fix(stream): update ToHeader function to accept pointer to header buffer and return copy

chore: update pion/dtls related deps
feat(agent): agent stream tunneling with TLS and dTLS (UDP)
2026-02-07 11:09:32 +01:00 · 2026-01-09 10:46:23 +08:00 · 2026-01-09 10:42:13 +08:00 · 2026-01-09 10:30:51 +08:00
164 changed files with 2492 additions and 8667 deletions
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -45,37 +45,11 @@ jobs:
      attestations: write

    steps:
-      - name: Checkout (for tag resolution)
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
      - name: Prepare
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

-      - name: Compute VERSION for build
-        run: |
-          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
-            version="${GITHUB_REF_NAME}"
-            cache_variant="release"
-          elif [ "${GITHUB_REF_NAME}" = "main" ] || [ "${GITHUB_REF_NAME}" = "compat" ]; then
-            git fetch --tags origin main
-            version="$(git describe --tags --abbrev=0 origin/main 2>/dev/null || git describe --tags --abbrev=0 main 2>/dev/null || echo v0.0.0)"
-            cache_variant="${GITHUB_REF_NAME}"
-          else
-            version="v$(date -u +'%Y%m%d-%H%M')"
-            cache_variant="nightly"
-          fi
-          echo "VERSION_FOR_BUILD=$version" >> $GITHUB_ENV
-          echo "CACHE_VARIANT=$cache_variant" >> $GITHUB_ENV
-          if [ "${GITHUB_REF_TYPE}" = "branch" ]; then
-            echo "BRANCH_FOR_BUILD=${GITHUB_REF_NAME}" >> $GITHUB_ENV
-          else
-            echo "BRANCH_FOR_BUILD=" >> $GITHUB_ENV
-          fi
-
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
@@ -106,15 +80,14 @@ jobs:
          file: ${{ env.DOCKERFILE }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ inputs.image_name }},push-by-digest=true,name-canonical=true,push=true
          cache-from: |
-            type=gha,scope=${{ github.workflow }}-${{ env.CACHE_VARIANT }}-${{ env.PLATFORM_PAIR }}
-            type=registry,ref=${{ env.REGISTRY }}/${{ inputs.image_name }}:buildcache-${{ env.CACHE_VARIANT }}-${{ env.PLATFORM_PAIR }}
+            type=registry,ref=${{ env.REGISTRY }}/${{ inputs.image_name }}:buildcache-${{ env.PLATFORM_PAIR }}
+          # type=gha,scope=${{ github.workflow }}-${{ env.PLATFORM_PAIR }}
          cache-to: |
-            type=gha,scope=${{ github.workflow }}-${{ env.CACHE_VARIANT }}-${{ env.PLATFORM_PAIR }},mode=max
-            type=registry,ref=${{ env.REGISTRY }}/${{ inputs.image_name }}:buildcache-${{ env.CACHE_VARIANT }}-${{ env.PLATFORM_PAIR }},mode=max
+            type=registry,ref=${{ env.REGISTRY }}/${{ inputs.image_name }}:buildcache-${{ env.PLATFORM_PAIR }},mode=max
+          # type=gha,scope=${{ github.workflow }}-${{ env.PLATFORM_PAIR }},mode=max
          build-args: |
-            VERSION=${{ env.VERSION_FOR_BUILD }}
+            VERSION=${{ github.ref_name }}
            MAKE_ARGS=${{ env.MAKE_ARGS }}
-            BRANCH=${{ env.BRANCH_FOR_BUILD }}

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v1
--- a/.gitignore
+++ b/.gitignore
@@ -40,8 +40,4 @@ tsconfig.tsbuildinfo

 !agent.compose.yml
 !agent/pkg/**
-dev-data/
-
-RELEASE_NOTES.md
-CLAUDE.md
-.kilocode/**
+dev-data/
--- a/.gitmodules
+++ b/.gitmodules
@@ -7,6 +7,3 @@
 [submodule "goutils"]
 	path = goutils
 	url = https://github.com/yusing/goutils.git
-[submodule "internal/go-proxmox"]
-	path = internal/go-proxmox
-	url = https://github.com/yusing/go-proxmox
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -1,128 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity
-and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
-  overall community
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or
-  advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
-  address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-yusing@6uo.me.
-All complaints will be reviewed and investigated promptly and fairly.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series
-of actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
-
-Community Impact Guidelines were inspired by [Mozilla's code of conduct
-enforcement ladder](https://github.com/mozilla/diversity).
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.
--- a/6
+++ b/6
@@ -1,5 +1,5 @@
 # Stage 1: deps
-FROM golang:1.25.6-alpine AS deps
+FROM golang:1.25.5-alpine AS deps
 HEALTHCHECK NONE

 # package version does not matter
@@ -14,7 +14,6 @@ WORKDIR /src
 COPY goutils/go.mod goutils/go.sum ./goutils/
 COPY internal/go-oidc/go.mod internal/go-oidc/go.sum ./internal/go-oidc/
 COPY internal/gopsutil/go.mod internal/gopsutil/go.sum ./internal/gopsutil/
-COPY internal/go-proxmox/go.mod internal/go-proxmox/go.sum ./internal/go-proxmox/
 COPY go.mod go.sum ./

 # remove godoxy stuff from go.mod first
@@ -44,9 +43,6 @@ ENV VERSION=${VERSION}
 ARG MAKE_ARGS
 ENV MAKE_ARGS=${MAKE_ARGS}

-ARG BRANCH
-ENV BRANCH=${BRANCH}
-
 RUN --mount=type=cache,target=/root/.cache/go-build \
  --mount=type=cache,target=/root/go/pkg/mod \
  make ${MAKE_ARGS} docker=1 build
--- a/19
+++ b/19
@@ -1,20 +1,12 @@
 shell := /bin/sh
 export VERSION ?= $(shell git describe --tags --abbrev=0)
-export BRANCH ?= $(shell git rev-parse --abbrev-ref HEAD)
 export BUILD_DATE ?= $(shell date -u +'%Y%m%d-%H%M')
 export GOOS = linux

-REPO_URL ?= https://github.com/yusing/godoxy
-
 WEBUI_DIR ?= ../godoxy-webui
 DOCS_DIR ?= ${WEBUI_DIR}/wiki

-ifneq ($(BRANCH), compat)
-	GO_TAGS = sonic
-else
-	GO_TAGS =
-endif
-
+GO_TAGS = sonic
 LDFLAGS = -X github.com/yusing/goutils/version.version=${VERSION} -checklinkname=0

 ifeq ($(agent), 1)
@@ -92,7 +84,7 @@ docker-build-test:

 go_ver := $(shell go version | cut -d' ' -f3 | cut -d'o' -f2)
 files := $(shell find . -name go.mod -type f -or -name Dockerfile -type f)
-gomod_paths := $(shell find . -name go.mod -type f | grep -vE '^./internal/(go-oidc|go-proxmox|gopsutil)/' | xargs dirname)
+gomod_paths := $(shell find . -name go.mod -type f | xargs dirname)

 update-go:
 	for file in ${files}; do \
@@ -143,6 +135,9 @@ benchmark:
 dev-run: build
 	cd dev-data && ${BIN_PATH}

+mtrace:
+	 ${BIN_PATH} debug-ls-mtrace > mtrace.json
+
 rapid-crash:
 	docker run --restart=always --name test_crash -p 80 debian:bookworm-slim /bin/cat &&\
 	sleep 3 &&\
@@ -159,7 +154,7 @@ cloc:
 	scc -w -i go --not-match '_test.go$$'

 push-github:
-	git push origin $(BRANCH)
+	git push origin $(shell git rev-parse --abbrev-ref HEAD)

 gen-swagger:
  # go install github.com/swaggo/swag/cmd/swag@latest
@@ -180,4 +175,4 @@ gen-api-types: gen-swagger

 .PHONY: update-wiki
 update-wiki:
-	DOCS_DIR=${DOCS_DIR} REPO_URL=${REPO_URL} bun --bun scripts/update-wiki/main.ts
+	DOCS_DIR=${DOCS_DIR} bun --bun scripts/update-wiki/main.ts
--- a/README.md
+++ b/README.md
@@ -33,10 +33,6 @@ Have questions? Ask [ChatGPT](https://chatgpt.com/g/g-6825390374b481919ad482f2e4
 - [Prerequisites](#prerequisites)
 - [Setup](#setup)
 - [How does GoDoxy work](#how-does-godoxy-work)
- [Proxmox Integration](#proxmox-integration)
-  - [Automatic Route Binding](#automatic-route-binding)
-  - [WebUI Management](#webui-management)
-  - [API Endpoints](#api-endpoints)
 - [Update / Uninstall system agent](#update--uninstall-system-agent)
 - [Screenshots](#screenshots)
  - [idlesleeper](#idlesleeper)
@@ -50,6 +46,8 @@ Have questions? Ask [ChatGPT](https://chatgpt.com/g/g-6825390374b481919ad482f2e4

 <https://demo.godoxy.dev>

+[![Deployed on Zeabur](https://zeabur.com/deployed-on-zeabur-dark.svg)](https://zeabur.com/referral?referralCode=yusing&utm_source=yusing&utm_campaign=oss)
+
 ## Key Features

 - **Simple**
@@ -71,11 +69,7 @@ Have questions? Ask [ChatGPT](https://chatgpt.com/g/g-6825390374b481919ad482f2e4
  - Podman
 - **Idle-sleep**: stop and wake containers based on traffic _(see [screenshots](#idlesleeper))_
  - Docker containers
-  - Proxmox LXC containers
- **Proxmox Integration**
-  - **Automatic route binding**: Routes automatically bind to Proxmox nodes or LXC containers by matching hostname, IP, or alias
-  - **LXC lifecycle control**: Start, stop, restart containers directly from WebUI
-  - **Real-time logs**: Stream journalctl logs from nodes and LXC containers via WebSocket
+  - Proxmox LXCs
 - **Traffic Management**
  - HTTP reserve proxy
  - TCP/UDP port forwarding
@@ -88,12 +82,7 @@ Have questions? Ask [ChatGPT](https://chatgpt.com/g/g-6825390374b481919ad482f2e4
  - App Dashboard
  - Config Editor
  - Uptime and System Metrics
-  - **Docker**
-    - Container lifecycle management (start, stop, restart)
-    - Real-time container logs via WebSocket
-  - **Proxmox**
-    - LXC container lifecycle management (start, stop, restart)
-    - Real-time node and LXC journalctl logs via WebSocket
+  - Docker Logs Viewer
 - **Cross-Platform support**
  - Supports **linux/amd64** and **linux/arm64**
 - **Efficient and Performant**
@@ -141,50 +130,6 @@ Configure Wildcard DNS Record(s) to point to machine running `GoDoxy`, e.g.
 >
 > For example, with the label `proxy.aliases: qbt` you can access your app via `qbt.domain.com`.

-## Proxmox Integration
-
-GoDoxy can automatically discover and manage Proxmox nodes and LXC containers through configured providers.
-
-### Automatic Route Binding
-
-Routes are automatically linked to Proxmox resources through reverse lookup:
-
-1. **Node-level routes** (VMID = 0): When hostname, IP, or alias matches a Proxmox node name or IP
-2. **Container-level routes** (VMID > 0): When hostname, IP, or alias matches an LXC container
-
-This enables seamless proxy configuration without manual binding:
-
-```yaml
-routes:
-  pve-node-01:
-    host: pve-node-01.internal
-    port: 8006
-    # Automatically links to Proxmox node pve-node-01
-```
-
-### WebUI Management
-
-From the WebUI, you can:
-
- **LXC Lifecycle Control**: Start, stop, restart containers
- **Node Logs**: Stream real-time journalctl output from nodes
- **LXC Logs**: Stream real-time journalctl output from containers
-
-### API Endpoints
-
-```http
-# Node journalctl (WebSocket)
-GET /api/v1/proxmox/journalctl/:node
-
-# LXC journalctl (WebSocket)
-GET /api/v1/proxmox/journalctl/:node/:vmid
-
-# LXC lifecycle control
-POST /api/v1/proxmox/lxc/:node/:vmid/start
-POST /api/v1/proxmox/lxc/:node/:vmid/stop
-POST /api/v1/proxmox/lxc/:node/:vmid/restart
-```
-
 ## Update / Uninstall system agent

 Update:
--- a/README_CHT.md
+++ b/README_CHT.md
@@ -34,10 +34,6 @@
 - [安裝](#安裝)
  - [手動安裝](#手動安裝)
  - [資料夾結構](#資料夾結構)
- [Proxmox 整合](#proxmox-整合)
-  - [自動路由綁定](#自動路由綁定)
-  - [WebUI 管理](#webui-管理)
-  - [API 端點](#api-端點)
 - [更新 / 卸載系統代理 (System Agent)](#更新--卸載系統代理-system-agent)
 - [截圖](#截圖)
  - [閒置休眠](#閒置休眠)
@@ -49,6 +45,8 @@

 <https://demo.godoxy.dev>

+[![Deployed on Zeabur](https://zeabur.com/deployed-on-zeabur-dark.svg)](https://zeabur.com/referral?referralCode=yusing&utm_source=yusing&utm_campaign=oss)
+
 ## 主要特點

