fixed subdomain matching for sub-sub-subdomain and so on, now return 404 when subdomain is missing

removed save registration.json since it does not work properly
example fix
2026-01-14 06:13:33 +01:00 · 2024-09-24 18:30:25 +08:00 · 2024-09-24 18:18:37 +08:00 · 2024-09-24 03:13:39 +08:00 · 2024-09-24 03:09:50 +08:00 · 2024-09-23 22:10:13 +08:00
162 changed files with 8417 additions and 5344 deletions
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -8,7 +8,14 @@ jobs:
  build_and_push:
    runs-on: ubuntu-latest
    steps:
-      - name: Build and Push Container to ghcr.io
+      - name: Set up Docker Build and Push
+        id: docker_build_push
        uses: GlueOps/github-actions-build-push-containers@v0.3.7
        with:
-          tags: latest,${{ github.ref_name }}
+          tags: ${{ github.ref_name }}
+
+      - name: Tag as latest
+        if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-')
+        run: |
+          docker tag ghcr.io/${{ github.repository }}:${{ github.ref_name }} ghcr.io/${{ github.repository }}:latest
+          docker push ghcr.io/${{ github.repository }}:latest
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -1,30 +0,0 @@
-# This workflow will build a golang project
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
-
-name: Go
-
-on:
-  push:
-    tags:
-      - "*"
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: "1.22.1"
-
-      - name: Build
-        run: make build
-
-      - name: Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: bin/go-proxy
-    #- name: Test
-    #  run: go test -v ./...
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,20 @@
 compose.yml

-config/
-certs/
+config*/
+certs*/
 bin/
+
 templates/codemirror/

 logs/
-log/
+log/
+
+.vscode/settings.json
+
+go.work.sum
+
+!src/**/
+
+todo.md
+
+.*.swp
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -0,0 +1,15 @@
+build-image:
+  image: docker
+  rules:
+    - if: $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH
+      variables:
+        CI_REGISTRY_IMAGE: $CI_REGISTRY_IMAGE:latest
+    - if: $CI_COMMIT_REF_NAME != $CI_DEFAULT_BRANCH
+      variables:
+        CI_REGISTRY_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_BRANCH
+  before_script:
+    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
+  script:
+    - echo building $CI_REGISTRY_IMAGE
+    - docker build --pull -t $CI_REGISTRY_IMAGE .
+    - docker push $CI_REGISTRY_IMAGE
--- a/.gitmodules
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "frontend"]
+	path = frontend
+	url = https://github.com/yusing/go-proxy-frontend
--- a/.vscode/settings.example.json
+++ b/.vscode/settings.example.json
@@ -0,0 +1,13 @@
+{
+  "yaml.schemas": {
+    "https://github.com/yusing/go-proxy/raw/main/schema/config.schema.json": [
+      "config.example.yml",
+      "config.yml"
+    ],
+    "https://github.com/yusing/go-proxy/raw/main/schema/providers.schema.json": [
+      "providers.example.yml",
+      "*.providers.yml",
+      "providers.yml"
+    ]
+  }
+}
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,16 +0,0 @@
-{
-    "go.inferGopath": false,
-    "yaml.schemas": {
-        // "https://github.com/yusing/go-proxy/raw/main/schema/config.schema.json": [
-        //     "config.example.yml",
-        //     "config.yml"
-        // ],
-        "https://github.com/yusing/go-proxy/raw/main/schema/providers.schema.json": [
-            "providers.example.yml",
-            "*.providers.yml"
-        ],
-        "file:///config/workspace/go-proxy/schema/config.schema.json": [
-            "file:///config/workspace/go-proxy/config.example.yml"
-        ]
-    }
-}
--- a/44
+++ b/44
@@ -1,39 +1,33 @@
-FROM alpine:latest AS codemirror
-RUN apk add --no-cache unzip wget make
-COPY Makefile .
-RUN make setup-codemirror
-
-FROM golang:1.22.1-alpine as builder
-COPY src/ /src
-COPY go.mod go.sum /src/go-proxy
-WORKDIR /src/go-proxy
-RUN --mount=type=cache,target="/go/pkg/mod" \
-    go mod download
-
+FROM golang:1.23.1-alpine AS builder
+RUN apk add --no-cache tzdata
+COPY src /src
 ENV GOCACHE=/root/.cache/go-build
+WORKDIR /src
 RUN --mount=type=cache,target="/go/pkg/mod" \
    --mount=type=cache,target="/root/.cache/go-build" \
-    CGO_ENABLED=0 GOOS=linux go build -pgo=auto -o go-proxy
+    go mod download && \
+    CGO_ENABLED=0 GOOS=linux go build -pgo=auto -o go-proxy github.com/yusing/go-proxy

-FROM alpine:latest
+FROM scratch

 LABEL maintainer="yusing@6uo.me"

-RUN apk add --no-cache tzdata
-RUN mkdir -p /app/templates
-COPY --from=codemirror templates/codemirror/ /app/templates/codemirror
-COPY templates/ /app/templates
-COPY schema/ /app/schema
-COPY --from=builder /src/go-proxy /app/
+# copy timezone data
+COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo

-RUN chmod +x /app/go-proxy
-ENV DOCKER_HOST unix:///var/run/docker.sock
-ENV GOPROXY_DEBUG 0
+# copy binary
+COPY --from=builder /src/go-proxy /app/
+COPY schema/ /app/schema
+
+# copy cert required for setup
+COPY --from=builder /etc/ssl/certs /etc/ssl/certs
+
+ENV DOCKER_HOST=unix:///var/run/docker.sock
+ENV GOPROXY_DEBUG=0

 EXPOSE 80
-EXPOSE 8080
+EXPOSE 8888
 EXPOSE 443
-EXPOSE 8443

 WORKDIR /app
 CMD ["/app/go-proxy"]
--- a/21
+++ b/21
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 [fullname]
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
--- a/48
+++ b/48
@@ -7,35 +7,41 @@ setup:
 	[ -f config/config.yml ] || cp config.example.yml config/config.yml
 	[ -f config/providers.yml ] || touch config/providers.yml

-setup-codemirror:
-	wget https://codemirror.net/5/codemirror.zip
-	unzip codemirror.zip
-	rm codemirror.zip
-	mkdir -p templates
-	mv codemirror-* templates/codemirror
-
 build:
 	mkdir -p bin
-	CGO_ENABLED=0 GOOS=linux go build -pgo=auto -o bin/go-proxy src/go-proxy/*.go
+	CGO_ENABLED=0 GOOS=linux go build -pgo=auto -o bin/go-proxy github.com/yusing/go-proxy
+
+test:
+	go test ./src/...

 up:
-	docker compose up -d --build app
+	docker compose up -d

 restart:
-	docker kill go-proxy
-	docker compose up -d app
+	docker compose restart -t 0

 logs:
-	tail -f log/go-proxy.log
+	docker compose logs -f

 get:
-	go get -d -u ./src/go-proxy
+	cd src && go get -u && go mod tidy && cd ..

-udp-server:
-	docker run -it --rm \
-		-p 9999:9999/udp \
-		--label proxy.test-udp.scheme=udp \
-		--label proxy.test-udp.port=20003:9999 \
-		--network host \
-		--name test-udp \
-		$$(docker build -q -f udp-test-server.Dockerfile .)
+debug:
+	make build && sudo GOPROXY_DEBUG=1 bin/go-proxy
+
+archive:
+	git archive HEAD -o ../go-proxy-$$(date +"%Y%m%d%H%M").zip
+
+repush:
+	git reset --soft HEAD^
+	git add -A
+	git commit -m "repush"
+	git push gitlab dev --force
+
+rapid-crash:
+	sudo docker run --restart=always --name test_crash debian:bookworm-slim /bin/cat &&\
+	sleep 3 &&\
+	sudo docker rm -f test_crash
+
+debug-list-containers:
+	bash -c 'echo -e "GET /containers/json HTTP/1.0\r\n" | sudo netcat -U /var/run/docker.sock | tail -n +9 | jq'
--- a/README.md
+++ b/README.md
@@ -1,435 +1,160 @@
 # go-proxy

-A simple auto docker reverse proxy for home use. **Written in _Go_**
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)

-In the examples domain `x.y.z` is used, replace them with your domain
+[繁體中文文檔請看此](README_CHT.md)
+
+A lightweight, easy-to-use, and [performant](docs/benchmark_result.md) reverse proxy with a web UI.

 ## Table of content

+<!-- TOC -->
+
 - [go-proxy](#go-proxy)
  - [Table of content](#table-of-content)
  - [Key Points](#key-points)
-  - [How to use](#how-to-use)
-  - [Tested Services](#tested-services)
-    - [HTTP/HTTPs Reverse Proxy](#httphttps-reverse-proxy)
-    - [TCP Proxy](#tcp-proxy)
-    - [UDP Proxy](#udp-proxy)
-  - [Command-line args](#command-line-args)
-    - [Commands](#commands)
-  - [Use JSON Schema in VSCode](#use-json-schema-in-vscode)
-  - [Configuration](#configuration)
-    - [Labels (docker)](#labels-docker)
+  - [Getting Started](#getting-started)
+    - [Setup](#setup)
+    - [Commands line arguments](#commands-line-arguments)
    - [Environment variables](#environment-variables)
+    - [Use JSON Schema in VSCode](#use-json-schema-in-vscode)
    - [Config File](#config-file)
-      - [Fields](#fields)
-      - [Provider Kinds](#provider-kinds)
    - [Provider File](#provider-file)
-    - [Supported DNS Challenge Providers](#supported-dns-challenge-providers)
-  - [Examples](#examples)
-    - [Single port configuration example](#single-port-configuration-example)
-    - [Multiple ports configuration example](#multiple-ports-configuration-example)
-    - [TCP/UDP configuration example](#tcpudp-configuration-example)
-  - [Load balancing Configuration Example](#load-balancing-configuration-example)
-  - [Troubleshooting](#troubleshooting)
-  - [Benchmarks](#benchmarks)
-  - [Known issues](#known-issues)
-  - [Memory usage](#memory-usage)
+  - [Showcase](#showcase)
+    - [idlesleeper](#idlesleeper)
  - [Build it yourself](#build-it-yourself)

 ## Key Points

- Fast (See [benchmarks](#benchmarks))
- Auto certificate obtaining and renewal (See [Config File](#config-file) and [Supported DNS Challenge Providers](#supported-dns-challenge-providers))
- Auto detect reverse proxies from docker
- Auto hot-reload on container `start` / `die` / `stop` or config file changes
- Custom proxy entries with `config.yml` and additional provider files
- Subdomain matching + Path matching **(domain name doesn't matter)**
- HTTP(s) reverse proxy + TCP/UDP Proxy
- HTTP(s) round robin load balance support (same subdomain and path across different hosts)
- Web UI on port 8080 (http) and port 8443 (https)
+-   Easy to use
+    -   Effortless configuration
+    -   Simple multi-node setup
+    -   Error messages is clear and detailed, easy troubleshooting
+-   Auto certificate obtaining and renewal (See [Supported DNS Challenge Providers](docs/dns_providers.md))
+-   Auto configuration for docker containers
+-   Auto hot-reload on container state / config file changes
+-   **idlesleeper**: stop containers on idle, wake it up on traffic _(optional, see [showcase](#idlesleeper))_
+-   HTTP(s) reserve proxy
+-   TCP and UDP port forwarding
+-   Web UI for configuration and monitoring (See [screenshots](https://github.com/yusing/go-proxy-frontend?tab=readme-ov-file#screenshots))
+-   Written in **[Go](https://go.dev)**

-  - a simple panel to see all reverse proxies and health
+[🔼Back to top](#table-of-content)

-    ![panel screenshot](screenshots/panel.png)
+## Getting Started

-  - a config editor to edit config and provider files with validation
+### Setup

-    **Validate and save file with Ctrl+S**
+1.  Pull docker image 
+    
+    ```shell
+    docker pull ghcr.io/yusing/go-proxy:latest
+    ```

-    ![config editor screenshot](screenshots/config_editor.png)
+2.  Create new directory, `cd` into it, then run setup

-## How to use
+    ```shell
+    docker run --rm -v .:/setup ghcr.io/yusing/go-proxy /app/go-proxy setup
+    ```

-1. Setup DNS Records to your machine's IP address
+3.  Setup DNS Records point to machine which runs `go-proxy`, e.g.

-   - A Record: `*.y.z` -> `10.0.10.1`
-   - AAAA Record: `*.y.z` -> `::ffff:a00:a01`
+    -   A Record: `*.y.z` -> `10.0.10.1`
+    -   AAAA Record: `*.y.z` -> `::ffff:a00:a01`

-2. Start `go-proxy` (see [Binary](docs/binary.md) or [docker](docs/docker.md))
+4.  Setup `docker-socket-proxy` other docker nodes _(if any)_ (see [example](docs/docker_socket_proxy.md)) and then them inside `config.yml`

-3. Start editing config files
-   - with text editor (i.e. Visual Studio Code)
-   - or with web config editor by navigate to `ip:8080`
+5.  Done. You may now do some extra configuration
+    -   With text editor (e.g. Visual Studio Code)
+    -   With Web UI via `gp.y.z`
+    -   For more info, [See docker.md](docs/docker.md)

-## Tested Services
+[🔼Back to top](#table-of-content)

-### HTTP/HTTPs Reverse Proxy
+### Commands line arguments

- nginx
- minio
- AdguardHome Dashboard
- etc.
+| Argument    | Description                      | Example                    |
+| ----------- | -------------------------------- | -------------------------- |
+| empty       | start proxy server               |                            |
+| `validate`  | validate config and exit         |                            |
+| `reload`    | trigger a force reload of config |                            |
+| `ls-config` | list config and exit             | `go-proxy ls-config \| jq` |
+| `ls-route`  | list proxy entries and exit      | `go-proxy ls-route \| jq`  |

-### TCP Proxy
-
- Minecraft server
- PostgreSQL
- MariaDB
-
-### UDP Proxy
-
- Adguardhome DNS
- Palworld Dedicated Server
-
-## Command-line args
-
-`go-proxy [command]`
-
-### Commands
-
- empty: start proxy server
- validate: validate config and exit
- reload: trigger a force reload of config
-
-Examples:
-
- Binary: `go-proxy reload`
- Docker: `docker exec -it go-proxy /app/go-proxy reload`
-
-## Use JSON Schema in VSCode
-
-Modify `.vscode/settings.json` to fit your needs
-
-```json
-{
-  "yaml.schemas": {
-    "https://github.com/yusing/go-proxy/raw/main/schema/config.schema.json": [
-      "config.example.yml",
-      "config.yml"
-    ],
-    "https://github.com/yusing/go-proxy/raw/main/schema/providers.schema.json": [
-      "providers.example.yml",
-      "*.providers.yml"
-    ]
-  }
-}
-```
-
-## Configuration
-
-With container name, no label needs to be added _(most of the time)_.
-
-### Labels (docker)
-
-See [docker.md](docs/docker.md#docker-compose-example) for examples
-
-When `go-proxy` is running in `host` network mode, see [here](docs/docker.md#docker-compose-example-host-network) for extra instructions
-
- `proxy.aliases`: comma separated aliases for subdomain matching
-
-  - default: container name
-
- `proxy.*.<field>`: wildcard label for all aliases
-
-Below labels has a **`proxy.<alias>.`** prefix (i.e. `proxy.nginx.scheme: http`)
-
- `scheme`: proxy protocol
-  - default: `http`
-  - allowed: `http`, `https`, `tcp`, `udp`
- `host`: proxy host
-  - default: `container_name`
- `port`: proxy port
-  - default: first expose port (declared in `Dockerfile` or `docker-compose.yml`)
-  - `http(s)`: number in range og `0 - 65535`
-  - `tcp/udp`: `[<listeningPort>:]<targetPort>`
-    - `listeningPort`: number, when it is omitted (not suggested), a free port starting from 20000 will be used.
-    - `targetPort`: number, or predefined names (see [constants.go:14](src/go-proxy/constants.go#L14))
- `no_tls_verify`: whether skip tls verify when scheme is https
-  - default: `false`
- `path`: proxy path _(http(s) proxy only)_
-  - default: empty
- `path_mode`: mode for path handling
-
-  - default: empty
-  - allowed: empty, `forward`, `sub`
-    - `empty`: remove path prefix from URL when proxying
-      1. apps.y.z/webdav -> webdav:80
-      2. apps.y.z./webdav/path/to/file -> webdav:80/path/to/file
-    - `forward`: path remain unchanged
-      1. apps.y.z/webdav -> webdav:80/webdav
-      2. apps.y.z./webdav/path/to/file -> webdav:80/webdav/path/to/file
-    - `sub`: (experimental) remove path prefix from URL and also append path to HTML link attributes (`src`, `href` and `action`) and Javascript `fetch(url)` by response body substitution
-      e.g. apps.y.z/app1 -> webdav:80, `href="/app1/path/to/file"` -> `href="/path/to/file"`
-
- `load_balance`: _(Docker only)_ enable load balance
-  - allowed: `1`, `true`
+**run with `docker exec <container_name> /app/go-proxy <command>`**

 ### Environment variables

- `GOPROXY_DEBUG`: set to `1` or `true` to enable debug behaviors (i.e. output, etc.)
- `GOPROXY_HOST_NETWORK`: _(Docker only)_ set to `1` when `network_mode: host`
+| Environment Variable           | Description                                 | Default          | Values        |
+| ------------------------------ | ------------------------------------------- | ---------------- | ------------- |
+| `GOPROXY_NO_SCHEMA_VALIDATION` | disable schema validation                   | `false`          | boolean       |
+| `GOPROXY_DEBUG`                | enable debug behaviors                      | `false`          | boolean       |
+| `GOPROXY_HTTP_ADDR`            | http server listening address               | `:80`            | `[host]:port` |
+| `GOPROXY_HTTPS_ADDR`           | https server listening address (if enabled) | `:443`           | `[host]:port` |
+| `GOPROXY_API_ADDR`             | api server listening address                | `127.0.0.1:8888` | `[host]:port` |
+
+### Use JSON Schema in VSCode
+
+Copy [`.vscode/settings.example.json`](.vscode/settings.example.json) to `.vscode/settings.json` and modify it to fit your needs
+
+[🔼Back to top](#table-of-content)

 ### Config File

 See [config.example.yml](config.example.yml) for more

-#### Fields
+```yaml
+# autocert configuration
+autocert:
+    email: # ACME Email
+    domains: # a list of domains for cert registration
+    provider: # DNS Challenge provider
+    options: # provider specific options
+        - ...
+# reverse proxy providers configuration
+providers:
+    include:
+        - providers.yml
+        - other_file_1.yml
+        - ...
+    docker:
+        local: $DOCKER_HOST
+        remote-1: tcp://10.0.2.1:2375
+        remote-2: ssh://root:1234@10.0.2.2
+```

- `autocert`: autocert configuration
-
-  - `email`: ACME Email
-  - `domains`: a list of domains for cert registration
-  - `provider`: DNS Challenge provider, see [Supported DNS Challenge Providers](#supported-dns-challenge-providers)
-  - `options`: provider specific options
-
- `providers`: reverse proxy providers configuration
-  - `kind`: provider kind (string), see [Provider Kinds](#provider-kinds)
-  - `value`: provider specific value
-
-#### Provider Kinds
-
- `docker`: load reverse proxies from docker
-
-  values:
-
-  - `FROM_ENV`: value from environment (`DOCKER_HOST`)
-  - full url to docker host (i.e. `tcp://host:2375`)
-
- `file`: load reverse proxies from provider file
-
-  value: relative path of file to `config/`
+[🔼Back to top](#table-of-content)

 ### Provider File

-Fields are same as [docker labels](#labels-docker) starting from `scheme`
+See [Fields](docs/docker.md#fields)

 See [providers.example.yml](providers.example.yml) for examples

-### Supported DNS Challenge Providers
+[🔼Back to top](#table-of-content)

- Cloudflare
+## Showcase

-  - `auth_token`: your zone API token
+### idlesleeper

-  Follow [this guide](https://cloudkul.com/blog/automcatic-renew-and-generate-ssl-on-your-website-using-lego-client/) to create a new token with `Zone.DNS` read and edit permissions
+![idlesleeper](showcase/idlesleeper.webp)

-To add more provider support, see [this](docs/add_dns_provider.md)
-
-## Examples
-
-See [docker.md](docs/docker.md#docker-compose-example) for complete examples
-
-### Single port configuration example
-
-```yaml
-# (default) https://<container_name>.y.z
-whoami:
-  image: traefik/whoami
-  container_name: whoami # => whoami.y.z
-
-# enable both subdomain and path matching:
-whoami:
-  image: traefik/whoami
-  container_name: whoami
-  labels:
-    - proxy.aliases=whoami,apps
-    - proxy.apps.path=/whoami
-# 1. visit https://whoami.y.z
-# 2. visit https://apps.y.z/whoami
-```
-
-### Multiple ports configuration example
-
-```yaml
-minio:
-  image: quay.io/minio/minio
-  container_name: minio
-  ...
-  labels:
-    - proxy.aliases=minio,minio-console
-    - proxy.minio.port=9000
-    - proxy.minio-console.port=9001
-
-# visit https://minio.y.z to access minio
-# visit https://minio-console.y.z/whoami to access minio console
-```
-
-### TCP/UDP configuration example
-
-```yaml
-# In the app
-app-db:
-  image: postgres:15
-  container_name: app-db
-  ...
-  labels:
-    # Optional (postgres is in the known image map)
-    - proxy.app-db.scheme=tcp
-
-    # Optional (first free port will be used for listening port)
-    - proxy.app-db.port=20000:postgres
-
-# In go-proxy
-go-proxy:
-  ...
-  ports:
-    - 80:80
-    ...
-    - <your desired port>:20000/tcp
-    # or 20000-20010:20000-20010/tcp to declare large range at once
-
-# access app-db via <*>.y.z:20000
-```
-
-## Load balancing Configuration Example
-
-```yaml
-nginx:
-  ...
-  deploy:
-    mode: replicated
-    replicas: 3
-  labels:
-    - proxy.nginx.load_balance=1 # allowed: [1, true]
-```
-
-## Troubleshooting
-
-Q: How to fix when it shows "no matching route for subdomain \<subdomain>"?
-
-A: Make sure the container is running, and \<subdomain> matches any container name / alias
-
-## Benchmarks
-
-Benchmarked with `wrk` connecting `traefik/whoami`'s `/bench` endpoint
-
-Remote benchmark (client running wrk and `go-proxy` server are different devices)
-
- Direct connection
-
-  ```shell
-  root@yusing-pc:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.100.3:8003/bench
-  Running 10s test @ http://10.0.100.3:8003/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency    94.75ms  199.92ms   1.68s    91.27%
-      Req/Sec     4.24k     1.79k   18.79k    72.13%
-    Latency Distribution
-      50%    1.14ms
-      75%  120.23ms
-      90%  245.63ms
-      99%    1.03s
-    423444 requests in 10.10s, 50.88MB read
-    Socket errors: connect 0, read 0, write 0, timeout 29
-  Requests/sec:  41926.32
-  Transfer/sec:      5.04MB
-  ```
-
- With reverse proxy
-
-  ```shell
-  root@yusing-pc:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.1.7/bench
-  Running 10s test @ http://10.0.1.7/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency    79.35ms  169.79ms   1.69s    92.55%
-      Req/Sec     4.27k     1.90k   19.61k    75.81%
-    Latency Distribution
-      50%    1.12ms
-      75%  105.66ms
-      90%  200.22ms
-      99%  814.59ms
-    409836 requests in 10.10s, 49.25MB read
-    Socket errors: connect 0, read 0, write 0, timeout 18
-  Requests/sec:  40581.61
-  Transfer/sec:      4.88MB
-  ```
-
-Local benchmark (client running wrk and `go-proxy` server are under same proxmox host but different LXCs)
-
- Direct connection
-
-  ```shell
-  root@http-benchmark-client:~# wrk -t 10 -c 200 -d 10s --latency http://10.0.100.1/bench
-  Running 10s test @ http://10.0.100.1/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency   434.08us  539.35us   8.76ms   85.28%
-      Req/Sec    67.71k     6.31k   87.21k    71.20%
-    Latency Distribution
-      50%  153.00us
-      75%  646.00us
-      90%    1.18ms
-      99%    2.38ms
-    6739591 requests in 10.01s, 809.85MB read
-  Requests/sec: 673608.15
-  Transfer/sec:     80.94MB
-  ```
-
- With `go-proxy` reverse proxy
-
-  ```shell
-  root@http-benchmark-client:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.1.7/bench
-  Running 10s test @ http://10.0.1.7/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency     1.23ms    0.96ms  11.43ms   72.09%
-      Req/Sec    17.48k     1.76k   21.48k    70.20%
-    Latency Distribution
-      50%    0.98ms
-      75%    1.76ms
-      90%    2.54ms
-      99%    4.24ms
-    1739079 requests in 10.01s, 208.97MB read
-  Requests/sec: 173779.44
-  Transfer/sec:     20.88MB
-  ```
-
- With `traefik-v3`
-
-  ```shell
-  root@traefik-benchmark:~# wrk -t10 -c200 -d10s -H "Host: benchmark.whoami" --latency http://127.0.0.1:8000/bench
-  Running 10s test @ http://127.0.0.1:8000/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency     2.81ms   10.36ms 180.26ms   98.57%
-      Req/Sec    11.35k     1.74k   13.76k    85.54%
-    Latency Distribution
-      50%    1.59ms
-      75%    2.27ms
-      90%    3.17ms
-      99%   37.91ms
-    1125723 requests in 10.01s, 109.50MB read
-  Requests/sec: 112499.59
-  Transfer/sec:     10.94MB
-  ```
-
-## Known issues
-
-None
-
-## Memory usage
-
-It takes ~15 MB for 50 proxy entries
+[🔼Back to top](#table-of-content)

 ## Build it yourself

-1. Install / Upgrade [go (>=1.22)](https://go.dev/doc/install) and `make` if not already
+1. Clone the repository `git clone https://github.com/yusing/go-proxy --depth=1`

-2. Clear cache if you have built this before (go < 1.22) with `go clean -cache`
+2. Install / Upgrade [go (>=1.22)](https://go.dev/doc/install) and `make` if not already

-3. get dependencies with `make get`
+3. Clear cache if you have built this before (go < 1.22) with `go clean -cache`

-4. build binary with `make build`
+4. get dependencies with `make get`

-5. start your container with `make up` (docker) or `bin/go-proxy` (binary)
+5. build binary with `make build`
+
+[🔼Back to top](#table-of-content)
--- a/README_CHT.md
+++ b/README_CHT.md
@@ -0,0 +1,144 @@
+# go-proxy
+
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+
+一個輕量化、易用且[高效](docs/benchmark_result.md)的反向代理和端口轉發工具
+
+## 目錄
+
+<!-- TOC -->
+
+- [go-proxy](#go-proxy)
+  - [目錄](#目錄)
+  - [重點](#重點)
+  - [入門指南](#入門指南)
+    - [安裝](#安裝)
+    - [命令行參數](#命令行參數)
+    - [環境變量](#環境變量)
+    - [VSCode 中使用 JSON Schema](#vscode-中使用-json-schema)
+    - [配置文件](#配置文件)
+    - [透過文件配置](#透過文件配置)
+  - [展示](#展示)
+    - [idlesleeper](#idlesleeper)
+  - [源碼編譯](#源碼編譯)
+
+## 重點
+
+-   易用
+    -   不需花費太多時間就能輕鬆配置
+    -   除錯簡單
+-   自動處理 HTTPS 證書（參見[可用的 DNS 供應商](docs/dns_providers.md)）
+-   透過 Docker 容器自動配置
+-   容器狀態變更時自動熱重載
+-   容器閒置時自動暫停/停止，入站時自動喚醒
+-   HTTP(s)反向代理
+-   TCP/UDP 端口轉發
+-   用於配置和監控的前端 Web 面板（[截圖](https://github.com/yusing/go-proxy-frontend?tab=readme-ov-file#screenshots)）
+-   使用 **[Go](https://go.dev)** 編寫
+
+[🔼 返回頂部](#目錄)
+
+## 入門指南
+
+### 安裝
+
+1. 設置 DNS 記錄，例如：
+
+    - A 記錄: `*.y.z` -> `10.0.10.1`
+    - AAAA 記錄: `*.y.z` -> `::ffff:a00:a01`
+
+2. 安裝 `go-proxy` [參見這裡](docs/docker.md)
+
+3. 配置 `go-proxy`
+    - 使用文本編輯器 (推薦 Visual Studio Code [參見 VSCode 使用 schema](#vscode-中使用-json-schema))
+    - 或通過 `http://gp.y.z` 使用網頁配置編輯器
+
+[🔼 返回頂部](#目錄)
+
+### 命令行參數
+
+| 參數        | 描述           | 示例                       |
+| ----------- | -------------- | -------------------------- |
+| 空          | 啟動代理服務器 |                            |
+| `validate`  | 驗證配置並退出 |                            |
+| `reload`    | 強制刷新配置   |                            |
+| `ls-config` | 列出配置並退出 | `go-proxy ls-config \| jq` |
+| `ls-route`  | 列出路由並退出 | `go-proxy ls-route \| jq`  |
+
+**使用 `docker exec <容器名稱> /app/go-proxy <參數>` 運行**
+
+### 環境變量
+
+| 環境變量                       | 描述             | 默認             | 格式          |
+| ------------------------------ | ---------------- | ---------------- | ------------- |
+| `GOPROXY_NO_SCHEMA_VALIDATION` | 禁用 schema 驗證 | `false`          | boolean       |
+| `GOPROXY_DEBUG`                | 啟用調試輸出     | `false`          | boolean       |
+| `GOPROXY_HTTP_ADDR`            | http 收聽地址    | `:80`            | `[host]:port` |
+| `GOPROXY_HTTPS_ADDR`           | https 收聽地址   | `:443`           | `[host]:port` |
+| `GOPROXY_API_ADDR`             | api 收聽地址     | `127.0.0.1:8888` | `[host]:port` |
+
+### VSCode 中使用 JSON Schema
+
+複製 [`.vscode/settings.example.json`](.vscode/settings.example.json) 到 `.vscode/settings.json` 並根據需求修改
+
+[🔼 返回頂部](#目錄)
+
+### 配置文件
+
+參見 [config.example.yml](config.example.yml) 了解更多
+
+```yaml
+# autocert 配置
+autocert:
+    email: # ACME 電子郵件
+    domains: # 域名列表
+    provider: # DNS 供應商
+    options: # 供應商個別配置
+        - ...
+# 配置文件 / docker
+providers:
+    include:
+        - providers.yml
+        - other_file_1.yml
+        - ...
+    docker:
+        local: $DOCKER_HOST
+        remote-1: tcp://10.0.2.1:2375
+        remote-2: ssh://root:1234@10.0.2.2
+```
+
+[🔼 返回頂部](#目錄)
+
+### 透過文件配置
+
+參見 [Fields](docs/docker.md#fields)
+
+參見範例 [providers.example.yml](providers.example.yml)
+
+[🔼 返回頂部](#目錄)
+
+## 展示
+
+### idlesleeper
+
+![idlesleeper](showcase/idlesleeper.webp)
+
+[🔼 返回頂部](#目錄)
+
+## 源碼編譯
+
+1. 獲取源碼 `git clone https://github.com/yusing/go-proxy --depth=1`
+
+2. 安裝/升級 [go 版本 (>=1.22)](https://go.dev/doc/install) 和 `make`（如果尚未安裝）
+
+3. 如果之前編譯過（go 版本 < 1.22），請使用 `go clean -cache` 清除緩存
+
+4. 使用 `make get` 獲取依賴項
+
+5. 使用 `make build` 編譯
+
+[🔼 返回頂部](#目錄)
--- a/compose.example.yml
+++ b/compose.example.yml
@@ -1,45 +1,33 @@
-version: '3'
 services:
+  frontend:
+    image: ghcr.io/yusing/go-proxy-frontend:latest
+    container_name: go-proxy-frontend
+    restart: unless-stopped
+    network_mode: host
+    labels:
+      - proxy.aliases=gp
+      - proxy.gp.port=3000
+    depends_on:
+      - app
  app:
    image: ghcr.io/yusing/go-proxy:latest
    container_name: go-proxy
    restart: always
-    networks: # ^also add here
-      - default
-    ports:
-      - 80:80 # http proxy
-      - 8080:8080 # http panel
-      # - 443:443 # optional, https proxy
-      # - 8443:8443 # optional, https panel
-
-      # optional, if you declared any tcp/udp proxy, set a range you want to use
-      # - 20000:20100/tcp
-      # - 20000:20100/udp
+    network_mode: host
+    environment:
+      # (Optional) change this to your timezone to get correct log timestamp
+      TZ: ETC/UTC
    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
      - ./config:/app/config

