addr {
-	if s.listener != nil {
-		return s.listener.Addr()
-	}
-	return s.laddr
-}
-
-func (s *UDPServer) Close() error {
-	if s.listener != nil {
-		return s.listener.Close()
-	}
-	return nil
-}
-
-func (s *UDPServer) logger(clientConn net.Conn) *zerolog.Logger {
-	l := log.With().Str("protocol", "udp").
-		Str("addr", s.Addr().String()).
-		Str("remote", clientConn.RemoteAddr().String()).Logger()
-	return &l
-}
-
-func (s *UDPServer) loggerWithDst(clientConn net.Conn, dstConn *net.UDPConn) *zerolog.Logger {
-	l := log.With().Str("protocol", "udp").
-		Str("addr", s.Addr().String()).
-		Str("remote", clientConn.RemoteAddr().String()).
-		Str("dst", dstConn.RemoteAddr().String()).Logger()
-	return &l
-}
-
-func (s *UDPServer) handleDTLSConnection(clientConn net.Conn) {
-	defer clientConn.Close()
-
-	// Read the stream header once as a handshake.
-	var headerBuf [headerSize]byte
-	if _, err := io.ReadFull(clientConn, headerBuf[:]); err != nil {
-		s.logger(clientConn).Err(err).Msg("failed to read stream header")
-		return
-	}
-	header := ToHeader(&headerBuf)
-	if !header.Validate() {
-		s.logger(clientConn).Error().Bytes("header", headerBuf[:]).Msg("invalid stream header received")
-		return
-	}
-
-	// Health check probe: close connection
-	if header.ShouldCloseImmediately() {
-		s.logger(clientConn).Info().Msg("Health check received")
-		return
-	}
-
-	host, port := header.GetHostPort()
-	dstConn, err := s.createDestConnection(host, port)
-	if err != nil {
-		s.logger(clientConn).Err(err).Msg("failed to get or create destination connection")
-		return
-	}
-	defer dstConn.Close()
-
-	go s.forwardFromDestination(dstConn, clientConn)
-
-	buf := sizedPool.GetSized(65535)
-	defer sizedPool.Put(buf)
-
-	for {
-		select {
-		case <-s.ctx.Done():
-			return
-		default:
-			n, err := clientConn.Read(buf)
-			// Per net.Conn contract, Read may return (n > 0, err == io.EOF).
-			// Always forward any bytes we got before acting on the error.
-			if n > 0 {
-				if _, werr := dstConn.Write(buf[:n]); werr != nil {
-					s.logger(clientConn).Err(werr).Msgf("failed to write %d bytes to destination", n)
-					return
-				}
-			}
-			if err != nil {
-				// Expected shutdown paths.
-				if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) {
-					return
-				}
-				s.logger(clientConn).Err(err).Msg("failed to read from client")
-				return
-			}
-		}
-	}
-}
-
-func (s *UDPServer) createDestConnection(host, port string) (*net.UDPConn, error) {
-	addr := net.JoinHostPort(host, port)
-	udpAddr, err := net.ResolveUDPAddr("udp", addr)
-	if err != nil {
-		return nil, err
-	}
-
-	dstConn, err := net.DialUDP("udp", nil, udpAddr)
-	if err != nil {
-		return nil, err
-	}
-
-	return dstConn, nil
-}
-
-func (s *UDPServer) forwardFromDestination(dstConn *net.UDPConn, clientConn net.Conn) {
-	buffer := sizedPool.GetSized(65535)
-	defer sizedPool.Put(buffer)
-
-	for {
-		select {
-		case <-s.ctx.Done():
-			return
-		default:
-			_ = dstConn.SetReadDeadline(time.Now().Add(readDeadline))
-			n, err := dstConn.Read(buffer)
-			if err != nil {
-				// The destination socket can be closed when the client disconnects (e.g. during
-				// the stream support probe in AgentConfig.StartWithCerts). Treat that as a
-				// normal exit and avoid noisy logs.
-				if errors.Is(err, net.ErrClosed) {
-					return
-				}
-				if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
-					continue
-				}
-				s.loggerWithDst(clientConn, dstConn).Err(err).Msg("failed to read from destination")
-				return
-			}
-			if _, err := clientConn.Write(buffer[:n]); err != nil {
-				s.loggerWithDst(clientConn, dstConn).Err(err).Msgf("failed to write %d bytes to client", n)
-				return
-			}
-		}
-	}
-}

agent/pkg/agent/templates/agent.compose.yml

@@ -0,0 +1,14 @@
+services:
+  agent:
+    image: "{{.Image}}"
+    container_name: godoxy-agent
+    restart: always
+    network_mode: host # do not change this
+    environment:
+      AGENT_NAME: "{{.Name}}"
+      AGENT_PORT: "{{.Port}}"
+      AGENT_CA_CERT: "{{.CACert}}"
+      AGENT_SSL_CERT: "{{.SSLCert}}"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./data:/app/data

agent/pkg/agent/templates/agent.compose.yml.tmpl

@@ -1,67 +0,0 @@
-services:
-  agent:
-    image: "{{.Image}}"
-    container_name: godoxy-agent
-    restart: always
-    {{ if eq .ContainerRuntime "podman" -}}
-    ports:
-      - "{{.Port}}:{{.Port}}/tcp"
-      - "{{.Port}}:{{.Port}}/udp"
-    {{ else -}}
-    network_mode: host # do not change this
-    {{ end -}}
-    environment:
-      {{ if eq .ContainerRuntime "nerdctl" -}}
-      DOCKER_SOCKET: "/var/run/containerd/containerd.sock"
-      RUNTIME: "nerdctl"
-      {{ else if eq .ContainerRuntime "podman" -}}
-      DOCKER_SOCKET: "/var/run/podman/podman.sock"
-      RUNTIME: "podman"
-      {{ else -}}
-      DOCKER_SOCKET: "/var/run/docker.sock"
-      RUNTIME: "docker"
-      {{ end -}}
-      AGENT_NAME: "{{.Name}}"
-      AGENT_PORT: "{{.Port}}"
-      AGENT_CA_CERT: "{{.CACert}}"
-      AGENT_SSL_CERT: "{{.SSLCert}}"
-      # use agent as a docker socket proxy: [host]:port
-      # set LISTEN_ADDR to enable (e.g. 127.0.0.1:2375)
-      LISTEN_ADDR:
-      POST: false
-      ALLOW_RESTARTS: false
-      ALLOW_START: false
-      ALLOW_STOP: false
-      AUTH: false
-      BUILD: false
-      COMMIT: false
-      CONFIGS: false
-      CONTAINERS: false
-      DISTRIBUTION: false
-      EVENTS: true
-      EXEC: false
-      GRPC: false
-      IMAGES: false
-      INFO: false
-      NETWORKS: false
-      NODES: false
-      PING: true
-      PLUGINS: false
-      SECRETS: false
-      SERVICES: false
-      SESSION: false
-      SWARM: false
-      SYSTEM: false
-      TASKS: false
-      VERSION: true
-      VOLUMES: false
-    volumes:
-      {{ if eq .ContainerRuntime "podman" -}}
-      - /var/run/podman/podman.sock:/var/run/podman/podman.sock
-      {{ else if eq .ContainerRuntime "nerdctl" -}}
-      - /var/run/containerd/containerd.sock:/var/run/containerd/containerd.sock
-      - /var/lib/nerdctl:/var/lib/nerdctl:ro # required to read metadata like network info
-      {{ else -}}
-      - /var/run/docker.sock:/var/run/docker.sock
-      {{ end -}}
-      - ./data:/app/data

agent/pkg/agentproxy/README.md

@@ -1,122 +0,0 @@
-# agent/pkg/agentproxy
-
-Package for configuring HTTP proxy connections through the GoDoxy Agent using HTTP headers.
-
-## Overview
-
-This package provides types and functions for parsing and setting agent proxy configuration via HTTP headers. It supports both a modern base64-encoded JSON format and a legacy header-based format for backward compatibility.
-
-## Architecture
-
-```mermaid
-graph LR
-    A[HTTP Request] --> B[ConfigFromHeaders]
-    B --> C{Modern Format?}
-    C -->|Yes| D[Parse X-Proxy-Config Base64 JSON]
-    C -->|No| E[Parse Legacy Headers]
-    D --> F[Config]
-    E --> F
-
-    F --> G[SetAgentProxyConfigHeaders]
-    G --> H[Modern Headers]
-    G --> I[Legacy Headers]
-```
-
-## Public Types
-
-### Config
-
-```go
-type Config struct {
-    Scheme string       // Proxy scheme (http or https)
-    Host   string       // Proxy host (hostname or hostname:port)
-    HTTPConfig         // Extended HTTP configuration
-}
-```
-
-The `HTTPConfig` embedded type (from `internal/route/types`) includes:
-
-- `NoTLSVerify` - Skip TLS certificate verification
-- `ResponseHeaderTimeout` - Timeout for response headers
-- `DisableCompression` - Disable gzip compression
-
-## Public Functions
-
-### ConfigFromHeaders
-
-```go
-func ConfigFromHeaders(h http.Header) (Config, error)
-```
-
-Parses proxy configuration from HTTP request headers. Tries modern format first, falls back to legacy format if not present.
-
-### proxyConfigFromHeaders
-
-```go
-func proxyConfigFromHeaders(h http.Header) (Config, error)
-```
-
-Parses the modern base64-encoded JSON format from `X-Proxy-Config` header.
-
-### proxyConfigFromHeadersLegacy
-
-```go
-func proxyConfigFromHeadersLegacy(h http.Header) Config
-```
-
-Parses the legacy header format:
-
-- `X-Proxy-Host` - Proxy host
-- `X-Proxy-Https` - Whether to use HTTPS
-- `X-Proxy-Skip-Tls-Verify` - Skip TLS verification
-- `X-Proxy-Response-Header-Timeout` - Response timeout in seconds
-
-### SetAgentProxyConfigHeaders
-
-```go
-func (cfg *Config) SetAgentProxyConfigHeaders(h http.Header)
-```
-
-Sets headers for modern format with base64-encoded JSON config.
-
-### SetAgentProxyConfigHeadersLegacy
-
-```go
-func (cfg *Config) SetAgentProxyConfigHeadersLegacy(h http.Header)
-```
-
-Sets headers for legacy format with individual header fields.
-
-## Header Constants
-
-Modern headers:
-
-- `HeaderXProxyScheme` - Proxy scheme
-- `HeaderXProxyHost` - Proxy host
-- `HeaderXProxyConfig` - Base64-encoded JSON config
-
-Legacy headers (deprecated):
-
-- `HeaderXProxyHTTPS`
-- `HeaderXProxySkipTLSVerify`
-- `HeaderXProxyResponseHeaderTimeout`
-
-## Usage Example
-
-```go
-// Reading configuration from incoming request headers
-func handleRequest(w http.ResponseWriter, r *http.Request) {
-    cfg, err := agentproxy.ConfigFromHeaders(r.Header)
-    if err != nil {
-        http.Error(w, "Invalid proxy config", http.StatusBadRequest)
-        return
-    }
-
-    // Use cfg.Scheme and cfg.Host to proxy the request
-    // ...
-}
-```
-
-## Integration
-
-This package is used by `agent/pkg/handler/proxy_http.go` to configure reverse proxy connections based on request headers.

agent/pkg/agentproxy/config.go

@@ -1,73 +0,0 @@
-package agentproxy
-
-import (
-	"encoding/base64"
-	"net/http"
-	"strconv"
-	"time"
-
-	"github.com/bytedance/sonic"
-	route "github.com/yusing/godoxy/internal/route/types"
-)
-
-type Config struct {
-	Scheme string `json:"scheme,omitempty"`
-	Host   string `json:"host,omitempty"` // host or host:port
-
-	route.HTTPConfig
-}
-
-func ConfigFromHeaders(h http.Header) (Config, error) {
-	cfg, err := proxyConfigFromHeaders(h)
-	if cfg.Host == "" || err != nil {
-		cfg = proxyConfigFromHeadersLegacy(h)
-	}
-	return cfg, nil
-}
-
-func proxyConfigFromHeadersLegacy(h http.Header) (cfg Config) {
-	cfg.Host = h.Get(HeaderXProxyHost)
-	isHTTPS, _ := strconv.ParseBool(h.Get(HeaderXProxyHTTPS))
-	cfg.NoTLSVerify, _ = strconv.ParseBool(h.Get(HeaderXProxySkipTLSVerify))
-	responseHeaderTimeout, err := strconv.Atoi(h.Get(HeaderXProxyResponseHeaderTimeout))
-	if err != nil {
-		responseHeaderTimeout = 0
-	}
-	cfg.ResponseHeaderTimeout = time.Duration(responseHeaderTimeout) * time.Second
-
-	cfg.Scheme = "http"
-	if isHTTPS {
-		cfg.Scheme = "https"
-	}
-
-	return cfg
-}
-
-func proxyConfigFromHeaders(h http.Header) (cfg Config, err error) {
-	cfg.Scheme = h.Get(HeaderXProxyScheme)
-	cfg.Host = h.Get(HeaderXProxyHost)
-
-	cfgBase64 := h.Get(HeaderXProxyConfig)
-	cfgJSON, err := base64.StdEncoding.DecodeString(cfgBase64)
-	if err != nil {
-		return cfg, err
-	}
-
-	err = sonic.Unmarshal(cfgJSON, &cfg)
-	return cfg, err
-}
-
-func (cfg *Config) SetAgentProxyConfigHeadersLegacy(h http.Header) {
-	h.Set(HeaderXProxyHost, cfg.Host)
-	h.Set(HeaderXProxyHTTPS, strconv.FormatBool(cfg.Scheme == "https"))
-	h.Set(HeaderXProxySkipTLSVerify, strconv.FormatBool(cfg.NoTLSVerify))
-	h.Set(HeaderXProxyResponseHeaderTimeout, strconv.Itoa(int(cfg.ResponseHeaderTimeout.Round(time.Second).Seconds())))
-}
-
-func (cfg *Config) SetAgentProxyConfigHeaders(h http.Header) {
-	h.Set(HeaderXProxyHost, cfg.Host)
-	h.Set(HeaderXProxyScheme, string(cfg.Scheme))
-	cfgJSON, _ := sonic.Marshal(cfg.HTTPConfig)
-	cfgBase64 := base64.StdEncoding.EncodeToString(cfgJSON)
-	h.Set(HeaderXProxyConfig, cfgBase64)
-}

agent/pkg/agentproxy/headers.go

@@ -1,14 +1,27 @@
 package agentproxy
 
-const (
-	HeaderXProxyScheme = "X-Proxy-Scheme"
-	HeaderXProxyHost   = "X-Proxy-Host"
-	HeaderXProxyConfig = "X-Proxy-Config"
+import (
+	"net/http"
+	"strconv"
 )
 
-// deprecated
 const (
+	HeaderXProxyHost                  = "X-Proxy-Host"
 	HeaderXProxyHTTPS                 = "X-Proxy-Https"
 	HeaderXProxySkipTLSVerify         = "X-Proxy-Skip-Tls-Verify"
 	HeaderXProxyResponseHeaderTimeout = "X-Proxy-Response-Header-Timeout"
 )
+
+type AgentProxyHeaders struct {
+	Host                  string
+	IsHTTPS               bool
+	SkipTLSVerify         bool
+	ResponseHeaderTimeout int
+}
+
+func SetAgentProxyHeaders(r *http.Request, headers *AgentProxyHeaders) {
+	r.Header.Set(HeaderXProxyHost, headers.Host)
+	r.Header.Set(HeaderXProxyHTTPS, strconv.FormatBool(headers.IsHTTPS))
+	r.Header.Set(HeaderXProxySkipTLSVerify, strconv.FormatBool(headers.SkipTLSVerify))
+	r.Header.Set(HeaderXProxyResponseHeaderTimeout, strconv.Itoa(headers.ResponseHeaderTimeout))
+}

agent/pkg/certs/README.md

@@ -1,102 +0,0 @@
-# agent/pkg/certs
-
-Certificate management package for creating and extracting certificate archives.
-
-## Overview
-
-This package provides utilities for packaging SSL certificates into ZIP archives and extracting them. It is used by the GoDoxy Agent to distribute certificates to clients in a convenient format.
-
-## Architecture
-
-```mermaid
-graph LR
-    A[Raw Certs] --> B[ZipCert]
-    B --> C[ZIP Archive]
-    C --> D[ca.pem]
-    C --> E[cert.pem]
-    C --> F[key.pem]
-
-    G[ZIP Archive] --> H[ExtractCert]
-    H --> I[ca, crt, key]
-```
-
-## Public Functions
-
-### ZipCert
-
-```go
-func ZipCert(ca, crt, key []byte) ([]byte, error)
-```
-
-Creates a ZIP archive containing three PEM files:
-
-- `ca.pem` - CA certificate
-- `cert.pem` - Server/client certificate
-- `key.pem` - Private key
-
-**Parameters:**
-
-- `ca` - CA certificate in PEM format
-- `crt` - Certificate in PEM format
-- `key` - Private key in PEM format
-
-**Returns:**
-
-- ZIP archive bytes
-- Error if packing fails
-
-### ExtractCert
-
-```go
-func ExtractCert(data []byte) (ca, crt, key []byte, err error)
-```
-
-Extracts certificates from a ZIP archive created by `ZipCert`.
-
-**Parameters:**
-
-- `data` - ZIP archive bytes
-
-**Returns:**
-
-- `ca` - CA certificate bytes
-- `crt` - Certificate bytes
-- `key` - Private key bytes
-- Error if extraction fails
-
-### AgentCertsFilepath
-
-```go
-func AgentCertsFilepath(host string) (filepathOut string, ok bool)
-```
-
-Generates the file path for storing agent certificates.
-
-**Parameters:**
-
-- `host` - Agent hostname
-
-**Returns:**
-
-- Full file path within `certs/` directory
-- `false` if host is invalid (contains path separators or special characters)
-
-### isValidAgentHost
-
-```go
-func isValidAgentHost(host string) bool
-```
-
-Validates that a host string is safe for use in file paths.
-
-## Constants
-
-```go
-const AgentCertsBasePath = "certs"
-```
-
-Base directory for storing certificate archives.
-
-## File Format
-
-The ZIP archive uses `zip.Store` compression (no compression) for fast creation and extraction. Each file is stored with its standard name (`ca.pem`, `cert.pem`, `key.pem`).

agent/pkg/certs/zip.go

@@ -6,11 +6,10 @@ import (
 	"io"
 	"path/filepath"
 
-	strutils "github.com/yusing/goutils/strings"
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
-const AgentCertsBasePath = "certs"
-
 func writeFile(zipWriter *zip.Writer, name string, data []byte) error {
 	w, err := zipWriter.CreateHeader(&zip.FileHeader{
 		Name:   name,
@@ -60,7 +59,7 @@ func AgentCertsFilepath(host string) (filepathOut string, ok bool) {
 	if !isValidAgentHost(host) {
 		return "", false
 	}
-	return filepath.Join(AgentCertsBasePath, host+".zip"), true
+	return filepath.Join(common.CertsDir, host+".zip"), true
 }
 
 func ExtractCert(data []byte) (ca, crt, key []byte, err error) {

agent/pkg/certs/zip_test.go

@@ -1,20 +1,19 @@
-package certs_test
+package certs
 
 import (
 	"testing"
 
-	"github.com/stretchr/testify/require"
-	"github.com/yusing/godoxy/agent/pkg/certs"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
 )
 
 func TestZipCert(t *testing.T) {
 	ca, crt, key := []byte("test1"), []byte("test2"), []byte("test3")
-	zipData, err := certs.ZipCert(ca, crt, key)
-	require.NoError(t, err)
+	zipData, err := ZipCert(ca, crt, key)
+	ExpectNoError(t, err)
 
-	ca2, crt2, key2, err := certs.ExtractCert(zipData)
-	require.NoError(t, err)
-	require.Equal(t, ca, ca2)
-	require.Equal(t, crt, crt2)
-	require.Equal(t, key, key2)
+	ca2, crt2, key2, err := ExtractCert(zipData)
+	ExpectNoError(t, err)
+	ExpectEqual(t, ca, ca2)
+	ExpectEqual(t, crt, crt2)
+	ExpectEqual(t, key, key2)
 }

agent/pkg/env/README.md

@@ -1,52 +0,0 @@
-# agent/pkg/env
-
-Environment configuration package for the GoDoxy Agent.
-
-## Overview
-
-This package manages environment variable parsing and provides a centralized location for all agent configuration options. It is automatically initialized on import.
-
-## Variables
-
-| Variable                   | Type             | Default                | Description                             |
-| -------------------------- | ---------------- | ---------------------- | --------------------------------------- |
-| `DockerSocket`             | string           | `/var/run/docker.sock` | Path to Docker socket                   |
-| `AgentName`                | string           | System hostname        | Agent identifier                        |
-| `AgentPort`                | int              | `8890`                 | Agent server port                       |
-| `AgentSkipClientCertCheck` | bool             | `false`                | Skip mTLS certificate verification      |
-| `AgentCACert`              | string           | (empty)                | Base64 Encoded CA certificate + key     |
-| `AgentSSLCert`             | string           | (empty)                | Base64 Encoded server certificate + key |
-| `Runtime`                  | ContainerRuntime | `docker`               | Container runtime (docker or podman)    |
-
-## ContainerRuntime Type
-
-```go
-type ContainerRuntime string
-
-const (
-    ContainerRuntimeDocker  ContainerRuntime = "docker"
-    ContainerRuntimePodman  ContainerRuntime = "podman"
-)
-```
-
-## Public Functions
-
-### DefaultAgentName
-
-```go
-func DefaultAgentName() string
-```
-
-Returns the system hostname as the default agent name. Falls back to `"agent"` if hostname cannot be determined.
-
-### Load
-
-```go
-func Load()
-```
-
-Reloads all environment variables from the environment. Called automatically on package init, but can be called again to refresh configuration.
-
-## Validation
-
-The `Load()` function validates that `Runtime` is either `docker` or `podman`. An invalid runtime causes a fatal error.

agent/pkg/env/env.go

@@ -3,10 +3,7 @@ package env
 import (
 	"os"
 