 - **簡單易用**
@@ -71,10 +69,6 @@
 - **閒置休眠**：根據流量停止和喚醒容器 _(參見[截圖](#閒置休眠))_
  - Docker 容器
  - Proxmox LXC 容器
- **Proxmox 整合**
-  - **自動路由綁定**：透過比對主機名稱、IP 或別名自動將路由綁定至 Proxmox 節點或 LXC 容器
-  - **LXC 生命週期控制**：可直接從 WebUI 啟動、停止、重新啟動容器
-  - **即時日誌**：透過 WebSocket 串流節點和 LXC 容器的 journalctl 日誌
 - **流量管理**
  - HTTP 反向代理
  - TCP/UDP 連接埠轉送
@@ -87,12 +81,7 @@
  - 應用程式一覽
  - 設定編輯器
  - 執行時間與系統指標
-  - **Docker**
-    - 容器生命週期管理 (啟動、停止、重新啟動)
-    - 透過 WebSocket 即時串流容器日誌
-  - **Proxmox**
-    - LXC 容器生命週期管理 (啟動、停止、重新啟動)
-    - 透過 WebSocket 即時串流節點和 LXC 容器 journalctl 日誌
+  - Docker 日誌檢視器
 - **跨平台支援**
  - 支援 **linux/amd64** 與 **linux/arm64**
 - **高效能**
@@ -157,50 +146,6 @@
 └── .env
 ```

-## Proxmox 整合
-
-GoDoxy 可透過配置的提供者自動探索和管理 Proxmox 節點和 LXC 容器。
-
-### 自動路由綁定
-
-路由透過反向查詢自動連結至 Proxmox 資源：
-
-1. **節點級路由** (VMID = 0)：當主機名稱、IP 或別名符合 Proxmox 節點名稱或 IP 時
-2. **容器級路由** (VMID > 0)：當主機名稱、IP 或別名符合 LXC 容器時
-
-這可實現無需手動綁定的無縫代理配置：
-
-```yaml
-routes:
-  pve-node-01:
-    host: pve-node-01.internal
-    port: 8006
-    # 自動連結至 Proxmox 節點 pve-node-01
-```
-
-### WebUI 管理
-
-您可以從 WebUI：
-
- **LXC 生命週期控制**：啟動、停止、重新啟動容器
- **節點日誌**：串流來自節點的即時 journalctl 輸出
- **LXC 日誌**：串流來自容器的即時 journalctl 輸出
-
-### API 端點
-
-```http
-# 節點 journalctl (WebSocket)
-GET /api/v1/proxmox/journalctl/:node
-
-# LXC journalctl (WebSocket)
-GET /api/v1/proxmox/journalctl/:node/:vmid
-
-# LXC 生命週期控制
-POST /api/v1/proxmox/lxc/:node/:vmid/start
-POST /api/v1/proxmox/lxc/:node/:vmid/stop
-POST /api/v1/proxmox/lxc/:node/:vmid/restart
-```
-
 ## 更新 / 卸載系統代理 (System Agent)

 更新：
--- a/agent/cmd/main.go
+++ b/agent/cmd/main.go
@@ -9,8 +9,6 @@ import (
 	"net/http"
 	"os"

-	stdlog "log"
-
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"github.com/yusing/godoxy/agent/pkg/agent"
@@ -20,6 +18,7 @@ import (
 	"github.com/yusing/godoxy/internal/metrics/systeminfo"
 	socketproxy "github.com/yusing/godoxy/socketproxy/pkg"
 	gperr "github.com/yusing/goutils/errs"
+	httpServer "github.com/yusing/goutils/server"
 	strutils "github.com/yusing/goutils/strings"
 	"github.com/yusing/goutils/task"
 	"github.com/yusing/goutils/version"
@@ -146,19 +145,12 @@ Tips:
 		runtime := strutils.Title(string(env.Runtime))

 		log.Info().Msgf("%s socket listening on: %s", runtime, socketproxy.ListenAddr)
-		l, err := net.Listen("tcp", socketproxy.ListenAddr)
-		if err != nil {
-			gperr.LogFatal("failed to listen on port", err)
+		opts := httpServer.Options{
+			Name:     runtime,
+			HTTPAddr: socketproxy.ListenAddr,
+			Handler:  socketproxy.NewHandler(),
 		}
-		errLog := log.Logger.With().Str("level", "error").Str("component", "socketproxy").Logger()
-		srv := http.Server{
-			Handler: socketproxy.NewHandler(),
-			BaseContext: func(net.Listener) context.Context {
-				return t.Context()
-			},
-			ErrorLog: stdlog.New(&errLog, "", 0),
-		}
-		srv.Serve(l)
+		httpServer.StartServer(t, opts)
 	}

 	systeminfo.Poller.Start()
--- a/agent/go.mod
+++ b/agent/go.mod
@@ -1,11 +1,6 @@
 module github.com/yusing/godoxy/agent

-go 1.25.6
-
-exclude (
-	github.com/moby/moby/api v1.53.0 // allow older daemon versions
-	github.com/moby/moby/client v0.2.2 // allow older daemon versions
-)
+go 1.25.5

 replace (
 	github.com/shirou/gopsutil/v4 => ../internal/gopsutil
@@ -20,30 +15,34 @@ replace (
 exclude github.com/containerd/nerdctl/mod/tigron v0.0.0

 require (
-	github.com/bytedance/sonic v1.15.0
+	github.com/bytedance/sonic v1.14.2
 	github.com/gin-gonic/gin v1.11.0
 	github.com/gorilla/websocket v1.5.3
 	github.com/pion/dtls/v3 v3.0.10
 	github.com/pion/transport/v3 v3.1.1
 	github.com/rs/zerolog v1.34.0
 	github.com/stretchr/testify v1.11.1
-	github.com/yusing/godoxy v0.25.2
+	github.com/yusing/godoxy v0.0.0-00010101000000-000000000000
 	github.com/yusing/godoxy/socketproxy v0.0.0-00010101000000-000000000000
 	github.com/yusing/goutils v0.7.0
+	github.com/yusing/goutils/server v0.0.0-20260103043911-785deb23bd64
 )

 require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/PuerkitoBio/goquery v1.11.0 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
+	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/bytedance/gopkg v0.1.3 // indirect
-	github.com/bytedance/sonic/loader v0.5.0 // indirect
+	github.com/bytedance/sonic/loader v0.4.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudwego/base64x v0.1.6 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v29.2.0+incompatible // indirect
+	github.com/docker/cli v29.1.3+incompatible // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/ebitengine/purego v0.9.1 // indirect
@@ -57,12 +56,13 @@ require (
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.30.1 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
-	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/goccy/go-yaml v1.19.1 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 // indirect
-	github.com/klauspost/compress v1.18.3 // indirect
+	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/lithammer/fuzzysearch v1.1.8 // indirect
 	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -76,23 +76,28 @@ require (
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pion/logging v0.2.4 // indirect
 	github.com/pion/transport/v4 v4.0.1 // indirect
+	github.com/pires/go-proxyproto v0.8.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/puzpuzpuz/xsync/v4 v4.4.0 // indirect
+	github.com/puzpuzpuz/xsync/v4 v4.2.0 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.59.0 // indirect
+	github.com/quic-go/quic-go v0.58.0 // indirect
+	github.com/samber/lo v1.52.0 // indirect
+	github.com/samber/slog-common v0.19.0 // indirect
+	github.com/samber/slog-zerolog/v2 v2.9.0 // indirect
 	github.com/shirou/gopsutil/v4 v4.25.12 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
 	github.com/tklauser/go-sysconf v0.3.16 // indirect
 	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.1 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/valyala/fasthttp v1.69.0 // indirect
-	github.com/yusing/ds v0.4.1 // indirect
+	github.com/valyala/fasthttp v1.68.0 // indirect
+	github.com/vincent-petithory/dataurl v1.0.0 // indirect
+	github.com/yusing/ds v0.3.1 // indirect
 	github.com/yusing/gointernals v0.1.16 // indirect
-	github.com/yusing/goutils/http/reverseproxy v0.0.0-20260129081554-24e52ede7468 // indirect
-	github.com/yusing/goutils/http/websocket v0.0.0-20260129081554-24e52ede7468 // indirect
+	github.com/yusing/goutils/http/reverseproxy v0.0.0-20260103043911-785deb23bd64 // indirect
+	github.com/yusing/goutils/http/websocket v0.0.0-20260103043911-785deb23bd64 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
@@ -100,10 +105,10 @@ require (
 	go.opentelemetry.io/otel/metric v1.39.0 // indirect
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
 	golang.org/x/arch v0.23.0 // indirect
-	golang.org/x/crypto v0.47.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/crypto v0.46.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
--- a/agent/go.sum
+++ b/agent/go.sum
@@ -10,10 +10,10 @@ github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY=
 github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE=
 github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
 github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
-github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
-github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
-github.com/bytedance/sonic/loader v0.5.0 h1:gXH3KVnatgY7loH5/TkeVyXPfESoqSBSBEiDd5VjlgE=
-github.com/bytedance/sonic/loader v0.5.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
+github.com/bytedance/sonic v1.14.2 h1:k1twIoe97C1DtYUo+fZQy865IuHia4PR5RPiuGPPIIE=
+github.com/bytedance/sonic v1.14.2/go.mod h1:T80iDELeHiHKSc0C9tubFygiuXoGzrkjKzX2quAx980=
+github.com/bytedance/sonic/loader v0.4.0 h1:olZ7lEqcxtZygCK9EKYKADnpQoYkRQxaeY2NYzevs+o=
+github.com/bytedance/sonic/loader v0.4.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -37,8 +37,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v29.2.0+incompatible h1:9oBd9+YM7rxjZLfyMGxjraKBKE4/nVyvVfN4qNl9XRM=
-github.com/docker/cli v29.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.1.3+incompatible h1:+kz9uDWgs+mAaIZojWfFt4d53/jv0ZUOOoSh5ZnH36c=
+github.com/docker/cli v29.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
 github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -55,8 +55,8 @@ github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w
 github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
 github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
 github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
-github.com/go-acme/lego/v4 v4.31.0 h1:gd4oUYdfs83PR1/SflkNdit9xY1iul2I4EystnU8NXM=
-github.com/go-acme/lego/v4 v4.31.0/go.mod h1:m6zcfX/zcbMYDa8s6AnCMnoORWNP8Epnei+6NBCTUGs=
+github.com/go-acme/lego/v4 v4.30.1 h1:tmb6U0lvy8Mc3lQbqKwTat7oAhE8FUYNJ3D0gSg6pJU=
+github.com/go-acme/lego/v4 v4.30.1/go.mod h1:V7m/Ip+EeFkjOe028+zeH+SwWtESxw1LHelwMIfAjm4=
 github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
 github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -79,11 +79,12 @@ github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
-github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-yaml v1.19.1 h1:3rG3+v8pkhRqoQ/88NYNMHYVGYztCOCIZ7UQhu7H+NE=
+github.com/goccy/go-yaml v1.19.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
-github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -99,8 +100,8 @@ github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/Kgo2/7xNSUuC5G28VR8ljfrLKU2G4IjU=
 github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0=
-github.com/klauspost/compress v1.18.3 h1:9PJRvfbmTabkOX8moIpXPbMMbYN60bWImDDU7L+/6zw=
-github.com/klauspost/compress v1.18.3/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
+github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -113,8 +114,8 @@ github.com/lithammer/fuzzysearch v1.1.8 h1:/HIuJnjHuXS8bKaiTMeeDlW2/AyIWk2brx1V8
 github.com/lithammer/fuzzysearch v1.1.8/go.mod h1:IdqeyBClc3FFqSzYq/MXESsS4S0FsZ5ajtkr5xPLts4=
 github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIiZhtifTV5OUqqiP82UAl0h87xj/l9k=
 github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/luthermonson/go-proxmox v0.3.2 h1:/zUg6FCl9cAABx0xU3OIgtDtClY0gVXxOCsrceDNylc=
-github.com/luthermonson/go-proxmox v0.3.2/go.mod h1:oyFgg2WwTEIF0rP6ppjiixOHa5ebK1p8OaRiFhvICBQ=
+github.com/luthermonson/go-proxmox v0.3.1 h1:h64s4/zIEQ06TBo0phFKcckV441YpvUPgLfRAptYsjY=
+github.com/luthermonson/go-proxmox v0.3.1/go.mod h1:oyFgg2WwTEIF0rP6ppjiixOHa5ebK1p8OaRiFhvICBQ=
 github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
 github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
@@ -124,8 +125,8 @@ github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
-github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
+github.com/miekg/dns v1.1.69 h1:Kb7Y/1Jo+SG+a2GtfoFUfDkG//csdRPwRLkCsxDG9Sc=
+github.com/miekg/dns v1.1.69/go.mod h1:7OyjD9nEba5OkqQ/hB4fy3PIoxafSZJtducccIelz3g=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/moby/api v1.52.0 h1:00BtlJY4MXkkt84WhUZPRqt5TvPbgig2FZvTbe3igYg=
@@ -153,20 +154,20 @@ github.com/pion/transport/v3 v3.1.1 h1:Tr684+fnnKlhPceU+ICdrw6KKkTms+5qHMgw6bIkY
 github.com/pion/transport/v3 v3.1.1/go.mod h1:+c2eewC5WJQHiAA46fkMMzoYZSuGzA/7E2FPrOYHctQ=
 github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o=
 github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM=
-github.com/pires/go-proxyproto v0.9.2 h1:H1UdHn695zUVVmB0lQ354lOWHOy6TZSpzBl3tgN0s1U=
-github.com/pires/go-proxyproto v0.9.2/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
+github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
+github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/puzpuzpuz/xsync/v4 v4.4.0 h1:vlSN6/CkEY0pY8KaB0yqo/pCLZvp9nhdbBdjipT4gWo=
-github.com/puzpuzpuz/xsync/v4 v4.4.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
+github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
+github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
-github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/quic-go/quic-go v0.58.0 h1:ggY2pvZaVdB9EyojxL1p+5mptkuHyX5MOSv4dgWF4Ug=
+github.com/quic-go/quic-go v0.58.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
@@ -178,14 +179,15 @@ github.com/samber/slog-common v0.19.0 h1:fNcZb8B2uOLooeYwFpAlKjkQTUafdjfqKcwcC89
 github.com/samber/slog-common v0.19.0/go.mod h1:dTz+YOU76aH007YUU0DffsXNsGFQRQllPQh9XyNoA3M=
 github.com/samber/slog-zerolog/v2 v2.9.0 h1:6LkOabJmZdNLaUWkTC3IVVA+dq7b/V0FM6lz6/7+THI=
 github.com/samber/slog-zerolog/v2 v2.9.0/go.mod h1:gnQW9VnCfM34v2pRMUIGMsZOVbYLqY/v0Wxu6atSVGc=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
@@ -202,14 +204,15 @@ github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.69.0 h1:fNLLESD2SooWeh2cidsuFtOcrEi4uB4m1mPrkJMZyVI=
-github.com/valyala/fasthttp v1.69.0/go.mod h1:4wA4PfAraPlAsJ5jMSqCE2ug5tqUPwKXxVj8oNECGcw=
+github.com/valyala/fasthttp v1.68.0 h1:v12Nx16iepr8r9ySOwqI+5RBJ/DqTxhOy1HrHoDFnok=
+github.com/valyala/fasthttp v1.68.0/go.mod h1:5EXiRfYQAoiO/khu4oU9VISC/eVY6JqmSpPJoHCKsz4=
 github.com/vincent-petithory/dataurl v1.0.0 h1:cXw+kPto8NLuJtlMsI152irrVw9fRDX8AbShPRpg2CI=
 github.com/vincent-petithory/dataurl v1.0.0/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
-github.com/yusing/ds v0.4.1 h1:syMCh7hO6Yw8xfcFkEaln3W+lVeWB/U/meYv6Wf2/Ig=
-github.com/yusing/ds v0.4.1/go.mod h1:XhKV4l7cZwBbbl7lRzNC9zX27zvCM0frIwiuD40ULRk=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yusing/ds v0.3.1 h1:mCqTgTQD8RhiBpcysvii5kZ7ZBmqcknVsFubNALGLbY=
+github.com/yusing/ds v0.3.1/go.mod h1:XhKV4l7cZwBbbl7lRzNC9zX27zvCM0frIwiuD40ULRk=
 github.com/yusing/gointernals v0.1.16 h1:GrhZZdxzA+jojLEqankctJrOuAYDb7kY1C93S1pVR34=
 github.com/yusing/gointernals v0.1.16/go.mod h1:B/0FVXt4WPmgzVy3ynzkqKi+BSGaJVmwCJBRXYapo34=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
@@ -234,30 +237,93 @@ go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
 go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/arch v0.23.0 h1:lKF64A2jF6Zd8L0knGltUnegD62JMFBiCPBmQpToHhg=
 golang.org/x/arch v0.23.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
-golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
--- a/agent/pkg/agent/README.md
+++ b/agent/pkg/agent/README.md
@@ -27,26 +27,26 @@ graph TD

 ## File Structure

-| File                                     | Purpose                                                   |
-| ---------------------------------------- | --------------------------------------------------------- |
-| [`config.go`](config.go)                 | Core configuration, initialization, and API client logic. |
-| [`new_agent.go`](new_agent.go)           | Agent creation and certificate generation logic.          |
-| [`docker_compose.go`](docker_compose.go) | Generator for agent Docker Compose configurations.        |
-| [`bare_metal.go`](bare_metal.go)         | Generator for bare metal installation scripts.            |
-| [`env.go`](env.go)                       | Environment configuration types and constants.            |
-| `common/`                                | Shared constants and utilities for agents.                |
+| File                                                     | Purpose                                                   |
+| -------------------------------------------------------- | --------------------------------------------------------- |
+| [`config.go`](agent/pkg/agent/config.go)                 | Core configuration, initialization, and API client logic. |
+| [`new_agent.go`](agent/pkg/agent/new_agent.go)           | Agent creation and certificate generation logic.          |
+| [`docker_compose.go`](agent/pkg/agent/docker_compose.go) | Generator for agent Docker Compose configurations.        |
+| [`bare_metal.go`](agent/pkg/agent/bare_metal.go)         | Generator for bare metal installation scripts.            |
+| [`env.go`](agent/pkg/agent/env.go)                       | Environment configuration types and constants.            |
+| [`common/`](agent/pkg/agent/common)                      | Shared constants and utilities for agents.                |

 ## Core Types

-### [`AgentConfig`](config.go:29)
+### [`AgentConfig`](agent/pkg/agent/config.go:29)

 The primary struct used by the GoDoxy server to manage a connection to an agent. It stores the agent's address, metadata, and TLS configuration.

-### [`AgentInfo`](config.go:45)
+### [`AgentInfo`](agent/pkg/agent/config.go:45)

 Contains basic metadata about the agent, including its version, name, and container runtime (Docker or Podman).

-### [`PEMPair`](new_agent.go:53)
+### [`PEMPair`](agent/pkg/agent/new_agent.go:53)

 A utility struct for handling PEM-encoded certificate and key pairs, supporting encryption, decryption, and conversion to `tls.Certificate`.

@@ -54,7 +54,7 @@ A utility struct for handling PEM-encoded certificate and key pairs, supporting

 ### Certificate Generation

-The [`NewAgent`](new_agent.go:147) function creates a complete certificate infrastructure for an agent:
+The [`NewAgent`](agent/pkg/agent/new_agent.go:147) function creates a complete certificate infrastructure for an agent:

 - **CA Certificate**: Self-signed root certificate with 1000-year validity.
 - **Server Certificate**: For the agent's HTTPS server, signed by the CA.
@@ -65,18 +65,18 @@ All certificates use ECDSA with P-256 curve and SHA-256 signatures.
 ### Certificate Security

 - Certificates are encrypted using AES-GCM with a provided encryption key.
- The [`PEMPair`](new_agent.go:53) struct provides methods for encryption, decryption, and conversion to `tls.Certificate`.
+- The [`PEMPair`](agent/pkg/agent/new_agent.go:53) struct provides methods for encryption, decryption, and conversion to `tls.Certificate`.
 - Base64 encoding is used for certificate storage and transmission.

 ## Key Features

 ### 1. Secure Communication

-All communication between the GoDoxy server and agents is secured using mutual TLS (mTLS). The [`AgentConfig`](config.go:29) handles the loading of CA and client certificates to establish secure connections.
+All communication between the GoDoxy server and agents is secured using mutual TLS (mTLS). The [`AgentConfig`](agent/pkg/agent/config.go:29) handles the loading of CA and client certificates to establish secure connections.

 ### 2. Agent Discovery and Initialization

-The [`Init`](config.go:231) and [`InitWithCerts`](config.go:110) methods allow the server to:
+The [`Init`](agent/pkg/agent/config.go:231) and [`InitWithCerts`](agent/pkg/agent/config.go:110) methods allow the server to:

 - Fetch agent metadata (version, name, runtime).
 - Verify compatibility between server and agent versions.
@@ -86,12 +86,12 @@ The [`Init`](config.go:231) and [`InitWithCerts`](config.go:110) methods allow t

 The package provides interfaces and implementations for generating deployment artifacts:

- **Docker Compose**: Generates a `docker-compose.yml` for running the agent as a container via [`AgentComposeConfig.Generate()`](docker_compose.go:21).
- **Bare Metal**: Generates a shell script to install and run the agent as a systemd service via [`AgentEnvConfig.Generate()`](bare_metal.go:27).
+- **Docker Compose**: Generates a `docker-compose.yml` for running the agent as a container via [`AgentComposeConfig.Generate()`](agent/pkg/agent/docker_compose.go:21).
+- **Bare Metal**: Generates a shell script to install and run the agent as a systemd service via [`AgentEnvConfig.Generate()`](agent/pkg/agent/bare_metal.go:27).

 ### 4. Fake Docker Host

-The package supports a "fake" Docker host scheme (`agent://<addr>`) to identify containers managed by an agent, allowing the GoDoxy server to route requests appropriately. See [`IsDockerHostAgent`](config.go:90) and [`GetAgentAddrFromDockerHost`](config.go:94).
+The package supports a "fake" Docker host scheme (`agent://<addr>`) to identify containers managed by an agent, allowing the GoDoxy server to route requests appropriately. See [`IsDockerHostAgent`](agent/pkg/agent/config.go:90) and [`GetAgentAddrFromDockerHost`](agent/pkg/agent/config.go:94).

 ## Usage Example

--- a/agent/pkg/agent/config.go
+++ b/agent/pkg/agent/config.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/json"
 	"encoding/pem"
 	"errors"
 	"fmt"
@@ -15,7 +16,6 @@ import (
 	"strings"
 	"time"

-	"github.com/bytedance/sonic"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"github.com/yusing/godoxy/agent/pkg/agent/common"
@@ -150,7 +150,7 @@ func (cfg *AgentConfig) InitWithCerts(ctx context.Context, ca, crt, key []byte)
 		// test stream server connection
 		const fakeAddress = "localhost:8080" // it won't be used, just for testing
 		// test TCP stream support
-		err := agentstream.TCPHealthCheck(ctx, cfg.Addr, cfg.caCert, cfg.clientCert)
+		err := agentstream.TCPHealthCheck(cfg.Addr, cfg.caCert, cfg.clientCert)
 		if err != nil {
 			streamUnsupportedErrs.Addf("failed to connect to stream server via TCP: %w", err)
 		} else {
@@ -158,7 +158,7 @@ func (cfg *AgentConfig) InitWithCerts(ctx context.Context, ca, crt, key []byte)
 		}

 		// test UDP stream support
-		err = agentstream.UDPHealthCheck(ctx, cfg.Addr, cfg.caCert, cfg.clientCert)
+		err = agentstream.UDPHealthCheck(cfg.Addr, cfg.caCert, cfg.clientCert)
 		if err != nil {
 			streamUnsupportedErrs.Addf("failed to connect to stream server via UDP: %w", err)
 		} else {
@@ -313,18 +313,8 @@ func (cfg *AgentConfig) do(ctx context.Context, method, endpoint string, body io
 	if err != nil {
 		return nil, err
 	}
-
-	timeout := 5 * time.Second
-	if deadline, ok := ctx.Deadline(); ok {
-		remaining := time.Until(deadline)
-		if remaining > 0 {
-			timeout = remaining
-		}
-	}
-
 	client := http.Client{
 		Transport: cfg.Transport(),
-		Timeout:   timeout,
 	}
 	return client.Do(req)
 }
@@ -366,7 +356,7 @@ func (cfg *AgentConfig) fetchJSON(ctx context.Context, endpoint string, out any)
 		return resp.StatusCode, nil
 	}

-	err = sonic.Unmarshal(data, out)
+	err = json.Unmarshal(data, out)
 	if err != nil {
 		return 0, err
 	}
--- a/agent/pkg/agent/stream/tcp_client.go
+++ b/agent/pkg/agent/stream/tcp_client.go
@@ -1,7 +1,6 @@
 package stream

 import (
-	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"net"
@@ -35,13 +34,13 @@ func NewTCPClient(serverAddr, targetAddress string, caCert *x509.Certificate, cl
 		return nil, err
 	}

-	return newTCPClientWIthHeader(context.Background(), serverAddr, header, caCert, clientCert)
+	return newTCPClientWIthHeader(serverAddr, header, caCert, clientCert)
 }

-func TCPHealthCheck(ctx context.Context, serverAddr string, caCert *x509.Certificate, clientCert *tls.Certificate) error {
+func TCPHealthCheck(serverAddr string, caCert *x509.Certificate, clientCert *tls.Certificate) error {
 	header := NewStreamHealthCheckHeader()

-	conn, err := newTCPClientWIthHeader(ctx, serverAddr, header, caCert, clientCert)
+	conn, err := newTCPClientWIthHeader(serverAddr, header, caCert, clientCert)
 	if err != nil {
 		return err
 	}
@@ -50,7 +49,7 @@ func TCPHealthCheck(ctx context.Context, serverAddr string, caCert *x509.Certifi
 	return nil
 }

-func newTCPClientWIthHeader(ctx context.Context, serverAddr string, header *StreamRequestHeader, caCert *x509.Certificate, clientCert *tls.Certificate) (net.Conn, error) {
+func newTCPClientWIthHeader(serverAddr string, header *StreamRequestHeader, caCert *x509.Certificate, clientCert *tls.Certificate) (net.Conn, error) {
 	// Setup TLS configuration
 	caCertPool := x509.NewCertPool()
 	caCertPool.AddCert(caCert)
@@ -63,43 +62,17 @@ func newTCPClientWIthHeader(ctx context.Context, serverAddr string, header *Stre
 		ServerName:   common.CertsDNSName,
 	}

-	dialer := &net.Dialer{
-		Timeout: dialTimeout,
-	}
-	tlsDialer := &tls.Dialer{
-		NetDialer: dialer,
-		Config:    tlsConfig,
-	}
-
 	// Establish TLS connection
-	conn, err := tlsDialer.DialContext(ctx, "tcp", serverAddr)
+	conn, err := tls.DialWithDialer(&net.Dialer{Timeout: dialTimeout}, "tcp", serverAddr, tlsConfig)
 	if err != nil {
 		return nil, err
 	}
-
-	deadline, hasDeadline := ctx.Deadline()
-	if hasDeadline {
-		err := conn.SetWriteDeadline(deadline)
-		if err != nil {
-			_ = conn.Close()
-			return nil, err
-		}
-	}
 	// Send the stream header once as a handshake.
 	if _, err := conn.Write(header.Bytes()); err != nil {
 		_ = conn.Close()
 		return nil, err
 	}

-	if hasDeadline {
-		// reset write deadline
-		err = conn.SetWriteDeadline(time.Time{})
-		if err != nil {
-			_ = conn.Close()
-			return nil, err
-		}
-	}
-
 	return &TCPClient{
 		conn: conn,
 	}, nil
--- a/agent/pkg/agent/stream/tcp_server.go
+++ b/agent/pkg/agent/stream/tcp_server.go
@@ -7,7 +7,6 @@ import (
 	"errors"
 	"io"
 	"net"
-	"time"

 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
@@ -148,11 +147,9 @@ func (s *TCPServer) handle(conn net.Conn) {
 func (s *TCPServer) redirect(conn net.Conn) (net.Conn, error) {
 	// Read the stream header once as a handshake.
 	var headerBuf [headerSize]byte
-	_ = conn.SetReadDeadline(time.Now().Add(dialTimeout))
 	if _, err := io.ReadFull(conn, headerBuf[:]); err != nil {
 		return nil, err
 	}
-	_ = conn.SetReadDeadline(time.Time{})

 	header := ToHeader(&headerBuf)
 	if !header.Validate() {
--- a/agent/pkg/agent/stream/tests/healthcheck_test.go
+++ b/agent/pkg/agent/stream/tests/healthcheck_test.go
@@ -12,7 +12,7 @@ func TestTCPHealthCheck(t *testing.T) {

 	srv := startTCPServer(t, certs)

-	err := stream.TCPHealthCheck(t.Context(), srv.Addr.String(), certs.CaCert, certs.ClientCert)
+	err := stream.TCPHealthCheck(srv.Addr.String(), certs.CaCert, certs.ClientCert)
 	require.NoError(t, err, "health check")
 }

@@ -21,6 +21,6 @@ func TestUDPHealthCheck(t *testing.T) {

 	srv := startUDPServer(t, certs)

-	err := stream.UDPHealthCheck(t.Context(), srv.Addr.String(), certs.CaCert, certs.ClientCert)
+	err := stream.UDPHealthCheck(srv.Addr.String(), certs.CaCert, certs.ClientCert)
 	require.NoError(t, err, "health check")
 }
--- a/agent/pkg/agent/stream/udp_client.go
+++ b/agent/pkg/agent/stream/udp_client.go
@@ -1,7 +1,6 @@
 package stream

 import (
-	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"net"
@@ -36,10 +35,10 @@ func NewUDPClient(serverAddr, targetAddress string, caCert *x509.Certificate, cl
 		return nil, err
 	}

-	return newUDPClientWIthHeader(context.Background(), serverAddr, header, caCert, clientCert)
+	return newUDPClientWIthHeader(serverAddr, header, caCert, clientCert)
 }

-func newUDPClientWIthHeader(ctx context.Context, serverAddr string, header *StreamRequestHeader, caCert *x509.Certificate, clientCert *tls.Certificate) (net.Conn, error) {
+func newUDPClientWIthHeader(serverAddr string, header *StreamRequestHeader, caCert *x509.Certificate, clientCert *tls.Certificate) (net.Conn, error) {
 	// Setup DTLS configuration
 	caCertPool := x509.NewCertPool()
 	caCertPool.AddCert(caCert)
@@ -63,40 +62,21 @@ func newUDPClientWIthHeader(ctx context.Context, serverAddr string, header *Stre
 	if err != nil {
 		return nil, err
 	}
-
-	deadline, hasDeadline := ctx.Deadline()
-	if hasDeadline {
-		err := conn.SetWriteDeadline(deadline)
-		if err != nil {
-			_ = conn.Close()
-			return nil, err
-		}
-	}
-
 	// Send the stream header once as a handshake.
 	if _, err := conn.Write(header.Bytes()); err != nil {
 		_ = conn.Close()
 		return nil, err
 	}

-	if hasDeadline {
-		// reset write deadline
-		err = conn.SetWriteDeadline(time.Time{})
-		if err != nil {
-			_ = conn.Close()
-			return nil, err
-		}
-	}
-
 	return &UDPClient{
 		conn: conn,
 	}, nil
 }

-func UDPHealthCheck(ctx context.Context, serverAddr string, caCert *x509.Certificate, clientCert *tls.Certificate) error {
+func UDPHealthCheck(serverAddr string, caCert *x509.Certificate, clientCert *tls.Certificate) error {
 	header := NewStreamHealthCheckHeader()

-	conn, err := newUDPClientWIthHeader(ctx, serverAddr, header, caCert, clientCert)
+	conn, err := newUDPClientWIthHeader(serverAddr, header, caCert, clientCert)
 	if err != nil {
 		return err
 	}
--- a/agent/pkg/agent/stream/udp_server.go
+++ b/agent/pkg/agent/stream/udp_server.go
@@ -102,13 +102,10 @@ func (s *UDPServer) handleDTLSConnection(clientConn net.Conn) {

 	// Read the stream header once as a handshake.
 	var headerBuf [headerSize]byte
-	_ = clientConn.SetReadDeadline(time.Now().Add(dialTimeout))
 	if _, err := io.ReadFull(clientConn, headerBuf[:]); err != nil {
 		s.logger(clientConn).Err(err).Msg("failed to read stream header")
 		return
 	}
-	_ = clientConn.SetReadDeadline(time.Time{})
-
 	header := ToHeader(&headerBuf)
 	if !header.Validate() {
 		s.logger(clientConn).Error().Bytes("header", headerBuf[:]).Msg("invalid stream header received")
--- a/agent/pkg/server/server.go
+++ b/agent/pkg/server/server.go
@@ -0,0 +1,43 @@
+package server
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net/http"
+
+	"github.com/rs/zerolog/log"
+	"github.com/yusing/godoxy/agent/pkg/env"
+	"github.com/yusing/godoxy/agent/pkg/handler"
+	"github.com/yusing/goutils/server"
+	"github.com/yusing/goutils/task"
+)
+
+type Options struct {
+	CACert, ServerCert *tls.Certificate
+	Port               int
+}
+
+func StartAgentServer(parent task.Parent, opt Options) {
+	caCertPool := x509.NewCertPool()
+	caCertPool.AddCert(opt.CACert.Leaf)
+
+	// Configure TLS
+	tlsConfig := &tls.Config{
+		Certificates: []tls.Certificate{*opt.ServerCert},
+		ClientCAs:    caCertPool,
+		ClientAuth:   tls.RequireAndVerifyClientCert,
+	}
+
+	if env.AgentSkipClientCertCheck {
+		tlsConfig.ClientAuth = tls.NoClientCert
+	}
+
+	agentServer := &http.Server{
+		Addr:      fmt.Sprintf(":%d", opt.Port),
+		Handler:   handler.NewAgentHandler(),
+		TLSConfig: tlsConfig,
+	}
+
+	server.Start(parent.Subtask("agent-server", false), agentServer, server.WithLogger(&log.Logger))
+}
--- a/cmd/bench_server/Dockerfile
+++ b/cmd/bench_server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.6-alpine AS builder
+FROM golang:1.25.5-alpine AS builder

 HEALTHCHECK NONE

--- a/cmd/bench_server/go.mod
+++ b/cmd/bench_server/go.mod
@@ -1,3 +1,3 @@
 module github.com/yusing/godoxy/cmd/bench_server

-go 1.25.6
+go 1.25.5
--- a/cmd/h2c_test_server/Dockerfile
+++ b/cmd/h2c_test_server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.6-alpine AS builder
+FROM golang:1.25.5-alpine AS builder

 HEALTHCHECK NONE

--- a/cmd/h2c_test_server/go.mod
+++ b/cmd/h2c_test_server/go.mod
@@ -1,7 +1,7 @@
 module github.com/yusing/godoxy/cmd/h2c_test_server

-go 1.25.6
+go 1.25.5

-require golang.org/x/net v0.49.0
+require golang.org/x/net v0.48.0

-require golang.org/x/text v0.33.0 // indirect
+require golang.org/x/text v0.32.0 // indirect
--- a/cmd/h2c_test_server/go.sum
+++ b/cmd/h2c_test_server/go.sum
@@ -1,4 +1,4 @@
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
-golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
-golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -3,7 +3,6 @@ package main
 import (
 	"os"
 	"sync"
-	"time"

 	"github.com/rs/zerolog/log"
 	"github.com/yusing/godoxy/internal/api"
@@ -11,7 +10,7 @@ import (
 	"github.com/yusing/godoxy/internal/common"
 	"github.com/yusing/godoxy/internal/config"
 	"github.com/yusing/godoxy/internal/dnsproviders"
-	iconlist "github.com/yusing/godoxy/internal/homepage/icons/list"
+	"github.com/yusing/godoxy/internal/homepage"
 	"github.com/yusing/godoxy/internal/logging"
 	"github.com/yusing/godoxy/internal/logging/memlogger"
 	"github.com/yusing/godoxy/internal/metrics/systeminfo"
@@ -33,16 +32,6 @@ func parallel(fns ...func()) {
 }

 func main() {
-	done := make(chan struct{}, 1)
-	go func() {
-		select {
-		case <-done:
-			return
-		case <-time.After(common.InitTimeout):
-			log.Fatal().Msgf("timeout waiting for initialization to complete, exiting...")
-		}
-	}()
-
 	initProfiling()

 	logging.InitLogger(os.Stderr, memlogger.GetMemLogger())
@@ -50,7 +39,7 @@ func main() {
 	log.Trace().Msg("trace enabled")
 	parallel(
 		dnsproviders.InitProviders,
-		iconlist.InitCache,
+		homepage.InitIconListCache,
 		systeminfo.Poller.Start,
 		middleware.LoadComposeFiles,
 	)
@@ -80,25 +69,14 @@ func main() {
 	server.StartServer(task.RootTask("api_server", false), server.Options{
 		Name:     "api",
 		HTTPAddr: common.APIHTTPAddr,
-		Handler:  api.NewHandler(true),
+		Handler:  api.NewHandler(),
 	})

-	// Local API Handler is used for unauthenticated access.
-	if common.LocalAPIHTTPAddr != "" {
-		server.StartServer(task.RootTask("local_api_server", false), server.Options{
-			Name:     "local_api",
-			HTTPAddr: common.LocalAPIHTTPAddr,
-			Handler:  api.NewHandler(false),
-		})
-	}
-
 	listenDebugServer()

 	uptime.Poller.Start()
 	config.WatchChanges()

-	close(done)
-
 	task.WaitExit(config.Value().TimeoutShutdown)
 }

--- a/go.mod
+++ b/go.mod
@@ -1,15 +1,9 @@
 module github.com/yusing/godoxy

-go 1.25.6
-
-exclude (
-	github.com/moby/moby/api v1.53.0 // allow older daemon versions
-	github.com/moby/moby/client v0.2.2 // allow older daemon versions
-)
+go 1.25.5

 replace (
 	github.com/coreos/go-oidc/v3 => ./internal/go-oidc
-	github.com/luthermonson/go-proxmox => ./internal/go-proxmox
 	github.com/shirou/gopsutil/v4 => ./internal/gopsutil
 	github.com/yusing/godoxy/agent => ./agent
 	github.com/yusing/godoxy/internal/dnsproviders => ./internal/dnsproviders
@@ -24,18 +18,18 @@ require (
 	github.com/coreos/go-oidc/v3 v3.17.0 // oidc authentication
 	github.com/fsnotify/fsnotify v1.9.0 // file watcher
 	github.com/gin-gonic/gin v1.11.0 // api server
-	github.com/go-acme/lego/v4 v4.31.0 // acme client
+	github.com/go-acme/lego/v4 v4.30.1 // acme client
 	github.com/go-playground/validator/v10 v10.30.1 // validator
 	github.com/gobwas/glob v0.2.3 // glob matcher for route rules
 	github.com/gorilla/websocket v1.5.3 // websocket for API and agent
 	github.com/gotify/server/v2 v2.8.0 // reference the Message struct for json response
 	github.com/lithammer/fuzzysearch v1.1.8 // fuzzy search for searching icons and filtering metrics
-	github.com/pires/go-proxyproto v0.9.2 // proxy protocol support
-	github.com/puzpuzpuz/xsync/v4 v4.4.0 // lock free map for concurrent operations
+	github.com/pires/go-proxyproto v0.8.1 // proxy protocol support
+	github.com/puzpuzpuz/xsync/v4 v4.2.0 // lock free map for concurrent operations
 	github.com/rs/zerolog v1.34.0 // logging
 	github.com/vincent-petithory/dataurl v1.0.0 // data url for fav icon
-	golang.org/x/crypto v0.47.0 // encrypting password with bcrypt
-	golang.org/x/net v0.49.0 // HTTP header utilities
+	golang.org/x/crypto v0.46.0 // encrypting password with bcrypt
+	golang.org/x/net v0.48.0 // HTTP header utilities
 	golang.org/x/oauth2 v0.34.0 // oauth2 authentication
 	golang.org/x/sync v0.19.0 // errgroup and singleflight for concurrent operations
 	golang.org/x/time v0.14.0 // time utilities
@@ -43,34 +37,34 @@ require (

 require (
 	github.com/bytedance/gopkg v0.1.3 // xxhash64 for fast hash
-	github.com/bytedance/sonic v1.15.0 // fast json parsing
-	github.com/docker/cli v29.2.0+incompatible // needs docker/cli/cli/connhelper connection helper for docker client
-	github.com/goccy/go-yaml v1.19.2 // yaml parsing for different config files
-	github.com/golang-jwt/jwt/v5 v5.3.1 // jwt authentication
-	github.com/luthermonson/go-proxmox v0.3.2 // proxmox API client
+	github.com/bytedance/sonic v1.14.2 // fast json parsing
+	github.com/docker/cli v29.1.3+incompatible // needs docker/cli/cli/connhelper connection helper for docker client
+	github.com/goccy/go-yaml v1.19.1 // yaml parsing for different config files
+	github.com/golang-jwt/jwt/v5 v5.3.0 // jwt authentication
+	github.com/luthermonson/go-proxmox v0.3.1 // proxmox API client
 	github.com/moby/moby/api v1.52.0 // docker API
 	github.com/moby/moby/client v0.2.1 // docker client
 	github.com/oschwald/maxminddb-golang v1.13.1 // maxminddb for geoip database
-	github.com/quic-go/quic-go v0.59.0 // http3 support
+	github.com/quic-go/quic-go v0.58.0 // http3 support
 	github.com/shirou/gopsutil/v4 v4.25.12 // system information
 	github.com/spf13/afero v1.15.0 // afero for file system operations
 	github.com/stretchr/testify v1.11.1 // testing framework
-	github.com/valyala/fasthttp v1.69.0 // fast http for health check
-	github.com/yusing/ds v0.4.1 // data structures and algorithms
-	github.com/yusing/godoxy/agent v0.0.0-20260129101716-0f13004ad6ba
-	github.com/yusing/godoxy/internal/dnsproviders v0.0.0-20260129101716-0f13004ad6ba
+	github.com/valyala/fasthttp v1.68.0 // fast http for health check
+	github.com/yusing/ds v0.3.1 // data structures and algorithms
+	github.com/yusing/godoxy/agent v0.0.0-20260104140148-1c2515cb298d
+	github.com/yusing/godoxy/internal/dnsproviders v0.0.0-20260104140148-1c2515cb298d
 	github.com/yusing/gointernals v0.1.16
 	github.com/yusing/goutils v0.7.0
-	github.com/yusing/goutils/http/reverseproxy v0.0.0-20260129081554-24e52ede7468
-	github.com/yusing/goutils/http/websocket v0.0.0-20260129081554-24e52ede7468
-	github.com/yusing/goutils/server v0.0.0-20260129081554-24e52ede7468
+	github.com/yusing/goutils/http/reverseproxy v0.0.0-20260103043911-785deb23bd64
+	github.com/yusing/goutils/http/websocket v0.0.0-20260103043911-785deb23bd64
+	github.com/yusing/goutils/server v0.0.0-20260103043911-785deb23bd64
 )

 require (
-	cloud.google.com/go/auth v0.18.1 // indirect
+	cloud.google.com/go/auth v0.18.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns v1.2.0 // indirect
@@ -98,7 +92,7 @@ require (
 	github.com/gofrs/flock v0.13.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
 	github.com/googleapis/gax-go/v2 v2.16.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
@@ -109,7 +103,7 @@ require (
 	github.com/magefile/mage v1.15.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/miekg/dns v1.1.72 // indirect
+	github.com/miekg/dns v1.1.69 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -127,7 +121,7 @@ require (
 	github.com/samber/slog-common v0.19.0 // indirect
 	github.com/samber/slog-zerolog/v2 v2.9.0 // indirect
 	github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
 	github.com/sony/gobreaker v1.0.0 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
@@ -137,15 +131,15 @@ require (
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
 	go.uber.org/atomic v1.11.0
 	go.uber.org/ratelimit v0.3.1 // indirect
-	golang.org/x/mod v0.32.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
-	golang.org/x/tools v0.41.0 // indirect
-	google.golang.org/api v0.263.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
+	golang.org/x/mod v0.31.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/tools v0.40.0 // indirect
+	google.golang.org/api v0.258.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
 	google.golang.org/grpc v1.78.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
-	gopkg.in/ini.v1 v1.67.1 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -154,7 +148,7 @@ require (
 	github.com/akamai/AkamaiOPEN-edgegrid-golang/v11 v11.1.0 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
-	github.com/bytedance/sonic/loader v0.5.0 // indirect
+	github.com/bytedance/sonic/loader v0.4.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudwego/base64x v0.1.6 // indirect
@@ -166,17 +160,17 @@ require (
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
 	github.com/go-resty/resty/v2 v2.17.1 // indirect
-	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
-	github.com/klauspost/compress v1.18.3 // indirect
+	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b // indirect
-	github.com/linode/linodego v1.64.0 // indirect
+	github.com/linode/linodego v1.63.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
 	github.com/nrdcg/goinwx v0.12.0 // indirect
-	github.com/nrdcg/oci-go-sdk/common/v1065 v1065.107.0 // indirect
-	github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.107.0 // indirect
+	github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2 // indirect
+	github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2 // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pion/dtls/v3 v3.0.10 // indirect
 	github.com/pion/logging v0.2.4 // indirect
--- a/go.sum
+++ b/go.sum
@@ -1,12 +1,12 @@
-cloud.google.com/go/auth v0.18.1 h1:IwTEx92GFUo2pJ6Qea0EU3zYvKnTAeRCODxfA/G5UWs=
-cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA=
+cloud.google.com/go/auth v0.18.0 h1:wnqy5hrv7p3k7cShwAU/Br3nzod7fxoqG+k0VZ+/Pk0=
+cloud.google.com/go/auth v0.18.0/go.mod h1:wwkPM1AgE1f2u6dG443MiWoD8C3BtOywNsUMcUTVDRo=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
@@ -51,10 +51,10 @@ github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY=
 github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE=
 github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
 github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
-github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
-github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
-github.com/bytedance/sonic/loader v0.5.0 h1:gXH3KVnatgY7loH5/TkeVyXPfESoqSBSBEiDd5VjlgE=
-github.com/bytedance/sonic/loader v0.5.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
+github.com/bytedance/sonic v1.14.2 h1:k1twIoe97C1DtYUo+fZQy865IuHia4PR5RPiuGPPIIE=
+github.com/bytedance/sonic v1.14.2/go.mod h1:T80iDELeHiHKSc0C9tubFygiuXoGzrkjKzX2quAx980=
+github.com/bytedance/sonic/loader v0.4.0 h1:olZ7lEqcxtZygCK9EKYKADnpQoYkRQxaeY2NYzevs+o=
+github.com/bytedance/sonic/loader v0.4.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -76,8 +76,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v29.2.0+incompatible h1:9oBd9+YM7rxjZLfyMGxjraKBKE4/nVyvVfN4qNl9XRM=
-github.com/docker/cli v29.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.1.3+incompatible h1:+kz9uDWgs+mAaIZojWfFt4d53/jv0ZUOOoSh5ZnH36c=
+github.com/docker/cli v29.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
 github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -100,8 +100,8 @@ github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w
 github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
 github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
 github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
-github.com/go-acme/lego/v4 v4.31.0 h1:gd4oUYdfs83PR1/SflkNdit9xY1iul2I4EystnU8NXM=
-github.com/go-acme/lego/v4 v4.31.0/go.mod h1:m6zcfX/zcbMYDa8s6AnCMnoORWNP8Epnei+6NBCTUGs=
+github.com/go-acme/lego/v4 v4.30.1 h1:tmb6U0lvy8Mc3lQbqKwTat7oAhE8FUYNJ3D0gSg6pJU=
+github.com/go-acme/lego/v4 v4.30.1/go.mod h1:V7m/Ip+EeFkjOe028+zeH+SwWtESxw1LHelwMIfAjm4=
 github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
 github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -126,19 +126,19 @@ github.com/go-resty/resty/v2 v2.17.1 h1:x3aMpHK1YM9e4va/TMDRlusDDoZiQ+ViDu/WpA6x
 github.com/go-resty/resty/v2 v2.17.1/go.mod h1:kCKZ3wWmwJaNc7S29BRtUhJwy7iqmn+2mLtQrOyQlVA=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
-github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
-github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-yaml v1.19.1 h1:3rG3+v8pkhRqoQ/88NYNMHYVGYztCOCIZ7UQhu7H+NE=
+github.com/goccy/go-yaml v1.19.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
 github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
-github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
-github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -151,8 +151,8 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
-github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.16.0 h1:iHbQmKLLZrexmb0OSsNGTeSTS0HO4YvFOG8g5E4Zd0Y=
 github.com/googleapis/gax-go/v2 v2.16.0/go.mod h1:o1vfQjjNZn4+dPnRdl/4ZD7S9414Y4xA+a/6Icj6l14=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
@@ -177,8 +177,8 @@ github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/
 github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
 github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
-github.com/klauspost/compress v1.18.3 h1:9PJRvfbmTabkOX8moIpXPbMMbYN60bWImDDU7L+/6zw=
-github.com/klauspost/compress v1.18.3/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
+github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b h1:udzkj9S/zlT5X367kqJis0QP7YMxobob6zhzq6Yre00=
@@ -191,12 +191,14 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/linode/linodego v1.64.0 h1:If6pULIwHuQytgogtpQaBdVLX7z2TTHUF5u1tj2TPiY=
-github.com/linode/linodego v1.64.0/go.mod h1:GoiwLVuLdBQcAebxAVKVL3mMYUgJZR/puOUSla04xBE=
+github.com/linode/linodego v1.63.0 h1:MdjizfXNJDVJU6ggoJmMO5O9h4KGPGivNX0fzrAnstk=
+github.com/linode/linodego v1.63.0/go.mod h1:GoiwLVuLdBQcAebxAVKVL3mMYUgJZR/puOUSla04xBE=
 github.com/lithammer/fuzzysearch v1.1.8 h1:/HIuJnjHuXS8bKaiTMeeDlW2/AyIWk2brx1V8LFgLN4=
 github.com/lithammer/fuzzysearch v1.1.8/go.mod h1:IdqeyBClc3FFqSzYq/MXESsS4S0FsZ5ajtkr5xPLts4=
 github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIiZhtifTV5OUqqiP82UAl0h87xj/l9k=
 github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/luthermonson/go-proxmox v0.3.1 h1:h64s4/zIEQ06TBo0phFKcckV441YpvUPgLfRAptYsjY=
+github.com/luthermonson/go-proxmox v0.3.1/go.mod h1:oyFgg2WwTEIF0rP6ppjiixOHa5ebK1p8OaRiFhvICBQ=
 github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
 github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
@@ -208,8 +210,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/maxatome/go-testdeep v1.14.0 h1:rRlLv1+kI8eOI3OaBXZwb3O7xY3exRzdW5QyX48g9wI=
 github.com/maxatome/go-testdeep v1.14.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM=
-github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
-github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
+github.com/miekg/dns v1.1.69 h1:Kb7Y/1Jo+SG+a2GtfoFUfDkG//csdRPwRLkCsxDG9Sc=
+github.com/miekg/dns v1.1.69/go.mod h1:7OyjD9nEba5OkqQ/hB4fy3PIoxafSZJtducccIelz3g=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
@@ -227,10 +229,10 @@ github.com/nrdcg/goacmedns v0.2.0 h1:ADMbThobzEMnr6kg2ohs4KGa3LFqmgiBA22/6jUWJR0
 github.com/nrdcg/goacmedns v0.2.0/go.mod h1:T5o6+xvSLrQpugmwHvrSNkzWht0UGAwj2ACBMhh73Cg=
 github.com/nrdcg/goinwx v0.12.0 h1:ujdUqDBnaRSFwzVnImvPHYw3w3m9XgmGImNUw1GyMb4=
 github.com/nrdcg/goinwx v0.12.0/go.mod h1:IrVKd3ZDbFiMjdPgML4CSxZAY9wOoqLvH44zv3NodJ0=
-github.com/nrdcg/oci-go-sdk/common/v1065 v1065.107.0 h1:eMzyN+jGJbxG4ut278uwIsUo9XacXc711lFjhKnaUso=
-github.com/nrdcg/oci-go-sdk/common/v1065 v1065.107.0/go.mod h1:Gcs8GCaZXL3FdiDWgdnMxlOLEdRprJJnPYB22TX1jw8=
-github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.107.0 h1:t34IpOa+8NfmjkU8bdWtYrLrmr346/FGhu8FlpJDQok=
-github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.107.0/go.mod h1:p95/OxVsdx71I2Qrck1GtIS87sRxcTRKXzUi5nWm9NY=
+github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2 h1:l0tH15ACQADZAzC+LZ+mo2tIX4H6uZu0ulrVmG5Tqz0=
+github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2/go.mod h1:Gcs8GCaZXL3FdiDWgdnMxlOLEdRprJJnPYB22TX1jw8=
+github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2 h1:gzB4c6ztb38C/jYiqEaFC+mCGcWFHDji9e6jwymY9d4=
+github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2/go.mod h1:l1qIPIq2uRV5WTSvkbhbl/ndbeOu7OCb3UZ+0+2ZSb8=
 github.com/nrdcg/porkbun v0.4.0 h1:rWweKlwo1PToQ3H+tEO9gPRW0wzzgmI/Ob3n2Guticw=
 github.com/nrdcg/porkbun v0.4.0/go.mod h1:/QMskrHEIM0IhC/wY7iTCUgINsxdT2WcOphktJ9+Q54=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -251,8 +253,8 @@ github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
 github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
 github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o=
 github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM=
-github.com/pires/go-proxyproto v0.9.2 h1:H1UdHn695zUVVmB0lQ354lOWHOy6TZSpzBl3tgN0s1U=
-github.com/pires/go-proxyproto v0.9.2/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
+github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
+github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -265,12 +267,12 @@ github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
 github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/puzpuzpuz/xsync/v4 v4.4.0 h1:vlSN6/CkEY0pY8KaB0yqo/pCLZvp9nhdbBdjipT4gWo=
-github.com/puzpuzpuz/xsync/v4 v4.4.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
+github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
+github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
-github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/quic-go/quic-go v0.58.0 h1:ggY2pvZaVdB9EyojxL1p+5mptkuHyX5MOSv4dgWF4Ug=
+github.com/quic-go/quic-go v0.58.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
@@ -284,8 +286,8 @@ github.com/samber/slog-zerolog/v2 v2.9.0 h1:6LkOabJmZdNLaUWkTC3IVVA+dq7b/V0FM6lz
 github.com/samber/slog-zerolog/v2 v2.9.0/go.mod h1:gnQW9VnCfM34v2pRMUIGMsZOVbYLqY/v0Wxu6atSVGc=
 github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 h1:ObX9hZmK+VmijreZO/8x9pQ8/P/ToHD/bdSb4Eg4tUo=
 github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36/go.mod h1:LEsDu4BubxK7/cWhtlQWfuxwL4rf/2UEpxXz1o1EMtM=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sony/gobreaker v1.0.0 h1:feX5fGGXSl3dYd4aHZItw+FpHLvvoaqkawKjVNiFMNQ=
 github.com/sony/gobreaker v1.0.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
@@ -298,6 +300,7 @@ github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
@@ -316,8 +319,8 @@ github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.69.0 h1:fNLLESD2SooWeh2cidsuFtOcrEi4uB4m1mPrkJMZyVI=
-github.com/valyala/fasthttp v1.69.0/go.mod h1:4wA4PfAraPlAsJ5jMSqCE2ug5tqUPwKXxVj8oNECGcw=
+github.com/valyala/fasthttp v1.68.0 h1:v12Nx16iepr8r9ySOwqI+5RBJ/DqTxhOy1HrHoDFnok=
+github.com/valyala/fasthttp v1.68.0/go.mod h1:5EXiRfYQAoiO/khu4oU9VISC/eVY6JqmSpPJoHCKsz4=
 github.com/vincent-petithory/dataurl v1.0.0 h1:cXw+kPto8NLuJtlMsI152irrVw9fRDX8AbShPRpg2CI=
 github.com/vincent-petithory/dataurl v1.0.0/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
 github.com/vultr/govultr/v3 v3.26.1 h1:G/M0rMQKwVSmL+gb0UgETbW5mcQi0Vf/o/ZSGdBCxJw=