-      # if local docker provider is used
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      
-      # use existing certificate
-      # - /path/to/cert.pem:/app/certs/cert.crt:ro
-      # - /path/to/privkey.pem:/app/certs/priv.key:ro
+      # (Optional) choose one of below to enable https
+      # 1. use existing certificate
+      # if your cert is not named `cert.crt` change `cert_path` in `config/config.yml`
+      # if your cert key is not named `priv.key` change `key_path` in `config/config.yml`
+
+      # - /path/to/certs:/app/certs
+
+      # 2. use autocert, certs will be stored in ./certs (or other path you specify)

-      # store autocert obtained cert
      # - ./certs:/app/certs
-    
-    # workaround for "lookup: no such host"
-    # dns:
-    #   - 127.0.0.1
-
-    # if you have container running in "host" network mode
-    # extra_hosts:
-    #   - host.docker.internal:host-gateway
-    logging:
-      driver: 'json-file'
-      options:
-        max-file: '1'
-        max-size: 128k
-networks: # ^you may add other external networks
-  default:
-    driver: bridge
--- a/config.example.yml
+++ b/config.example.yml
@@ -1,21 +1,36 @@
-# Autocert (uncomment to enable)
-# autocert: # (optional, if you need autocert feature)
-#   email: "user@domain.com" # (required) email for acme certificate
-#   domains: # (required)
-#     - "*.y.z" # domain for acme certificate, use wild card to allow all subdomains
-#   provider: cloudflare # (required) dns challenge provider (string)
-#   options: # provider specific options
-#     auth_token: "YOUR_ZONE_API_TOKEN"
-providers:
-  local:
-    kind: docker
-    # for value format, see https://docs.docker.com/reference/cli/dockerd/
-    # i.e. FROM_ENV, ssh://user@10.0.1.1:22, tcp://10.0.2.1:2375
-    value: FROM_ENV
-  providers:
-    kind: file
-    value: providers.yml
+# Autocert (choose one below and uncomment to enable)

+# 1. use existing cert
+# autocert:
+#   provider: local
+#   cert_path: certs/cert.crt # optional, uncomment only if you need to change it
+#   key_path: certs/priv.key # optional, uncomment only if you need to change it
+
+# 2. cloudflare
+# autocert:
+#   provider: cloudflare
+#   email: # ACME Email
+#   domains: # a list of domains for cert registration
+#     - x.y.z
+#   options:
+#     - auth_token: c1234565789-abcdefghijklmnopqrst # your zone API token
+
+# 3. other providers, check docs/dns_providers.md for more
+
+providers:
+  # include:
+  #   - providers.yml # config/providers.yml
+  #   # add some more below if you want
+  #   - file1.yml # config/file_1.yml
+  #   - file2.yml
+  docker:
+    # for value format, see https://docs.docker.com/reference/cli/dockerd/
+    # $DOCKER_HOST implies unix:///var/run/docker.sock by default
+    local: $DOCKER_HOST
+    # add more docker providers if needed
+    # remote-1: tcp://10.0.2.1:2375
+    # remote-2: ssh://root:1234@10.0.2.2
 # Fixed options (optional, non hot-reloadable)
+
 # timeout_shutdown: 5
-# redirect_to_https: false
+# redirect_to_https: false # redirect http requests to https (if enabled)
--- a/docs/add_dns_provider.md
+++ b/docs/add_dns_provider.md
@@ -7,7 +7,7 @@
   ```go
   var providersGenMap = map[string]ProviderGenerator{
     "cloudflare": providerGenerator(cloudflare.NewDefaultConfig, cloudflare.NewDNSProviderConfig),
-     // add here, i.e.
+     // add here, e.g.
     "clouddns": providerGenerator(clouddns.NewDefaultConfig, clouddns.NewDNSProviderConfig),
   }
   ```
@@ -37,5 +37,5 @@
       password: b9841238feb177a84330f
   ```

-5. Run and test if it works
+5. Run with `GOPROXY_NO_SCHEMA_VALIDATION=1` and test if it works
 6. Commit and create pull request
--- a/docs/benchmark_result.md
+++ b/docs/benchmark_result.md
@@ -0,0 +1,104 @@
+# Benchmarks
+
+Benchmarked with `wrk` and `traefik/whoami`'s `/bench` endpoint
+
+## Remote benchmark
+
+- Direct connection
+
+  ```shell
+  root@yusing-pc:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.100.3:8003/bench
+  Running 10s test @ http://10.0.100.3:8003/bench
+    10 threads and 200 connections
+    Thread Stats   Avg      Stdev     Max   +/- Stdev
+      Latency    94.75ms  199.92ms   1.68s    91.27%
+      Req/Sec     4.24k     1.79k   18.79k    72.13%
+    Latency Distribution
+      50%    1.14ms
+      75%  120.23ms
+      90%  245.63ms
+      99%    1.03s
+    423444 requests in 10.10s, 50.88MB read
+    Socket errors: connect 0, read 0, write 0, timeout 29
+  Requests/sec:  41926.32
+  Transfer/sec:      5.04MB
+  ```
+
+- With reverse proxy
+
+  ```shell
+  root@yusing-pc:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.1.7/bench
+  Running 10s test @ http://10.0.1.7/bench
+    10 threads and 200 connections
+    Thread Stats   Avg      Stdev     Max   +/- Stdev
+      Latency    79.35ms  169.79ms   1.69s    92.55%
+      Req/Sec     4.27k     1.90k   19.61k    75.81%
+    Latency Distribution
+      50%    1.12ms
+      75%  105.66ms
+      90%  200.22ms
+      99%  814.59ms
+    409836 requests in 10.10s, 49.25MB read
+    Socket errors: connect 0, read 0, write 0, timeout 18
+  Requests/sec:  40581.61
+  Transfer/sec:      4.88MB
+  ```
+
+## Local benchmark (client running wrk and `go-proxy` server are under same proxmox host but different LXCs)
+
+- Direct connection
+
+  ```shell
+  root@http-benchmark-client:~# wrk -t 10 -c 200 -d 10s --latency http://10.0.100.1/bench
+  Running 10s test @ http://10.0.100.1/bench
+    10 threads and 200 connections
+    Thread Stats   Avg      Stdev     Max   +/- Stdev
+      Latency   434.08us  539.35us   8.76ms   85.28%
+      Req/Sec    67.71k     6.31k   87.21k    71.20%
+    Latency Distribution
+      50%  153.00us
+      75%  646.00us
+      90%    1.18ms
+      99%    2.38ms
+    6739591 requests in 10.01s, 809.85MB read
+  Requests/sec: 673608.15
+  Transfer/sec:     80.94MB
+  ```
+
+- With `go-proxy` reverse proxy
+
+  ```shell
+  root@http-benchmark-client:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.1.7/bench
+  Running 10s test @ http://10.0.1.7/bench
+    10 threads and 200 connections
+    Thread Stats   Avg      Stdev     Max   +/- Stdev
+      Latency     1.23ms    0.96ms  11.43ms   72.09%
+      Req/Sec    17.48k     1.76k   21.48k    70.20%
+    Latency Distribution
+      50%    0.98ms
+      75%    1.76ms
+      90%    2.54ms
+      99%    4.24ms
+    1739079 requests in 10.01s, 208.97MB read
+  Requests/sec: 173779.44
+  Transfer/sec:     20.88MB
+  ```
+
+- With `traefik-v3`
+
+  ```shell
+  root@traefik-benchmark:~# wrk -t10 -c200 -d10s -H "Host: benchmark.whoami" --latency http://127.0.0.1:8000/bench
+  Running 10s test @ http://127.0.0.1:8000/bench
+    10 threads and 200 connections
+    Thread Stats   Avg      Stdev     Max   +/- Stdev
+      Latency     2.81ms   10.36ms 180.26ms   98.57%
+      Req/Sec    11.35k     1.74k   13.76k    85.54%
+    Latency Distribution
+      50%    1.59ms
+      75%    2.27ms
+      90%    3.17ms
+      99%   37.91ms
+    1125723 requests in 10.01s, 109.50MB read
+  Requests/sec: 112499.59
+  Transfer/sec:     10.94MB
+  ```
--- a/docs/binary.md
+++ b/docs/binary.md
@@ -1,59 +0,0 @@
-# Getting started with `go-proxy` (binary)
-
-## Setup
-
-1. Install `bash`, `make` and `wget` if not already
-
-2. Run setup script
-
-   To specitfy a version _(optional)_
-
-   ```shell
-   export VERSION=latest # will be resolved into real version number
-   export VERSION=<version>
-   ```
-
-   If you don't need web config editor
-
-   ```shell
-   export SETUP_CODEMIRROR=0
-   ```
-
-   Setup
-
-   ```shell
-   wget -qO- https://6uo.me/go-proxy-setup-binary | sudo bash
-   ```
-
-   What it does:
-
-   - Download source file and binary into /opt/go-proxy/$VERSION
-   - Setup `config.yml` and `providers.yml`
-   - Setup `template/codemirror` which is a dependency for web config editor
-   - Create a systemd service (if available) in `/etc/systemd/system/go-proxy.service`
-   - Enable and start `go-proxy` service
-
-3. Start editing config files in `http://<ip>:8080`
-
-4. Check logs / status with `systemctl status go-proxy`
-
-## Setup (alternative method)
-
-1. Download the latest release and extract somewhere
-
-2. Run `make setup` and _(optional) `make setup-codemirror`_
-
-3. Enable HTTPS _(optional)_
-
-   - To use autocert feature
-
-     complete `autocert` in `config/config.yml`
-
-   - To use existing certificate
-
-     Prepare your wildcard (`*.y.z`) SSL cert in `certs/`
-
-     - cert / chain / fullchain: `certs/cert.crt`
-     - private key: `certs/priv.key`
-
-4. Run the binary `bin/go-proxy`
--- a/docs/dns_providers.md
+++ b/docs/dns_providers.md
@@ -0,0 +1,81 @@
+# Supported DNS Providers
+
+<!-- TOC -->
+
+- [Supported DNS Providers](#supported-dns-providers)
+  - [Cloudflare](#cloudflare)
+  - [CloudDNS](#clouddns)
+  - [DuckDNS](#duckdns)
+  - [OVHCloud](#ovhcloud)
+  - [Implement other DNS providers](#implement-other-dns-providers)
+
+## Cloudflare
+
+```yaml
+autocert:
+    provider: cloudflare
+    options:
+        auth_token:
+```
+
+`auth_token` your zone API token
+
+Follow [this guide](https://cloudkul.com/blog/automcatic-renew-and-generate-ssl-on-your-website-using-lego-client/) to create a new token with `Zone.DNS` read and edit permissions
+
+## CloudDNS
+
+```yaml
+autocert:
+    provider: clouddns
+    options:
+        client_id:
+        email:
+        password:
+```
+
+## DuckDNS
+
+```yaml
+autocert:
+    provider: duckdns
+    options:
+        token:
+```
+
+Tested by [earvingad](https://github.com/earvingad)
+
+## OVHCloud
+
+```yaml
+autocert:
+    provider: ovh
+    options:
+        api_endpoint:
+        application_key:
+        application_secret:
+        consumer_key:
+        oauth2_config:
+            client_id:
+            client_secret:
+```
+
+_Note, `application_key` and `oauth2_config` **CANNOT** be used together_
+
+-   `api_endpoint`: Endpoint URL, or one of
+    -   `ovh-eu`,
+    -   `ovh-ca`,
+    -   `ovh-us`,
+    -   `kimsufi-eu`,
+    -   `kimsufi-ca`,
+    -   `soyoustart-eu`,
+    -   `soyoustart-ca`
+-   `application_secret`
+-   `application_key`
+-   `consumer_key`
+-   `oauth2_config`: Client ID and Client Secret
+    -   `client_id`
+    -   `client_secret`
+
+## Implement other DNS providers
+
+See [add_dns_provider.md](docs/add_dns_provider.md)
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -1,242 +1,293 @@
-# Getting started with `go-proxy` docker container
+# Docker compose guide

-## Setup
+## Table of content

-1. Install `wget` if not already
+<!-- TOC -->

-2. Run setup script
+- [Docker compose guide](#docker-compose-guide)
+  - [Table of content](#table-of-content)
+  - [Additional setup](#additional-setup)
+  - [Labels](#labels)
+    - [Syntax](#syntax)
+    - [Fields](#fields)
+      - [Key-value mapping example](#key-value-mapping-example)
+      - [List example](#list-example)
+  - [Troubleshooting](#troubleshooting)
+  - [Docker compose examples](#docker-compose-examples)
+    - [Services URLs for above examples](#services-urls-for-above-examples)

-   `bash <(wget -qO- https://6uo.me/go-proxy-setup-docker)`
+## Additional setup

-   What it does:
+1.  Enable HTTPs _(optional)_

-   - Create required directories
-   - Setup `config.yml` and `compose.yml`
+    Mount a folder to store obtained certs or to load existing cert

-3. Verify folder structure and then `cd go-proxy`
+    ```yaml
+    services:
+      go-proxy:
+        ...
+        volumes:
+          - ./certs:/app/certs
+    ```

-   ```plain
-   go-proxy
-   ├── certs
-   ├── compose.yml
-   └── config
-       ├── config.yml
-       └── providers.yml
-   ```
+    To use **autocert**, complete that section in `config.yml`, e.g.

-4. Enable HTTPs _(optional)_
+    ```yaml
+    autocert:
+        email: john.doe@x.y.z # ACME Email
+        domains: # a list of domains for cert registration
+            - x.y.z
+        provider: cloudflare
+        options:
+            - auth_token: c1234565789-abcdefghijklmnopqrst # your zone API token
+    ```

-   - To use autocert feature
+    To use **existing certificate**, set path for cert and key in `config.yml`, e.g.

-     - completing `autocert` section in `config/config.yml`
-     - mount `certs/` to `/app/certs` to store obtained certs
+    ```yaml
+    autocert:
+        provider: local
+        cert_path: /app/certs/cert.crt
+        key_path: /app/certs/priv.key
+    ```

-   - To use existing certificate
+2.  Modify `compose.yml` to fit your needs

-     mount your wildcard (`*.y.z`) SSL cert
+3.  Run `docker compose up -d` to start the container

-     - cert / chain / fullchain -> `/app/certs/cert.crt`
-     - private key -> `/app/certs/priv.key`
+4.  Navigate to Web panel `http://gp.yourdomain.com` or use **Visual Studio Code (provides schema check)** to edit proxy config

-5. Modify `compose.yml` fit your needs
+[🔼Back to top](#table-of-content)

-   Add networks to make sure it is in the same network with other containers, or make sure `proxy.<alias>.host` is reachable
+## Labels

-6. Run `docker compose up -d` to start the container
+### Syntax

-7. Start editing config files in `http://<ip>:8080`
+| Label                    | Description                                                                                                                                                         | Example                        | Default                     | Accepted values                                                           |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | --------------------------- | ------------------------------------------------------------------------- |
+| `proxy.aliases`          | comma separated aliases for subdomain and label matching                                                                                                            | `gitlab,gitlab-reg,gitlab-ssh` | `container_name`            | any                                                                       |
+| `proxy.exclude`          | to be excluded from `go-proxy`                                                                                                                                      |                                | false                       | boolean                                                                   |
+| `proxy.idle_timeout`     | time for idle (no traffic) before put it into sleep **(http/s only)**<br> _**NOTE: idlewatcher will only be enabled containers that has non-empty `idle_timeout`**_ | `1h`                           | empty or `0` **(disabled)** | `number[unit]...`, e.g. `1m30s`                                           |
+| `proxy.wake_timeout`     | time to wait for target site to be ready                                                                                                                            |                                | `10s`                       | `number[unit]...`                                                         |
+| `proxy.stop_method`      | method to stop after `idle_timeout`                                                                                                                                 |                                | `stop`                      | `stop`, `pause`, `kill`                                                   |
+| `proxy.stop_timeout`     | time to wait for stop command                                                                                                                                       |                                | `10s`                       | `number[unit]...`                                                         |
+| `proxy.stop_signal`      | signal sent to container for `stop` and `kill` methods                                                                                                              |                                | docker's default            | `SIGINT`, `SIGTERM`, `SIGHUP`, `SIGQUIT` and those without **SIG** prefix |
+| `proxy.<alias>.<field>`  | set field for specific alias                                                                                                                                        | `proxy.gitlab-ssh.scheme`      | N/A                         | N/A                                                                       |
+| `proxy.$<index>.<field>` | set field for specific alias at index (starting from **1**)                                                                                                         | `proxy.$3.port`                | N/A                         | N/A                                                                       |
+| `proxy.*.<field>`        | set field for all aliases                                                                                                                                           | `proxy.*.set_headers`          | N/A                         | N/A                                                                       |
+
+### Fields
+
+| Field           | Description                                                                                    | Default                                                                          | Allowed Values / Syntax                                                                                                                                                                                                 |
+| --------------- | ---------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scheme`        | proxy protocol                                                                                 | <ul><li>`http` for numeric port</li><li>`tcp` for `x:y` port</li></ul>           | `http`, `https`, `tcp`, `udp`                                                                                                                                                                                           |
+| `host`          | proxy host                                                                                     | <ul><li>Docker: docker client IP / hostname </li><li>File: `localhost`</li></ul> | IP address, hostname                                                                                                                                                                                                    |
+| `port`          | proxy port **(http/s)**                                                                        | first port returned from docker                                                  | number in range of `1 - 65535`                                                                                                                                                                                          |
+| `port`          | proxy port **(tcp/udp)**                                                                       | `0:first_port`                                                                   | `x:y` <br><ul><li>**x**: port for `go-proxy` to listen on.<br>**x** can be 0, which means listen on a random port</li><li>**y**: port or [_service name_](../src/common/constants.go#L55) of target container</li></ul> |
+| `no_tls_verify` | whether skip tls verify **(https only)**                                                       | `false`                                                                          | boolean                                                                                                                                                                                                                 |
+| `path_patterns` | proxy path patterns **(http/s only)**<br> only requests that matched a pattern will be proxied | `/` **(proxy all requests)**                                                     | yaml style list[<sup>1</sup>](#list-example) of ([path patterns](https://pkg.go.dev/net/http#hdr-Patterns-ServeMux))                                                                                                    |
+| `set_headers`   | header to set **(http/s only)**                                                                | empty                                                                            | yaml style key-value mapping[<sup>2</sup>](#key-value-mapping-example) of header-value pairs                                                                                                                            |
+| `hide_headers`  | header to hide **(http/s only)**                                                               | empty                                                                            | yaml style list[<sup>1</sup>](#list-example) of headers                                                                                                                                                                 |
+
+[🔼Back to top](#table-of-content)
+
+#### Key-value mapping example
+
+Docker Compose
+
+```yaml
+services:
+  nginx:
+    ...
+    labels:
+      # values from duplicated header keys will be combined
+      proxy.nginx.set_headers: | # remember to add the '|'
+        X-Custom-Header1: value1, value2
+        X-Custom-Header2: value3
+        X-Custom-Header2: value4
+      # X-Custom-Header2 will be "value3, value4"
+```
+
+File Provider
+
+```yaml
+service_a:
+    host: service_a.internal
+    set_headers:
+        # do not duplicate header keys, as it is not allowed in YAML
+        X-Custom-Header1: value1, value2
+        X-Custom-Header2: value3
+```
+
+[🔼Back to top](#table-of-content)
+
+#### List example
+
+Docker Compose
+
+```yaml
+services:
+  nginx:
+    ...
+    labels:
+      proxy.nginx.path_patterns: | # remember to add the '|'
+        - GET /
+        - POST /auth
+      proxy.nginx.hide_headers: | # remember to add the '|'
+        - X-Custom-Header1
+        - X-Custom-Header2
+```
+
+File Provider
+
+```yaml
+service_a:
+    host: service_a.internal
+    path_patterns:
+        - GET /
+        - POST /auth
+    hide_headers:
+        - X-Custom-Header1
+        - X-Custom-Header2
+```
+
+[🔼Back to top](#table-of-content)

 ## Troubleshooting

- Firewall issues
+-   Container not showing up in proxies list

-  If you are using `ufw` with vpn that drop all inbound traffic except vpn, run below:
+    Please check that either `ports` or label `proxy.<alias>.port` is declared, e.g.

-  `sudo ufw allow from 172.16.0.0/16 to 100.64.0.0/10`
+    ```yaml
+    services:
+      nginx-1: # Option 1
+        ...
+        ports:
+          - 80
+      nginx-2: # Option 2
+        ...
+        container_name: nginx-2
+        network_mode: host
+        labels:
+          proxy.nginx-2.port: 80
+    ```

-  Explaination:
+-   Firewall issues

-  Docker network is usually `172.16.0.0/16`
+    If you are using `ufw` with vpn that drop all inbound traffic except vpn, run below:

-  Tailscale is used as an example, `100.64.0.0/10` will be the CIDR
+    `sudo ufw allow from 172.16.0.0/16 to 100.64.0.0/10`

-  You can also list CIDRs of all docker bridge networks by:
+    Explaination:

-  `docker network inspect $(docker network ls | awk '$3 == "bridge" { print $1}') | jq -r '.[] | .Name + " " + .IPAM.Config[0].Subnet' -`
+    Docker network is usually `172.16.0.0/16`

-## Docker compose example (bridge network)
+    Tailscale is used as an example, `100.64.0.0/10` will be the CIDR
+
+    You can also list CIDRs of all docker bridge networks by:
+
+    `docker network inspect $(docker network ls | awk '$3 == "bridge" { print $1}') | jq -r '.[] | .Name + " " + .IPAM.Config[0].Subnet' -`
+
+[🔼Back to top](#table-of-content)
+
+## Docker compose examples
+
+More examples in [here](examples/)