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/goutils/env"
-
-	"github.com/rs/zerolog/log"
+	"github.com/yusing/go-proxy/internal/common"
 )
 
 func DefaultAgentName() string {
@@ -18,32 +15,10 @@ func DefaultAgentName() string {
 }
 
 var (
-	AgentName                string
-	AgentPort                int
-	AgentSkipClientCertCheck bool
-	AgentCACert              string
-	AgentSSLCert             string
-	DockerSocket             string
-	Runtime                  agent.ContainerRuntime
+	AgentName                = common.GetEnvString("AGENT_NAME", DefaultAgentName())
+	AgentPort                = common.GetEnvInt("AGENT_PORT", 8890)
+	AgentSkipClientCertCheck = common.GetEnvBool("AGENT_SKIP_CLIENT_CERT_CHECK", false)
+
+	AgentCACert  = common.GetEnvString("AGENT_CA_CERT", "")
+	AgentSSLCert = common.GetEnvString("AGENT_SSL_CERT", "")
 )
-
-func init() {
-	Load()
-}
-
-func Load() {
-	DockerSocket = env.GetEnvString("DOCKER_SOCKET", "/var/run/docker.sock")
-	AgentName = env.GetEnvString("AGENT_NAME", DefaultAgentName())
-	AgentPort = env.GetEnvInt("AGENT_PORT", 8890)
-	AgentSkipClientCertCheck = env.GetEnvBool("AGENT_SKIP_CLIENT_CERT_CHECK", false)
-
-	AgentCACert = env.GetEnvString("AGENT_CA_CERT", "")
-	AgentSSLCert = env.GetEnvString("AGENT_SSL_CERT", "")
-	Runtime = agent.ContainerRuntime(env.GetEnvString("RUNTIME", "docker"))
-
-	switch Runtime {
-	case agent.ContainerRuntimeDocker, agent.ContainerRuntimePodman: //, agent.ContainerRuntimeNerdctl:
-	default:
-		log.Fatal().Str("runtime", string(Runtime)).Msg("invalid runtime")
-	}
-}

agent/pkg/handler/README.md

@@ -1,127 +0,0 @@
-# agent/pkg/handler
-
-HTTP request handler package for the GoDoxy Agent.
-
-## Overview
-
-This package provides the HTTP handler for the GoDoxy Agent server, including endpoints for:
-
-- Version information
-- Agent name and runtime
-- Health checks
-- System metrics (via SSE)
-- HTTP proxy routing
-- Docker socket proxying
-
-## Architecture
-
-```mermaid
-graph TD
-    A[HTTP Request] --> B[NewAgentHandler]
-    B --> C{ServeMux Router}
-
-    C --> D[GET /version]
-    C --> E[GET /name]
-    C --> F[GET /runtime]
-    C --> G[GET /health]
-    C --> H[GET /system-info]
-    C --> I[GET /proxy/http/#123;path...#125;]
-    C --> J[ /#42; Docker Socket]
-
-    H --> K[Gin Router]
-    K --> L[WebSocket Upgrade]
-    L --> M[SystemInfo Poller]
-```
-
-## Public Types
-
-### ServeMux
-
-```go
-type ServeMux struct{ *http.ServeMux }
-```
-
-Wrapper around `http.ServeMux` with agent-specific endpoint helpers.
-
-**Methods:**
-
-- `HandleEndpoint(method, endpoint string, handler http.HandlerFunc)` - Registers handler with API base path
-- `HandleFunc(endpoint string, handler http.HandlerFunc)` - Registers GET handler with API base path
-
-## Public Functions
-
-### NewAgentHandler
-
-```go
-func NewAgentHandler() http.Handler
-```
-
-Creates and configures the HTTP handler for the agent server. Sets up:
-
-- Gin-based metrics handler with WebSocket support for SSE
-- All standard agent endpoints
-- HTTP proxy endpoint
-- Docker socket proxy fallback
-
-## Endpoints
-
-| Endpoint                | Method   | Description                          |
-| ----------------------- | -------- | ------------------------------------ |
-| `/version`              | GET      | Returns agent version                |
-| `/name`                 | GET      | Returns agent name                   |
-| `/runtime`              | GET      | Returns container runtime            |
-| `/health`               | GET      | Health check with scheme query param |
-| `/system-info`          | GET      | System metrics via SSE or WebSocket  |
-| `/proxy/http/{path...}` | GET/POST | HTTP proxy with config from headers  |
-| `/*`                    | \*       | Docker socket proxy                  |
-
-## Sub-packages
-
-### proxy_http.go
-
-Handles HTTP proxy requests by reading configuration from request headers and proxying to the configured upstream.
-
-**Key Function:**
-
-- `ProxyHTTP(w, r)` - Proxies HTTP requests based on `X-Proxy-*` headers
-
-### check_health.go
-
-Handles health check requests for various schemes.
-
-**Key Function:**
-
-- `CheckHealth(w, r)` - Performs health checks with configurable scheme
-
-**Supported Schemes:**
-
-- `http`, `https` - HTTP health check
-- `h2c` - HTTP/2 cleartext health check
-- `tcp`, `udp`, `tcp4`, `udp4`, `tcp6`, `udp6` - TCP/UDP health check
-- `fileserver` - File existence check
-
-## Usage Example
-
-```go
-package main
-
-import (
-    "net/http"
-    "github.com/yusing/godoxy/agent/pkg/handler"
-)
-
-func main() {
-    mux := http.NewServeMux()
-    mux.Handle("/", handler.NewAgentHandler())
-
-    http.ListenAndServe(":8890", mux)
-}
-```
-
-## WebSocket Support
-
-The handler includes a permissive WebSocket upgrader for internal use (no origin check). This enables real-time system metrics streaming via Server-Sent Events (SSE).
-
-## Docker Socket Integration
-
-All unmatched requests fall through to the Docker socket handler, allowing the agent to proxy Docker API calls when configured.

agent/pkg/handler/check_health.go

@@ -1,69 +1,71 @@
 package handler
 
 import (
-	"net"
+	"fmt"
 	"net/http"
 	"net/url"
-	"strconv"
+	"os"
 	"strings"
-	"time"
 
-	"github.com/bytedance/sonic"
-	healthcheck "github.com/yusing/godoxy/internal/health/check"
-	"github.com/yusing/godoxy/internal/types"
+	"github.com/yusing/go-proxy/internal/net/gphttp"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
 )
 
+var defaultHealthConfig = health.DefaultHealthConfig()
+
 func CheckHealth(w http.ResponseWriter, r *http.Request) {
 	query := r.URL.Query()
 	scheme := query.Get("scheme")
 	if scheme == "" {
-		http.Error(w, "missing scheme", http.StatusBadRequest)
+		http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
 		return
 	}
-	timeout := parseMsOrDefault(query.Get("timeout"))
 
-	var (
-		result types.HealthCheckResult
-		err    error
-	)
+	var result *health.HealthCheckResult
+	var err error
 	switch scheme {
 	case "fileserver":
 		path := query.Get("path")
 		if path == "" {
-			http.Error(w, "missing path", http.StatusBadRequest)
+			http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
 			return
 		}
-		result, err = healthcheck.FileServer(path)
-	case "http", "https", "h2c": // path is optional
+		_, err := os.Stat(path)
+		result = &health.HealthCheckResult{Healthy: err == nil}
+		if err != nil {
+			result.Detail = err.Error()
+		}
+	case "http", "https": // path is optional
 		host := query.Get("host")
 		path := query.Get("path")
 		if host == "" {
-			http.Error(w, "missing host", http.StatusBadRequest)
+			http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
 			return
 		}
-		url := url.URL{Scheme: scheme, Host: host}
-		if scheme == "h2c" {
-			result, err = healthcheck.H2C(r.Context(), &url, http.MethodHead, path, timeout)
-		} else {
-			result, err = healthcheck.HTTP(&url, http.MethodHead, path, timeout)
-		}
-	case "tcp", "udp", "tcp4", "udp4", "tcp6", "udp6":
+		result, err = monitor.NewHTTPHealthMonitor(&url.URL{
+			Scheme: scheme,
+			Host:   host,
+			Path:   path,
+		}, defaultHealthConfig).CheckHealth()
+	case "tcp", "udp":
 		host := query.Get("host")
 		if host == "" {
-			http.Error(w, "missing host", http.StatusBadRequest)
+			http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
 			return
 		}
 		hasPort := strings.Contains(host, ":")
 		port := query.Get("port")
-		if port != "" && hasPort {
-			http.Error(w, "port and host with port cannot both be provided", http.StatusBadRequest)
+		if port != "" && !hasPort {
+			host = fmt.Sprintf("%s:%s", host, port)
+		} else {
+			http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
 			return
 		}
-		if port != "" {
-			host = net.JoinHostPort(host, port)
-		}
-		url := url.URL{Scheme: scheme, Host: host}
-		result, err = healthcheck.Stream(r.Context(), &url, timeout)
+		result, err = monitor.NewRawHealthMonitor(&url.URL{
+			Scheme: scheme,
+			Host:   host,
+		}, defaultHealthConfig).CheckHealth()
 	}
 
 	if err != nil {
@@ -71,20 +73,5 @@ func CheckHealth(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusOK)
-	sonic.ConfigDefault.NewEncoder(w).Encode(result)
-}
-
-func parseMsOrDefault(msStr string) time.Duration {
-	if msStr == "" {
-		return types.HealthCheckTimeoutDefault
-	}
-
-	timeoutMs, _ := strconv.ParseInt(msStr, 10, 64)
-	if timeoutMs == 0 {
-		return types.HealthCheckTimeoutDefault
-	}
-
-	return time.Duration(timeoutMs) * time.Millisecond
+	gphttp.RespondJSON(w, r, result)
 }

agent/pkg/handler/check_health_test.go

@@ -1,7 +1,6 @@
 package handler_test
 
 import (
-	"encoding/json"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -9,10 +8,12 @@ import (
 	"strconv"
 	"testing"
 
+	"github.com/yusing/go-proxy/pkg/json"
+
 	"github.com/stretchr/testify/require"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/godoxy/agent/pkg/handler"
-	"github.com/yusing/godoxy/internal/types"
+	"github.com/yusing/go-proxy/agent/pkg/agent"
+	"github.com/yusing/go-proxy/agent/pkg/handler"
+	"github.com/yusing/go-proxy/internal/watcher/health"
 )
 
 func TestCheckHealthHTTP(t *testing.T) {
@@ -81,7 +82,7 @@ func TestCheckHealthHTTP(t *testing.T) {
 			require.Equal(t, recorder.Code, tt.expectedStatus)
 
 			if tt.expectedStatus == http.StatusOK {
-				var result types.HealthCheckResult
+				var result health.HealthCheckResult
 				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &result))
 				require.Equal(t, result.Healthy, tt.expectedHealthy)
 			}
@@ -125,7 +126,7 @@ func TestCheckHealthFileServer(t *testing.T) {
 
 			require.Equal(t, recorder.Code, tt.expectedStatus)
 
-			var result types.HealthCheckResult
+			var result health.HealthCheckResult
 			require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &result))
 			require.Equal(t, result.Healthy, tt.expectedHealthy)
 			require.Equal(t, result.Detail, tt.expectedDetail)
@@ -172,9 +173,9 @@ func TestCheckHealthTCPUDP(t *testing.T) {
 		{
 			name:            "InvalidHost",
 			scheme:          "tcp",
-			host:            "",
+			host:            "invalid",
 			port:            8080,
-			expectedStatus:  http.StatusBadRequest,
+			expectedStatus:  http.StatusOK,
 			expectedHealthy: false,
 		},
 		{
@@ -188,17 +189,9 @@ func TestCheckHealthTCPUDP(t *testing.T) {
 		{
 			name:            "InvalidHost",
 			scheme:          "udp",
-			host:            "",
+			host:            "invalid",
 			port:            8080,
-			expectedStatus:  http.StatusBadRequest,
-			expectedHealthy: false,
-		},
-		{
-			name:            "Port in both host and port",
-			scheme:          "tcp",
-			host:            "localhost:1234",
-			port:            1234,
-			expectedStatus:  http.StatusBadRequest,
+			expectedStatus:  http.StatusOK,
 			expectedHealthy: false,
 		},
 	}
@@ -216,11 +209,9 @@ func TestCheckHealthTCPUDP(t *testing.T) {
 
 			require.Equal(t, recorder.Code, tt.expectedStatus)
 
-			if tt.expectedStatus == http.StatusOK {
-				var result types.HealthCheckResult
-				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &result))
-				require.Equal(t, result.Healthy, tt.expectedHealthy)
-			}
+			var result health.HealthCheckResult
+			require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &result))
+			require.Equal(t, result.Healthy, tt.expectedHealthy)
 		})
 	}
 }

agent/pkg/handler/docker_socket.go

@@ -0,0 +1,30 @@
+package handler
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/docker/docker/client"
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/docker"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/net/gphttp/reverseproxy"
+)
+
+func serviceUnavailable(w http.ResponseWriter, r *http.Request) {
+	http.Error(w, "docker socket is not available", http.StatusServiceUnavailable)
+}
+
+func DockerSocketHandler() http.HandlerFunc {
+	dockerClient, err := docker.NewClient(common.DockerHostFromEnv)
+	if err != nil {
+		logging.Warn().Err(err).Msg("failed to connect to docker client")
+		return serviceUnavailable
+	}
+	rp := reverseproxy.NewReverseProxy("docker", &url.URL{
+		Scheme: "http",
+		Host:   client.DummyHost,
+	}, dockerClient.HTTPClient().Transport)
+
+	return rp.ServeHTTP
+}

agent/pkg/handler/handler.go

@@ -1,60 +1,49 @@
 package handler
 
 import (
+	"fmt"
+	"io"
 	"net/http"
 
-	"github.com/bytedance/sonic"
-	"github.com/gin-gonic/gin"
-	"github.com/gorilla/websocket"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/godoxy/agent/pkg/env"
-	"github.com/yusing/godoxy/internal/metrics/systeminfo"
-	socketproxy "github.com/yusing/godoxy/socketproxy/pkg"
-	"github.com/yusing/goutils/version"
+	"github.com/yusing/go-proxy/agent/pkg/agent"
+	"github.com/yusing/go-proxy/agent/pkg/env"
+	v1 "github.com/yusing/go-proxy/internal/api/v1"
+	"github.com/yusing/go-proxy/internal/logging/memlogger"
+	"github.com/yusing/go-proxy/internal/metrics/systeminfo"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
 type ServeMux struct{ *http.ServeMux }
 
-func (mux ServeMux) HandleEndpoint(method, endpoint string, handler http.HandlerFunc) {
-	mux.ServeMux.HandleFunc(method+" "+agent.APIEndpointBase+endpoint, handler)
+func (mux ServeMux) HandleMethods(methods, endpoint string, handler http.HandlerFunc) {
+	for _, m := range strutils.CommaSeperatedList(methods) {
+		mux.ServeMux.HandleFunc(m+" "+agent.APIEndpointBase+endpoint, handler)
+	}
 }
 
 func (mux ServeMux) HandleFunc(endpoint string, handler http.HandlerFunc) {
 	mux.ServeMux.HandleFunc(agent.APIEndpointBase+endpoint, handler)
 }
 
-var upgrader = &websocket.Upgrader{
-	// no origin check needed for internal websocket
-	CheckOrigin: func(r *http.Request) bool {
-		return true
-	},
+type NopWriteCloser struct {
+	io.Writer
+}
+
+func (NopWriteCloser) Close() error {
+	return nil
 }
 
 func NewAgentHandler() http.Handler {
-	gin.SetMode(gin.ReleaseMode)
 	mux := ServeMux{http.NewServeMux()}
 
-	metricsHandler := gin.Default()
-	{
-		metrics := metricsHandler.Group(agent.APIEndpointBase)
-		metrics.GET(agent.EndpointSystemInfo, func(c *gin.Context) {
-			c.Set("upgrader", upgrader)
-			systeminfo.Poller.ServeHTTP(c)
-		})
-	}
-
 	mux.HandleFunc(agent.EndpointProxyHTTP+"/{path...}", ProxyHTTP)
-	mux.HandleFunc(agent.EndpointInfo, func(w http.ResponseWriter, r *http.Request) {
-		agentInfo := agent.AgentInfo{
-			Version: version.Get(),
-			Name:    env.AgentName,
-			Runtime: env.Runtime,
-		}
-		w.Header().Set("Content-Type", "application/json")
-		sonic.ConfigDefault.NewEncoder(w).Encode(agentInfo)
+	mux.HandleMethods("GET", agent.EndpointVersion, v1.GetVersion)
+	mux.HandleMethods("GET", agent.EndpointName, func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, env.AgentName)
 	})
-	mux.HandleEndpoint("GET", agent.EndpointHealth, CheckHealth)
-	mux.HandleEndpoint("GET", agent.EndpointSystemInfo, metricsHandler.ServeHTTP)
-	mux.ServeMux.HandleFunc("/", socketproxy.DockerSocketHandler(env.DockerSocket))
+	mux.HandleMethods("GET", agent.EndpointHealth, CheckHealth)
+	mux.HandleMethods("GET", agent.EndpointLogs, memlogger.HandlerFunc())
+	mux.HandleMethods("GET", agent.EndpointSystemInfo, systeminfo.Poller.ServeHTTP)
+	mux.ServeMux.HandleFunc("/", DockerSocketHandler())
 	return mux
 }

agent/pkg/handler/proxy_http.go

@@ -1,72 +1,62 @@
 package handler
 
 import (
-	"fmt"
+	"crypto/tls"
 	"net/http"
-	"net/http/httputil"
-	"strings"
+	"net/url"
+	"strconv"
 	"time"
 
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/godoxy/agent/pkg/agentproxy"
+	"github.com/yusing/go-proxy/agent/pkg/agent"
+	"github.com/yusing/go-proxy/agent/pkg/agentproxy"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/net/gphttp"
+	"github.com/yusing/go-proxy/internal/net/gphttp/reverseproxy"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
-func NewTransport() *http.Transport {
-	return &http.Transport{
-		MaxIdleConnsPerHost:   100,
-		IdleConnTimeout:       90 * time.Second,
-		TLSHandshakeTimeout:   10 * time.Second,
-		ExpectContinueTimeout: 1 * time.Second,
-		ResponseHeaderTimeout: 60 * time.Second,
-		WriteBufferSize:       16 * 1024, // 16KB
-		ReadBufferSize:        16 * 1024, // 16KB
-	}
-}
-
 func ProxyHTTP(w http.ResponseWriter, r *http.Request) {
-	cfg, err := agentproxy.ConfigFromHeaders(r.Header)
+	host := r.Header.Get(agentproxy.HeaderXProxyHost)
+	isHTTPS := strutils.ParseBool(r.Header.Get(agentproxy.HeaderXProxyHTTPS))
+	skipTLSVerify := strutils.ParseBool(r.Header.Get(agentproxy.HeaderXProxySkipTLSVerify))
+	responseHeaderTimeout, err := strconv.Atoi(r.Header.Get(agentproxy.HeaderXProxyResponseHeaderTimeout))
 	if err != nil {
-		http.Error(w, fmt.Sprintf("failed to parse agent proxy config: %s", err.Error()), http.StatusBadRequest)
+		responseHeaderTimeout = 0
+	}
+
+	if host == "" {
+		http.Error(w, "missing required headers", http.StatusBadRequest)
 		return
 	}
 
-	transport := NewTransport()
-	if cfg.ResponseHeaderTimeout > 0 {
-		transport.ResponseHeaderTimeout = cfg.ResponseHeaderTimeout
-	}
-	if cfg.DisableCompression {
-		transport.DisableCompression = true
+	scheme := "http"
+	if isHTTPS {
+		scheme = "https"
 	}
 
-	transport.TLSClientConfig, err = cfg.BuildTLSConfig(r.URL)
-	if err != nil {
-		http.Error(w, fmt.Sprintf("failed to build TLS client config: %s", err.Error()), http.StatusInternalServerError)
-		return
+	var transport *http.Transport
+	if skipTLSVerify {
+		transport = gphttp.NewTransportWithTLSConfig(&tls.Config{InsecureSkipVerify: true})
+	} else {
+		transport = gphttp.NewTransport()
 	}
 
-	// Strip the {API_BASE}/proxy/http prefix while preserving URL escaping.
-	//
-	// NOTE: `r.URL.Path` is decoded. If we rewrite it without keeping `RawPath`
-	// in sync, Go may re-escape the path (e.g. turning "%5B" into "%255B"),
-	// which breaks urls with percent-encoded characters, like Next.js static chunk URLs.
-	prefix := agent.APIEndpointBase + agent.EndpointProxyHTTP
-	r.URL.Path = strings.TrimPrefix(r.URL.Path, prefix)
-	if r.URL.RawPath != "" {
-		if after, ok := strings.CutPrefix(r.URL.RawPath, prefix); ok {
-			r.URL.RawPath = after
-		} else {
-			// RawPath is no longer a valid encoding for Path; force Go to re-derive it.
-			r.URL.RawPath = ""
-		}
+	if responseHeaderTimeout > 0 {
+		transport.ResponseHeaderTimeout = time.Duration(responseHeaderTimeout) * time.Second
 	}
-	r.RequestURI = ""
 
-	rp := &httputil.ReverseProxy{
-		Director: func(r *http.Request) {
-			r.URL.Scheme = cfg.Scheme
-			r.URL.Host = cfg.Host
-		},
-		Transport: transport,
-	}
+	r.URL.Scheme = ""
+	r.URL.Host = ""
+	r.URL.Path = r.URL.Path[agent.HTTPProxyURLPrefixLen:] // strip the {API_BASE}/proxy/http prefix
+	r.RequestURI = r.URL.String()
+	r.URL.Host = host
+	r.URL.Scheme = scheme
+
+	logging.Debug().Msgf("proxy http request: %s %s", r.Method, r.URL.String())
+
+	rp := reverseproxy.NewReverseProxy("agent", &url.URL{
+		Scheme: scheme,
+		Host:   host,
+	}, transport)
 	rp.ServeHTTP(w, r)
 }

agent/pkg/server/server.go

@@ -6,11 +6,11 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/rs/zerolog/log"
-	"github.com/yusing/godoxy/agent/pkg/env"
-	"github.com/yusing/godoxy/agent/pkg/handler"
-	"github.com/yusing/goutils/server"
-	"github.com/yusing/goutils/task"
+	"github.com/yusing/go-proxy/agent/pkg/env"
+	"github.com/yusing/go-proxy/agent/pkg/handler"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/net/gphttp/server"
+	"github.com/yusing/go-proxy/internal/task"
 )
 
 type Options struct {
@@ -33,11 +33,12 @@ func StartAgentServer(parent task.Parent, opt Options) {
 		tlsConfig.ClientAuth = tls.NoClientCert
 	}
 
+	logger := logging.GetLogger()
 	agentServer := &http.Server{
 		Addr:      fmt.Sprintf(":%d", opt.Port),
 		Handler:   handler.NewAgentHandler(),
 		TLSConfig: tlsConfig,
 	}
 
-	server.Start(parent.Subtask("agent-server", false), agentServer, server.WithLogger(&log.Logger))
+	server.Start(parent, agentServer, logger)
 }

cmd/README.md

@@ -1,73 +0,0 @@
-# cmd
-
-Main entry point package for GoDoxy, a lightweight reverse proxy with WebUI for Docker containers.
-
-## Overview
-
-This package contains the `main.go` entry point that initializes and starts the GoDoxy server. It coordinates the initialization of all core components including configuration loading, API server, authentication, and monitoring services.
-
-## Architecture
-
-```mermaid
-graph TD
-    A[main] --> B[Init Profiling]
-    A --> C[Init Logger]
-    A --> D[Parallel Init]
-    D --> D1[DNS Providers]
-    D --> D2[Icon Cache]
-    D --> D3[System Info Poller]
-    D --> D4[Middleware Compose Files]
-    A --> E[JWT Secret Setup]
-    A --> F[Create Directories]
-    A --> G[Load Config]
-    A --> H[Start Proxy Servers]
-    A --> I[Init Auth]
-    A --> J[Start API Server]
-    A --> K[Debug Server]
-    A --> L[Uptime Poller]
-    A --> M[Watch Changes]
-    A --> N[Wait Exit]
-```
-
-## Main Function Flow
-
-The `main()` function performs the following initialization steps:
-
-1. **Profiling Setup**: Initializes pprof endpoints for performance monitoring
-1. **Logger Initialization**: Configures zerolog with memory logging
-1. **Parallel Initialization**: Starts DNS providers, icon cache, system info poller, and middleware
-1. **JWT Secret**: Ensures API JWT secret is set (generates random if not provided)
-1. **Directory Preparation**: Creates required directories for logs, certificates, etc.
-1. **Configuration Loading**: Loads YAML configuration and reports any errors
-1. **Proxy Servers**: Starts HTTP/HTTPS proxy servers based on configuration
-1. **Authentication**: Initializes authentication system with access control
-1. **API Server**: Starts the REST API server with all configured routes
-1. **Debug Server**: Starts the debug page server (development mode)
-1. **Monitoring**: Starts uptime and system info polling
-1. **Change Watcher**: Starts watching for Docker container and configuration changes
-1. **Graceful Shutdown**: Waits for exit signal with configured timeout
-
-## Configuration
-
-The main configuration is loaded from `config/config.yml`. Required directories include:
-
-- `logs/` - Log files
-- `config/` - Configuration directory
-- `certs/` - SSL certificates
-- `proxy/` - Proxy-related files
-
-## Environment Variables
-
-- `API_JWT_SECRET` - Secret key for JWT authentication (optional, auto-generated if not set)
-
-## Dependencies
-
-- `internal/api` - REST API handlers
-- `internal/auth` - Authentication and ACL
-- `internal/config` - Configuration management
-- `internal/dnsproviders` - DNS provider integration
-- `internal/homepage` - WebUI dashboard
-- `internal/logging` - Logging infrastructure
-- `internal/metrics` - System metrics collection
-- `internal/route` - HTTP routing and middleware
-- `github.com/yusing/goutils/task` - Task lifecycle management

cmd/bench_server/Dockerfile

@@ -1,18 +0,0 @@
-FROM golang:1.25.5-alpine AS builder
-
-HEALTHCHECK NONE
-
-WORKDIR /src
-
-COPY go.mod go.sum ./
-COPY main.go ./
-
-RUN go build -o bench_server main.go
-
-FROM scratch
-
-COPY --from=builder /src/bench_server /app/run
-
-USER 1001:1001
-
-CMD ["/app/run"]