@@ -327,8 +330,8 @@ github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3i
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yusing/ds v0.4.1 h1:syMCh7hO6Yw8xfcFkEaln3W+lVeWB/U/meYv6Wf2/Ig=
-github.com/yusing/ds v0.4.1/go.mod h1:XhKV4l7cZwBbbl7lRzNC9zX27zvCM0frIwiuD40ULRk=
+github.com/yusing/ds v0.3.1 h1:mCqTgTQD8RhiBpcysvii5kZ7ZBmqcknVsFubNALGLbY=
+github.com/yusing/ds v0.3.1/go.mod h1:XhKV4l7cZwBbbl7lRzNC9zX27zvCM0frIwiuD40ULRk=
 github.com/yusing/gointernals v0.1.16 h1:GrhZZdxzA+jojLEqankctJrOuAYDb7kY1C93S1pVR34=
 github.com/yusing/gointernals v0.1.16/go.mod h1:B/0FVXt4WPmgzVy3ynzkqKi+BSGaJVmwCJBRXYapo34=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
@@ -363,15 +366,15 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
@@ -381,8 +384,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -402,6 +405,7 @@ golang.org/x/sys v0.0.0-20210331175145-43e1dd70ce54/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -412,8 +416,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -432,8 +436,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
-golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -442,19 +446,19 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.263.0 h1:UFs7qn8gInIdtk1ZA6eXRXp5JDAnS4x9VRsRVCeKdbk=
-google.golang.org/api v0.263.0/go.mod h1:fAU1xtNNisHgOF5JooAs8rRaTkl2rT3uaoNGo9NS3R8=
+google.golang.org/api v0.258.0 h1:IKo1j5FBlN74fe5isA2PVozN3Y5pwNKriEgAXPOkDAc=
+google.golang.org/api v0.258.0/go.mod h1:qhOMTQEZ6lUps63ZNq9jhODswwjkjYYguA7fA3TBFww=
 google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 h1:GvESR9BIyHUahIb0NcTum6itIWtdoglGX+rnGxm2934=
 google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:yJ2HH4EHEDTd3JiLmhds6NkJ17ITVYOdV3m3VKOnws0=
 google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
 google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
 google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
@@ -462,8 +466,8 @@ google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/ini.v1 v1.67.1 h1:tVBILHy0R6e4wkYOn3XmiITt/hEVH4TFMYvAX2Ytz6k=
-gopkg.in/ini.v1 v1.67.1/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
--- a/2
+++ b/2
--- a/internal/acl/config.go
+++ b/internal/acl/config.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"math"
 	"net"
+	"sync/atomic"
 	"time"

 	"github.com/puzpuzpuz/xsync/v4"
@@ -26,9 +27,9 @@ type Config struct {
 	Log        *accesslog.ACLLoggerConfig `json:"log"`

 	Notify struct {
-		To             []string      `json:"to,omitempty"`             // list of notification providers
-		Interval       time.Duration `json:"interval,omitempty"`       // interval between notifications
-		IncludeAllowed *bool         `json:"include_allowed,omitzero"` // default: false
+		To             []string      `json:"to"`              // list of notification providers
+		Interval       time.Duration `json:"interval"`        // interval between notifications
+		IncludeAllowed *bool         `json:"include_allowed"` // default: false
 	} `json:"notify"`

 	config
@@ -74,7 +75,8 @@ type ipLog struct {
 	allowed bool
 }

-type ContextKey struct{}
+// could be nil
+var ActiveConfig atomic.Pointer[Config]

 const cacheTTL = 1 * time.Minute

@@ -106,7 +108,7 @@ func (c *Config) Validate() gperr.Error {
 		c.allowLocal = true
 	}

-	if c.Notify.Interval <= 0 {
+	if c.Notify.Interval < 0 {
 		c.Notify.Interval = defaultNotifyInterval
 	}

@@ -290,16 +292,16 @@ func (c *Config) IPAllowed(ip net.IP) bool {
 	}

 	ipAndStr := &maxmind.IPInfo{IP: ip, Str: ipStr}
-	if c.Deny.Match(ipAndStr) {
-		c.logAndNotify(ipAndStr, false)
-		c.cacheRecord(ipAndStr, false)
-		return false
-	}
 	if c.Allow.Match(ipAndStr) {
 		c.logAndNotify(ipAndStr, true)
 		c.cacheRecord(ipAndStr, true)
 		return true
 	}
+	if c.Deny.Match(ipAndStr) {
+		c.logAndNotify(ipAndStr, false)
+		c.cacheRecord(ipAndStr, false)
+		return false
+	}

 	c.logAndNotify(ipAndStr, c.defaultAllow)
 	c.cacheRecord(ipAndStr, c.defaultAllow)
--- a/internal/acl/matcher.go
+++ b/internal/acl/matcher.go
@@ -1,7 +1,6 @@
 package acl

 import (
-	"bytes"
 	"net"
 	"strings"

@@ -13,7 +12,6 @@ type MatcherFunc func(*maxmind.IPInfo) bool

 type Matcher struct {
 	match MatcherFunc
-	raw   string
 }

 type Matchers []Matcher
@@ -48,7 +46,6 @@ func (matcher *Matcher) Parse(s string) error {
 	if len(parts) != 2 {
 		return errSyntax
 	}
-	matcher.raw = s

 	switch parts[0] {
 	case MatcherTypeIP:
@@ -82,18 +79,6 @@ func (matchers Matchers) Match(ip *maxmind.IPInfo) bool {
 	return false
 }

-func (matchers Matchers) MarshalText() ([]byte, error) {
-	if len(matchers) == 0 {
-		return []byte("[]"), nil
-	}
-	var buf bytes.Buffer
-	for _, m := range matchers {
-		buf.WriteString(m.raw)
-		buf.WriteByte('\n')
-	}
-	return buf.Bytes(), nil
-}
-
 func matchIP(ip net.IP) MatcherFunc {
 	return func(ip2 *maxmind.IPInfo) bool {
 		return ip.Equal(ip2.IP)
--- a/internal/agentpool/agent.go
+++ b/internal/agentpool/agent.go
@@ -27,7 +27,6 @@ func newAgent(cfg *agent.AgentConfig) *Agent {
 		AgentConfig: cfg,
 		httpClient: &http.Client{
 			Transport: transport,
-			Timeout:   5 * time.Second,
 		},
 		fasthttpHcClient: &fasthttp.Client{
 			DialTimeout: func(addr string, timeout time.Duration) (net.Conn, error) {
--- a/internal/api/handler.go
+++ b/internal/api/handler.go
@@ -16,7 +16,6 @@ import (
 	fileApi "github.com/yusing/godoxy/internal/api/v1/file"
 	homepageApi "github.com/yusing/godoxy/internal/api/v1/homepage"
 	metricsApi "github.com/yusing/godoxy/internal/api/v1/metrics"
-	proxmoxApi "github.com/yusing/godoxy/internal/api/v1/proxmox"
 	routeApi "github.com/yusing/godoxy/internal/api/v1/route"
 	"github.com/yusing/godoxy/internal/auth"
 	"github.com/yusing/godoxy/internal/common"
@@ -39,7 +38,7 @@ import (

 // @externalDocs.description  GoDoxy Docs
 // @externalDocs.url          https://docs.godoxy.dev
-func NewHandler(requireAuth bool) *gin.Engine {
+func NewHandler() *gin.Engine {
 	if !common.IsDebug {
 		gin.SetMode("release")
 	}
@@ -52,7 +51,7 @@ func NewHandler(requireAuth bool) *gin.Engine {

 	r.GET("/api/v1/version", apiV1.Version)

-	if auth.IsEnabled() && requireAuth {
+	if auth.IsEnabled() {
 		v1Auth := r.Group("/api/v1/auth")
 		{
 			v1Auth.HEAD("/check", authApi.Check)
@@ -65,7 +64,7 @@ func NewHandler(requireAuth bool) *gin.Engine {
 	}

 	v1 := r.Group("/api/v1")
-	if auth.IsEnabled() && requireAuth {
+	if auth.IsEnabled() {
 		v1.Use(AuthMiddleware())
 	}
 	if common.APISkipOriginCheck {
@@ -86,8 +85,6 @@ func NewHandler(requireAuth bool) *gin.Engine {
 			route.GET("/providers", routeApi.Providers)
 			route.GET("/by_provider", routeApi.ByProvider)
 			route.POST("/playground", routeApi.Playground)
-			route.GET("/validate", routeApi.Validate) // websocket
-			route.POST("/validate", routeApi.Validate)
 		}

 		file := v1.Group("/file")
@@ -143,21 +140,6 @@ func NewHandler(requireAuth bool) *gin.Engine {
 			docker.POST("/start", dockerApi.Start)
 			docker.POST("/stop", dockerApi.Stop)
 			docker.POST("/restart", dockerApi.Restart)
-			docker.GET("/stats/:id", dockerApi.Stats)
-		}
-
-		proxmox := v1.Group("/proxmox")
-		{
-			proxmox.GET("/tail", proxmoxApi.Tail)
-			proxmox.GET("/journalctl", proxmoxApi.Journalctl)
-			proxmox.GET("/journalctl/:node", proxmoxApi.Journalctl)
-			proxmox.GET("/journalctl/:node/:vmid", proxmoxApi.Journalctl)
-			proxmox.GET("/journalctl/:node/:vmid/:service", proxmoxApi.Journalctl)
-			proxmox.GET("/stats/:node", proxmoxApi.NodeStats)
-			proxmox.GET("/stats/:node/:vmid", proxmoxApi.VMStats)
-			proxmox.POST("/lxc/:node/:vmid/start", proxmoxApi.Start)
-			proxmox.POST("/lxc/:node/:vmid/stop", proxmoxApi.Stop)
-			proxmox.POST("/lxc/:node/:vmid/restart", proxmoxApi.Restart)
 		}
 	}

--- a/internal/api/v1/README.md
+++ b/internal/api/v1/README.md
@@ -44,7 +44,6 @@ Types are defined in `goutils/apitypes`:
 | `file`     | Configuration file read/write operations       |
 | `auth`     | Authentication and session management          |
 | `agent`    | Remote agent creation and management           |
-| `proxmox`  | Proxmox API management and monitoring          |

 ## Architecture

@@ -78,16 +77,15 @@ API listening address is configured with `GODOXY_API_ADDR` environment variable.

 ### Internal Dependencies

-| Package                 | Purpose                               |
-| ----------------------- | ------------------------------------- |
-| `internal/route/routes` | Route storage and iteration           |
-| `internal/docker`       | Docker client management              |
-| `internal/config`       | Configuration access                  |
-| `internal/metrics`      | System metrics collection             |
-| `internal/homepage`     | Homepage item generation              |
-| `internal/agentpool`    | Remote agent management               |
-| `internal/auth`         | Authentication services               |
-| `internal/proxmox`      | Proxmox API management and monitoring |
+| Package                 | Purpose                     |
+| ----------------------- | --------------------------- |
+| `internal/route/routes` | Route storage and iteration |
+| `internal/docker`       | Docker client management    |
+| `internal/config`       | Configuration access        |
+| `internal/metrics`      | System metrics collection   |
+| `internal/homepage`     | Homepage item generation    |
+| `internal/agentpool`    | Remote agent management     |
+| `internal/auth`         | Authentication services     |

 ### External Dependencies

--- a/internal/api/v1/agent/verify.go
+++ b/internal/api/v1/agent/verify.go
@@ -1,7 +1,6 @@
 package agentapi

 import (
-	"context"
 	"fmt"
 	"net/http"
 	"os"
@@ -37,9 +36,6 @@ type VerifyNewAgentRequest struct {
 // @Failure		500		{object}	ErrorResponse
 // @Router			/agent/verify [post]
 func Verify(c *gin.Context) {
-	// avoid timeout waiting for response headers
-	c.Status(http.StatusContinue)
-
 	var request VerifyNewAgentRequest
 	if err := c.ShouldBindJSON(&request); err != nil {
 		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
@@ -64,7 +60,7 @@ func Verify(c *gin.Context) {
 		return
 	}

-	nRoutesAdded, err := verifyNewAgent(c.Request.Context(), request.Host, ca, client, request.ContainerRuntime)
+	nRoutesAdded, err := verifyNewAgent(request.Host, ca, client, request.ContainerRuntime)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
 		return
@@ -86,7 +82,7 @@ func Verify(c *gin.Context) {

 var errAgentAlreadyExists = gperr.New("agent already exists")

-func verifyNewAgent(ctx context.Context, host string, ca agent.PEMPair, client agent.PEMPair, containerRuntime agent.ContainerRuntime) (int, gperr.Error) {
+func verifyNewAgent(host string, ca agent.PEMPair, client agent.PEMPair, containerRuntime agent.ContainerRuntime) (int, gperr.Error) {
 	var agentCfg agent.AgentConfig
 	agentCfg.Addr = host
 	agentCfg.Runtime = containerRuntime
@@ -103,7 +99,7 @@ func verifyNewAgent(ctx context.Context, host string, ca agent.PEMPair, client a
 		return 0, errAgentAlreadyExists
 	}

-	err := agentCfg.InitWithCerts(ctx, ca.Cert, client.Cert, client.Key)
+	err := agentCfg.InitWithCerts(cfgState.Context(), ca.Cert, client.Cert, client.Key)
 	if err != nil {
 		return 0, gperr.Wrap(err, "failed to initialize agent config")
 	}
--- a/internal/api/v1/docker/logs.go
+++ b/internal/api/v1/docker/logs.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"strconv"

 	"github.com/gin-gonic/gin"
 	"github.com/moby/moby/api/pkg/stdcopy"
@@ -23,7 +22,6 @@ type LogsQueryParams struct {
 	Since  string `form:"from"`
 	Until  string `form:"to"`
 	Levels string `form:"levels"`
-	Limit  int    `form:"limit,default=100" binding:"min=1,max=1000"`
 } //	@name	LogsQueryParams

 // @x-id				"logs"
@@ -36,10 +34,9 @@ type LogsQueryParams struct {
 // @Param			id	path	string	true	"container id"
 // @Param			stdout		query	bool	false	"show stdout"
 // @Param			stderr		query	bool	false	"show stderr"
-// @Param			from		  query	string	false	"from timestamp"
-// @Param			to			  query	string	false	"to timestamp"
+// @Param			from		query	string	false	"from timestamp"
+// @Param			to			query	string	false	"to timestamp"
 // @Param			levels		query	string	false	"levels"
-// @Param			limit		  query	int	false	"limit"
 // @Success		200
 // @Failure		400	{object}	apitypes.ErrorResponse
 // @Failure		403	{object}	apitypes.ErrorResponse
@@ -80,7 +77,7 @@ func Logs(c *gin.Context) {
 		Until:      queryParams.Until,
 		Timestamps: true,
 		Follow:     true,
-		Tail:       strconv.Itoa(queryParams.Limit),
+		Tail:       "100",
 	}
 	if queryParams.Levels != "" {
 		opts.Details = true
--- a/internal/api/v1/docker/stats.go
+++ b/internal/api/v1/docker/stats.go
@@ -1,117 +0,0 @@
-package dockerapi
-
-import (
-	"context"
-	"errors"
-	"io"
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/moby/moby/api/types/container"
-	"github.com/moby/moby/client"
-	"github.com/yusing/godoxy/internal/docker"
-	"github.com/yusing/godoxy/internal/route/routes"
-	"github.com/yusing/godoxy/internal/types"
-	apitypes "github.com/yusing/goutils/apitypes"
-	"github.com/yusing/goutils/http/httpheaders"
-	"github.com/yusing/goutils/http/websocket"
-	"github.com/yusing/goutils/synk"
-	"github.com/yusing/goutils/task"
-)
-
-type ContainerStatsResponse container.StatsResponse // @name ContainerStatsResponse
-
-// @x-id				"stats"
-// @BasePath		/api/v1
-// @Summary		Get container stats
-// @Description	Get container stats by container id
-// @Tags			docker,websocket
-// @Produce		json
-// @Param			id	path		string	true	"Container ID or route alias"
-// @Success		200	{object}	ContainerStatsResponse
-// @Failure		400	{object}	apitypes.ErrorResponse "Invalid request: id is required or route is not a docker container"
-// @Failure		403	{object}	apitypes.ErrorResponse
-// @Failure		404	{object}	apitypes.ErrorResponse "Container not found"
-// @Failure		500	{object}	apitypes.ErrorResponse
-// @Router			/docker/stats/{id} [get]
-func Stats(c *gin.Context) {
-	id := c.Param("id")
-	if id == "" {
-		c.JSON(http.StatusBadRequest, apitypes.Error("id is required"))
-		return
-	}
-
-	dockerCfg, ok := docker.GetDockerCfgByContainerID(id)
-	if !ok {
-		var route types.Route
-		route, ok = routes.GetIncludeExcluded(id)
-		if ok {
-			cont := route.ContainerInfo()
-			if cont == nil {
-				c.JSON(http.StatusBadRequest, apitypes.Error("route is not a docker container"))
-				return
-			}
-			dockerCfg = cont.DockerCfg
-			id = cont.ContainerID
-		}
-	}
-	if !ok {
-		c.JSON(http.StatusNotFound, apitypes.Error("container or route not found"))
-		return
-	}
-
-	dockerClient, err := docker.NewClient(dockerCfg)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to create docker client"))
-		return
-	}
-	defer dockerClient.Close()
-
-	if httpheaders.IsWebsocket(c.Request.Header) {
-		stats, err := dockerClient.ContainerStats(c.Request.Context(), id, client.ContainerStatsOptions{Stream: true})
-		if err != nil {
-			c.Error(apitypes.InternalServerError(err, "failed to get container stats"))
-			return
-		}
-		defer stats.Body.Close()
-
-		manager, err := websocket.NewManagerWithUpgrade(c)
-		if err != nil {
-			c.Error(apitypes.InternalServerError(err, "failed to create websocket manager"))
-			return
-		}
-		defer manager.Close()
-
-		buf := synk.GetSizedBytesPool().GetSized(4096)
-		defer synk.GetSizedBytesPool().Put(buf)
-
-		for {
-			select {
-			case <-manager.Done():
-				return
-			default:
-				_, err = io.CopyBuffer(manager.NewWriter(websocket.TextMessage), stats.Body, buf)
-				if err != nil {
-					if errors.Is(err, context.Canceled) || errors.Is(err, task.ErrProgramExiting) {
-						return
-					}
-					c.Error(apitypes.InternalServerError(err, "failed to copy container stats"))
-					return
-				}
-			}
-		}
-	}
-
-	stats, err := dockerClient.ContainerStats(c.Request.Context(), id, client.ContainerStatsOptions{Stream: false})
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to get container stats"))
-		return
-	}
-	defer stats.Body.Close()
-
-	_, err = io.Copy(c.Writer, stats.Body)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to copy container stats"))
-		return
-	}
-}
--- a/internal/api/v1/docs/swagger.json
+++ b/internal/api/v1/docs/swagger.json
--- a/internal/api/v1/docs/swagger.yaml
+++ b/internal/api/v1/docs/swagger.yaml
--- a/internal/api/v1/favicon.go
+++ b/internal/api/v1/favicon.go
@@ -5,8 +5,7 @@ import (
 	"net/http"

 	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/internal/homepage/icons"
-	iconfetch "github.com/yusing/godoxy/internal/homepage/icons/fetch"
+	"github.com/yusing/godoxy/internal/homepage"
 	"github.com/yusing/godoxy/internal/route/routes"
 	apitypes "github.com/yusing/goutils/apitypes"

@@ -14,9 +13,9 @@ import (
 )

 type GetFavIconRequest struct {
-	URL     string        `form:"url" binding:"required_without=Alias"`
-	Alias   string        `form:"alias" binding:"required_without=URL"`
-	Variant icons.Variant `form:"variant" binding:"omitempty,oneof=light dark"`
+	URL     string               `form:"url" binding:"required_without=Alias"`
+	Alias   string               `form:"alias" binding:"required_without=URL"`
+	Variant homepage.IconVariant `form:"variant" binding:"omitempty,oneof=light dark"`
 } //	@name	GetFavIconRequest

 // @x-id				"favicon"
@@ -28,7 +27,7 @@ type GetFavIconRequest struct {
 // @Produce		image/svg+xml,image/x-icon,image/png,image/webp
 // @Param			url		query		string	false	"URL of the route"
 // @Param			alias	query		string	false	"Alias of the route"
-// @Success		200		{array}		iconfetch.Result
+// @Success		200		{array}		homepage.FetchResult
 // @Failure		400		{object}	apitypes.ErrorResponse "Bad Request: alias is empty or route is not HTTPRoute"
 // @Failure		403		{object}	apitypes.ErrorResponse "Forbidden: unauthorized"
 // @Failure		404		{object}	apitypes.ErrorResponse "Not Found: route or icon not found"
@@ -43,18 +42,18 @@ func FavIcon(c *gin.Context) {

 	// try with url
 	if request.URL != "" {
-		var iconURL icons.URL
+		var iconURL homepage.IconURL
 		if err := iconURL.Parse(request.URL); err != nil {
 			c.JSON(http.StatusBadRequest, apitypes.Error("invalid url", err))
 			return
 		}
 		icon := &iconURL
-		if request.Variant != icons.VariantNone {
+		if request.Variant != homepage.IconVariantNone {
 			icon = icon.WithVariant(request.Variant)
 		}
-		fetchResult, err := iconfetch.FetchFavIconFromURL(c.Request.Context(), icon)
+		fetchResult, err := homepage.FetchFavIconFromURL(c.Request.Context(), icon)
 		if err != nil {
-			iconfetch.GinError(c, fetchResult.StatusCode, err)
+			homepage.GinFetchError(c, fetchResult.StatusCode, err)
 			return
 		}
 		c.Data(fetchResult.StatusCode, fetchResult.ContentType(), fetchResult.Icon)
@@ -64,40 +63,40 @@ func FavIcon(c *gin.Context) {
 	// try with alias
 	result, err := GetFavIconFromAlias(c.Request.Context(), request.Alias, request.Variant)
 	if err != nil {
-		iconfetch.GinError(c, result.StatusCode, err)
+		homepage.GinFetchError(c, result.StatusCode, err)
 		return
 	}
 	c.Data(result.StatusCode, result.ContentType(), result.Icon)
 }

 //go:linkname GetFavIconFromAlias v1.GetFavIconFromAlias
-func GetFavIconFromAlias(ctx context.Context, alias string, variant icons.Variant) (iconfetch.Result, error) {
+func GetFavIconFromAlias(ctx context.Context, alias string, variant homepage.IconVariant) (homepage.FetchResult, error) {
 	// try with route.Icon
 	r, ok := routes.HTTP.Get(alias)
 	if !ok {
-		return iconfetch.FetchResultWithErrorf(http.StatusNotFound, "route not found")
+		return homepage.FetchResultWithErrorf(http.StatusNotFound, "route not found")
 	}

 	var (
-		result iconfetch.Result
+		result homepage.FetchResult
 		err    error
 	)
 	hp := r.HomepageItem()
 	if hp.Icon != nil {
-		if hp.Icon.Source == icons.SourceRelative {
-			result, err = iconfetch.FindIcon(ctx, r, *hp.Icon.FullURL, variant)
-		} else if variant != icons.VariantNone {
-			result, err = iconfetch.FetchFavIconFromURL(ctx, hp.Icon.WithVariant(variant))
+		if hp.Icon.IconSource == homepage.IconSourceRelative {
+			result, err = homepage.FindIcon(ctx, r, *hp.Icon.FullURL, variant)
+		} else if variant != homepage.IconVariantNone {
+			result, err = homepage.FetchFavIconFromURL(ctx, hp.Icon.WithVariant(variant))
 			if err != nil {
 				// fallback to no variant
-				result, err = iconfetch.FetchFavIconFromURL(ctx, hp.Icon.WithVariant(icons.VariantNone))
+				result, err = homepage.FetchFavIconFromURL(ctx, hp.Icon.WithVariant(homepage.IconVariantNone))
 			}
 		} else {
-			result, err = iconfetch.FetchFavIconFromURL(ctx, hp.Icon)
+			result, err = homepage.FetchFavIconFromURL(ctx, hp.Icon)
 		}
 	} else {
 		// try extract from "link[rel=icon]"
-		result, err = iconfetch.FindIcon(ctx, r, "/", variant)
+		result, err = homepage.FindIcon(ctx, r, "/", variant)
 	}
 	if result.StatusCode == 0 {
 		result.StatusCode = http.StatusOK
--- a/internal/api/v1/file/validate.go
+++ b/internal/api/v1/file/validate.go
@@ -20,7 +20,7 @@ type ValidateFileRequest struct {
 // @Summary		Validate file
 // @Description	Validate file
 // @Tags			file
-// @Accept		application/yaml
+// @Accept			text/plain
 // @Produce		json
 // @Param			type	query		FileType	true	"Type"
 // @Param			file	body		string		true	"File content"
@@ -29,7 +29,7 @@ type ValidateFileRequest struct {
 // @Failure		403		{object}	apitypes.ErrorResponse "Forbidden"
 // @Failure		417		{object}	any "Validation failed"
 // @Failure		500		{object}	apitypes.ErrorResponse "Internal server error"
-// @Router		/file/validate [post]
+// @Router			/file/validate [post]
 func Validate(c *gin.Context) {
 	var request ValidateFileRequest
 	if err := c.ShouldBindQuery(&request); err != nil {
--- a/internal/api/v1/icons.go
+++ b/internal/api/v1/icons.go
@@ -4,7 +4,7 @@ import (
 	"net/http"

 	"github.com/gin-gonic/gin"
-	iconlist "github.com/yusing/godoxy/internal/homepage/icons/list"
+	"github.com/yusing/godoxy/internal/homepage"
 	apitypes "github.com/yusing/goutils/apitypes"
 )

@@ -22,7 +22,7 @@ type ListIconsRequest struct {
 // @Produce		json
 // @Param			limit	query		int		false	"Limit"
 // @Param			keyword	query		string	false	"Keyword"
-// @Success		200		{array}		iconlist.IconMetaSearch
+// @Success		200		{array}		homepage.IconMetaSearch
 // @Failure		400		{object}	apitypes.ErrorResponse
 // @Failure		403		{object}	apitypes.ErrorResponse
 // @Router			/icons [get]
@@ -32,6 +32,6 @@ func Icons(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
 		return
 	}
-	icons := iconlist.SearchIcons(request.Keyword, request.Limit)
+	icons := homepage.SearchIcons(request.Keyword, request.Limit)
 	c.JSON(http.StatusOK, icons)
 }
--- a/internal/api/v1/proxmox/common.go
+++ b/internal/api/v1/proxmox/common.go
@@ -1,6 +0,0 @@
-package proxmoxapi
-
-type ActionRequest struct {
-	Node string `uri:"node" binding:"required"`
-	VMID int    `uri:"vmid" binding:"required"`
-} //	@name	ProxmoxVMActionRequest
--- a/internal/api/v1/proxmox/journalctl.go
+++ b/internal/api/v1/proxmox/journalctl.go
@@ -1,85 +0,0 @@
-package proxmoxapi
-
-import (
-	"errors"
-	"io"
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/internal/proxmox"
-	"github.com/yusing/goutils/apitypes"
-	"github.com/yusing/goutils/http/websocket"
-)
-
-// e.g. ws://localhost:8889/api/v1/proxmox/journalctl?node=pve&vmid=127&service=pveproxy&service=pvedaemon&limit=10
-// e.g. ws://localhost:8889/api/v1/proxmox/journalctl/pve/127?service=pveproxy&service=pvedaemon&limit=10
-
-type JournalctlRequest struct {
-	Node     string   `form:"node" uri:"node" binding:"required"`                       // Node name
-	VMID     *int     `form:"vmid" uri:"vmid"`                                          // Container VMID (optional - if not provided, streams node journalctl)
-	Services []string `form:"service" uri:"service"`                                    // Service names
-	Limit    *int     `form:"limit" uri:"limit" default:"100" binding:"min=1,max=1000"` // Limit output lines (1-1000)
-} //	@name	ProxmoxJournalctlRequest
-
-// @x-id				"journalctl"
-// @BasePath		/api/v1
-// @Summary		Get journalctl output
-// @Description	Get journalctl output for node or LXC container. If vmid is not provided, streams node journalctl.
-// @Tags			proxmox,websocket
-// @Accept		json
-// @Produce		application/json
-// @Param			query		query		JournalctlRequest	true	"Request"
-// @Param			path		path		JournalctlRequest	true	"Request"
-// @Success		200			string	plain	  "Journalctl output"
-// @Failure		400			{object}	apitypes.ErrorResponse	"Invalid request"
-// @Failure		403			{object}	apitypes.ErrorResponse	"Unauthorized"
-// @Failure		404			{object}	apitypes.ErrorResponse	"Node not found"
-// @Failure		500			{object}	apitypes.ErrorResponse	"Internal server error"
-// @Router		/proxmox/journalctl [get]
-// @Router		/proxmox/journalctl/{node} [get]
-// @Router		/proxmox/journalctl/{node}/{vmid} [get]
-// @Router		/proxmox/journalctl/{node}/{vmid}/{service} [get]
-func Journalctl(c *gin.Context) {
-	var request JournalctlRequest
-	uriErr := c.ShouldBindUri(&request)
-	queryErr := c.ShouldBindQuery(&request)
-	if uriErr != nil && queryErr != nil { // allow both uri and query parameters to be set
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", errors.Join(uriErr, queryErr)))
-		return
-	}
-
-	node, ok := proxmox.Nodes.Get(request.Node)
-	if !ok {
-		c.JSON(http.StatusNotFound, apitypes.Error("node not found"))
-		return
-	}
-
-	c.Status(http.StatusContinue)
-
-	var reader io.ReadCloser
-	var err error
-	if request.VMID == nil {
-		reader, err = node.NodeJournalctl(c.Request.Context(), request.Services, *request.Limit)
-	} else {
-		reader, err = node.LXCJournalctl(c.Request.Context(), *request.VMID, request.Services, *request.Limit)
-	}
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to get journalctl output"))
-		return
-	}
-	defer reader.Close()
-
-	manager, err := websocket.NewManagerWithUpgrade(c)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to upgrade to websocket"))
-		return
-	}
-	defer manager.Close()
-
-	writer := manager.NewWriter(websocket.TextMessage)
-	_, err = io.Copy(writer, reader)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to copy journalctl output"))
-		return
-	}
-}
--- a/internal/api/v1/proxmox/restart.go
+++ b/internal/api/v1/proxmox/restart.go
@@ -1,42 +0,0 @@
-package proxmoxapi
-
-import (
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/internal/proxmox"
-	apitypes "github.com/yusing/goutils/apitypes"
-)
-
-// @x-id				"lxcRestart"
-// @BasePath		/api/v1
-// @Summary		Restart LXC container
-// @Description	Restart LXC container by node and vmid
-// @Tags			proxmox
-// @Produce		json
-// @Param			path		path		ActionRequest	true	"Request"
-// @Success		200	{object}  apitypes.SuccessResponse
-// @Failure		400	{object}	apitypes.ErrorResponse "Invalid request"
-// @Failure		404	{object}	apitypes.ErrorResponse "Node not found"
-// @Failure		500	{object}	apitypes.ErrorResponse
-// @Router		/proxmox/lxc/:node/:vmid/restart [post]
-func Restart(c *gin.Context) {
-	var req ActionRequest
-	if err := c.ShouldBindUri(&req); err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
-		return
-	}
-
-	node, ok := proxmox.Nodes.Get(req.Node)
-	if !ok {
-		c.JSON(http.StatusNotFound, apitypes.Error("node not found"))
-		return
-	}
-
-	if err := node.LXCAction(c.Request.Context(), req.VMID, proxmox.LXCReboot); err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to restart container"))
-		return
-	}
-
-	c.JSON(http.StatusOK, apitypes.Success("container restarted"))
-}
--- a/internal/api/v1/proxmox/start.go
+++ b/internal/api/v1/proxmox/start.go
@@ -1,42 +0,0 @@
-package proxmoxapi
-
-import (
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/internal/proxmox"
-	apitypes "github.com/yusing/goutils/apitypes"
-)
-
-// @x-id				"lxcStart"
-// @BasePath		/api/v1
-// @Summary		Start LXC container
-// @Description	Start LXC container by node and vmid
-// @Tags			proxmox
-// @Produce		json
-// @Param			path		path		ActionRequest	true	"Request"
-// @Success		200	{object}  apitypes.SuccessResponse
-// @Failure		400	{object}	apitypes.ErrorResponse "Invalid request"
-// @Failure		404	{object}	apitypes.ErrorResponse "Node not found"
-// @Failure		500	{object}	apitypes.ErrorResponse
-// @Router		/proxmox/lxc/:node/:vmid/start [post]
-func Start(c *gin.Context) {
-	var req ActionRequest
-	if err := c.ShouldBindUri(&req); err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
-		return
-	}
-
-	node, ok := proxmox.Nodes.Get(req.Node)
-	if !ok {
-		c.JSON(http.StatusNotFound, apitypes.Error("node not found"))
-		return
-	}
-
-	if err := node.LXCAction(c.Request.Context(), req.VMID, proxmox.LXCStart); err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to start container"))
-		return
-	}
-
-	c.JSON(http.StatusOK, apitypes.Success("container started"))
-}
--- a/internal/api/v1/proxmox/stats.go
+++ b/internal/api/v1/proxmox/stats.go
@@ -1,139 +0,0 @@
-package proxmoxapi
-
-import (
-	"io"
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/internal/proxmox"
-	"github.com/yusing/goutils/apitypes"
-	"github.com/yusing/goutils/http/httpheaders"
-	"github.com/yusing/goutils/http/websocket"
-)
-
-type StatsRequest struct {
-	Node string `uri:"node" binding:"required"`
-	VMID int    `uri:"vmid" binding:"required"`
-}
-
-// @x-id			"nodeStats"
-// @BasePath	/api/v1
-// @Summary		Get proxmox node stats
-// @Description	Get proxmox node stats in json
-// @Tags			proxmox,websocket
-// @Produce		application/json
-// @Param			node		path	  	string	true	"Node name"
-// @Success		200			{object}	proxmox.NodeStats	      "Stats output"
-// @Failure		400			{object}	apitypes.ErrorResponse	"Invalid request"
-// @Failure		403			{object}	apitypes.ErrorResponse	"Unauthorized"
-// @Failure		404			{object}	apitypes.ErrorResponse	"Node not found"
-// @Failure		500			{object}	apitypes.ErrorResponse	"Internal server error"
-// @Router		/proxmox/stats/{node} [get]
-func NodeStats(c *gin.Context) {
-	nodeName := c.Param("node")
-	if nodeName == "" {
-		c.JSON(http.StatusBadRequest, apitypes.Error("node name is required"))
-		return
-	}
-
-	node, ok := proxmox.Nodes.Get(nodeName)
-	if !ok {
-		c.JSON(http.StatusNotFound, apitypes.Error("node not found"))
-		return
-	}
-
-	isWs := httpheaders.IsWebsocket(c.Request.Header)
-
-	reader, err := node.NodeStats(c.Request.Context(), isWs)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to get stats"))
-		return
-	}
-	defer reader.Close()
-
-	if !isWs {
-		var line [512]byte
-		n, err := reader.Read(line[:])
-		if err != nil {
-			c.Error(apitypes.InternalServerError(err, "failed to copy stats"))
-			return
-		}
-		c.Data(http.StatusOK, "application/json", line[:n])
-		return
-	}
-
-	manager, err := websocket.NewManagerWithUpgrade(c)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to upgrade to websocket"))
-		return
-	}
-	defer manager.Close()
-
-	writer := manager.NewWriter(websocket.TextMessage)
-	_, err = io.Copy(writer, reader)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to copy stats"))
-		return
-	}
-}
-
-// @x-id			"vmStats"
-// @BasePath	/api/v1
-// @Summary		Get proxmox VM stats
-// @Description	Get proxmox VM stats in format of "STATUS|CPU%%|MEM USAGE/LIMIT|MEM%%|NET I/O|BLOCK I/O"
-// @Tags			proxmox,websocket
-// @Produce		text/plain
-// @Param			path		path		StatsRequest	true	"Request"
-// @Success		200			string		plain	"Stats output"
-// @Failure		400			{object}	apitypes.ErrorResponse	"Invalid request"
-// @Failure		403			{object}	apitypes.ErrorResponse	"Unauthorized"
-// @Failure		404			{object}	apitypes.ErrorResponse	"Node not found"
-// @Failure		500			{object}	apitypes.ErrorResponse	"Internal server error"
-// @Router		/proxmox/stats/{node}/{vmid} [get]
-func VMStats(c *gin.Context) {
-	var request StatsRequest
-	if err := c.ShouldBindUri(&request); err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
-		return
-	}
-
-	node, ok := proxmox.Nodes.Get(request.Node)
-	if !ok {
-		c.JSON(http.StatusNotFound, apitypes.Error("node not found"))
-		return
-	}
-
-	isWs := httpheaders.IsWebsocket(c.Request.Header)
-
-	reader, err := node.LXCStats(c.Request.Context(), request.VMID, isWs)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to get stats"))
-		return
-	}
-	defer reader.Close()
-
-	if !isWs {
-		var line [128]byte
-		n, err := reader.Read(line[:])
-		if err != nil {
-			c.Error(apitypes.InternalServerError(err, "failed to copy stats"))
-			return
-		}
-		c.Data(http.StatusOK, "text/plain; charset=utf-8", line[:n])
-		return
-	}
-
-	manager, err := websocket.NewManagerWithUpgrade(c)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to upgrade to websocket"))
-		return
-	}
-	defer manager.Close()
-
-	writer := manager.NewWriter(websocket.TextMessage)
-	_, err = io.Copy(writer, reader)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to copy stats"))
-		return
-	}
-}
--- a/internal/api/v1/proxmox/stop.go
+++ b/internal/api/v1/proxmox/stop.go
@@ -1,42 +0,0 @@
-package proxmoxapi
-
-import (
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/internal/proxmox"
-	apitypes "github.com/yusing/goutils/apitypes"
-)
-
-// @x-id				"lxcStop"
-// @BasePath		/api/v1
-// @Summary		Stop LXC container
-// @Description	Stop LXC container by node and vmid
-// @Tags			proxmox
-// @Produce		json
-// @Param			path		path		ActionRequest	true	"Request"
-// @Success		200	{object}  apitypes.SuccessResponse
-// @Failure		400	{object}	apitypes.ErrorResponse "Invalid request"
-// @Failure		404	{object}	apitypes.ErrorResponse "Node not found"
-// @Failure		500	{object}	apitypes.ErrorResponse
-// @Router		/proxmox/lxc/:node/:vmid/stop [post]
-func Stop(c *gin.Context) {
-	var req ActionRequest
-	if err := c.ShouldBindUri(&req); err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
-		return
-	}
-
-	node, ok := proxmox.Nodes.Get(req.Node)
-	if !ok {
-		c.JSON(http.StatusNotFound, apitypes.Error("node not found"))
-		return
-	}
-
-	if err := node.LXCAction(c.Request.Context(), req.VMID, proxmox.LXCShutdown); err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to stop container"))
-		return
-	}
-
-	c.JSON(http.StatusOK, apitypes.Success("container stopped"))
-}
--- a/internal/api/v1/proxmox/tail.go
+++ b/internal/api/v1/proxmox/tail.go
@@ -1,77 +0,0 @@
-package proxmoxapi
-
-import (
-	"io"
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yusing/godoxy/internal/proxmox"
-	"github.com/yusing/goutils/apitypes"
-	"github.com/yusing/goutils/http/websocket"
-)
-
-// e.g. ws://localhost:8889/api/v1/proxmox/tail?node=pve&vmid=127&file=/var/log/immich/web.log&file=/var/log/immich/ml.log&limit=10
-
-type TailRequest struct {
-	Node  string   `form:"node" binding:"required"`                      // Node name
-	VMID  *int     `form:"vmid"`                                         // Container VMID (optional - if not provided, streams node journalctl)
-	Files []string `form:"file" binding:"required,dive,filepath"`        // File paths
-	Limit int      `form:"limit" default:"100" binding:"min=1,max=1000"` // Limit output lines (1-1000)
-} //	@name	ProxmoxTailRequest
-
-// @x-id				"tail"
-// @BasePath		/api/v1
-// @Summary		Get tail output
-// @Description	Get tail output for node or LXC container. If vmid is not provided, streams node tail.
-// @Tags			proxmox,websocket
-// @Accept		json
-// @Produce		application/json
-// @Param			query		query		TailRequest	true	"Request"
-// @Success		200			string	plain	  "Tail output"
-// @Failure		400			{object}	apitypes.ErrorResponse	"Invalid request"
-// @Failure		403			{object}	apitypes.ErrorResponse	"Unauthorized"
-// @Failure		404			{object}	apitypes.ErrorResponse	"Node not found"
-// @Failure		500			{object}	apitypes.ErrorResponse	"Internal server error"
-// @Router		/proxmox/tail [get]
-func Tail(c *gin.Context) {
-	var request TailRequest
-	if err := c.ShouldBindQuery(&request); err != nil {
-		c.JSON(http.StatusBadRequest, apitypes.Error("invalid request", err))
-		return
-	}
-
-	node, ok := proxmox.Nodes.Get(request.Node)
-	if !ok {
-		c.JSON(http.StatusNotFound, apitypes.Error("node not found"))
-		return
-	}
-
-	c.Status(http.StatusContinue)
-
-	var reader io.ReadCloser
-	var err error
-	if request.VMID == nil {
-		reader, err = node.NodeTail(c.Request.Context(), request.Files, request.Limit)
-	} else {
-		reader, err = node.LXCTail(c.Request.Context(), *request.VMID, request.Files, request.Limit)
-	}
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to get journalctl output"))
-		return
-	}
-	defer reader.Close()
-
-	manager, err := websocket.NewManagerWithUpgrade(c)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to upgrade to websocket"))
-		return
-	}
-	defer manager.Close()
-
-	writer := manager.NewWriter(websocket.TextMessage)
-	_, err = io.Copy(writer, reader)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to copy journalctl output"))
-		return
-	}
-}
--- a/internal/api/v1/route/route.go
+++ b/internal/api/v1/route/route.go
@@ -4,6 +4,7 @@ import (
 	"net/http"

 	"github.com/gin-gonic/gin"
+	statequery "github.com/yusing/godoxy/internal/config/query"
 	"github.com/yusing/godoxy/internal/route/routes"
 	apitypes "github.com/yusing/goutils/apitypes"
 )
@@ -32,10 +33,17 @@ func Route(c *gin.Context) {
 		return
 	}

-	route, ok := routes.GetIncludeExcluded(request.Which)
+	route, ok := routes.Get(request.Which)
 	if ok {
 		c.JSON(http.StatusOK, route)
 		return
 	}
-	c.JSON(http.StatusNotFound, apitypes.Error("route not found"))
+
+	// also search for excluded routes
+	route = statequery.SearchRoute(request.Which)
+	if route != nil {
+		c.JSON(http.StatusOK, route)
+		return
+	}
+	c.JSON(http.StatusNotFound, nil)
 }
--- a/internal/api/v1/route/validate.go
+++ b/internal/api/v1/route/validate.go
@@ -1,69 +0,0 @@
-package routeApi
-
-import (
-	"net/http"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/goccy/go-yaml"
-	"github.com/yusing/godoxy/internal/route"
-	"github.com/yusing/godoxy/internal/serialization"
-	apitypes "github.com/yusing/goutils/apitypes"
-	"github.com/yusing/goutils/http/httpheaders"
-	"github.com/yusing/goutils/http/websocket"
-)
-
-type _ = route.Route
-
-// @x-id			"validate"
-// @BasePath	/api/v1
-// @Summary		Validate route
-// @Description	Validate route,
-// @Tags			route,websocket
-// @Accept		application/yaml
-// @Produce		json
-// @Param			route body route.Route true "Route"
-// @Success		200		{object}	apitypes.SuccessResponse "Route validated"
-// @Failure		400		{object}	apitypes.ErrorResponse "Bad request"
-// @Failure		403		{object}	apitypes.ErrorResponse "Forbidden"
-// @Failure		417		{object}	any "Validation failed"
-// @Failure		500		{object}	apitypes.ErrorResponse "Internal server error"
-// @Router		/route/validate [get]
-// @Router		/route/validate [post]
-func Validate(c *gin.Context) {
-	if httpheaders.IsWebsocket(c.Request.Header) {
-		ValidateWS(c)
-		return
-	}
-	var request route.Route
-	if err := c.ShouldBindWith(&request, serialization.GinYAMLBinding{}); err != nil {
-		c.JSON(http.StatusExpectationFailed, err)
-		return
-	}
-	c.JSON(http.StatusOK, apitypes.Success("route validated"))
-}
-
-func ValidateWS(c *gin.Context) {
-	manager, err := websocket.NewManagerWithUpgrade(c)
-	if err != nil {
-		c.Error(apitypes.InternalServerError(err, "failed to upgrade to websocket"))
-		return
-	}
-	defer manager.Close()
-
-	const writeTimeout = 5 * time.Second
-
-	for {
-		select {
-		case <-manager.Done():
-			return
-		case msg := <-manager.ReadCh():
-			var request route.Route
-			if err := serialization.UnmarshalValidate(msg, &request, yaml.Unmarshal); err != nil {
-				manager.WriteJSON(gin.H{"error": err}, writeTimeout)
-				continue
-			}
-			manager.WriteJSON(gin.H{"message": "route validated"}, writeTimeout)
-		}
-	}
-}
--- a/internal/autocert/config.go
+++ b/internal/autocert/config.go
@@ -4,13 +4,10 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/sha256"
 	"crypto/x509"
-	"encoding/hex"
 	"fmt"
 	"net/http"
 	"os"
-	"path/filepath"
 	"regexp"

 	"github.com/go-acme/lego/v4/certcrypto"
@@ -30,7 +27,7 @@ type Config struct {
 	CertPath    string                       `json:"cert_path,omitempty"`
 	KeyPath     string                       `json:"key_path,omitempty"`
 	Extra       []ConfigExtra                `json:"extra,omitempty"`
-	ACMEKeyPath string                       `json:"acme_key_path,omitempty"` // shared by all extra providers with the same CA directory URL
+	ACMEKeyPath string                       `json:"acme_key_path,omitempty"` // shared by all extra providers
 	Provider    string                       `json:"provider,omitempty"`
 	Options     map[string]strutils.Redacted `json:"options,omitempty"`

@@ -91,7 +88,7 @@ func (cfg *Config) validate(seenPaths map[string]int) gperr.Error {
 		cfg.KeyPath = KeyFileDefault
 	}
 	if cfg.ACMEKeyPath == "" {
-		cfg.ACMEKeyPath = acmeKeyPath(cfg.CADirURL)
+		cfg.ACMEKeyPath = ACMEKeyFileDefault
 	}

 	b := gperr.NewBuilder("certificate error")
@@ -275,16 +272,3 @@ func (cfg *Config) SaveACMEKey(key *ecdsa.PrivateKey) error {
 	}
 	return os.WriteFile(cfg.ACMEKeyPath, data, 0o600)
 }
-
-// acmeKeyPath returns the path to the ACME key file based on the CA directory URL.
-// Different CA directory URLs will use different key files to avoid key conflicts.
-func acmeKeyPath(caDirURL string) string {
-	// Use a hash of the CA directory URL to create a unique key filename
-	// Default to "acme" if no custom CA is configured (Let's Encrypt default)
-	filename := "acme"
-	if caDirURL != "" {
-		hash := sha256.Sum256([]byte(caDirURL))
-		filename = "acme_" + hex.EncodeToString(hash[:])[:16]
-	}
-	return filepath.Join(certBasePath, filename+".key")
-}
--- a/internal/autocert/config_test.go
+++ b/internal/autocert/config_test.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"testing"

-	"github.com/goccy/go-yaml"
 	"github.com/stretchr/testify/require"
 	"github.com/yusing/godoxy/internal/autocert"
 	"github.com/yusing/godoxy/internal/dnsproviders"
@@ -26,9 +25,9 @@ func TestEABConfigRequired(t *testing.T) {

 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			yamlCfg := fmt.Appendf(nil, "eab_kid: %s\neab_hmac: %s", test.cfg.EABKid, test.cfg.EABHmac)
+			yaml := fmt.Appendf(nil, "eab_kid: %s\neab_hmac: %s", test.cfg.EABKid, test.cfg.EABHmac)
 			cfg := autocert.Config{}
-			err := serialization.UnmarshalValidate(yamlCfg, &cfg, yaml.Unmarshal)
+			err := serialization.UnmarshalValidateYAML(yaml, &cfg)
 			if (err != nil) != test.wantErr {
 				t.Errorf("Validate() error = %v, wantErr %v", err, test.wantErr)
 			}
--- a/internal/autocert/paths.go
+++ b/internal/autocert/paths.go
@@ -1,7 +1,8 @@
 package autocert

 const (
-	certBasePath    = "certs/"
-	CertFileDefault = certBasePath + "cert.crt"
-	KeyFileDefault  = certBasePath + "priv.key"
+	certBasePath       = "certs/"
+	CertFileDefault    = certBasePath + "cert.crt"
+	KeyFileDefault     = certBasePath + "priv.key"
+	ACMEKeyFileDefault = certBasePath + "acme.key"
 )
--- a/internal/autocert/provider.go
+++ b/internal/autocert/provider.go
@@ -222,14 +222,13 @@ func (p *Provider) ObtainCertIfNotExistsAll() error {
 		})
 	}

-	err := errs.Wait().Error()
 	p.rebuildSNIMatcher()
-	return err
+	return errs.Wait().Error()
 }

 // obtainCertIfNotExists obtains a new certificate for this provider if it does not exist.
 func (p *Provider) obtainCertIfNotExists() error {
-	err := p.loadCert()
+	err := p.LoadCert()
 	if err == nil {
 		return nil
 	}
@@ -262,10 +261,7 @@ func (p *Provider) ObtainCertAll() error {
 			return nil
 		})
 	}
-
-	err := errs.Wait().Error()
-	p.rebuildSNIMatcher()
-	return err
+	return errs.Wait().Error()
 }

 // ObtainCert renews existing certificate or obtains a new certificate for this provider.
@@ -350,32 +346,29 @@ func (p *Provider) ObtainCert() error {
 	return nil
 }

-func (p *Provider) LoadCertAll() error {
+func (p *Provider) LoadCert() error {
 	var errs gperr.Builder
-	for _, provider := range p.allProviders() {
-		if err := provider.loadCert(); err != nil {
-			errs.Add(provider.fmtError(err))
-		}
-	}
-	p.rebuildSNIMatcher()
-	return errs.Error()
-}
-
-func (p *Provider) loadCert() error {
 	cert, err := tls.LoadX509KeyPair(p.cfg.CertPath, p.cfg.KeyPath)
 	if err != nil {
-		return err
+		errs.Addf("load SSL certificate: %w", p.fmtError(err))
 	}

 	expiries, err := getCertExpiries(&cert)
 	if err != nil {
-		return err
+		errs.Addf("parse SSL certificate: %w", p.fmtError(err))
 	}

 	p.tlsCert = &cert
 	p.certExpiries = expiries

-	return nil
+	for _, ep := range p.extraProviders {
+		if err := ep.LoadCert(); err != nil {
+			errs.Add(err)
+		}
+	}
+
+	p.rebuildSNIMatcher()
+	return errs.Error()
 }

 // PrintCertExpiriesAll prints the certificate expiries for this provider and all extra providers.
--- a/internal/autocert/provider_test/multi_cert_test.go
+++ b/internal/autocert/provider_test/multi_cert_test.go
@@ -6,7 +6,6 @@ import (
 	"os"
 	"testing"

-	"github.com/goccy/go-yaml"
 	"github.com/stretchr/testify/require"
 	"github.com/yusing/godoxy/internal/autocert"
 	"github.com/yusing/godoxy/internal/serialization"
@@ -42,7 +41,7 @@ func TestMultipleCertificatesLifecycle(t *testing.T) {
 	cfg.HTTPClient = acmeServer.httpClient()

 	/* unmarshal yaml config with multiple certs */
-	err := error(serialization.UnmarshalValidate(yamlConfig, &cfg, yaml.Unmarshal))
+	err := error(serialization.UnmarshalValidateYAML(yamlConfig, &cfg))
 	require.NoError(t, err)
 	require.Equal(t, []string{"main.example.com"}, cfg.Domains)
 	require.Len(t, cfg.Extra, 2)
--- a/internal/autocert/provider_test/sni_test.go
+++ b/internal/autocert/provider_test/sni_test.go
@@ -81,7 +81,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert, err := p.GetCert(&tls.ClientHelloInfo{ServerName: "a.internal.example.com"})
@@ -113,7 +113,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert, err := p.GetCert(&tls.ClientHelloInfo{ServerName: "foo.example.com"})
@@ -145,7 +145,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert, err := p.GetCert(&tls.ClientHelloInfo{ServerName: "unknown.domain.com"})
@@ -171,7 +171,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert, err := p.GetCert(nil)
@@ -197,7 +197,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert, err := p.GetCert(&tls.ClientHelloInfo{ServerName: ""})
@@ -229,7 +229,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert, err := p.GetCert(&tls.ClientHelloInfo{ServerName: "FOO.EXAMPLE.COM"})
@@ -261,7 +261,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert, err := p.GetCert(&tls.ClientHelloInfo{ServerName: "  foo.example.com.  "})
@@ -293,7 +293,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert, err := p.GetCert(&tls.ClientHelloInfo{ServerName: "foo.a.example.com"})
@@ -319,7 +319,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert, err := p.GetCert(&tls.ClientHelloInfo{ServerName: "bar.example.com"})
@@ -355,7 +355,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert1, err := p.GetCert(&tls.ClientHelloInfo{ServerName: "foo.test.com"})
@@ -392,7 +392,7 @@ func TestGetCertBySNI(t *testing.T) {
 		p, err := autocert.NewProvider(cfg, nil, nil)
 		require.NoError(t, err)

-		err = p.LoadCertAll()
+		err = p.LoadCert()
 		require.NoError(t, err)

 		cert1, err := p.GetCert(&tls.ClientHelloInfo{ServerName: "foo.example.com"})
--- a/internal/autocert/setup_test.go
+++ b/internal/autocert/setup_test.go
@@ -3,7 +3,6 @@ package autocert_test
 import (
 	"testing"

-	"github.com/goccy/go-yaml"
 	"github.com/stretchr/testify/require"
 	"github.com/yusing/godoxy/internal/autocert"
 	"github.com/yusing/godoxy/internal/dnsproviders"
@@ -43,7 +42,7 @@ extra:
 `

 	var cfg autocert.Config
-	err := error(serialization.UnmarshalValidate([]byte(cfgYAML), &cfg, yaml.Unmarshal))
+	err := error(serialization.UnmarshalValidateYAML([]byte(cfgYAML), &cfg))
 	require.NoError(t, err)

 	// Test: extra[0] inherits all fields from main except CertPath and KeyPath.
--- a/internal/common/env.go
+++ b/internal/common/env.go
@@ -13,8 +13,6 @@ var (
 	IsDebug = env.GetEnvBool("DEBUG", IsTest)
 	IsTrace = env.GetEnvBool("TRACE", false) && IsDebug

-	InitTimeout = env.GetEnvDuation("INIT_TIMEOUT", 1*time.Minute)
-
 	ShortLinkPrefix = env.GetEnvString("SHORTLINK_PREFIX", "go")

 	ProxyHTTPAddr,
@@ -32,11 +30,6 @@ var (
 	APIHTTPPort,
 	APIHTTPURL = env.GetAddrEnv("API_ADDR", "127.0.0.1:8888", "http")

-	LocalAPIHTTPAddr,
-	LocalAPIHTTPHost,
-	LocalAPIHTTPPort,
-	LocalAPIHTTPURL = env.GetAddrEnv("LOCAL_API_ADDR", "", "http")
-
 	APIJWTSecure   = env.GetEnvBool("API_JWT_SECURE", true)
 	APIJWTSecret   = decodeJWTKey(env.GetEnvString("API_JWT_SECRET", ""))
 	APIJWTTokenTTL = env.GetEnvDuation("API_JWT_TOKEN_TTL", 24*time.Hour)
--- a/internal/config/events.go
+++ b/internal/config/events.go
@@ -10,7 +10,6 @@ import (
 	"github.com/yusing/godoxy/internal/common"
 	config "github.com/yusing/godoxy/internal/config/types"
 	"github.com/yusing/godoxy/internal/notif"
-	"github.com/yusing/godoxy/internal/route/routes"
 	"github.com/yusing/godoxy/internal/watcher"
 	"github.com/yusing/godoxy/internal/watcher/events"
 	gperr "github.com/yusing/goutils/errs"
@@ -60,15 +59,6 @@ func Load() error {

 	cfgWatcher = watcher.NewConfigFileWatcher(common.ConfigFileName)

-	// disable pool logging temporary since we already have pretty logging
-	routes.HTTP.DisableLog(true)
-	routes.Stream.DisableLog(true)
-
-	defer func() {
-		routes.HTTP.DisableLog(false)
-		routes.Stream.DisableLog(false)
-	}()
-
 	initErr := state.InitFromFile(common.ConfigPath)
 	err := errors.Join(initErr, state.StartProviders())
 	if err != nil {
--- a/internal/config/query/README.md
+++ b/internal/config/query/README.md
@@ -54,6 +54,12 @@ Returns all route providers as a map keyed by their short name. Thread-safe acce
 func RouteProviderList() []RouteProviderListResponse
 ```