 ```yaml
 volumes:
-  adg-work:
-  adg-conf:
-  mc-data:
-  palworld:
-  nginx:
+    adg-work:
+    adg-conf:
+    mc-data:
+    palworld:
+    nginx:
 services:
-  adg:
-    image: adguard/adguardhome
-    restart: unless-stopped
-    labels:
-      - proxy.aliases=adg,adg-dns,adg-setup
-      - proxy.adg.port=80
-      - proxy.adg-setup.port=3000
-      - proxy.adg-dns.scheme=udp
-      - proxy.adg-dns.port=20000:dns
-    volumes:
-      - adg-work:/opt/adguardhome/work
-      - adg-conf:/opt/adguardhome/conf
-  mc:
-    image: itzg/minecraft-server
-    tty: true
-    stdin_open: true
-    container_name: mc
-    restart: unless-stopped
-    labels:
-      - proxy.mc.scheme=tcp
-      - proxy.mc.port=20001:25565
-    environment:
-      - EULA=TRUE
-    volumes:
-      - mc-data:/data
-  palworld:
-    image: thijsvanloef/palworld-server-docker:latest
-    restart: unless-stopped
-    container_name: pal
-    stop_grace_period: 30s
-    labels:
-      - proxy.aliases=pal1,pal2
-      - proxy.*.scheme=udp
-      - proxy.pal1.port=20002:8211
-      - proxy.pal2.port=20003:27015
-    environment: ...
-    volumes:
-      - palworld:/palworld
-  nginx:
-    image: nginx
-    container_name: nginx
-    volumes:
-      - nginx:/usr/share/nginx/html
-  go-proxy:
-    image: ghcr.io/yusing/go-proxy
-    container_name: go-proxy
-    restart: always
-    ports:
-      - 80:80 # http
-      - 443:443 # optional, https
-      - 8080:8080 # http panel
-      - 8443:8443 # optional, https panel
-
-      - 53:20000/udp # adguardhome
-      - 25565:20001/tcp # minecraft
-      - 8211:20002/udp # palworld
-      - 27015:20003/udp # palworld
-    volumes:
-      - ./config:/app/config
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    labels:
-      - proxy.aliases=gp
-      - proxy.panel.port=8080
+    adg:
+        image: adguard/adguardhome
+        restart: unless-stopped
+        labels:
+            - proxy.aliases=adg,adg-dns,adg-setup
+            - proxy.$1.port=80
+            - proxy.$2.scheme=udp
+            - proxy.$2.port=20000:dns
+            - proxy.$3.port=3000
+        volumes:
+            - adg-work:/opt/adguardhome/work
+            - adg-conf:/opt/adguardhome/conf
+        ports:
+            - 80
+            - 3000
+            - 53/udp
+    mc:
+        image: itzg/minecraft-server
+        tty: true
+        stdin_open: true
+        container_name: mc
+        restart: unless-stopped
+        ports:
+            - 25565
+        labels:
+            - proxy.mc.port=20001:25565
+        environment:
+            - EULA=TRUE
+        volumes:
+            - mc-data:/data
+    palworld:
+        image: thijsvanloef/palworld-server-docker:latest
+        restart: unless-stopped
+        container_name: pal
+        stop_grace_period: 30s
+        ports:
+            - 8211/udp
+            - 27015/udp
+        labels:
+            - proxy.aliases=pal1,pal2
+            - proxy.*.scheme=udp
+            - proxy.$1.port=20002:8211
+            - proxy.$2.port=20003:27015
+        environment: ...
+        volumes:
+            - palworld:/palworld
+    nginx:
+        image: nginx
+        container_name: nginx
+        volumes:
+            - nginx:/usr/share/nginx/html
+        ports:
+            - 80
+        labels:
+            proxy.idle_timeout: 1m
+    go-proxy:
+        image: ghcr.io/yusing/go-proxy:latest
+        container_name: go-proxy
+        restart: always
+        network_mode: host
+        volumes:
+            - ./config:/app/config
+            - /var/run/docker.sock:/var/run/docker.sock
+    go-proxy-frontend:
+        image: ghcr.io/yusing/go-proxy-frontend:latest
+        container_name: go-proxy-frontend
+        restart: unless-stopped
+        network_mode: host
+        labels:
+            - proxy.aliases=gp
+            - proxy.gp.port=3000
+        depends_on:
+            - go-proxy
 ```

-### Services URLs
+[🔼Back to top](#table-of-content)

- `gp.yourdomain.com`: go-proxy web panel
- `adg-setup.yourdomain.com`: adguard setup (first time setup)
- `adg.yourdomain.com`: adguard dashboard
- `nginx.yourdomain.com`: nginx
- `yourdomain.com:53`: adguard dns
- `yourdomain.com:25565`: minecraft server
- `yourdomain.com:8211`: palworld server
+### Services URLs for above examples

-## Docker compose example (host network)
+-   `gp.yourdomain.com`: go-proxy web panel
+-   `adg-setup.yourdomain.com`: adguard setup (first time setup)
+-   `adg.yourdomain.com`: adguard dashboard
+-   `nginx.yourdomain.com`: nginx
+-   `yourdomain.com:2000`: adguard dns (udp)
+-   `yourdomain.com:20001`: minecraft server
+-   `yourdomain.com:20002`: palworld server

-### Notice
-
-When `go-proxy` is running in `host` network mode, you must:
-
- set `GOPROXY_HOST_NETWORK=1`
- map ports to host explicitly
- add an asterisk sign **(*)** before `port` number under `labels`
-
-```yaml
-volumes:
-  adg-work:
-  adg-conf:
-  mc-data:
-  palworld:
-  nginx:
-services:
-  adg:
-    image: adguard/adguardhome
-    restart: unless-stopped
-    ports: # map random ports to container ports
-      - 80
-      - 3000
-      - 53/udp
-      - 53/tcp
-    labels:
-      - proxy.aliases=adg,adg-dns,adg-setup
-      # add an asterisk (*) before to find host port automatically
-      - proxy.adg.port=*80
-      - proxy.adg-setup.port=*3000
-      - proxy.adg-dns.scheme=udp
-      - proxy.adg-dns.port=*53
-    volumes:
-      - adg-work:/opt/adguardhome/work
-      - adg-conf:/opt/adguardhome/conf
-  mc:
-    image: itzg/minecraft-server
-    tty: true
-    stdin_open: true
-    container_name: mc
-    restart: unless-stopped
-    ports:
-      - 25565
-    labels:
-      - proxy.mc.scheme=tcp
-      - proxy.mc.port=*25565
-    environment:
-      - EULA=TRUE
-    volumes:
-      - mc-data:/data
-  palworld:
-    image: thijsvanloef/palworld-server-docker:latest
-    restart: unless-stopped
-    container_name: pal
-    stop_grace_period: 30s
-    ports:
-      - 8211/udp
-      - 27015/udp
-    labels:
-      - proxy.aliases=pal1,pal2
-      - proxy.*.scheme=udp
-      - proxy.pal1.port=*8211
-      - proxy.pal2.port=*27015
-    environment: ...
-    volumes:
-      - palworld:/palworld
-  nginx:
-    image: nginx
-    container_name: nginx
-    # for single port container, host port will be found automatically
-    ports:
-      - 80
-    volumes:
-      - nginx:/usr/share/nginx/html
-  go-proxy:
-    image: ghcr.io/yusing/go-proxy
-    container_name: go-proxy
-    restart: always
-    network_mode: host # no port mapping needed for host network mode
-    environment:
-      - GOPROXY_HOST_NETWORK=1 # required for host network mode
-    volumes:
-      - ./config:/app/config
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    labels:
-      - proxy.aliases=gp
-      - proxy.panel.port=808
-```
-
-**Same services URLs as [`bridge`](#services-urls) example!**
+[🔼Back to top](#table-of-content)
--- a/docs/docker_socket_proxy.md
+++ b/docs/docker_socket_proxy.md
@@ -0,0 +1,40 @@
+## Docker Socket Proxy
+
+For docker client on other machine, set this up, then add `name: tcp://<machine_ip>:2375` to `config.yml` under `docker` section
+
+```yml
+# compose.yml on remote machine (e.g. server1)
+docker-proxy:
+  container_name: docker-proxy
+  image: tecnativa/docker-socket-proxy
+  privileged: true
+  environment:
+    - ALLOW_START=1
+    - ALLOW_STOP=1
+    - ALLOW_RESTARTS=1
+    - CONTAINERS=1
+    - EVENTS=1
+    - PING=1
+    - POST=1
+    - VERSION=1
+  volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+  restart: always
+  ports:
+    - 2375:2375
+    # or more secure
+    - <machine_private_ip>:2375:2375
+```
+
+```yml
+# config.yml on go-proxy machine
+autocert:
+  ... # your config
+
+providers:
+  include:
+    ...
+  docker:
+    ...
+    server1: tcp://<machine_ip>:2375
+```
--- a/examples/microbin.yml
+++ b/examples/microbin.yml
@@ -0,0 +1,16 @@
+services:
+  app:
+    container_name: microbin
+    cpu_shares: 10
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+    env_file: .env
+    image: docker.i.sh/danielszabo99/microbin:latest
+    ports:
+      - 8080
+    restart: unless-stopped
+    volumes:
+      - ./data:/app/microbin_data
+# microbin.domain.tld
--- a/examples/siyuan.yml
+++ b/examples/siyuan.yml
@@ -0,0 +1,16 @@
+services:
+  main:
+    image: b3log/siyuan:v3.1.0
+    container_name: siyuan
+    command:
+      - --workspace=/siyuan/workspace/
+      - --accessAuthCode=<some password>
+    user: 1000:1000
+    volumes:
+      - ./workspace:/siyuan/workspace
+    restart: unless-stopped
+    environment:
+      - TZ=Asia/Hong_Kong
+    ports:
+      - 6806
+# siyuan.domain.tld
--- a/1
+++ b/1
--- a/go.work
+++ b/go.work
@@ -0,0 +1,5 @@
+go 1.22.0
+
+toolchain go1.23.1
+
+use ./src
--- a/providers.example.yml
+++ b/providers.example.yml
@@ -1,25 +1,21 @@
-example: # matching `app.y.z`
-  # optional, defaults to http
-  scheme:
-  # required, proxy target
-  host: 10.0.0.1
-  # optional, defaults to 80 for http, 443 for https
-  port: 80
-  # optional, defaults to empty
-  path:
-  # optional, defaults to sub
-  path_mode:
-  # optional (https only)
-  # no_tls_verify: false
-app1: # matching `app1.y.z` -> http://x.y.z
-  host: x.y.z
-app2: # `app2` has no effect for tcp / udp, but still has to be unique across files
-  scheme: tcp
-  host: 10.0.0.2
-  port: 20000:tcp
-app3: # matching `app3.y.z` -> https://10.0.0.1/app3
-  scheme: https
-  host: 10.0.0.1
-  path: /app3
-  path_mode: forward
-  no_tls_verify: false
+example: # matching `example.y.z`
+    scheme: https
+    host: 10.0.0.1
+    port: 80
+    path_patterns: # Check https://pkg.go.dev/net/http#hdr-Patterns-ServeMux for syntax
+        - GET / # accept any GET request
+        - POST /auth # for /auth and /auth/* accept only POST
+        - GET /home/{$} # for exactly /home
+    no_tls_verify: false
+    set_headers:
+        HEADER_A: VALUE_A, VALUE_B
+        HEADER_B: VALUE_C
+    hide_headers:
+        - HEADER_C
+        - HEADER_D
+app1: # app1 -> localhost:8080
+    port: 8080
+app2:
+    scheme: udp
+    host: 10.0.0.2
+    port: 2223:dns
--- a/schema/config.schema.json
+++ b/schema/config.schema.json
@@ -8,44 +8,207 @@
      "type": "object",
      "properties": {
        "email": {
-          "description": "ACME Email",
+          "title": "ACME Email",
          "type": "string",
          "pattern": "^[\\w-\\.]+@([\\w-]+\\.)+[\\w-]{2,4}$",
          "patternErrorMessage": "Invalid email"
        },
        "domains": {
-          "description": "Cert Domains",
+          "title": "Cert Domains",
          "type": "array",
          "items": {
            "type": "string"
          },
          "minItems": 1
        },
+        "cert_path": {
+          "title": "path of cert file to load/store",
+          "default": "certs/cert.crt",
+          "markdownDescription": "default: `certs/cert.crt`",
+          "type": "string"
+        },
+        "key_path": {
+          "title": "path of key file to load/store",
+          "default": "certs/priv.key",
+          "markdownDescription": "default: `certs/priv.key`",
+          "type": "string"
+        },
        "provider": {
-          "description": "DNS Challenge Provider",
+          "title": "DNS Challenge Provider",
+          "default": "local",
          "type": "string",
-          "enum": ["cloudflare"]
+          "enum": ["local", "cloudflare", "clouddns", "duckdns", "ovh"]
        },
        "options": {
-          "description": "Provider specific options",
-          "type": "object",
-          "properties": {
-            "auth_token": {
-              "description": "Cloudflare API Token with Zone Scope",
-              "type": "string"
-            }
-          }
+          "title": "Provider specific options",
+          "type": "object"
        }
      },
-      "required": ["email", "domains", "provider", "options"],
-      "anyOf": [
+      "allOf": [
        {
-          "properties": {
-            "provider": {
-              "const": "cloudflare"
-            },
-            "options": {
-              "required": ["auth_token"]
+          "if": {
+            "not": {
+              "properties": {
+                "provider": {
+                  "const": "local"
+                }
+              }
+            }
+          },
+          "then": {
+            "required": ["email", "domains", "provider", "options"]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "provider": {
+                "const": "cloudflare"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "options": {
+                "required": ["auth_token"],
+                "additionalProperties": false,
+                "properties": {
+                  "auth_token": {
+                    "description": "Cloudflare API Token with Zone Scope",
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "provider": {
+                "const": "clouddns"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "options": {
+                "required": ["client_id", "email", "password"],
+                "additionalProperties": false,
+                "properties": {
+                  "client_id": {
+                    "description": "CloudDNS Client ID",
+                    "type": "string"
+                  },
+                  "email": {
+                    "description": "CloudDNS Email",
+                    "type": "string"
+                  },
+                  "password": {
+                    "description": "CloudDNS Password",
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "provider": {
+                "const": "duckdns"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "options": {
+                "required": ["token"],
+                "additionalProperties": false,
+                "properties": {
+                  "token": {
+                    "description": "DuckDNS Token",
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "provider": {
+                "const": "ovh"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "options": {
+                "required": ["application_secret", "consumer_key"],
+                "additionalProperties": false,
+                "oneOf": [
+                  {
+                    "required": ["application_key"]
+                  },
+                  {
+                    "required": ["oauth2_config"]
+                  }
+                ],
+                "properties": {
+                  "api_endpoint": {
+                    "description": "OVH API endpoint",
+                    "default": "ovh-eu",
+                    "anyOf": [
+                      {
+                        "enum": [
+                          "ovh-eu",
+                          "ovh-ca",
+                          "ovh-us",
+                          "kimsufi-eu",
+                          "kimsufi-ca",
+                          "soyoustart-eu",
+                          "soyoustart-ca"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "format": "uri"
+                      }
+                    ]
+                  },
+                  "application_secret": {
+                    "description": "OVH Application Secret",
+                    "type": "string"
+                  },
+                  "consumer_key": {
+                    "description": "OVH Consumer Key",
+                    "type": "string"
+                  },
+                  "application_key": {
+                    "description": "OVH Application Key",
+                    "type": "string"
+                  },
+                  "oauth2_config": {
+                    "description": "OVH OAuth2 config",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "properties": {
+                      "client_id": {
+                        "description": "OVH Client ID",
+                        "type": "string"
+                      },
+                      "client_secret": {
+                        "description": "OVH Client Secret",
+                        "type": "string"
+                      }
+                    },
+                    "required": ["client_id", "client_secret"]
+                  }
+                }
+              }
            }
          }
        }
@@ -54,67 +217,54 @@
    "providers": {
      "title": "Proxy providers configuration",
      "type": "object",
-      "patternProperties": {
-        "^[a-zA-Z0-9_-]+$": {
-          "description": "Proxy provider",
+      "additionalProperties": false,
+      "properties": {
+        "include": {
+          "title": "Proxy providers configuration files",
+          "description": "relative path to 'config'",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[a-zA-Z0-9_-]+\\.(yml|yaml)$",
+            "patternErrorMessage": "Invalid file name"
+          }
+        },
+        "docker": {
+          "title": "Docker provider configuration",
+          "description": "docker clients (name-address pairs)",
          "type": "object",
-          "properties": {
-            "kind": {
-              "description": "Proxy provider kind",
+          "patternProperties": {
+            "^[a-zA-Z0-9-_]+$": {
              "type": "string",
-              "enum": ["docker", "file"]
-            },
-            "value": {
-              "type": "string"
-            }
-          },
-          "required": ["kind", "value"],
-          "allOf": [
-            {
-              "if": {
-                "properties": {
-                  "kind": {
-                    "const": "docker"
-                  }
-                }
-              },
-              "then": {
-                "if": {
-                  "properties": {
-                    "value": {
-                      "const": "FROM_ENV"
-                    }
-                  }
+              "examples": [
+                "unix:///var/run/docker.sock",
+                "tcp://127.0.0.1:2375",
+                "ssh://user@host:port"
+              ],
+              "oneOf": [
+                {
+                  "const": "$DOCKER_HOST",
+                  "description": "Use DOCKER_HOST environment variable"
                },
-                "then": {
-                  "properties": {
-                    "value": {
-                      "description": "use docker client from environment"
-                    }
-                  }
+                {
+                  "pattern": "^unix://.+$",
+                  "description": "A Unix socket for local Docker communication."
                },
-                "else": {
-                  "properties": {
-                    "value": {
-                      "description": "docker client URL",
-                      "examples": [
-                        "unix:///var/run/docker.sock",
-                        "tcp://127.0.0.1:2375",
-                        "ssh://user@host:port"
-                      ]
-                    }
-                  }
+                {
+                  "pattern": "^ssh://.+$",
+                  "description": "An SSH connection to a remote Docker host."
+                },
+                {
+                  "pattern": "^fd://.+$",
+                  "description": "A file descriptor for Docker communication."
+                },
+                {
+                  "pattern": "^tcp://.+$",
+                  "description": "A TCP connection to a remote Docker host."
                }
-              },
-              "else": {
-                "properties": {
-                  "value": {
-                    "description": "file path"
-                  }
-                }
-              }
+              ]
            }
-          ]
+          }
        }
      }
    },
@@ -124,7 +274,7 @@
      "minimum": 0
    },
    "redirect_to_https": {
-      "title": "Redirect to HTTPS",
+      "title": "Redirect to HTTPS on HTTP requests",
      "type": "boolean"
    }
  },
--- a/schema/providers.schema.json
+++ b/schema/providers.schema.json
@@ -1,12 +1,12 @@
 {
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "go-proxy providers file",
-  "anyOf": [
+  "oneOf": [
    {
-      "type":"object"
+      "type": "object"
    },
    {
-      "type":"null"
+      "type": "null"
    }
  ],
  "patternProperties": {
@@ -16,19 +16,33 @@
      "properties": {
        "scheme": {
          "title": "Proxy scheme (http, https, tcp, udp)",
-          "anyOf": [
+          "oneOf": [
            {
              "type": "string",
-              "enum": ["http", "https", "tcp", "udp"]
+              "enum": [
+                "http",
+                "https",
+                "tcp",
+                "udp",
+                "tcp:tcp",
+                "udp:udp",
+                "tcp:udp",
+                "udp:tcp"
+              ]
            },
            {
              "type": "null",
-              "description": "HTTP proxy"
+              "description": "Auto detect base on port format"
            }
          ]
        },
        "host": {
-          "anyOf": [
+          "default": "localhost",
+          "oneOf": [
+            {
+              "type": "null",
+              "description": "localhost (default)"
+            },
            {
              "type": "string",
              "format": "ipv4",
@@ -47,69 +61,59 @@
          ],
          "title": "Proxy host (ipv4 / ipv6 / hostname)"
        },
-        "port": {
-          "title": "Proxy port"
-        },
-        "path": {},
-        "path_mode": {},
-        "no_tls_verify": {
-          "description": "Disable TLS verification for https proxy",
-          "type": "boolean"
-        }
+        "port": {},
+        "no_tls_verify": {},
+        "path_patterns": {},
+        "set_headers": {},
+        "hide_headers": {}
      },
-      "required": ["host"],
      "additionalProperties": false,
      "allOf": [
        {
          "if": {
-            "anyOf": [
-              {
-                "properties": {
-                  "scheme": {
-                    "enum": ["http", "https"]
-                  }
-                }
-              },
-              {
-                "properties": {
-                  "scheme": {
-                    "not": true
-                  }
-                }
-              },
-              {
-                "properties": {
-                  "scheme": {
+            "properties": {
+              "scheme": {
+                "anyOf": [
+                  {
+                    "enum": [
+                      "http",
+                      "https"
+                    ]
+                  },
+                  {
                    "type": "null"
                  }
-                }
+                ]
              }
-            ]
+            }
          },
          "then": {
            "properties": {
              "port": {
-                "anyOf": [
+                "markdownDescription": "Proxy port from **0** to **65535**",
+                "oneOf": [
                  {
                    "type": "string",
-                    "pattern": "^[0-9]{1,5}$",
-                    "minimum": 1,
-                    "maximum": 65535,
-                    "markdownDescription": "Proxy port from **1** to **65535**",
-                    "patternErrorMessage": "'port' must be a number"
+                    "pattern": "^\\d{1,5}$",
+                    "patternErrorMessage": "`port` must be a number"
                  },
                  {
                    "type": "integer",
-                    "minimum": 1,
+                    "minimum": 0,
                    "maximum": 65535
                  }
                ]
              },
-              "path": {
-                "anyOf": [
+              "path_patterns": {
+                "oneOf": [
                  {
-                    "type": "string",
-                    "description": "Proxy path"
+                    "type": "array",
+                    "markdownDescription": "A list of [path patterns](https://pkg.go.dev/net/http#hdr-Patterns-ServeMux)",
+                    "items": {
+                      "type": "string",
+                      "pattern": "^((GET|POST|DELETE|PUT|PATCH|HEAD|OPTIONS|CONNECT)\\s)?(/(\\w*|{\\w*}|{\\$}))+/?$",
+                      "patternErrorMessage": "invalid path pattern"
+                    }
                  },
                  {
                    "type": "null",
@@ -117,50 +121,71 @@
                  }
                ]
              },
-              "path_mode": {
-                "anyOf": [
-                  {
-                    "description": "Proxy path mode (forward, sub, empty)",
-                    "type": "string",
-                    "enum": ["", "forward", "sub"]
-                  },
-                  {
-                    "description": "Default proxy path mode (sub)",
-                    "type": "null"
+              "set_headers": {
+                "type": "object",
+                "description": "Proxy headers to set",
+                "additionalProperties": {
+                  "items": {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
                  }
-                ]
+                }
+              },
+              "hide_headers": {
+                "type": "array",
+                "description": "Proxy headers to hide",
+                "items": {
+                  "type": "string"
+                }
              }
            }
          },
          "else": {
            "properties": {
              "port": {
-                "markdownDescription": "`listening port`:`target port | service type`",
+                "markdownDescription": "`listening port:proxy port` or `listening port:service name`",
                "type": "string",
                "pattern": "^[0-9]+\\:[0-9a-z]+$",
-                "patternErrorMessage": "'port' must be in the format of '<listening port>:<target port | service type>'"
+                "patternErrorMessage": "invalid syntax"
              },
-              "path": {
+              "no_tls_verify": {
                "not": true
              },
-              "path_mode": {
+              "path_patterns": {
+                "not": true
+              },
+              "set_headers": {
+                "not": true
+              },
+              "hide_headers": {
                "not": true
              }
            },
-            "required": ["port"]
+            "required": [
+              "port"
+            ]
          }
        },
        {
          "if": {
-            "not": {
-              "properties": {
-                "scheme": {
-                  "const": "https"
-                }
+            "properties": {
+              "scheme": {
+                "const": "https"
              }
            }
          },
          "then": {
+            "properties": {
+              "no_tls_verify": {
+                "description": "Disable TLS verification for https proxy",
+                "type": "boolean",
+                "default": false
+              }
+            }
+          },
+          "else": {
            "properties": {
              "no_tls_verify": {
                "not": true
@@ -172,4 +197,4 @@
    }
  },
  "additionalProperties": false
-}
+}
--- a/screenshots/config_editor.png
+++ b/screenshots/config_editor.png
--- a/screenshots/panel.png
+++ b/screenshots/panel.png
--- a/setup-binary.sh
+++ b/setup-binary.sh
@@ -1,114 +0,0 @@
-#!/bin/bash
-set -e
-REPO_URL=https://github.com/yusing/go-proxy
-BIN_URL="${REPO_URL}/releases/download/${VERSION}/go-proxy"
-SRC_URL="${REPO_URL}/archive/refs/tags/${VERSION}.tar.gz"
-APP_ROOT="/opt/go-proxy/${VERSION}"
-LOG_FILE="/tmp/go-proxy-setup.log"
-
-if [ -z "$VERSION" ] || [ "$VERSION" = "latest" ]; then
-    VERSION_URL="${REPO_URL}/raw/main/version.txt"
-    VERSION=$(wget -qO- "$VERSION_URL")
-fi
-
-if [ -d "$APP_ROOT" ]; then
-    echo "$APP_ROOT already exists"
-    exit 1
-fi
-
-# check if wget exists