cmd/bench_server/go.mod

@@ -1,3 +0,0 @@
-module github.com/yusing/godoxy/cmd/bench_server
-
-go 1.25.5

cmd/bench_server/main.go

@@ -1,34 +0,0 @@
-package main
-
-import (
-	"log"
-	"net/http"
-
-	"math/rand/v2"
-)
-
-var printables = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-var random = make([]byte, 4096)
-
-func init() {
-	for i := range random {
-		random[i] = printables[rand.IntN(len(printables))]
-	}
-}
-
-func main() {
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		w.Write(random)
-	})
-
-	server := &http.Server{
-		Addr:    ":80",
-		Handler: handler,
-	}
-
-	log.Println("Bench server listening on :80")
-	if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-		log.Fatalf("ListenAndServe: %v", err)
-	}
-}

cmd/debug_page.go

@@ -1,257 +0,0 @@
-//go:build !production
-
-package main
-
-import (
-	"fmt"
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/internal/api"
-	apiV1 "github.com/yusing/godoxy/internal/api/v1"
-	agentApi "github.com/yusing/godoxy/internal/api/v1/agent"
-	authApi "github.com/yusing/godoxy/internal/api/v1/auth"
-	certApi "github.com/yusing/godoxy/internal/api/v1/cert"
-	dockerApi "github.com/yusing/godoxy/internal/api/v1/docker"
-	fileApi "github.com/yusing/godoxy/internal/api/v1/file"
-	homepageApi "github.com/yusing/godoxy/internal/api/v1/homepage"
-	metricsApi "github.com/yusing/godoxy/internal/api/v1/metrics"
-	routeApi "github.com/yusing/godoxy/internal/api/v1/route"
-	"github.com/yusing/godoxy/internal/auth"
-	"github.com/yusing/godoxy/internal/idlewatcher"
-	idlewatcherTypes "github.com/yusing/godoxy/internal/idlewatcher/types"
-)
-
-type debugMux struct {
-	endpoints []debugEndpoint
-	mux       http.ServeMux
-}
-
-type debugEndpoint struct {
-	name   string
-	method string
-	path   string
-}
-
-func newDebugMux() *debugMux {
-	return &debugMux{
-		endpoints: make([]debugEndpoint, 0),
-		mux:       *http.NewServeMux(),
-	}
-}
-
-func (mux *debugMux) registerEndpoint(name, method, path string) {
-	mux.endpoints = append(mux.endpoints, debugEndpoint{name: name, method: method, path: path})
-}
-
-func (mux *debugMux) HandleFunc(name, method, path string, handler http.HandlerFunc) {
-	mux.registerEndpoint(name, method, path)
-	mux.mux.HandleFunc(method+" "+path, handler)
-}
-
-func (mux *debugMux) Finalize() {
-	mux.mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.WriteHeader(http.StatusOK)
-		fmt.Fprintln(w, `
-<!DOCTYPE html>
-<html>
-	<head>
-		<style>
-				body {
-					font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial, Apple Color Emoji, Segoe UI Emoji;
-					font-size: 16px;
-					line-height: 1.5;
-					color: #f8f9fa;
-					background-color: #121212;
-					margin: 0;
-					padding: 0;
-				}
-				table {
-					border-collapse: collapse;
-					width: 100%;
-					margin-top: 20px;
-				}
-				th, td {
-					padding: 12px;
-					text-align: left;
-					border-bottom: 1px solid #333;
-				}
-				th {
-					background-color: #1e1e1e;
-					font-weight: 600;
-					color: #f8f9fa;
-				}
-				td {
-					color: #e9ecef;
-				}
-				.link {
-					color: #007bff;
-					text-decoration: none;
-				}
-				.link:hover {
-					text-decoration: underline;
-				}
-				.method {
-					color: #6c757d;
-					font-family: monospace;
-				}
-				.path {
-					color: #6c757d;
-					font-family: monospace;
-				}
-		</style>
-	</head>
-	<body>
-		<table>
-			<thead>
-				<tr>
-					<th>Name</th>
-					<th>Method</th>
-					<th>Path</th>
-				</tr>
-			</thead>
-			<tbody>`)
-		for _, endpoint := range mux.endpoints {
-			fmt.Fprintf(w, "<tr><td><a class='link' href=%q>%s</a></td><td class='method'>%s</td><td class='path'>%s</td></tr>", endpoint.path, endpoint.name, endpoint.method, endpoint.path)
-		}
-		fmt.Fprintln(w, `
-			</tbody>
-		</table>
-	</body>
-</html>`)
-	})
-}
-
-func listenDebugServer() {
-	mux := newDebugMux()
-	mux.mux.HandleFunc("/favicon.ico", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "image/svg+xml")
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><text x="50" y="50" text-anchor="middle" dominant-baseline="middle">🐙</text></svg>`))
-	})
-
-	mux.HandleFunc("Auth block page", "GET", "/auth/block", AuthBlockPageHandler)
-	mux.HandleFunc("Idlewatcher loading page", "GET", idlewatcherTypes.PathPrefix, idlewatcher.DebugHandler)
-	apiHandler := newApiHandler(mux)
-	mux.mux.HandleFunc("/api/v1/", apiHandler.ServeHTTP)
-
-	mux.Finalize()
-
-	go http.ListenAndServe(":7777", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Pragma", "no-cache")
-		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
-		w.Header().Set("Expires", "0")
-		mux.mux.ServeHTTP(w, r)
-	}))
-}
-
-func newApiHandler(debugMux *debugMux) *gin.Engine {
-	r := gin.New()
-	r.Use(api.ErrorHandler())
-	r.Use(api.ErrorLoggingMiddleware())
-	r.Use(api.NoCache())
-
-	registerGinRoute := func(router gin.IRouter, method, name string, path string, handler gin.HandlerFunc) {
-		if group, ok := router.(*gin.RouterGroup); ok {
-			debugMux.registerEndpoint(name, method, group.BasePath()+path)
-		} else {
-			debugMux.registerEndpoint(name, method, path)
-		}
-		router.Handle(method, path, handler)
-	}
-
-	registerGinRoute(r, "GET", "App version", "/api/v1/version", apiV1.Version)
-
-	v1 := r.Group("/api/v1")
-	if auth.IsEnabled() {
-		v1Auth := v1.Group("/auth")
-		{
-			registerGinRoute(v1Auth, "HEAD", "Auth check", "/check", authApi.Check)
-			registerGinRoute(v1Auth, "POST", "Auth login", "/login", authApi.Login)
-			registerGinRoute(v1Auth, "GET", "Auth callback", "/callback", authApi.Callback)
-			registerGinRoute(v1Auth, "POST", "Auth callback", "/callback", authApi.Callback)
-			registerGinRoute(v1Auth, "POST", "Auth logout", "/logout", authApi.Logout)
-			registerGinRoute(v1Auth, "GET", "Auth logout", "/logout", authApi.Logout)
-		}
-	}
-
-	{
-		// enable cache for favicon
-		registerGinRoute(v1, "GET", "Route favicon", "/favicon", apiV1.FavIcon)
-		registerGinRoute(v1, "GET", "Route health", "/health", apiV1.Health)
-		registerGinRoute(v1, "GET", "List icons", "/icons", apiV1.Icons)
-		registerGinRoute(v1, "POST", "Config reload", "/reload", apiV1.Reload)
-		registerGinRoute(v1, "GET", "Route stats", "/stats", apiV1.Stats)
-
-		route := v1.Group("/route")
-		{
-			registerGinRoute(route, "GET", "List routes", "/list", routeApi.Routes)
-			registerGinRoute(route, "GET", "Get route", "/:which", routeApi.Route)
-			registerGinRoute(route, "GET", "List providers", "/providers", routeApi.Providers)
-			registerGinRoute(route, "GET", "List routes by provider", "/by_provider", routeApi.ByProvider)
-			registerGinRoute(route, "POST", "Playground", "/playground", routeApi.Playground)
-		}
-
-		file := v1.Group("/file")
-		{
-			registerGinRoute(file, "GET", "List files", "/list", fileApi.List)
-			registerGinRoute(file, "GET", "Get file", "/content", fileApi.Get)
-			registerGinRoute(file, "PUT", "Set file", "/content", fileApi.Set)
-			registerGinRoute(file, "POST", "Set file", "/content", fileApi.Set)
-			registerGinRoute(file, "POST", "Validate file", "/validate", fileApi.Validate)
-		}
-
-		homepage := v1.Group("/homepage")
-		{
-			registerGinRoute(homepage, "GET", "List categories", "/categories", homepageApi.Categories)
-			registerGinRoute(homepage, "GET", "List items", "/items", homepageApi.Items)
-			registerGinRoute(homepage, "POST", "Set item", "/set/item", homepageApi.SetItem)
-			registerGinRoute(homepage, "POST", "Set items batch", "/set/items_batch", homepageApi.SetItemsBatch)
-			registerGinRoute(homepage, "POST", "Set item visible", "/set/item_visible", homepageApi.SetItemVisible)
-			registerGinRoute(homepage, "POST", "Set item favorite", "/set/item_favorite", homepageApi.SetItemFavorite)
-			registerGinRoute(homepage, "POST", "Set item sort order", "/set/item_sort_order", homepageApi.SetItemSortOrder)
-			registerGinRoute(homepage, "POST", "Set item all sort order", "/set/item_all_sort_order", homepageApi.SetItemAllSortOrder)
-			registerGinRoute(homepage, "POST", "Set item fav sort order", "/set/item_fav_sort_order", homepageApi.SetItemFavSortOrder)
-			registerGinRoute(homepage, "POST", "Set category order", "/set/category_order", homepageApi.SetCategoryOrder)
-			registerGinRoute(homepage, "POST", "Item click", "/item_click", homepageApi.ItemClick)
-		}
-
-		cert := v1.Group("/cert")
-		{
-			registerGinRoute(cert, "GET", "Get cert info", "/info", certApi.Info)
-			registerGinRoute(cert, "GET", "Renew cert", "/renew", certApi.Renew)
-		}
-
-		agent := v1.Group("/agent")
-		{
-			registerGinRoute(agent, "GET", "List agents", "/list", agentApi.List)
-			registerGinRoute(agent, "POST", "Create agent", "/create", agentApi.Create)
-			registerGinRoute(agent, "POST", "Verify agent", "/verify", agentApi.Verify)
-		}
-
-		metrics := v1.Group("/metrics")
-		{
-			registerGinRoute(metrics, "GET", "Get system info", "/system_info", metricsApi.SystemInfo)
-			registerGinRoute(metrics, "GET", "Get all system info", "/all_system_info", metricsApi.AllSystemInfo)
-			registerGinRoute(metrics, "GET", "Get uptime", "/uptime", metricsApi.Uptime)
-		}
-
-		docker := v1.Group("/docker")
-		{
-			registerGinRoute(docker, "GET", "Get container", "/container/:id", dockerApi.GetContainer)
-			registerGinRoute(docker, "GET", "List containers", "/containers", dockerApi.Containers)
-			registerGinRoute(docker, "GET", "Get docker info", "/info", dockerApi.Info)
-			registerGinRoute(docker, "GET", "Get docker logs", "/logs/:id", dockerApi.Logs)
-			registerGinRoute(docker, "POST", "Start docker container", "/start", dockerApi.Start)
-			registerGinRoute(docker, "POST", "Stop docker container", "/stop", dockerApi.Stop)
-			registerGinRoute(docker, "POST", "Restart docker container", "/restart", dockerApi.Restart)
-		}
-	}
-
-	return r
-}
-
-func AuthBlockPageHandler(w http.ResponseWriter, r *http.Request) {
-	auth.WriteBlockPage(w, http.StatusForbidden, "Forbidden", "Login", "/login")
-}

cmd/debug_page_prod.go

@@ -1,7 +0,0 @@
-//go:build production
-
-package main
-
-func listenDebugServer() {
-	// no-op
-}

cmd/h2c_test_server/Dockerfile

@@ -1,18 +0,0 @@
-FROM golang:1.25.5-alpine AS builder
-
-HEALTHCHECK NONE
-
-WORKDIR /src
-
-COPY go.mod go.sum ./
-COPY main.go ./
-
-RUN go build -o h2c_test_server main.go
-
-FROM scratch
-
-COPY --from=builder /src/h2c_test_server /app/run
-
-USER 1001:1001
-
-CMD ["/app/run"]

cmd/h2c_test_server/go.mod

@@ -1,7 +0,0 @@
-module github.com/yusing/godoxy/cmd/h2c_test_server
-
-go 1.25.5
-
-require golang.org/x/net v0.48.0
-
-require golang.org/x/text v0.32.0 // indirect

cmd/h2c_test_server/go.sum

@@ -1,4 +0,0 @@
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=

cmd/h2c_test_server/main.go

@@ -1,26 +0,0 @@
-package main
-
-import (
-	"log"
-	"net/http"
-
-	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
-)
-
-func main() {
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("ok"))
-	})
-
-	server := &http.Server{
-		Addr:    ":80",
-		Handler: h2c.NewHandler(handler, &http2.Server{}),
-	}
-
-	log.Println("H2C server listening on :80")
-	if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-		log.Fatalf("ListenAndServe: %v", err)
-	}
-}

cmd/main.go

@@ -1,89 +1,173 @@
 package main
 
 import (
+	"encoding/json"
+	"log"
 	"os"
 	"sync"
 
-	"github.com/rs/zerolog/log"
-	"github.com/yusing/godoxy/internal/api"
-	"github.com/yusing/godoxy/internal/auth"
-	"github.com/yusing/godoxy/internal/common"
-	"github.com/yusing/godoxy/internal/config"
-	"github.com/yusing/godoxy/internal/dnsproviders"
-	"github.com/yusing/godoxy/internal/homepage"
-	"github.com/yusing/godoxy/internal/logging"
-	"github.com/yusing/godoxy/internal/logging/memlogger"
-	"github.com/yusing/godoxy/internal/metrics/systeminfo"
-	"github.com/yusing/godoxy/internal/metrics/uptime"
-	"github.com/yusing/godoxy/internal/net/gphttp/middleware"
-	"github.com/yusing/godoxy/internal/route/rules"
-	gperr "github.com/yusing/goutils/errs"
-	"github.com/yusing/goutils/server"
-	"github.com/yusing/goutils/task"
-	"github.com/yusing/goutils/version"
+	"github.com/yusing/go-proxy/internal/api/v1/auth"
+	debugapi "github.com/yusing/go-proxy/internal/api/v1/debug"
+	"github.com/yusing/go-proxy/internal/api/v1/query"
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/config"
+	"github.com/yusing/go-proxy/internal/gperr"
+	"github.com/yusing/go-proxy/internal/homepage"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/logging/memlogger"
+	"github.com/yusing/go-proxy/internal/metrics/systeminfo"
+	"github.com/yusing/go-proxy/internal/metrics/uptime"
+	"github.com/yusing/go-proxy/internal/net/gphttp/middleware"
+	"github.com/yusing/go-proxy/internal/route/routes/routequery"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/migrations"
+	"github.com/yusing/go-proxy/pkg"
 )
 
+var rawLogger = log.New(os.Stdout, "", 0)
+
 func parallel(fns ...func()) {
 	var wg sync.WaitGroup
 	for _, fn := range fns {
-		wg.Go(fn)
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			fn()
+		}()
 	}
 	wg.Wait()
 }
 
 func main() {
 	initProfiling()
+	if err := migrations.RunMigrations(); err != nil {
+		gperr.LogFatal("migration error", err)
+	}
+	args := pkg.GetArgs(common.MainServerCommandValidator{})
 
-	logging.InitLogger(os.Stderr, memlogger.GetMemLogger())
-	log.Info().Msgf("GoDoxy version %s", version.Get())
-	log.Trace().Msg("trace enabled")
-	parallel(
-		dnsproviders.InitProviders,
-		homepage.InitIconListCache,
-		systeminfo.Poller.Start,
-		middleware.LoadComposeFiles,
-	)
+	switch args.Command {
+	case common.CommandReload:
+		if err := query.ReloadServer(); err != nil {
+			gperr.LogFatal("server reload error", err)
+		}
+		rawLogger.Println("ok")
+		return
+	case common.CommandListIcons:
+		icons, err := homepage.ListAvailableIcons()
+		if err != nil {
+			rawLogger.Fatal(err)
+		}
+		printJSON(icons)
+		return
+	case common.CommandListRoutes:
+		routes, err := query.ListRoutes()
+		if err != nil {
+			log.Printf("failed to connect to api server: %s", err)
+			log.Printf("falling back to config file")
+		} else {
+			printJSON(routes)
+			return
+		}
+	case common.CommandDebugListMTrace:
+		trace, err := query.ListMiddlewareTraces()
+		if err != nil {
+			log.Fatal(err)
+		}
+		printJSON(trace)
+		return
+	}
 
-	if common.APIJWTSecret == nil {
-		log.Warn().Msg("API_JWT_SECRET is not set, using random key")
-		common.APIJWTSecret = common.RandomJWTKey()
+	if args.Command == common.CommandStart {
+		logging.InitLogger(os.Stderr, memlogger.GetMemLogger())
+		logging.Info().Msgf("GoDoxy version %s", pkg.GetVersion())
+		logging.Trace().Msg("trace enabled")
+		parallel(
+			homepage.InitIconListCache,
+			homepage.InitIconCache,
+			homepage.InitOverridesConfig,
+			systeminfo.Poller.Start,
+		)
+
+		if common.APIJWTSecret == nil {
+			logging.Warn().Msg("API_JWT_SECRET is not set, using random key")
+			common.APIJWTSecret = common.RandomJWTKey()
+		}
+	} else {
+		logging.DiscardLogger()
+	}
+
+	if args.Command == common.CommandValidate {
+		data, err := os.ReadFile(common.ConfigPath)
+		if err == nil {
+			err = config.Validate(data)
+		}
+		if err != nil {
+			log.Fatal("config error: ", err)
+		}
+		log.Print("config OK")
+		return
 	}
 
 	for _, dir := range common.RequiredDirectories {
 		prepareDirectory(dir)
 	}
 
-	err := config.Load()
-	if err != nil {
+	middleware.LoadComposeFiles()
+
+	var cfg *config.Config
+	var err gperr.Error
+	if cfg, err = config.Load(); err != nil {
 		gperr.LogWarn("errors in config", err)
+		err = nil
 	}
 
-	config.StartProxyServers()
-
-	if err := auth.Initialize(); err != nil {
-		log.Fatal().Err(err).Msg("failed to initialize authentication")
+	switch args.Command {
+	case common.CommandListRoutes:
+		cfg.StartProxyProviders()
+		printJSON(routequery.RoutesByAlias())
+		return
+	case common.CommandListConfigs:
+		printJSON(cfg.Value())
+		return
+	case common.CommandDebugListEntries:
+		printJSON(cfg.DumpRoutes())
+		return
+	case common.CommandDebugListProviders:
+		printJSON(cfg.DumpRouteProviders())
+		return
 	}
-	rules.InitAuthHandler(auth.AuthOrProceed)
 
-	// API Handler needs to start after auth is initialized.
-	server.StartServer(task.RootTask("api_server", false), server.Options{
-		Name:     "api",
-		HTTPAddr: common.APIHTTPAddr,
-		Handler:  api.NewHandler(),
+	cfg.Start(&config.StartServersOptions{
+		Proxy: true,
+	})
+	if err := auth.Initialize(); err != nil {
+		logging.Fatal().Err(err).Msg("failed to initialize authentication")
+	}
+	// API Handler needs to start after auth is initialized.
+	cfg.StartServers(&config.StartServersOptions{
+		API: true,
 	})
-
-	listenDebugServer()
 
 	uptime.Poller.Start()
 	config.WatchChanges()
 
-	task.WaitExit(config.Value().TimeoutShutdown)
+	debugapi.StartServer(cfg)
+
+	task.WaitExit(cfg.Value().TimeoutShutdown)
 }
 
 func prepareDirectory(dir string) {
 	if _, err := os.Stat(dir); os.IsNotExist(err) {
 		if err = os.MkdirAll(dir, 0o755); err != nil {
-			log.Fatal().Msgf("failed to create directory %s: %v", dir, err)
+			logging.Fatal().Msgf("failed to create directory %s: %v", dir, err)
 		}
 	}
 }
+
+func printJSON(obj any) {
+	j, err := json.MarshalIndent(obj, "", "  ")
+	if err != nil {
+		logging.Fatal().Err(err).Send()
+	}
+	rawLogger.Print(string(j)) // raw output for convenience using "jq"
+}

cmd/pprof_prof.go

@@ -3,46 +3,18 @@
 package main
 
 import (
+	"log"
 	"net/http"
 	_ "net/http/pprof"
 	"runtime"
 	"runtime/debug"
-	"time"
-
-	"github.com/rs/zerolog/log"
-	strutils "github.com/yusing/goutils/strings"
 )
 
 func initProfiling() {
+	runtime.GOMAXPROCS(2)
+	debug.SetMemoryLimit(100 * 1024 * 1024)
+	debug.SetMaxStack(15 * 1024 * 1024)
 	go func() {
-		log.Info().Msgf("pprof server started at http://localhost:7777/debug/pprof/")
-		log.Error().Err(http.ListenAndServe(":7777", nil)).Msg("pprof server failed")
-	}()
-	go func() {
-		ticker := time.NewTicker(time.Second * 10)
-		defer ticker.Stop()
-
-		var m runtime.MemStats
-		var gcStats debug.GCStats
-
-		for range ticker.C {
-			runtime.ReadMemStats(&m)
-			debug.ReadGCStats(&gcStats)
-
-			log.Info().Msgf("-----------------------------------------------------")
-			log.Info().Msgf("Timestamp: %s", time.Now().Format(time.RFC3339))
-			log.Info().Msgf("  Go Heap - In Use (Alloc/HeapAlloc): %s", strutils.FormatByteSize(m.Alloc))
-			log.Info().Msgf("  Go Heap - Reserved from OS (HeapSys): %s", strutils.FormatByteSize(m.HeapSys))
-			log.Info().Msgf("  Go Stacks - In Use (StackInuse): %s", strutils.FormatByteSize(m.StackInuse))
-			log.Info().Msgf("  Go Runtime - Other Sys (MSpanInuse, MCacheInuse, BuckHashSys, GCSys, OtherSys): %s", strutils.FormatByteSize(m.MSpanInuse+m.MCacheInuse+m.BuckHashSys+m.GCSys+m.OtherSys))
-			log.Info().Msgf("  Go Runtime - Total from OS (Sys): %s", strutils.FormatByteSize(m.Sys))
-			log.Info().Msgf("  Go Runtime - Freed from OS (HeapReleased): %s", strutils.FormatByteSize(m.HeapReleased))
-			log.Info().Msgf("  Number of Goroutines: %d", runtime.NumGoroutine())
-			log.Info().Msgf("  Number of completed GC cycles: %d", m.NumGC)
-			log.Info().Msgf("  Number of GCs: %d", gcStats.NumGC)
-			log.Info().Msgf("  Total GC time: %s", gcStats.PauseTotal)
-			log.Info().Msgf("  Last GC time: %s", gcStats.LastGC.Format(time.DateTime))
-			log.Info().Msg("-----------------------------------------------------")
-		}
+		log.Println(http.ListenAndServe(":7777", nil))
 	}()
 }

compose.example.yml

@@ -1,50 +1,21 @@
 ---
 services:
-  socket-proxy:
-    container_name: socket-proxy
-    image: ghcr.io/yusing/socket-proxy:latest
-    environment:
-      - ALLOW_START=1
-      - ALLOW_STOP=1
-      - ALLOW_RESTARTS=1
-      - CONTAINERS=1
-      - EVENTS=1
-      - INFO=1
-      - PING=1
-      - POST=1
-      - VERSION=1
-    volumes:
-      - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
-    restart: unless-stopped
-    tmpfs:
-      - /run
-    ports:
-      - ${SOCKET_PROXY_LISTEN_ADDR:-127.0.0.1:2375}:2375
   frontend:
-    image: ghcr.io/yusing/godoxy-frontend:${TAG:-latest}
-    # lite variant
-    # image: ghcr.io/yusing/godoxy-frontend:${TAG:-latest}-lite
+    image: ghcr.io/yusing/godoxy-frontend:latest
     container_name: godoxy-frontend
     restart: unless-stopped
+    network_mode: host # do not change this
     env_file: .env
-    # comment out `user` for lite variant
-    user: ${GODOXY_UID:-1000}:${GODOXY_GID:-1000}
-    read_only: true
-    tmpfs:
-      - /app/.next/cache # next image caching
-
-      # for lite variant, do not change uid/gid
-      # - /var/cache/nginx:uid=101,gid=101
-      # - /run:uid=101,gid=101
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - all
     depends_on:
       - app
+    environment:
+      PORT: ${GODOXY_FRONTEND_PORT:-3000}
+
+    # modify below to fit your needs
     labels:
-      proxy.aliases: ${GODOXY_FRONTEND_ALIASES:-godoxy}
-      # proxy.#1.middlewares.cidr_whitelist: |
+      proxy.aliases: godoxy
+      proxy.godoxy.port: ${GODOXY_FRONTEND_PORT:-3000}
+      # proxy.godoxy.middlewares.cidr_whitelist: |
       #   status: 403
       #   message: IP not allowed
       #   allow:
@@ -53,32 +24,22 @@ services:
       #     - 192.168.0.0/16
       #     - 172.16.0.0/12
   app:
-    image: ghcr.io/yusing/godoxy:${TAG:-latest}
-    container_name: godoxy-proxy
+    image: ghcr.io/yusing/godoxy:latest
+    container_name: godoxy
     restart: always
     network_mode: host # do not change this
     env_file: .env
-    user: ${GODOXY_UID:-1000}:${GODOXY_GID:-1000}
-    depends_on:
-      socket-proxy:
-        condition: service_started
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - all
-    cap_add:
-      - NET_BIND_SERVICE
-    environment:
-      - DOCKER_HOST=tcp://${SOCKET_PROXY_LISTEN_ADDR:-127.0.0.1:2375}
     volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
       - ./config:/app/config
       - ./logs:/app/logs
-      - ./error_pages:/app/error_pages:ro
+      - ./error_pages:/app/error_pages
       - ./data:/app/data
 