+Returns a list of route providers with their short and full names. Useful for API responses.
+
+```go
+func SearchRoute(alias string) types.Route
+```
+
 Searches for a route by alias across all providers. Returns `nil` if not found.

 ```go
@@ -173,6 +179,15 @@ for shortName, provider := range providers {
 }
 ```

+### Searching for a route
+
+```go
+route := statequery.SearchRoute("my-service")
+if route != nil {
+    fmt.Printf("Found route: %s\n", route.Alias())
+}
+```
+
 ### Getting system statistics

 ```go
@@ -198,4 +213,14 @@ func handleGetStats(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(stats)
 }
+
+func handleFindRoute(w http.ResponseWriter, r *http.Request) {
+    alias := r.URL.Query().Get("alias")
+    route := statequery.SearchRoute(alias)
+    if route == nil {
+        http.NotFound(w, r)
+        return
+    }
+    json.NewEncoder(w).Encode(route)
+}
 ```
--- a/internal/config/query/query.go
+++ b/internal/config/query/query.go
@@ -30,3 +30,13 @@ func RouteProviderList() []RouteProviderListResponse {
 	}
 	return list
 }
+
+func SearchRoute(alias string) types.Route {
+	state := config.ActiveState.Load()
+	for _, p := range state.IterProviders() {
+		if r, ok := p.GetRoute(alias); ok {
+			return r
+		}
+	}
+	return nil
+}
--- a/internal/config/state.go
+++ b/internal/config/state.go
@@ -28,6 +28,7 @@ import (
 	"github.com/yusing/godoxy/internal/maxmind"
 	"github.com/yusing/godoxy/internal/notif"
 	route "github.com/yusing/godoxy/internal/route/provider"
+	"github.com/yusing/godoxy/internal/route/routes"
 	"github.com/yusing/godoxy/internal/serialization"
 	"github.com/yusing/godoxy/internal/types"
 	gperr "github.com/yusing/goutils/errs"
@@ -73,6 +74,7 @@ func SetState(state config.State) {

 	cfg := state.Value()
 	config.ActiveState.Store(state)
+	acl.ActiveConfig.Store(cfg.ACL)
 	entrypoint.ActiveConfig.Store(&cfg.Entrypoint)
 	homepage.ActiveConfig.Store(&cfg.Homepage)
 	if autocertProvider := state.AutoCertProvider(); autocertProvider != nil {
@@ -103,7 +105,7 @@ func (state *state) InitFromFile(filename string) error {
 }

 func (state *state) Init(data []byte) error {
-	err := serialization.UnmarshalValidate(data, &state.Config, yaml.Unmarshal)
+	err := serialization.UnmarshalValidateYAML(data, &state.Config)
 	if err != nil {
 		return err
 	}
@@ -111,14 +113,14 @@ func (state *state) Init(data []byte) error {
 	g := gperr.NewGroup("config load error")
 	g.Go(state.initMaxMind)
 	g.Go(state.initProxmox)
+	g.Go(state.loadRouteProviders)
 	g.Go(state.initAutoCert)

 	errs := g.Wait()
 	// these won't benefit from running on goroutines
 	errs.Add(state.initNotification())
-	errs.Add(state.initACL())
+	errs.Add(state.initAccessLogger())
 	errs.Add(state.initEntrypoint())
-	errs.Add(state.loadRouteProviders())
 	return errs.Error()
 }