-if ! [ -x "$(command -v wget)" ]; then
-    echo "wget is not installed"
-    exit 1
-fi
-
-# check if make exists
-if ! [ -x "$(command -v make)" ]; then
-    echo "make is not installed"
-    exit 1
-fi
-
-dl_source() {
-    cd /tmp
-    echo "Downloading go-proxy source ${VERSION}"
-    wget -c "${SRC_URL}" -O go-proxy.tar.gz &> $LOG_FILE
-    if [ $? -gt 0 ]; then
-        echo "Source download failed, check your internet connection and version number"
-        exit 1
-    fi
-    echo "Done"
-    echo "Extracting go-proxy source ${VERSION}"
-    tar xzf go-proxy.tar.gz &> $LOG_FILE
-    if [ $? -gt 0 ]; then
-        echo "failed to untar go-proxy.tar.gz"
-        exit 1
-    fi
-    rm go-proxy.tar.gz
-    mkdir -p "$(dirname "${APP_ROOT}")"
-    mv "go-proxy-${VERSION}" "$APP_ROOT"
-    cd "$APP_ROOT"
-    echo "Done"
-}
-dl_binary() {
-    mkdir -p bin
-    echo "Downloading go-proxy binary ${VERSION}"
-    wget -c "${BIN_URL}" -O bin/go-proxy &> $LOG_FILE
-    if [ $? -gt 0 ]; then
-        echo "Binary download failed, check your internet connection and version number"
-        exit 1
-    fi
-    chmod +x bin/go-proxy
-    echo "Done"
-}
-setup() {
-    make setup &> $LOG_FILE
-    if [ $? -gt 0 ]; then
-        echo "make setup failed"
-        exit 1
-    fi
-    # SETUP_CODEMIRROR = 1
-    if [ "$SETUP_CODEMIRROR" != "0" ]; then
-        make setup-codemirror &> $LOG_FILE || echo "make setup-codemirror failed, ignored"
-    fi
-}
-
-dl_source
-dl_binary
-setup
-
-# setup systemd
-
-# check if systemctl exists
-if ! command -v systemctl is-system-running > /dev/null 2>&1; then
-    echo "systemctl not found, skipping systemd setup"
-    exit 0
-fi
-systemctl_failed() {
-    echo "Failed to enable and start go-proxy"
-    systemctl status go-proxy
-    exit 1
-}
-echo "Setting up systemd service"
-cat <<EOF > /etc/systemd/system/go-proxy.service
-[Unit]
-Description=go-proxy reverse proxy
-After=network-online.target
-Wants=network-online.target systemd-networkd-wait-online.service
-[Service]
-Type=simple
-ExecStart=${APP_ROOT}/bin/go-proxy
-WorkingDirectory=${APP_ROOT}
-Environment="IS_SYSTEMD=1"
-Restart=on-failure
-RestartSec=1s
-KillMode=process
-KillSignal=SIGINT
-TimeoutStartSec=5s
-TimeoutStopSec=5s
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl daemon-reload &>$LOG_FILE || systemctl_failed
-systemctl enable --now go-proxy &>$LOG_FILE || systemctl_failed
-echo "Done"
-echo "Setup complete"
--- a/setup-docker.sh
+++ b/setup-docker.sh
@@ -1,14 +0,0 @@
-#!/bin/sh
-
-set -e
-if [ -z "$BRANCH" ]; then
-    BRANCH="main"
-fi
-BASE_URL="https://github.com/yusing/go-proxy/raw/${BRANCH}"
-mkdir -p go-proxy
-cd go-proxy
-mkdir -p config
-mkdir -p certs
-[ -f compose.yml ] || wget -cO - ${BASE_URL}/compose.example.yml > compose.yml
-[ -f config/config.yml ] || wget -cO - ${BASE_URL}/config.example.yml > config/config.yml
-[ -f config/providers.yml ] || touch config/providers.yml
--- a/showcase/idlesleeper.webp
+++ b/showcase/idlesleeper.webp
--- a/src/api/handler.go
+++ b/src/api/handler.go
@@ -0,0 +1,30 @@
+package api
+
+import (
+	"net/http"
+
+	v1 "github.com/yusing/go-proxy/api/v1"
+	"github.com/yusing/go-proxy/config"
+)
+
+func NewHandler(cfg *config.Config) http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /v1", v1.Index)
+	mux.HandleFunc("GET /v1/checkhealth", wrap(cfg, v1.CheckHealth))
+	mux.HandleFunc("HEAD /v1/checkhealth", wrap(cfg, v1.CheckHealth))
+	mux.HandleFunc("POST /v1/reload", wrap(cfg, v1.Reload))
+	mux.HandleFunc("GET /v1/list", wrap(cfg, v1.List))
+	mux.HandleFunc("GET /v1/list/{what}", wrap(cfg, v1.List))
+	mux.HandleFunc("GET /v1/file", v1.GetFileContent)
+	mux.HandleFunc("GET /v1/file/{filename}", v1.GetFileContent)
+	mux.HandleFunc("POST /v1/file/{filename}", v1.SetFileContent)
+	mux.HandleFunc("PUT /v1/file/{filename}", v1.SetFileContent)
+	mux.HandleFunc("GET /v1/stats", wrap(cfg, v1.Stats))
+	return mux
+}
+
+func wrap(cfg *config.Config, f func(cfg *config.Config, w http.ResponseWriter, r *http.Request)) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		f(cfg, w, r)
+	}
+}
--- a/src/api/v1/checkhealth.go
+++ b/src/api/v1/checkhealth.go
@@ -0,0 +1,42 @@
+package v1
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	U "github.com/yusing/go-proxy/api/v1/utils"
+	"github.com/yusing/go-proxy/config"
+	R "github.com/yusing/go-proxy/route"
+)
+
+func CheckHealth(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
+	target := r.FormValue("target")
+	if target == "" {
+		U.HandleErr(w, r, U.ErrMissingKey("target"), http.StatusBadRequest)
+		return
+	}
+
+	var ok bool
+	route := cfg.FindRoute(target)
+
+	switch {
+	case route == nil:
+		U.HandleErr(w, r, U.ErrNotFound("target", target), http.StatusNotFound)
+		return
+	case route.Type() == R.RouteTypeReverseProxy:
+		ok = U.IsSiteHealthy(route.URL().String())
+	case route.Type() == R.RouteTypeStream:
+		entry := route.Entry()
+		ok = U.IsStreamHealthy(
+			strings.Split(entry.Scheme, ":")[1], // target scheme
+			fmt.Sprintf("%s:%v", entry.Host, strings.Split(entry.Port, ":")[1]),
+		)
+	}
+
+	if ok {
+		w.WriteHeader(http.StatusOK)
+	} else {
+		w.WriteHeader(http.StatusRequestTimeout)
+	}
+}
--- a/src/api/v1/file.go
+++ b/src/api/v1/file.go
@@ -0,0 +1,57 @@
+package v1
+
+import (
+	"io"
+	"net/http"
+	"os"
+	"path"
+
+	U "github.com/yusing/go-proxy/api/v1/utils"
+	"github.com/yusing/go-proxy/common"
+	"github.com/yusing/go-proxy/config"
+	"github.com/yusing/go-proxy/proxy/provider"
+)
+
+func GetFileContent(w http.ResponseWriter, r *http.Request) {
+	filename := r.PathValue("filename")
+	if filename == "" {
+		filename = common.ConfigFileName
+	}
+	content, err := os.ReadFile(path.Join(common.ConfigBasePath, filename))
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	w.Write(content)
+}
+
+func SetFileContent(w http.ResponseWriter, r *http.Request) {
+	filename := r.PathValue("filename")
+	if filename == "" {
+		U.HandleErr(w, r, U.ErrMissingKey("filename"), http.StatusBadRequest)
+		return
+	}
+	content, err := io.ReadAll(r.Body)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+
+	if filename == common.ConfigFileName {
+		err = config.Validate(content).Error()
+	} else {
+		err = provider.Validate(content).Error()
+	}
+
+	if err != nil {
+		U.HandleErr(w, r, err, http.StatusBadRequest)
+		return
+	}
+
+	err = os.WriteFile(path.Join(common.ConfigBasePath, filename), content, 0644)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	w.WriteHeader(http.StatusOK)
+}
--- a/src/api/v1/index.go
+++ b/src/api/v1/index.go
@@ -0,0 +1,7 @@
+package v1
+
+import "net/http"
+
+func Index(w http.ResponseWriter, r *http.Request) {
+	w.Write([]byte("API ready"))
+}
--- a/src/api/v1/list.go
+++ b/src/api/v1/list.go
@@ -0,0 +1,62 @@
+package v1
+
+import (
+	"encoding/json"
+	"net/http"
+	"os"
+
+	"github.com/yusing/go-proxy/common"
+	"github.com/yusing/go-proxy/config"
+
+	U "github.com/yusing/go-proxy/api/v1/utils"
+)
+
+func List(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
+	what := r.PathValue("what")
+	if what == "" {
+		what = "routes"
+	}
+
+	switch what {
+	case "routes":
+		listRoutes(cfg, w, r)
+	case "config_files":
+		listConfigFiles(w, r)
+	default:
+		U.HandleErr(w, r, U.ErrInvalidKey("what"), http.StatusBadRequest)
+	}
+}
+
+func listRoutes(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
+	routes := cfg.RoutesByAlias()
+	typeFilter := r.FormValue("type")
+	if typeFilter != "" {
+		for k, v := range routes {
+			if v["type"] != typeFilter {
+				delete(routes, k)
+			}
+		}
+	}
+
+	if err := U.RespondJson(routes, w); err != nil {
+		U.HandleErr(w, r, err)
+	}
+}
+
+func listConfigFiles(w http.ResponseWriter, r *http.Request) {
+	files, err := os.ReadDir(common.ConfigBasePath)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	filenames := make([]string, len(files))
+	for i, f := range files {
+		filenames[i] = f.Name()
+	}
+	resp, err := json.Marshal(filenames)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	w.Write(resp)
+}
--- a/src/api/v1/reload.go
+++ b/src/api/v1/reload.go
@@ -0,0 +1,16 @@
+package v1
+
+import (
+	"net/http"
+
+	U "github.com/yusing/go-proxy/api/v1/utils"
+	"github.com/yusing/go-proxy/config"
+)
+
+func Reload(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
+	if err := cfg.Reload().Error(); err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	w.WriteHeader(http.StatusOK)
+}
--- a/src/api/v1/stats.go
+++ b/src/api/v1/stats.go
@@ -0,0 +1,20 @@
+package v1
+
+import (
+	"net/http"
+
+	U "github.com/yusing/go-proxy/api/v1/utils"
+	"github.com/yusing/go-proxy/config"
+	"github.com/yusing/go-proxy/server"
+	"github.com/yusing/go-proxy/utils"
+)
+
+func Stats(cfg *config.Config, w http.ResponseWriter, r *http.Request) {
+	stats := map[string]any{
+		"proxies": cfg.Statistics(),
+		"uptime":  utils.FormatDuration(server.GetProxyServer().Uptime()),
+	}
+	if err := U.RespondJson(stats, w); err != nil {
+		U.HandleErr(w, r, err)
+	}
+}
--- a/src/api/v1/utils/error.go
+++ b/src/api/v1/utils/error.go
@@ -0,0 +1,32 @@
+package utils
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/sirupsen/logrus"
+	E "github.com/yusing/go-proxy/error"
+)
+
+func HandleErr(w http.ResponseWriter, r *http.Request, origErr error, code ...int) {
+	err := E.From(origErr).Subjectf("%s %s", r.Method, r.URL)
+	logrus.WithField("module", "api").Error(err)
+	if len(code) > 0 {
+		http.Error(w, err.String(), code[0])
+		return
+	}
+	http.Error(w, err.String(), http.StatusInternalServerError)
+}
+
+func ErrMissingKey(k string) error {
+	return errors.New("missing key '" + k + "' in query or request body")
+}
+
+func ErrInvalidKey(k string) error {
+	return errors.New("invalid key '" + k + "' in query or request body")
+}
+
+func ErrNotFound(k, v string) error {
+	return fmt.Errorf("key %q with value %q not found", k, v)
+}
--- a/src/api/v1/utils/net.go
+++ b/src/api/v1/utils/net.go
@@ -0,0 +1,62 @@
+package utils
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/http"
+
+	"github.com/yusing/go-proxy/common"
+	E "github.com/yusing/go-proxy/error"
+)
+
+func IsSiteHealthy(url string) bool {
+	// try HEAD first
+	// if HEAD is not allowed, try GET
+	resp, err := HttpClient.Head(url)
+	if resp != nil {
+		resp.Body.Close()
+	}
+	if err != nil && resp != nil && resp.StatusCode == http.StatusMethodNotAllowed {
+		_, err = HttpClient.Get(url)
+	}
+	if resp != nil {
+		resp.Body.Close()
+	}
+	return err == nil
+}
+
+func IsStreamHealthy(scheme, address string) bool {
+	conn, err := net.DialTimeout(scheme, address, common.DialTimeout)
+	if err != nil {
+		return false
+	}
+	conn.Close()
+	return true
+}
+
+func ReloadServer() E.NestedError {
+	resp, err := HttpClient.Post(fmt.Sprintf("http://localhost%v/reload", common.APIHTTPAddr), "", nil)
+	if err != nil {
+		return E.From(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return E.Failure("server reload").Subjectf("status code: %v", resp.StatusCode)
+	}
+	return nil
+}
+
+var HttpClient = &http.Client{
+	Timeout: common.ConnectionTimeout,
+	Transport: &http.Transport{
+		Proxy:             http.ProxyFromEnvironment,
+		DisableKeepAlives: true,
+		ForceAttemptHTTP2: true,
+		DialContext: (&net.Dialer{
+			Timeout:   common.DialTimeout,
+			KeepAlive: common.KeepAlive, // this is different from DisableKeepAlives
+		}).DialContext,
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	},
+}
--- a/src/api/v1/utils/utils.go
+++ b/src/api/v1/utils/utils.go
@@ -0,0 +1,17 @@
+package utils
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+func RespondJson(data any, w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/json")
+	j, err := json.Marshal(data)
+	if err != nil {
+		return err
+	} else {
+		w.Write(j)
+	}
+	return nil
+}
--- a/src/autocert/config.go
+++ b/src/autocert/config.go
@@ -0,0 +1,75 @@
+package autocert
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+
+	"github.com/go-acme/lego/v4/certcrypto"
+	"github.com/go-acme/lego/v4/lego"
+	E "github.com/yusing/go-proxy/error"
+	M "github.com/yusing/go-proxy/models"
+)
+
+type Config M.AutoCertConfig
+
+func NewConfig(cfg *M.AutoCertConfig) *Config {
+	if cfg.CertPath == "" {
+		cfg.CertPath = CertFileDefault
+	}
+	if cfg.KeyPath == "" {
+		cfg.KeyPath = KeyFileDefault
+	}
+	if cfg.Provider == "" {
+		cfg.Provider = ProviderLocal
+	}
+	return (*Config)(cfg)
+}
+
+func (cfg *Config) GetProvider() (provider *Provider, res E.NestedError) {
+	b := E.NewBuilder("unable to initialize autocert")
+	defer b.To(&res)
+
+	if cfg.Provider != ProviderLocal {
+		if len(cfg.Domains) == 0 {
+			b.Addf("no domains specified")
+		}
+		if cfg.Provider == "" {
+			b.Addf("no provider specified")
+		}
+		if cfg.Email == "" {
+			b.Addf("no email specified")
+		}
+		// check if provider is implemented
+		_, ok := providersGenMap[cfg.Provider]
+		if !ok {
+			b.Addf("unknown provider: %q", cfg.Provider)
+		}
+	}
+
+	if b.HasError() {
+		return
+	}
+
+	privKey, err := E.Check(ecdsa.GenerateKey(elliptic.P256(), rand.Reader))
+	if err.HasError() {
+		b.Add(E.FailWith("generate private key", err))
+		return
+	}
+
+	user := &User{
+		Email: cfg.Email,
+		key:   privKey,
+	}
+
+	legoCfg := lego.NewConfig(user)
+	legoCfg.Certificate.KeyType = certcrypto.RSA2048
+
+	provider = &Provider{
+		cfg:     cfg,
+		user:    user,
+		legoCfg: legoCfg,
+	}
+
+	return
+}
--- a/src/autocert/constants.go
+++ b/src/autocert/constants.go
@@ -0,0 +1,40 @@
+package autocert
+
+import (
+	"errors"
+
+	"github.com/go-acme/lego/v4/providers/dns/clouddns"
+	"github.com/go-acme/lego/v4/providers/dns/cloudflare"
+	"github.com/go-acme/lego/v4/providers/dns/duckdns"
+	"github.com/go-acme/lego/v4/providers/dns/ovh"
+	"github.com/sirupsen/logrus"
+)
+
+const (
+	certBasePath     = "certs/"
+	CertFileDefault  = certBasePath + "cert.crt"
+	KeyFileDefault   = certBasePath + "priv.key"
+	RegistrationFile = certBasePath + "registration.json"
+)
+
+const (
+	ProviderLocal      = "local"
+	ProviderCloudflare = "cloudflare"
+	ProviderClouddns   = "clouddns"
+	ProviderDuckdns    = "duckdns"
+	ProviderOVH        = "ovh"
+)
+
+var providersGenMap = map[string]ProviderGenerator{
+	ProviderLocal:      providerGenerator(NewDummyDefaultConfig, NewDummyDNSProviderConfig),
+	ProviderCloudflare: providerGenerator(cloudflare.NewDefaultConfig, cloudflare.NewDNSProviderConfig),
+	ProviderClouddns:   providerGenerator(clouddns.NewDefaultConfig, clouddns.NewDNSProviderConfig),
+	ProviderDuckdns:    providerGenerator(duckdns.NewDefaultConfig, duckdns.NewDNSProviderConfig),
+	ProviderOVH:        providerGenerator(ovh.NewDefaultConfig, ovh.NewDNSProviderConfig),
+}
+
+var (
+	ErrGetCertFailure = errors.New("get certificate failed")
+)
+
+var logger = logrus.WithField("module", "autocert")
--- a/src/autocert/dummy.go
+++ b/src/autocert/dummy.go
@@ -0,0 +1,20 @@
+package autocert
+
+type DummyConfig struct{}
+type DummyProvider struct{}
+
+func NewDummyDefaultConfig() *DummyConfig {
+	return &DummyConfig{}
+}
+
+func NewDummyDNSProviderConfig(*DummyConfig) (*DummyProvider, error) {
+	return &DummyProvider{}, nil
+}
+
+func (DummyProvider) Present(domain, token, keyAuth string) error {
+	return nil
+}
+
+func (DummyProvider) CleanUp(domain, token, keyAuth string) error {
+	return nil
+}
--- a/src/autocert/provider.go
+++ b/src/autocert/provider.go
@@ -0,0 +1,279 @@
+package autocert
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"os"
+	"reflect"
+	"sort"
+	"time"
+
+	"github.com/go-acme/lego/v4/certificate"
+	"github.com/go-acme/lego/v4/challenge"
+	"github.com/go-acme/lego/v4/lego"
+	"github.com/go-acme/lego/v4/registration"
+	E "github.com/yusing/go-proxy/error"
+	M "github.com/yusing/go-proxy/models"
+	U "github.com/yusing/go-proxy/utils"
+)
+
+type Provider struct {
+	cfg     *Config
+	user    *User
+	legoCfg *lego.Config
+	client  *lego.Client
+
+	tlsCert      *tls.Certificate
+	certExpiries CertExpiries
+}
+
+type ProviderGenerator func(M.AutocertProviderOpt) (challenge.Provider, E.NestedError)
+type CertExpiries map[string]time.Time
+
+func (p *Provider) GetCert(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	if p.tlsCert == nil {
+		return nil, ErrGetCertFailure
+	}
+	return p.tlsCert, nil
+}
+
+func (p *Provider) GetName() string {
+	return p.cfg.Provider
+}
+
+func (p *Provider) GetCertPath() string {
+	return p.cfg.CertPath
+}
+
+func (p *Provider) GetKeyPath() string {
+	return p.cfg.KeyPath
+}
+
+func (p *Provider) GetExpiries() CertExpiries {
+	return p.certExpiries
+}
+
+func (p *Provider) ObtainCert() (res E.NestedError) {
+	b := E.NewBuilder("failed to obtain certificate")
+	defer b.To(&res)
+
+	if p.cfg.Provider == ProviderLocal {
+		b.Addf("provider is set to %q", ProviderLocal).WithSeverity(E.SeverityWarning)
+		return
+	}
+
+	if p.client == nil {
+		if err := p.initClient(); err.HasError() {
+			b.Add(E.FailWith("init autocert client", err))
+			return
+		}
+	}
+
+	if p.user.Registration == nil {
+		if err := p.registerACME(); err.HasError() {
+			b.Add(E.FailWith("register ACME", err))
+			return
+		}
+	}
+
+	client := p.client
+	req := certificate.ObtainRequest{
+		Domains: p.cfg.Domains,
+		Bundle:  true,
+	}
+	cert, err := E.Check(client.Certificate.Obtain(req))
+	if err.HasError() {
+		b.Add(err)
+		return
+	}
+
+	if err = p.saveCert(cert); err.HasError() {
+		b.Add(E.FailWith("save certificate", err))
+		return
+	}
+
+	tlsCert, err := E.Check(tls.X509KeyPair(cert.Certificate, cert.PrivateKey))
+	if err.HasError() {
+		b.Add(E.FailWith("parse obtained certificate", err))
+		return
+	}
+
+	expiries, err := getCertExpiries(&tlsCert)
+	if err.HasError() {
+		b.Add(E.FailWith("get certificate expiry", err))
+		return
+	}
+	p.tlsCert = &tlsCert
+	p.certExpiries = expiries
+
+	return nil
+}
+
+func (p *Provider) LoadCert() E.NestedError {
+	cert, err := E.Check(tls.LoadX509KeyPair(p.cfg.CertPath, p.cfg.KeyPath))
+	if err.HasError() {
+		return err
+	}
+	expiries, err := getCertExpiries(&cert)
+	if err.HasError() {
+		return err
+	}
+	p.tlsCert = &cert
+	p.certExpiries = expiries
+
+	logger.Infof("next renewal in %v", U.FormatDuration(time.Until(p.ShouldRenewOn())))
+	return p.renewIfNeeded()
+}
+
+func (p *Provider) ShouldRenewOn() time.Time {
+	for _, expiry := range p.certExpiries {
+		return expiry.AddDate(0, -1, 0) // 1 month before
+	}
+	// this line should never be reached
+	panic("no certificate available")
+}
+
+func (p *Provider) ScheduleRenewal(ctx context.Context) {
+	if p.GetName() == ProviderLocal {
+		return
+	}
+
+	logger.Debug("started renewal scheduler")
+	defer logger.Debug("renewal scheduler stopped")
+
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C: // check every 5 seconds
+			if err := p.renewIfNeeded(); err.HasError() {
+				logger.Warn(err)
+			}
+		}
+	}
+}
+
+func (p *Provider) initClient() E.NestedError {
+	legoClient, err := E.Check(lego.NewClient(p.legoCfg))
+	if err.HasError() {
+		return E.FailWith("create lego client", err)
+	}
+
+	legoProvider, err := providersGenMap[p.cfg.Provider](p.cfg.Options)
+	if err.HasError() {
+		return E.FailWith("create lego provider", err)
+	}
+
+	err = E.From(legoClient.Challenge.SetDNS01Provider(legoProvider))
+	if err.HasError() {
+		return E.FailWith("set challenge provider", err)
+	}
+
+	p.client = legoClient
+	return nil
+}
+
+func (p *Provider) registerACME() E.NestedError {
+	if p.user.Registration != nil {
+		return nil
+	}
+	reg, err := E.Check(p.client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true}))
+	if err.HasError() {
+		return err
+	}
+	p.user.Registration = reg
+
+	return nil
+}
+
+func (p *Provider) saveCert(cert *certificate.Resource) E.NestedError {
+	err := os.WriteFile(p.cfg.KeyPath, cert.PrivateKey, 0o600) // -rw-------
+	if err != nil {
+		return E.FailWith("write key file", err)
+	}
+	err = os.WriteFile(p.cfg.CertPath, cert.Certificate, 0o644) // -rw-r--r--
+	if err != nil {
+		return E.FailWith("write cert file", err)
+	}
+	return nil
+}
+
+func (p *Provider) certState() CertState {
+	if time.Now().After(p.ShouldRenewOn()) {
+		return CertStateExpired
+	}
+
+	certDomains := make([]string, len(p.certExpiries))
+	wantedDomains := make([]string, len(p.cfg.Domains))
+	i := 0
+	for domain := range p.certExpiries {
+		certDomains[i] = domain
+		i++
+	}
+	copy(wantedDomains, p.cfg.Domains)
+	sort.Strings(wantedDomains)
+	sort.Strings(certDomains)
+
+	if !reflect.DeepEqual(certDomains, wantedDomains) {
+		logger.Debugf("cert domains mismatch: %v != %v", certDomains, p.cfg.Domains)
+		return CertStateMismatch
+	}
+
+	return CertStateValid
+}
+
+func (p *Provider) renewIfNeeded() E.NestedError {
+	switch p.certState() {
+	case CertStateExpired:
+		logger.Info("certs expired, renewing")
+	case CertStateMismatch:
+		logger.Info("cert domains mismatch with config, renewing")
+	default:
+		return nil
+	}
+
+	if err := p.ObtainCert(); err.HasError() {
+		return E.FailWith("renew certificate", err)
+	}
+	return nil
+}
+
+func getCertExpiries(cert *tls.Certificate) (CertExpiries, E.NestedError) {
+	r := make(CertExpiries, len(cert.Certificate))
+	for _, cert := range cert.Certificate {
+		x509Cert, err := E.Check(x509.ParseCertificate(cert))
+		if err.HasError() {
+			return nil, E.FailWith("parse certificate", err)
+		}
+		if x509Cert.IsCA {
+			continue
+		}
+		r[x509Cert.Subject.CommonName] = x509Cert.NotAfter
+		for i := range x509Cert.DNSNames {
+			r[x509Cert.DNSNames[i]] = x509Cert.NotAfter
+		}
+	}
+	return r, nil
+}
+
+func providerGenerator[CT any, PT challenge.Provider](
+	defaultCfg func() *CT,
+	newProvider func(*CT) (PT, error),
+) ProviderGenerator {
+	return func(opt M.AutocertProviderOpt) (challenge.Provider, E.NestedError) {
+		cfg := defaultCfg()
+		err := U.Deserialize(opt, cfg)
+		if err.HasError() {
+			return nil, err
+		}
+		p, err := E.Check(newProvider(cfg))
+		if err.HasError() {
+			return nil, err
+		}
+		return p, nil
+	}
+}
--- a/src/autocert/provider_test/ovh_test.go
+++ b/src/autocert/provider_test/ovh_test.go
@@ -0,0 +1,50 @@
+package provider_test
+
+import (
+	"testing"
+
+	"github.com/go-acme/lego/v4/providers/dns/ovh"
+	U "github.com/yusing/go-proxy/utils"
+	. "github.com/yusing/go-proxy/utils/testing"
+	"gopkg.in/yaml.v3"
+)
+
+// type Config struct {
+// 	APIEndpoint string
+
+// 	ApplicationKey    string
+// 	ApplicationSecret string
+// 	ConsumerKey       string
+
+// 	OAuth2Config *OAuth2Config
+
+// 	PropagationTimeout time.Duration
+// 	PollingInterval    time.Duration
+// 	TTL                int
+// 	HTTPClient         *http.Client
+// }
+
+func TestOVH(t *testing.T) {
+	cfg := &ovh.Config{}
+	testYaml := `
+api_endpoint: https://eu.api.ovh.com
+application_key: <application_key>
+application_secret: <application_secret>
+consumer_key: <consumer_key>
+oauth2_config:
+  client_id: <client_id>
+  client_secret: <client_secret>
+`
+	cfgExpected := &ovh.Config{
+		APIEndpoint:       "https://eu.api.ovh.com",
+		ApplicationKey:    "<application_key>",
+		ApplicationSecret: "<application_secret>",
+		ConsumerKey:       "<consumer_key>",
+		OAuth2Config:      &ovh.OAuth2Config{ClientID: "<client_id>", ClientSecret: "<client_secret>"},
+	}
+	testYaml = testYaml[1:] // remove first \n
+	opt := make(map[string]any)
+	ExpectNoError(t, yaml.Unmarshal([]byte(testYaml), opt))
+	ExpectTrue(t, U.Deserialize(opt, cfg).NoError())
+	ExpectDeepEqual(t, cfg, cfgExpected)
+}
--- a/src/autocert/setup.go
+++ b/src/autocert/setup.go
@@ -0,0 +1,29 @@
+package autocert
+
+import (
+	"context"
+	"os"
+
+	E "github.com/yusing/go-proxy/error"
+)
+
+func (p *Provider) Setup(ctx context.Context) (err E.NestedError) {
+	if err = p.LoadCert(); err != nil {
+		if !err.Is(os.ErrNotExist) { // ignore if cert doesn't exist
+			return err
+		}
+		logger.Debug("obtaining cert due to error loading cert")
+		if err = p.ObtainCert(); err != nil {
+			return err.Warn()
+		}
+	}
+
+	go p.ScheduleRenewal(ctx)
+
+	for _, expiry := range p.GetExpiries() {
+		logger.Infof("certificate expire on %s", expiry)
+		break
+	}
+
+	return nil
+}
--- a/src/autocert/state.go
+++ b/src/autocert/state.go
@@ -0,0 +1,9 @@
+package autocert
+
+type CertState int
+
+const (
+	CertStateValid    CertState = 0
+	CertStateExpired  CertState = iota
+	CertStateMismatch CertState = iota
+)
--- a/src/autocert/user.go
+++ b/src/autocert/user.go
@@ -0,0 +1,22 @@
+package autocert
+
+import (
+	"github.com/go-acme/lego/v4/registration"
+	"crypto"
+)
+
+type User struct {
+	Email        string
+	Registration *registration.Resource
+	key          crypto.PrivateKey
+}
+
+func (u *User) GetEmail() string {
+	return u.Email
+}
+func (u *User) GetRegistration() *registration.Resource {
+	return u.Registration
+}
+func (u *User) GetPrivateKey() crypto.PrivateKey {
+	return u.key
+}
--- a/src/common/args.go
+++ b/src/common/args.go
@@ -0,0 +1,53 @@
+package common
+
+import (
+	"flag"
+
+	"github.com/sirupsen/logrus"
+	E "github.com/yusing/go-proxy/error"
+)
+
+type Args struct {
+	Command string
+}
+
+const (
+	CommandStart              = ""
+	CommandSetup              = "setup"
+	CommandValidate           = "validate"
+	CommandListConfigs        = "ls-config"
+	CommandListRoutes         = "ls-routes"
+	CommandReload             = "reload"
+	CommandDebugListEntries   = "debug-ls-entries"
+	CommandDebugListProviders = "debug-ls-providers"
+)
+
+var ValidCommands = []string{
+	CommandStart,
+	CommandSetup,
+	CommandValidate,
+	CommandListConfigs,
+	CommandListRoutes,
+	CommandReload,
+	CommandDebugListEntries,
+	CommandDebugListProviders,
+}
+
+func GetArgs() Args {
+	var args Args
+	flag.Parse()
+	args.Command = flag.Arg(0)
+	if err := validateArg(args.Command); err.HasError() {
+		logrus.Fatal(err)
+	}
+	return args
+}
+
+func validateArg(arg string) E.NestedError {
+	for _, v := range ValidCommands {
+		if arg == v {
+			return nil
+		}
+	}
+	return E.Invalid("argument", arg)
+}
--- a/src/common/constants.go
+++ b/src/common/constants.go
@@ -0,0 +1,40 @@
+package common
+
+import (
+	"time"
+)
+
+const (
+	ConnectionTimeout = 5 * time.Second
+	DialTimeout       = 3 * time.Second
+	KeepAlive         = 5 * time.Second
+)
+
+// file, folder structure
+
+const (
+	ConfigBasePath        = "config"
+	ConfigFileName        = "config.yml"
+	ConfigExampleFileName = "config.example.yml"
+	ConfigPath            = ConfigBasePath + "/" + ConfigFileName
+)
+
+const (
+	SchemaBasePath         = "schema"
+	ConfigSchemaPath       = SchemaBasePath + "/config.schema.json"
+	FileProviderSchemaPath = SchemaBasePath + "/providers.schema.json"
+)
+
+const (
+	ComposeFileName        = "compose.yml"
+	ComposeExampleFileName = "compose.example.yml"
+)
+
+const DockerHostFromEnv = "$DOCKER_HOST"
+
+const (
+	IdleTimeoutDefault = "0"
+	WakeTimeoutDefault = "10s"
+	StopTimeoutDefault = "10s"
+	StopMethodDefault  = "stop"
+)
--- a/src/common/env.go
+++ b/src/common/env.go
@@ -0,0 +1,27 @@
+package common
+
+import (
+	"os"
+
+	U "github.com/yusing/go-proxy/utils"
+)
+
+var (
+	NoSchemaValidation = GetEnvBool("GOPROXY_NO_SCHEMA_VALIDATION")
+	IsDebug            = GetEnvBool("GOPROXY_DEBUG")
+	ProxyHTTPAddr      = GetEnv("GOPROXY_HTTP_ADDR", ":80")
+	ProxyHTTPSAddr     = GetEnv("GOPROXY_HTTPS_ADDR", ":443")
+	APIHTTPAddr        = GetEnv("GOPROXY_API_ADDR", "127.0.0.1:8888")
+)
+
+func GetEnvBool(key string) bool {
+	return U.ParseBool(os.Getenv(key))
+}
+
+func GetEnv(key string, defaultValue string) string {
+	value, ok := os.LookupEnv(key)
+	if !ok {
+		value = defaultValue
+	}
+	return value
+}
--- a/src/common/ports.go
+++ b/src/common/ports.go
@@ -0,0 +1,74 @@
+package common
+
+var (
+	WellKnownHTTPPorts = map[string]bool{
+		"80":   true,
+		"8000": true,
+		"8008": true,
+		"8080": true,
+		"3000": true,
+	}
+
+	ServiceNamePortMapTCP = map[string]int{
+		"mssql":     1433,
+		"mysql":     3306,
+		"mariadb":   3306,
+		"postgres":  5432,
+		"rabbitmq":  5672,
+		"redis":     6379,
+		"memcached": 11211,
+		"mongo":     27017,
+
+		"ssh":  22,
+		"ftp":  21,
+		"smtp": 25,
+		"dns":  53,
+		"pop3": 110,