-      # This path stores certs obtained from autocert and agent TLS client certs
+      # To use autocert, certs will be stored in "./certs".
+      # You can also use a docker volume to store it
       - ./certs:/app/certs
 
-      # mount existing certificate
+      # remove "./certs:/app/certs" and uncomment below to use existing certificate
       # - /path/to/certs/cert.crt:/app/certs/cert.crt
       # - /path/to/certs/priv.key:/app/certs/priv.key

config.example.yml

@@ -4,8 +4,6 @@
 
 # autocert:
 #   provider: local
-#   cert_path: /path/to/cert.crt # default: /app/certs/cert.crt
-#   key_path: /path/to/priv.key # default: /app/certs/priv.key
 
 # 2. cloudflare
 # autocert:
@@ -17,82 +15,28 @@
 #   options:
 #     auth_token: c1234565789-abcdefghijklmnopqrst # your zone API token
 
-# 3. other providers, see https://docs.godoxy.dev/DNS-01-Providers
-
-# Access Control
-# When enabled, it will be applied globally at connection level,
-# all incoming connections (web, tcp and udp) will be checked against the ACL rules.
-
-# acl:
-#   default: allow # or deny (default: allow)
-#   allow_local: true # or false (default: true)
-#   allow:
-#     - ip:1.2.3.4
-#     - cidr:1.2.3.4/32
-#     - country:US
-#     - timezone:Asia/Shanghai
-#   deny:
-#     - ip:1.2.3.4
-#     - cidr:1.2.3.4/32
-#     - country:US
-#     - timezone:Asia/Shanghai
-#   log: # warning: logging ACL can be slow based on the number of incoming connections and configured rules
-#     path: /app/logs/acl.log # (default: none)
-#     stdout: false # (default: false)
-#     keep: 30 days # (default: 30 days)
-#     log_allowed: false # (default: false)
-#   notify:
-#     interval: 1m # (default: 1m)
-#     to: [gotify, discord] # names under providers.notification
-#     include_allowed: false # (default: false)
+# 3. other providers, see https://github.com/yusing/godoxy/wiki/Supported-DNS%E2%80%9001-Providers#supported-dns-01-providers
 
 entrypoint:
-  # Proxy Protocol: https://www.haproxy.com/blog/use-the-proxy-protocol-to-preserve-a-clients-ip-address
-  # When set to true, web entrypoint and all tcp routes will be wrapped with Proxy Protocol listener in order to preserve the client's IP address.
-  # Note that HTTP/3 with proxy protocol is not supported yet.
-  support_proxy_protocol: false
-
   # Below define an example of middleware config
-  # 1. set security headers
-  # 2. block non local IP connections
-  # 3. redirect HTTP to HTTPS
+  # 1. block non local IP connections
+  # 2. redirect HTTP to HTTPS
   #
-  middlewares:
-    - use: CloudflareRealIP
-    - use: ModifyResponse
-      set_headers:
-        Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
-        Access-Control-Allow-Headers: "*"
-        Access-Control-Allow-Origin: "*"
-        Access-Control-Max-Age: 180
-        Vary: "*"
-        X-XSS-Protection: 1; mode=block
-        Content-Security-Policy: "object-src 'self'; frame-ancestors 'self';"
-        X-Content-Type-Options: nosniff
-        X-Frame-Options: SAMEORIGIN
-        Referrer-Policy: same-origin
-        Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
-    # - use: RedirectHTTP
+  # middlewares:
+  #   - use: CIDRWhitelist
+  #     allow:
+  #       - "127.0.0.1"
+  #       - "10.0.0.0/8"
+  #       - "172.16.0.0/12"
+  #       - "192.168.0.0/16"
+  #     status: 403
+  #     message: "Forbidden"
+  #   - use: RedirectHTTP
 
   # below enables access log
   access_log:
     format: combined
     path: /app/logs/entrypoint.log
-    stdout: false # (default: false)
-    keep: 30 days # (default: 30 days)
-
-  # customize behavior for non-existent routes, e.g. pass over to another proxy
-  #
-  # rules:
-  #   not_found:
-  #     - name: default
-  #       do: proxy http://other-proxy:8080
-
-defaults:
-  healthcheck:
-    interval: 5s
-    timeout: 15s
-    retries: 3
 
 providers:
   # include files are standalone yaml files under `config/` directory
@@ -117,13 +61,9 @@ providers:
     # remote-1: tcp://10.0.2.1:2375
     # remote-2: ssh://root:1234@10.0.2.2
 
-  # notification providers
+  # notification providers (notify when service health changes)
   #
   # notification:
-  #   - name: ntfy
-  #     provider: ntfy
-  #     url: https://ntfy.domain.tld
-  #     topic: godoxy
   #   - name: gotify
   #     provider: gotify
   #     url: https://gotify.domain.tld
@@ -132,22 +72,9 @@ providers:
   #     provider: webhook
   #     url: https://discord.com/api/webhooks/...
   #     template: discord # this means use payload template from internal/notif/templates/discord.json
-  #   - name: pushover
-  #     provider: webhook
-  #     url: https://api.pushover.net/1/messages.json
-  #     mime_type: application/x-www-form-urlencoded
-  #     payload: '{"token": "your-app-token", "user": "your-user-key", "title": $title, "message": $message}'
 
-  # Proxmox providers (for idlesleep support for proxmox LXCs)
-  #
-  # proxmox:
-  #   - url: https://pve.domain.com:8006/api2/json
-  #     token_id: root@pam!abcdef
-  #     secret: aaaa-bbbb-cccc-dddd
-  #     no_tls_verify: true
-
-# Match domains
-# See https://docs.godoxy.dev/Certificates-and-domain-matching
+# Check https://github.com/yusing/godoxy/wiki/Certificates-and-domain-matching#domain-matching
+# for explaination of `match_domains`
 #
 # match_domains:
 #   - my.site

dev.Dockerfile

@@ -1,7 +0,0 @@
-FROM debian:bookworm-slim
-
-RUN apt-get update && apt-get install -y ca-certificates
-
-WORKDIR /app
-
-CMD ["/app/run"]

dev.compose.yml

@@ -1,257 +0,0 @@
-x-benchmark: &benchmark
-  restart: no
-  labels:
-    proxy.exclude: true
-    proxy.#1.healthcheck.disable: true
-services:
-  app:
-    image: godoxy-dev
-    build:
-      context: .
-      dockerfile: dev.Dockerfile
-    container_name: godoxy-proxy-dev
-    restart: unless-stopped
-    env_file: dev.env
-    environment:
-      DOCKER_HOST: unix:///var/run/docker.sock
-      TZ: Asia/Hong_Kong
-      API_ADDR: 127.0.0.1:8999
-      API_USER: dev
-      API_PASSWORD: 1234
-      API_SKIP_ORIGIN_CHECK: true
-      API_JWT_TTL: 24h
-      DEBUG: true
-      API_JWT_SECRET: 1234567891234567
-    labels:
-      proxy.exclude: true
-      proxy.#1.healthcheck.disable: true
-    ipc: host
-    network_mode: host
-    volumes:
-      - ./bin/godoxy:/app/run:ro
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./dev-data/config:/app/config
-      - ./dev-data/certs:/app/certs
-      - ./dev-data/error_pages:/app/error_pages:ro
-      - ./dev-data/data:/app/data
-      - ./dev-data/logs:/app/logs
-      - ~/certs/myCA.pem:/etc/ssl/certs/ca.crt:ro
-  parca:
-    image: ghcr.io/parca-dev/parca:v0.24.2
-    container_name: godoxy-parca
-    restart: unless-stopped
-    command: [/parca, --config-path, /parca.yaml]
-    network_mode: host
-    # ports:
-    #   - 7070:7070
-    configs:
-      - source: parca
-        target: /parca.yaml
-    labels:
-      proxy.#1.port: "7070"
-  tinyauth:
-    image: ghcr.io/steveiliop56/tinyauth:v3
-    container_name: tinyauth
-    restart: unless-stopped
-    environment:
-      - SECRET=12345678912345671234567891234567
-      - APP_URL=https://tinyauth.my.app
-      - USERS=user:$$2a$$10$$UdLYoJ5lgPsC0RKqYH/jMua7zIn0g9kPqWmhYayJYLaZQ/FTmH2/u # user:password
-    labels:
-      proxy.tinyauth.port: "3000"
-  jotty: # issue #182
-    image: ghcr.io/fccview/jotty:latest
-    container_name: jotty
-    user: "1000:1000"
-    tmpfs:
-      - /app/data:rw,uid=1000,gid=1000
-      - /app/config:rw,uid=1000,gid=1000
-      - /app/.next/cache:rw,uid=1000,gid=1000
-    restart: unless-stopped
-    environment:
-      - NODE_ENV=production
-    labels:
-      proxy.aliases: "jotty.my.app"
-  postgres-test:
-    image: postgres:18-alpine
-    container_name: postgres-test
-    restart: unless-stopped
-    environment:
-      - POSTGRES_USER=postgres
-      - POSTGRES_PASSWORD=postgres
-      - POSTGRES_DB=postgres
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 30s
-  h2c_test_server:
-    build:
-      context: cmd/h2c_test_server
-      dockerfile: Dockerfile
-    container_name: h2c_test
-    restart: unless-stopped
-    labels:
-      proxy.#1.scheme: h2c
-      proxy.#1.port: 80
-  bench: # returns 4096 bytes of random data
-    <<: *benchmark
-    build:
-      context: cmd/bench_server
-      dockerfile: Dockerfile
-    container_name: bench
-  godoxy:
-    <<: *benchmark
-    build: .
-    container_name: godoxy-benchmark
-    ports:
-      - 8080:80
-    configs:
-      - source: godoxy_config
-        target: /app/config/config.yml
-      - source: godoxy_provider
-        target: /app/config/providers.yml
-  traefik:
-    <<: *benchmark
-    image: traefik:latest
-    container_name: traefik
-    command:
-      - --api.insecure=true
-      - --entrypoints.web.address=:8081
-      - --providers.file.directory=/etc/traefik/dynamic
-      - --providers.file.watch=true
-      - --log.level=ERROR
-    ports:
-      - 8081:8081
-    configs:
-      - source: traefik_config
-        target: /etc/traefik/dynamic/routes.yml
-  caddy:
-    <<: *benchmark
-    image: caddy:latest
-    container_name: caddy
-    ports:
-      - 8082:80
-    configs:
-      - source: caddy_config
-        target: /etc/caddy/Caddyfile
-    tmpfs:
-      - /data
-      - /config
-  nginx:
-    <<: *benchmark
-    image: nginx:latest
-    container_name: nginx
-    command: nginx -g 'daemon off;' -c /etc/nginx/nginx.conf
-    ports:
-      - 8083:80
-    configs:
-      - source: nginx_config
-        target: /etc/nginx/nginx.conf
-
-configs:
-  godoxy_config:
-    content: |
-      providers:
-        include:
-          - providers.yml
-  godoxy_provider:
-    content: |
-      bench.domain.com:
-        host: bench
-  traefik_config:
-    content: |
-      http:
-        routers:
-          bench:
-            rule: "Host(`bench.domain.com`)"
-            entryPoints:
-              - web
-            service: bench
-        services:
-          bench:
-            loadBalancer:
-              servers:
-                - url: "http://bench:80"
-  caddy_config:
-    content: |
-      {
-        admin off
-        auto_https off
-        default_bind 0.0.0.0
-
-        servers {
-          protocols h1 h2c
-        }
-      }
-
-      http://bench.domain.com {
-        reverse_proxy bench:80
-      }
-  nginx_config:
-    content: |
-      worker_processes auto;
-      worker_rlimit_nofile 65535;
-      error_log /dev/null;
-      pid /var/run/nginx.pid;
-
-      events {
-        worker_connections 10240;
-        multi_accept on;
-        use epoll;
-      }
-
-      http {
-        include /etc/nginx/mime.types;
-        default_type application/octet-stream;
-        
-        access_log off;
-        
-        sendfile on;
-        tcp_nopush on;
-        tcp_nodelay on;
-        keepalive_timeout 65;
-        keepalive_requests 10000;
-        
-        upstream backend {
-          server bench:80;
-          keepalive 128;
-        }
-
-        server {
-          listen 80 default_server;
-          server_name _;
-          http2 on;
-
-          return 404;
-        }
-
-        server {
-          listen 80;
-          server_name bench.domain.com;
-          http2 on;
-          
-          location / {
-            proxy_pass http://backend;
-            proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            proxy_set_header Host $$host;
-            proxy_set_header X-Real-IP $$remote_addr;
-            proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
-            proxy_buffering off;
-          }
-        }
-      }
-  parca:
-    content: |
-      object_storage:
-        bucket:
-          type: "FILESYSTEM"
-          config:
-            directory: "./data"
-      scrape_configs:
-        - job_name: "parca"
-          scrape_interval: "1s"
-          static_configs:
-            - targets: [ 'localhost:7777' ]

go.mod

@@ -1,190 +1,149 @@
-module github.com/yusing/godoxy
+module github.com/yusing/go-proxy
 
-go 1.25.5
+go 1.24.2
 
-replace (
-	github.com/coreos/go-oidc/v3 => ./internal/go-oidc
-	github.com/shirou/gopsutil/v4 => ./internal/gopsutil
-	github.com/yusing/godoxy/agent => ./agent
-	github.com/yusing/godoxy/internal/dnsproviders => ./internal/dnsproviders
-	github.com/yusing/goutils => ./goutils
-	github.com/yusing/goutils/http/reverseproxy => ./goutils/http/reverseproxy
-	github.com/yusing/goutils/http/websocket => ./goutils/http/websocket
-	github.com/yusing/goutils/server => ./goutils/server
-)
+// misc
 
 require (
-	github.com/PuerkitoBio/goquery v1.11.0 // parsing HTML for extract fav icon; modify_html middleware
-	github.com/coreos/go-oidc/v3 v3.17.0 // oidc authentication
+	github.com/bytedance/sonic v1.13.2 // faster json unmarshal (for marshal it's using custom implementation)
 	github.com/fsnotify/fsnotify v1.9.0 // file watcher
-	github.com/gin-gonic/gin v1.11.0 // api server
-	github.com/go-acme/lego/v4 v4.30.1 // acme client
-	github.com/go-playground/validator/v10 v10.30.1 // validator
+	github.com/go-acme/lego/v4 v4.22.2 // acme client
+	github.com/go-playground/validator/v10 v10.26.0 // validator
 	github.com/gobwas/glob v0.2.3 // glob matcher for route rules
-	github.com/gorilla/websocket v1.5.3 // websocket for API and agent
-	github.com/gotify/server/v2 v2.8.0 // reference the Message struct for json response
+	github.com/goccy/go-yaml v1.17.1 // yaml parsing for different config files
+	github.com/gotify/server/v2 v2.6.1 // reference the Message struct for json response
 	github.com/lithammer/fuzzysearch v1.1.8 // fuzzy search for searching icons and filtering metrics
-	github.com/pires/go-proxyproto v0.8.1 // proxy protocol support
-	github.com/puzpuzpuz/xsync/v4 v4.2.0 // lock free map for concurrent operations
-	github.com/rs/zerolog v1.34.0 // logging
+	github.com/puzpuzpuz/xsync/v3 v3.5.1 // lock free map for concurrent operations
+	golang.org/x/text v0.24.0 // string utilities
+	golang.org/x/time v0.11.0 // time utilities
+)
+
+// http
+
+require (
+	github.com/coder/websocket v1.8.13 // websocket for API and agent
+	github.com/quic-go/quic-go v0.50.1 // http3 server
+	golang.org/x/net v0.39.0 // HTTP header utilities
+)
+
+// authentication
+
+require (
+	github.com/coreos/go-oidc/v3 v3.14.1 // oidc authentication
+	github.com/golang-jwt/jwt/v5 v5.2.2 // jwt for default auth
+	golang.org/x/crypto v0.37.0 // encrypting password with bcrypt
+	golang.org/x/oauth2 v0.29.0 // oauth2 authentication
+)
+
+// favicon extraction
+require (
+	github.com/PuerkitoBio/goquery v1.10.3 // parsing HTML for extract fav icon
 	github.com/vincent-petithory/dataurl v1.0.0 // data url for fav icon
-	golang.org/x/crypto v0.46.0 // encrypting password with bcrypt
-	golang.org/x/net v0.48.0 // HTTP header utilities
-	golang.org/x/oauth2 v0.34.0 // oauth2 authentication
-	golang.org/x/sync v0.19.0 // errgroup and singleflight for concurrent operations
-	golang.org/x/time v0.14.0 // time utilities
 )
 
-require (
-	github.com/bytedance/gopkg v0.1.3 // xxhash64 for fast hash
-	github.com/bytedance/sonic v1.14.2 // fast json parsing
-	github.com/docker/cli v29.1.3+incompatible // needs docker/cli/cli/connhelper connection helper for docker client
-	github.com/goccy/go-yaml v1.19.1 // yaml parsing for different config files
-	github.com/golang-jwt/jwt/v5 v5.3.0 // jwt authentication
-	github.com/luthermonson/go-proxmox v0.3.1 // proxmox API client
-	github.com/moby/moby/api v1.52.0 // docker API
-	github.com/moby/moby/client v0.2.1 // docker client
-	github.com/oschwald/maxminddb-golang v1.13.1 // maxminddb for geoip database
-	github.com/quic-go/quic-go v0.58.0 // http3 support
-	github.com/shirou/gopsutil/v4 v4.25.12 // system information
-	github.com/spf13/afero v1.15.0 // afero for file system operations
-	github.com/stretchr/testify v1.11.1 // testing framework
-	github.com/valyala/fasthttp v1.68.0 // fast http for health check
-	github.com/yusing/ds v0.3.1 // data structures and algorithms
-	github.com/yusing/godoxy/agent v0.0.0-20260104140148-1c2515cb298d
-	github.com/yusing/godoxy/internal/dnsproviders v0.0.0-20260104140148-1c2515cb298d
-	github.com/yusing/gointernals v0.1.16
-	github.com/yusing/goutils v0.7.0
-	github.com/yusing/goutils/http/reverseproxy v0.0.0-20260103043911-785deb23bd64
-	github.com/yusing/goutils/http/websocket v0.0.0-20260103043911-785deb23bd64
-	github.com/yusing/goutils/server v0.0.0-20260103043911-785deb23bd64
-)
+// docker
+
+require (
+	github.com/docker/cli v28.0.4+incompatible // docker cli
+	github.com/docker/docker v28.0.4+incompatible // docker daemon
+	github.com/docker/go-connections v0.5.0 // docker connection utilities
+)
+
+// logging
+
+require (
+	github.com/rs/zerolog v1.34.0 // logging
+	github.com/samber/slog-zerolog/v2 v2.7.3 // zerlog to slog adapter for quic-go
+)
+
+// metrics
+
+require (
+	github.com/prometheus/client_golang v1.22.0 // metrics
+	github.com/shirou/gopsutil/v4 v4.25.3 // system info metrics
+	github.com/stretchr/testify v1.10.0 // testing utilities
+)
+
+require github.com/luthermonson/go-proxmox v0.2.2
 
 require (
-	cloud.google.com/go/auth v0.18.0 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns v1.2.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/privatedns/armprivatedns v1.3.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph v0.9.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/andybalholm/cascadia v1.3.3 // indirect
-	github.com/benbjohnson/clock v1.3.5 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/buger/goterm v1.0.4 // indirect
+	github.com/bytedance/sonic/loader v0.2.4 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cloudflare/cloudflare-go v0.115.0 // indirect
+	github.com/cloudwego/base64x v0.1.5 // indirect
+	github.com/containerd/log v0.1.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/diskfs/go-diskfs v1.7.0 // indirect
+	github.com/diskfs/go-diskfs v1.6.0 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/djherbis/times v1.6.0 // indirect
-	github.com/docker/go-connections v0.6.0
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/ebitengine/purego v0.9.1 // indirect
+	github.com/ebitengine/purego v0.8.2 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/gofrs/flock v0.13.0 // indirect
-	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
-	github.com/googleapis/gax-go/v2 v2.16.0 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
+	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/jinzhu/copier v0.4.0 // indirect
-	github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 // indirect
-	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
 	github.com/magefile/mage v1.15.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/miekg/dns v1.1.69 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/miekg/dns v1.1.65 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/nrdcg/goacmedns v0.2.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nrdcg/porkbun v0.4.0 // indirect
+	github.com/onsi/ginkgo/v2 v2.23.4 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/ovh/go-ovh v1.9.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
-	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/ovh/go-ovh v1.7.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/samber/lo v1.52.0 // indirect
-	github.com/samber/slog-common v0.19.0 // indirect
-	github.com/samber/slog-zerolog/v2 v2.9.0 // indirect
-	github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 // indirect
-	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
-	github.com/sony/gobreaker v1.0.0 // indirect
-	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0
-	go.opentelemetry.io/otel v1.39.0 // indirect
-	go.opentelemetry.io/otel/metric v1.39.0 // indirect
-	go.opentelemetry.io/otel/trace v1.39.0 // indirect
-	go.uber.org/atomic v1.11.0
-	go.uber.org/ratelimit v0.3.1 // indirect
-	golang.org/x/mod v0.31.0 // indirect
-	golang.org/x/sys v0.39.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/tools v0.40.0 // indirect
-	google.golang.org/api v0.258.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
-	google.golang.org/grpc v1.78.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
-	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-)
-
-require (
-	github.com/akamai/AkamaiOPEN-edgegrid-golang/v11 v11.1.0 // indirect
-	github.com/andybalholm/brotli v1.2.0 // indirect
-	github.com/boombuler/barcode v1.1.0 // indirect
-	github.com/bytedance/sonic/loader v0.4.0 // indirect
-	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cloudwego/base64x v0.1.6 // indirect
-	github.com/containerd/errdefs v1.0.0 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
-	github.com/fatih/color v1.18.0 // indirect
-	github.com/fatih/structs v1.1.0 // indirect
-	github.com/gin-contrib/sse v1.1.0 // indirect
-	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
-	github.com/go-resty/resty/v2 v2.17.1 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
-	github.com/goccy/go-json v0.10.5 // indirect
-	github.com/google/go-querystring v1.2.0 // indirect
-	github.com/klauspost/compress v1.18.2 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b // indirect
-	github.com/linode/linodego v1.63.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
-	github.com/nrdcg/goinwx v0.12.0 // indirect
-	github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2 // indirect
-	github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2 // indirect
-	github.com/pierrec/lz4/v4 v4.1.21 // indirect
-	github.com/pion/dtls/v3 v3.0.10 // indirect
-	github.com/pion/logging v0.2.4 // indirect
-	github.com/pion/transport/v4 v4.0.1 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/pquerna/otp v1.5.0 // indirect
-	github.com/stretchr/objx v0.5.3 // indirect
-	github.com/tklauser/go-sysconf v0.3.16 // indirect
-	github.com/tklauser/numcpus v0.11.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.63.0 // indirect
+	github.com/prometheus/procfs v0.16.0 // indirect
+	github.com/quic-go/qpack v0.5.1 // indirect
+	github.com/samber/lo v1.49.1 // indirect
+	github.com/samber/slog-common v0.18.1 // indirect
+	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
+	github.com/tklauser/go-sysconf v0.3.15 // indirect
+	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.3.1 // indirect
-	github.com/ulikunitz/xz v0.5.15 // indirect
-	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/vultr/govultr/v3 v3.26.1 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	golang.org/x/arch v0.23.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
+	go.uber.org/automaxprocs v1.6.0 // indirect
+	go.uber.org/mock v0.5.1 // indirect
+	golang.org/x/arch v0.16.0 // indirect
+	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/sync v0.13.0 // indirect
+	golang.org/x/sys v0.32.0 // indirect
+	golang.org/x/tools v0.32.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gotest.tools/v3 v3.5.1 // indirect
 )