@@ -190,17 +192,12 @@ func (state *state) FlushTmpLog() {
 	state.tmpLogBuf.Reset()
 }

-// initACL initializes the ACL.
-func (state *state) initACL() error {
+// this one is connection level access logger, different from entrypoint access logger
+func (state *state) initAccessLogger() error {
 	if !state.ACL.Valid() {
 		return nil
 	}
-	err := state.ACL.Start(state.task)
-	if err != nil {
-		return err
-	}
-	state.task.SetValue(acl.ContextKey{}, state.ACL)
-	return nil
+	return state.ACL.Start(state.task)
 }

 func (state *state) initEntrypoint() error {
@@ -317,50 +314,76 @@ func (state *state) initProxmox() error {
 	return errs.Wait().Error()
 }

+func (state *state) storeProvider(p types.RouteProvider) {
+	state.providers.Store(p.String(), p)
+}
+
 func (state *state) loadRouteProviders() error {
-	providers := state.Providers
+	// disable pool logging temporary since we will have pretty logging below
+	routes.HTTP.ToggleLog(false)
+	routes.Stream.ToggleLog(false)
+
+	defer func() {
+		routes.HTTP.ToggleLog(true)
+		routes.Stream.ToggleLog(true)
+	}()
+
+	providers := &state.Providers
 	errs := gperr.NewGroup("route provider errors")
+	results := gperr.NewGroup("loaded route providers")

 	agentpool.RemoveAll()

-	registerProvider := func(p types.RouteProvider) {
-		if actual, loaded := state.providers.LoadOrStore(p.String(), p); loaded {
-			errs.Addf("provider %s already exists, first: %s, second: %s", p.String(), actual.GetType(), p.GetType())
-		}
-	}
+	numProviders := len(providers.Agents) + len(providers.Files) + len(providers.Docker)
+	providersCh := make(chan types.RouteProvider, numProviders)

-	agentErrs := gperr.NewGroup("agent init errors")
+	// start providers concurrently
+	var providersConsumer sync.WaitGroup
+	providersConsumer.Go(func() {
+		for p := range providersCh {
+			if actual, loaded := state.providers.LoadOrStore(p.String(), p); loaded {
+				errs.Add(gperr.Errorf("provider %s already exists, first: %s, second: %s", p.String(), actual.GetType(), p.GetType()))
+				continue
+			}
+			state.storeProvider(p)
+		}
+	})
+
+	var providersProducer sync.WaitGroup
 	for _, a := range providers.Agents {
-		agentErrs.Go(func() error {
+		providersProducer.Go(func() {
 			if err := a.Init(state.task.Context()); err != nil {
-				return gperr.PrependSubject(a.String(), err)
+				errs.Add(gperr.PrependSubject(a.String(), err))
+				return
 			}
 			agentpool.Add(a)
-			return nil
+			p := route.NewAgentProvider(a)
+			providersCh <- p
 		})
 	}

-	if err := agentErrs.Wait().Error(); err != nil {
-		errs.Add(err)
-	}
-
-	for _, a := range providers.Agents {
-		registerProvider(route.NewAgentProvider(a))
-	}
-
 	for _, filename := range providers.Files {
-		p, err := route.NewFileProvider(filename)
-		if err != nil {
-			errs.Add(gperr.PrependSubject(filename, err))
-			return err
-		}
-		registerProvider(p)
+		providersProducer.Go(func() {
+			p, err := route.NewFileProvider(filename)
+			if err != nil {
+				errs.Add(gperr.PrependSubject(filename, err))
+			} else {
+				providersCh <- p
+			}
+		})
 	}

 	for name, dockerCfg := range providers.Docker {
-		registerProvider(route.NewDockerProvider(name, dockerCfg))
+		providersProducer.Go(func() {
+			providersCh <- route.NewDockerProvider(name, dockerCfg)
+		})
 	}

+	providersProducer.Wait()
+
+	close(providersCh)
+	providersConsumer.Wait()
+
 	lenLongestName := 0
 	for k := range state.providers.Range {
 		if len(k) > lenLongestName {
@@ -369,26 +392,18 @@ func (state *state) loadRouteProviders() error {
 	}

 	// load routes concurrently
-	loadErrs := gperr.NewGroup("route load errors")
-
-	results := gperr.NewBuilder("loaded route providers")
-	resultsMu := sync.Mutex{}
+	var providersLoader sync.WaitGroup
 	for _, p := range state.providers.Range {
-		loadErrs.Go(func() error {
+		providersLoader.Go(func() {
 			if err := p.LoadRoutes(); err != nil {
-				return err.Subject(p.String())
+				errs.Add(err.Subject(p.String()))
 			}
-			resultsMu.Lock()
 			results.Addf("%-"+strconv.Itoa(lenLongestName)+"s %d routes", p.String(), p.NumRoutes())
-			resultsMu.Unlock()
-			return nil
 		})
 	}
-	if err := loadErrs.Wait().Error(); err != nil {
-		errs.Add(err)
-	}
+	providersLoader.Wait()

-	state.tmpLog.Info().Msg(results.String())
+	state.tmpLog.Info().Msg(results.Wait().String())
 	state.printRoutesByProvider(lenLongestName)
 	state.printState()
 	return errs.Wait().Error()
--- a/internal/config/types/config.go
+++ b/internal/config/types/config.go
@@ -4,7 +4,6 @@ import (
 	"regexp"

 	"github.com/go-playground/validator/v10"
-	"github.com/goccy/go-yaml"
 	"github.com/yusing/godoxy/agent/pkg/agent"
 	"github.com/yusing/godoxy/internal/acl"
 	"github.com/yusing/godoxy/internal/autocert"
@@ -37,14 +36,14 @@ type (
 		Docker       map[string]types.DockerProviderConfig `json:"docker" yaml:"docker,omitempty" validate:"non_empty_docker_keys"`
 		Agents       []*agent.AgentConfig                  `json:"agents" yaml:"agents,omitempty"`
 		Notification []*notif.NotificationConfig           `json:"notification" yaml:"notification,omitempty"`
-		Proxmox      []*proxmox.Config                     `json:"proxmox" yaml:"proxmox,omitempty"`
+		Proxmox      []proxmox.Config                      `json:"proxmox" yaml:"proxmox,omitempty"`
 		MaxMind      *maxmind.Config                       `json:"maxmind" yaml:"maxmind,omitempty"`
 	}
 )

 func Validate(data []byte) gperr.Error {
 	var model Config
-	return serialization.UnmarshalValidate(data, &model, yaml.Unmarshal)
+	return serialization.UnmarshalValidateYAML(data, &model)
 }

 func DefaultConfig() Config {
--- a/internal/dnsproviders/go.mod
+++ b/internal/dnsproviders/go.mod
@@ -1,19 +1,19 @@
 module github.com/yusing/godoxy/internal/dnsproviders

-go 1.25.6
+go 1.25.5

 replace github.com/yusing/godoxy => ../..

 require (
-	github.com/go-acme/lego/v4 v4.31.0
-	github.com/yusing/godoxy v0.25.2
+	github.com/go-acme/lego/v4 v4.30.1
+	github.com/yusing/godoxy v0.23.0
 )

 require (
-	cloud.google.com/go/auth v0.18.1 // indirect
+	cloud.google.com/go/auth v0.18.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns v1.2.0 // indirect
@@ -24,8 +24,8 @@ require (
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
 	github.com/bytedance/gopkg v0.1.3 // indirect
-	github.com/bytedance/sonic v1.15.0 // indirect
-	github.com/bytedance/sonic/loader v0.5.0 // indirect
+	github.com/bytedance/sonic v1.14.2 // indirect
+	github.com/bytedance/sonic/loader v0.4.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudwego/base64x v0.1.6 // indirect
@@ -41,14 +41,14 @@ require (
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.30.1 // indirect
 	github.com/go-resty/resty/v2 v2.17.1 // indirect
-	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/goccy/go-yaml v1.19.1 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
 	github.com/googleapis/gax-go/v2 v2.16.0 // indirect
 	github.com/gotify/server/v2 v2.8.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
@@ -57,22 +57,22 @@ require (
 	github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/linode/linodego v1.64.0 // indirect
+	github.com/linode/linodego v1.63.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/maxatome/go-testdeep v1.14.0 // indirect
-	github.com/miekg/dns v1.1.72 // indirect
+	github.com/miekg/dns v1.1.69 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/nrdcg/goacmedns v0.2.0 // indirect
 	github.com/nrdcg/goinwx v0.12.0 // indirect
-	github.com/nrdcg/oci-go-sdk/common/v1065 v1065.107.0 // indirect
-	github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.107.0 // indirect
+	github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2 // indirect
+	github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2 // indirect
 	github.com/nrdcg/porkbun v0.4.0 // indirect
 	github.com/ovh/go-ovh v1.9.0 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/pquerna/otp v1.5.0 // indirect
-	github.com/puzpuzpuz/xsync/v4 v4.4.0 // indirect
+	github.com/puzpuzpuz/xsync/v4 v4.2.0 // indirect
 	github.com/rs/zerolog v1.34.0 // indirect
 	github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 // indirect
 	github.com/sony/gobreaker v1.0.0 // indirect
@@ -90,19 +90,19 @@ require (
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
 	go.uber.org/ratelimit v0.3.1 // indirect
 	golang.org/x/arch v0.23.0 // indirect
-	golang.org/x/crypto v0.47.0 // indirect
-	golang.org/x/mod v0.32.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/crypto v0.46.0 // indirect
+	golang.org/x/mod v0.31.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
-	golang.org/x/tools v0.41.0 // indirect
-	google.golang.org/api v0.263.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/tools v0.40.0 // indirect
+	google.golang.org/api v0.258.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
 	google.golang.org/grpc v1.78.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
-	gopkg.in/ini.v1 v1.67.1 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
--- a/internal/dnsproviders/go.sum
+++ b/internal/dnsproviders/go.sum
@@ -1,12 +1,12 @@
-cloud.google.com/go/auth v0.18.1 h1:IwTEx92GFUo2pJ6Qea0EU3zYvKnTAeRCODxfA/G5UWs=
-cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA=
+cloud.google.com/go/auth v0.18.0 h1:wnqy5hrv7p3k7cShwAU/Br3nzod7fxoqG+k0VZ+/Pk0=
+cloud.google.com/go/auth v0.18.0/go.mod h1:wwkPM1AgE1f2u6dG443MiWoD8C3BtOywNsUMcUTVDRo=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
@@ -39,10 +39,10 @@ github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVk
 github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
 github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
-github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
-github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
-github.com/bytedance/sonic/loader v0.5.0 h1:gXH3KVnatgY7loH5/TkeVyXPfESoqSBSBEiDd5VjlgE=
-github.com/bytedance/sonic/loader v0.5.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
+github.com/bytedance/sonic v1.14.2 h1:k1twIoe97C1DtYUo+fZQy865IuHia4PR5RPiuGPPIIE=
+github.com/bytedance/sonic v1.14.2/go.mod h1:T80iDELeHiHKSc0C9tubFygiuXoGzrkjKzX2quAx980=
+github.com/bytedance/sonic/loader v0.4.0 h1:olZ7lEqcxtZygCK9EKYKADnpQoYkRQxaeY2NYzevs+o=
+github.com/bytedance/sonic/loader v0.4.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -62,8 +62,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
 github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
-github.com/go-acme/lego/v4 v4.31.0 h1:gd4oUYdfs83PR1/SflkNdit9xY1iul2I4EystnU8NXM=
-github.com/go-acme/lego/v4 v4.31.0/go.mod h1:m6zcfX/zcbMYDa8s6AnCMnoORWNP8Epnei+6NBCTUGs=
+github.com/go-acme/lego/v4 v4.30.1 h1:tmb6U0lvy8Mc3lQbqKwTat7oAhE8FUYNJ3D0gSg6pJU=
+github.com/go-acme/lego/v4 v4.30.1/go.mod h1:V7m/Ip+EeFkjOe028+zeH+SwWtESxw1LHelwMIfAjm4=
 github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
 github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -83,15 +83,15 @@ github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy0
 github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
 github.com/go-resty/resty/v2 v2.17.1 h1:x3aMpHK1YM9e4va/TMDRlusDDoZiQ+ViDu/WpA6xTM4=
 github.com/go-resty/resty/v2 v2.17.1/go.mod h1:kCKZ3wWmwJaNc7S29BRtUhJwy7iqmn+2mLtQrOyQlVA=
-github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
-github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
-github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/goccy/go-yaml v1.19.1 h1:3rG3+v8pkhRqoQ/88NYNMHYVGYztCOCIZ7UQhu7H+NE=
+github.com/goccy/go-yaml v1.19.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
 github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
-github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
-github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -103,8 +103,8 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
-github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.16.0 h1:iHbQmKLLZrexmb0OSsNGTeSTS0HO4YvFOG8g5E4Zd0Y=
 github.com/googleapis/gax-go/v2 v2.16.0/go.mod h1:o1vfQjjNZn4+dPnRdl/4ZD7S9414Y4xA+a/6Icj6l14=
 github.com/gotify/server/v2 v2.8.0 h1:E3UDDn/3rFZi1sjZfbuhXNnxJP3ACZhdcw/iySegPRA=
@@ -131,8 +131,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/linode/linodego v1.64.0 h1:If6pULIwHuQytgogtpQaBdVLX7z2TTHUF5u1tj2TPiY=
-github.com/linode/linodego v1.64.0/go.mod h1:GoiwLVuLdBQcAebxAVKVL3mMYUgJZR/puOUSla04xBE=
+github.com/linode/linodego v1.63.0 h1:MdjizfXNJDVJU6ggoJmMO5O9h4KGPGivNX0fzrAnstk=
+github.com/linode/linodego v1.63.0/go.mod h1:GoiwLVuLdBQcAebxAVKVL3mMYUgJZR/puOUSla04xBE=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
@@ -142,18 +142,18 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/maxatome/go-testdeep v1.14.0 h1:rRlLv1+kI8eOI3OaBXZwb3O7xY3exRzdW5QyX48g9wI=
 github.com/maxatome/go-testdeep v1.14.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM=
-github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
-github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
+github.com/miekg/dns v1.1.69 h1:Kb7Y/1Jo+SG+a2GtfoFUfDkG//csdRPwRLkCsxDG9Sc=
+github.com/miekg/dns v1.1.69/go.mod h1:7OyjD9nEba5OkqQ/hB4fy3PIoxafSZJtducccIelz3g=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/nrdcg/goacmedns v0.2.0 h1:ADMbThobzEMnr6kg2ohs4KGa3LFqmgiBA22/6jUWJR0=
 github.com/nrdcg/goacmedns v0.2.0/go.mod h1:T5o6+xvSLrQpugmwHvrSNkzWht0UGAwj2ACBMhh73Cg=
 github.com/nrdcg/goinwx v0.12.0 h1:ujdUqDBnaRSFwzVnImvPHYw3w3m9XgmGImNUw1GyMb4=
 github.com/nrdcg/goinwx v0.12.0/go.mod h1:IrVKd3ZDbFiMjdPgML4CSxZAY9wOoqLvH44zv3NodJ0=
-github.com/nrdcg/oci-go-sdk/common/v1065 v1065.107.0 h1:eMzyN+jGJbxG4ut278uwIsUo9XacXc711lFjhKnaUso=
-github.com/nrdcg/oci-go-sdk/common/v1065 v1065.107.0/go.mod h1:Gcs8GCaZXL3FdiDWgdnMxlOLEdRprJJnPYB22TX1jw8=
-github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.107.0 h1:t34IpOa+8NfmjkU8bdWtYrLrmr346/FGhu8FlpJDQok=
-github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.107.0/go.mod h1:p95/OxVsdx71I2Qrck1GtIS87sRxcTRKXzUi5nWm9NY=
+github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2 h1:l0tH15ACQADZAzC+LZ+mo2tIX4H6uZu0ulrVmG5Tqz0=
+github.com/nrdcg/oci-go-sdk/common/v1065 v1065.105.2/go.mod h1:Gcs8GCaZXL3FdiDWgdnMxlOLEdRprJJnPYB22TX1jw8=
+github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2 h1:gzB4c6ztb38C/jYiqEaFC+mCGcWFHDji9e6jwymY9d4=
+github.com/nrdcg/oci-go-sdk/dns/v1065 v1065.105.2/go.mod h1:l1qIPIq2uRV5WTSvkbhbl/ndbeOu7OCb3UZ+0+2ZSb8=
 github.com/nrdcg/porkbun v0.4.0 h1:rWweKlwo1PToQ3H+tEO9gPRW0wzzgmI/Ob3n2Guticw=
 github.com/nrdcg/porkbun v0.4.0/go.mod h1:/QMskrHEIM0IhC/wY7iTCUgINsxdT2WcOphktJ9+Q54=
 github.com/ovh/go-ovh v1.9.0 h1:6K8VoL3BYjVV3In9tPJUdT7qMx9h0GExN9EXx1r2kKE=
@@ -166,8 +166,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
 github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/puzpuzpuz/xsync/v4 v4.4.0 h1:vlSN6/CkEY0pY8KaB0yqo/pCLZvp9nhdbBdjipT4gWo=
-github.com/puzpuzpuz/xsync/v4 v4.4.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
+github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
+github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
@@ -223,12 +223,12 @@ go.uber.org/ratelimit v0.3.1 h1:K4qVE+byfv/B3tC+4nYWP7v/6SimcO7HzHekoMNBma0=
 go.uber.org/ratelimit v0.3.1/go.mod h1:6euWsTB6U/Nb3X++xEUXA8ciPJvr19Q/0h1+oDcJhRk=
 golang.org/x/arch v0.23.0 h1:lKF64A2jF6Zd8L0knGltUnegD62JMFBiCPBmQpToHhg=
 golang.org/x/arch v0.23.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
@@ -237,26 +237,26 @@ golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
-golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.263.0 h1:UFs7qn8gInIdtk1ZA6eXRXp5JDAnS4x9VRsRVCeKdbk=
-google.golang.org/api v0.263.0/go.mod h1:fAU1xtNNisHgOF5JooAs8rRaTkl2rT3uaoNGo9NS3R8=
+google.golang.org/api v0.258.0 h1:IKo1j5FBlN74fe5isA2PVozN3Y5pwNKriEgAXPOkDAc=
+google.golang.org/api v0.258.0/go.mod h1:qhOMTQEZ6lUps63ZNq9jhODswwjkjYYguA7fA3TBFww=
 google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 h1:GvESR9BIyHUahIb0NcTum6itIWtdoglGX+rnGxm2934=
 google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:yJ2HH4EHEDTd3JiLmhds6NkJ17ITVYOdV3m3VKOnws0=
 google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
 google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
 google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
@@ -264,8 +264,8 @@ google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/ini.v1 v1.67.1 h1:tVBILHy0R6e4wkYOn3XmiITt/hEVH4TFMYvAX2Ytz6k=
-gopkg.in/ini.v1 v1.67.1/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
--- a/internal/docker/client.go
+++ b/internal/docker/client.go
@@ -152,7 +152,7 @@ func NewClient(cfg types.DockerProviderConfig, unique ...bool) (*SharedClient, e
 	if agent.IsDockerHostAgent(host) {
 		a, ok := agentpool.Get(host)
 		if !ok {
-			return nil, fmt.Errorf("agent %q not found", host)
+			panic(fmt.Errorf("agent %q not found", host))
 		}
 		opt = []client.Opt{
 			client.WithHost(agent.DockerHost),
--- a/internal/docker/container.go
+++ b/internal/docker/container.go
@@ -210,25 +210,23 @@ func setPrivateHostname(c *types.Container, helper containerHelper) {
 		return
 	}
 	if c.Network != "" {
-		v, hasNetwork := helper.NetworkSettings.Networks[c.Network]
-		if hasNetwork && v.IPAddress.IsValid() {
+		v, ok := helper.NetworkSettings.Networks[c.Network]
+		if ok && v.IPAddress.IsValid() {
 			c.PrivateHostname = v.IPAddress.String()
 			return
 		}
-		var hasComposeNetwork bool
 		// try {project_name}_{network_name}
 		if proj := DockerComposeProject(c); proj != "" {
-			newNetwork := fmt.Sprintf("%s_%s", proj, c.Network)
-			v, hasComposeNetwork = helper.NetworkSettings.Networks[newNetwork]
-			if hasComposeNetwork && v.IPAddress.IsValid() {
-				c.Network = newNetwork // update network to the new one
-				c.PrivateHostname = v.IPAddress.String()
-				return
+			oldNetwork, newNetwork := c.Network, fmt.Sprintf("%s_%s", proj, c.Network)
+			if newNetwork != oldNetwork {
+				v, ok = helper.NetworkSettings.Networks[newNetwork]
+				if ok && v.IPAddress.IsValid() {
+					c.Network = newNetwork // update network to the new one
+					c.PrivateHostname = v.IPAddress.String()
+					return
+				}
 			}
 		}
-		if hasNetwork || hasComposeNetwork { // network is found, but no IP assigned yet
-			return
-		}
 		nearest := gperr.DoYouMeanField(c.Network, helper.NetworkSettings.Networks)
 		addError(c, fmt.Errorf("network %q not found, %w", c.Network, nearest))
 		return
--- a/internal/entrypoint/entrypoint.go
+++ b/internal/entrypoint/entrypoint.go
@@ -100,7 +100,7 @@ func (ep *Entrypoint) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		rec := accesslog.GetResponseRecorder(w)
 		w = rec
 		defer func() {
-			ep.accessLogger.LogRequest(r, rec.Response())
+			ep.accessLogger.Log(r, rec.Response())
 			accesslog.PutResponseRecorder(rec)
 		}()
 	}
--- a/internal/go-proxmox
+++ b/internal/go-proxmox
--- a/internal/health/check/http.go
+++ b/internal/health/check/http.go
@@ -76,11 +76,8 @@ func H2C(ctx context.Context, url *url.URL, method, path string, timeout time.Du

 	setCommonHeaders(req.Header.Set)

-	client := *h2cClient
-	client.Timeout = timeout
-
 	start := time.Now()
-	resp, err := client.Do(req)
+	resp, err := h2cClient.Do(req)
 	lat := time.Since(start)

 	if resp != nil {
--- a/internal/health/check/stream.go
+++ b/internal/health/check/stream.go
@@ -12,14 +12,6 @@ import (
 )

 func Stream(ctx context.Context, url *url.URL, timeout time.Duration) (types.HealthCheckResult, error) {
-	if port := url.Port(); port == "" || port == "0" {
-		return types.HealthCheckResult{
-			Latency: 0,
-			Healthy: false,
-			Detail:  "no port specified",
-		}, nil
-	}
-
 	dialer := net.Dialer{
 		Timeout:       timeout,
 		FallbackDelay: -1,
--- a/internal/health/monitor/monitor.go
+++ b/internal/health/monitor/monitor.go
@@ -26,8 +26,6 @@ type (
 		config  types.HealthCheckConfig
 		url     synk.Value[*url.URL]

-		onUpdateURL func(url *url.URL)
-
 		status     synk.Value[types.HealthStatus]
 		lastResult synk.Value[types.HealthCheckResult]

@@ -153,9 +151,6 @@ func (mon *monitor) UpdateURL(url *url.URL) {
 		return
 	}
 	mon.url.Store(url)
-	if mon.onUpdateURL != nil {
-		mon.onUpdateURL(url)
-	}
 }

 // URL implements HealthChecker.
--- a/internal/health/monitor/new.go
+++ b/internal/health/monitor/new.go
@@ -97,7 +97,7 @@ func NewDockerHealthMonitor(config types.HealthCheckConfig, client *docker.Share
 	isFirstFailure := true

 	var mon monitor
-	mon.init(displayURL, config, func(_ *url.URL) (result Result, err error) {
+	mon.init(displayURL, config, func(u *url.URL) (result Result, err error) {
 		result, err = healthcheck.Docker(mon.Context(), state, config.Timeout)
 		if err != nil {
 			if isFirstFailure {
@@ -110,14 +110,13 @@ func NewDockerHealthMonitor(config types.HealthCheckConfig, client *docker.Share
 		}
 		return result, nil
 	})
-	mon.onUpdateURL = fallback.UpdateURL
 	return &mon
 }

 func NewAgentProxiedMonitor(config types.HealthCheckConfig, agent *agentpool.Agent, targetUrl *url.URL) Monitor {
 	var mon monitor
 	mon.init(targetUrl, config, func(u *url.URL) (result Result, err error) {
-		return CheckHealthAgentProxied(agent, config.Timeout, u)
+		return CheckHealthAgentProxied(agent, config.Timeout, targetUrl)
 	})
 	return &mon
 }
--- a/internal/homepage/README.md
+++ b/internal/homepage/README.md
@@ -1,6 +1,6 @@
 # Homepage

-The homepage package provides the GoDoxy WebUI dashboard with support for categories, favorites, widgets, dynamic item configuration, and icon management.
+The homepage package provides the GoDoxy WebUI dashboard with support for categories, favorites, widgets, and dynamic item configuration.