+		"imap": 143,
+	}
+
+	ImageNamePortMap = func() (m map[string]int) {
+		m = make(map[string]int, len(ServiceNamePortMapTCP)+len(imageNamePortMap))
+		for k, v := range ServiceNamePortMapTCP {
+			m[k] = v
+		}
+		for k, v := range imageNamePortMap {
+			m[k] = v
+		}
+		return
+	}()
+
+	imageNamePortMap = map[string]int{
+		"adguardhome":         3000,
+		"bazarr":              6767,
+		"calibre-web":         8083,
+		"changedetection.io":  3000,
+		"dockge":              5001,
+		"gitea":               3000,
+		"gogs":                3000,
+		"grafana":             3000,
+		"home-assistant":      8123,
+		"homebridge":          8581,
+		"httpd":               80,
+		"immich":              3001,
+		"jellyfin":            8096,
+		"lidarr":              8686,
+		"minecraft-server":    25565,
+		"nginx":               80,
+		"nginx-proxy-manager": 81,
+		"open-webui":          8080,
+		"plex":                32400,
+		"portainer":           9000,
+		"portainer-ce":        9000,
+		"prometheus":          9090,
+		"prowlarr":            9696,
+		"radarr":              7878,
+		"radarr-sma":          7878,
+		"rsshub":              1200,
+		"rss-bridge":          80,
+		"sonarr":              8989,
+		"sonarr-sma":          8989,
+		"uptime-kuma":         3001,
+		"whisparr":            6969,
+	}
+)
--- a/src/config/config.go
+++ b/src/config/config.go
@@ -0,0 +1,213 @@
+package config
+
+import (
+	"context"
+	"os"
+
+	"github.com/sirupsen/logrus"
+	"github.com/yusing/go-proxy/autocert"
+	"github.com/yusing/go-proxy/common"
+	E "github.com/yusing/go-proxy/error"
+	M "github.com/yusing/go-proxy/models"
+	PR "github.com/yusing/go-proxy/proxy/provider"
+	R "github.com/yusing/go-proxy/route"
+	U "github.com/yusing/go-proxy/utils"
+	F "github.com/yusing/go-proxy/utils/functional"
+	W "github.com/yusing/go-proxy/watcher"
+	"github.com/yusing/go-proxy/watcher/events"
+	"gopkg.in/yaml.v3"
+)
+
+type Config struct {
+	value            *M.Config
+	proxyProviders   F.Map[string, *PR.Provider]
+	autocertProvider *autocert.Provider
+
+	l logrus.FieldLogger
+
+	watcher       W.Watcher
+	watcherCtx    context.Context
+	watcherCancel context.CancelFunc
+	reloadReq     chan struct{}
+}
+
+func Load() (*Config, E.NestedError) {
+	cfg := &Config{
+		proxyProviders: F.NewMapOf[string, *PR.Provider](),
+		l:              logrus.WithField("module", "config"),
+		watcher:        W.NewFileWatcher(common.ConfigFileName),
+		reloadReq:      make(chan struct{}, 1),
+	}
+	return cfg, cfg.load()
+}
+
+func Validate(data []byte) E.NestedError {
+	return U.ValidateYaml(U.GetSchema(common.ConfigSchemaPath), data)
+}
+
+func (cfg *Config) Value() M.Config {
+	return *cfg.value
+}
+
+func (cfg *Config) GetAutoCertProvider() *autocert.Provider {
+	return cfg.autocertProvider
+}
+
+func (cfg *Config) Dispose() {
+	if cfg.watcherCancel != nil {
+		cfg.watcherCancel()
+		cfg.l.Debug("stopped watcher")
+	}
+	cfg.stopProviders()
+}
+
+func (cfg *Config) Reload() E.NestedError {
+	cfg.stopProviders()
+	if err := cfg.load(); err.HasError() {
+		return err
+	}
+	cfg.StartProxyProviders()
+	return nil
+}
+
+func (cfg *Config) StartProxyProviders() {
+	cfg.controlProviders("start", (*PR.Provider).StartAllRoutes)
+}
+
+func (cfg *Config) WatchChanges() {
+	cfg.watcherCtx, cfg.watcherCancel = context.WithCancel(context.Background())
+	go func() {
+		for {
+			select {
+			case <-cfg.watcherCtx.Done():
+				return
+			case <-cfg.reloadReq:
+				if err := cfg.Reload(); err.HasError() {
+					cfg.l.Error(err)
+				}
+			}
+		}
+	}()
+	go func() {
+		eventCh, errCh := cfg.watcher.Events(cfg.watcherCtx)
+		for {
+			select {
+			case <-cfg.watcherCtx.Done():
+				return
+			case event := <-eventCh:
+				if event.Action == events.ActionFileDeleted {
+					cfg.stopProviders()
+				} else {
+					cfg.reloadReq <- struct{}{}
+				}
+			case err := <-errCh:
+				cfg.l.Error(err)
+				continue
+			}
+		}
+	}()
+}
+
+func (cfg *Config) forEachRoute(do func(alias string, r R.Route, p *PR.Provider)) {
+	cfg.proxyProviders.RangeAll(func(_ string, p *PR.Provider) {
+		p.RangeRoutes(func(a string, r R.Route) {
+			do(a, r, p)
+		})
+	})
+}
+
+func (cfg *Config) load() (res E.NestedError) {
+	b := E.NewBuilder("errors loading config")
+	defer b.To(&res)
+
+	cfg.l.Debug("loading config")
+	defer cfg.l.Debug("loaded config")
+
+	data, err := E.Check(os.ReadFile(common.ConfigPath))
+	if err.HasError() {
+		b.Add(E.FailWith("read config", err))
+		return
+	}
+
+	if !common.NoSchemaValidation {
+		if err = Validate(data); err.HasError() {
+			b.Add(E.FailWith("schema validation", err))
+			return
+		}
+	}
+
+	model := M.DefaultConfig()
+	if err := E.From(yaml.Unmarshal(data, model)); err.HasError() {
+		b.Add(E.FailWith("parse config", err))
+		return
+	}
+
+	// errors are non fatal below
+	b.WithSeverity(E.SeverityWarning)
+	b.Add(cfg.initAutoCert(&model.AutoCert))
+	b.Add(cfg.loadProviders(&model.Providers))
+
+	cfg.value = model
+	return
+}
+
+func (cfg *Config) initAutoCert(autocertCfg *M.AutoCertConfig) (err E.NestedError) {
+	if cfg.autocertProvider != nil {
+		return
+	}
+
+	cfg.l.Debug("initializing autocert")
+	defer cfg.l.Debug("initialized autocert")
+
+	cfg.autocertProvider, err = autocert.NewConfig(autocertCfg).GetProvider()
+	if err.HasError() {
+		err = E.FailWith("autocert provider", err)
+	}
+	return
+}
+
+func (cfg *Config) loadProviders(providers *M.ProxyProviders) (res E.NestedError) {
+	cfg.l.Debug("loading providers")
+	defer cfg.l.Debug("loaded providers")
+
+	b := E.NewBuilder("errors loading providers")
+	defer b.To(&res)
+
+	for _, filename := range providers.Files {
+		p, err := PR.NewFileProvider(filename)
+		if err != nil {
+			b.Add(err.Subject(filename))
+			continue
+		}
+		cfg.proxyProviders.Store(p.GetName(), p)
+		b.Add(p.LoadRoutes().Subject(filename))
+	}
+	for name, dockerHost := range providers.Docker {
+		p, err := PR.NewDockerProvider(name, dockerHost)
+		if err != nil {
+			b.Add(err.Subjectf("%s (%s)", name, dockerHost))
+			continue
+		}
+		cfg.proxyProviders.Store(p.GetName(), p)
+		b.Add(p.LoadRoutes().Subject(dockerHost))
+	}
+	return
+}
+
+func (cfg *Config) controlProviders(action string, do func(*PR.Provider) E.NestedError) {
+	errors := E.NewBuilder("errors in %s these providers", action)
+
+	cfg.proxyProviders.RangeAll(func(name string, p *PR.Provider) {
+		if err := do(p); err.HasError() {
+			errors.Add(err.Subject(p))
+		}
+	})
+
+	if err := errors.Build(); err.HasError() {
+		cfg.l.Error(err)
+	}
+}
+
+func (cfg *Config) stopProviders() {
+	cfg.controlProviders("stop routes", (*PR.Provider).StopAllRoutes)
+}
--- a/src/config/query.go
+++ b/src/config/query.go
@@ -0,0 +1,82 @@
+package config
+
+import (
+	M "github.com/yusing/go-proxy/models"
+	PR "github.com/yusing/go-proxy/proxy/provider"
+	R "github.com/yusing/go-proxy/route"
+	U "github.com/yusing/go-proxy/utils"
+	F "github.com/yusing/go-proxy/utils/functional"
+)
+
+func (cfg *Config) DumpEntries() map[string]*M.RawEntry {
+	entries := make(map[string]*M.RawEntry)
+	cfg.forEachRoute(func(alias string, r R.Route, p *PR.Provider) {
+		entries[alias] = r.Entry()
+	})
+	return entries
+}
+
+func (cfg *Config) DumpProviders() map[string]*PR.Provider {
+	entries := make(map[string]*PR.Provider)
+	cfg.proxyProviders.RangeAll(func(name string, p *PR.Provider) {
+		entries[name] = p
+	})
+	return entries
+}
+
+func (cfg *Config) RoutesByAlias() map[string]U.SerializedObject {
+	routes := make(map[string]U.SerializedObject)
+	cfg.forEachRoute(func(alias string, r R.Route, p *PR.Provider) {
+		obj, err := U.Serialize(r)
+		if err.HasError() {
+			cfg.l.Error(err)
+			return
+		}
+		obj["provider"] = p.GetName()
+		obj["type"] = string(r.Type())
+		routes[alias] = obj
+	})
+	return routes
+}
+
+func (cfg *Config) Statistics() map[string]any {
+	nTotalStreams := 0
+	nTotalRPs := 0
+	providerStats := make(map[string]any)
+
+	cfg.forEachRoute(func(alias string, r R.Route, p *PR.Provider) {
+		s, ok := providerStats[p.GetName()]
+		if !ok {
+			s = make(map[string]int)
+		}
+
+		stats := s.(map[string]int)
+		switch r.Type() {
+		case R.RouteTypeStream:
+			stats["num_streams"]++
+			nTotalStreams++
+		case R.RouteTypeReverseProxy:
+			stats["num_reverse_proxies"]++
+			nTotalRPs++
+		default:
+			panic("bug: should not reach here")
+		}
+	})
+
+	return map[string]any{
+		"num_total_streams":         nTotalStreams,
+		"num_total_reverse_proxies": nTotalRPs,
+		"providers":                 providerStats,
+	}
+}
+
+func (cfg *Config) FindRoute(alias string) R.Route {
+	return F.MapFind(cfg.proxyProviders,
+		func(p *PR.Provider) (R.Route, bool) {
+			if route, ok := p.GetRoute(alias); ok {
+				return route, true
+			}
+			return nil, false
+		},
+	)
+}
--- a/src/docker/client.go
+++ b/src/docker/client.go
@@ -0,0 +1,153 @@
+package docker
+
+import (
+	"net/http"
+	"sync"
+	"sync/atomic"
+
+	"github.com/docker/cli/cli/connhelper"
+	"github.com/docker/docker/client"
+	"github.com/sirupsen/logrus"
+	"github.com/yusing/go-proxy/common"
+	E "github.com/yusing/go-proxy/error"
+	F "github.com/yusing/go-proxy/utils/functional"
+)
+
+type Client struct {
+	key      string
+	refCount *atomic.Int32
+	*client.Client
+
+	l logrus.FieldLogger
+}
+
+func ParseDockerHostname(host string) (string, E.NestedError) {
+	switch host {
+	case common.DockerHostFromEnv, "":
+		return "localhost", nil
+	}
+	url, err := E.Check(client.ParseHostURL(host))
+	if err != nil {
+		return "", E.Invalid("host", host).With(err)
+	}
+	return url.Hostname(), nil
+}
+
+func (c Client) DaemonHostname() string {
+	// DaemonHost should always return a valid host
+	hostname, _ := ParseDockerHostname(c.DaemonHost())
+	return hostname
+}
+
+func (c Client) Connected() bool {
+	return c.Client != nil
+}
+
+// if the client is still referenced, this is no-op
+func (c *Client) Close() error {
+	if c.refCount.Add(-1) > 0 {
+		return nil
+	}
+
+	clientMap.Delete(c.key)
+
+	client := c.Client
+	c.Client = nil
+
+	c.l.Debugf("client closed")
+
+	if client != nil {
+		return client.Close()
+	}
+	return nil
+}
+
+// ConnectClient creates a new Docker client connection to the specified host.
+//
+// Returns existing client if available.
+//
+// Parameters:
+//   - host: the host to connect to (either a URL or common.DockerHostFromEnv).
+//
+// Returns:
+//   - Client: the Docker client connection.
+//   - error: an error if the connection failed.
+func ConnectClient(host string) (Client, E.NestedError) {
+	clientMapMu.Lock()
+	defer clientMapMu.Unlock()
+
+	// check if client exists
+	if client, ok := clientMap.Load(host); ok {
+		client.refCount.Add(1)
+		return client, nil
+	}
+
+	// create client
+	var opt []client.Opt
+
+	switch host {
+	case common.DockerHostFromEnv:
+		opt = clientOptEnvHost
+	default:
+		helper, err := E.Check(connhelper.GetConnectionHelper(host))
+		if err.HasError() {
+			return Client{}, E.UnexpectedError(err.Error())
+		}
+		if helper != nil {
+			httpClient := &http.Client{
+				Transport: &http.Transport{
+					DialContext: helper.Dialer,
+				},
+			}
+			opt = []client.Opt{
+				client.WithHTTPClient(httpClient),
+				client.WithHost(helper.Host),
+				client.WithAPIVersionNegotiation(),
+				client.WithDialContext(helper.Dialer),
+			}
+		} else {
+			opt = []client.Opt{
+				client.WithHost(host),
+				client.WithAPIVersionNegotiation(),
+			}
+		}
+	}
+
+	client, err := E.Check(client.NewClientWithOpts(opt...))
+
+	if err.HasError() {
+		return Client{}, err
+	}
+
+	c := Client{
+		Client:   client,
+		key:      host,
+		refCount: &atomic.Int32{},
+		l:        logger.WithField("docker_client", client.DaemonHost()),
+	}
+	c.refCount.Add(1)
+	c.l.Debugf("client connected")
+
+	clientMap.Store(host, c)
+	return c, nil
+}
+
+func CloseAllClients() {
+	clientMap.RangeAll(func(_ string, c Client) {
+		c.Client.Close()
+	})
+	clientMap.Clear()
+	logger.Debug("closed all clients")
+}
+
+var (
+	clientMap   F.Map[string, Client] = F.NewMapOf[string, Client]()
+	clientMapMu sync.Mutex
+
+	clientOptEnvHost = []client.Opt{
+		client.WithHostFromEnv(),
+		client.WithAPIVersionNegotiation(),
+	}
+
+	logger = logrus.WithField("module", "docker")
+)
--- a/src/docker/client_info.go
+++ b/src/docker/client_info.go
@@ -0,0 +1,54 @@
+package docker
+
+import (
+	"context"
+	"time"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/client"
+
+	E "github.com/yusing/go-proxy/error"
+)
+
+type ClientInfo struct {
+	Client     Client
+	Containers []types.Container
+}
+
+var listOptions = container.ListOptions{
+	// Filters: filters.NewArgs(
+	// 	filters.Arg("health", "healthy"),
+	// 	filters.Arg("health", "none"),
+	// 	filters.Arg("health", "starting"),
+	// ),
+	All: true,
+}
+
+func GetClientInfo(clientHost string, getContainer bool) (*ClientInfo, E.NestedError) {
+	dockerClient, err := ConnectClient(clientHost)
+	if err.HasError() {
+		return nil, E.FailWith("connect to docker", err)
+	}
+	defer dockerClient.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	var containers []types.Container
+	if getContainer {
+		containers, err = E.Check(dockerClient.ContainerList(ctx, listOptions))
+		if err.HasError() {
+			return nil, E.FailWith("list containers", err)
+		}
+	}
+
+	return &ClientInfo{
+		Client:     dockerClient,
+		Containers: containers,
+	}, nil
+}
+
+func IsErrConnectionFailed(err error) bool {
+	return client.IsErrConnectionFailed(err)
+}
--- a/src/docker/container.go
+++ b/src/docker/container.go
@@ -0,0 +1,128 @@
+package docker
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/docker/docker/api/types"
+	U "github.com/yusing/go-proxy/utils"
+)
+
+type ProxyProperties struct {
+	DockerHost         string      `yaml:"-" json:"docker_host"`
+	ContainerName      string      `yaml:"-" json:"container_name"`
+	ImageName          string      `yaml:"-" json:"image_name"`
+	PublicPortMapping  PortMapping `yaml:"-" json:"public_port_mapping"`  // non-zero publicPort:types.Port
+	PrivatePortMapping PortMapping `yaml:"-" json:"private_port_mapping"` // privatePort:types.Port
+	NetworkMode        string      `yaml:"-" json:"network_mode"`
+
+	Aliases     []string `yaml:"-" json:"aliases"`
+	IsExcluded  bool     `yaml:"-" json:"is_excluded"`
+	IdleTimeout string   `yaml:"-" json:"idle_timeout"`
+	WakeTimeout string   `yaml:"-" json:"wake_timeout"`
+	StopMethod  string   `yaml:"-" json:"stop_method"`
+	StopTimeout string   `yaml:"-" json:"stop_timeout"` // stop_method = "stop" only
+	StopSignal  string   `yaml:"-" json:"stop_signal"`  // stop_method = "stop" | "kill" only
+	Running     bool     `yaml:"-" json:"running"`
+}
+
+type Container struct {
+	*types.Container
+	*ProxyProperties
+}
+
+type PortMapping = map[string]types.Port
+
+func FromDocker(c *types.Container, dockerHost string) (res Container) {
+	res.Container = c
+	res.ProxyProperties = &ProxyProperties{
+		DockerHost:         dockerHost,
+		ContainerName:      res.getName(),
+		ImageName:          res.getImageName(),
+		PublicPortMapping:  res.getPublicPortMapping(),
+		PrivatePortMapping: res.getPrivatePortMapping(),
+		NetworkMode:        c.HostConfig.NetworkMode,
+		Aliases:            res.getAliases(),
+		IsExcluded:         U.ParseBool(res.getDeleteLabel(LabelExclude)),
+		IdleTimeout:        res.getDeleteLabel(LabelIdleTimeout),
+		WakeTimeout:        res.getDeleteLabel(LabelWakeTimeout),
+		StopMethod:         res.getDeleteLabel(LabelStopMethod),
+		StopTimeout:        res.getDeleteLabel(LabelStopTimeout),
+		StopSignal:         res.getDeleteLabel(LabelStopSignal),
+		Running:            c.Status == "running" || c.State == "running",
+	}
+	return
+}
+
+func FromJson(json types.ContainerJSON, dockerHost string) Container {
+	ports := make([]types.Port, 0)
+	for k, bindings := range json.NetworkSettings.Ports {
+		for _, v := range bindings {
+			pubPort, _ := strconv.Atoi(v.HostPort)
+			privPort, _ := strconv.Atoi(k.Port())
+			ports = append(ports, types.Port{
+				IP:          v.HostIP,
+				PublicPort:  uint16(pubPort),
+				PrivatePort: uint16(privPort),
+			})
+		}
+	}
+	return FromDocker(&types.Container{
+		ID:     json.ID,
+		Names:  []string{json.Name},
+		Image:  json.Image,
+		Ports:  ports,
+		Labels: json.Config.Labels,
+		State:  json.State.Status,
+		Status: json.State.Status,
+	}, dockerHost)
+}
+
+func (c Container) getDeleteLabel(label string) string {
+	if l, ok := c.Labels[label]; ok {
+		delete(c.Labels, label)
+		return l
+	}
+	return ""
+}
+
+func (c Container) getAliases() []string {
+	if l := c.getDeleteLabel(LabelAliases); l != "" {
+		return U.CommaSeperatedList(l)
+	} else {
+		return []string{c.getName()}
+	}
+}
+
+func (c Container) getName() string {
+	return strings.TrimPrefix(c.Names[0], "/")
+}
+
+func (c Container) getImageName() string {
+	colonSep := strings.Split(c.Image, ":")
+	slashSep := strings.Split(colonSep[0], "/")
+	return slashSep[len(slashSep)-1]
+}
+
+func (c Container) getPublicPortMapping() PortMapping {
+	res := make(PortMapping)
+	for _, v := range c.Ports {
+		if v.PublicPort == 0 {
+			continue
+		}
+		res[fmt.Sprint(v.PublicPort)] = v
+	}
+	return res
+}
+
+func (c Container) getPrivatePortMapping() PortMapping {
+	res := make(PortMapping)
+	for _, v := range c.Ports {
+		if v.PublicPort == 0 {
+			continue
+		}
+		res[fmt.Sprint(v.PrivatePort)] = v
+	}
+	return res
+}
--- a/src/docker/homepage_label.go
+++ b/src/docker/homepage_label.go
@@ -0,0 +1,32 @@
+package docker
+
+type (
+	HomePageConfig   struct{ m map[string]HomePageCategory }
+	HomePageCategory []HomePageItem
+
+	HomePageItem struct {
+		Name         string
+		Icon         string
+		Category     string
+		Description  string
+		WidgetConfig map[string]any
+	}
+)
+
+func NewHomePageConfig() *HomePageConfig {
+	return &HomePageConfig{m: make(map[string]HomePageCategory)}
+}
+
+func NewHomePageItem() *HomePageItem {
+	return &HomePageItem{}
+}
+
+func (c *HomePageConfig) Clear() {
+	c.m = make(map[string]HomePageCategory)
+}
+
+func (c *HomePageConfig) Add(item HomePageItem) {
+	c.m[item.Category] = HomePageCategory{item}
+}
+
+const NSHomePage = "homepage"
--- a/src/docker/idlewatcher/html/loading_page.html
+++ b/src/docker/idlewatcher/html/loading_page.html
@@ -0,0 +1,87 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>{{.Title}}</title>
+        <style>
+            /* Global Styles */
+            * {
+                box-sizing: border-box;
+                margin: 0;
+                padding: 0;
+            }
+            body {
+                font-family: Inter, Arial, sans-serif;
+                font-size: 16px;
+                line-height: 1.5;
+                color: #fff;
+                background-color: #212121;
+                display: flex;
+                justify-content: center;
+                align-items: center;
+                height: 100vh;
+                margin: 0;
+            }
+
+            /* Spinner Styles */
+            .spinner {
+                width: 120px;
+                height: 120px;
+                border: 16px solid #333;
+                border-radius: 50%;
+                border-top: 16px solid #66d9ef;
+                animation: spin 2s linear infinite;
+            }
+            @keyframes spin {
+                0% {
+                    transform: rotate(0deg);
+                }
+                100% {
+                    transform: rotate(360deg);
+                }
+            }
+
+            /* Error Styles */
+            .error {
+                display: inline-block;
+                text-align: center;
+                justify-content: center;
+            }
+            .error::before {
+                content: "\26A0"; /* Unicode for warning symbol */
+                font-size: 40px;
+                color: #ff9900;
+            }
+
+            /* Message Styles */
+            .message {
+                font-size: 24px;
+                font-weight: bold;
+                padding-left: 32px;
+                text-align: center;
+            }
+        </style>
+    </head>
+    <body>
+        <script>
+            window.onload = async function () {
+                let result = await fetch(window.location.href, {
+                    headers: {
+                        {{ range $key, $value := .RequestHeaders }}
+                        '{{ $key }}' : {{ $value }}
+                        {{ end }}
+                    },
+                }).then((resp) => resp.text())
+                    .catch((err) => {
+                        document.getElementById("message").innerText = err;
+                    });
+                if (result) {
+                    document.documentElement.innerHTML = result
+                }
+            };
+        </script>
+        <div class="{{.SpinnerClass}}"></div>
+        <div class="message">{{.Message}}</div>
+    </body>
+</html>
--- a/src/docker/idlewatcher/http.go
+++ b/src/docker/idlewatcher/http.go
@@ -0,0 +1,93 @@
+package idlewatcher
+
+import (
+	"bytes"
+	_ "embed"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"text/template"
+)
+
+type templateData struct {
+	Title          string
+	Message        string
+	RequestHeaders http.Header
+	SpinnerClass   string
+}
+
+//go:embed html/loading_page.html
+var loadingPage []byte
+var loadingPageTmpl = func() *template.Template {
+	tmpl, err := template.New("loading").Parse(string(loadingPage))
+	if err != nil {
+		panic(err)
+	}
+	return tmpl
+}()
+
+const (
+	htmlContentType = "text/html; charset=utf-8"
+
+	errPrefix = "\u1000"
+
+	headerGoProxyTargetURL = "X-GoProxy-Target"
+	headerContentType      = "Content-Type"
+
+	spinnerClassSpinner   = "spinner"
+	spinnerClassErrorSign = "error"
+)
+
+func (w *watcher) makeSuccResp(redirectURL string, resp *http.Response) (*http.Response, error) {
+	h := make(http.Header)
+	h.Set("Location", redirectURL)
+	h.Set("Content-Length", "0")
+	h.Set(headerContentType, htmlContentType)
+	return &http.Response{
+		StatusCode: http.StatusTemporaryRedirect,
+		Header:     h,
+		Body:       http.NoBody,
+		TLS:        resp.TLS,
+	}, nil
+}
+
+func (w *watcher) makeErrResp(errFmt string, args ...any) (*http.Response, error) {
+	return w.makeResp(errPrefix+errFmt, args...)
+}
+
+func (w *watcher) makeResp(format string, args ...any) (*http.Response, error) {
+	msg := fmt.Sprintf(format, args...)
+
+	data := new(templateData)
+	data.Title = w.ContainerName
+	data.Message = strings.ReplaceAll(msg, "\n", "<br>")
+	data.Message = strings.ReplaceAll(data.Message, " ", "&ensp;")
+	data.RequestHeaders = make(http.Header)
+	data.RequestHeaders.Add(headerGoProxyTargetURL, "window.location.href")
+	if strings.HasPrefix(data.Message, errPrefix) {
+		data.Message = strings.TrimLeft(data.Message, errPrefix)
+		data.SpinnerClass = spinnerClassErrorSign
+	} else {
+		data.SpinnerClass = spinnerClassSpinner
+	}
+
+	buf := bytes.NewBuffer(make([]byte, 128)) // more than enough
+	err := loadingPageTmpl.Execute(buf, data)
+	if err != nil { // should never happen
+		panic(err)
+	}
+	return &http.Response{
+		StatusCode: http.StatusAccepted,
+		Header: http.Header{
+			headerContentType: {htmlContentType},
+			"Cache-Control": {
+				"no-cache",
+				"no-store",
+				"must-revalidate",
+			},
+		},
+		Body:          io.NopCloser(buf),
+		ContentLength: int64(buf.Len()),
+	}, nil
+}
--- a/src/docker/idlewatcher/round_trip.go
+++ b/src/docker/idlewatcher/round_trip.go
@@ -0,0 +1,78 @@
+package idlewatcher
+
+import (
+	"context"
+	"net/http"
+	"time"
+)
+
+type (
+	roundTripper struct {
+		patched roundTripFunc
+	}
+	roundTripFunc func(*http.Request) (*http.Response, error)
+)
+
+func (rt roundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return rt.patched(req)
+}
+
+func (w *watcher) roundTrip(origRoundTrip roundTripFunc, req *http.Request) (*http.Response, error) {
+	// target site is ready, passthrough
+	if w.ready.Load() {
+		return origRoundTrip(req)
+	}
+
+	// wake the container
+	w.wakeCh <- struct{}{}
+
+	// initial request
+	targetUrl := req.Header.Get(headerGoProxyTargetURL)
+	if targetUrl == "" {
+		return w.makeResp(
+			"%s is starting... Please wait",
+			w.ContainerName,
+		)
+	}
+
+	w.l.Debug("serving event")
+
+	// stream request
+	rtDone := make(chan *http.Response, 1)
+	ctx, cancel := context.WithTimeout(req.Context(), w.WakeTimeout)
+	defer cancel()
+
+	// loop original round trip until success in a goroutine
+	go func() {
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-w.ctx.Done():
+				return
+			default:
+				resp, err := origRoundTrip(req)
+				if err == nil {
+					w.ready.Store(true)
+					rtDone <- resp
+					return
+				}
+				time.Sleep(time.Millisecond * 200)
+			}
+		}
+	}()
+
+	for {
+		select {
+		case resp := <-rtDone:
+			return w.makeSuccResp(targetUrl, resp)
+		case <-ctx.Done():
+			if ctx.Err() == context.DeadlineExceeded {
+				return w.makeErrResp("Timed out waiting for %s to fully wake", w.ContainerName)
+			}
+			return w.makeErrResp("idlewatcher has stopped\n%s", w.ctx.Err().Error())
+		case <-w.ctx.Done():
+			return w.makeErrResp("idlewatcher has stopped\n%s", w.ctx.Err().Error())
+		}
+	}
+}
--- a/src/docker/idlewatcher/watcher.go
+++ b/src/docker/idlewatcher/watcher.go
@@ -0,0 +1,276 @@
+package idlewatcher
+
+import (
+	"context"
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/sirupsen/logrus"
+	D "github.com/yusing/go-proxy/docker"
+	E "github.com/yusing/go-proxy/error"
+	P "github.com/yusing/go-proxy/proxy"
+	PT "github.com/yusing/go-proxy/proxy/fields"
+	W "github.com/yusing/go-proxy/watcher"
+)
+
+type (
+	watcher struct {
+		*P.ReverseProxyEntry
+
+		client D.Client
+
+		ready        atomic.Bool  // whether the site is ready to accept connection
+		stopByMethod StopCallback // send a docker command w.r.t. `stop_method`
+
+		wakeCh   chan struct{}
+		wakeDone chan E.NestedError
+
+		ctx      context.Context
+		cancel   context.CancelFunc
+		refCount *sync.WaitGroup
+
+		l logrus.FieldLogger
+	}
+
+	WakeDone     <-chan error
+	WakeFunc     func() WakeDone
+	StopCallback func() E.NestedError
+)
+
+var (
+	mainLoopCtx    context.Context
+	mainLoopCancel context.CancelFunc
+	mainLoopWg     sync.WaitGroup
+
+	watcherMap   = make(map[string]*watcher)
+	watcherMapMu sync.Mutex
+
+	newWatcherCh = make(chan *watcher)
+
+	logger = logrus.WithField("module", "idle_watcher")
+)
+
+func Register(entry *P.ReverseProxyEntry) (*watcher, E.NestedError) {
+	failure := E.Failure("idle_watcher register")
+
+	if entry.IdleTimeout == 0 {
+		return nil, failure.With(E.Invalid("idle_timeout", 0))
+	}
+
+	watcherMapMu.Lock()
+	defer watcherMapMu.Unlock()
+
+	if w, ok := watcherMap[entry.ContainerName]; ok {
+		w.refCount.Add(1)
+		w.ReverseProxyEntry = entry
+		return w, nil
+	}
+
+	client, err := D.ConnectClient(entry.DockerHost)
+	if err.HasError() {
+		return nil, failure.With(err)
+	}
+
+	w := &watcher{
+		ReverseProxyEntry: entry,
+		client:            client,
+		refCount:          &sync.WaitGroup{},
+		wakeCh:            make(chan struct{}, 1),
+		wakeDone:          make(chan E.NestedError, 1),
+		l:                 logger.WithField("container", entry.ContainerName),
+	}
+	w.refCount.Add(1)
+	w.stopByMethod = w.getStopCallback()
+
+	watcherMap[w.ContainerName] = w
+
+	go func() {
+		newWatcherCh <- w
+	}()
+
+	return w, nil
+}
+
+func Unregister(containerName string) {
+	if w, ok := watcherMap[containerName]; ok {
+		w.refCount.Add(-1)
+	}
+}
+
+func Start() {
+	logger.Debug("started")
+	defer logger.Debug("stopped")
+
+	mainLoopCtx, mainLoopCancel = context.WithCancel(context.Background())
+
+	for {
+		select {
+		case <-mainLoopCtx.Done():
+			return
+		case w := <-newWatcherCh:
+			w.l.Debug("registered")
+			mainLoopWg.Add(1)
+			go func() {
+				w.watchUntilCancel()
+				w.refCount.Wait() // wait for 0 ref count
+
+				w.client.Close()
+				delete(watcherMap, w.ContainerName)
+				w.l.Debug("unregistered")
+				mainLoopWg.Done()
+			}()
+		}
+	}
+}
+
+func Stop() {
+	mainLoopCancel()
+	mainLoopWg.Wait()
+}
+