go.sum

@@ -1,188 +1,131 @@
-cloud.google.com/go/auth v0.18.0 h1:wnqy5hrv7p3k7cShwAU/Br3nzod7fxoqG+k0VZ+/Pk0=
-cloud.google.com/go/auth v0.18.0/go.mod h1:wwkPM1AgE1f2u6dG443MiWoD8C3BtOywNsUMcUTVDRo=
-cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
-cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
-cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
-cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns v1.2.0 h1:lpOxwrQ919lCZoNCd69rVt8u1eLZuMORrGXqy8sNf3c=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns v1.2.0/go.mod h1:fSvRkb8d26z9dbL40Uf/OO6Vo9iExtZK3D0ulRV+8M0=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0 h1:2qsIIvxVT+uE6yrNldntJKlLRgxGbZ85kgtz5SNBhMw=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0/go.mod h1:AW8VEadnhw9xox+VaVd9sP7NjzOAnaZBLRH6Tq3cJ38=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/privatedns/armprivatedns v1.3.0 h1:yzrctSl9GMIQ5lHu7jc8olOsGjWDCsBpJhWqfGa/YIM=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/privatedns/armprivatedns v1.3.0/go.mod h1:GE4m0rnnfwLGX0Y9A9A25Zx5N/90jneT5ABevqzhuFQ=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph v0.9.0 h1:zLzoX5+W2l95UJoVwiyNS4dX8vHyQ6x2xRLoBBL9wMk=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph v0.9.0/go.mod h1:wVEOJfGTj0oPAUGA1JuRAvz/lxXQsWW16axmHPP47Bk=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 h1:Dd+RhdJn0OTtVGaeDLZpcumkIVCtA/3/Fo42+eoYvVM=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
-github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
-github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/PuerkitoBio/goquery v1.11.0 h1:jZ7pwMQXIITcUXNH83LLk+txlaEy6NVOfTuP43xxfqw=
-github.com/PuerkitoBio/goquery v1.11.0/go.mod h1:wQHgxUOU3JGuj3oD/QFfxUdlzW6xPHfqyHre6VMY4DQ=
-github.com/akamai/AkamaiOPEN-edgegrid-golang/v11 v11.1.0 h1:h/33OxYLqBk0BYmEbSUy7MlvgQR/m1w1/7OJFKoPL1I=
-github.com/akamai/AkamaiOPEN-edgegrid-golang/v11 v11.1.0/go.mod h1:rvh3imDA6EaQi+oM/GQHkQAOHbXPKJ7EWJvfjuw141Q=
-github.com/anchore/go-lzo v0.1.0 h1:NgAacnzqPeGH49Ky19QKLBZEuFRqtTG9cdaucc3Vncs=
-github.com/anchore/go-lzo v0.1.0/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
-github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
-github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
+github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
 github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
 github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
-github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
-github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVkHo=
-github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY=
 github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE=
-github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
-github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
-github.com/bytedance/sonic v1.14.2 h1:k1twIoe97C1DtYUo+fZQy865IuHia4PR5RPiuGPPIIE=
-github.com/bytedance/sonic v1.14.2/go.mod h1:T80iDELeHiHKSc0C9tubFygiuXoGzrkjKzX2quAx980=
-github.com/bytedance/sonic/loader v0.4.0 h1:olZ7lEqcxtZygCK9EKYKADnpQoYkRQxaeY2NYzevs+o=
-github.com/bytedance/sonic/loader v0.4.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
-github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
-github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/bytedance/sonic v1.13.2 h1:8/H1FempDZqC4VqjptGo14QQlJx8VdZJegxs6wwfqpQ=
+github.com/bytedance/sonic v1.13.2/go.mod h1:o68xyaF9u2gvVBuGHPlUVCy+ZfmNNO5ETf1+KgkJhz4=
+github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
+github.com/bytedance/sonic/loader v0.2.4 h1:ZWCw4stuXUsn1/+zQDqeE7JKP+QO47tz7QCNan80NzY=
+github.com/bytedance/sonic/loader v0.2.4/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
-github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
-github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
-github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
-github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
-github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/cloudflare/cloudflare-go v0.115.0 h1:84/dxeeXweCc0PN5Cto44iTA8AkG1fyT11yPO5ZB7sM=
+github.com/cloudflare/cloudflare-go v0.115.0/go.mod h1:Ds6urDwn/TF2uIU24mu7H91xkKP8gSAHxQ44DSZgVmU=
+github.com/cloudwego/base64x v0.1.5 h1:XPciSp1xaq2VCSt6lF0phncD4koWyULpl5bUxbfCyP4=
+github.com/cloudwego/base64x v0.1.5/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
+github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
+github.com/coder/websocket v1.8.13 h1:f3QZdXy7uGVz+4uCJy2nTZyM0yTBj8yANEHhqlXZ9FE=
+github.com/coder/websocket v1.8.13/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
+github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/diskfs/go-diskfs v1.7.0 h1:vonWmt5CMowXwUc79jWyGrf2DIMeoOjkLlMnQYGVOs8=
-github.com/diskfs/go-diskfs v1.7.0/go.mod h1:LhQyXqOugWFRahYUSw47NyZJPezFzB9UELwhpszLP/k=
+github.com/diskfs/go-diskfs v1.6.0 h1:YmK5+vLSfkwC6kKKRTRPGaDGNF+Xh8FXeiNHwryDfu4=
+github.com/diskfs/go-diskfs v1.6.0/go.mod h1:bRFumZeGFCO8C2KNswrQeuj2m1WCVr4Ms5IjWMczMDk=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v29.1.3+incompatible h1:+kz9uDWgs+mAaIZojWfFt4d53/jv0ZUOOoSh5ZnH36c=
-github.com/docker/cli v29.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
-github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
+github.com/docker/cli v28.0.4+incompatible h1:pBJSJeNd9QeIWPjRcV91RVJihd/TXB77q1ef64XEu4A=
+github.com/docker/cli v28.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.0.4+incompatible h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok=
+github.com/docker/docker v28.0.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
-github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.8.2 h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
+github.com/ebitengine/purego v0.8.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab h1:h1UgjJdAAhj+uPL68n7XASS6bU+07ZX1WJvVS2eyoeY=
 github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab/go.mod h1:GLo/8fDswSAniFG+BFIaiSPcK610jyzgEhWYPQwuQdw=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
-github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
-github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
-github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
-github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
-github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
-github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
-github.com/go-acme/lego/v4 v4.30.1 h1:tmb6U0lvy8Mc3lQbqKwTat7oAhE8FUYNJ3D0gSg6pJU=
-github.com/go-acme/lego/v4 v4.30.1/go.mod h1:V7m/Ip+EeFkjOe028+zeH+SwWtESxw1LHelwMIfAjm4=
-github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
-github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
+github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/go-acme/lego/v4 v4.22.2 h1:ck+HllWrV/rZGeYohsKQ5iKNnU/WAZxwOdiu6cxky+0=
+github.com/go-acme/lego/v4 v4.22.2/go.mod h1:E2FndyI3Ekv0usNJt46mFb9LVpV/XBYT+4E3tz02Tzo=
+github.com/go-jose/go-jose/v4 v4.1.0 h1:cYSYxd3pw5zd2FSXk2vGdn9igQU2PS8MuxrCOCl0FdY=
+github.com/go-jose/go-jose/v4 v4.1.0/go.mod h1:GG/vqmYm3Von2nYiB2vGTXzdoNKE5tix5tuc6iAd+sw=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
-github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
-github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
-github.com/go-resty/resty/v2 v2.17.1 h1:x3aMpHK1YM9e4va/TMDRlusDDoZiQ+ViDu/WpA6xTM4=
-github.com/go-resty/resty/v2 v2.17.1/go.mod h1:kCKZ3wWmwJaNc7S29BRtUhJwy7iqmn+2mLtQrOyQlVA=
+github.com/go-playground/validator/v10 v10.26.0 h1:SP05Nqhjcvz81uJaRfEV0YBSSSGMc/iMaVtFbr3Sw2k=
+github.com/go-playground/validator/v10 v10.26.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
-github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/goccy/go-yaml v1.19.1 h1:3rG3+v8pkhRqoQ/88NYNMHYVGYztCOCIZ7UQhu7H+NE=
-github.com/goccy/go-yaml v1.19.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-yaml v1.17.1 h1:LI34wktB2xEE3ONG/2Ar54+/HJVBriAGJ55PHls4YuY=
+github.com/goccy/go-yaml v1.17.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
-github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
-github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
-github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
-github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
-github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
+github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
-github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
-github.com/googleapis/gax-go/v2 v2.16.0 h1:iHbQmKLLZrexmb0OSsNGTeSTS0HO4YvFOG8g5E4Zd0Y=
-github.com/googleapis/gax-go/v2 v2.16.0/go.mod h1:o1vfQjjNZn4+dPnRdl/4ZD7S9414Y4xA+a/6Icj6l14=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gotify/server/v2 v2.8.0 h1:E3UDDn/3rFZi1sjZfbuhXNnxJP3ACZhdcw/iySegPRA=
-github.com/gotify/server/v2 v2.8.0/go.mod h1:6ci5adxcE2hf1v+2oowKiQmixOxXV8vU+CRLKP6sqZA=
+github.com/gotify/server/v2 v2.6.1 h1:Kf7v5fzBxzELzZa/jonWfwJMkqYqh1LBzBpCmt5QIAI=
+github.com/gotify/server/v2 v2.6.1/go.mod h1:Dk8HLyTVDqmXM8YEg6tjROBen6mxyHZFRggJFHTwZLc=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1NhHmEPPzzuhWgcza5M1Ji1I=
 github.com/h2non/gock v1.2.0 h1:K6ol8rfrRkUOefooBC8elXoaNGYkpp7y2qcxGG6BzUE=
 github.com/h2non/gock v1.2.0/go.mod h1:tNhoxHYW2W42cYkYb1WqzdbYIieALC99kpYr7rH/BQk=
 github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw=
 github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI=
-github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
-github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
-github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
-github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
-github.com/jarcoal/httpmock v1.4.1 h1:0Ju+VCFuARfFlhVXFc2HxlcQkfB+Xq12/EotHko+x2A=
-github.com/jarcoal/httpmock v1.4.1/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
+github.com/jarcoal/httpmock v1.3.0 h1:2RJ8GP0IIaWwcC9Fp2BmVi8Kog3v2Hn7VXM3fTd+nuc=
+github.com/jarcoal/httpmock v1.3.0/go.mod h1:3yb8rc4BI7TCBhFY8ng0gjuLKJNquuDNiPaZjnENuYg=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
-github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/Kgo2/7xNSUuC5G28VR8ljfrLKU2G4IjU=
-github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0=
-github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
-github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
-github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
-github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b h1:udzkj9S/zlT5X367kqJis0QP7YMxobob6zhzq6Yre00=
-github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b/go.mod h1:pcaDhQK0/NJZEvtCO0qQPPropqV0sJOJ6YW7X+9kRwM=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
+github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -191,14 +134,12 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/linode/linodego v1.63.0 h1:MdjizfXNJDVJU6ggoJmMO5O9h4KGPGivNX0fzrAnstk=
-github.com/linode/linodego v1.63.0/go.mod h1:GoiwLVuLdBQcAebxAVKVL3mMYUgJZR/puOUSla04xBE=
 github.com/lithammer/fuzzysearch v1.1.8 h1:/HIuJnjHuXS8bKaiTMeeDlW2/AyIWk2brx1V8LFgLN4=
 github.com/lithammer/fuzzysearch v1.1.8/go.mod h1:IdqeyBClc3FFqSzYq/MXESsS4S0FsZ5ajtkr5xPLts4=
-github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIiZhtifTV5OUqqiP82UAl0h87xj/l9k=
-github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/luthermonson/go-proxmox v0.3.1 h1:h64s4/zIEQ06TBo0phFKcckV441YpvUPgLfRAptYsjY=
-github.com/luthermonson/go-proxmox v0.3.1/go.mod h1:oyFgg2WwTEIF0rP6ppjiixOHa5ebK1p8OaRiFhvICBQ=
+github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 h1:PpXWgLPs+Fqr325bN2FD2ISlRRztXibcX6e8f5FR5Dc=
+github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/luthermonson/go-proxmox v0.2.2 h1:BZ7VEj302wxw2i/EwTcyEiBzQib8teocB2SSkLHyySY=
+github.com/luthermonson/go-proxmox v0.2.2/go.mod h1:oyFgg2WwTEIF0rP6ppjiixOHa5ebK1p8OaRiFhvICBQ=
 github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
 github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
@@ -208,55 +149,33 @@ github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/maxatome/go-testdeep v1.14.0 h1:rRlLv1+kI8eOI3OaBXZwb3O7xY3exRzdW5QyX48g9wI=
-github.com/maxatome/go-testdeep v1.14.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM=
-github.com/miekg/dns v1.1.69 h1:Kb7Y/1Jo+SG+a2GtfoFUfDkG//csdRPwRLkCsxDG9Sc=
-github.com/miekg/dns v1.1.69/go.mod h1:7OyjD9nEba5OkqQ/hB4fy3PIoxafSZJtducccIelz3g=
-github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/maxatome/go-testdeep v1.12.0 h1:Ql7Go8Tg0C1D/uMMX59LAoYK7LffeJQ6X2T04nTH68g=
+github.com/maxatome/go-testdeep v1.12.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM=
+github.com/miekg/dns v1.1.65 h1:0+tIPHzUW0GCge7IiK3guGP57VAw7hoPDfApjkMD1Fc=
+github.com/miekg/dns v1.1.65/go.mod h1:Dzw9769uoKVaLuODMDZz9M6ynFU6Em65csPuoi8G0ck=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/moby/api v1.52.0 h1:00BtlJY4MXkkt84WhUZPRqt5TvPbgig2FZvTbe3igYg=
-github.com/moby/moby/api v1.52.0/go.mod h1:8mb+ReTlisw4pS6BRzCMts5M49W5M7bKt1cJy/YbAqc=
-github.com/moby/moby/client v0.2.1 h1:1Grh1552mvv6i+sYOdY+xKKVTvzJegcVMhuXocyDz/k=
-github.com/moby/moby/client v0.2.1/go.mod h1:O+/tw5d4a1Ha/ZA/tPxIZJapJRUS6LNZ1wiVRxYHyUE=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/nrdcg/goacmedns v0.2.0 h1:ADMbThobzEMnr6kg2ohs4KGa3LFqmgiBA22/6jUWJR0=
-github.com/nrdcg/goacmedns v0.2.0/go.mod h1:T5o6+xvSLrQpugmwHvrSNkzWht0UGAwj2ACBMhh73Cg=
-github.com/nrdcg/goinwx v0.12.0 h1:ujdUqDBnaRSFwzVnImvPHYw3w3m9XgmGImNUw1GyMb4=
-github.com/nrdcg/goinwx v0.12.0/go.mod h1:IrVKd3ZDbFiMjdPgML4CSxZAY9wOoqLvH44zv3NodJ0=
-github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2 h1:l0tH15ACQADZAzC+LZ+mo2tIX4H6uZu0ulrVmG5Tqz0=
-github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2/go.mod h1:Gcs8GCaZXL3FdiDWgdnMxlOLEdRprJJnPYB22TX1jw8=
-github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2 h1:gzB4c6ztb38C/jYiqEaFC+mCGcWFHDji9e6jwymY9d4=
-github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2/go.mod h1:l1qIPIq2uRV5WTSvkbhbl/ndbeOu7OCb3UZ+0+2ZSb8=
+github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nrdcg/porkbun v0.4.0 h1:rWweKlwo1PToQ3H+tEO9gPRW0wzzgmI/Ob3n2Guticw=
 github.com/nrdcg/porkbun v0.4.0/go.mod h1:/QMskrHEIM0IhC/wY7iTCUgINsxdT2WcOphktJ9+Q54=
+github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
+github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
+github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
+github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5MbwsmL4MRQE=
-github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
-github.com/ovh/go-ovh v1.9.0 h1:6K8VoL3BYjVV3In9tPJUdT7qMx9h0GExN9EXx1r2kKE=
-github.com/ovh/go-ovh v1.9.0/go.mod h1:cTVDnl94z4tl8pP1uZ/8jlVxntjSIf09bNcQ5TJSC7c=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
-github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
-github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pion/dtls/v3 v3.0.10 h1:k9ekkq1kaZoxnNEbyLKI8DI37j/Nbk1HWmMuywpQJgg=
-github.com/pion/dtls/v3 v3.0.10/go.mod h1:YEmmBYIoBsY3jmG56dsziTv/Lca9y4Om83370CXfqJ8=
-github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
-github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
-github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o=
-github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM=
-github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
-github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/ovh/go-ovh v1.7.0 h1:V14nF7FwDjQrZt9g7jzcvAAQ3HN6DNShRFRMC3jLoPw=
+github.com/ovh/go-ovh v1.7.0/go.mod h1:cTVDnl94z4tl8pP1uZ/8jlVxntjSIf09bNcQ5TJSC7c=
+github.com/pierrec/lz4/v4 v4.1.17 h1:kV4Ip+/hUBC+8T6+2EgburRtkE9ef4nbY3f4dFhGjMc=
+github.com/pierrec/lz4/v4 v4.1.17/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/xattr v0.4.9 h1:5883YPCtkSd8LFbs13nXplj9g9tlrwoJRjgpgMu1/fE=
 github.com/pkg/xattr v0.4.9/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
@@ -265,117 +184,112 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
-github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
-github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
-github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
-github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.58.0 h1:ggY2pvZaVdB9EyojxL1p+5mptkuHyX5MOSv4dgWF4Ug=
-github.com/quic-go/quic-go v0.58.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
+github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
+github.com/prometheus/procfs v0.16.0 h1:xh6oHhKwnOJKMYiYBDWmkHqQPyiY40sny36Cmx2bbsM=
+github.com/prometheus/procfs v0.16.0/go.mod h1:8veyXUu3nGP7oaCxhX6yeaM5u4stL2FeMXnCqhDthZg=
+github.com/puzpuzpuz/xsync/v3 v3.5.1 h1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=
+github.com/puzpuzpuz/xsync/v3 v3.5.1/go.mod h1:VjzYrABPabuM4KyBh1Ftq6u8nhwY5tBPKP9jpmh0nnA=
+github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
+github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
+github.com/quic-go/quic-go v0.50.1 h1:unsgjFIUqW8a2oopkY7YNONpV1gYND6Nt9hnt1PN94Q=
+github.com/quic-go/quic-go v0.50.1/go.mod h1:Vim6OmUvlYdwBhXP9ZVrtGmCMWa3wEqhq3NgYrI8b4E=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
 github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
-github.com/samber/lo v1.52.0 h1:Rvi+3BFHES3A8meP33VPAxiBZX/Aws5RxrschYGjomw=
-github.com/samber/lo v1.52.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
-github.com/samber/slog-common v0.19.0 h1:fNcZb8B2uOLooeYwFpAlKjkQTUafdjfqKcwcC89G9YI=
-github.com/samber/slog-common v0.19.0/go.mod h1:dTz+YOU76aH007YUU0DffsXNsGFQRQllPQh9XyNoA3M=
-github.com/samber/slog-zerolog/v2 v2.9.0 h1:6LkOabJmZdNLaUWkTC3IVVA+dq7b/V0FM6lz6/7+THI=
-github.com/samber/slog-zerolog/v2 v2.9.0/go.mod h1:gnQW9VnCfM34v2pRMUIGMsZOVbYLqY/v0Wxu6atSVGc=
-github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 h1:ObX9hZmK+VmijreZO/8x9pQ8/P/ToHD/bdSb4Eg4tUo=
-github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36/go.mod h1:LEsDu4BubxK7/cWhtlQWfuxwL4rf/2UEpxXz1o1EMtM=
+github.com/samber/lo v1.49.1 h1:4BIFyVfuQSEpluc7Fua+j1NolZHiEHEpaSEKdsH0tew=
+github.com/samber/lo v1.49.1/go.mod h1:dO6KHFzUKXgP8LDhU0oI8d2hekjXnGOu0DB8Jecxd6o=
+github.com/samber/slog-common v0.18.1 h1:c0EipD/nVY9HG5shgm/XAs67mgpWDMF+MmtptdJNCkQ=
+github.com/samber/slog-common v0.18.1/go.mod h1:QNZiNGKakvrfbJ2YglQXLCZauzkI9xZBjOhWFKS3IKk=
+github.com/samber/slog-zerolog/v2 v2.7.3 h1:/MkPDl/tJhijN2GvB1MWwBn2FU8RiL3rQ8gpXkQm2EY=
+github.com/samber/slog-zerolog/v2 v2.7.3/go.mod h1:oWU7WHof4Xp8VguiNO02r1a4VzkgoOyOZhY5CuRke60=
+github.com/shirou/gopsutil/v4 v4.25.3 h1:SeA68lsu8gLggyMbmCn8cmp97V1TI9ld9sVzAUcKcKE=
+github.com/shirou/gopsutil/v4 v4.25.3/go.mod h1:xbuxyoZj+UsgnZrENu3lQivsngRR5BdjbJwf2fv4szA=
 github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
 github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/sony/gobreaker v1.0.0 h1:feX5fGGXSl3dYd4aHZItw+FpHLvvoaqkawKjVNiFMNQ=
-github.com/sony/gobreaker v1.0.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
-github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
-github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
-github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
-github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
-github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
-github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
+github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
+github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
+github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
+github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
-github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
-github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
-github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
-github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
-github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.68.0 h1:v12Nx16iepr8r9ySOwqI+5RBJ/DqTxhOy1HrHoDFnok=
-github.com/valyala/fasthttp v1.68.0/go.mod h1:5EXiRfYQAoiO/khu4oU9VISC/eVY6JqmSpPJoHCKsz4=
+github.com/ulikunitz/xz v0.5.11 h1:kpFauv27b6ynzBNT/Xy+1k+fK4WswhN/6PN5WhFAGw8=
+github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/vincent-petithory/dataurl v1.0.0 h1:cXw+kPto8NLuJtlMsI152irrVw9fRDX8AbShPRpg2CI=
 github.com/vincent-petithory/dataurl v1.0.0/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
-github.com/vultr/govultr/v3 v3.26.1 h1:G/M0rMQKwVSmL+gb0UgETbW5mcQi0Vf/o/ZSGdBCxJw=
-github.com/vultr/govultr/v3 v3.26.1/go.mod h1:9WwnWGCKnwDlNjHjtt+j+nP+0QWq6hQXzaHgddqrLWY=
-github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
-github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
-github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
-github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yusing/ds v0.3.1 h1:mCqTgTQD8RhiBpcysvii5kZ7ZBmqcknVsFubNALGLbY=
-github.com/yusing/ds v0.3.1/go.mod h1:XhKV4l7cZwBbbl7lRzNC9zX27zvCM0frIwiuD40ULRk=
-github.com/yusing/gointernals v0.1.16 h1:GrhZZdxzA+jojLEqankctJrOuAYDb7kY1C93S1pVR34=
-github.com/yusing/gointernals v0.1.16/go.mod h1:B/0FVXt4WPmgzVy3ynzkqKi+BSGaJVmwCJBRXYapo34=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 h1:ssfIgGNANqpVFCndZvcuyKbl0g+UAVcbBcqGkG28H0Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0/go.mod h1:GQ/474YrbE4Jx8gZ4q5I4hrhUzM6UPzyrqJYV2AqPoQ=
-go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
-go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
-go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
-go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
-go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
-go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
-go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
-go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
-go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
-go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
-go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
-go.uber.org/ratelimit v0.3.1 h1:K4qVE+byfv/B3tC+4nYWP7v/6SimcO7HzHekoMNBma0=
-go.uber.org/ratelimit v0.3.1/go.mod h1:6euWsTB6U/Nb3X++xEUXA8ciPJvr19Q/0h1+oDcJhRk=
-golang.org/x/arch v0.23.0 h1:lKF64A2jF6Zd8L0knGltUnegD62JMFBiCPBmQpToHhg=
-golang.org/x/arch v0.23.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0 h1:lsInsfvhVIfOI6qHVyysXMNDnjO9Npvl7tlDPJFBVd4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0/go.mod h1:KQsVNh4OjgjTG0G6EiNi1jVpnaeeKsKMRwbLN+f1+8M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 h1:umZgi92IyxfXd/l4kaDhnKgY8rnN/cZcF1LKc6I8OQ8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0/go.mod h1:4lVs6obhSVRb1EW5FhOuBTyiQhtRtAnnva9vD3yRfq8=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
+go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
+go.uber.org/mock v0.5.1 h1:ASgazW/qBmR+A32MYFDB6E2POoTgOwT509VP0CT/fjs=
+go.uber.org/mock v0.5.1/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+golang.org/x/arch v0.16.0 h1:foMtLTdyOmIniqWCHjY6+JxuC54XP1fDwx4N0ASyW+U=
+golang.org/x/arch v0.16.0/go.mod h1:JmwW7aLIoRUKgaTzhkiEFxvcEiQGyOg9BMonBJUS7EE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
+golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
-golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
@@ -384,21 +298,25 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
-golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
+golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
+golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210331175145-43e1dd70ce54/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -416,8 +334,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
+golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -436,45 +354,41 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
+golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
-golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/tools v0.32.0 h1:Q7N1vhpkQv7ybVzLFtTjvQya2ewbwNDZzUgfXGqtMWU=
+golang.org/x/tools v0.32.0/go.mod h1:ZxrU41P/wAbZD8EDa6dDCa6XfpkhJ7HFMjHJXfBDu8s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.258.0 h1:IKo1j5FBlN74fe5isA2PVozN3Y5pwNKriEgAXPOkDAc=
-google.golang.org/api v0.258.0/go.mod h1:qhOMTQEZ6lUps63ZNq9jhODswwjkjYYguA7fA3TBFww=
-google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 h1:GvESR9BIyHUahIb0NcTum6itIWtdoglGX+rnGxm2934=
-google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:yJ2HH4EHEDTd3JiLmhds6NkJ17ITVYOdV3m3VKOnws0=
-google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
-google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
-google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
-google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOskjbcSMcF2jiYMNiQYZ0c2KEJLKKU=
+google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697 h1:pgr/4QbFyktUv9CtQ/Fq4gzEE6/Xs7iCXbktaGzLHbQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697/go.mod h1:+D9ySVjN8nY8YCVjc5O7PZDIdZporIDY3KaGfJunh88=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
+google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
-gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
-pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
+gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
+gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
+nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=