 ## Overview

@@ -194,6 +194,18 @@ Widgets can display various types of information:
 - **Links**: Quick access links
 - **Custom**: Provider-specific data

+## Icon Handling
+
+Icons are handled via `IconURL` type:
+
+```go
+type IconURL struct {
+    // Icon URL with various sources
+}
+
+// Automatic favicon fetching from item URL
+```
+
 ## Categories

 ### Default Categories
--- a/internal/homepage/icons/fetch/content.go
+++ b/internal/homepage/icons/fetch/content.go
@@ -1,4 +1,4 @@
-package iconfetch
+package homepage

 import (
 	"bufio"
--- a/internal/homepage/icons/fetch/fetch.go
+++ b/internal/homepage/icons/fetch/fetch.go
@@ -1,4 +1,4 @@
-package iconfetch
+package homepage

 import (
 	"bytes"
@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"math"
 	"net/http"
 	"net/url"
 	"slices"
@@ -16,7 +15,6 @@ import (
 	"github.com/PuerkitoBio/goquery"
 	"github.com/gin-gonic/gin"
 	"github.com/vincent-petithory/dataurl"
-	"github.com/yusing/godoxy/internal/homepage/icons"
 	gphttp "github.com/yusing/godoxy/internal/net/gphttp"
 	apitypes "github.com/yusing/goutils/apitypes"
 	"github.com/yusing/goutils/cache"
@@ -24,22 +22,22 @@ import (
 	strutils "github.com/yusing/goutils/strings"
 )

-type Result struct {
+type FetchResult struct {
 	Icon       []byte
 	StatusCode int

 	contentType string
-} // @name IconFetchResult
-
-func FetchResultWithErrorf(statusCode int, msgFmt string, args ...any) (Result, error) {
-	return Result{StatusCode: statusCode}, fmt.Errorf(msgFmt, args...)
 }

-func FetchResultOK(icon []byte, contentType string) (Result, error) {
-	return Result{Icon: icon, contentType: contentType}, nil
+func FetchResultWithErrorf(statusCode int, msgFmt string, args ...any) (FetchResult, error) {
+	return FetchResult{StatusCode: statusCode}, fmt.Errorf(msgFmt, args...)
 }

-func GinError(c *gin.Context, statusCode int, err error) {
+func FetchResultOK(icon []byte, contentType string) (FetchResult, error) {
+	return FetchResult{Icon: icon, contentType: contentType}, nil
+}
+
+func GinFetchError(c *gin.Context, statusCode int, err error) {
 	if statusCode == 0 {
 		statusCode = http.StatusInternalServerError
 	}
@@ -52,7 +50,7 @@ func GinError(c *gin.Context, statusCode int, err error) {

 const faviconFetchTimeout = 3 * time.Second

-func (res *Result) ContentType() string {
+func (res *FetchResult) ContentType() string {
 	if res.contentType == "" {
 		if bytes.HasPrefix(res.Icon, []byte("<svg")) || bytes.HasPrefix(res.Icon, []byte("<?xml")) {
 			return "image/svg+xml"
@@ -64,19 +62,19 @@ func (res *Result) ContentType() string {

 const maxRedirectDepth = 5

-func FetchFavIconFromURL(ctx context.Context, iconURL *icons.URL) (Result, error) {
-	switch iconURL.Source {
-	case icons.SourceAbsolute:
+func FetchFavIconFromURL(ctx context.Context, iconURL *IconURL) (FetchResult, error) {
+	switch iconURL.IconSource {
+	case IconSourceAbsolute:
 		return FetchIconAbsolute(ctx, iconURL.URL())
-	case icons.SourceRelative:
+	case IconSourceRelative:
 		return FetchResultWithErrorf(http.StatusBadRequest, "unexpected relative icon")
-	case icons.SourceWalkXCode, icons.SourceSelfhSt:
+	case IconSourceWalkXCode, IconSourceSelfhSt:
 		return fetchKnownIcon(ctx, iconURL)
 	}
 	return FetchResultWithErrorf(http.StatusBadRequest, "invalid icon source")
 }

-var FetchIconAbsolute = cache.NewKeyFunc(func(ctx context.Context, url string) (Result, error) {
+var FetchIconAbsolute = cache.NewKeyFunc(func(ctx context.Context, url string) (FetchResult, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return FetchResultWithErrorf(http.StatusInternalServerError, "cannot create request: %w", err)
@@ -105,7 +103,7 @@ var FetchIconAbsolute = cache.NewKeyFunc(func(ctx context.Context, url string) (
 		return FetchResultWithErrorf(http.StatusNotFound, "empty icon")
 	}

-	res := Result{Icon: icon}
+	res := FetchResult{Icon: icon}
 	if contentType := resp.Header.Get("Content-Type"); contentType != "" {
 		res.contentType = contentType
 	}
@@ -124,22 +122,22 @@ func sanitizeName(name string) string {
 	return strings.ToLower(nameSanitizer.Replace(name))
 }

-func fetchKnownIcon(ctx context.Context, url *icons.URL) (Result, error) {
+func fetchKnownIcon(ctx context.Context, url *IconURL) (FetchResult, error) {
 	// if icon isn't in the list, no need to fetch
 	if !url.HasIcon() {
-		return Result{StatusCode: http.StatusNotFound}, errors.New("no such icon")
+		return FetchResult{StatusCode: http.StatusNotFound}, errors.New("no such icon")
 	}

 	return FetchIconAbsolute(ctx, url.URL())
 }

-func fetchIcon(ctx context.Context, filename string) (Result, error) {
+func fetchIcon(ctx context.Context, filename string) (FetchResult, error) {
 	for _, fileType := range []string{"svg", "webp", "png"} {
-		result, err := fetchKnownIcon(ctx, icons.NewURL(icons.SourceSelfhSt, filename, fileType))
+		result, err := fetchKnownIcon(ctx, NewSelfhStIconURL(filename, fileType))
 		if err == nil {
 			return result, err
 		}
-		result, err = fetchKnownIcon(ctx, icons.NewURL(icons.SourceWalkXCode, filename, fileType))
+		result, err = fetchKnownIcon(ctx, NewWalkXCodeIconURL(filename, fileType))
 		if err == nil {
 			return result, err
 		}
@@ -152,10 +150,10 @@ type contextValue struct {
 	uri string
 }

-func FindIcon(ctx context.Context, r route, uri string, variant icons.Variant) (Result, error) {
+func FindIcon(ctx context.Context, r route, uri string, variant IconVariant) (FetchResult, error) {
 	for _, ref := range r.References() {
 		ref = sanitizeName(ref)
-		if variant != icons.VariantNone {
+		if variant != IconVariantNone {
 			ref += "-" + string(variant)
 		}
 		result, err := fetchIcon(ctx, ref)
@@ -164,21 +162,18 @@ func FindIcon(ctx context.Context, r route, uri string, variant icons.Variant) (
 		}
 	}
 	if r, ok := r.(httpRoute); ok {
-		if mon := r.HealthMonitor(); mon != nil && !mon.Status().Good() {
-			return FetchResultWithErrorf(http.StatusServiceUnavailable, "service unavailable")
-		}
 		// fallback to parse html
 		return findIconSlowCached(context.WithValue(ctx, "route", contextValue{r: r, uri: uri}), r.Key())
 	}
 	return FetchResultWithErrorf(http.StatusNotFound, "no icon found")
 }

-var findIconSlowCached = cache.NewKeyFunc(func(ctx context.Context, key string) (Result, error) {
+var findIconSlowCached = cache.NewKeyFunc(func(ctx context.Context, key string) (FetchResult, error) {
 	v := ctx.Value("route").(contextValue)
 	return findIconSlow(ctx, v.r, v.uri, nil)
-}).WithMaxEntries(200).WithRetriesConstantBackoff(math.MaxInt, 15*time.Second).Build() // infinite retries, 15 seconds interval
+}).WithMaxEntries(200).Build() // no retries, no ttl

-func findIconSlow(ctx context.Context, r httpRoute, uri string, stack []string) (Result, error) {
+func findIconSlow(ctx context.Context, r httpRoute, uri string, stack []string) (FetchResult, error) {
 	select {
 	case <-ctx.Done():
 		return FetchResultWithErrorf(http.StatusBadGateway, "request timeout")
--- a/internal/homepage/homepage.go
+++ b/internal/homepage/homepage.go
@@ -5,7 +5,6 @@ import (
 	"strings"

 	"github.com/yusing/ds/ordered"
-	"github.com/yusing/godoxy/internal/homepage/icons"
 	"github.com/yusing/godoxy/internal/homepage/widgets"
 	"github.com/yusing/godoxy/internal/serialization"
 	strutils "github.com/yusing/goutils/strings"
@@ -23,13 +22,13 @@ type (
 	} // @name HomepageCategory

 	ItemConfig struct {
-		Show        bool       `json:"show"`
-		Name        string     `json:"name"` // display name
-		Icon        *icons.URL `json:"icon" swaggertype:"string"`
-		Category    string     `json:"category" validate:"omitempty"`
-		Description string     `json:"description" aliases:"desc"`
-		URL         string     `json:"url,omitempty"`
-		Favorite    bool       `json:"favorite"`
+		Show        bool     `json:"show"`
+		Name        string   `json:"name"` // display name
+		Icon        *IconURL `json:"icon" swaggertype:"string"`
+		Category    string   `json:"category" validate:"omitempty"`
+		Description string   `json:"description" aliases:"desc"`
+		URL         string   `json:"url,omitempty"`
+		Favorite    bool     `json:"favorite"`

 		WidgetConfig *widgets.Config `json:"widget_config,omitempty" aliases:"widget" extensions:"x-nullable"`
 	} // @name HomepageItemConfig
--- a/internal/homepage/homepage_test.go
+++ b/internal/homepage/homepage_test.go
@@ -4,24 +4,19 @@ import (
 	"testing"

 	. "github.com/yusing/godoxy/internal/homepage"
-	"github.com/yusing/godoxy/internal/homepage/icons"

 	expect "github.com/yusing/goutils/testing"
 )

-func strPtr(s string) *string {
-	return &s
-}
-
 func TestOverrideItem(t *testing.T) {
 	a := &Item{
 		Alias: "foo",
 		ItemConfig: ItemConfig{
 			Show: false,
 			Name: "Foo",
-			Icon: &icons.URL{
-				FullURL: strPtr("/favicon.ico"),
-				Source:  icons.SourceRelative,
+			Icon: &IconURL{
+				FullURL:    strPtr("/favicon.ico"),
+				IconSource: IconSourceRelative,
 			},
 			Category: "App",
 		},
@@ -30,9 +25,9 @@ func TestOverrideItem(t *testing.T) {
 		Show:     true,
 		Name:     "Bar",
 		Category: "Test",
-		Icon: &icons.URL{
-			FullURL: strPtr("@walkxcode/example.png"),
-			Source:  icons.SourceWalkXCode,
+		Icon: &IconURL{
+			FullURL:    strPtr("@walkxcode/example.png"),
+			IconSource: IconSourceWalkXCode,
 		},
 	}
 	overrides := GetOverrideConfig()
--- a/internal/homepage/icons/url.go
+++ b/internal/homepage/icons/url.go
@@ -1,4 +1,4 @@
-package icons
+package homepage

 import (
 	"fmt"
@@ -8,43 +8,43 @@ import (
 )

 type (
-	URL struct {
-		Source `json:"source"`
+	IconURL struct {
+		IconSource `json:"source"`

-		FullURL *string `json:"value,omitempty"` // only for absolute/relative icons
-		Extra   *Extra  `json:"extra,omitempty"` // only for walkxcode/selfhst icons
+		FullURL *string    `json:"value,omitempty"` // only for absolute/relative icons
+		Extra   *IconExtra `json:"extra,omitempty"` // only for walkxcode/selfhst icons
 	}

-	Extra struct {
-		Key      Key    `json:"key"`
-		Ref      string `json:"ref"`
-		FileType string `json:"file_type"`
-		IsLight  bool   `json:"is_light"`
-		IsDark   bool   `json:"is_dark"`
+	IconExtra struct {
+		Key      IconKey `json:"key"`
+		Ref      string  `json:"ref"`
+		FileType string  `json:"file_type"`
+		IsLight  bool    `json:"is_light"`
+		IsDark   bool    `json:"is_dark"`
 	}

-	Source  string
-	Variant string
+	IconSource  string
+	IconVariant string
 )

 const (
-	SourceAbsolute  Source = "https://"
-	SourceRelative  Source = "@target"
-	SourceWalkXCode Source = "@walkxcode"
-	SourceSelfhSt   Source = "@selfhst"
+	IconSourceAbsolute  IconSource = "https://"
+	IconSourceRelative  IconSource = "@target"
+	IconSourceWalkXCode IconSource = "@walkxcode"
+	IconSourceSelfhSt   IconSource = "@selfhst"
 )

 const (
-	VariantNone  Variant = ""
-	VariantLight Variant = "light"
-	VariantDark  Variant = "dark"
+	IconVariantNone  IconVariant = ""
+	IconVariantLight IconVariant = "light"
+	IconVariantDark  IconVariant = "dark"
 )

 var ErrInvalidIconURL = gperr.New("invalid icon url")

-func NewURL(source Source, refOrName, format string) *URL {
+func NewIconURL(source IconSource, refOrName, format string) *IconURL {
 	switch source {
-	case SourceWalkXCode, SourceSelfhSt:
+	case IconSourceWalkXCode, IconSourceSelfhSt:
 	default:
 		panic("invalid icon source")
 	}
@@ -56,10 +56,10 @@ func NewURL(source Source, refOrName, format string) *URL {
 		isDark = true
 		refOrName = strings.TrimSuffix(refOrName, "-dark")
 	}
-	return &URL{
-		Source: source,
-		Extra: &Extra{
-			Key:      NewKey(source, refOrName),
+	return &IconURL{
+		IconSource: source,
+		Extra: &IconExtra{
+			Key:      NewIconKey(source, refOrName),
 			FileType: format,
 			Ref:      refOrName,
 			IsLight:  isLight,
@@ -68,42 +68,53 @@ func NewURL(source Source, refOrName, format string) *URL {
 	}
 }

-func (u *URL) HasIcon() bool {
-	return hasIcon(u)
+func NewSelfhStIconURL(refOrName, format string) *IconURL {
+	return NewIconURL(IconSourceSelfhSt, refOrName, format)
 }

-func (u *URL) WithVariant(variant Variant) *URL {
-	switch u.Source {
-	case SourceWalkXCode, SourceSelfhSt:
+func NewWalkXCodeIconURL(name, format string) *IconURL {
+	return NewIconURL(IconSourceWalkXCode, name, format)
+}
+
+// HasIcon checks if the icon referenced by the IconURL exists in the cache based on its source.
+// Returns false if the icon does not exist for IconSourceSelfhSt or IconSourceWalkXCode,
+// otherwise returns true.
+func (u *IconURL) HasIcon() bool {
+	return HasIcon(u)
+}
+
+func (u *IconURL) WithVariant(variant IconVariant) *IconURL {
+	switch u.IconSource {
+	case IconSourceWalkXCode, IconSourceSelfhSt:
 	default:
 		return u // no variant for absolute/relative icons
 	}

-	var extra *Extra
+	var extra *IconExtra
 	if u.Extra != nil {
-		extra = &Extra{
+		extra = &IconExtra{
 			Key:      u.Extra.Key,
 			Ref:      u.Extra.Ref,
 			FileType: u.Extra.FileType,
-			IsLight:  variant == VariantLight,
-			IsDark:   variant == VariantDark,
+			IsLight:  variant == IconVariantLight,
+			IsDark:   variant == IconVariantDark,
 		}
 		extra.Ref = strings.TrimSuffix(extra.Ref, "-light")
 		extra.Ref = strings.TrimSuffix(extra.Ref, "-dark")
 	}
-	return &URL{
-		Source:  u.Source,
-		FullURL: u.FullURL,
-		Extra:   extra,
+	return &IconURL{
+		IconSource: u.IconSource,
+		FullURL:    u.FullURL,
+		Extra:      extra,
 	}
 }

 // Parse implements strutils.Parser.
-func (u *URL) Parse(v string) error {
+func (u *IconURL) Parse(v string) error {
 	return u.parse(v, true)
 }

-func (u *URL) parse(v string, checkExists bool) error {
+func (u *IconURL) parse(v string, checkExists bool) error {
 	if v == "" {
 		return ErrInvalidIconURL
 	}
@@ -115,19 +126,19 @@ func (u *URL) parse(v string, checkExists bool) error {
 	switch beforeSlash {
 	case "http:", "https:":
 		u.FullURL = &v
-		u.Source = SourceAbsolute
+		u.IconSource = IconSourceAbsolute
 	case "@target", "": // @target/favicon.ico, /favicon.ico
 		url := v[slashIndex:]
 		if url == "/" {
 			return ErrInvalidIconURL.Withf("%s", "empty path")
 		}
 		u.FullURL = &url
-		u.Source = SourceRelative
+		u.IconSource = IconSourceRelative
 	case "@selfhst", "@walkxcode": // selfh.st / walkxcode Icons, @selfhst/<reference>.<format>
 		if beforeSlash == "@selfhst" {
-			u.Source = SourceSelfhSt
+			u.IconSource = IconSourceSelfhSt
 		} else {
-			u.Source = SourceWalkXCode
+			u.IconSource = IconSourceWalkXCode
 		}
 		parts := strings.Split(v[slashIndex+1:], ".")
 		if len(parts) != 2 {
@@ -150,15 +161,15 @@ func (u *URL) parse(v string, checkExists bool) error {
 			isDark = true
 			reference = strings.TrimSuffix(reference, "-dark")
 		}
-		u.Extra = &Extra{
-			Key:      NewKey(u.Source, reference),
+		u.Extra = &IconExtra{
+			Key:      NewIconKey(u.IconSource, reference),
 			FileType: format,
 			Ref:      reference,
 			IsLight:  isLight,
 			IsDark:   isDark,
 		}
 		if checkExists && !u.HasIcon() {
-			return ErrInvalidIconURL.Withf("no such icon %s.%s from %s", reference, format, u.Source)
+			return ErrInvalidIconURL.Withf("no such icon %s.%s from %s", reference, format, u.IconSource)
 		}
 	default:
 		return ErrInvalidIconURL.Subject(v)
@@ -167,7 +178,7 @@ func (u *URL) parse(v string, checkExists bool) error {
 	return nil
 }

-func (u *URL) URL() string {
+func (u *IconURL) URL() string {
 	if u.FullURL != nil {
 		return *u.FullURL
 	}
@@ -180,16 +191,16 @@ func (u *URL) URL() string {
 	} else if u.Extra.IsDark {
 		filename += "-dark"
 	}
-	switch u.Source {
-	case SourceWalkXCode:
+	switch u.IconSource {
+	case IconSourceWalkXCode:
 		return fmt.Sprintf("https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/%s/%s.%s", u.Extra.FileType, filename, u.Extra.FileType)
-	case SourceSelfhSt:
+	case IconSourceSelfhSt:
 		return fmt.Sprintf("https://cdn.jsdelivr.net/gh/selfhst/icons/%s/%s.%s", u.Extra.FileType, filename, u.Extra.FileType)
 	}
 	return ""
 }

-func (u *URL) String() string {
+func (u *IconURL) String() string {
 	if u.FullURL != nil {
 		return *u.FullURL
 	}
@@ -202,14 +213,14 @@ func (u *URL) String() string {
 	} else if u.Extra.IsDark {
 		suffix = "-dark"
 	}
-	return fmt.Sprintf("%s/%s%s.%s", u.Source, u.Extra.Ref, suffix, u.Extra.FileType)
+	return fmt.Sprintf("%s/%s%s.%s", u.IconSource, u.Extra.Ref, suffix, u.Extra.FileType)
 }

-func (u *URL) MarshalText() ([]byte, error) {
+func (u *IconURL) MarshalText() ([]byte, error) {
 	return []byte(u.String()), nil
 }

 // UnmarshalText implements encoding.TextUnmarshaler.
-func (u *URL) UnmarshalText(data []byte) error {
+func (u *IconURL) UnmarshalText(data []byte) error {
 	return u.parse(string(data), false)
 }
--- a/internal/homepage/icons/url_test.go
+++ b/internal/homepage/icons/url_test.go
@@ -1,9 +1,9 @@
-package icons_test
+package homepage_test

 import (
 	"testing"

-	. "github.com/yusing/godoxy/internal/homepage/icons"
+	. "github.com/yusing/godoxy/internal/homepage"
 	expect "github.com/yusing/goutils/testing"
 )

@@ -15,31 +15,31 @@ func TestIconURL(t *testing.T) {
 	tests := []struct {
 		name      string
 		input     string
-		wantValue *URL
+		wantValue *IconURL
 		wantErr   bool
 	}{
 		{
 			name:  "absolute",
 			input: "http://example.com/icon.png",
-			wantValue: &URL{
-				FullURL: strPtr("http://example.com/icon.png"),
-				Source:  SourceAbsolute,
+			wantValue: &IconURL{
+				FullURL:    strPtr("http://example.com/icon.png"),
+				IconSource: IconSourceAbsolute,
 			},
 		},
 		{
 			name:  "relative",
 			input: "@target/icon.png",
-			wantValue: &URL{
-				FullURL: strPtr("/icon.png"),
-				Source:  SourceRelative,
+			wantValue: &IconURL{
+				FullURL:    strPtr("/icon.png"),
+				IconSource: IconSourceRelative,
 			},
 		},
 		{
 			name:  "relative2",
 			input: "/icon.png",
-			wantValue: &URL{
-				FullURL: strPtr("/icon.png"),
-				Source:  SourceRelative,
+			wantValue: &IconURL{
+				FullURL:    strPtr("/icon.png"),
+				IconSource: IconSourceRelative,
 			},
 		},
 		{
@@ -55,10 +55,10 @@ func TestIconURL(t *testing.T) {
 		{
 			name:  "walkxcode",
 			input: "@walkxcode/adguard-home.png",
-			wantValue: &URL{
-				Source: SourceWalkXCode,
-				Extra: &Extra{
-					Key:      NewKey(SourceWalkXCode, "adguard-home"),
+			wantValue: &IconURL{
+				IconSource: IconSourceWalkXCode,
+				Extra: &IconExtra{
+					Key:      NewIconKey(IconSourceWalkXCode, "adguard-home"),
 					FileType: "png",
 					Ref:      "adguard-home",
 				},
@@ -67,10 +67,10 @@ func TestIconURL(t *testing.T) {
 		{
 			name:  "walkxcode_light",
 			input: "@walkxcode/pfsense-light.png",
-			wantValue: &URL{
-				Source: SourceWalkXCode,
-				Extra: &Extra{
-					Key:      NewKey(SourceWalkXCode, "pfsense"),
+			wantValue: &IconURL{
+				IconSource: IconSourceWalkXCode,
+				Extra: &IconExtra{
+					Key:      NewIconKey(IconSourceWalkXCode, "pfsense"),
 					FileType: "png",
 					Ref:      "pfsense",
 					IsLight:  true,
@@ -85,10 +85,10 @@ func TestIconURL(t *testing.T) {
 		{
 			name:  "selfh.st_valid",
 			input: "@selfhst/adguard-home.webp",
-			wantValue: &URL{
-				Source: SourceSelfhSt,
-				Extra: &Extra{
-					Key:      NewKey(SourceSelfhSt, "adguard-home"),
+			wantValue: &IconURL{
+				IconSource: IconSourceSelfhSt,
+				Extra: &IconExtra{
+					Key:      NewIconKey(IconSourceSelfhSt, "adguard-home"),
 					FileType: "webp",
 					Ref:      "adguard-home",
 				},
@@ -97,10 +97,10 @@ func TestIconURL(t *testing.T) {
 		{
 			name:  "selfh.st_light",
 			input: "@selfhst/adguard-home-light.png",
-			wantValue: &URL{
-				Source: SourceSelfhSt,
-				Extra: &Extra{
-					Key:      NewKey(SourceSelfhSt, "adguard-home"),
+			wantValue: &IconURL{
+				IconSource: IconSourceSelfhSt,
+				Extra: &IconExtra{
+					Key:      NewIconKey(IconSourceSelfhSt, "adguard-home"),
 					FileType: "png",
 					Ref:      "adguard-home",
 					IsLight:  true,
@@ -110,10 +110,10 @@ func TestIconURL(t *testing.T) {
 		{
 			name:  "selfh.st_dark",
 			input: "@selfhst/adguard-home-dark.svg",
-			wantValue: &URL{
-				Source: SourceSelfhSt,
-				Extra: &Extra{
-					Key:      NewKey(SourceSelfhSt, "adguard-home"),
+			wantValue: &IconURL{
+				IconSource: IconSourceSelfhSt,
+				Extra: &IconExtra{
+					Key:      NewIconKey(IconSourceSelfhSt, "adguard-home"),
 					FileType: "svg",
 					Ref:      "adguard-home",
 					IsDark:   true,
@@ -143,7 +143,7 @@ func TestIconURL(t *testing.T) {
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			u := &URL{}
+			u := &IconURL{}
 			err := u.Parse(tc.input)
 			if tc.wantErr {
 				expect.ErrorIs(t, ErrInvalidIconURL, err)
--- a/internal/homepage/icons/README.md
+++ b/internal/homepage/icons/README.md
@@ -1,491 +0,0 @@
-# Icons Package
-
-Icon URL parsing, fetching, and listing for the homepage dashboard.
-
-## Overview
-
-The icons package manages icon resources from multiple sources with support for light/dark variants and multiple image formats. It provides a unified API for parsing icon URLs, checking icon availability, fetching icon data, and searching available icons from CDN repositories.
-
-### Purpose
-
- Parse and validate icon URLs from various sources
- Fetch icon data with caching and fallback strategies
- Maintain a searchable index of available icons from walkxcode and selfh.st CDNs
- Support light/dark theme variants and multiple image formats (SVG, PNG, WebP)
-
-### Primary Consumers
-
- `internal/homepage/` - Homepage route management and icon assignment
- `internal/api/` - Icon search and listing API endpoints
- `internal/route/` - Route icon resolution for proxy targets
-
-### Non-goals
-
- Icon generation or modification (only fetching)
- Authentication for remote icon sources (public CDNs only)
- Icon validation beyond format checking
-
-### Stability
-
-This package exposes a stable public API. Internal implementations (caching strategies, fetch logic) may change without notice.
-
-## Concepts and Terminology
-
-| Term         | Definition                                                                            |
-| ------------ | ------------------------------------------------------------------------------------- |
-| **Source**   | The origin type of an icon (absolute URL, relative path, walkxcode CDN, selfh.st CDN) |
-| **Variant**  | Theme variant: none, light, or dark                                                   |
-| **Key**      | Unique identifier combining source and reference (e.g., `@walkxcode/nginx`)           |
-| **Meta**     | Metadata describing available formats and variants for an icon                        |
-| **Provider** | Interface for checking icon existence without fetching data                           |
-
-## Public API
-
-### Exported Types
-
-#### Source
-
-Source identifies the origin of an icon. Use the constants defined below.
-
-```go
-type Source string
-
-const (
-    // SourceAbsolute is a full URL (http:// or https://)
-    SourceAbsolute Source = "https://"
-
-    // SourceRelative is a path relative to the target service (@target or leading /)
-    SourceRelative Source = "@target"
-
-    // SourceWalkXCode is the walkxcode dashboard-icons CDN
-    SourceWalkXCode Source = "@walkxcode"
-
-    // SourceSelfhSt is the selfh.st icons CDN
-    SourceSelfhSt Source = "@selfhst"
-)
-```
-
-#### Variant
-
-Variant indicates the theme preference for icons that support light/dark modes.
-
-```go
-type Variant string
-
-const (
-    VariantNone  Variant = ""     // Default, no variant suffix
-    VariantLight Variant = "light" // Light theme variant (-light suffix)
-    VariantDark  Variant = "dark"  // Dark theme variant (-dark suffix)
-)
-```
-
-#### URL
-
-URL represents a parsed icon URL with its source and metadata.
-
-```go
-type URL struct {
-    // Source identifies the icon origin
-    Source `json:"source"`
-
-    // FullURL contains the resolved URL for absolute/relative sources
-    FullURL *string `json:"value,omitempty"`
-
-    // Extra contains metadata for CDN sources (walkxcode/selfhst)
-    Extra *Extra `json:"extra,omitempty"`
-}
-```
-
-**URL Methods:**
-
- `Parse(v string) error` - Parses an icon URL string (implements `strutils.Parser`)
- `URL() string` - Returns the absolute URL for fetching
- `HasIcon() bool` - Checks if the icon exists (requires Provider to be set)
- `WithVariant(variant Variant) *URL` - Returns a new URL with the specified variant
- `String() string` - Returns the original URL representation
- `MarshalText() ([]byte, error)` - Serializes to text (implements `encoding.TextMarshaler`)
- `UnmarshalText(data []byte) error` - Deserializes from text (implements `encoding.TextUnmarshaler`)
-
-#### Extra
-
-Extra contains metadata for icons from CDN sources.
-
-```go
-type Extra struct {
-    // Key is the unique icon key
-    Key Key `json:"key"`
-
-    // Ref is the icon reference name (without variant suffix)
-    Ref string `json:"ref"`
-
-    // FileType is the image format: "svg", "png", or "webp"
-    FileType string `json:"file_type"`
-
-    // IsLight indicates if this is a light variant
-    IsLight bool `json:"is_light"`
-
-    // IsDark indicates if this is a dark variant
-    IsDark bool `json:"is_dark"`
-}
-```
-
-#### Key
-
-Key is a unique identifier for an icon from a specific source.
-
-```go
-type Key string
-
-// NewKey creates a key from source and reference
-func NewKey(source Source, reference string) Key
-
-// SourceRef extracts the source and reference from a key
-func (k Key) SourceRef() (Source, string)
-```
-
-#### Meta
-
-Meta stores availability metadata for an icon.
-
-```go
-type Meta struct {
-    // Available formats
-    SVG  bool `json:"SVG"`  // SVG format available
-    PNG  bool `json:"PNG"`  // PNG format available
-    WebP bool `json:"WebP"` // WebP format available
-
-    // Available variants
-    Light bool `json:"Light"` // Light variant available
-    Dark  bool `json:"Dark"`  // Dark variant available
-
-    // DisplayName is the human-readable name (selfh.st only)
-    DisplayName string `json:"-"`
-
-    // Tag is the category tag (selfh.st only)
-    Tag string `json:"-"`
-}
-
-// Filenames returns all available filename variants for this icon
-func (icon *Meta) Filenames(ref string) []string
-```
-
-### Exported Functions
-
-```go
-// NewURL creates a URL for a CDN source with the given reference and format
-func NewURL(source Source, refOrName, format string) *URL
-
-// ErrInvalidIconURL is returned when icon URL parsing fails
-var ErrInvalidIconURL = gperr.New("invalid icon url")
-```
-
-### Provider Interface
-
-```go
-type Provider interface {
-    // HasIcon returns true if the icon exists in the provider's catalog
-    HasIcon(u *URL) bool
-}
-
-// SetProvider sets the global icon provider for existence checks
-func SetProvider(p Provider)
-```
-
-The provider pattern allows the icons package to check icon existence without fetching data. The `list` subpackage registers a provider that checks against the cached icon list.
-
-## Architecture
-
-### Core Components
-
-```mermaid
-graph TD
-    subgraph icons/
-        URL["URL"] --> Parser[URL Parser]
-        URL --> VariantHandler[Variant Handler]
-        Key --> Provider
-    end
-
-    subgraph fetch/
-        FetchFavIconFromURL --> FetchIconAbsolute
-        FetchFavIconFromURL --> FindIcon
-        FindIcon --> fetchKnownIcon
-        FindIcon --> findIconSlow
-        fetchKnownIcon --> FetchIconAbsolute
-    end
-
-    subgraph list/
-        InitCache --> updateIcons
-        updateIcons --> UpdateWalkxCodeIcons
-        updateIcons --> UpdateSelfhstIcons
-        SearchIcons --> fuzzyRank[Fuzzy Rank Match]
-        HasIcon --> ListAvailableIcons
-    end
-
-    style URL fill:#22553F,color:#fff
-    style list fill:#22553F,color:#fff
-    style fetch fill:#22553F,color:#fff
-```
-
-### Component Interactions
-
-1. **URL Parsing** (`url.go`): Parses icon URL strings and validates format
-2. **Icon Existence** (`provider.go`): Delegates to registered Provider
-3. **Icon Fetching** (`fetch/fetch.go`): Fetches icon data with caching
-4. **Icon Listing** (`list/list_icons.go`): Maintains cached index of available icons
-
-### Data Flow
-
-```mermaid
-sequenceDiagram
-    participant Client
-    participant URLParser
-    participant Provider
-    participant FetchCache
-    participant ExternalCDN
-
-    Client->>URLParser: Parse("@walkxcode/nginx.svg")
-    URLParser->>Provider: HasIcon(icon)
-    Provider->>FetchCache: Check cached list
-    FetchCache-->>Provider: exists
-    Provider-->>URLParser: true
-    URLParser-->>Client: URL object
-
-    Client->>FetchCache: FetchFavIconFromURL(url)
-    FetchCache->>ExternalCDN: GET https://...
-    ExternalCDN-->>FetchCache: icon data
-    FetchCache-->>Client: Result{Icon: [...], StatusCode: 200}
-```
-
-## Subpackages
-
-### fetch/
-
-Icon fetching implementation with caching and fallback strategies.
-
-```go
-type Result struct {
-    Icon       []byte  // Raw icon image data
-    StatusCode int     // HTTP status code from fetch
-}
-
-// FetchFavIconFromURL fetches an icon from a parsed URL
-func FetchFavIconFromURL(ctx context.Context, iconURL *URL) (Result, error)
-
-// FindIcon finds an icon for a route with variant support
-func FindIcon(ctx context.Context, r route, uri string, variant Variant) (Result, error)
-```
-
-**Key behaviors:**
-
- `FetchIconAbsolute` is cached with 200 entries and 4-hour TTL
- `findIconSlow` has infinite retries with 15-second backoff
- HTML parsing fallback extracts `<link rel=icon>` from target pages
-
-### list/
-
-Icon catalog management with search and caching.
-
-```go
-type IconMap map[Key]*Meta
-type IconMetaSearch struct {
-    *Meta
-    Source Source `json:"Source"`
-    Ref    string `json:"Ref"`
-    rank   int
-}
-
-// InitCache loads icon metadata from cache or remote sources
-func InitCache()
-
-// ListAvailableIcons returns the current icon catalog
-func ListAvailableIcons() IconMap
-
-// SearchIcons performs fuzzy search on icon names
-func SearchIcons(keyword string, limit int) []*IconMetaSearch
-
-// HasIcon checks if an icon exists in the catalog
-func HasIcon(icon *URL) bool
-```
-
-**Key behaviors:**
-
- Updates from walkxcode and selfh.st CDNs every 2 hours
- Persists cache to disk for fast startup
- Fuzzy search uses Levenshtein distance ranking
-
-## Configuration
-
-### Cache Location
-
-Icons cache is stored at the path specified by `common.IconListCachePath`.
-
-### Environment Variables
-
-No direct environment variable configuration. Cache is managed internally.
-
-### Reloading
-
-Icon cache updates automatically every 2 hours in the background. Manual refresh requires program restart.
-
-## Observability
-
-### Logs
-
- `failed to load icons` - Cache load failure at startup
- `icons loaded` - Successful cache load with entry count
- `updating icon data` - Background update started
- `icons list updated` - Successful cache refresh with entry count
- `failed to save icons` - Cache persistence failure
-
-### Metrics
-
-No metrics exposed directly. Status codes in `Result` can be monitored via HTTP handlers.
-
-### Tracing
-
-Standard `context.Context` propagation is used throughout. Fetch operations respect context cancellation and deadlines.
-
-## Security Considerations
-
- **Input Validation**: Icon URLs are strictly validated for format and source
- **SSRF Protection**: Only absolute URLs passed directly; no arbitrary URL construction
- **Content-Type**: Detected from response headers or inferred from SVG magic bytes
- **Size Limits**: Cache limited to 200 entries; no explicit size limit on icon data
- **Timeouts**: 3-second timeout on favicon fetches, 5-second timeout on list updates
-
-## Performance Characteristics
-
- **Parsing**: O(1) string parsing with early validation
- **Caching**: LRU-style cache with TTL for fetched icons
- **Background Updates**: Non-blocking updates every 2 hours
- **Search**: O(n) fuzzy match with early exit at rank > 3
- **Memory**: Icon list typically contains ~2000 entries
-
-## Failure Modes and Recovery
-
-| Failure                | Behavior                                 | Recovery                         |
-| ---------------------- | ---------------------------------------- | -------------------------------- |
-| CDN fetch timeout      | Return cached data or fail               | Automatic retry with backoff     |
-| Cache load failure     | Attempt legacy format, then remote fetch | Manual cache reset if persistent |
-| Icon not found in list | Return error from Parse                  | User must select valid icon      |
-| HTML parse failure     | Return "icon element not found"          | Manual icon selection            |
-
-## Usage Examples
-
-### Basic: Parse and Generate URL
-
-```go
-package main
-
-import (
-    "fmt"
-    "github.com/yusing/godoxy/internal/homepage/icons"
-)
-
-func main() {
-    // Parse a CDN icon URL
-    url := &icons.URL{}
-    err := url.Parse("@walkxcode/nginx.svg")
-    if err != nil {
-        panic(err)
-    }
-
-    // Get the actual fetchable URL
-    fmt.Println(url.URL())
-    // Output: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/svg/nginx.svg
-
-    // Get string representation
-    fmt.Println(url.String())
-    // Output: @walkxcode/nginx.svg
-
-    // Create with dark variant
-    darkUrl := url.WithVariant(icons.VariantDark)
-    fmt.Println(darkUrl.URL())
-    // Output: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/svg/nginx-dark.svg
-}
-```
-
-### Advanced: Fetch Icon Data
-
-```go
-package main
-
-import (
-    "context"
-    "fmt"
-    "net/http"
-
-    "github.com/yusing/godoxy/internal/homepage/icons/fetch"
-)
-
-func main() {
-    // Initialize the icon list cache first
-    iconlist.InitCache()
-
-    // Parse icon URL
-    url := &icons.URL{}
-    if err := url.Parse("@walkxcode/nginx.svg"); err != nil {
-        panic(err)
-    }
-
-    // Fetch icon data
-    ctx := context.Background()
-    result, err := fetch.FetchFavIconFromURL(ctx, url)
-    if err != nil {
-        fmt.Printf("Fetch failed: %v\n", err)
-        return
-    }
-
-    if result.StatusCode != http.StatusOK {
-        fmt.Printf("HTTP %d\n", result.StatusCode)
-        return
-    }
-
-    fmt.Printf("Fetched %d bytes, Content-Type: %s\n",
-        len(result.Icon), result.ContentType())
-}
-```
-
-### Integration: Search Available Icons
-
-```go
-package main
-
-import (
-    "fmt"
-
-    "github.com/yusing/godoxy/internal/homepage/icons/list"
-)
-
-func main() {
-    // Initialize cache
-    list.InitCache()
-
-    // Search for icons matching a keyword
-    results := list.SearchIcons("nginx", 5)
-
-    for _, icon := range results {
-        source, ref := icon.Key.SourceRef()
-        fmt.Printf("[%s] %s - SVG:%v PNG:%v WebP:%v\n",
-            source, ref, icon.SVG, icon.PNG, icon.WebP)
-    }
-}
-```
-
-## Testing Notes
-
- Unit tests in `url_test.go` validate parsing and serialization
- Test mode (`common.IsTest`) bypasses existence checks
- Mock HTTP in list tests via `MockHTTPGet()`
- Golden tests not used; test fixtures embedded in test cases
-
-## Icon URL Formats
-
-| Format        | Example                        | Output URL                                                            |
-| ------------- | ------------------------------ | --------------------------------------------------------------------- |
-| Absolute      | `https://example.com/icon.png` | `https://example.com/icon.png`                                        |
-| Relative      | `@target/favicon.ico`          | `/favicon.ico`                                                        |
-| WalkXCode     | `@walkxcode/nginx.svg`         | `https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/svg/nginx.svg` |
-| Selfh.st      | `@selfhst/adguard-home.webp`   | `https://cdn.jsdelivr.net/gh/selfhst/icons/webp/adguard-home.webp`    |
-| Light variant | `@walkxcode/nginx-light.png`   | `.../nginx-light.png`                                                 |
-| Dark variant  | `@walkxcode/nginx-dark.svg`    | `.../nginx-dark.svg`                                                  |
--- a/internal/homepage/icons/key.go
+++ b/internal/homepage/icons/key.go
@@ -1,17 +0,0 @@
-package icons
-
-import (
-	"fmt"
-	"strings"
-)
-
-type Key string
-
-func NewKey(source Source, reference string) Key {
-	return Key(fmt.Sprintf("%s/%s", source, reference))
-}
-
-func (k Key) SourceRef() (Source, string) {
-	source, ref, _ := strings.Cut(string(k), "/")
-	return Source(source), ref
-}
--- a/internal/homepage/icons/metadata.go
+++ b/internal/homepage/icons/metadata.go
@@ -1,43 +0,0 @@
-package icons
-
-type Meta struct {
-	SVG         bool   `json:"SVG"`
-	PNG         bool   `json:"PNG"`
-	WebP        bool   `json:"WebP"`
-	Light       bool   `json:"Light"`
-	Dark        bool   `json:"Dark"`
-	DisplayName string `json:"-"`
-	Tag         string `json:"-"`
-}
-
-func (icon *Meta) Filenames(ref string) []string {
-	filenames := make([]string, 0)
-	if icon.SVG {
-		filenames = append(filenames, ref+".svg")
-		if icon.Light {
-			filenames = append(filenames, ref+"-light.svg")
-		}
-		if icon.Dark {
-			filenames = append(filenames, ref+"-dark.svg")
-		}
-	}
-	if icon.PNG {
-		filenames = append(filenames, ref+".png")
-		if icon.Light {
-			filenames = append(filenames, ref+"-light.png")
-		}
-		if icon.Dark {
-			filenames = append(filenames, ref+"-dark.png")
-		}
-	}
-	if icon.WebP {
-		filenames = append(filenames, ref+".webp")
-		if icon.Light {
-			filenames = append(filenames, ref+"-light.webp")
-		}
-		if icon.Dark {
-			filenames = append(filenames, ref+"-dark.webp")
-		}
-	}
-	return filenames
-}
--- a/internal/homepage/icons/provider.go
+++ b/internal/homepage/icons/provider.go
@@ -1,21 +0,0 @@
-package icons
-
-import "sync/atomic"
-
-type Provider interface {
-	HasIcon(u *URL) bool
-}
-
-var provider atomic.Value
-
-func SetProvider(p Provider) {
-	provider.Store(p)
-}
-
-func hasIcon(u *URL) bool {
-	v := provider.Load()
-	if v == nil {
-		return false
-	}
-	return v.(Provider).HasIcon(u)
-}
--- a/internal/homepage/icons/list/list_icons.go
+++ b/internal/homepage/icons/list/list_icons.go
@@ -1,7 +1,8 @@
-package iconlist
+package homepage