+func (w *watcher) PatchRoundTripper(rtp http.RoundTripper) roundTripper {
+	return roundTripper{patched: func(r *http.Request) (*http.Response, error) {
+		return w.roundTrip(rtp.RoundTrip, r)
+	}}
+}
+
+func (w *watcher) containerStop() error {
+	return w.client.ContainerStop(w.ctx, w.ContainerName, container.StopOptions{
+		Signal:  string(w.StopSignal),
+		Timeout: &w.StopTimeout})
+}
+
+func (w *watcher) containerPause() error {
+	return w.client.ContainerPause(w.ctx, w.ContainerName)
+}
+
+func (w *watcher) containerKill() error {
+	return w.client.ContainerKill(w.ctx, w.ContainerName, string(w.StopSignal))
+}
+
+func (w *watcher) containerUnpause() error {
+	return w.client.ContainerUnpause(w.ctx, w.ContainerName)
+}
+
+func (w *watcher) containerStart() error {
+	return w.client.ContainerStart(w.ctx, w.ContainerName, container.StartOptions{})
+}
+
+func (w *watcher) containerStatus() (string, E.NestedError) {
+	json, err := w.client.ContainerInspect(w.ctx, w.ContainerName)
+	if err != nil {
+		return "", E.FailWith("inspect container", err)
+	}
+	return json.State.Status, nil
+}
+
+func (w *watcher) wakeIfStopped() E.NestedError {
+	status, err := w.containerStatus()
+
+	if err.HasError() {
+		return err
+	}
+	// "created", "running", "paused", "restarting", "removing", "exited", or "dead"
+	switch status {
+	case "exited", "dead":
+		return E.From(w.containerStart())
+	case "paused":
+		return E.From(w.containerUnpause())
+	case "running":
+		return nil
+	default:
+		return E.Unexpected("container state", status)
+	}
+}
+
+func (w *watcher) getStopCallback() StopCallback {
+	var cb func() error
+	switch w.StopMethod {
+	case PT.StopMethodPause:
+		cb = w.containerPause
+	case PT.StopMethodStop:
+		cb = w.containerStop
+	case PT.StopMethodKill:
+		cb = w.containerKill
+	default:
+		panic("should not reach here")
+	}
+	return func() E.NestedError {
+		status, err := w.containerStatus()
+		if err.HasError() {
+			return err
+		}
+		if status != "running" {
+			return nil
+		}
+		return E.From(cb())
+	}
+}
+
+func (w *watcher) watchUntilCancel() {
+	defer close(w.wakeCh)
+
+	w.ctx, w.cancel = context.WithCancel(context.Background())
+
+	dockerWatcher := W.NewDockerWatcherWithClient(w.client)
+	dockerEventCh, dockerEventErrCh := dockerWatcher.EventsWithOptions(w.ctx, W.DockerListOptions{
+		Filters: W.NewDockerFilter(
+			W.DockerFilterContainer,
+			W.DockerrFilterContainerName(w.ContainerName),
+			W.DockerFilterStart,
+			W.DockerFilterStop,
+			W.DockerFilterDie,
+			W.DockerFilterKill,
+			W.DockerFilterPause,
+			W.DockerFilterUnpause,
+		),
+	})
+
+	ticker := time.NewTicker(w.IdleTimeout)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-mainLoopCtx.Done():
+			w.cancel()
+		case <-w.ctx.Done():
+			w.l.Debug("stopped")
+			return
+		case err := <-dockerEventErrCh:
+			if err != nil && err.IsNot(context.Canceled) {
+				w.l.Error(E.FailWith("docker watcher", err))
+			}
+		case e := <-dockerEventCh:
+			switch {
+			// create / start / unpause
+			case e.Action.IsContainerWake():
+				ticker.Reset(w.IdleTimeout)
+				w.l.Info(e)
+			default: // stop / pause / kill
+				ticker.Stop()
+				w.ready.Store(false)
+				w.l.Info(e)
+			}
+		case <-ticker.C:
+			w.l.Debug("idle timeout")
+			ticker.Stop()
+			if err := w.stopByMethod(); err != nil && err.IsNot(context.Canceled) {
+				w.l.Error(E.FailWith("stop", err).Extraf("stop method: %s", w.StopMethod))
+			}
+		case <-w.wakeCh:
+			w.l.Debug("wake signal received")
+			ticker.Reset(w.IdleTimeout)
+			err := w.wakeIfStopped()
+			if err != nil && err.IsNot(context.Canceled) {
+				w.l.Error(E.FailWith("wake", err))
+			}
+			select {
+			case w.wakeDone <- err: // this is passed to roundtrip
+			default:
+			}
+		}
+	}
+}
--- a/src/docker/inspect.go
+++ b/src/docker/inspect.go
@@ -0,0 +1,19 @@
+package docker
+
+import (
+	"context"
+	"time"
+
+	E "github.com/yusing/go-proxy/error"
+)
+
+func (c Client) Inspect(containerID string) (Container, E.NestedError) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	json, err := c.ContainerInspect(ctx, containerID)
+	if err != nil {
+		return Container{}, E.From(err)
+	}
+	return FromJson(json, c.key), nil
+}
--- a/src/docker/label.go
+++ b/src/docker/label.go
@@ -0,0 +1,78 @@
+package docker
+
+import (
+	"strings"
+
+	E "github.com/yusing/go-proxy/error"
+	U "github.com/yusing/go-proxy/utils"
+)
+
+type Label struct {
+	Namespace string
+	Target    string
+	Attribute string
+	Value     any
+}
+
+// Apply applies the value of a Label to the corresponding field in the given object.
+//
+// Parameters:
+//   - obj: a pointer to the object to which the Label value will be applied.
+//   - l: a pointer to the Label containing the attribute and value to be applied.
+//
+// Returns:
+//   - error: an error if the field does not exist.
+func ApplyLabel[T any](obj *T, l *Label) E.NestedError {
+	return U.Deserialize(map[string]any{l.Attribute: l.Value}, obj)
+}
+
+type ValueParser func(string) (any, E.NestedError)
+type ValueParserMap map[string]ValueParser
+
+func ParseLabel(label string, value string) (*Label, E.NestedError) {
+	parts := strings.Split(label, ".")
+
+	if len(parts) < 2 {
+		return &Label{
+			Namespace: label,
+			Value:     value,
+		}, nil
+	}
+
+	l := &Label{
+		Namespace: parts[0],
+		Target:    parts[1],
+		Value:     value,
+	}
+
+	if len(parts) == 3 {
+		l.Attribute = parts[2]
+	} else {
+		l.Attribute = l.Target
+	}
+
+	// find if namespace has value parser
+	pm, ok := labelValueParserMap[l.Namespace]
+	if !ok {
+		return l, nil
+	}
+	// find if attribute has value parser
+	p, ok := pm[l.Attribute]
+	if !ok {
+		return l, nil
+	}
+	// try to parse value
+	v, err := p(value)
+	if err.HasError() {
+		return nil, err
+	}
+	l.Value = v
+	return l, nil
+}
+
+func RegisterNamespace(namespace string, pm ValueParserMap) {
+	labelValueParserMap[namespace] = pm
+}
+
+// namespace:target.attribute -> func(string) (any, error)
+var labelValueParserMap = make(map[string]ValueParserMap)
--- a/src/docker/label_parser.go
+++ b/src/docker/label_parser.go
@@ -0,0 +1,61 @@
+package docker
+
+import (
+	"strings"
+
+	E "github.com/yusing/go-proxy/error"
+	"gopkg.in/yaml.v3"
+)
+
+func yamlListParser(value string) (any, E.NestedError) {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return []string{}, nil
+	}
+	var data []string
+	err := E.From(yaml.Unmarshal([]byte(value), &data))
+	return data, err
+}
+
+func yamlStringMappingParser(value string) (any, E.NestedError) {
+	value = strings.TrimSpace(value)
+	lines := strings.Split(value, "\n")
+	h := make(map[string]string)
+	for _, line := range lines {
+		parts := strings.SplitN(line, ":", 2)
+		if len(parts) != 2 {
+			return nil, E.Invalid("set header statement", line)
+		}
+		key := strings.TrimSpace(parts[0])
+		val := strings.TrimSpace(parts[1])
+		if existing, ok := h[key]; ok {
+			h[key] = existing + ", " + val
+		} else {
+			h[key] = val
+		}
+	}
+	return h, nil
+}
+
+func boolParser(value string) (any, E.NestedError) {
+	switch strings.ToLower(value) {
+	case "true", "yes", "1":
+		return true, nil
+	case "false", "no", "0":
+		return false, nil
+	default:
+		return nil, E.Invalid("boolean value", value)
+	}
+}
+
+const NSProxy = "proxy"
+
+var _ = func() int {
+	RegisterNamespace(NSProxy, ValueParserMap{
+		"path_patterns": yamlListParser,
+		"set_headers":   yamlStringMappingParser,
+		"hide_headers":  yamlListParser,
+		"no_tls_verify": boolParser,
+	})
+	return 0
+}()
--- a/src/docker/label_parser_test.go
+++ b/src/docker/label_parser_test.go
@@ -0,0 +1,140 @@
+package docker
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	E "github.com/yusing/go-proxy/error"
+	. "github.com/yusing/go-proxy/utils/testing"
+)
+
+func makeLabel(namespace string, alias string, field string) string {
+	return fmt.Sprintf("%s.%s.%s", namespace, alias, field)
+}
+
+func TestHomePageLabel(t *testing.T) {
+	alias := "foo"
+	field := "ip"
+	v := "bar"
+	pl, err := ParseLabel(makeLabel(NSHomePage, alias, field), v)
+	ExpectNoError(t, err.Error())
+	if pl.Target != alias {
+		t.Errorf("Expected alias=%s, got %s", alias, pl.Target)
+	}
+	if pl.Attribute != field {
+		t.Errorf("Expected field=%s, got %s", field, pl.Target)
+	}
+	if pl.Value != v {
+		t.Errorf("Expected value=%q, got %s", v, pl.Value)
+	}
+}
+
+func TestStringProxyLabel(t *testing.T) {
+	v := "bar"
+	pl, err := ParseLabel(makeLabel(NSProxy, "foo", "ip"), v)
+	ExpectNoError(t, err.Error())
+	ExpectEqual(t, pl.Value.(string), v)
+}
+
+func TestBoolProxyLabelValid(t *testing.T) {
+	tests := map[string]bool{
+		"true":  true,
+		"TRUE":  true,
+		"yes":   true,
+		"1":     true,
+		"false": false,
+		"FALSE": false,
+		"no":    false,
+		"0":     false,
+	}
+
+	for k, v := range tests {
+		pl, err := ParseLabel(makeLabel(NSProxy, "foo", "no_tls_verify"), k)
+		ExpectNoError(t, err.Error())
+		ExpectEqual(t, pl.Value.(bool), v)
+	}
+}
+
+func TestBoolProxyLabelInvalid(t *testing.T) {
+	alias := "foo"
+	field := "no_tls_verify"
+	_, err := ParseLabel(makeLabel(NSProxy, alias, field), "invalid")
+	if !err.Is(E.ErrInvalid) {
+		t.Errorf("Expected err InvalidProxyLabel, got %s", err.Error())
+	}
+}
+
+func TestSetHeaderProxyLabelValid(t *testing.T) {
+	v := `
+X-Custom-Header1: foo, bar
+X-Custom-Header1: baz
+X-Custom-Header2: boo`
+	v = strings.TrimPrefix(v, "\n")
+	h := map[string]string{
+		"X-Custom-Header1": "foo, bar, baz",
+		"X-Custom-Header2": "boo",
+	}
+
+	pl, err := ParseLabel(makeLabel(NSProxy, "foo", "set_headers"), v)
+	ExpectNoError(t, err.Error())
+	hGot := ExpectType[map[string]string](t, pl.Value)
+	if hGot != nil && !reflect.DeepEqual(h, hGot) {
+		t.Errorf("Expected %v, got %v", h, hGot)
+	}
+
+}
+
+func TestSetHeaderProxyLabelInvalid(t *testing.T) {
+	tests := []string{
+		"X-Custom-Header1 = bar",
+		"X-Custom-Header1",
+		"- X-Custom-Header1",
+	}
+
+	for _, v := range tests {
+		_, err := ParseLabel(makeLabel(NSProxy, "foo", "set_headers"), v)
+		if !err.Is(E.ErrInvalid) {
+			t.Errorf("Expected invalid err for %q, got %s", v, err.Error())
+		}
+	}
+}
+
+func TestHideHeadersProxyLabel(t *testing.T) {
+	v := `
+- X-Custom-Header1
+- X-Custom-Header2
+- X-Custom-Header3
+`
+	v = strings.TrimPrefix(v, "\n")
+	pl, err := ParseLabel(makeLabel(NSProxy, "foo", "hide_headers"), v)
+	ExpectNoError(t, err.Error())
+	sGot := ExpectType[[]string](t, pl.Value)
+	sWant := []string{"X-Custom-Header1", "X-Custom-Header2", "X-Custom-Header3"}
+	if sGot != nil {
+		ExpectDeepEqual(t, sGot, sWant)
+	}
+}
+
+// func TestCommaSepProxyLabelSingle(t *testing.T) {
+// 	v := "a"
+// 	pl, err := ParseLabel("proxy.aliases", v)
+// 	ExpectNoError(t, err)
+// 	sGot := ExpectType[[]string](t, pl.Value)
+// 	sWant := []string{"a"}
+// 	if sGot != nil {
+// 		ExpectEqual(t, sGot, sWant)
+// 	}
+// }
+
+// func TestCommaSepProxyLabelMulti(t *testing.T) {
+// 	v := "X-Custom-Header1, X-Custom-Header2,X-Custom-Header3"
+// 	pl, err := ParseLabel("proxy.aliases", v)
+// 	ExpectNoError(t, err)
+// 	sGot := ExpectType[[]string](t, pl.Value)
+// 	sWant := []string{"X-Custom-Header1", "X-Custom-Header2", "X-Custom-Header3"}
+// 	if sGot != nil {
+// 		ExpectEqual(t, sGot, sWant)
+// 	}
+// }
--- a/src/docker/labels.go
+++ b/src/docker/labels.go
@@ -0,0 +1,13 @@
+package docker
+
+const (
+	WildcardAlias = "*"
+
+	LabelAliases     = NSProxy + ".aliases"
+	LabelExclude     = NSProxy + ".exclude"
+	LabelIdleTimeout = NSProxy + ".idle_timeout"
+	LabelWakeTimeout = NSProxy + ".wake_timeout"
+	LabelStopMethod  = NSProxy + ".stop_method"
+	LabelStopTimeout = NSProxy + ".stop_timeout"
+	LabelStopSignal  = NSProxy + ".stop_signal"
+)
--- a/src/error/builder.go
+++ b/src/error/builder.go
@@ -0,0 +1,76 @@
+package error
+
+import (
+	"fmt"
+	"sync"
+)
+
+type Builder struct {
+	*builder
+}
+
+type builder struct {
+	message  string
+	errors   []NestedError
+	severity Severity
+	sync.Mutex
+}
+
+func NewBuilder(format string, args ...any) Builder {
+	return Builder{&builder{message: fmt.Sprintf(format, args...)}}
+}
+
+// adding nil / nil is no-op,
+// you may safely pass expressions returning error to it
+func (b Builder) Add(err NestedError) Builder {
+	if err != nil {
+		b.Lock()
+		// TODO: if err severity is higher than b.severity, update b.severity
+		b.errors = append(b.errors, err)
+		b.Unlock()
+	}
+	return b
+}
+
+func (b Builder) AddE(err error) Builder {
+	return b.Add(From(err))
+}
+
+func (b Builder) Addf(format string, args ...any) Builder {
+	return b.Add(errorf(format, args...))
+}
+
+func (b Builder) WithSeverity(s Severity) Builder {
+	b.severity = s
+	return b
+}
+
+// Build builds a NestedError based on the errors collected in the Builder.
+//
+// If there are no errors in the Builder, it returns a Nil() NestedError.
+// Otherwise, it returns a NestedError with the message and the errors collected.
+//
+// Returns:
+//   - NestedError: the built NestedError.
+func (b Builder) Build() NestedError {
+	if len(b.errors) == 0 {
+		return nil
+	} else if len(b.errors) == 1 {
+		return b.errors[0]
+	}
+	return Join(b.message, b.errors...).Severity(b.severity)
+}
+
+func (b Builder) To(ptr *NestedError) {
+	if ptr == nil {
+		return
+	} else if *ptr == nil {
+		*ptr = b.Build()
+	} else {
+		(*ptr).With(b.Build())
+	}
+}
+
+func (b Builder) HasError() bool {
+	return len(b.errors) > 0
+}
--- a/src/error/builder_test.go
+++ b/src/error/builder_test.go
@@ -0,0 +1,53 @@
+package error
+
+import (
+	"testing"
+
+	. "github.com/yusing/go-proxy/utils/testing"
+)
+
+func TestBuilderEmpty(t *testing.T) {
+	eb := NewBuilder("qwer")
+	ExpectTrue(t, eb.Build() == nil)
+	ExpectTrue(t, eb.Build().NoError())
+	ExpectFalse(t, eb.HasError())
+}
+
+func TestBuilderAddNil(t *testing.T) {
+	eb := NewBuilder("asdf")
+	var err NestedError
+	for range 3 {
+		eb.Add(nil)
+	}
+	for range 3 {
+		eb.Add(err)
+	}
+	ExpectTrue(t, eb.Build() == nil)
+	ExpectTrue(t, eb.Build().NoError())
+	ExpectFalse(t, eb.HasError())
+}
+
+func TestBuilderNested(t *testing.T) {
+	eb := NewBuilder("error occurred")
+	eb.Add(Failure("Action 1").With(Invalid("Inner", "1")).With(Invalid("Inner", "2")))
+	eb.Add(Failure("Action 2").With(Invalid("Inner", "3")))
+
+	got := eb.Build().String()
+	expected1 :=
+		(`error occurred:
+  - Action 1 failed:
+    - invalid Inner: 1
+    - invalid Inner: 2
+  - Action 2 failed:
+    - invalid Inner: 3`)
+	expected2 :=
+		(`error occurred:
+  - Action 1 failed:
+    - invalid Inner: "1"
+    - invalid Inner: "2"
+  - Action 2 failed:
+    - invalid Inner: "3"`)
+	if got != expected1 && got != expected2 {
+		t.Errorf("expected \n%s, got \n%s", expected1, got)
+	}
+}
--- a/src/error/error.go
+++ b/src/error/error.go
@@ -0,0 +1,264 @@
+package error
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+type (
+	NestedError = *nestedError
+	nestedError struct {
+		subject  string
+		err      error
+		extras   []nestedError
+		severity Severity
+	}
+	Severity uint8
+)
+
+const (
+	SeverityWarning Severity = iota
+	SeverityFatal
+)
+
+func From(err error) NestedError {
+	if IsNil(err) {
+		return nil
+	}
+	return &nestedError{err: err}
+}
+
+// Check is a helper function that
+// convert (T, error) to (T, NestedError).
+func Check[T any](obj T, err error) (T, NestedError) {
+	return obj, From(err)
+}
+
+func Join(message string, err ...NestedError) NestedError {
+	extras := make([]nestedError, len(err))
+	nErr := 0
+	for i, e := range err {
+		if e == nil {
+			continue
+		}
+		extras[i] = *e
+		nErr += 1
+	}
+	if nErr == 0 {
+		return nil
+	}
+	return &nestedError{
+		err:    errors.New(message),
+		extras: extras,
+	}
+}
+
+func JoinE(message string, err ...error) NestedError {
+	b := NewBuilder(message)
+	for _, e := range err {
+		b.AddE(e)
+	}
+	return b.Build()
+}
+
+func IsNil(err error) bool {
+	return err == nil
+}
+
+func IsNotNil(err error) bool {
+	return err != nil
+}
+
+func (ne NestedError) String() string {
+	var buf strings.Builder
+	ne.writeToSB(&buf, 0, "")
+	return buf.String()
+}
+
+func (ne NestedError) Is(err error) bool {
+	if ne == nil {
+		return err == nil
+	}
+	// return errors.Is(ne.err, err)
+	if errors.Is(ne.err, err) {
+		return true
+	}
+	for _, e := range ne.extras {
+		if e.Is(err) {
+			return true
+		}
+	}
+	return false
+}
+
+func (ne NestedError) IsNot(err error) bool {
+	return !ne.Is(err)
+}
+
+func (ne NestedError) Error() error {
+	if ne == nil {
+		return nil
+	}
+	return ne.buildError(0, "")
+}
+
+func (ne NestedError) With(s any) NestedError {
+	if ne == nil {
+		return ne
+	}
+	var msg string
+	switch ss := s.(type) {
+	case nil:
+		return ne
+	case NestedError:
+		return ne.withError(ss)
+	case error:
+		return ne.withError(From(ss))
+	case string:
+		msg = ss
+	case fmt.Stringer:
+		return ne.append(ss.String())
+	default:
+		return ne.append(fmt.Sprint(s))
+	}
+	return ne.withError(From(errors.New(msg)))
+}
+
+func (ne NestedError) Extraf(format string, args ...any) NestedError {
+	return ne.With(errorf(format, args...))
+}
+
+func (ne NestedError) Subject(s any) NestedError {
+	if ne == nil {
+		return ne
+	}
+	switch ss := s.(type) {
+	case string:
+		ne.subject = ss
+	case fmt.Stringer:
+		ne.subject = ss.String()
+	default:
+		ne.subject = fmt.Sprint(s)
+	}
+	return ne
+}
+
+func (ne NestedError) Subjectf(format string, args ...any) NestedError {
+	if ne == nil {
+		return ne
+	}
+	if strings.Contains(format, "%q") {
+		panic("Subjectf format should not contain %q")
+	}
+	if strings.Contains(format, "%w") {
+		panic("Subjectf format should not contain %w")
+	}
+	ne.subject = fmt.Sprintf(format, args...)
+	return ne
+}
+
+func (ne NestedError) Severity(s Severity) NestedError {
+	if ne == nil {
+		return ne
+	}
+	ne.severity = s
+	return ne
+}
+
+func (ne NestedError) Warn() NestedError {
+	if ne == nil {
+		return ne
+	}
+	ne.severity = SeverityWarning
+	return ne
+}
+
+func (ne NestedError) NoError() bool {
+	return ne == nil
+}
+
+func (ne NestedError) HasError() bool {
+	return ne != nil
+}
+
+func (ne NestedError) IsFatal() bool {
+	return ne != nil && ne.severity == SeverityFatal
+}
+
+func (ne NestedError) IsWarning() bool {
+	return ne != nil && ne.severity == SeverityWarning
+}
+
+func errorf(format string, args ...any) NestedError {
+	return From(fmt.Errorf(format, args...))
+}
+
+func (ne NestedError) withError(err NestedError) NestedError {
+	if ne != nil && err != nil {
+		ne.extras = append(ne.extras, *err)
+	}
+	return ne
+}
+
+func (ne NestedError) append(msg string) NestedError {
+	if ne == nil {
+		return nil
+	}
+	ne.err = fmt.Errorf("%w %s", ne.err, msg)
+	return ne
+}
+
+func (ne NestedError) writeToSB(sb *strings.Builder, level int, prefix string) {
+	for i := 0; i < level; i++ {
+		sb.WriteString("  ")
+	}
+	sb.WriteString(prefix)
+
+	if ne.NoError() {
+		sb.WriteString("nil")
+		return
+	}
+
+	sb.WriteString(ne.err.Error())
+	if ne.subject != "" {
+		sb.WriteString(fmt.Sprintf(" for %q", ne.subject))
+	}
+	if len(ne.extras) > 0 {
+		sb.WriteRune(':')
+		for _, extra := range ne.extras {
+			sb.WriteRune('\n')
+			extra.writeToSB(sb, level+1, "- ")
+		}
+	}
+}
+
+func (ne NestedError) buildError(level int, prefix string) error {
+	var res error
+	var sb strings.Builder
+
+	for i := 0; i < level; i++ {
+		sb.WriteString("  ")
+	}
+	sb.WriteString(prefix)
+
+	if ne.NoError() {
+		sb.WriteString("nil")
+		return errors.New(sb.String())
+	}
+
+	res = fmt.Errorf("%s%w", sb.String(), ne.err)
+	sb.Reset()
+
+	if ne.subject != "" {
+		sb.WriteString(fmt.Sprintf(" for %q", ne.subject))
+	}
+	if len(ne.extras) > 0 {
+		sb.WriteRune(':')
+		res = fmt.Errorf("%w%s", res, sb.String())
+		for _, extra := range ne.extras {
+			res = errors.Join(res, extra.buildError(level+1, "- "))
+		}
+	}
+	return res
+}
--- a/src/error/error_test.go
+++ b/src/error/error_test.go
@@ -0,0 +1,109 @@
+package error_test
+
+import (
+	"errors"
+	"testing"
+
+	. "github.com/yusing/go-proxy/error"
+	. "github.com/yusing/go-proxy/utils/testing"
+)
+
+func TestErrorIs(t *testing.T) {
+	ExpectTrue(t, Failure("foo").Is(ErrFailure))
+	ExpectTrue(t, Failure("foo").With("bar").Is(ErrFailure))
+	ExpectFalse(t, Failure("foo").With("bar").Is(ErrInvalid))
+	ExpectFalse(t, Failure("foo").With("bar").With("baz").Is(ErrInvalid))
+
+	ExpectTrue(t, Invalid("foo", "bar").Is(ErrInvalid))
+	ExpectFalse(t, Invalid("foo", "bar").Is(ErrFailure))
+
+	ExpectFalse(t, Invalid("foo", "bar").Is(nil))
+
+	ExpectTrue(t, errors.Is(Failure("foo").Error(), ErrFailure))
+	ExpectTrue(t, errors.Is(Failure("foo").With(Invalid("bar", "baz")).Error(), ErrInvalid))
+	ExpectTrue(t, errors.Is(Failure("foo").With(Invalid("bar", "baz")).Error(), ErrFailure))
+	ExpectFalse(t, errors.Is(Failure("foo").With(Invalid("bar", "baz")).Error(), ErrNotExists))
+}
+
+func TestErrorNestedIs(t *testing.T) {
+	var err NestedError
+	ExpectTrue(t, err.Is(nil))
+
+	err = Failure("some reason")
+	ExpectTrue(t, err.Is(ErrFailure))
+	ExpectFalse(t, err.Is(ErrAlreadyExist))
+
+	err.With(AlreadyExist("something", ""))
+	ExpectTrue(t, err.Is(ErrFailure))
+	ExpectTrue(t, err.Is(ErrAlreadyExist))
+	ExpectFalse(t, err.Is(ErrInvalid))
+}
+
+func TestIsNil(t *testing.T) {
+	var err NestedError
+	ExpectTrue(t, err.Is(nil))
+	ExpectFalse(t, err.HasError())
+	ExpectTrue(t, err == nil)
+	ExpectTrue(t, err.NoError())
+
+	eb := NewBuilder("")
+	returnNil := func() error {
+		return eb.Build().Error()
+	}
+	ExpectTrue(t, IsNil(returnNil()))
+	ExpectTrue(t, returnNil() == nil)
+
+	ExpectTrue(t, (err.
+		Subject("any").
+		With("something").
+		Extraf("foo %s", "bar")) == nil)
+}
+
+func TestErrorSimple(t *testing.T) {
+	ne := Failure("foo bar")
+	ExpectEqual(t, ne.String(), "foo bar failed")
+	ne = ne.Subject("baz")
+	ExpectEqual(t, ne.String(), "foo bar failed for \"baz\"")
+}
+
+func TestErrorWith(t *testing.T) {
+	ne := Failure("foo").With("bar").With("baz")
+	ExpectEqual(t, ne.String(), "foo failed:\n  - bar\n  - baz")
+}
+
+func TestErrorNested(t *testing.T) {
+	inner := Failure("inner").
+		With("1").
+		With("1")
+	inner2 := Failure("inner2").
+		Subject("action 2").
+		With("2").
+		With("2")
+	inner3 := Failure("inner3").
+		Subject("action 3").
+		With("3").
+		With("3")
+	ne := Failure("foo").
+		With("bar").
+		With("baz").
+		With(inner).
+		With(inner.With(inner2.With(inner3)))
+	want :=
+		`foo failed:
+  - bar
+  - baz
+  - inner failed:
+    - 1
+    - 1
+  - inner failed:
+    - 1
+    - 1
+    - inner2 failed for "action 2":
+      - 2
+      - 2
+      - inner3 failed for "action 3":
+        - 3
+        - 3`
+	ExpectEqual(t, ne.String(), want)
+	ExpectEqual(t, ne.Error().Error(), want)
+}
--- a/src/error/errors.go
+++ b/src/error/errors.go
@@ -0,0 +1,62 @@
+package error
+
+import (
+	stderrors "errors"
+)
+
+var (
+	ErrFailure      = stderrors.New("failed")
+	ErrInvalid      = stderrors.New("invalid")
+	ErrUnsupported  = stderrors.New("unsupported")
+	ErrUnexpected   = stderrors.New("unexpected")
+	ErrNotExists    = stderrors.New("does not exist")
+	ErrMissing      = stderrors.New("missing")
+	ErrAlreadyExist = stderrors.New("already exist")
+	ErrOutOfRange   = stderrors.New("out of range")
+)
+
+const fmtSubjectWhat = "%w %v: %q"
+
+func Failure(what string) NestedError {
+	return errorf("%s %w", what, ErrFailure)
+}
+
+func FailedWhy(what string, why string) NestedError {
+	return Failure(what).With(why)
+}
+
+func FailWith(what string, err any) NestedError {
+	return Failure(what).With(err)
+}
+
+func Invalid(subject, what any) NestedError {
+	return errorf(fmtSubjectWhat, ErrInvalid, subject, what)
+}
+
+func Unsupported(subject, what any) NestedError {
+	return errorf(fmtSubjectWhat, ErrUnsupported, subject, what)
+}
+
+func Unexpected(subject, what any) NestedError {
+	return errorf(fmtSubjectWhat, ErrUnexpected, subject, what)
+}
+
+func UnexpectedError(err error) NestedError {
+	return errorf("%w error: %w", ErrUnexpected, err)
+}
+
+func NotExist(subject, what any) NestedError {
+	return errorf("%v %w: %v", subject, ErrNotExists, what)
+}
+
+func Missing(subject any) NestedError {
+	return errorf("%w %v", ErrMissing, subject)
+}
+
+func AlreadyExist(subject, what any) NestedError {
+	return errorf("%v %w: %v", subject, ErrAlreadyExist, what)
+}
+
+func OutOfRange(subject string, value any) NestedError {
+	return errorf("%v %w: %v", subject, ErrOutOfRange, value)
+}
--- a/src/go-proxy/args.go
+++ b/src/go-proxy/args.go
@@ -1,38 +0,0 @@
-package main
-
-import (
-	"flag"
-
-	"github.com/sirupsen/logrus"
-)
-
-type Args struct {
-	Command string
-}
-
-const (
-	CommandStart    = ""
-	CommandValidate = "validate"
-	CommandReload   = "reload"
-)
-
-var ValidCommands = []string{CommandStart, CommandValidate, CommandReload}
-
-func getArgs() Args {
-	var args Args
-	flag.Parse()
-	args.Command = flag.Arg(0)
-	if err := validateArgs(args.Command, ValidCommands); err != nil {
-		logrus.Fatal(err)
-	}
-	return args
-}
-
-func validateArgs[T comparable](arg T, validArgs []T) error {
-	for _, v := range validArgs {
-		if arg == v {
-			return nil
-		}
-	}
-	return NewNestedError("invalid argument").Subjectf("%v", arg)
-}
--- a/src/go-proxy/autocert.go
+++ b/src/go-proxy/autocert.go
@@ -1,309 +0,0 @@
-package main
-
-import (
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/tls"
-	"crypto/x509"
-	"os"
-	"path"
-	"sync"
-	"time"
-
-	"github.com/go-acme/lego/v4/certcrypto"
-	"github.com/go-acme/lego/v4/certificate"
-	"github.com/go-acme/lego/v4/challenge"
-	"github.com/go-acme/lego/v4/lego"
-	"github.com/go-acme/lego/v4/providers/dns/clouddns"
-	"github.com/go-acme/lego/v4/providers/dns/cloudflare"
-	"github.com/go-acme/lego/v4/registration"
-)
-
-type ProviderOptions map[string]string
-type ProviderGenerator func(ProviderOptions) (challenge.Provider, error)
-type CertExpiries map[string]time.Time
-
-type AutoCertConfig struct {
-	Email    string          `json:"email"`
-	Domains  []string        `yaml:",flow" json:"domains"`
-	Provider string          `json:"provider"`
-	Options  ProviderOptions `yaml:",flow" json:"options"`
-}
-
-type AutoCertUser struct {
-	Email        string
-	Registration *registration.Resource
-	key          crypto.PrivateKey
-}
-
-func (u *AutoCertUser) GetEmail() string {
-	return u.Email
-}
-func (u *AutoCertUser) GetRegistration() *registration.Resource {
-	return u.Registration
-}
-func (u *AutoCertUser) GetPrivateKey() crypto.PrivateKey {
-	return u.key
-}
-
-type AutoCertProvider interface {
-	GetCert(*tls.ClientHelloInfo) (*tls.Certificate, error)
-	GetName() string
-	GetExpiries() CertExpiries
-	LoadCert() bool
-	ObtainCert() NestedErrorLike
-	RenewalOn() time.Time
-	ScheduleRenewal()
-}
-
-func (cfg AutoCertConfig) GetProvider() (AutoCertProvider, error) {
-	ne := NewNestedError("invalid autocert config")
-
-	if len(cfg.Domains) == 0 {
-		ne.Extra("no domains specified")
-	}
-	if cfg.Provider == "" {
-		ne.Extra("no provider specified")
-	}
-	if cfg.Email == "" {
-		ne.Extra("no email specified")
-	}
-	gen, ok := providersGenMap[cfg.Provider]
-	if !ok {
-		ne.Extraf("unknown provider: %s", cfg.Provider)
-	}
-	if ne.HasExtras() {
-		return nil, ne
-	}
-
-	ne = NewNestedError("unable to create provider")
-	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		return nil, ne.With(NewNestedError("unable to generate private key").With(err))
-	}
-	user := &AutoCertUser{
-		Email: cfg.Email,
-		key:   privKey,
-	}
-	legoCfg := lego.NewConfig(user)
-	legoCfg.Certificate.KeyType = certcrypto.RSA2048
-	legoClient, err := lego.NewClient(legoCfg)
-	if err != nil {
-		return nil, ne.With(NewNestedError("unable to create lego client").With(err))
-	}
-	base := &autoCertProvider{
-		name:    cfg.Provider,
-		cfg:     cfg,
-		user:    user,
-		legoCfg: legoCfg,
-		client:  legoClient,
-	}
-	legoProvider, err := gen(cfg.Options)
-	if err != nil {
-		return nil, ne.With(err)
-	}
-	err = legoClient.Challenge.SetDNS01Provider(legoProvider)
-	if err != nil {
-		return nil, ne.With(NewNestedError("unable to set challenge provider").With(err))
-	}
-	return base, nil
-}
-