internal/acl/README.md

@@ -1,282 +0,0 @@
-# ACL (Access Control List)
-
-Access control at the TCP connection level with IP/CIDR, timezone, and country-based filtering.
-
-## Overview
-
-The ACL package provides network-level access control by wrapping TCP listeners and validating incoming connections against configurable allow/deny rules. It integrates with MaxMind GeoIP for geographic-based filtering and supports access logging with notification batching.
-
-### Primary consumers
-
-- `internal/entrypoint` - Wraps the main TCP listener for connection filtering
-- Operators - Configure rules via YAML configuration
-
-### Non-goals
-
-- HTTP request-level filtering (handled by middleware)
-- Authentication or authorization (see `internal/auth`)
-- VPN or tunnel integration
-
-### Stability
-
-Stable internal package. The public API is the `Config` struct and its methods.
-
-## Public API
-
-### Exported types
-
-```go
-type Config struct {
-    Default    string                     // "allow" or "deny" (default: "allow")
-    AllowLocal *bool                      // Allow private/loopback IPs (default: true)
-    Allow      Matchers                   // Allow rules
-    Deny       Matchers                   // Deny rules
-    Log        *accesslog.ACLLoggerConfig // Access logging configuration
-
-    Notify struct {
-        To             []string      // Notification providers
-        Interval       time.Duration // Notification frequency (default: 1m)
-        IncludeAllowed *bool         // Include allowed in notifications (default: false)
-    }
-}
-```
-
-```go
-type Matcher struct {
-    match MatcherFunc
-}
-```
-
-```go
-type Matchers []Matcher
-```
-
-### Exported functions and methods
-
-```go
-func (c *Config) Validate() gperr.Error
-```
-
-Validates configuration and sets defaults. Must be called before `Start`.
-
-```go
-func (c *Config) Start(parent task.Parent) gperr.Error
-```
-
-Initializes the ACL, starts the logger and notification goroutines.
-
-```go
-func (c *Config) IPAllowed(ip net.IP) bool
-```
-
-Returns true if the IP is allowed based on configured rules. Performs caching and GeoIP lookup if needed.
-
-```go
-func (c *Config) WrapTCP(lis net.Listener) net.Listener
-```
-
-Wraps a `net.Listener` to filter connections by IP.
-
-```go
-func (matcher *Matcher) Parse(s string) error
-```
-
-Parses a matcher string in the format `{type}:{value}`. Supported types: `ip`, `cidr`, `tz`, `country`.
-
-## Architecture
-
-### Core components
-
-```mermaid
-graph TD
-    A[TCP Listener] --> B[TCPListener Wrapper]
-    B --> C{IP Allowed?}
-    C -->|Yes| D[Accept Connection]
-    C -->|No| E[Close Connection]
-
-    F[Config] --> G[Validate]
-    G --> H[Start]
-    H --> I[Matcher Evaluation]
-    I --> C
-
-    J[MaxMind] -.-> K[IP Lookup]
-    K -.-> I
-
-    L[Access Logger] -.-> M[Log & Notify]
-    M -.-> B
-```
-
-### Connection filtering flow
-
-```mermaid
-sequenceDiagram
-    participant Client
-    participant TCPListener
-    participant Config
-    participant MaxMind
-    participant Logger
-
-    Client->>TCPListener: Connection Request
-    TCPListener->>Config: IPAllowed(clientIP)
-
-    alt Loopback IP
-        Config-->>TCPListener: true
-    else Private IP (allow_local)
-        Config-->>TCPListener: true
-    else Cached Result
-        Config-->>TCPListener: Cached Result
-    else Evaluate Allow Rules
-        Config->>Config: Check Allow list
-        alt Matches
-            Config->>Config: Cache true
-            Config-->>TCPListener: Allowed
-        else Evaluate Deny Rules
-            Config->>Config: Check Deny list
-            alt Matches
-                Config->>Config: Cache false
-                Config-->>TCPListener: Denied
-            else Default Action
-                Config->>MaxMind: Lookup GeoIP
-                MaxMind-->>Config: IPInfo
-                Config->>Config: Apply default rule
-                Config->>Config: Cache result
-                Config-->>TCPListener: Result
-            end
-        end
-    end
-
-    alt Logging enabled
-        Config->>Logger: Log access attempt
-    end
-```
-
-### Matcher types
-
-| Type     | Format            | Example               |
-| -------- | ----------------- | --------------------- |
-| IP       | `ip:address`      | `ip:192.168.1.1`      |
-| CIDR     | `cidr:network`    | `cidr:192.168.0.0/16` |
-| TimeZone | `tz:timezone`     | `tz:Asia/Shanghai`    |
-| Country  | `country:ISOCode` | `country:GB`          |
-
-## Configuration Surface
-
-### Config sources
-
-Configuration is loaded from `config/config.yml` under the `acl` key.
-
-### Schema
-
-```yaml
-acl:
-  default: "allow"              # "allow" or "deny"
-  allow_local: true             # Allow private/loopback IPs
-  log:
-    log_allowed: false          # Log allowed connections
-  notify:
-    to: ["gotify"]              # Notification providers
-    interval: "1m"              # Notification interval
-    include_allowed: false      # Include allowed in notifications
-```
-
-### Hot-reloading
-
-Configuration requires restart. The ACL does not support dynamic rule updates.
-
-## Dependency and Integration Map
-
-### Internal dependencies
-
-- `internal/maxmind` - IP geolocation lookup
-- `internal/logging/accesslog` - Access logging
-- `internal/notif` - Notifications
-- `internal/task/task.go` - Lifetime management
-
-### Integration points
-
-```go
-// Entrypoint uses ACL to wrap the TCP listener
-aclListener := config.ACL.WrapTCP(listener)
-http.Server.Serve(aclListener, entrypoint)
-```
-
-## Observability
-
-### Logs
-
-- `ACL started` - Configuration summary on start
-- `log_notify_loop` - Access attempts (allowed/denied)
-
-Log levels: `Info` for startup, `Debug` for client closure.
-
-### Metrics
-
-No metrics are currently exposed.
-
-## Security Considerations
-
-- Loopback and private IPs are always allowed unless explicitly denied
-- Cache TTL is 1 minute to limit memory usage
-- Notification channel has a buffer of 100 to prevent blocking
-- Failed connections are immediately closed without response
-
-## Failure Modes and Recovery
-
-| Failure                           | Behavior                              | Recovery                                      |
-| --------------------------------- | ------------------------------------- | --------------------------------------------- |
-| Invalid matcher syntax            | Validation fails on startup           | Fix configuration syntax                      |
-| MaxMind database unavailable      | GeoIP lookups return unknown location | Default action applies; cache hit still works |
-| Notification provider unavailable | Notification dropped                  | Error logged, continues operation             |
-| Cache full                        | No eviction, uses Go map              | No action needed                              |
-
-## Usage Examples
-
-### Basic configuration
-
-```go
-aclConfig := &acl.Config{
-    Default:    "allow",
-    AllowLocal: ptr(true),
-    Allow: acl.Matchers{
-        {match: matchIP(net.ParseIP("192.168.1.0/24"))},
-    },
-    Deny: acl.Matchers{
-        {match: matchISOCode("CN")},
-    },
-}
-if err := aclConfig.Validate(); err != nil {
-    log.Fatal(err)
-}
-if err := aclConfig.Start(parent); err != nil {
-    log.Fatal(err)
-}
-```
-
-### Wrapping a TCP listener
-
-```go
-listener, err := net.Listen("tcp", ":443")
-if err != nil {
-    log.Fatal(err)
-}
-
-// Wrap with ACL
-aclListener := aclConfig.WrapTCP(listener)
-
-// Use with HTTP server
-server := &http.Server{}
-server.Serve(aclListener)
-```
-
-### Creating custom matchers
-
-```go
-matcher := &acl.Matcher{}
-err := matcher.Parse("country:US")
-if err != nil {
-    log.Fatal(err)
-}
-
-// Use the matcher
-allowed := matcher.match(ipInfo)
-```

internal/acl/config.go

@@ -1,309 +0,0 @@
-package acl
-
-import (
-	"fmt"
-	"math"
-	"net"
-	"sync/atomic"
-	"time"
-
-	"github.com/puzpuzpuz/xsync/v4"
-	"github.com/rs/zerolog"
-	"github.com/rs/zerolog/log"
-	"github.com/yusing/godoxy/internal/common"
-	"github.com/yusing/godoxy/internal/logging/accesslog"
-	"github.com/yusing/godoxy/internal/maxmind"
-	"github.com/yusing/godoxy/internal/notif"
-	gperr "github.com/yusing/goutils/errs"
-	strutils "github.com/yusing/goutils/strings"
-	"github.com/yusing/goutils/task"
-)
-
-type Config struct {
-	Default    string                     `json:"default" validate:"omitempty,oneof=allow deny"` // default: allow
-	AllowLocal *bool                      `json:"allow_local"`                                   // default: true
-	Allow      Matchers                   `json:"allow"`
-	Deny       Matchers                   `json:"deny"`
-	Log        *accesslog.ACLLoggerConfig `json:"log"`
-
-	Notify struct {
-		To             []string      `json:"to"`              // list of notification providers
-		Interval       time.Duration `json:"interval"`        // interval between notifications
-		IncludeAllowed *bool         `json:"include_allowed"` // default: false
-	} `json:"notify"`
-
-	config
-	valErr gperr.Error
-}
-
-const defaultNotifyInterval = 1 * time.Minute
-
-type config struct {
-	defaultAllow bool
-	allowLocal   bool
-	ipCache      *xsync.Map[string, *checkCache]
-
-	// will be nil if Notify.To is empty
-	// these are per IP, reset every Notify.Interval
-	allowedCount map[string]uint32
-	blockedCount map[string]uint32
-
-	// these are total, never reset
-	totalAllowedCount uint64
-	totalBlockedCount uint64
-
-	logAllowed bool
-	// will be nil if Log is nil
-	logger accesslog.AccessLogger
-
-	// will never tick if Notify.To is empty
-	notifyTicker  *time.Ticker
-	notifyAllowed bool
-
-	// will be nil if both Log and Notify.To are empty
-	logNotifyCh chan ipLog
-}
-
-type checkCache struct {
-	*maxmind.IPInfo
-	allow   bool
-	created time.Time
-}
-
-type ipLog struct {
-	info    *maxmind.IPInfo
-	allowed bool
-}
-
-// could be nil
-var ActiveConfig atomic.Pointer[Config]
-
-const cacheTTL = 1 * time.Minute
-
-func (c *checkCache) Expired() bool {
-	return c.created.Add(cacheTTL).Before(time.Now())
-}
-
-// TODO: add stats
-
-const (
-	ACLAllow = "allow"
-	ACLDeny  = "deny"
-)
-
-func (c *Config) Validate() gperr.Error {
-	switch c.Default {
-	case "", ACLAllow:
-		c.defaultAllow = true
-	case ACLDeny:
-		c.defaultAllow = false
-	default:
-		c.valErr = gperr.New("invalid default value").Subject(c.Default)
-		return c.valErr
-	}
-
-	if c.AllowLocal != nil {
-		c.allowLocal = *c.AllowLocal
-	} else {
-		c.allowLocal = true
-	}
-
-	if c.Notify.Interval < 0 {
-		c.Notify.Interval = defaultNotifyInterval
-	}
-
-	if c.Log != nil {
-		c.logAllowed = c.Log.LogAllowed
-	}
-
-	if !c.allowLocal && !c.defaultAllow && len(c.Allow) == 0 {
-		c.valErr = gperr.New("allow_local is false and default is deny, but no allow rules are configured")
-		return c.valErr
-	}
-
-	c.ipCache = xsync.NewMap[string, *checkCache]()
-
-	if c.Notify.IncludeAllowed != nil {
-		c.notifyAllowed = *c.Notify.IncludeAllowed
-	} else {
-		c.notifyAllowed = false
-	}
-	return nil
-}
-
-func (c *Config) Valid() bool {
-	return c != nil && c.valErr == nil
-}
-
-func (c *Config) Start(parent task.Parent) gperr.Error {
-	if c.Log != nil {
-		logger, err := accesslog.NewAccessLogger(parent, c.Log)
-		if err != nil {
-			return gperr.New("failed to start access logger").With(err)
-		}
-		c.logger = logger
-	}
-	if c.valErr != nil {
-		return c.valErr
-	}
-
-	if c.needLogOrNotify() {
-		c.logNotifyCh = make(chan ipLog, 100)
-	}
-
-	if c.needNotify() {
-		c.allowedCount = make(map[string]uint32)
-		c.blockedCount = make(map[string]uint32)
-		c.notifyTicker = time.NewTicker(c.Notify.Interval)
-	} else {
-		c.notifyTicker = time.NewTicker(time.Duration(math.MaxInt64)) // never tick
-	}
-
-	if c.needLogOrNotify() {
-		go c.logNotifyLoop(parent)
-	}
-
-	log.Info().
-		Str("default", c.Default).
-		Bool("allow_local", c.allowLocal).
-		Int("allow_rules", len(c.Allow)).
-		Int("deny_rules", len(c.Deny)).
-		Msg("ACL started")
-	return nil
-}
-
-func (c *Config) cacheRecord(info *maxmind.IPInfo, allow bool) {
-	if common.ForceResolveCountry && info.City == nil {
-		maxmind.LookupCity(info)
-	}
-	c.ipCache.Store(info.Str, &checkCache{
-		IPInfo:  info,
-		allow:   allow,
-		created: time.Now(),
-	})
-}
-
-func (c *Config) needLogOrNotify() bool {
-	return c.needLog() || c.needNotify()
-}
-
-func (c *Config) needLog() bool {
-	return c.logger != nil
-}
-
-func (c *Config) needNotify() bool {
-	return len(c.Notify.To) > 0
-}
-
-func (c *Config) getCachedCity(ip string) string {
-	record, ok := c.ipCache.Load(ip)
-	if ok {
-		if record.City != nil {
-			if record.City.Country.IsoCode != "" {
-				return record.City.Country.IsoCode
-			}
-			return record.City.Location.TimeZone
-		}
-	}
-	return "unknown location"
-}
-
-func (c *Config) logNotifyLoop(parent task.Parent) {
-	defer c.notifyTicker.Stop()
-
-	for {
-		select {
-		case <-parent.Context().Done():
-			return
-		case log := <-c.logNotifyCh:
-			if c.logger != nil {
-				if !log.allowed || c.logAllowed {
-					c.logger.LogACL(log.info, !log.allowed)
-				}
-			}
-			if c.needNotify() {
-				if log.allowed {
-					if c.notifyAllowed {
-						c.allowedCount[log.info.Str]++
-						c.totalAllowedCount++
-					}
-				} else {
-					c.blockedCount[log.info.Str]++
-					c.totalBlockedCount++
-				}
-			}
-		case <-c.notifyTicker.C: // will never tick when notify is disabled
-			total := len(c.allowedCount) + len(c.blockedCount)
-			if total == 0 {
-				continue
-			}
-			total++
-			fieldsBody := make(notif.ListBody, total)
-			i := 0
-			fieldsBody[i] = fmt.Sprintf("Total: allowed %d, blocked %d", c.totalAllowedCount, c.totalBlockedCount)
-			i++
-			for ip, count := range c.allowedCount {
-				fieldsBody[i] = fmt.Sprintf("%s (%s): allowed %d times", ip, c.getCachedCity(ip), count)
-				i++
-			}
-			for ip, count := range c.blockedCount {
-				fieldsBody[i] = fmt.Sprintf("%s (%s): blocked %d times", ip, c.getCachedCity(ip), count)
-				i++
-			}
-			notif.Notify(&notif.LogMessage{
-				Level: zerolog.InfoLevel,
-				Title: "ACL Summary for last " + strutils.FormatDuration(c.Notify.Interval),
-				Body:  fieldsBody,
-				To:    c.Notify.To,
-			})
-			clear(c.allowedCount)
-			clear(c.blockedCount)
-		}
-	}
-}
-
-// log and notify if needed
-func (c *Config) logAndNotify(info *maxmind.IPInfo, allowed bool) {
-	if c.logNotifyCh != nil {
-		c.logNotifyCh <- ipLog{info: info, allowed: allowed}
-	}
-}
-
-func (c *Config) IPAllowed(ip net.IP) bool {
-	if ip == nil {
-		return false
-	}
-
-	// always allow loopback, not logged
-	if ip.IsLoopback() {
-		return true
-	}
-
-	if c.allowLocal && ip.IsPrivate() {
-		c.logAndNotify(&maxmind.IPInfo{IP: ip, Str: ip.String()}, true)
-		return true
-	}
-
-	ipStr := ip.String()
-	record, ok := c.ipCache.Load(ipStr)
-	if ok && !record.Expired() {
-		c.logAndNotify(record.IPInfo, record.allow)
-		return record.allow
-	}
-
-	ipAndStr := &maxmind.IPInfo{IP: ip, Str: ipStr}
-	if c.Allow.Match(ipAndStr) {
-		c.logAndNotify(ipAndStr, true)
-		c.cacheRecord(ipAndStr, true)
-		return true
-	}
-	if c.Deny.Match(ipAndStr) {
-		c.logAndNotify(ipAndStr, false)
-		c.cacheRecord(ipAndStr, false)
-		return false
-	}
-
-	c.logAndNotify(ipAndStr, c.defaultAllow)
-	c.cacheRecord(ipAndStr, c.defaultAllow)
-	return c.defaultAllow
-}

internal/acl/matcher.go

@@ -1,112 +0,0 @@
-package acl
-
-import (
-	"net"
-	"strings"
-
-	"github.com/yusing/godoxy/internal/maxmind"
-	gperr "github.com/yusing/goutils/errs"
-)
-
-type MatcherFunc func(*maxmind.IPInfo) bool
-
-type Matcher struct {
-	match MatcherFunc
-}
-
-type Matchers []Matcher
-
-const (
-	MatcherTypeIP       = "ip"
-	MatcherTypeCIDR     = "cidr"
-	MatcherTypeTimeZone = "tz"
-	MatcherTypeCountry  = "country"
-)
-
-// TODO: use this error in the future
-//
-//nolint:unused
-var errMatcherFormat = gperr.Multiline().AddLines(
-	"invalid matcher format, expect {type}:{value}",
-	"Available types: ip|cidr|tz|country",
-	"ip:127.0.0.1",
-	"cidr:127.0.0.0/8",
-	"tz:Asia/Shanghai",
-	"country:GB",
-)
-
-var (
-	errSyntax      = gperr.New("syntax error")
-	errInvalidIP   = gperr.New("invalid IP")
-	errInvalidCIDR = gperr.New("invalid CIDR")
-)
-
-func (matcher *Matcher) Parse(s string) error {
-	parts := strings.Split(s, ":")
-	if len(parts) != 2 {
-		return errSyntax
-	}
-
-	switch parts[0] {
-	case MatcherTypeIP:
-		ip := net.ParseIP(parts[1])
-		if ip == nil {
-			return errInvalidIP
-		}
-		matcher.match = matchIP(ip)
-	case MatcherTypeCIDR:
-		_, net, err := net.ParseCIDR(parts[1])
-		if err != nil {
-			return errInvalidCIDR
-		}
-		matcher.match = matchCIDR(net)
-	case MatcherTypeTimeZone:
-		matcher.match = matchTimeZone(parts[1])
-	case MatcherTypeCountry:
-		matcher.match = matchISOCode(parts[1])
-	default:
-		return errSyntax
-	}
-	return nil
-}
-
-func (matchers Matchers) Match(ip *maxmind.IPInfo) bool {
-	for _, m := range matchers {
-		if m.match(ip) {
-			return true
-		}
-	}
-	return false
-}
-
-func matchIP(ip net.IP) MatcherFunc {
-	return func(ip2 *maxmind.IPInfo) bool {
-		return ip.Equal(ip2.IP)
-	}
-}
-
-func matchCIDR(n *net.IPNet) MatcherFunc {
-	return func(ip *maxmind.IPInfo) bool {
-		return n.Contains(ip.IP)
-	}
-}
-
-func matchTimeZone(tz string) MatcherFunc {
-	return func(ip *maxmind.IPInfo) bool {
-		city, ok := maxmind.LookupCity(ip)
-		if !ok {
-			return false
-		}
-		return city.Location.TimeZone == tz
-	}
-}
-
-func matchISOCode(iso string) MatcherFunc {
-	return func(ip *maxmind.IPInfo) bool {
-		city, ok := maxmind.LookupCity(ip)
-		if !ok {
-			return false
-		}
-		return city.Country.IsoCode == iso
-	}
-}

internal/acl/matcher_test.go

@@ -1,49 +0,0 @@
-package acl
-
-import (
-	"net"
-	"reflect"
-	"testing"
-
-	maxmind "github.com/yusing/godoxy/internal/maxmind/types"
-	"github.com/yusing/godoxy/internal/serialization"
-)
-
-func TestMatchers(t *testing.T) {
-	strMatchers := []string{
-		"ip:127.0.0.1",
-		"cidr:10.0.0.0/8",
-	}
-
-	var mathers Matchers
-	err := serialization.Convert(reflect.ValueOf(strMatchers), reflect.ValueOf(&mathers), false)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	tests := []struct {
-		ip   string
-		want bool
-	}{
-		{"127.0.0.1", true},
-		{"10.0.0.1", true},
-		{"127.0.0.2", false},
-		{"192.168.0.1", false},
-		{"11.0.0.1", false},
-	}
-
-	for _, test := range tests {
-		ip := net.ParseIP(test.ip)
-		if ip == nil {
-			t.Fatalf("invalid ip: %s", test.ip)
-		}
-
-		got := mathers.Match(&maxmind.IPInfo{
-			IP:  ip,
-			Str: test.ip,
-		})
-		if got != test.want {
-			t.Errorf("mathers.Match(%s) = %v, want %v", test.ip, got, test.want)
-		}
-	}
-}