 import (
 	"context"
+	"fmt"
 	"net/http"
 	"slices"
 	"strings"
@@ -11,7 +12,6 @@ import (
 	"github.com/lithammer/fuzzysearch/fuzzy"
 	"github.com/rs/zerolog/log"
 	"github.com/yusing/godoxy/internal/common"
-	"github.com/yusing/godoxy/internal/homepage/icons"
 	"github.com/yusing/godoxy/internal/serialization"
 	httputils "github.com/yusing/goutils/http"
 	"github.com/yusing/goutils/intern"
@@ -21,19 +21,60 @@ import (
 )

 type (
-	IconMap  map[icons.Key]*icons.Meta
+	IconKey  string
+	IconMap  map[IconKey]*IconMeta
 	IconList []string
-
+	IconMeta struct {
+		SVG         bool   `json:"SVG"`
+		PNG         bool   `json:"PNG"`
+		WebP        bool   `json:"WebP"`
+		Light       bool   `json:"Light"`
+		Dark        bool   `json:"Dark"`
+		DisplayName string `json:"-"`
+		Tag         string `json:"-"`
+	}
 	IconMetaSearch struct {
-		*icons.Meta
+		*IconMeta

-		Source icons.Source `json:"Source"`
-		Ref    string       `json:"Ref"`
+		Source IconSource `json:"Source"`
+		Ref    string     `json:"Ref"`

 		rank int
-	} // @name IconMetaSearch
+	}
 )

+func (icon *IconMeta) Filenames(ref string) []string {
+	filenames := make([]string, 0)
+	if icon.SVG {
+		filenames = append(filenames, ref+".svg")
+		if icon.Light {
+			filenames = append(filenames, ref+"-light.svg")
+		}
+		if icon.Dark {
+			filenames = append(filenames, ref+"-dark.svg")
+		}
+	}
+	if icon.PNG {
+		filenames = append(filenames, ref+".png")
+		if icon.Light {
+			filenames = append(filenames, ref+"-light.png")
+		}
+		if icon.Dark {
+			filenames = append(filenames, ref+"-dark.png")
+		}
+	}
+	if icon.WebP {
+		filenames = append(filenames, ref+".webp")
+		if icon.Light {
+			filenames = append(filenames, ref+"-light.webp")
+		}
+		if icon.Dark {
+			filenames = append(filenames, ref+"-dark.webp")
+		}
+	}
+	return filenames
+}
+
 const updateInterval = 2 * time.Hour

 var iconsCache synk.Value[IconMap]
@@ -43,32 +84,31 @@ const (
 	selfhstIcons   = "https://raw.githubusercontent.com/selfhst/icons/refs/heads/main/index.json"
 )

-type provider struct{}
-
-func (p provider) HasIcon(u *icons.URL) bool {
-	return HasIcon(u)
+func NewIconKey(source IconSource, reference string) IconKey {
+	return IconKey(fmt.Sprintf("%s/%s", source, reference))
 }

-func init() {
-	icons.SetProvider(provider{})
+func (k IconKey) SourceRef() (IconSource, string) {
+	source, ref, _ := strings.Cut(string(k), "/")
+	return IconSource(source), ref
 }

-func InitCache() {
+func InitIconListCache() {
 	m := make(IconMap)
-	err := serialization.LoadFileIfExist(common.IconListCachePath, &m, sonic.Unmarshal)
+	err := serialization.LoadJSONIfExist(common.IconListCachePath, &m)
 	if err != nil {
 		// backward compatible
 		oldFormat := struct {
 			Icons      IconMap
 			LastUpdate time.Time
 		}{}
-		err = serialization.LoadFileIfExist(common.IconListCachePath, &oldFormat, sonic.Unmarshal)
+		err = serialization.LoadJSONIfExist(common.IconListCachePath, &oldFormat)
 		if err != nil {
 			log.Error().Err(err).Msg("failed to load icons")
 		} else {
 			m = oldFormat.Icons
 			// store it to disk immediately
-			_ = serialization.SaveFile(common.IconListCachePath, &m, 0o644, sonic.Marshal)
+			_ = serialization.SaveJSON(common.IconListCachePath, &m, 0o644)
 		}
 	} else if len(m) > 0 {
 		log.Info().
@@ -84,7 +124,7 @@ func InitCache() {

 	task.OnProgramExit("save_icons_cache", func() {
 		icons := iconsCache.Load()
-		_ = serialization.SaveFile(common.IconListCachePath, &icons, 0o644, sonic.Marshal)
+		_ = serialization.SaveJSON(common.IconListCachePath, &icons, 0o644)
 	})

 	go backgroundUpdateIcons()
@@ -105,7 +145,7 @@ func backgroundUpdateIcons() {
 				// swap old cache with new cache
 				iconsCache.Store(newCache)
 				// save it to disk
-				err := serialization.SaveFile(common.IconListCachePath, &newCache, 0o644, sonic.Marshal)
+				err := serialization.SaveJSON(common.IconListCachePath, &newCache, 0o644)
 				if err != nil {
 					log.Warn().Err(err).Msg("failed to save icons")
 				}
@@ -156,10 +196,10 @@ func SearchIcons(keyword string, limit int) []*IconMetaSearch {

 		source, ref := k.SourceRef()
 		ranked := &IconMetaSearch{
-			Source: source,
-			Ref:    ref,
-			Meta:   icon,
-			rank:   rank,
+			Source:   source,
+			Ref:      ref,
+			IconMeta: icon,
+			rank:     rank,
 		}
 		// Sorted insert based on rank (lower rank = better match)
 		insertPos, _ := slices.BinarySearchFunc(results, ranked, sortByRank)
@@ -173,7 +213,7 @@ func SearchIcons(keyword string, limit int) []*IconMetaSearch {
 	return results[:min(len(results), limit)]
 }

-func HasIcon(icon *icons.URL) bool {
+func HasIcon(icon *IconURL) bool {
 	if icon.Extra == nil {
 		return false
 	}
@@ -201,11 +241,11 @@ type HomepageMeta struct {
 	Tag         string
 }

-func GetMetadata(ref string) (HomepageMeta, bool) {
-	meta, ok := ListAvailableIcons()[icons.NewKey(icons.SourceSelfhSt, ref)]
+func GetHomepageMeta(ref string) (HomepageMeta, bool) {
+	meta, ok := ListAvailableIcons()[NewIconKey(IconSourceSelfhSt, ref)]
 	// these info is not available in walkxcode
 	// if !ok {
-	// 	meta, ok = iconsCache.Icons[icons.NewIconKey(icons.IconSourceWalkXCode, ref)]
+	// 	meta, ok = iconsCache.Icons[NewIconKey(IconSourceWalkXCode, ref)]
 	// }
 	if !ok {
 		return HomepageMeta{}, false
@@ -277,14 +317,14 @@ func UpdateWalkxCodeIcons(m IconMap) error {
 	}

 	for fileType, files := range data {
-		var setExt func(icon *icons.Meta)
+		var setExt func(icon *IconMeta)
 		switch fileType {
 		case "png":
-			setExt = func(icon *icons.Meta) { icon.PNG = true }
+			setExt = func(icon *IconMeta) { icon.PNG = true }
 		case "svg":
-			setExt = func(icon *icons.Meta) { icon.SVG = true }
+			setExt = func(icon *IconMeta) { icon.SVG = true }
 		case "webp":
-			setExt = func(icon *icons.Meta) { icon.WebP = true }
+			setExt = func(icon *IconMeta) { icon.WebP = true }
 		}
 		for _, f := range files {
 			f = strings.TrimSuffix(f, "."+fileType)
@@ -296,10 +336,10 @@ func UpdateWalkxCodeIcons(m IconMap) error {
 			if isDark {
 				f = strings.TrimSuffix(f, "-dark")
 			}
-			key := icons.NewKey(icons.SourceWalkXCode, f)
+			key := NewIconKey(IconSourceWalkXCode, f)
 			icon, ok := m[key]
 			if !ok {
-				icon = new(icons.Meta)
+				icon = new(IconMeta)
 				m[key] = icon
 			}
 			setExt(icon)
@@ -361,7 +401,7 @@ func UpdateSelfhstIcons(m IconMap) error {
 			tag, _, _ = strings.Cut(item.Tags, ",")
 			tag = strings.TrimSpace(tag)
 		}
-		icon := &icons.Meta{
+		icon := &IconMeta{
 			DisplayName: item.Name,
 			Tag:         intern.Make(tag).Value(),
 			SVG:         item.SVG == "Yes",
@@ -370,7 +410,7 @@ func UpdateSelfhstIcons(m IconMap) error {
 			Light:       item.Light == "Yes",
 			Dark:        item.Dark == "Yes",
 		}
-		key := icons.NewKey(icons.SourceSelfhSt, item.Reference)
+		key := NewIconKey(IconSourceSelfhSt, item.Reference)
 		m[key] = icon
 	}
 	return nil
--- a/internal/homepage/icons/list/list_icons_test.go
+++ b/internal/homepage/icons/list/list_icons_test.go
@@ -1,10 +1,9 @@
-package iconlist_test
+package homepage_test

 import (
 	"testing"

-	. "github.com/yusing/godoxy/internal/homepage/icons"
-	. "github.com/yusing/godoxy/internal/homepage/icons/list"
+	. "github.com/yusing/godoxy/internal/homepage"
 )

 const walkxcodeIcons = `{
@@ -70,8 +69,8 @@ const selfhstIcons = `[
 ]`

 type testCases struct {
-	Key Key
-	Meta
+	Key IconKey
+	IconMeta
 }

 func runTests(t *testing.T, iconsCache IconMap, test []testCases) {
@@ -110,8 +109,8 @@ func TestListWalkxCodeIcons(t *testing.T) {
 	}
 	test := []testCases{
 		{
-			Key: NewKey(SourceWalkXCode, "app1"),
-			Meta: Meta{
+			Key: NewIconKey(IconSourceWalkXCode, "app1"),
+			IconMeta: IconMeta{
 				SVG:   true,
 				PNG:   true,
 				WebP:  true,
@@ -119,15 +118,15 @@ func TestListWalkxCodeIcons(t *testing.T) {
 			},
 		},
 		{
-			Key: NewKey(SourceWalkXCode, "app2"),
-			Meta: Meta{
+			Key: NewIconKey(IconSourceWalkXCode, "app2"),
+			IconMeta: IconMeta{
 				PNG:  true,
 				WebP: true,
 			},
 		},
 		{
-			Key: NewKey(SourceWalkXCode, "karakeep"),
-			Meta: Meta{
+			Key: NewIconKey(IconSourceWalkXCode, "karakeep"),
+			IconMeta: IconMeta{
 				SVG:  true,
 				PNG:  true,
 				WebP: true,
@@ -150,8 +149,8 @@ func TestListSelfhstIcons(t *testing.T) {
 	}
 	test := []testCases{
 		{
-			Key: NewKey(SourceSelfhSt, "2fauth"),
-			Meta: Meta{
+			Key: NewIconKey(IconSourceSelfhSt, "2fauth"),
+			IconMeta: IconMeta{
 				SVG:         true,
 				PNG:         true,
 				WebP:        true,
@@ -161,16 +160,16 @@ func TestListSelfhstIcons(t *testing.T) {
 			},
 		},
 		{
-			Key: NewKey(SourceSelfhSt, "dittofeed"),
-			Meta: Meta{
+			Key: NewIconKey(IconSourceSelfhSt, "dittofeed"),
+			IconMeta: IconMeta{
 				PNG:         true,
 				WebP:        true,
 				DisplayName: "Dittofeed",
 			},
 		},
 		{
-			Key: NewKey(SourceSelfhSt, "ars-technica"),
-			Meta: Meta{
+			Key: NewIconKey(IconSourceSelfhSt, "ars-technica"),
+			IconMeta: IconMeta{
 				SVG:         true,
 				PNG:         true,
 				WebP:        true,
--- a/internal/homepage/icons/fetch/route.go
+++ b/internal/homepage/icons/fetch/route.go
@@ -1,10 +1,9 @@
-package iconfetch
+package homepage

 import (
 	"net/http"

 	nettypes "github.com/yusing/godoxy/internal/net/types"
-	"github.com/yusing/godoxy/internal/types"
 	"github.com/yusing/goutils/pool"
 )

@@ -13,7 +12,6 @@ type route interface {
 	ProviderName() string
 	References() []string
 	TargetURL() *nettypes.URL
-	HealthMonitor() types.HealthMonitor
 }

 type httpRoute interface {
--- a/internal/homepage/types/README.md
+++ b/internal/homepage/types/README.md
@@ -1,13 +0,0 @@
-# Types Package
-
-Configuration types for the homepage package.
-
-## Config
-
-```go
-type Config struct {
-    UseDefaultCategories bool `json:"use_default_categories"`
-}
-
-var ActiveConfig atomic.Pointer[Config]
-```
--- a/internal/idlewatcher/handle_http.go
+++ b/internal/idlewatcher/handle_http.go
@@ -7,8 +7,7 @@ import (
 	"net/http"
 	"strconv"

-	"github.com/yusing/godoxy/internal/homepage/icons"
-	iconfetch "github.com/yusing/godoxy/internal/homepage/icons/fetch"
+	"github.com/yusing/godoxy/internal/homepage"
 	idlewatcher "github.com/yusing/godoxy/internal/idlewatcher/types"
 	gperr "github.com/yusing/goutils/errs"
 	httputils "github.com/yusing/goutils/http"
@@ -100,18 +99,18 @@ func (w *Watcher) handleWakeEventsSSE(rw http.ResponseWriter, r *http.Request) {
 	}
 }

-func (w *Watcher) getFavIcon(ctx context.Context) (result iconfetch.Result, err error) {
+func (w *Watcher) getFavIcon(ctx context.Context) (result homepage.FetchResult, err error) {
 	r := w.route
 	hp := r.HomepageItem()
 	if hp.Icon != nil {
-		if hp.Icon.Source == icons.SourceRelative {
-			result, err = iconfetch.FindIcon(ctx, r, *hp.Icon.FullURL, icons.VariantNone)
+		if hp.Icon.IconSource == homepage.IconSourceRelative {
+			result, err = homepage.FindIcon(ctx, r, *hp.Icon.FullURL, homepage.IconVariantNone)
 		} else {
-			result, err = iconfetch.FetchFavIconFromURL(ctx, hp.Icon)
+			result, err = homepage.FetchFavIconFromURL(ctx, hp.Icon)
 		}
 	} else {
 		// try extract from "link[rel=icon]"
-		result, err = iconfetch.FindIcon(ctx, r, "/", icons.VariantNone)
+		result, err = homepage.FindIcon(ctx, r, "/", homepage.IconVariantNone)
 	}
 	if result.StatusCode == 0 {
 		result.StatusCode = http.StatusOK
--- a/internal/idlewatcher/provider/proxmox.go
+++ b/internal/idlewatcher/provider/proxmox.go
@@ -26,10 +26,6 @@ const proxmoxStateCheckInterval = 1 * time.Second
 var ErrNodeNotFound = gperr.New("node not found in pool")

 func NewProxmoxProvider(ctx context.Context, nodeName string, vmid int) (idlewatcher.Provider, error) {
-	if nodeName == "" || vmid == 0 {
-		return nil, gperr.New("node name and vmid are required")
-	}
-
 	node, ok := proxmox.Nodes.Get(nodeName)
 	if !ok {
 		return nil, ErrNodeNotFound.Subject(nodeName).
--- a/internal/idlewatcher/types/config.go
+++ b/internal/idlewatcher/types/config.go
@@ -0,0 +1 @@
+package idlewatcher
--- a/internal/idlewatcher/watcher.go
+++ b/internal/idlewatcher/watcher.go
@@ -173,7 +173,7 @@ func NewWatcher(parent task.Parent, r types.Route, cfg *types.IdlewatcherConfig)
 		}

 		if !ok {
-			depRoute, ok = routes.GetIncludeExcluded(dep)
+			depRoute, ok = routes.Get(dep)
 			if !ok {
 				depErrors.Addf("dependency %q not found", dep)
 				continue
@@ -612,6 +612,10 @@ func (w *Watcher) watchUntilDestroy() (returnCause error) {
 				if ready {
 					// Container is now ready, notify waiting handlers
 					w.healthTicker.Stop()
+					select {
+					case w.readyNotifyCh <- struct{}{}:
+					default: // channel full, notification already pending
+					}
 					w.resetIdleTimer()
 				}
 				// If not ready yet, keep checking on next tick
--- a/internal/jsonstore/jsonstore.go
+++ b/internal/jsonstore/jsonstore.go
@@ -83,8 +83,7 @@ func loadNS[T store](ns namespace) T {
 func save() error {
 	errs := gperr.NewBuilder("failed to save data stores")
 	for ns, store := range stores {
-		path := filepath.Join(storesPath, string(ns)+".json")
-		if err := serialization.SaveFile(path, &store, 0o644, sonic.Marshal); err != nil {
+		if err := serialization.SaveJSON(filepath.Join(storesPath, string(ns)+".json"), &store, 0o644); err != nil {
 			errs.Add(err)
 		}
 	}
--- a/internal/logging/accesslog/file_access_logger.go
+++ b/internal/logging/accesslog/file_access_logger.go
@@ -20,20 +20,25 @@ import (
 )

 type (
-	File interface {
-		io.WriteCloser
-		supportRotate
-		Name() string
+	AccessLogger interface {
+		Log(req *http.Request, res *http.Response)
+		LogError(req *http.Request, err error)
+		LogACL(info *maxmind.IPInfo, blocked bool)
+
+		Config() *Config
+
+		Flush()
+		Close() error
 	}

-	fileAccessLogger struct {
+	accessLogger struct {
 		task *task.Task
 		cfg  *Config

-		writer    BufferedWriter
-		file      File
-		writeLock *sync.Mutex
-		closed    bool
+		writer        BufferedWriter
+		supportRotate SupportRotate
+		writeLock     *sync.Mutex
+		closed        bool

 		writeCount int64
 		bufSize    int
@@ -43,7 +48,32 @@ type (
 		logger zerolog.Logger

 		RequestFormatter
-		ACLLogFormatter
+		ACLFormatter
+	}
+
+	Writer interface {
+		io.WriteCloser
+		ShouldBeBuffered() bool
+		Name() string // file name or path
+	}
+
+	SupportRotate interface {
+		io.Writer
+		supportRotate
+		Name() string
+	}
+
+	AccessLogRotater interface {
+		Rotate(result *RotateResult) (rotated bool, err error)
+	}
+
+	RequestFormatter interface {
+		// AppendRequestLog appends a log line to line with or without a trailing newline
+		AppendRequestLog(line []byte, req *http.Request, res *http.Response) []byte
+	}
+	ACLFormatter interface {
+		// AppendACLLog appends a log line to line with or without a trailing newline
+		AppendACLLog(line []byte, info *maxmind.IPInfo, blocked bool) []byte
 	}
 )

@@ -66,87 +96,112 @@ const (
 var bytesPool = synk.GetUnsizedBytesPool()
 var sizedPool = synk.GetSizedBytesPool()

-func NewFileAccessLogger(parent task.Parent, file File, anyCfg AnyConfig) AccessLogger {
+func NewAccessLogger(parent task.Parent, cfg AnyConfig) (AccessLogger, error) {
+	writers, err := cfg.Writers()
+	if err != nil {
+		return nil, err
+	}
+
+	return NewMultiAccessLogger(parent, cfg, writers), nil
+}
+
+func NewMockAccessLogger(parent task.Parent, cfg *RequestLoggerConfig) AccessLogger {
+	return NewAccessLoggerWithIO(parent, NewMockFile(true), cfg)
+}
+
+func NewAccessLoggerWithIO(parent task.Parent, writer Writer, anyCfg AnyConfig) AccessLogger {
 	cfg := anyCfg.ToConfig()
 	if cfg.RotateInterval == 0 {
 		cfg.RotateInterval = defaultRotateInterval
 	}

-	name := file.Name()
-	l := &fileAccessLogger{
-		task:           parent.Subtask("accesslog."+name, true),
+	l := &accessLogger{
+		task:           parent.Subtask("accesslog."+writer.Name(), true),
 		cfg:            cfg,
 		bufSize:        InitialBufferSize,
 		errRateLimiter: rate.NewLimiter(rate.Every(errRateLimit), errBurst),
-		logger:         log.With().Str("file", name).Logger(),
+		logger:         log.With().Str("file", writer.Name()).Logger(),
 	}

-	l.writeLock, _ = writerLocks.LoadOrStore(name, &sync.Mutex{})
+	l.writeLock, _ = writerLocks.LoadOrStore(writer.Name(), &sync.Mutex{})

-	l.writer = ioutils.NewBufferedWriter(file, InitialBufferSize)
-	l.file = file
+	if writer.ShouldBeBuffered() {
+		l.writer = ioutils.NewBufferedWriter(writer, InitialBufferSize)
+	} else {
+		l.writer = NewUnbufferedWriter(writer)
+	}
+
+	if supportRotate, ok := writer.(SupportRotate); ok {
+		l.supportRotate = supportRotate
+	}

 	if cfg.req != nil {
+		fmt := CommonFormatter{cfg: &cfg.req.Fields}
 		switch cfg.req.Format {
 		case FormatCommon:
-			l.RequestFormatter = CommonFormatter{cfg: &cfg.req.Fields}
+			l.RequestFormatter = &fmt
 		case FormatCombined:
-			l.RequestFormatter = CombinedFormatter{CommonFormatter{cfg: &cfg.req.Fields}}
+			l.RequestFormatter = &CombinedFormatter{fmt}
 		case FormatJSON:
-			l.RequestFormatter = JSONFormatter{cfg: &cfg.req.Fields}
+			l.RequestFormatter = &JSONFormatter{fmt}
 		default: // should not happen, validation has done by validate tags
 			panic("invalid access log format")
 		}
+	} else {
+		l.ACLFormatter = ACLLogFormatter{}
 	}

 	go l.start()
 	return l
 }

-func (l *fileAccessLogger) Config() *Config {
+func (l *accessLogger) Config() *Config {
 	return l.cfg
 }