-type autoCertProvider struct {
-	name    string
-	cfg     AutoCertConfig
-	user    *AutoCertUser
-	legoCfg *lego.Config
-	client  *lego.Client
-
-	tlsCert      *tls.Certificate
-	certExpiries CertExpiries
-	mutex        sync.Mutex
-}
-
-func (p *autoCertProvider) GetCert(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	if p.tlsCert == nil {
-		return nil, NewNestedError("no certificate available")
-	}
-	return p.tlsCert, nil
-}
-
-func (p *autoCertProvider) GetName() string {
-	return p.name
-}
-
-func (p *autoCertProvider) GetExpiries() CertExpiries {
-	return p.certExpiries
-}
-
-func (p *autoCertProvider) ObtainCert() NestedErrorLike {
-	ne := NewNestedError("failed to obtain certificate")
-
-	client := p.client
-	if p.user.Registration == nil {
-		reg, err := client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
-		if err != nil {
-			return ne.With(NewNestedError("failed to register account").With(err))
-		}
-		p.user.Registration = reg
-	}
-	req := certificate.ObtainRequest{
-		Domains: p.cfg.Domains,
-		Bundle:  true,
-	}
-	cert, err := client.Certificate.Obtain(req)
-	if err != nil {
-		return ne.With(err)
-	}
-	err = p.saveCert(cert)
-	if err != nil {
-		return ne.With(NewNestedError("failed to save certificate").With(err))
-	}
-	tlsCert, err := tls.X509KeyPair(cert.Certificate, cert.PrivateKey)
-	if err != nil {
-		return ne.With(NewNestedError("failed to parse obtained certificate").With(err))
-	}
-	expiries, err := getCertExpiries(&tlsCert)
-	if err != nil {
-		return ne.With(NewNestedError("failed to get certificate expiry").With(err))
-	}
-	p.tlsCert = &tlsCert
-	p.certExpiries = expiries
-	return nil
-}
-
-func (p *autoCertProvider) LoadCert() bool {
-	cert, err := tls.LoadX509KeyPair(certFileDefault, keyFileDefault)
-	if err != nil {
-		return false
-	}
-	expiries, err := getCertExpiries(&cert)
-	if err != nil {
-		return false
-	}
-	p.tlsCert = &cert
-	p.certExpiries = expiries
-	p.renewIfNeeded()
-	return true
-}
-
-func (p *autoCertProvider) RenewalOn() time.Time {
-	t := time.Now().AddDate(0, 0, 3)
-	for _, expiry := range p.certExpiries {
-		if expiry.Before(t) {
-			return time.Now()
-		}
-		return t
-	}
-	// this line should never be reached
-	panic("no certificate available")
-}
-
-func (p *autoCertProvider) ScheduleRenewal() {
-	for {
-		t := time.Until(p.RenewalOn())
-		aclog.Infof("next renewal in %v", t)
-		time.Sleep(t)
-		err := p.renewIfNeeded()
-		if err != nil {
-			aclog.Fatal(err)
-		}
-	}
-}
-
-func (p *autoCertProvider) saveCert(cert *certificate.Resource) NestedErrorLike {
-	err := os.MkdirAll(path.Dir(certFileDefault), 0644)
-	if err != nil {
-		return NewNestedError("unable to create cert directory").With(err)
-	}
-	err = os.WriteFile(keyFileDefault, cert.PrivateKey, 0600) // -rw-------
-	if err != nil {
-		return NewNestedError("unable to write key file").With(err)
-	}
-	err = os.WriteFile(certFileDefault, cert.Certificate, 0644) // -rw-r--r--
-	if err != nil {
-		return NewNestedError("unable to write cert file").With(err)
-	}
-	return nil
-}
-
-func (p *autoCertProvider) needRenewal() bool {
-	return time.Now().After(p.RenewalOn())
-}
-
-func (p *autoCertProvider) renewIfNeeded() NestedErrorLike {
-	if !p.needRenewal() {
-		return nil
-	}
-
-	p.mutex.Lock()
-	defer p.mutex.Unlock()
-
-	if !p.needRenewal() {
-		return nil
-	}
-
-	trials := 0
-	for {
-		err := p.ObtainCert()
-		if err == nil {
-			return nil
-		}
-		trials++
-		if trials > 3 {
-			return NewNestedError("failed to renew certificate after 3 trials").With(err)
-		}
-		aclog.Errorf("failed to renew certificate: %v, trying again in 5 seconds", err)
-		time.Sleep(5 * time.Second)
-	}
-}
-
-func providerGenerator[CT any, PT challenge.Provider](
-	defaultCfg func() *CT,
-	newProvider func(*CT) (PT, error),
-) ProviderGenerator {
-	return func(opt ProviderOptions) (challenge.Provider, error) {
-		cfg := defaultCfg()
-		err := setOptions(cfg, opt)
-		if err != nil {
-			return nil, err
-		}
-		p, err := newProvider(cfg)
-		if err != nil {
-			return nil, err
-		}
-		return p, nil
-	}
-}
-
-func getCertExpiries(cert *tls.Certificate) (CertExpiries, error) {
-	r := make(CertExpiries, len(cert.Certificate))
-	for _, cert := range cert.Certificate {
-		x509Cert, err := x509.ParseCertificate(cert)
-		if err != nil {
-			return nil, NewNestedError("unable to parse certificate").With(err)
-		}
-		if x509Cert.IsCA {
-			continue
-		}
-		r[x509Cert.Subject.CommonName] = x509Cert.NotAfter
-	}
-	return r, nil
-}
-
-func setOptions[T interface{}](cfg *T, opt ProviderOptions) error {
-	for k, v := range opt {
-		err := setFieldFromSnake(cfg, k, v)
-		if err != nil {
-			return NewNestedError("unable to set option").Subject(k).With(err)
-		}
-	}
-	return nil
-}
-
-var providersGenMap = map[string]ProviderGenerator{
-	"cloudflare": providerGenerator(cloudflare.NewDefaultConfig, cloudflare.NewDNSProviderConfig),
-	"clouddns": providerGenerator(clouddns.NewDefaultConfig, clouddns.NewDNSProviderConfig),
-}
--- a/src/go-proxy/config.go
+++ b/src/go-proxy/config.go
@@ -1,201 +0,0 @@
-package main
-
-import (
-	"os"
-	"sync"
-	"time"
-
-	"gopkg.in/yaml.v3"
-)
-
-// commented out if unused
-type Config interface {
-	Value() configModel
-	// Load() error
-	MustLoad()
-	GetAutoCertProvider() (AutoCertProvider, error)
-	// MustReload()
-	Reload() error
-	StartProviders()
-	StopProviders()
-	WatchChanges()
-	StopWatching()
-}
-
-func NewConfig(path string) Config {
-	cfg := &config{
-		reader: &FileReader{Path: path},
-	}
-	cfg.watcher = NewFileWatcher(
-		path,
-		cfg.MustReload,        // OnChange
-		func() { os.Exit(1) }, // OnDelete
-	)
-	return cfg
-}
-
-func ValidateConfig(data []byte) error {
-	cfg := &config{reader: &ByteReader{data}}
-	return cfg.Load()
-}
-
-func (cfg *config) Value() configModel {
-	return *cfg.m
-}
-
-func (cfg *config) Load(reader ...Reader) error {
-	cfg.mutex.Lock()
-	defer cfg.mutex.Unlock()
-
-	if cfg.reader == nil {
-		panic("config reader not set")
-	}
-
-	data, err := cfg.reader.Read()
-	if err != nil {
-		return NewNestedError("unable to read config file").With(err)
-	}
-
-	model := defaultConfig()
-	if err := yaml.Unmarshal(data, model); err != nil {
-		return NewNestedError("unable to parse config file").With(err)
-	}
-
-	ne := NewNestedError("invalid config")
-
-	err = validateYaml(configSchema, data)
-	if err != nil {
-		ne.With(err)
-	}
-
-	pErrs := NewNestedError("errors in these providers")
-
-	for name, p := range model.Providers {
-		if p.Kind != ProviderKind_File {
-			continue
-		}
-		_, err := p.ValidateFile()
-		if err != nil {
-			pErrs.ExtraError(
-				NewNestedError("provider file validation error").
-					Subject(name).
-					With(err),
-			)
-		}
-	}
-	if pErrs.HasExtras() {
-		ne.With(pErrs)
-	}
-	if ne.HasInner() {
-		return ne
-	}
-
-	cfg.m = model
-	return nil
-}
-
-func (cfg *config) MustLoad() {
-	if err := cfg.Load(); err != nil {
-		cfgl.Fatal(err)
-	}
-}
-
-func (cfg *config) GetAutoCertProvider() (AutoCertProvider, error) {
-	return cfg.m.AutoCert.GetProvider()
-}
-
-func (cfg *config) Reload() error {
-	cfg.StopProviders()
-	if err := cfg.Load(); err != nil {
-		return err
-	}
-	cfg.StartProviders()
-	return nil
-}
-
-func (cfg *config) MustReload() {
-	if err := cfg.Reload(); err != nil {
-		cfgl.Fatal(err)
-	}
-}
-
-func (cfg *config) StartProviders() {
-	if cfg.providerInitialized {
-		return
-	}
-
-	cfg.mutex.Lock()
-	defer cfg.mutex.Unlock()
-	if cfg.providerInitialized {
-		return
-	}
-
-	pErrs := NewNestedError("failed to start these providers")
-
-	ParallelForEachKeyValue(cfg.m.Providers, func(name string, p *Provider) {
-		err := p.Init(name)
-		if err != nil {
-			pErrs.ExtraError(NewNestedErrorFrom(err).Subjectf("%s providers %q", p.Kind, name))
-			delete(cfg.m.Providers, name)
-		}
-		p.StartAllRoutes()
-	})
-
-	cfg.providerInitialized = true
-
-	if pErrs.HasExtras() {
-		cfgl.Error(pErrs)
-	}
-}
-
-func (cfg *config) StopProviders() {
-	if !cfg.providerInitialized {
-		return
-	}
-
-	cfg.mutex.Lock()
-	defer cfg.mutex.Unlock()
-	if !cfg.providerInitialized {
-		return
-	}
-	ParallelForEachValue(cfg.m.Providers, (*Provider).StopAllRoutes)
-	cfg.m.Providers = make(map[string]*Provider)
-	cfg.providerInitialized = false
-}
-
-func (cfg *config) WatchChanges() {
-	if cfg.watcher == nil {
-		return
-	}
-	cfg.watcher.Start()
-}
-
-func (cfg *config) StopWatching() {
-	if cfg.watcher == nil {
-		return
-	}
-	cfg.watcher.Stop()
-}
-
-type configModel struct {
-	Providers       map[string]*Provider `yaml:",flow" json:"providers"`
-	AutoCert        AutoCertConfig       `yaml:",flow" json:"autocert"`
-	TimeoutShutdown time.Duration        `yaml:"timeout_shutdown" json:"timeout_shutdown"`
-	RedirectToHTTPS bool                 `yaml:"redirect_to_https" json:"redirect_to_https"`
-}
-
-func defaultConfig() *configModel {
-	return &configModel{
-		TimeoutShutdown: 3 * time.Second,
-		RedirectToHTTPS: false,
-	}
-}
-
-type config struct {
-	m *configModel
-
-	reader              Reader
-	watcher             Watcher
-	mutex               sync.Mutex
-	providerInitialized bool
-}
--- a/src/go-proxy/constants.go
+++ b/src/go-proxy/constants.go
@@ -1,184 +0,0 @@
-package main
-
-import (
-	"crypto/tls"
-	"net"
-	"net/http"
-	"os"
-	"time"
-
-	"github.com/santhosh-tekuri/jsonschema"
-	"github.com/sirupsen/logrus"
-)
-
-var (
-	ImageNamePortMapTCP = map[string]string{
-		"postgres":  "5432",
-		"mysql":     "3306",
-		"mariadb":   "3306",
-		"redis":     "6379",
-		"mssql":     "1433",
-		"memcached": "11211",
-		"rabbitmq":  "5672",
-		"mongo":     "27017",
-	}
-	ExtraNamePortMapTCP = map[string]string{
-		"dns":  "53",
-		"ssh":  "22",
-		"ftp":  "21",
-		"smtp": "25",
-		"pop3": "110",
-		"imap": "143",
-	}
-	NamePortMapTCP = func() map[string]string {
-		m := make(map[string]string)
-		for k, v := range ImageNamePortMapTCP {
-			m[k] = v
-		}
-		for k, v := range ExtraNamePortMapTCP {
-			m[k] = v
-		}
-		return m
-	}()
-)
-
-var ImageNamePortMapHTTP = map[string]uint16{
-	"nginx":               80,
-	"httpd":               80,
-	"adguardhome":         3000,
-	"gogs":                3000,
-	"gitea":               3000,
-	"portainer":           9000,
-	"portainer-ce":        9000,
-	"home-assistant":      8123,
-	"homebridge":          8581,
-	"uptime-kuma":         3001,
-	"changedetection.io":  3000,
-	"prometheus":          9090,
-	"grafana":             3000,
-	"dockge":              5001,
-	"nginx-proxy-manager": 81,
-}
-
-var wellKnownHTTPPorts = map[uint16]bool{
-	80:   true,
-	8000: true,
-	8008: true,
-	8080: true,
-	3000: true,
-}
-
-var (
-	StreamSchemes = []string{StreamType_TCP, StreamType_UDP} // TODO: support "tcp:udp", "udp:tcp"
-	HTTPSchemes   = []string{"http", "https"}
-	ValidSchemes  = append(StreamSchemes, HTTPSchemes...)
-)
-
-const (
-	StreamType_UDP = "udp"
-	StreamType_TCP = "tcp"
-)
-
-const (
-	ProxyPathMode_Forward     = "forward"
-	ProxyPathMode_Sub         = "sub"
-	ProxyPathMode_RemovedPath = ""
-)
-
-const (
-	ProviderKind_Docker = "docker"
-	ProviderKind_File   = "file"
-)
-
-// TODO: default + per proxy
-var (
-	transport = &http.Transport{
-		Proxy: http.ProxyFromEnvironment,
-		DialContext: (&net.Dialer{
-			Timeout:   60 * time.Second,
-			KeepAlive: 60 * time.Second,
-		}).DialContext,
-		MaxIdleConns:        1000,
-		MaxIdleConnsPerHost: 1000,
-	}
-
-	transportNoTLS = func() *http.Transport {
-		var clone = transport.Clone()
-		clone.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
-		return clone
-	}()
-
-	healthCheckHttpClient = &http.Client{
-		Timeout: 5 * time.Second,
-		Transport: &http.Transport{
-			Proxy:             http.ProxyFromEnvironment,
-			DisableKeepAlives: true,
-			ForceAttemptHTTP2: true,
-			DialContext: (&net.Dialer{
-				Timeout:   5 * time.Second,
-				KeepAlive: 5 * time.Second,
-			}).DialContext,
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		},
-	}
-)
-
-const wildcardLabelPrefix = "proxy.*."
-
-const clientUrlFromEnv = "FROM_ENV"
-
-const (
-	certBasePath    = "certs/"
-	certFileDefault = certBasePath + "cert.crt"
-	keyFileDefault  = certBasePath + "priv.key"
-
-	configBasePath = "config/"
-	configPath     = configBasePath + "config.yml"
-
-	templatesBasePath        = "templates/"
-	panelTemplatePath        = templatesBasePath + "panel/index.html"
-	configEditorTemplatePath = templatesBasePath + "config_editor/index.html"
-
-	schemaBasePath      = "schema/"
-	configSchemaPath    = schemaBasePath + "config.schema.json"
-	providersSchemaPath = schemaBasePath + "providers.schema.json"
-)
-
-var (
-	configSchema    *jsonschema.Schema
-	providersSchema *jsonschema.Schema
-	_               = func() *jsonschema.Compiler {
-		c := jsonschema.NewCompiler()
-		c.Draft = jsonschema.Draft7
-		var err error
-		if configSchema, err = c.Compile(configSchemaPath); err != nil {
-			panic(err)
-		}
-		if providersSchema, err = c.Compile(providersSchemaPath); err != nil {
-			panic(err)
-		}
-		return c
-	}()
-)
-
-const (
-	streamStopListenTimeout = 1 * time.Second
-	streamDialTimeout       = 3 * time.Second
-)
-
-const udpBufferSize = 1500
-
-var isHostNetworkMode = os.Getenv("GOPROXY_HOST_NETWORK") == "1"
-
-var logLevel = func() logrus.Level {
-	switch os.Getenv("GOPROXY_DEBUG") {
-	case "1", "true":
-		logrus.SetLevel(logrus.DebugLevel)
-	}
-	return logrus.GetLevel()
-}()
-
-var isRunningAsService = func() bool {
-	v := os.Getenv("IS_SYSTEMD")
-	return v == "1"
-}()
--- a/src/go-proxy/docker_provider.go
+++ b/src/go-proxy/docker_provider.go
@@ -1,266 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/docker/cli/cli/connhelper"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/client"
-	"golang.org/x/net/context"
-)
-
-func (p *Provider) setConfigField(c *ProxyConfig, label string, value string, prefix string) error {
-	if strings.HasPrefix(label, prefix) {
-		field := strings.TrimPrefix(label, prefix)
-		if err := setFieldFromSnake(c, field, value); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (p *Provider) getContainerProxyConfigs(container *types.Container, clientIP string) ProxyConfigSlice {
-	var aliases []string
-
-	cfgs := make(ProxyConfigSlice, 0)
-
-	containerName := strings.TrimPrefix(container.Names[0], "/")
-	aliasesLabel, ok := container.Labels["proxy.aliases"]
-
-	if !ok {
-		aliases = []string{containerName}
-	} else {
-		aliases = strings.Split(aliasesLabel, ",")
-	}
-
-	if clientIP == "" && isHostNetworkMode {
-		clientIP = "127.0.0.1"
-	}
-	isRemote := clientIP != ""
-
-	for _, alias := range aliases {
-		ne := NewNestedError("invalid label config").Subjectf("container %s", containerName)
-
-		l := p.l.WithField("container", containerName).WithField("alias", alias)
-		config := NewProxyConfig(p)
-		prefix := fmt.Sprintf("proxy.%s.", alias)
-		for label, value := range container.Labels {
-			err := p.setConfigField(&config, label, value, prefix)
-			if err != nil {
-				ne.ExtraError(NewNestedErrorFrom(err).Subjectf("alias %s", alias))
-			}
-			err = p.setConfigField(&config, label, value, wildcardLabelPrefix)
-			if err != nil {
-				ne.ExtraError(NewNestedErrorFrom(err).Subjectf("alias %s", alias))
-			}
-		}
-		if config.Port == "" {
-			config.Port = fmt.Sprintf("%d", selectPort(container, isRemote))
-		}
-		if config.Port == "0" {
-			l.Infof("no ports exposed, ignored")
-			continue
-		}
-		if config.Scheme == "" {
-			switch {
-			case strings.HasSuffix(config.Port, "443"):
-				config.Scheme = "https"
-			case strings.HasPrefix(container.Image, "sha256:"):
-				config.Scheme = "http"
-			default:
-				imageName := getImageName(container)
-				_, isKnownImage := ImageNamePortMapTCP[imageName]
-				if isKnownImage {
-					config.Scheme = "tcp"
-				} else {
-					config.Scheme = "http"
-				}
-			}
-		}
-		if !isValidScheme(config.Scheme) {
-			ne.Extra("unsupported scheme").Subject(config.Scheme)
-		}
-
-		if isRemote && strings.HasPrefix(config.Port, "*") {
-			var err error
-			// find matching port
-			srcPort := config.Port[1:]
-			config.Port, err = findMatchingContainerPort(container,srcPort)
-			if err != nil {
-				ne.ExtraError(NewNestedErrorFrom(err).Subjectf("alias %s", alias))
-			}
-			if isStreamScheme(config.Scheme) {
-				config.Port = fmt.Sprintf("%s:%s", srcPort, config.Port)
-			}
-		}
-		
-		
-		if config.Host == "" {
-			switch {
-			case isRemote:
-				config.Host = clientIP
-			case container.HostConfig.NetworkMode == "host":
-				config.Host = "host.docker.internal"
-			case config.LoadBalance == "true", config.LoadBalance == "1":
-				for _, network := range container.NetworkSettings.Networks {
-					config.Host = network.IPAddress
-					break
-				}
-			default:
-				for _, network := range container.NetworkSettings.Networks {
-					for _, alias := range network.Aliases {
-						config.Host = alias
-						break
-					}
-				}
-			}
-		}
-		if config.Host == "" {
-			config.Host = containerName
-		}
-		config.Alias = alias
-
-		if ne.HasExtras() {
-			l.Error(ne)
-			continue
-		}
-		cfgs = append(cfgs, config)
-	}
-	return cfgs
-}
-
-func (p *Provider) getDockerClient() (*client.Client, error) {
-	var dockerOpts []client.Opt
-	if p.Value == clientUrlFromEnv {
-		dockerOpts = []client.Opt{
-			client.WithHostFromEnv(),
-			client.WithAPIVersionNegotiation(),
-		}
-	} else {
-		helper, err := connhelper.GetConnectionHelper(p.Value)
-		if err != nil {
-			p.l.Fatal("unexpected error: ", err)
-		}
-		if helper != nil {
-			httpClient := &http.Client{
-				Transport: &http.Transport{
-					DialContext: helper.Dialer,
-				},
-			}
-			dockerOpts = []client.Opt{
-				client.WithHTTPClient(httpClient),
-				client.WithHost(helper.Host),
-				client.WithAPIVersionNegotiation(),
-				client.WithDialContext(helper.Dialer),
-			}
-		} else {
-			dockerOpts = []client.Opt{
-				client.WithHost(p.Value),
-				client.WithAPIVersionNegotiation(),
-			}
-		}
-	}
-	return client.NewClientWithOpts(dockerOpts...)
-}
-
-func (p *Provider) getDockerProxyConfigs() (ProxyConfigSlice, error) {
-	var clientIP string
-
-	if p.Value == clientUrlFromEnv {
-		clientIP = ""
-	} else {
-		url, err := client.ParseHostURL(p.Value)
-		if err != nil {
-			return nil, NewNestedError("invalid host url").Subject(p.Value).With(err)
-		}
-		clientIP = strings.Split(url.Host, ":")[0]
-	}
-
-	dockerClient, err := p.getDockerClient()
-
-	if err != nil {
-		return nil, NewNestedError("unable to create docker client").With(err)
-	}
-
-	ctx, _ := context.WithTimeout(context.Background(), 3*time.Second)
-	containerSlice, err := dockerClient.ContainerList(ctx, container.ListOptions{All: true})
-
-	if err != nil {
-		return nil, NewNestedError("unable to list containers").With(err)
-	}
-
-	cfgs := make(ProxyConfigSlice, 0)
-
-	for _, container := range containerSlice {
-		cfgs = append(cfgs, p.getContainerProxyConfigs(&container, clientIP)...)
-	}
-
-	return cfgs, nil
-}
-
-// var dockerUrlRegex = regexp.MustCompile(`^(?P<scheme>\w+)://(?P<host>[^:]+)(?P<port>:\d+)?(?P<path>/.*)?$`)
-func getImageName(c *types.Container) string {
-	imageSplit := strings.Split(c.Image, "/")
-	imageSplit = strings.Split(imageSplit[len(imageSplit)-1], ":")
-	return imageSplit[0]
-}
-
-func getPublicPort(p types.Port) uint16  { return p.PublicPort }
-func getPrivatePort(p types.Port) uint16 { return p.PrivatePort }
-
-func selectPort(c *types.Container, isRemote bool) uint16 {
-	if isRemote || c.HostConfig.NetworkMode == "host" {
-		return selectPortInternal(c, getPublicPort)
-	}
-	return selectPortInternal(c, getPrivatePort)
-}
-
-// used when isRemote is true
-func findMatchingContainerPort(c *types.Container, ps string) (string, error) {
-	p, err := strconv.Atoi(ps)
-	if err != nil {
-		return "", err
-	}
-	pWant := uint16(p)
-	for _, pGot := range c.Ports {
-		if pGot.PrivatePort == pWant {
-			return fmt.Sprintf("%d", pGot.PublicPort), nil
-		}
-	}
-	return "", fmt.Errorf("port %d not found", p)
-}
-
-func selectPortInternal(c *types.Container, getPort func(types.Port) uint16) uint16 {
-	imageName := getImageName(c)
-	// if is known image -> use known port
-	if port, isKnown := ImageNamePortMapHTTP[imageName]; isKnown {
-		for _, p := range c.Ports {
-			if p.PrivatePort == port {
-				return getPort(p)
-			}
-		}
-	}
-	// if it has known http port -> use it
-	for _, p := range c.Ports {
-		if isWellKnownHTTPPort(p.PrivatePort) {
-			return getPort(p)
-		}
-	}
-	// if it has any port -> use it
-	for _, p := range c.Ports {
-		if port := getPort(p); port != 0 {
-			return port
-		}
-	}
-	return 0
-}
-
-func isWellKnownHTTPPort(port uint16) bool {
-	_, ok := wellKnownHTTPPorts[port]
-	return ok
-}
--- a/src/go-proxy/error.go
+++ b/src/go-proxy/error.go
@@ -1,194 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"strings"
-	"sync"
-)
-
-type NestedError struct {
-	subject string
-	message string
-	extras  []string
-	inner   *NestedError
-	level   int
-
-	sync.Mutex
-}
-
-type NestedErrorLike interface {
-	Error() string
-	Inner() NestedErrorLike
-	Level() int
-	HasInner() bool
-	HasExtras() bool
-
-	Extra(string) NestedErrorLike
-	Extraf(string, ...any) NestedErrorLike
-	ExtraError(error) NestedErrorLike
-	Subject(string) NestedErrorLike
-	Subjectf(string, ...any) NestedErrorLike
-	With(error) NestedErrorLike
-
-	addLevel(int) NestedErrorLike
-	copy() *NestedError
-}
-
-func NewNestedError(message string) NestedErrorLike {
-	return &NestedError{message: message, extras: make([]string, 0)}
-}
-
-func NewNestedErrorf(format string, args ...any) NestedErrorLike {
-	return NewNestedError(fmt.Sprintf(format, args...))
-}
-
-func NewNestedErrorFrom(err error) NestedErrorLike {
-	if err == nil {
-		panic("cannot convert nil error to NestedError")
-	}
-	return NewNestedError(err.Error())
-}
-
-func (ne *NestedError) Extra(s string) NestedErrorLike {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return ne
-	}
-	ne.Lock()
-	defer ne.Unlock()
-	ne.extras = append(ne.extras, s)
-	return ne
-}
-
-func (ne *NestedError) Extraf(format string, args ...any) NestedErrorLike {
-	return ne.Extra(fmt.Sprintf(format, args...))
-}
-
-func (ne *NestedError) ExtraError(e error) NestedErrorLike {
-	switch t := e.(type) {
-	case NestedErrorLike:
-		extra := t.copy()
-		extra.addLevel(ne.Level() + 1)
-		e = extra
-	}
-	return ne.Extra(e.Error())
-}
-
-func (ne *NestedError) Subject(s string) NestedErrorLike {
-	ne.subject = s
-	return ne
-}
-
-func (ne *NestedError) Subjectf(format string, args ...any) NestedErrorLike {
-	ne.subject = fmt.Sprintf(format, args...)
-	return ne
-}
-
-func (ne *NestedError) Inner() NestedErrorLike {
-	return ne.inner
-}
-
-func (ne *NestedError) Level() int {
-	return ne.level
-}
-
-func (ef *NestedError) Error() string {
-	var buf strings.Builder
-	ef.writeToSB(&buf, "")
-	return buf.String()
-}
-
-func (ef *NestedError) HasInner() bool {
-	return ef.inner != nil
-}
-
-func (ef *NestedError) HasExtras() bool {
-	return len(ef.extras) > 0
-}
-
-func (ef *NestedError) With(inner error) NestedErrorLike {
-	ef.Lock()
-	defer ef.Unlock()
-
-	var in *NestedError
-
-	switch t := inner.(type) {
-	case NestedErrorLike:
-		in = t.copy()
-	default:
-		in = &NestedError{extras: []string{t.Error()}}
-	}
-	if ef.inner == nil {
-		ef.inner = in
-	} else {
-		ef.inner.ExtraError(in)
-	}
-	root := ef
-	for root.inner != nil {
-		root.inner.level = root.level + 1
-		root = root.inner
-	}
-	return ef
-}
-
-func (ef *NestedError) addLevel(level int) NestedErrorLike {
-	ef.level += level
-	if ef.inner != nil {
-		ef.inner.addLevel(level)
-	}
-	return ef
-}
-
-func (ef *NestedError) copy() *NestedError {
-	var inner *NestedError
-	if ef.inner != nil {
-		inner = ef.inner.copy()
-	}
-	return &NestedError{
-		subject: ef.subject,
-		message: ef.message,
-		extras:  ef.extras,
-		inner:   inner,
-		level:   ef.level,
-	}
-}
-
-func (ef *NestedError) writeIndents(sb *strings.Builder, level int) {
-	for i := 0; i < level; i++ {
-		sb.WriteString("  ")
-	}
-}
-
-func (ef *NestedError) writeToSB(sb *strings.Builder, prefix string) {
-	ef.writeIndents(sb, ef.level)
-	sb.WriteString(prefix)
-
-	if ef.subject != "" {
-		sb.WriteRune('"')
-		sb.WriteString(ef.subject)
-		sb.WriteRune('"')
-		if ef.message != "" {
-			sb.WriteString(":\n")
-		} else {
-			sb.WriteRune('\n')
-		}
-	}
-	if ef.message != "" {
-		ef.writeIndents(sb, ef.level)
-		sb.WriteString(ef.message)
-		sb.WriteRune('\n')
-	}
-	for _, l := range ef.extras {
-		l = strings.TrimSpace(l)
-		if l == "" {
-			continue
-		}
-		ef.writeIndents(sb, ef.level)
-		sb.WriteString("- ")
-		sb.WriteString(l)
-		sb.WriteRune('\n')
-	}
-	if ef.inner != nil {
-		ef.inner.writeToSB(sb, "- ")
-	}
-}
--- a/src/go-proxy/file_provider.go
+++ b/src/go-proxy/file_provider.go
@@ -1,54 +0,0 @@
-package main
-
-import (
-	"os"
-	"path"
-
-	"gopkg.in/yaml.v3"
-)
-
-func (p *Provider) GetFilePath() string {
-	return path.Join(configBasePath, p.Value)
-}
-
-func (p *Provider) ValidateFile() (ProxyConfigSlice, error) {
-	path := p.GetFilePath()
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return nil, NewNestedError("unable to read providers file").Subject(path).With(err)
-	}
-	result, err := ValidateFileContent(data)
-	if err != nil {
-		return nil, NewNestedError(err.Error()).Subject(path)
-	}
-	return result, nil
-}
-
-func ValidateFileContent(data []byte) (ProxyConfigSlice, error) {
-	configMap := make(ProxyConfigMap, 0)
-	if err := yaml.Unmarshal(data, &configMap); err != nil {
-		return nil, NewNestedError("invalid yaml").With(err)
-	}
-
-	ne := NewNestedError("errors in providers")
-
-	configs := make(ProxyConfigSlice, len(configMap))
-	i := 0
-	for alias, cfg := range configMap {
-		cfg.Alias = alias
-		if err := cfg.SetDefaults(); err != nil {
-			ne.ExtraError(err)
-		} else {
-			configs[i] = cfg
-		}
-		i++
-	}
-
-	if err := validateYaml(providersSchema, data); err != nil {
-		ne.ExtraError(err)
-	}
-	if ne.HasExtras() {
-		return nil, ne
-	}
-	return configs, nil
-}
--- a/src/go-proxy/functional.go
+++ b/src/go-proxy/functional.go
@@ -1,39 +0,0 @@
-package main
-
-import "sync"
-
-func ParallelForEach[T interface{}](obj []T, do func(T)) {
-	var wg sync.WaitGroup
-	wg.Add(len(obj))
-	for _, v := range obj {
-		go func(v T) {
-			do(v)
-			wg.Done()
-		}(v)
-	}
-	wg.Wait()
-}
-
-func ParallelForEachValue[K comparable, V interface{}](obj map[K]V, do func(V)) {
-	var wg sync.WaitGroup
-	wg.Add(len(obj))
-	for _, v := range obj {
-		go func(v V) {
-			do(v)
-			wg.Done()
-		}(v)
-	}
-	wg.Wait()
-}
-
-func ParallelForEachKeyValue[K comparable, V interface{}](obj map[K]V, do func(K, V)) {
-	var wg sync.WaitGroup
-	wg.Add(len(obj))
-	for k, v := range obj {
-		go func(k K, v V) {
-			do(k, v)
-			wg.Done()
-		}(k, v)
-	}
-	wg.Wait()
-}
--- a/src/go-proxy/http_lbpool.go
+++ b/src/go-proxy/http_lbpool.go
@@ -1,29 +0,0 @@
-package main
-
-import "sync/atomic"
-
-type httpLoadBalancePool struct {
-	pool        []*HTTPRoute
-	curentIndex atomic.Int32
-}
-
-func NewHTTPLoadBalancePool() *httpLoadBalancePool {
-	return &httpLoadBalancePool{
-		pool: make([]*HTTPRoute, 0),
-	}
-}
-
-func (p *httpLoadBalancePool) Add(route *HTTPRoute) {
-	p.pool = append(p.pool, route)
-}
-
-func (p *httpLoadBalancePool) Iterator() []*HTTPRoute {
-	return p.pool
-}
-
-func (p *httpLoadBalancePool) Pick() *HTTPRoute {
-	// round-robin
-	index := int(p.curentIndex.Load())
-	defer p.curentIndex.Add(1)
-	return p.pool[index%len(p.pool)]
-}
--- a/src/go-proxy/http_route.go
+++ b/src/go-proxy/http_route.go
@@ -1,162 +0,0 @@
-package main
-
-import (
-	"fmt"
-
-	"net/http"
-	"net/url"
-	"strings"
-
-	"github.com/sirupsen/logrus"
-)
-
-type HTTPRoute struct {
-	Alias    string
-	Url      *url.URL
-	Path     string
-	PathMode string
-	Proxy    *ReverseProxy
-
-	l logrus.FieldLogger
-}
-
-func NewHTTPRoute(config *ProxyConfig) (*HTTPRoute, error) {
-	u := fmt.Sprintf("%s://%s:%s", config.Scheme, config.Host, config.Port)
-	url, err := url.Parse(u)
-	if err != nil {
-		return nil, NewNestedErrorf("invalid url").Subject(u).With(err)
-	}
-
-	var tr *http.Transport