internal/acl/tcp_listener.go

@@ -1,75 +0,0 @@
-package acl
-
-import (
-	"errors"
-	"io"
-	"net"
-	"time"
-)
-
-type TCPListener struct {
-	acl *Config
-	lis net.Listener
-}
-
-type noConn struct{}
-
-func (noConn) Read(b []byte) (int, error)         { return 0, io.EOF }
-func (noConn) Write(b []byte) (int, error)        { return 0, io.EOF }
-func (noConn) Close() error                       { return nil }
-func (noConn) LocalAddr() net.Addr                { return nil }
-func (noConn) RemoteAddr() net.Addr               { return nil }
-func (noConn) SetDeadline(t time.Time) error      { return nil }
-func (noConn) SetReadDeadline(t time.Time) error  { return nil }
-func (noConn) SetWriteDeadline(t time.Time) error { return nil }
-
-func (c *Config) WrapTCP(lis net.Listener) net.Listener {
-	if c == nil {
-		return lis
-	}
-	return &TCPListener{
-		acl: c,
-		lis: lis,
-	}
-}
-
-func (s *TCPListener) Addr() net.Addr {
-	return s.lis.Addr()
-}
-
-func (s *TCPListener) Accept() (net.Conn, error) {
-	c, err := s.lis.Accept()
-	if err != nil {
-		return nil, err
-	}
-	addr, ok := c.RemoteAddr().(*net.TCPAddr)
-	if !ok {
-		// Not a TCPAddr, drop
-		c.Close()
-		return noConn{}, nil
-	}
-	if !s.acl.IPAllowed(addr.IP) {
-		c.Close()
-		return noConn{}, nil
-	}
-	return c, nil
-}
-
-type tcpListener interface {
-	SetDeadline(t time.Time) error
-}
-
-var _ tcpListener = (*net.TCPListener)(nil)
-
-func (s *TCPListener) SetDeadline(t time.Time) error {
-	switch lis := s.lis.(type) {
-	case tcpListener:
-		return lis.SetDeadline(t)
-	default:
-		return errors.New("not a TCPListener")
-	}
-}
-
-func (s *TCPListener) Close() error {
-	return s.lis.Close()
-}

internal/acl/udp_listener.go

@@ -1,105 +0,0 @@
-package acl
-
-import (
-	"errors"
-	"net"
-	"time"
-)
-
-type UDPListener struct {
-	acl *Config
-	lis net.PacketConn
-}
-
-func (c *Config) WrapUDP(lis net.PacketConn) net.PacketConn {
-	if c == nil {
-		return lis
-	}
-	return &UDPListener{
-		acl: c,
-		lis: lis,
-	}
-}
-
-func (s *UDPListener) LocalAddr() net.Addr {
-	return s.lis.LocalAddr()
-}
-
-func (s *UDPListener) ReadFrom(p []byte) (int, net.Addr, error) {
-	for {
-		n, addr, err := s.lis.ReadFrom(p)
-		if err != nil {
-			return n, addr, err
-		}
-		udpAddr, ok := addr.(*net.UDPAddr)
-		if !ok {
-			// Not a UDPAddr, drop
-			continue
-		}
-		if !s.acl.IPAllowed(udpAddr.IP) {
-			// Drop packet from disallowed IP
-			continue
-		}
-		return n, addr, nil
-	}
-}
-
-func (s *UDPListener) WriteTo(p []byte, addr net.Addr) (int, error) {
-	for {
-		n, err := s.lis.WriteTo(p, addr)
-		if err != nil {
-			return n, err
-		}
-		udpAddr, ok := addr.(*net.UDPAddr)
-		if !ok {
-			// Not a UDPAddr, drop
-			continue
-		}
-		if !s.acl.IPAllowed(udpAddr.IP) {
-			// Drop packet to disallowed IP
-			continue
-		}
-		return n, nil
-	}
-}
-
-func (s *UDPListener) SetDeadline(t time.Time) error {
-	return s.lis.SetDeadline(t)
-}
-
-func (s *UDPListener) SetReadDeadline(t time.Time) error {
-	return s.lis.SetReadDeadline(t)
-}
-
-func (s *UDPListener) SetWriteDeadline(t time.Time) error {
-	return s.lis.SetWriteDeadline(t)
-}
-
-type udpListener interface {
-	SetReadBuffer(bytes int) error
-	SetWriteBuffer(bytes int) error
-}
-
-var _ udpListener = (*net.UDPConn)(nil)
-
-func (s *UDPListener) SetReadBuffer(bytes int) error {
-	switch lis := s.lis.(type) {
-	case udpListener:
-		return lis.SetReadBuffer(bytes)
-	default:
-		return errors.New("not a UDPConn")
-	}
-}
-
-func (s *UDPListener) SetWriteBuffer(bytes int) error {
-	switch lis := s.lis.(type) {
-	case udpListener:
-		return lis.SetWriteBuffer(bytes)
-	default:
-		return errors.New("not a UDPConn")
-	}
-}
-
-func (s *UDPListener) Close() error {
-	return s.lis.Close()
-}

internal/agentpool/README.md

@@ -1,281 +0,0 @@
-# Agent Pool
-
-Thread-safe pool for managing remote Docker agent connections.
-
-## Overview
-
-The agentpool package provides a centralized pool for storing and retrieving remote agent configurations. It enables GoDoxy to connect to Docker hosts via agent connections instead of direct socket access, enabling secure remote container management.
-
-### Primary consumers
-
-- `internal/route/provider` - Creates agent-based route providers
-- `internal/docker` - Manages agent-based Docker client connections
-- Configuration loading during startup
-
-### Non-goals
-
-- Agent lifecycle management (handled by `agent/pkg/agent`)
-- Agent health monitoring
-- Agent authentication/authorization
-
-### Stability
-
-Stable internal package. The pool uses `xsync.Map` for lock-free concurrent access.
-
-## Public API
-
-### Exported types
-
-```go
-type Agent struct {
-    *agent.AgentConfig
-    httpClient       *http.Client
-    fasthttpHcClient *fasthttp.Client
-}
-```
-
-### Exported functions
-
-```go
-func Add(cfg *agent.AgentConfig) (added bool)
-```
-
-Adds an agent to the pool. Returns `true` if added, `false` if already exists. Uses `LoadOrCompute` to prevent duplicates.
-
-```go
-func Has(cfg *agent.AgentConfig) bool
-```
-
-Checks if an agent exists in the pool.
-
-```go
-func Remove(cfg *agent.AgentConfig)
-```
-
-Removes an agent from the pool.
-
-```go
-func RemoveAll()
-```
-
-Removes all agents from the pool. Called during configuration reload.
-
-```go
-func Get(agentAddrOrDockerHost string) (*Agent, bool)
-```
-
-Retrieves an agent by address or Docker host URL. Automatically detects if the input is an agent address or Docker host URL and resolves accordingly.
-
-```go
-func GetAgent(name string) (*Agent, bool)
-```
-
-Retrieves an agent by name. O(n) iteration over pool contents.
-
-```go
-func List() []*Agent
-```
-
-Returns all agents as a slice. Creates a new copy for thread safety.
-
-```go
-func Iter() iter.Seq2[string, *Agent]
-```
-
-Returns an iterator over all agents. Uses `xsync.Map.Range`.
-
-```go
-func Num() int
-```
-
-Returns the number of agents in the pool.
-
-```go
-func (agent *Agent) HTTPClient() *http.Client
-```
-
-Returns an HTTP client configured for the agent.
-
-## Architecture
-
-### Core components
-
-```mermaid
-graph TD
-    A[Agent Config] --> B[Add to Pool]
-    B --> C[xsync.Map Storage]
-    C --> D{Get Request}
-    D -->|By Address| E[Load from map]
-    D -->|By Docker Host| F[Resolve agent addr]
-    D -->|By Name| G[Iterate & match]
-
-    H[Docker Client] --> I[Get Agent]
-    I --> C
-    I --> J[HTTP Client]
-    J --> K[Agent Connection]
-
-    L[Route Provider] --> M[List Agents]
-    M --> C
-```
-
-### Thread safety model
-
-The pool uses `xsync.Map[string, *Agent]` for concurrent-safe operations:
-
-- `Add`: `LoadOrCompute` prevents race conditions and duplicates
-- `Get`: Lock-free read operations
-- `Iter`: Consistent snapshot iteration via `Range`
-- `Remove`: Thread-safe deletion
-
-### Test mode
-
-When running tests (binary ends with `.test`), a test agent is automatically added:
-
-```go
-func init() {
-    if strings.HasSuffix(os.Args[0], ".test") {
-        agentPool.Store("test-agent", &Agent{
-            AgentConfig: &agent.AgentConfig{
-                Addr: "test-agent",
-            },
-        })
-    }
-}
-```
-
-## Configuration Surface
-
-No direct configuration. Agents are added via configuration loading from `config/config.yml`:
-
-```yaml
-providers:
-  agents:
-    - addr: agent.example.com:443
-      name: remote-agent
-      tls:
-        ca_file: /path/to/ca.pem
-        cert_file: /path/to/cert.pem
-        key_file: /path/to/key.pem
-```
-
-## Dependency and Integration Map
-
-### Internal dependencies
-
-- `agent/pkg/agent` - Agent configuration and connection settings
-- `xsync/v4` - Concurrent map implementation
-
-### External dependencies
-
-- `valyala/fasthttp` - Fast HTTP client for agent communication
-
-### Integration points
-
-```go
-// Docker package uses agent pool for remote connections
-if agent.IsDockerHostAgent(host) {
-    a, ok := agentpool.Get(host)
-    if !ok {
-        panic(fmt.Errorf("agent %q not found", host))
-    }
-    opt := []client.Opt{
-        client.WithHost(agent.DockerHost),
-        client.WithHTTPClient(a.HTTPClient()),
-    }
-}
-```
-
-## Observability
-
-### Logs
-
-No specific logging in the agentpool package. Client creation/destruction is logged in the docker package.
-
-### Metrics
-
-No metrics are currently exposed.
-
-## Security Considerations
-
-- TLS configuration is loaded from agent configuration
-- Connection credentials are not stored in the pool after agent creation
-- HTTP clients are created per-request to ensure credential freshness
-
-## Failure Modes and Recovery
-
-| Failure              | Behavior             | Recovery                     |
-| -------------------- | -------------------- | ---------------------------- |
-| Agent not found      | Returns `nil, false` | Add agent to pool before use |
-| Duplicate add        | Returns `false`      | Existing agent is preserved  |
-| Test mode activation | Test agent added     | Only during test binaries    |
-
-## Performance Characteristics
-
-- O(1) lookup by address
-- O(n) iteration for name-based lookup
-- Pre-sized to 10 entries via `xsync.WithPresize(10)`
-- No locks required for read operations
-- HTTP clients are created per-call to ensure fresh connections
-
-## Usage Examples
-
-### Adding an agent
-
-```go
-agentConfig := &agent.AgentConfig{
-    Addr: "agent.example.com:443",
-    Name: "my-agent",
-}
-
-added := agentpool.Add(agentConfig)
-if !added {
-    log.Println("Agent already exists")
-}
-```
-
-### Retrieving an agent
-
-```go
-// By address
-agent, ok := agentpool.Get("agent.example.com:443")
-if !ok {
-    log.Fatal("Agent not found")
-}
-
-// By Docker host URL
-agent, ok := agentpool.Get("http://docker-host:2375")
-if !ok {
-    log.Fatal("Agent not found")
-}
-
-// By name
-agent, ok := agentpool.GetAgent("my-agent")
-if !ok {
-    log.Fatal("Agent not found")
-}
-```
-
-### Iterating over all agents
-
-```go
-for addr, agent := range agentpool.Iter() {
-    log.Printf("Agent: %s at %s", agent.Name, addr)
-}
-```
-
-### Using with Docker client
-
-```go
-// When creating a Docker client with an agent host
-if agent.IsDockerHostAgent(host) {
-    a, ok := agentpool.Get(host)
-    if !ok {
-        panic(fmt.Errorf("agent %q not found", host))
-    }
-    opt := []client.Opt{
-        client.WithHost(agent.DockerHost),
-        client.WithHTTPClient(a.HTTPClient()),
-    }
-    dockerClient, err := client.New(opt...)
-}
-```

internal/agentpool/agent.go

@@ -1,54 +0,0 @@
-package agentpool
-
-import (
-	"net"
-	"net/http"
-	"time"
-
-	"github.com/valyala/fasthttp"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-)
-
-type Agent struct {
-	*agent.AgentConfig
-
-	httpClient       *http.Client
-	fasthttpHcClient *fasthttp.Client
-}
-
-func newAgent(cfg *agent.AgentConfig) *Agent {
-	transport := cfg.Transport()
-	transport.MaxIdleConns = 100
-	transport.MaxIdleConnsPerHost = 100
-	transport.ReadBufferSize = 16384
-	transport.WriteBufferSize = 16384
-
-	return &Agent{
-		AgentConfig: cfg,
-		httpClient: &http.Client{
-			Transport: transport,
-		},
-		fasthttpHcClient: &fasthttp.Client{
-			DialTimeout: func(addr string, timeout time.Duration) (net.Conn, error) {
-				if addr != agent.AgentHost+":443" {
-					return nil, &net.AddrError{Err: "invalid address", Addr: addr}
-				}
-				return net.DialTimeout("tcp", cfg.Addr, timeout)
-			},
-			TLSConfig:                     cfg.TLSConfig(),
-			ReadTimeout:                   5 * time.Second,
-			WriteTimeout:                  3 * time.Second,
-			DisableHeaderNamesNormalizing: true,
-			DisablePathNormalizing:        true,
-			NoDefaultUserAgentHeader:      true,
-			ReadBufferSize:                1024,
-			WriteBufferSize:               1024,
-		},
-	}
-}
-
-func (agent *Agent) HTTPClient() *http.Client {
-	return &http.Client{
-		Transport: agent.Transport(),
-	}
-}

internal/agentpool/http_requests.go

@@ -1,96 +0,0 @@
-package agentpool
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"time"
-
-	"github.com/bytedance/sonic"
-	"github.com/gorilla/websocket"
-	"github.com/valyala/fasthttp"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/goutils/http/reverseproxy"
-)
-
-func (cfg *Agent) Do(ctx context.Context, method, endpoint string, body io.Reader) (*http.Response, error) {
-	req, err := http.NewRequestWithContext(ctx, method, agent.APIBaseURL+endpoint, body)
-	if err != nil {
-		return nil, err
-	}
-	return cfg.httpClient.Do(req)
-}
-
-func (cfg *Agent) Forward(req *http.Request, endpoint string) (*http.Response, error) {
-	req.URL.Host = agent.AgentHost
-	req.URL.Scheme = "https"
-	req.URL.Path = agent.APIEndpointBase + endpoint
-	req.RequestURI = ""
-	resp, err := cfg.httpClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	return resp, nil
-}
-
-type HealthCheckResponse struct {
-	Healthy bool          `json:"healthy"`
-	Detail  string        `json:"detail"`
-	Latency time.Duration `json:"latency"`
-}
-
-func (cfg *Agent) DoHealthCheck(timeout time.Duration, query string) (ret HealthCheckResponse, err error) {
-	req := fasthttp.AcquireRequest()
-	defer fasthttp.ReleaseRequest(req)
-
-	resp := fasthttp.AcquireResponse()
-	defer fasthttp.ReleaseResponse(resp)
-
-	req.SetRequestURI(agent.APIBaseURL + agent.EndpointHealth + "?" + query)
-	req.Header.SetMethod(fasthttp.MethodGet)
-	req.Header.Set("Accept-Encoding", "identity")
-	req.SetConnectionClose()
-
-	start := time.Now()
-	err = cfg.fasthttpHcClient.DoTimeout(req, resp, timeout)
-	ret.Latency = time.Since(start)
-	if err != nil {
-		return ret, err
-	}
-
-	if status := resp.StatusCode(); status != http.StatusOK {
-		ret.Detail = fmt.Sprintf("HTTP %d %s", status, resp.Body())
-		return ret, nil
-	} else {
-		err = sonic.Unmarshal(resp.Body(), &ret)
-		if err != nil {
-			return ret, err
-		}
-	}
-	return ret, nil
-}
-
-func (cfg *Agent) Websocket(ctx context.Context, endpoint string) (*websocket.Conn, *http.Response, error) {
-	transport := cfg.Transport()
-	dialer := websocket.Dialer{
-		NetDialContext:    transport.DialContext,
-		NetDialTLSContext: transport.DialTLSContext,
-	}
-	return dialer.DialContext(ctx, agent.APIBaseURL+endpoint, http.Header{
-		"Host": {agent.AgentHost},
-	})
-}
-
-// ReverseProxy reverse proxies the request to the agent
-//
-// It will create a new request with the same context, method, and body, but with the agent host and scheme, and the endpoint
-// If the request has a query, it will be added to the proxy request's URL
-func (cfg *Agent) ReverseProxy(w http.ResponseWriter, req *http.Request, endpoint string) {
-	rp := reverseproxy.NewReverseProxy("agent", agent.AgentURL, cfg.Transport())
-	req.URL.Host = agent.AgentHost
-	req.URL.Scheme = "https"
-	req.URL.Path = endpoint
-	req.RequestURI = ""
-	rp.ServeHTTP(w, req)
-}

internal/agentpool/pool.go

@@ -1,79 +0,0 @@
-package agentpool
-
-import (
-	"iter"
-	"os"
-	"strings"
-
-	"github.com/puzpuzpuz/xsync/v4"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-)
-
-var agentPool = xsync.NewMap[string, *Agent](xsync.WithPresize(10))
-
-func init() {
-	if strings.HasSuffix(os.Args[0], ".test") {
-		agentPool.Store("test-agent", &Agent{
-			AgentConfig: &agent.AgentConfig{
-				Addr: "test-agent",
-			},
-		})
-	}
-}
-
-func Get(agentAddrOrDockerHost string) (*Agent, bool) {
-	if !agent.IsDockerHostAgent(agentAddrOrDockerHost) {
-		return getAgentByAddr(agentAddrOrDockerHost)
-	}
-	return getAgentByAddr(agent.GetAgentAddrFromDockerHost(agentAddrOrDockerHost))
-}
-
-func GetAgent(name string) (*Agent, bool) {
-	for _, agent := range agentPool.Range {
-		if agent.Name == name {
-			return agent, true
-		}
-	}
-	return nil, false
-}
-
-func Add(cfg *agent.AgentConfig) (added bool) {
-	_, loaded := agentPool.LoadOrCompute(cfg.Addr, func() (*Agent, bool) {
-		return newAgent(cfg), false
-	})
-	return !loaded
-}
-
-func Has(cfg *agent.AgentConfig) bool {
-	_, ok := agentPool.Load(cfg.Addr)
-	return ok
-}
-
-func Remove(cfg *agent.AgentConfig) {
-	agentPool.Delete(cfg.Addr)
-}
-
-func RemoveAll() {
-	agentPool.Clear()
-}
-
-func List() []*Agent {
-	agents := make([]*Agent, 0, agentPool.Size())
-	for _, agent := range agentPool.Range {
-		agents = append(agents, agent)
-	}
-	return agents
-}
-
-func Iter() iter.Seq2[string, *Agent] {
-	return agentPool.Range
-}
-
-func Num() int {
-	return agentPool.Size()
-}
-
-func getAgentByAddr(addr string) (agent *Agent, ok bool) {
-	agent, ok = agentPool.Load(addr)
-	return agent, ok
-}

internal/api/handler.go

@@ -2,206 +2,69 @@ package api
 
 import (
 	"net/http"
-	"reflect"
 
-	"github.com/gin-gonic/gin"
-	"github.com/gin-gonic/gin/codec/json"
-	"github.com/gorilla/websocket"
-	"github.com/rs/zerolog/log"
-	apiV1 "github.com/yusing/godoxy/internal/api/v1"
-	agentApi "github.com/yusing/godoxy/internal/api/v1/agent"
-	authApi "github.com/yusing/godoxy/internal/api/v1/auth"
-	certApi "github.com/yusing/godoxy/internal/api/v1/cert"
-	dockerApi "github.com/yusing/godoxy/internal/api/v1/docker"
-	fileApi "github.com/yusing/godoxy/internal/api/v1/file"
-	homepageApi "github.com/yusing/godoxy/internal/api/v1/homepage"
-	metricsApi "github.com/yusing/godoxy/internal/api/v1/metrics"
-	routeApi "github.com/yusing/godoxy/internal/api/v1/route"
-	"github.com/yusing/godoxy/internal/auth"
-	"github.com/yusing/godoxy/internal/common"
-	apitypes "github.com/yusing/goutils/apitypes"
-	gperr "github.com/yusing/goutils/errs"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	v1 "github.com/yusing/go-proxy/internal/api/v1"
+	"github.com/yusing/go-proxy/internal/api/v1/auth"
+	"github.com/yusing/go-proxy/internal/api/v1/certapi"
+	"github.com/yusing/go-proxy/internal/api/v1/dockerapi"
+	"github.com/yusing/go-proxy/internal/api/v1/favicon"
+	"github.com/yusing/go-proxy/internal/common"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/logging/memlogger"
+	"github.com/yusing/go-proxy/internal/metrics/uptime"
+	"github.com/yusing/go-proxy/internal/net/gphttp/servemux"
 )
 
-// @title           GoDoxy API
-// @version         1.0
-// @description     GoDoxy API
-// @termsOfService  https://github.com/yusing/godoxy/blob/main/LICENSE
+func NewHandler(cfg config.ConfigInstance) http.Handler {
+	mux := servemux.NewServeMux(cfg)
+	mux.HandleFunc("GET", "/v1", v1.Index)
+	mux.HandleFunc("GET", "/v1/version", v1.GetVersion)
 
-// @contact.name   Yusing
-// @contact.url    https://github.com/yusing/godoxy/issues
+	mux.HandleFunc("GET", "/v1/stats", v1.Stats, true)
+	mux.HandleFunc("POST", "/v1/reload", v1.Reload, true)
+	mux.HandleFunc("GET", "/v1/list", v1.List, true)
+	mux.HandleFunc("GET", "/v1/list/{what}", v1.List, true)
+	mux.HandleFunc("GET", "/v1/list/{what}/{which}", v1.List, true)
+	mux.HandleFunc("GET", "/v1/file/{type}/{filename}", v1.GetFileContent, true)
+	mux.HandleFunc("POST,PUT", "/v1/file/{type}/{filename}", v1.SetFileContent, true)
+	mux.HandleFunc("POST", "/v1/file/validate/{type}", v1.ValidateFile, true)
+	mux.HandleFunc("GET", "/v1/health", v1.Health, true)
+	mux.HandleFunc("GET", "/v1/logs", memlogger.Handler(), true)
+	mux.HandleFunc("GET", "/v1/favicon", favicon.GetFavIcon, true)
+	mux.HandleFunc("POST", "/v1/homepage/set", v1.SetHomePageOverrides, true)
+	mux.HandleFunc("GET", "/v1/agents", v1.ListAgents, true)
+	mux.HandleFunc("GET", "/v1/agents/new", v1.NewAgent, true)
+	mux.HandleFunc("POST", "/v1/agents/verify", v1.VerifyNewAgent, true)
+	mux.HandleFunc("GET", "/v1/metrics/system_info", v1.SystemInfo, true)
+	mux.HandleFunc("GET", "/v1/metrics/uptime", uptime.Poller.ServeHTTP, true)
+	mux.HandleFunc("GET", "/v1/cert/info", certapi.GetCertInfo, true)
+	mux.HandleFunc("", "/v1/cert/renew", certapi.RenewCert, true)
+	mux.HandleFunc("GET", "/v1/docker/info", dockerapi.DockerInfo, true)
+	mux.HandleFunc("GET", "/v1/docker/logs/{server}/{container}", dockerapi.Logs, true)
+	mux.HandleFunc("GET", "/v1/docker/containers", dockerapi.Containers, true)
 