-func (l *fileAccessLogger) LogRequest(req *http.Request, res *http.Response) {
-	if !l.cfg.ShouldLogRequest(req, res) {
+func (l *accessLogger) shouldLog(req *http.Request, res *http.Response) bool {
+	if !l.cfg.req.Filters.StatusCodes.CheckKeep(req, res) ||
+		!l.cfg.req.Filters.Method.CheckKeep(req, res) ||
+		!l.cfg.req.Filters.Headers.CheckKeep(req, res) ||
+		!l.cfg.req.Filters.CIDR.CheckKeep(req, res) {
+		return false
+	}
+	return true
+}
+
+func (l *accessLogger) Log(req *http.Request, res *http.Response) {
+	if !l.shouldLog(req, res) {
 		return
 	}

-	line := bytesPool.GetBuffer()
-	defer bytesPool.PutBuffer(line)
-	l.AppendRequestLog(line, req, res)
-	// line is never empty
-	if line.Bytes()[line.Len()-1] != '\n' {
-		line.WriteByte('\n')
+	line := bytesPool.Get()
+	line = l.AppendRequestLog(line, req, res)
+	if line[len(line)-1] != '\n' {
+		line = append(line, '\n')
 	}
-	l.write(line.Bytes())
+	l.write(line)
+	bytesPool.Put(line)
 }

-var internalErrorResponse = &http.Response{
-	StatusCode: http.StatusInternalServerError,
-	Status:     http.StatusText(http.StatusInternalServerError),
+func (l *accessLogger) LogError(req *http.Request, err error) {
+	l.Log(req, &http.Response{StatusCode: http.StatusInternalServerError, Status: err.Error()})
 }

-func (l *fileAccessLogger) LogError(req *http.Request, err error) {
-	l.LogRequest(req, internalErrorResponse)
-}
-
-func (l *fileAccessLogger) LogACL(info *maxmind.IPInfo, blocked bool) {
-	line := bytesPool.GetBuffer()
-	defer bytesPool.PutBuffer(line)
-	l.AppendACLLog(line, info, blocked)
-	// line is never empty
-	if line.Bytes()[line.Len()-1] != '\n' {
-		line.WriteByte('\n')
+func (l *accessLogger) LogACL(info *maxmind.IPInfo, blocked bool) {
+	line := bytesPool.Get()
+	line = l.AppendACLLog(line, info, blocked)
+	if line[len(line)-1] != '\n' {
+		line = append(line, '\n')
 	}
-	l.write(line.Bytes())
+	l.write(line)
+	bytesPool.Put(line)
 }

-func (l *fileAccessLogger) ShouldRotate() bool {
-	return l.cfg.Retention.IsValid()
+func (l *accessLogger) ShouldRotate() bool {
+	return l.supportRotate != nil && l.cfg.Retention.IsValid()
 }

-func (l *fileAccessLogger) Rotate(result *RotateResult) (rotated bool, err error) {
+func (l *accessLogger) Rotate(result *RotateResult) (rotated bool, err error) {
 	if !l.ShouldRotate() {
 		return false, nil
 	}
@@ -155,11 +210,11 @@ func (l *fileAccessLogger) Rotate(result *RotateResult) (rotated bool, err error
 	l.writeLock.Lock()
 	defer l.writeLock.Unlock()

-	rotated, err = rotateLogFile(l.file, l.cfg.Retention, result)
+	rotated, err = rotateLogFile(l.supportRotate, l.cfg.Retention, result)
 	return
 }

-func (l *fileAccessLogger) handleErr(err error) {
+func (l *accessLogger) handleErr(err error) {
 	if l.errRateLimiter.Allow() {
 		gperr.LogError("failed to write access log", err, &l.logger)
 	} else {
@@ -168,7 +223,7 @@ func (l *fileAccessLogger) handleErr(err error) {
 	}
 }

-func (l *fileAccessLogger) start() {
+func (l *accessLogger) start() {
 	defer func() {
 		l.Flush()
 		l.Close()
@@ -204,7 +259,7 @@ func (l *fileAccessLogger) start() {
 	}
 }

-func (l *fileAccessLogger) Close() error {
+func (l *accessLogger) Close() error {
 	l.writeLock.Lock()
 	defer l.writeLock.Unlock()
 	if l.closed {
@@ -215,7 +270,7 @@ func (l *fileAccessLogger) Close() error {
 	return l.writer.Close()
 }

-func (l *fileAccessLogger) Flush() {
+func (l *accessLogger) Flush() {
 	l.writeLock.Lock()
 	defer l.writeLock.Unlock()
 	if l.closed {
@@ -224,7 +279,7 @@ func (l *fileAccessLogger) Flush() {
 	l.writer.Flush()
 }

-func (l *fileAccessLogger) write(data []byte) {
+func (l *accessLogger) write(data []byte) {
 	l.writeLock.Lock()
 	defer l.writeLock.Unlock()
 	if l.closed {
@@ -239,7 +294,7 @@ func (l *fileAccessLogger) write(data []byte) {
 	atomic.AddInt64(&l.writeCount, int64(n))
 }

-func (l *fileAccessLogger) adjustBuffer() {
+func (l *accessLogger) adjustBuffer() {
 	wps := int(atomic.SwapInt64(&l.writeCount, 0)) / int(bufferAdjustInterval.Seconds())
 	origBufSize := l.bufSize
 	newBufSize := origBufSize
--- a/internal/logging/accesslog/file_access_logger_test.go
+++ b/internal/logging/accesslog/file_access_logger_test.go
@@ -1,7 +1,6 @@
 package accesslog_test

 import (
-	"bytes"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -54,13 +53,13 @@ var (
 )

 func fmtLog(cfg *RequestLoggerConfig) (ts string, line string) {
-	buf := bytes.NewBuffer(make([]byte, 0, 1024))
+	buf := make([]byte, 0, 1024)

 	t := time.Now()
 	logger := NewMockAccessLogger(testTask, cfg)
 	mockable.MockTimeNow(t)
-	logger.(RequestFormatter).AppendRequestLog(buf, req, resp)
-	return t.Format(LogTimeFormat), buf.String()
+	buf = logger.(RequestFormatter).AppendRequestLog(buf, req, resp)
+	return t.Format(LogTimeFormat), string(buf)
 }

 func TestAccessLoggerCommon(t *testing.T) {
@@ -142,6 +141,9 @@ func TestAccessLoggerJSON(t *testing.T) {
 	expect.Equal(t, entry.UserAgent, ua)
 	expect.Equal(t, len(entry.Headers), 0)
 	expect.Equal(t, len(entry.Cookies), 0)
+	if status >= 400 {
+		expect.Equal(t, entry.Error, http.StatusText(status))
+	}
 }

 func BenchmarkAccessLoggerJSON(b *testing.B) {
@@ -150,7 +152,7 @@ func BenchmarkAccessLoggerJSON(b *testing.B) {
 	logger := NewMockAccessLogger(testTask, config)
 	b.ResetTimer()
 	for b.Loop() {
-		logger.LogRequest(req, resp)
+		logger.Log(req, resp)
 	}
 }

@@ -160,6 +162,6 @@ func BenchmarkAccessLoggerCombined(b *testing.B) {
 	logger := NewMockAccessLogger(testTask, config)
 	b.ResetTimer()
 	for b.Loop() {
-		logger.LogRequest(req, resp)
+		logger.Log(req, resp)
 	}
 }
--- a/internal/logging/accesslog/back_scanner.go
+++ b/internal/logging/accesslog/back_scanner.go
@@ -13,9 +13,10 @@ type ReaderAtSeeker interface {

 // BackScanner provides an interface to read a file backward line by line.
 type BackScanner struct {
-	file     ReaderAtSeeker
-	size     int64
-	chunkBuf []byte
+	file      ReaderAtSeeker
+	size      int64
+	chunkSize int
+	chunkBuf  []byte

 	offset int64
 	chunk  []byte
@@ -26,25 +27,16 @@ type BackScanner struct {
 // NewBackScanner creates a new Scanner to read the file backward.
 // chunkSize determines the size of each read chunk from the end of the file.
 func NewBackScanner(file ReaderAtSeeker, fileSize int64, chunkSize int) *BackScanner {
-	return newBackScanner(file, fileSize, sizedPool.GetSized(chunkSize))
+	return newBackScanner(file, fileSize, make([]byte, chunkSize))
 }

 func newBackScanner(file ReaderAtSeeker, fileSize int64, buf []byte) *BackScanner {
 	return &BackScanner{
-		file:     file,
-		size:     fileSize,
-		offset:   fileSize,
-		chunkBuf: buf,
-	}
-}
-
-// Release releases the buffer back to the pool.
-func (s *BackScanner) Release() {
-	sizedPool.Put(s.chunkBuf)
-	s.chunkBuf = nil
-	if s.chunk != nil {
-		sizedPool.Put(s.chunk)
-		s.chunk = nil
+		file:      file,
+		size:      fileSize,
+		offset:    fileSize,
+		chunkSize: len(buf),
+		chunkBuf:  buf,
 	}
 }

@@ -72,14 +64,13 @@ func (s *BackScanner) Scan() bool {
 				// No more data to read; check remaining buffer
 				if len(s.chunk) > 0 {
 					s.line = s.chunk
-					sizedPool.Put(s.chunk)
 					s.chunk = nil
 					return true
 				}
 				return false
 			}

-			newOffset := max(0, s.offset-int64(len(s.chunkBuf)))
+			newOffset := max(0, s.offset-int64(s.chunkSize))
 			chunkSize := s.offset - newOffset
 			chunk := s.chunkBuf[:chunkSize]

@@ -94,19 +85,8 @@ func (s *BackScanner) Scan() bool {
 			}

 			// Prepend the chunk to the buffer
-			if s.chunk == nil { // first chunk
-				s.chunk = sizedPool.GetSized(2 * len(s.chunkBuf))
-				copy(s.chunk, chunk[:n])
-				s.chunk = s.chunk[:n]
-			} else {
-				neededSize := n + len(s.chunk)
-				newChunk := sizedPool.GetSized(max(neededSize, 2*len(s.chunkBuf)))
-				copy(newChunk, chunk[:n])
-				copy(newChunk[n:], s.chunk)
-				sizedPool.Put(s.chunk)
-				s.chunk = newChunk[:neededSize]
-			}
-
+			clone := append([]byte{}, chunk[:n]...)
+			s.chunk = append(clone, s.chunk...)
 			s.offset = newOffset

 			// Check for newline in the updated buffer
@@ -131,3 +111,12 @@ func (s *BackScanner) Bytes() []byte {
 func (s *BackScanner) Err() error {
 	return s.err
 }
+
+func (s *BackScanner) Reset() error {
+	_, err := s.file.Seek(0, io.SeekStart)
+	if err != nil {
+		return err
+	}
+	*s = *newBackScanner(s.file, s.size, s.chunkBuf)
+	return nil
+}
--- a/internal/logging/accesslog/back_scanner_test.go
+++ b/internal/logging/accesslog/back_scanner_test.go
@@ -1,17 +1,15 @@
 package accesslog

 import (
-	"bytes"
 	"fmt"
-	"math/rand/v2"
 	"net/http"
 	"net/http/httptest"
 	"os"
-	"strconv"
 	"strings"
 	"testing"

 	"github.com/spf13/afero"
+	expect "github.com/yusing/goutils/testing"

 	strutils "github.com/yusing/goutils/strings"
 	"github.com/yusing/goutils/task"
@@ -137,40 +135,88 @@ func TestBackScannerWithVaryingChunkSizes(t *testing.T) {
 	}
 }

-var logEntry = func() func() []byte {
+func logEntry() []byte {
 	accesslog := NewMockAccessLogger(task.RootTask("test", false), &RequestLoggerConfig{
 		Format: FormatJSON,
 	})
-
-	contentTypes := []string{"application/json", "text/html", "text/plain", "application/xml", "application/x-www-form-urlencoded"}
-	userAgents := []string{"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/120.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/120.0", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/120.0"}
-	methods := []string{"GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"}
-	paths := []string{"/", "/about", "/contact", "/login", "/logout", "/register", "/profile"}
-
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		allocSize := rand.IntN(8192)
-		w.Header().Set("Content-Type", contentTypes[rand.IntN(len(contentTypes))])
-		w.Header().Set("Content-Length", strconv.Itoa(allocSize))
-		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("hello"))
 	}))
 	srv.URL = "http://localhost:8080"
-
-	return func() []byte {
-		// make a request to the server
-		req, _ := http.NewRequest(http.MethodGet, srv.URL, nil)
-		res := httptest.NewRecorder()
-		req.Header.Set("User-Agent", userAgents[rand.IntN(len(userAgents))])
-		req.Method = methods[rand.IntN(len(methods))]
-		req.URL.Path = paths[rand.IntN(len(paths))]
-		// server the request
-		srv.Config.Handler.ServeHTTP(res, req)
-		b := bytes.NewBuffer(make([]byte, 0, 1024))
-		accesslog.(RequestFormatter).AppendRequestLog(b, req, res.Result())
-		return b.Bytes()
+	defer srv.Close()
+	// make a request to the server
+	req, _ := http.NewRequest(http.MethodGet, srv.URL, nil)
+	res := httptest.NewRecorder()
+	// server the request
+	srv.Config.Handler.ServeHTTP(res, req)
+	b := accesslog.(RequestFormatter).AppendRequestLog(nil, req, res.Result())
+	if b[len(b)-1] != '\n' {
+		b = append(b, '\n')
 	}
-}()
+	return b
+}
+
+func TestReset(t *testing.T) {
+	file, err := afero.TempFile(afero.NewOsFs(), "", "accesslog")
+	if err != nil {
+		t.Fatalf("failed to create temp file: %v", err)
+	}
+	defer os.Remove(file.Name())
+	line := logEntry()
+	nLines := 1000
+	for range nLines {
+		_, err := file.Write(line)
+		if err != nil {
+			t.Fatalf("failed to write to temp file: %v", err)
+		}
+	}
+	linesRead := 0
+	stat, _ := file.Stat()
+	s := NewBackScanner(file, stat.Size(), defaultChunkSize)
+	for s.Scan() {
+		linesRead++
+	}
+	if err := s.Err(); err != nil {
+		t.Errorf("scanner error: %v", err)
+	}
+	expect.Equal(t, linesRead, nLines)
+	err = s.Reset()
+	if err != nil {
+		t.Errorf("failed to reset scanner: %v", err)
+	}
+
+	linesRead = 0
+	for s.Scan() {
+		linesRead++
+	}
+	if err := s.Err(); err != nil {
+		t.Errorf("scanner error: %v", err)
+	}
+	expect.Equal(t, linesRead, nLines)
+}

 // 100000 log entries.
+func BenchmarkBackScanner(b *testing.B) {
+	mockFile := NewMockFile(false)
+	line := logEntry()
+	for range 100000 {
+		_, _ = mockFile.Write(line)
+	}
+	for i := range 14 {
+		chunkSize := (2 << i) * kilobyte
+		scanner := NewBackScanner(mockFile, mockFile.MustSize(), chunkSize)
+		name := strutils.FormatByteSize(chunkSize)
+		b.ResetTimer()
+		b.Run(name, func(b *testing.B) {
+			for b.Loop() {
+				_ = scanner.Reset()
+				for scanner.Scan() {
+				}
+			}
+		})
+	}
+}
+
 func BenchmarkBackScannerRealFile(b *testing.B) {
 	file, err := afero.TempFile(afero.NewOsFs(), "", "accesslog")
 	if err != nil {
@@ -178,58 +224,51 @@ func BenchmarkBackScannerRealFile(b *testing.B) {
 	}
 	defer os.Remove(file.Name())

-	buf := bytes.NewBuffer(nil)
-	for range 100000 {
-		buf.Write(logEntry())
+	for range 10000 {
+		_, err = file.Write(logEntry())
+		if err != nil {
+			b.Fatalf("failed to write to temp file: %v", err)
+		}
 	}

-	fSize := int64(buf.Len())
-	_, err = file.Write(buf.Bytes())
-	if err != nil {
-		b.Fatalf("failed to write to file: %v", err)
+	stat, _ := file.Stat()
+	scanner := NewBackScanner(file, stat.Size(), 256*kilobyte)
+	b.ResetTimer()
+	for scanner.Scan() {
 	}
-
-	// file position does not matter, Seek not needed
-
-	for i := range 12 {
-		chunkSize := (2 << i) * kilobyte
-		name := strutils.FormatByteSize(chunkSize)
-		b.ResetTimer()
-		b.Run(name, func(b *testing.B) {
-			for b.Loop() {
-				scanner := NewBackScanner(file, fSize, chunkSize)
-				for scanner.Scan() {
-				}
-				scanner.Release()
-			}
-		})
+	if err := scanner.Err(); err != nil {
+		b.Errorf("scanner error: %v", err)
 	}
 }

 /*
-BenchmarkBackScannerRealFile
-BenchmarkBackScannerRealFile/2_KiB
-BenchmarkBackScannerRealFile/2_KiB-10                 21          51796773 ns/op             619 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/4_KiB
-BenchmarkBackScannerRealFile/4_KiB-10                 36          32081281 ns/op             699 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/8_KiB
-BenchmarkBackScannerRealFile/8_KiB-10                 57          22155619 ns/op             847 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/16_KiB
-BenchmarkBackScannerRealFile/16_KiB-10                62          21323125 ns/op            1449 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/32_KiB
-BenchmarkBackScannerRealFile/32_KiB-10                63          17534883 ns/op            2729 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/64_KiB
-BenchmarkBackScannerRealFile/64_KiB-10                73          17877029 ns/op            4617 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/128_KiB
-BenchmarkBackScannerRealFile/128_KiB-10               75          17797267 ns/op            8866 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/256_KiB
-BenchmarkBackScannerRealFile/256_KiB-10               67          16732108 ns/op           19691 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/512_KiB
-BenchmarkBackScannerRealFile/512_KiB-10               70          17121683 ns/op           37577 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/1_MiB
-BenchmarkBackScannerRealFile/1_MiB-10                 51          19615791 ns/op          102930 B/op          1 allocs/op
-BenchmarkBackScannerRealFile/2_MiB
-BenchmarkBackScannerRealFile/2_MiB-10                 26          41744928 ns/op        77595287 B/op         57 allocs/op
-BenchmarkBackScannerRealFile/4_MiB
-BenchmarkBackScannerRealFile/4_MiB-10                 22          48081521 ns/op        79692224 B/op         49 allocs/op
+BenchmarkBackScanner
+BenchmarkBackScanner/2_KiB
+BenchmarkBackScanner/2_KiB-20         	      52	  23254071 ns/op	67596663 B/op	   26420 allocs/op
+BenchmarkBackScanner/4_KiB
+BenchmarkBackScanner/4_KiB-20         	      55	  20961059 ns/op	62529378 B/op	   13211 allocs/op
+BenchmarkBackScanner/8_KiB
+BenchmarkBackScanner/8_KiB-20         	      64	  18242460 ns/op	62951141 B/op	    6608 allocs/op
+BenchmarkBackScanner/16_KiB
+BenchmarkBackScanner/16_KiB-20        	      52	  20162076 ns/op	62940256 B/op	    3306 allocs/op
+BenchmarkBackScanner/32_KiB
+BenchmarkBackScanner/32_KiB-20        	      54	  19247968 ns/op	67553645 B/op	    1656 allocs/op
+BenchmarkBackScanner/64_KiB
+BenchmarkBackScanner/64_KiB-20        	      60	  20909046 ns/op	64053342 B/op	     827 allocs/op
+BenchmarkBackScanner/128_KiB
+BenchmarkBackScanner/128_KiB-20       	      68	  17759890 ns/op	62201945 B/op	     414 allocs/op
+BenchmarkBackScanner/256_KiB
+BenchmarkBackScanner/256_KiB-20       	      52	  19531877 ns/op	61030487 B/op	     208 allocs/op
+BenchmarkBackScanner/512_KiB
+BenchmarkBackScanner/512_KiB-20       	      54	  19124656 ns/op	61030485 B/op	     208 allocs/op
+BenchmarkBackScanner/1_MiB
+BenchmarkBackScanner/1_MiB-20         	      67	  17078936 ns/op	61030495 B/op	     208 allocs/op
+BenchmarkBackScanner/2_MiB
+BenchmarkBackScanner/2_MiB-20         	      66	  18467421 ns/op	61030492 B/op	     208 allocs/op
+BenchmarkBackScanner/4_MiB
+BenchmarkBackScanner/4_MiB-20         	      68	  17214573 ns/op	61030486 B/op	     208 allocs/op
+BenchmarkBackScanner/8_MiB
+BenchmarkBackScanner/8_MiB-20         	      57	  18235229 ns/op	61030492 B/op	     208 allocs/op
+BenchmarkBackScanner/16_MiB
+BenchmarkBackScanner/16_MiB-20        	      57	  19343441 ns/op	61030499 B/op	     208 allocs/op
 */
--- a/internal/logging/accesslog/config.go
+++ b/internal/logging/accesslog/config.go
@@ -1,7 +1,6 @@
 package accesslog

 import (
-	"net/http"
 	"time"

 	"github.com/yusing/godoxy/internal/serialization"
@@ -10,15 +9,16 @@ import (

 type (
 	ConfigBase struct {
-		Path           string        `json:"path,omitempty"`
+		B              int           `json:"buffer_size"` // Deprecated: buffer size is adjusted dynamically
+		Path           string        `json:"path"`
 		Stdout         bool          `json:"stdout"`
 		Retention      *Retention    `json:"retention" aliases:"keep"`
 		RotateInterval time.Duration `json:"rotate_interval,omitempty" swaggertype:"primitive,integer"`
-	} // @name AccessLoggerConfigBase
+	}
 	ACLLoggerConfig struct {
 		ConfigBase
 		LogAllowed bool `json:"log_allowed"`
-	} // @name ACLLoggerConfig
+	}
 	RequestLoggerConfig struct {
 		ConfigBase
 		Format  Format  `json:"format" validate:"oneof=common combined json"`
@@ -32,21 +32,21 @@ type (
 	}
 	AnyConfig interface {
 		ToConfig() *Config
-		Writers() ([]File, error)
+		Writers() ([]Writer, error)
 	}

 	Format  string
 	Filters struct {
-		StatusCodes LogFilter[*StatusCodeRange] `json:"status_codes,omitzero"`
-		Method      LogFilter[HTTPMethod]       `json:"method,omitzero"`
-		Host        LogFilter[Host]             `json:"host,omitzero"`
-		Headers     LogFilter[*HTTPHeader]      `json:"headers,omitzero"` // header exists or header == value
-		CIDR        LogFilter[*CIDR]            `json:"cidr,omitzero"`
+		StatusCodes LogFilter[*StatusCodeRange] `json:"status_codes"`
+		Method      LogFilter[HTTPMethod]       `json:"method"`
+		Host        LogFilter[Host]             `json:"host"`
+		Headers     LogFilter[*HTTPHeader]      `json:"headers"` // header exists or header == value
+		CIDR        LogFilter[*CIDR]            `json:"cidr"`
 	}
 	Fields struct {
-		Headers FieldConfig `json:"headers,omitzero" aliases:"header"`
-		Query   FieldConfig `json:"query,omitzero" aliases:"queries"`
-		Cookies FieldConfig `json:"cookies,omitzero" aliases:"cookie"`
+		Headers FieldConfig `json:"headers" aliases:"header"`
+		Query   FieldConfig `json:"query" aliases:"queries"`
+		Cookies FieldConfig `json:"cookies" aliases:"cookie"`
 	}
 )

@@ -66,17 +66,17 @@ func (cfg *ConfigBase) Validate() gperr.Error {
 }

 // Writers returns a list of writers for the config.
-func (cfg *ConfigBase) Writers() ([]File, error) {
-	writers := make([]File, 0, 2)
+func (cfg *ConfigBase) Writers() ([]Writer, error) {
+	writers := make([]Writer, 0, 2)
 	if cfg.Path != "" {
-		f, err := OpenFile(cfg.Path)
+		io, err := NewFileIO(cfg.Path)
 		if err != nil {
 			return nil, err
 		}
-		writers = append(writers, f)
+		writers = append(writers, io)
 	}
 	if cfg.Stdout {
-		writers = append(writers, stdout)
+		writers = append(writers, NewStdout())
 	}
 	return writers, nil
 }
@@ -95,16 +95,6 @@ func (cfg *RequestLoggerConfig) ToConfig() *Config {
 	}
 }

-func (cfg *Config) ShouldLogRequest(req *http.Request, res *http.Response) bool {
-	if cfg.req == nil {
-		return true
-	}
-	return cfg.req.Filters.StatusCodes.CheckKeep(req, res) &&
-		cfg.req.Filters.Method.CheckKeep(req, res) &&
-		cfg.req.Filters.Headers.CheckKeep(req, res) &&
-		cfg.req.Filters.CIDR.CheckKeep(req, res)
-}
-
 func DefaultRequestLoggerConfig() *RequestLoggerConfig {
 	return &RequestLoggerConfig{
 		ConfigBase: ConfigBase{
--- a/internal/logging/accesslog/console_logger.go
+++ b/internal/logging/accesslog/console_logger.go
@@ -1,73 +0,0 @@
-package accesslog
-
-import (
-	"net/http"
-	"os"
-
-	"github.com/rs/zerolog"
-	maxmind "github.com/yusing/godoxy/internal/maxmind/types"
-)
-
-type ConsoleLogger struct {
-	cfg *Config
-
-	formatter ConsoleFormatter
-}
-
-var stdoutLogger = func() *zerolog.Logger {
-	l := zerolog.New(zerolog.NewConsoleWriter(func(w *zerolog.ConsoleWriter) {
-		w.Out = os.Stdout
-		w.TimeFormat = zerolog.TimeFieldFormat
-		w.FieldsOrder = []string{
-			"uri", "protocol", "type", "size",
-			"useragent", "query", "headers", "cookies",
-			"error", "iso_code", "time_zone"}
-	})).With().Str("level", zerolog.InfoLevel.String()).Timestamp().Logger()
-	return &l
-}()
-
-// placeholder for console logger
-var stdout File = &sharedFileHandle{}
-
-func NewConsoleLogger(cfg *Config) AccessLogger {
-	if cfg == nil {
-		panic("accesslog: NewConsoleLogger called with nil config")
-	}
-	l := &ConsoleLogger{
-		cfg: cfg,
-	}
-	if cfg.req != nil {
-		l.formatter = ConsoleFormatter{cfg: &cfg.req.Fields}
-	}
-	return l
-}
-
-func (l *ConsoleLogger) Config() *Config {
-	return l.cfg
-}
-
-func (l *ConsoleLogger) LogRequest(req *http.Request, res *http.Response) {
-	if !l.cfg.ShouldLogRequest(req, res) {
-		return
-	}
-
-	l.formatter.LogRequestZeroLog(stdoutLogger, req, res)
-}
-
-func (l *ConsoleLogger) LogError(req *http.Request, err error) {
-	log := stdoutLogger.With().Err(err).Logger()
-	l.formatter.LogRequestZeroLog(&log, req, internalErrorResponse)
-}
-
-func (l *ConsoleLogger) LogACL(info *maxmind.IPInfo, blocked bool) {
-	ConsoleACLFormatter{}.LogACLZeroLog(stdoutLogger, info, blocked)
-}
-
-func (l *ConsoleLogger) Flush() {
-	// No-op for console logger
-}
-
-func (l *ConsoleLogger) Close() error {
-	// No-op for console logger
-	return nil
-}
--- a/internal/logging/accesslog/shared_file_handle.go
+++ b/internal/logging/accesslog/shared_file_handle.go
@@ -11,8 +11,8 @@ import (
 	"github.com/yusing/goutils/synk"
 )

-type sharedFileHandle struct {
-	*os.File
+type File struct {
+	f *os.File

 	// os.File.Name() may not equal to key of `openedFiles`.
 	// Store it for later delete from `openedFiles`.
@@ -22,18 +22,18 @@ type sharedFileHandle struct {
 }

 var (
-	openedFiles   = make(map[string]*sharedFileHandle)
+	openedFiles   = make(map[string]*File)
 	openedFilesMu sync.Mutex
 )

-// OpenFile creates a new file writer with cleaned path.
+// NewFileIO creates a new file writer with cleaned path.
 //
 // If the file is already opened, it will be returned.
-func OpenFile(path string) (File, error) {
+func NewFileIO(path string) (Writer, error) {
 	openedFilesMu.Lock()
 	defer openedFilesMu.Unlock()

-	var file *sharedFileHandle
+	var file *File
 	var err error

 	// make it absolute path, so that we can use it as key of `openedFiles` and shared lock
@@ -53,38 +53,65 @@ func OpenFile(path string) (File, error) {
 		return nil, fmt.Errorf("access log open error: %w", err)
 	}
 	if _, err := f.Seek(0, io.SeekEnd); err != nil {
-		f.Close()
 		return nil, fmt.Errorf("access log seek error: %w", err)
 	}
-
-	file = &sharedFileHandle{File: f, path: path, refCount: synk.NewRefCounter()}
+	file = &File{f: f, path: path, refCount: synk.NewRefCounter()}
 	openedFiles[path] = file
-
-	log.Debug().Str("path", path).Msg("file opened")
-
 	go file.closeOnZero()
 	return file, nil
 }

-func (f *sharedFileHandle) Name() string {
+// Name returns the absolute path of the file.
+func (f *File) Name() string {
 	return f.path
 }

-func (f *sharedFileHandle) Close() error {
+func (f *File) ShouldBeBuffered() bool {
+	return true
+}
+
+func (f *File) Write(p []byte) (n int, err error) {
+	return f.f.Write(p)
+}
+
+func (f *File) ReadAt(p []byte, off int64) (n int, err error) {
+	return f.f.ReadAt(p, off)
+}
+
+func (f *File) WriteAt(p []byte, off int64) (n int, err error) {
+	return f.f.WriteAt(p, off)
+}
+
+func (f *File) Seek(offset int64, whence int) (int64, error) {
+	return f.f.Seek(offset, whence)
+}
+
+func (f *File) Size() (int64, error) {
+	stat, err := f.f.Stat()
+	if err != nil {
+		return 0, err
+	}
+	return stat.Size(), nil
+}
+
+func (f *File) Truncate(size int64) error {
+	return f.f.Truncate(size)
+}
+
+func (f *File) Close() error {
 	f.refCount.Sub()
 	return nil
 }

-func (f *sharedFileHandle) closeOnZero() {
-	defer log.Debug().Str("path", f.path).Msg("file closed")
+func (f *File) closeOnZero() {
+	defer log.Debug().
+		Str("path", f.path).
+		Msg("access log closed")

 	<-f.refCount.Zero()

 	openedFilesMu.Lock()
 	delete(openedFiles, f.path)
 	openedFilesMu.Unlock()
-	err := f.File.Close()
-	if err != nil {
-		log.Error().Str("path", f.path).Err(err).Msg("failed to close file")
-	}
+	f.f.Close()
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
yusing	b4559c30db	fix(stream): update ToHeader function to accept pointer to header buffer and return copy	2026-01-09 10:46:23 +08:00
yusing	b1f72dd4dd	chore: update pion/dtls related deps	2026-01-09 10:42:13 +08:00
yusing	8227efac3b	feat(agent): agent stream tunneling with TLS and dTLS (UDP)	2026-01-09 10:30:51 +08:00