-// @license.name  MIT
-// @license.url   https://github.com/yusing/godoxy/blob/main/LICENSE
-
-// @BasePath  /api/v1
-
-// @externalDocs.description  GoDoxy Docs
-// @externalDocs.url          https://docs.godoxy.dev
-func NewHandler() *gin.Engine {
-	if !common.IsDebug {
-		gin.SetMode("release")
-	}
-	r := gin.New()
-	r.Use(ErrorHandler())
-	r.Use(ErrorLoggingMiddleware())
-	r.Use(NoCache())
-
-	log.Debug().Msg("gin codec json.API: " + reflect.TypeOf(json.API).Name())
-
-	r.GET("/api/v1/version", apiV1.Version)
-
-	if auth.IsEnabled() {
-		v1Auth := r.Group("/api/v1/auth")
-		{
-			v1Auth.HEAD("/check", authApi.Check)
-			v1Auth.POST("/login", authApi.Login)
-			v1Auth.GET("/callback", authApi.Callback)
-			v1Auth.POST("/callback", authApi.Callback)
-			v1Auth.POST("/logout", authApi.Logout)
-			v1Auth.GET("/logout", authApi.Logout)
-		}
+	if common.PrometheusEnabled {
+		mux.Handle("GET /v1/metrics", promhttp.Handler())
+		logging.Info().Msg("prometheus metrics enabled")
 	}
 
-	v1 := r.Group("/api/v1")
-	if auth.IsEnabled() {
-		v1.Use(AuthMiddleware())
-	}
-	if common.APISkipOriginCheck {
-		v1.Use(SkipOriginCheckMiddleware())
-	}
-	{
-		// enable cache for favicon
-		v1.GET("/favicon", apiV1.FavIcon)
-		v1.GET("/health", apiV1.Health)
-		v1.GET("/icons", apiV1.Icons)
-		v1.POST("/reload", apiV1.Reload)
-		v1.GET("/stats", apiV1.Stats)
-
-		route := v1.Group("/route")
-		{
-			route.GET("/list", routeApi.Routes)
-			route.GET("/:which", routeApi.Route)
-			route.GET("/providers", routeApi.Providers)
-			route.GET("/by_provider", routeApi.ByProvider)
-			route.POST("/playground", routeApi.Playground)
-		}
-
-		file := v1.Group("/file")
-		{
-			file.GET("/list", fileApi.List)
-			file.GET("/content", fileApi.Get)
-			file.PUT("/content", fileApi.Set)
-			file.POST("/content", fileApi.Set)
-			file.POST("/validate", fileApi.Validate)
-		}
-
-		homepage := v1.Group("/homepage")
-		{
-			homepage.GET("/categories", homepageApi.Categories)
-			homepage.GET("/items", homepageApi.Items)
-			homepage.POST("/set/item", homepageApi.SetItem)
-			homepage.POST("/set/items_batch", homepageApi.SetItemsBatch)
-			homepage.POST("/set/item_visible", homepageApi.SetItemVisible)
-			homepage.POST("/set/item_favorite", homepageApi.SetItemFavorite)
-			homepage.POST("/set/item_sort_order", homepageApi.SetItemSortOrder)
-			homepage.POST("/set/item_all_sort_order", homepageApi.SetItemAllSortOrder)
-			homepage.POST("/set/item_fav_sort_order", homepageApi.SetItemFavSortOrder)
-			homepage.POST("/set/category_order", homepageApi.SetCategoryOrder)
-			homepage.POST("/item_click", homepageApi.ItemClick)
-		}
-
-		cert := v1.Group("/cert")
-		{
-			cert.GET("/info", certApi.Info)
-			cert.GET("/renew", certApi.Renew)
-		}
-
-		agent := v1.Group("/agent")
-		{
-			agent.GET("/list", agentApi.List)
-			agent.POST("/create", agentApi.Create)
-			agent.POST("/verify", agentApi.Verify)
-		}
-
-		metrics := v1.Group("/metrics")
-		{
-			metrics.GET("/system_info", metricsApi.SystemInfo)
-			metrics.GET("/all_system_info", metricsApi.AllSystemInfo)
-			metrics.GET("/uptime", metricsApi.Uptime)
-		}
-
-		docker := v1.Group("/docker")
-		{
-			docker.GET("/container/:id", dockerApi.GetContainer)
-			docker.GET("/containers", dockerApi.Containers)
-			docker.GET("/info", dockerApi.Info)
-			docker.GET("/logs/:id", dockerApi.Logs)
-			docker.POST("/start", dockerApi.Start)
-			docker.POST("/stop", dockerApi.Stop)
-			docker.POST("/restart", dockerApi.Restart)
-		}
-	}
-
-	return r
-}
-
-func NoCache() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		// skip cache if Cache-Control header is set
-		if c.Writer.Header().Get("Cache-Control") == "" {
-			c.Header("Cache-Control", "no-cache, no-store, must-revalidate")
-			c.Header("Pragma", "no-cache")
-			c.Header("Expires", "0")
-		}
-		c.Next()
-	}
-}
-
-func AuthMiddleware() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		err := auth.GetDefaultAuth().CheckToken(c.Request)
-		if err != nil {
-			c.JSON(http.StatusUnauthorized, apitypes.Error("Unauthorized", err))
-			c.Abort()
-			return
-		}
-		c.Next()
-	}
-}
-
-func SkipOriginCheckMiddleware() gin.HandlerFunc {
-	upgrader := &websocket.Upgrader{
-		CheckOrigin: func(r *http.Request) bool {
-			return true
-		},
-	}
-	return func(c *gin.Context) {
-		c.Set("upgrader", upgrader)
-		c.Next()
-	}
-}
-
-func ErrorHandler() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		c.Next()
-		if len(c.Errors) > 0 {
-			logger := log.With().Str("uri", c.Request.RequestURI).Logger()
-			for _, err := range c.Errors {
-				gperr.LogError("Internal error", err.Err, &logger)
+	defaultAuth := auth.GetDefaultAuth()
+	if defaultAuth != nil {
+		mux.HandleFunc("GET", "/v1/auth/redirect", defaultAuth.RedirectLoginPage)
+		mux.HandleFunc("GET", "/v1/auth/check", func(w http.ResponseWriter, r *http.Request) {
+			if err := defaultAuth.CheckToken(r); err != nil {
+				http.Error(w, err.Error(), http.StatusUnauthorized)
+				return
 			}
-			if !c.IsWebsocket() {
-				c.JSON(http.StatusInternalServerError, apitypes.Error("Internal server error"))
-			}
-		}
+		})
+		mux.HandleFunc("GET,POST", "/v1/auth/callback", defaultAuth.LoginCallbackHandler)
+		mux.HandleFunc("GET,POST", "/v1/auth/logout", defaultAuth.LogoutCallbackHandler)
+	} else {
+		mux.HandleFunc("GET", "/v1/auth/check", func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		})
 	}
-}
-
-func ErrorLoggingMiddleware() gin.HandlerFunc {
-	return gin.CustomRecoveryWithWriter(nil, func(c *gin.Context, err any) {
-		log.Error().Any("error", err).Str("uri", c.Request.RequestURI).Msg("Internal error")
-		if !c.IsWebsocket() {
-			c.JSON(http.StatusInternalServerError, apitypes.Error("Internal server error"))
-		}
-	})
+	return mux
 }

internal/api/v1/README.md

@@ -1,197 +0,0 @@
-# API v1 Package
-
-Implements the v1 REST API handlers for GoDoxy, exposing endpoints for managing routes, Docker containers, certificates, metrics, and system configuration.
-
-## Overview
-
-The `internal/api/v1` package implements the HTTP handlers that power GoDoxy's REST API. It uses the Gin web framework and provides endpoints for route management, container operations, certificate handling, system metrics, and configuration.
-
-### Primary Consumers
-
-- **WebUI**: The homepage dashboard and admin interface consume these endpoints
-
-### Non-goals
-
-- Authentication and authorization logic (delegated to `internal/auth`)
-- Route proxying and request handling (handled by `internal/route`)
-- Docker container lifecycle management (delegated to `internal/docker`)
-- Certificate issuance and storage (handled by `internal/autocert`)
-
-### Stability
-
-This package is stable. Public API endpoints follow semantic versioning for request/response contracts. Internal implementation may change between minor versions.
-
-## Public API
-
-### Exported Types
-
-Types are defined in `goutils/apitypes`:
-
-| Type                       | Purpose                          |
-| -------------------------- | -------------------------------- |
-| `apitypes.ErrorResponse`   | Standard error response format   |
-| `apitypes.SuccessResponse` | Standard success response format |
-
-### Handler Subpackages
-
-| Package    | Purpose                                        |
-| ---------- | ---------------------------------------------- |
-| `route`    | Route listing, details, and playground testing |
-| `docker`   | Docker container management and monitoring     |
-| `cert`     | Certificate information and renewal            |
-| `metrics`  | System metrics and uptime information          |
-| `homepage` | Homepage items and category management         |
-| `file`     | Configuration file read/write operations       |
-| `auth`     | Authentication and session management          |
-| `agent`    | Remote agent creation and management           |
-
-## Architecture
-
-### Handler Organization
-
-Package structure mirrors the API endpoint paths (e.g., `auth/login.go` handles `/auth/login`).
-
-### Request Flow
-
-```mermaid
-sequenceDiagram
-    participant Client
-    participant GinRouter
-    participant Handler
-    participant Service
-    participant Response
-
-    Client->>GinRouter: HTTP Request
-    GinRouter->>Handler: Route to handler
-    Handler->>Service: Call service layer
-    Service-->>Handler: Data or error
-    Handler->>Response: Format JSON response
-    Response-->>Client: JSON or redirect
-```
-
-## Configuration Surface
-
-API listening address is configured with `GODOXY_API_ADDR` environment variable.
-
-## Dependency and Integration Map
-
-### Internal Dependencies
-
-| Package                 | Purpose                     |
-| ----------------------- | --------------------------- |
-| `internal/route/routes` | Route storage and iteration |
-| `internal/docker`       | Docker client management    |
-| `internal/config`       | Configuration access        |
-| `internal/metrics`      | System metrics collection   |
-| `internal/homepage`     | Homepage item generation    |
-| `internal/agentpool`    | Remote agent management     |
-| `internal/auth`         | Authentication services     |
-
-### External Dependencies
-
-| Package                        | Purpose                     |
-| ------------------------------ | --------------------------- |
-| `github.com/gin-gonic/gin`     | HTTP routing and middleware |
-| `github.com/gorilla/websocket` | WebSocket support           |
-| `github.com/moby/moby/client`  | Docker API client           |
-
-## Observability
-
-### Logs
-
-Handlers log at `INFO` level for requests and `ERROR` level for failures. Logs include:
-
-- Request path and method
-- Response status code
-- Error details (when applicable)
-
-### Metrics
-
-No dedicated metrics exposed by handlers. Request metrics collected by middleware.
-
-## Security Considerations
-
-- All endpoints (except `/api/v1/version`) require authentication
-- Input validation using Gin binding tags
-- Path traversal prevention in file operations
-- WebSocket connections use same auth middleware as HTTP
-
-## Failure Modes and Recovery
-
-| Failure                             | Behavior                                   |
-| ----------------------------------- | ------------------------------------------ |
-| Docker host unreachable             | Returns partial results with errors logged |
-| Certificate provider not configured | Returns 404                                |
-| Invalid request body                | Returns 400 with error details             |
-| Authentication failure              | Returns 302 redirect to login              |
-| Agent not found                     | Returns 404                                |
-
-## Usage Examples
-
-### Listing All Routes via WebSocket
-
-```go
-import (
-    "github.com/gorilla/websocket"
-)
-
-func watchRoutes(provider string) error {
-    url := "ws://localhost:8888/api/v1/route/list"
-    if provider != "" {
-        url += "?provider=" + provider
-    }
-
-    conn, _, err := websocket.DefaultDialer.Dial(url, nil)
-    if err != nil {
-        return err
-    }
-    defer conn.Close()
-
-    for {
-        _, message, err := conn.ReadMessage()
-        if err != nil {
-            return err
-        }
-        // message contains JSON array of routes
-        processRoutes(message)
-    }
-}
-```
-
-### Getting Container Status
-
-```go
-import (
-    "encoding/json"
-    "net/http"
-)
-
-type Container struct {
-    Server string `json:"server"`
-    Name   string `json:"name"`
-    ID     string `json:"id"`
-    Image  string `json:"image"`
-}
-
-func listContainers() ([]Container, error) {
-    resp, err := http.Get("http://localhost:8888/api/v1/docker/containers")
-    if err != nil {
-        return nil, err
-    }
-    defer resp.Body.Close()
-
-    var containers []Container
-    if err := json.NewDecoder(resp.Body).Decode(&containers); err != nil {
-        return nil, err
-    }
-    return containers, nil
-}
-```
-
-### Health Check
-
-```bash
-curl http://localhost:8888/health
-```
-
-)

internal/api/v1/agent/common.go

@@ -1,67 +0,0 @@
-package agentapi
-
-import (
-	"crypto/rand"
-	"encoding/base64"
-	"sync/atomic"
-	"time"
-
-	"github.com/rs/zerolog/log"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-)
-
-type PEMPairResponse struct {
-	Cert string `json:"cert" format:"base64"`
-	Key  string `json:"key" format:"base64"`
-} // @name PEMPairResponse
-
-var encryptionKey atomic.Value
-
-const rotateKeyInterval = 15 * time.Minute
-
-func init() {
-	if err := rotateKey(); err != nil {
-		log.Panic().Err(err).Msg("failed to generate encryption key")
-	}
-	go func() {
-		for range time.Tick(rotateKeyInterval) {
-			if err := rotateKey(); err != nil {
-				log.Error().Err(err).Msg("failed to rotate encryption key")
-			}
-		}
-	}()
-}
-
-func getEncryptionKey() []byte {
-	return encryptionKey.Load().([]byte)
-}
-
-func rotateKey() error {
-	// generate a random 32 bytes key
-	key := make([]byte, 32)
-	if _, err := rand.Read(key); err != nil {
-		return err
-	}
-	encryptionKey.Store(key)
-	return nil
-}
-
-func toPEMPairResponse(encPEMPair agent.PEMPair) PEMPairResponse {
-	return PEMPairResponse{
-		Cert: base64.StdEncoding.EncodeToString(encPEMPair.Cert),
-		Key:  base64.StdEncoding.EncodeToString(encPEMPair.Key),
-	}
-}
-
-func fromEncryptedPEMPairResponse(pemPair PEMPairResponse) (agent.PEMPair, error) {
-	encCert, err := base64.StdEncoding.DecodeString(pemPair.Cert)
-	if err != nil {
-		return agent.PEMPair{}, err
-	}
-	encKey, err := base64.StdEncoding.DecodeString(pemPair.Key)
-	if err != nil {
-		return agent.PEMPair{}, err
-	}
-	pair := agent.PEMPair{Cert: encCert, Key: encKey}
-	return pair.Decrypt(getEncryptionKey())
-}

internal/api/v1/agent/create.go

@@ -1,108 +0,0 @@
-package agentapi
-
-import (
-	"net"
-	"net/http"
-	"strconv"
-
-	_ "embed"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/godoxy/internal/agentpool"
-	apitypes "github.com/yusing/goutils/apitypes"
-)
-
-type NewAgentRequest struct {
-	Name             string                 `json:"name" binding:"required"`
-	Host             string                 `json:"host" binding:"required"`
-	Port             int                    `json:"port" binding:"required,min=1,max=65535"`
-	Type             string                 `json:"type" binding:"required,oneof=docker system"`
-	Nightly          bool                   `json:"nightly" binding:"omitempty"`
-	ContainerRuntime agent.ContainerRuntime `json:"container_runtime" binding:"omitempty,oneof=docker podman" default:"docker"`
-} // @name NewAgentRequest
-
-type NewAgentResponse struct {
-	Compose string          `json:"compose"`
-	CA      PEMPairResponse `json:"ca"`
-	Client  PEMPairResponse `json:"client"`
-} // @name NewAgentResponse
-
-// @x-id				"create"
-// @BasePath		/api/v1
-// @Summary		Create a new agent
-// @Description	Create a new agent and return the docker compose file, encrypted CA and client PEMs
-// @Description	The returned PEMs are encrypted with a random key and will be used for verification when adding a new agent
-// @Tags			agent
-// @Accept			json
-// @Produce		json
-// @Param			request	body		NewAgentRequest	true	"Request"
-// @Success		200		{object}	NewAgentResponse
-// @Failure		400		{object}	apitypes.ErrorResponse
-// @Failure		403		{object}	apitypes.ErrorResponse
-// @Failure		409		{object}	apitypes.ErrorResponse
-// @Failure		500		{object}	apitypes.ErrorResponse
-// @Router			/agent/create [post]
-func Create(c *gin.Context) {
-	var request NewAgentRequest
-	if err := c.ShouldBindJSON(&request); err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
-		return
-	}
-
-	hostport := net.JoinHostPort(request.Host, strconv.Itoa(request.Port))
-	if _, ok := agentpool.Get(hostport); ok {
-		c.JSON(http.StatusConflict, apitypes.Error("agent already exists"))
-		return
-	}
-
-	var image string
-	if request.Nightly {
-		image = agent.DockerImageNightly
-	} else {
-		image = agent.DockerImageProduction
-	}
-
-	ca, srv, client, err := agent.NewAgent()
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to create agent"))
-		return
-	}
-
-	var cfg agent.Generator = &agent.AgentEnvConfig{
-		Name:             request.Name,
-		Port:             request.Port,
-		CACert:           ca.String(),
-		SSLCert:          srv.String(),
-		ContainerRuntime: request.ContainerRuntime,
-	}
-	if request.Type == "docker" {
-		cfg = &agent.AgentComposeConfig{
-			Image:          image,
-			AgentEnvConfig: cfg.(*agent.AgentEnvConfig),
-		}
-	}
-	template, err := cfg.Generate()
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to generate agent config"))
-		return
-	}
-
-	key := getEncryptionKey()
-	encCA, err := ca.Encrypt(key)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to encrypt CA PEMs"))
-		return
-	}
-	encClient, err := client.Encrypt(key)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to encrypt client PEMs"))
-		return
-	}
-
-	c.JSON(http.StatusOK, NewAgentResponse{
-		Compose: template,
-		CA:      toPEMPairResponse(encCA),
-		Client:  toPEMPairResponse(encClient),
-	})
-}

internal/api/v1/agent/list.go

@@ -1,33 +0,0 @@
-package agentapi
-
-import (
-	"net/http"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/internal/agentpool"
-	"github.com/yusing/goutils/http/httpheaders"
-	"github.com/yusing/goutils/http/websocket"
-
-	_ "github.com/yusing/goutils/apitypes"
-)
-
-// @x-id				"list"
-// @BasePath		/api/v1
-// @Summary		List agents
-// @Description	List agents
-// @Tags			agent,websocket
-// @Accept			json
-// @Produce		json
-// @Success		200	{array}		agent.AgentConfig
-// @Failure		403	{object}	apitypes.ErrorResponse
-// @Router			/agent/list [get]
-func List(c *gin.Context) {
-	if httpheaders.IsWebsocket(c.Request.Header) {
-		websocket.PeriodicWrite(c, 10*time.Second, func() (any, error) {
-			return agentpool.List(), nil
-		})
-	} else {
-		c.JSON(http.StatusOK, agentpool.List())
-	}
-}

internal/api/v1/agent/verify.go

@@ -1,125 +0,0 @@
-package agentapi
-
-import (
-	"fmt"
-	"net/http"
-	"os"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/agent/pkg/agent"
-	"github.com/yusing/godoxy/agent/pkg/certs"
-	"github.com/yusing/godoxy/internal/agentpool"
-	config "github.com/yusing/godoxy/internal/config/types"
-	"github.com/yusing/godoxy/internal/route/provider"
-	apitypes "github.com/yusing/goutils/apitypes"
-	gperr "github.com/yusing/goutils/errs"
-)
-
-type VerifyNewAgentRequest struct {
-	Host             string                 `json:"host"`
-	CA               PEMPairResponse        `json:"ca"`
-	Client           PEMPairResponse        `json:"client"`
-	ContainerRuntime agent.ContainerRuntime `json:"container_runtime"`
-} // @name VerifyNewAgentRequest
-
-// @x-id          "verify"
-// @BasePath		/api/v1
-// @Summary		Verify a new agent
-// @Description	Verify a new agent and return the number of routes added
-// @Tags			agent
-// @Accept			json
-// @Produce		json
-// @Param			request	body		VerifyNewAgentRequest	true	"Request"
-// @Success		200		{object}	SuccessResponse
-// @Failure		400		{object}	ErrorResponse
-// @Failure		403		{object}	ErrorResponse
-// @Failure		500		{object}	ErrorResponse
-// @Router			/agent/verify [post]
-func Verify(c *gin.Context) {
-	var request VerifyNewAgentRequest
-	if err := c.ShouldBindJSON(&request); err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
-		return
-	}
-
-	filename, ok := certs.AgentCertsFilepath(request.Host)
-	if !ok {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid host", nil))
-		return
-	}
-
-	ca, err := fromEncryptedPEMPairResponse(request.CA)
-	if err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid CA", err))
-		return
-	}
-
-	client, err := fromEncryptedPEMPairResponse(request.Client)
-	if err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid client", err))
-		return
-	}
-
-	nRoutesAdded, err := verifyNewAgent(request.Host, ca, client, request.ContainerRuntime)
-	if err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
-		return
-	}
-
-	zip, err := certs.ZipCert(ca.Cert, client.Cert, client.Key)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to zip certs"))
-		return
-	}
-
-	if err := os.WriteFile(filename, zip, 0o600); err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to write certs"))
-		return
-	}
-
-	c.JSON(http.StatusOK, apitypes.Success(fmt.Sprintf("Added %d routes", nRoutesAdded)))
-}
-
-var errAgentAlreadyExists = gperr.New("agent already exists")
-
-func verifyNewAgent(host string, ca agent.PEMPair, client agent.PEMPair, containerRuntime agent.ContainerRuntime) (int, gperr.Error) {
-	var agentCfg agent.AgentConfig
-	agentCfg.Addr = host
-	agentCfg.Runtime = containerRuntime
-
-	// check if agent host exists in the config
-	cfgState := config.ActiveState.Load()
-	for _, a := range cfgState.Value().Providers.Agents {
-		if a.Addr == host {
-			return 0, errAgentAlreadyExists
-		}
-	}
-	// check if agent host exists in the agent pool
-	if agentpool.Has(&agentCfg) {
-		return 0, errAgentAlreadyExists
-	}
-
-	err := agentCfg.InitWithCerts(cfgState.Context(), ca.Cert, client.Cert, client.Key)
-	if err != nil {
-		return 0, gperr.Wrap(err, "failed to initialize agent config")
-	}
-
-	provider := provider.NewAgentProvider(&agentCfg)
-	if _, loaded := cfgState.LoadOrStoreProvider(provider.String(), provider); loaded {
-		return 0, gperr.Errorf("provider %s already exists", provider.String())
-	}
-
-	// agent must be added before loading routes
-	added := agentpool.Add(&agentCfg)
-	if !added {
-		return 0, errAgentAlreadyExists
-	}
-	err = provider.LoadRoutes()
-	if err != nil {
-		cfgState.DeleteProvider(provider.String())
-		agentpool.Remove(&agentCfg)
-		return 0, gperr.Wrap(err, "failed to load routes")
-	}
-
-	return provider.NumRoutes(), nil
-}

internal/api/v1/agents.go

@@ -0,0 +1,14 @@
+package v1
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/yusing/go-proxy/agent/pkg/agent"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/net/gphttp/gpwebsocket"
+)
+
+func ListAgents(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
+	gpwebsocket.DynamicJSONHandler(w, r, agent.Agents.Slice, 10*time.Second)
+}

internal/api/v1/auth/auth.go

@@ -0,0 +1,52 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/net/gphttp"
+)
+
+var defaultAuth Provider
+
+// Initialize sets up authentication providers.
+func Initialize() error {
+	if !IsEnabled() {
+		return nil
+	}
+
+	var err error
+	// Initialize OIDC if configured.
+	if common.OIDCIssuerURL != "" {
+		defaultAuth, err = NewOIDCProviderFromEnv()
+	} else {
+		defaultAuth, err = NewUserPassAuthFromEnv()
+	}
+
+	return err
+}
+
+func GetDefaultAuth() Provider {
+	return defaultAuth
+}
+
+func IsEnabled() bool {
+	return !common.DebugDisableAuth && (common.APIJWTSecret != nil || IsOIDCEnabled())
+}
+
+func IsOIDCEnabled() bool {
+	return common.OIDCIssuerURL != ""
+}
+
+func RequireAuth(next http.HandlerFunc) http.HandlerFunc {
+	if IsEnabled() {
+		return func(w http.ResponseWriter, r *http.Request) {
+			if err := defaultAuth.CheckToken(r); err != nil {
+				gphttp.ClientError(w, err, http.StatusUnauthorized)
+			} else {
+				next(w, r)
+			}
+		}
+	}
+	return next
+}