-	if config.NoTLSVerify {
-		tr = transportNoTLS
-	} else {
-		tr = transport
-	}
-
-	proxy := NewSingleHostReverseProxy(url, tr)
-
-	route := &HTTPRoute{
-		Alias:    config.Alias,
-		Url:      url,
-		Path:     config.Path,
-		Proxy:    proxy,
-		PathMode: config.PathMode,
-		l: hrlog.WithFields(logrus.Fields{
-			"alias":     config.Alias,
-			// "path":      config.Path,
-			// "path_mode": config.PathMode,
-		}),
-	}
-
-	var rewriteBegin = proxy.Rewrite
-	var rewrite func(*ProxyRequest)
-	var modifyResponse func(*http.Response) error
-
-	switch {
-	case config.Path == "", config.PathMode == ProxyPathMode_Forward:
-		rewrite = rewriteBegin
-	case config.PathMode == ProxyPathMode_RemovedPath:
-		rewrite = func(pr *ProxyRequest) {
-			rewriteBegin(pr)
-			pr.Out.URL.Path = strings.TrimPrefix(pr.Out.URL.Path, config.Path)
-		}
-	case config.PathMode == ProxyPathMode_Sub:
-		rewrite = func(pr *ProxyRequest) {
-			rewriteBegin(pr)
-			// disable compression
-			pr.Out.Header.Set("Accept-Encoding", "identity")
-			// remove path prefix
-			pr.Out.URL.Path = strings.TrimPrefix(pr.Out.URL.Path, config.Path)
-		}
-		modifyResponse = config.pathSubModResp
-	default:
-		return nil, NewNestedError("invalid path mode").Subject(config.PathMode)
-	}
-
-	if logLevel == logrus.DebugLevel {
-		route.Proxy.Rewrite = func(pr *ProxyRequest) {
-			rewrite(pr)
-			route.l.Debug("request URL: ", pr.In.Host, pr.In.URL.Path)
-			route.l.Debug("request headers: ", pr.In.Header)
-		}
-		route.Proxy.ModifyResponse = func(r *http.Response) error {
-			route.l.Debug("response URL: ", r.Request.URL.String())
-			route.l.Debug("response headers: ", r.Header)
-			if modifyResponse != nil {
-				return modifyResponse(r)
-			}
-			return nil
-		}
-	} else {
-		route.Proxy.Rewrite = rewrite
-	}
-
-	return route, nil
-}
-
-func (r *HTTPRoute) Start() {
-	// dummy
-}
-func (r *HTTPRoute) Stop() {
-	httpRoutes.Delete(r.Alias)
-}
-
-func redirectToTLSHandler(w http.ResponseWriter, r *http.Request) {
-	// Redirect to the same host but with HTTPS
-	var redirectCode int
-	if r.Method == http.MethodGet {
-		redirectCode = http.StatusMovedPermanently
-	} else {
-		redirectCode = http.StatusPermanentRedirect
-	}
-	http.Redirect(w, r, fmt.Sprintf("https://%s%s?%s", r.Host, r.URL.Path, r.URL.RawQuery), redirectCode)
-}
-
-func findHTTPRoute(host string, path string) (*HTTPRoute, error) {
-	subdomain := strings.Split(host, ".")[0]
-	routeMap, ok := httpRoutes.UnsafeGet(subdomain)
-	if ok {
-		return routeMap.FindMatch(path)
-	}
-	return nil, NewNestedError("no matching route for subdomain").Subject(subdomain)
-}
-
-func proxyHandler(w http.ResponseWriter, r *http.Request) {
-	route, err := findHTTPRoute(r.Host, r.URL.Path)
-	if err != nil {
-		http.Error(w, "404 Not Found", http.StatusNotFound)
-		err = NewNestedError("request failed").
-			Subjectf("%s %s%s", r.Method, r.Host, r.URL.Path).
-			With(err)
-		logrus.Error(err)
-		return
-	}
-	route.Proxy.ServeHTTP(w, r)
-}
-
-func (config *ProxyConfig) pathSubModResp(r *http.Response) error {
-	contentType, ok := r.Header["Content-Type"]
-	if !ok || len(contentType) == 0 {
-		return nil
-	}
-	// disable cache
-	r.Header.Set("Cache-Control", "no-store")
-
-	var err error = nil
-	switch {
-	case strings.HasPrefix(contentType[0], "text/html"):
-		err = utils.respHTMLSubPath(r, config.Path)
-	case strings.HasPrefix(contentType[0], "application/javascript"):
-		err = utils.respJSSubPath(r, config.Path)
-	}
-	if err != nil {
-		err = NewNestedError("failed to remove path prefix").Subject(config.Path).With(err)
-	}
-	return err
-}
-
-// alias -> (path -> routes)
-type HTTPRoutes SafeMap[string, pathPoolMap]
-
-var httpRoutes HTTPRoutes = NewSafeMapOf[HTTPRoutes](newPathPoolMap)
--- a/src/go-proxy/io.go
+++ b/src/go-proxy/io.go
@@ -1,127 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"sync/atomic"
-)
-
-type Reader interface {
-	Read() ([]byte, error)
-}
-
-type FileReader struct {
-	Path string
-}
-
-func (r *FileReader) Read() ([]byte, error) {
-	return os.ReadFile(r.Path)
-}
-
-type ByteReader struct {
-	Data []byte
-}
-
-func (r *ByteReader) Read() ([]byte, error) {
-	return r.Data, nil
-}
-
-type ReadCloser struct {
-	ctx    context.Context
-	r      io.ReadCloser
-	closed atomic.Bool
-}
-
-func (r *ReadCloser) Read(p []byte) (int, error) {
-	select {
-	case <-r.ctx.Done():
-		return 0, r.ctx.Err()
-	default:
-		return r.r.Read(p)
-	}
-}
-
-func (r *ReadCloser) Close() error {
-	if r.closed.Load() {
-		return nil
-	}
-	r.closed.Store(true)
-	return r.r.Close()
-}
-
-type Pipe struct {
-	r      ReadCloser
-	w      io.WriteCloser
-	ctx    context.Context
-	cancel context.CancelFunc
-}
-
-func NewPipe(ctx context.Context, r io.ReadCloser, w io.WriteCloser) *Pipe {
-	ctx, cancel := context.WithCancel(ctx)
-	return &Pipe{
-		r:      ReadCloser{ctx: ctx, r: r},
-		w:      w,
-		ctx:    ctx,
-		cancel: cancel,
-	}
-}
-
-func (p *Pipe) Start() error {
-	return Copy(p.ctx, p.w, &p.r)
-}
-
-func (p *Pipe) Stop() error {
-	p.cancel()
-	return errors.Join(fmt.Errorf("read: %w", p.r.Close()), fmt.Errorf("write: %w", p.w.Close()))
-}
-
-func (p *Pipe) Write(b []byte) (int, error) {
-	return p.w.Write(b)
-}
-
-type BidirectionalPipe struct {
-	pSrcDst Pipe
-	pDstSrc Pipe
-}
-
-func NewBidirectionalPipe(ctx context.Context, rw1 io.ReadWriteCloser, rw2 io.ReadWriteCloser) *BidirectionalPipe {
-	return &BidirectionalPipe{
-		pSrcDst: *NewPipe(ctx, rw1, rw2),
-		pDstSrc: *NewPipe(ctx, rw2, rw1),
-	}
-}
-
-func NewBidirectionalPipeIntermediate(ctx context.Context, listener io.ReadCloser, client io.ReadWriteCloser, target io.ReadWriteCloser) *BidirectionalPipe {
-	return &BidirectionalPipe{
-		pSrcDst: *NewPipe(ctx, listener, client),
-		pDstSrc: *NewPipe(ctx, client, target),
-	}
-}
-
-func (p *BidirectionalPipe) Start() error {
-	errCh := make(chan error, 2)
-	go func() {
-		errCh <- p.pSrcDst.Start()
-	}()
-	go func() {
-		errCh <- p.pDstSrc.Start()
-	}()
-	for err := range errCh {
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (p *BidirectionalPipe) Stop() error {
-	return errors.Join(p.pSrcDst.Stop(), p.pDstSrc.Stop())
-}
-
-func Copy(ctx context.Context, dst io.WriteCloser, src io.ReadCloser) error {
-	_, err := io.Copy(dst, &ReadCloser{ctx: ctx, r: src})
-	return err
-}
--- a/src/go-proxy/loggers.go
+++ b/src/go-proxy/loggers.go
@@ -1,11 +0,0 @@
-package main
-
-import "github.com/sirupsen/logrus"
-
-var palog = logrus.WithField("component", "panel")
-var prlog = logrus.WithField("component", "provider")
-var cfgl = logrus.WithField("component", "config")
-var hrlog = logrus.WithField("component", "http_proxy")
-var srlog = logrus.WithField("component", "stream")
-var wlog = logrus.WithField("component", "watcher")
-var aclog = logrus.WithField("component", "autocert")
--- a/src/go-proxy/main.go
+++ b/src/go-proxy/main.go
@@ -1,135 +0,0 @@
-package main
-
-import (
-	"net/http"
-	"os"
-	"os/signal"
-	"runtime"
-	"sync"
-	"syscall"
-	"time"
-
-	"github.com/sirupsen/logrus"
-)
-
-var cfg Config
-
-func main() {
-	runtime.GOMAXPROCS(runtime.NumCPU())
-
-	args := getArgs()
-
-	if isRunningAsService {
-		logrus.SetFormatter(&logrus.TextFormatter{
-			DisableColors:    true,
-			DisableTimestamp: true,
-			DisableSorting:   true,
-		})
-	} else {
-		logrus.SetFormatter(&logrus.TextFormatter{
-			ForceColors:     true,
-			DisableColors:   false,
-			DisableSorting:  true,
-			FullTimestamp:   true,
-			TimestampFormat: "01-02 15:04:05",
-		})
-	}
-
-	if args.Command == CommandReload {
-		err := utils.reloadServer()
-		if err != nil {
-			logrus.Fatal(err)
-		}
-		return
-	}
-
-	cfg = NewConfig(configPath)
-	cfg.MustLoad()
-
-	if args.Command == CommandValidate {
-		logrus.Printf("config OK")
-		return
-	}
-
-	autoCertProvider, err := cfg.GetAutoCertProvider()
-
-	if err != nil {
-		aclog.Warn(err)
-		autoCertProvider = nil // TODO: remove, it is expected to be nil if error is not nil, but it is not for now
-	}
-
-	var proxyServer *Server
-	var panelServer *Server
-
-	if autoCertProvider != nil {
-		ok := autoCertProvider.LoadCert()
-		if !ok {
-			if ne := autoCertProvider.ObtainCert(); ne != nil {
-				aclog.Fatal(ne)
-			}
-		}
-		for name, expiry := range autoCertProvider.GetExpiries() {
-			aclog.Infof("certificate %q: expire on %v", name, expiry)
-		}
-		go autoCertProvider.ScheduleRenewal()
-	}
-	proxyServer = NewServer(ServerOptions{
-		Name:            "proxy",
-		CertProvider:    autoCertProvider,
-		HTTPAddr:        ":80",
-		HTTPSAddr:       ":443",
-		Handler:         http.HandlerFunc(proxyHandler),
-		RedirectToHTTPS: cfg.Value().RedirectToHTTPS,
-	})
-	panelServer = NewServer(ServerOptions{
-		Name:            "panel",
-		CertProvider:    autoCertProvider,
-		HTTPAddr:        ":8080",
-		HTTPSAddr:       ":8443",
-		Handler:         panelHandler,
-		RedirectToHTTPS: cfg.Value().RedirectToHTTPS,
-	})
-
-	proxyServer.Start()
-	panelServer.Start()
-
-	InitFSWatcher()
-
-	cfg.StartProviders()
-	cfg.WatchChanges()
-
-	sig := make(chan os.Signal, 1)
-	signal.Notify(sig, syscall.SIGINT)
-	signal.Notify(sig, syscall.SIGTERM)
-	signal.Notify(sig, syscall.SIGHUP)
-
-	<-sig
-	logrus.Info("shutting down")
-	done := make(chan struct{}, 1)
-
-	var wg sync.WaitGroup
-	wg.Add(3)
-
-	go func() {
-		StopFSWatcher()
-		StopDockerWatcher()
-		cfg.StopProviders()
-		wg.Done()
-	}()
-	go func() {
-		panelServer.Stop()
-		proxyServer.Stop()
-		wg.Done()
-	}()
-	go func() {
-		wg.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		logrus.Info("shutdown complete")
-	case <-time.After(cfg.Value().TimeoutShutdown * time.Second):
-		logrus.Info("timeout waiting for shutdown")
-	}
-}
--- a/src/go-proxy/map.go
+++ b/src/go-proxy/map.go
@@ -1,98 +0,0 @@
-package main
-
-import "sync"
-
-type safeMap[KT comparable, VT interface{}] struct {
-	SafeMap[KT, VT]
-	m              map[KT]VT
-	defaultFactory func() VT
-	sync.RWMutex
-}
-
-type SafeMap[KT comparable, VT interface{}] interface {
-	Set(key KT, value VT)
-	Ensure(key KT)
-	Get(key KT) VT
-	UnsafeGet(key KT) (VT, bool)
-	Delete(key KT)
-	Clear()
-	Size() int
-	Contains(key KT) bool
-	ForEach(fn func(key KT, value VT))
-	Iterator() map[KT]VT
-}
-
-func NewSafeMapOf[T SafeMap[KT, VT], KT comparable, VT interface{}](df ...func() VT) SafeMap[KT, VT] {
-	if len(df) == 0 {
-		return &safeMap[KT, VT]{
-			m: make(map[KT]VT),
-		}
-	}
-	return &safeMap[KT, VT]{
-		m:              make(map[KT]VT),
-		defaultFactory: df[0],
-	}
-}
-
-func (m *safeMap[KT, VT]) Set(key KT, value VT) {
-	m.Lock()
-	m.m[key] = value
-	m.Unlock()
-}
-
-func (m *safeMap[KT, VT]) Ensure(key KT) {
-	m.Lock()
-	if _, ok := m.m[key]; !ok {
-		m.m[key] = m.defaultFactory()
-	}
-	m.Unlock()
-}
-
-func (m *safeMap[KT, VT]) Get(key KT) VT {
-	m.RLock()
-	value := m.m[key]
-	m.RUnlock()
-	return value
-}
-
-func (m *safeMap[KT, VT]) UnsafeGet(key KT) (VT, bool) {
-	value, ok := m.m[key]
-	return value, ok
-}
-
-func (m *safeMap[KT, VT]) Delete(key KT) {
-	m.Lock()
-	delete(m.m, key)
-	m.Unlock()
-}
-
-func (m *safeMap[KT, VT]) Clear() {
-	m.Lock()
-	m.m = make(map[KT]VT)
-	m.Unlock()
-}
-
-func (m *safeMap[KT, VT]) Size() int {
-	m.RLock()
-	defer m.RUnlock()
-	return len(m.m)
-}
-
-func (m *safeMap[KT, VT]) Contains(key KT) bool {
-	m.RLock()
-	_, ok := m.m[key]
-	m.RUnlock()
-	return ok
-}
-
-func (m *safeMap[KT, VT]) ForEach(fn func(key KT, value VT)) {
-	m.RLock()
-	for k, v := range m.m {
-		fn(k, v)
-	}
-	m.RUnlock()
-}
-
-func (m *safeMap[KT, VT]) Iterator() map[KT]VT {
-	return m.m
-}
--- a/src/go-proxy/panel.go
+++ b/src/go-proxy/panel.go
@@ -1,153 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"html/template"
-	"net/http"
-	"net/url"
-	"os"
-	"path"
-)
-
-var panelHandler = panelRouter()
-
-func panelRouter() *http.ServeMux {
-	mux := http.NewServeMux()
-	mux.HandleFunc("GET /{$}", panelServeFile)
-	mux.HandleFunc("GET /{file}", panelServeFile)
-	mux.HandleFunc("GET /panel/", panelPage)
-	mux.HandleFunc("GET /panel/{file}", panelServeFile)
-	mux.HandleFunc("HEAD /checkhealth", panelCheckTargetHealth)
-	mux.HandleFunc("GET /config_editor/", panelConfigEditor)
-	mux.HandleFunc("GET /config_editor/{file}", panelServeFile)
-	mux.HandleFunc("GET /config/{file}", panelConfigGet)
-	mux.HandleFunc("PUT /config/{file}", panelConfigUpdate)
-	mux.HandleFunc("POST /reload", configReload)
-	mux.HandleFunc("GET /codemirror/", panelServeFile)
-	return mux
-}
-
-func panelPage(w http.ResponseWriter, r *http.Request) {
-	resp := struct {
-		HTTPRoutes   HTTPRoutes
-		StreamRoutes StreamRoutes
-	}{httpRoutes, streamRoutes}
-
-	panelRenderFile(w, r, panelTemplatePath, resp)
-}
-
-func panelCheckTargetHealth(w http.ResponseWriter, r *http.Request) {
-	targetUrl := r.URL.Query().Get("target")
-
-	if targetUrl == "" {
-		panelHandleErr(w, r, errors.New("target is required"), http.StatusBadRequest)
-		return
-	}
-
-	url, err := url.Parse(targetUrl)
-	if err != nil {
-		err = NewNestedError("failed to parse url").Subject(targetUrl).With(err)
-		panelHandleErr(w, r, err, http.StatusBadRequest)
-		return
-	}
-	scheme := url.Scheme
-
-	if isStreamScheme(scheme) {
-		err = utils.healthCheckStream(scheme, url.Host)
-	} else {
-		err = utils.healthCheckHttp(targetUrl)
-	}
-
-	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-	} else {
-		w.WriteHeader(http.StatusOK)
-	}
-}
-
-func panelConfigEditor(w http.ResponseWriter, r *http.Request) {
-	cfgFiles := make([]string, 0)
-	cfgFiles = append(cfgFiles, path.Base(configPath))
-	for _, p := range cfg.Value().Providers {
-		if p.Kind != ProviderKind_File {
-			continue
-		}
-		cfgFiles = append(cfgFiles, p.Value)
-	}
-
-	panelRenderFile(w, r, configEditorTemplatePath, cfgFiles)
-}
-
-func panelConfigGet(w http.ResponseWriter, r *http.Request) {
-	http.ServeFile(w, r, path.Join(configBasePath, r.PathValue("file")))
-}
-
-func panelConfigUpdate(w http.ResponseWriter, r *http.Request) {
-	p := r.PathValue("file")
-	content := make([]byte, r.ContentLength)
-	_, err := r.Body.Read(content)
-	if err != nil {
-		panelHandleErr(w, r, NewNestedError("unable to read request body").Subject(p).With(err))
-		return
-	}
-	if p == path.Base(configPath) {
-		err = ValidateConfig(content)
-	} else {
-		_, err = ValidateFileContent(content)
-	}
-	if err != nil {
-		panelHandleErr(w, r, err)
-		return
-	}
-	p = path.Join(configBasePath, p)
-	_, err = os.Stat(p)
-	exists := !errors.Is(err, os.ErrNotExist)
-	err = os.WriteFile(p, content, 0644)
-	if err != nil {
-		panelHandleErr(w, r, NewNestedError("unable to write config file").With(err))
-		return
-	}
-	w.WriteHeader(http.StatusOK)
-	if !exists {
-		w.Write([]byte(fmt.Sprintf("Config file %s created, remember to add it to config.yml!", p)))
-		return
-	}
-	w.Write([]byte(fmt.Sprintf("Config file %s updated", p)))
-}
-
-func panelServeFile(w http.ResponseWriter, r *http.Request) {
-	http.ServeFile(w, r, path.Join(templatesBasePath, r.URL.Path))
-}
-
-func panelRenderFile(w http.ResponseWriter, r *http.Request, f string, data any) {
-	tmpl, err := template.ParseFiles(f)
-	if err != nil {
-		panelHandleErr(w, r, NewNestedError("unable to parse template").With(err))
-		return
-	}
-
-	err = tmpl.Execute(w, data)
-	if err != nil {
-		panelHandleErr(w, r, NewNestedError("unable to render template").With(err))
-	}
-}
-
-func configReload(w http.ResponseWriter, r *http.Request) {
-	err := cfg.Reload()
-	if err != nil {
-		panelHandleErr(w, r, err)
-		return
-	}
-	w.WriteHeader(http.StatusOK)
-}
-
-func panelHandleErr(w http.ResponseWriter, r *http.Request, err error, code ...int) {
-	err = NewNestedErrorFrom(err).Subjectf("%s %s", r.Method, r.URL)
-	palog.Error(err)
-	if len(code) > 0 {
-		http.Error(w, err.Error(), code[0])
-		return
-	}
-	http.Error(w, err.Error(), http.StatusInternalServerError)
-}
--- a/src/go-proxy/path_pool_map.go
+++ b/src/go-proxy/path_pool_map.go
@@ -1,27 +0,0 @@
-package main
-
-import (
-	"strings"
-)
-
-type pathPoolMap struct {
-	SafeMap[string, *httpLoadBalancePool]
-}
-
-func newPathPoolMap() pathPoolMap {
-	return pathPoolMap{NewSafeMapOf[pathPoolMap](NewHTTPLoadBalancePool)}
-}
-
-func (m pathPoolMap) Add(path string, route *HTTPRoute) {
-	m.Ensure(path)
-	m.Get(path).Add(route)
-}
-
-func (m pathPoolMap) FindMatch(pathGot string) (*HTTPRoute, NestedErrorLike) {
-	for pathWant, v := range m.Iterator() {
-		if strings.HasPrefix(pathGot, pathWant) {
-			return v.Pick(), nil
-		}
-	}
-	return nil, NewNestedError("no matching path").Subject(pathGot)
-}
--- a/src/go-proxy/provider.go
+++ b/src/go-proxy/provider.go
@@ -1,105 +0,0 @@
-package main
-
-import (
-	"sync"
-
-	"github.com/sirupsen/logrus"
-)
-
-type Provider struct {
-	Kind  string `json:"kind"` // docker, file
-	Value string `json:"value"`
-
-	watcher Watcher
-	routes  map[string]Route // id -> Route
-	mutex   sync.Mutex
-	l       logrus.FieldLogger
-}
-
-// Init is called after LoadProxyConfig
-func (p *Provider) Init(name string) error {
-	p.l = prlog.WithFields(logrus.Fields{"kind": p.Kind, "name": name})
-	defer p.initWatcher()
-
-	if err := p.loadProxyConfig(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *Provider) StartAllRoutes() {
-	ParallelForEachValue(p.routes, Route.Start)
-	p.watcher.Start()
-}
-
-func (p *Provider) StopAllRoutes() {
-	p.watcher.Stop()
-	ParallelForEachValue(p.routes, Route.Stop)
-	p.routes = nil
-}
-
-func (p *Provider) ReloadRoutes() {
-	p.mutex.Lock()
-	defer p.mutex.Unlock()
-
-	p.StopAllRoutes()
-	err := p.loadProxyConfig()
-	if err != nil {
-		p.l.Error("failed to reload routes: ", err)
-		return
-	}
-	p.StartAllRoutes()
-}
-
-func (p *Provider) loadProxyConfig() error {
-	var cfgs ProxyConfigSlice
-	var err error
-
-	switch p.Kind {
-	case ProviderKind_Docker:
-		cfgs, err = p.getDockerProxyConfigs()
-	case ProviderKind_File:
-		cfgs, err = p.ValidateFile()
-	default:
-		// this line should never be reached
-		return NewNestedError("unknown provider kind")
-	}
-
-	if err != nil {
-		return err
-	}
-	p.l.Infof("loaded %d proxy configurations", len(cfgs))
-
-	p.routes = make(map[string]Route, len(cfgs))
-	pErrs := NewNestedError("failed to create these routes")
-
-	for _, cfg := range cfgs {
-		r, err := NewRoute(&cfg)
-		if err != nil {
-			pErrs.ExtraError(NewNestedErrorFrom(err).Subject(cfg.Alias))
-			continue
-		}
-		p.routes[cfg.GetID()] = r
-	}
-
-	if pErrs.HasExtras() {
-		p.routes = nil
-		return pErrs
-	}
-	return nil
-}
-
-func (p *Provider) initWatcher() error {
-	switch p.Kind {
-	case ProviderKind_Docker:
-		dockerClient, err := p.getDockerClient()
-		if err != nil {
-			return NewNestedError("unable to create docker client").With(err)
-		}
-		p.watcher = NewDockerWatcher(dockerClient, p.ReloadRoutes)
-	case ProviderKind_File:
-		p.watcher = NewFileWatcher(p.GetFilePath(), p.ReloadRoutes, p.StopAllRoutes)
-	}
-	return nil
-}
--- a/src/go-proxy/proxy_config.go
+++ b/src/go-proxy/proxy_config.go
@@ -1,58 +0,0 @@
-package main
-
-import "fmt"
-
-type ProxyConfig struct {
-	Alias       string `yaml:"-" json:"-"`
-	Scheme      string `yaml:"scheme" json:"scheme"`
-	Host        string `yaml:"host" json:"host"`
-	Port        string `yaml:"port" json:"port"`
-	LoadBalance string `yaml:"-" json:"-"`                         // docker provider only
-	NoTLSVerify bool   `yaml:"no_tls_verify" json:"no_tls_verify"` // http proxy only
-	Path        string `yaml:"path" json:"path"`                   // http proxy only
-	PathMode    string `yaml:"path_mode" json:"path_mode"`         // http proxy only
-
-	provider *Provider
-}
-
-type ProxyConfigMap map[string]ProxyConfig
-type ProxyConfigSlice []ProxyConfig
-
-func NewProxyConfig(provider *Provider) ProxyConfig {
-	return ProxyConfig{
-		provider: provider,
-	}
-}
-
-// used by `GetFileProxyConfigs`
-func (cfg *ProxyConfig) SetDefaults() error {
-	err := NewNestedError("invalid proxy config").Subject(cfg.Alias)
-
-	if cfg.Alias == "" {
-		err.Extra("alias is required")
-	}
-	if cfg.Scheme == "" {
-		cfg.Scheme = "http"
-	}
-	if cfg.Host == "" {
-		err.Extra("host is required")
-	}
-	if cfg.Port == "" {
-		switch cfg.Scheme {
-		case "http":
-			cfg.Port = "80"
-		case "https":
-			cfg.Port = "443"
-		default:
-			err.Extraf("port is required for %s scheme", cfg.Scheme)
-		}
-	}
-	if err.HasExtras() {
-		return err
-	}
-	return nil
-}
-
-func (cfg *ProxyConfig) GetID() string {
-	return fmt.Sprintf("%s-%s-%s-%s-%s", cfg.Alias, cfg.Scheme, cfg.Host, cfg.Port, cfg.Path)
-}
--- a/src/go-proxy/route.go
+++ b/src/go-proxy/route.go
@@ -1,46 +0,0 @@
-package main
-
-type Route interface {
-	Start()
-	Stop()
-}
-
-func NewRoute(cfg *ProxyConfig) (Route, error) {
-	if isStreamScheme(cfg.Scheme) {
-		id := cfg.GetID()
-		if streamRoutes.Contains(id) {
-			return nil, NewNestedError("duplicated stream").Subject(cfg.Alias)
-		}
-		route, err := NewStreamRoute(cfg)
-		if err != nil {
-			return nil, NewNestedErrorFrom(err).Subject(cfg.Alias)
-		}
-		return route, nil
-	} else {
-		httpRoutes.Ensure(cfg.Alias)
-		route, err := NewHTTPRoute(cfg)
-		if err != nil {
-			return nil, NewNestedErrorFrom(err).Subject(cfg.Alias)
-		}
-		httpRoutes.Get(cfg.Alias).Add(cfg.Path, route)
-		return route, nil
-	}
-}
-
-func isValidScheme(s string) bool {
-	for _, v := range ValidSchemes {
-		if v == s {
-			return true
-		}
-	}
-	return false
-}
-
-func isStreamScheme(s string) bool {
-	for _, v := range StreamSchemes {
-		if v == s {
-			return true
-		}
-	}
-	return false
-}
--- a/src/go-proxy/server.go
+++ b/src/go-proxy/server.go
@@ -1,140 +0,0 @@
-package main
-
-import (
-	"crypto/tls"
-	"log"
-	"net/http"
-	"time"
-
-	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
-)
-
-type Server struct {
-	Name         string
-	KeyFile      string
-	CertFile     string
-	CertProvider AutoCertProvider
-	http         *http.Server
-	https        *http.Server
-	httpStarted  bool
-	httpsStarted bool
-}
-
-type ServerOptions struct {
-	Name            string
-	HTTPAddr        string
-	HTTPSAddr       string
-	CertProvider    AutoCertProvider
-	RedirectToHTTPS bool
-	Handler         http.Handler
-}
-
-type LogrusWrapper struct {
-	*logrus.Entry
-}
-
-func (l LogrusWrapper) Write(b []byte) (int, error) {
-	return l.Logger.WriterLevel(logrus.ErrorLevel).Write(b)
-}
-
-func NewServer(opt ServerOptions) *Server {
-	var httpHandler http.Handler
-	var s *Server
-	if opt.RedirectToHTTPS {
-		httpHandler = http.HandlerFunc(redirectToTLSHandler)
-	} else {
-		httpHandler = opt.Handler
-	}
-	logger := log.Default()
-	logger.SetOutput(LogrusWrapper{
-		logrus.WithFields(logrus.Fields{"component": "server", "name": opt.Name}),
-	})
-	if opt.CertProvider != nil {
-		s = &Server{
-			Name:         opt.Name,
-			CertProvider: opt.CertProvider,
-			http: &http.Server{
-				Addr:     opt.HTTPAddr,
-				Handler:  httpHandler,
-				ErrorLog: logger,
-			},
-			https: &http.Server{
-				Addr:     opt.HTTPSAddr,
-				Handler:  opt.Handler,
-				ErrorLog: logger,
-				TLSConfig: &tls.Config{
-					GetCertificate: opt.CertProvider.GetCert,
-				},
-			},
-		}
-	}
-	s = &Server{
-		Name:     opt.Name,
-		KeyFile:  keyFileDefault,
-		CertFile: certFileDefault,
-		http: &http.Server{
-			Addr:     opt.HTTPAddr,
-			Handler:  httpHandler,
-			ErrorLog: logger,
-		},
-		https: &http.Server{
-			Addr:     opt.HTTPSAddr,
-			Handler:  opt.Handler,
-			ErrorLog: logger,
-		},
-	}
-	if !s.certsOK() {
-		s.http.Handler = opt.Handler
-	}
-	return s
-}
-
-func (s *Server) Start() {
-	if s.http != nil {
-		s.httpStarted = true
-		logrus.Printf("starting http %s server on %s", s.Name, s.http.Addr)
-		go func() {
-			err := s.http.ListenAndServe()
-			s.handleErr("http", err)
-		}()
-	}
-
-	if s.https != nil && (s.CertProvider != nil || s.certsOK()) {
-		s.httpsStarted = true
-		logrus.Printf("starting https %s server on %s", s.Name, s.https.Addr)
-		go func() {
-			err := s.https.ListenAndServeTLS(s.CertFile, s.KeyFile)
-			s.handleErr("https", err)
-		}()
-	}
-}
-
-func (s *Server) Stop() {
-	ctx, _ := context.WithTimeout(context.Background(), 3*time.Second)
-
-	if s.httpStarted {
-		errHTTP := s.http.Shutdown(ctx)
-		s.handleErr("http", errHTTP)
-		s.httpStarted = false
-	}
-
-	if s.httpsStarted {
-		errHTTPS := s.https.Shutdown(ctx)
-		s.handleErr("https", errHTTPS)
-		s.httpsStarted = false
-	}
-}
-
-func (s *Server) handleErr(scheme string, err error) {
-	switch err {
-	case nil, http.ErrServerClosed:
-		return
-	default:
-		logrus.Fatalf("failed to start %s %s server: %v", scheme, s.Name, err)
-	}
-}
-
-func (s *Server) certsOK() bool {
-	return utils.fileOK(s.CertFile) && utils.fileOK(s.KeyFile)
-}
--- a/src/go-proxy/stream_route.go
+++ b/src/go-proxy/stream_route.go
@@ -1,238 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/sirupsen/logrus"
-)
-
-type StreamImpl interface {
-	Setup() error
-	Accept() (interface{}, error)
-	Handle(interface{}) error
-	CloseListeners()
-}
-
-type StreamRoute interface {
-	Route
-	ListeningUrl() string
-	TargetUrl() string
-	Logger() logrus.FieldLogger
-}
-
-type StreamRouteBase struct {
-	Alias           string // to show in panel
-	Type            string
-	ListeningScheme string
-	ListeningPort   int
-	TargetScheme    string
-	TargetHost      string
-	TargetPort      int
-
-	id      string
-	wg      sync.WaitGroup
-	stopCh  chan struct{}
-	connCh  chan interface{}
-	started bool
-	l       logrus.FieldLogger
-
-	StreamImpl
-}
-
-func newStreamRouteBase(config *ProxyConfig) (*StreamRouteBase, error) {
-	var streamType string = StreamType_TCP
-	var srcPort, dstPort string
-	var srcScheme, dstScheme string
-
-	portSplit := strings.Split(config.Port, ":")
-	if len(portSplit) != 2 {
-		cfgl.Warnf("invalid port %s, assuming it is target port", config.Port)
-		srcPort = "0"
-		dstPort = config.Port
-	} else {
-		srcPort = portSplit[0]
-		dstPort = portSplit[1]
-	}
-
-	if port, hasName := NamePortMapTCP[dstPort]; hasName {
-		dstPort = port
-	}
-
-	srcPortInt, err := strconv.Atoi(srcPort)
-	if err != nil {
-		return nil, NewNestedError("invalid stream source port").Subject(srcPort)
-	}
-
-	utils.markPortInUse(srcPortInt)
-
-	dstPortInt, err := strconv.Atoi(dstPort)
-	if err != nil {
-		return nil, NewNestedError("invalid stream target port").Subject(dstPort)
-	}
-
-	schemeSplit := strings.Split(config.Scheme, ":")
-	if len(schemeSplit) == 2 {
-		srcScheme = schemeSplit[0]
-		dstScheme = schemeSplit[1]
-	} else {
-		srcScheme = config.Scheme
-		dstScheme = config.Scheme
-	}
-
-	if srcScheme != dstScheme {
-		return nil, NewNestedError("unsupported").Subjectf("%v -> %v", srcScheme, dstScheme)
-	}
-
-	return &StreamRouteBase{
-		Alias:           config.Alias,
-		Type:            streamType,
-		ListeningScheme: srcScheme,
-		ListeningPort:   srcPortInt,
-		TargetScheme:    dstScheme,
-		TargetHost:      config.Host,
-		TargetPort:      dstPortInt,
-
-		id:      config.GetID(),
-		wg:      sync.WaitGroup{},
-		stopCh:  make(chan struct{}, 1),
-		connCh:  make(chan interface{}),
-		started: false,
-		l: srlog.WithFields(logrus.Fields{
-			"alias": config.Alias,
-			// "src":   fmt.Sprintf("%s://:%d", srcScheme, srcPortInt),
-			// "dst":   fmt.Sprintf("%s://%s:%d", dstScheme, config.Host, dstPortInt),
-		}),
-	}, nil
-}
-
-func NewStreamRoute(config *ProxyConfig) (StreamRoute, error) {
-	base, err := newStreamRouteBase(config)
-	if err != nil {
-		return nil, err
-	}
-	switch config.Scheme {
-	case StreamType_TCP:
-		base.StreamImpl = NewTCPRoute(base)
-	case StreamType_UDP:
-		base.StreamImpl = NewUDPRoute(base)
-	default:
-		return nil, NewNestedError("invalid stream type").Subject(config.Scheme)
-	}
-	return base, nil
-}
-
-func (route *StreamRouteBase) ListeningUrl() string {
-	return fmt.Sprintf("%s:%v", route.ListeningScheme, route.ListeningPort)
-}
-
-func (route *StreamRouteBase) TargetUrl() string {
-	return fmt.Sprintf("%s://%s:%v", route.TargetScheme, route.TargetHost, route.TargetPort)
-}
-
-func (route *StreamRouteBase) Logger() logrus.FieldLogger {
-	return route.l
-}
-
-func (route *StreamRouteBase) Start() {
-	route.wg.Wait()
-	route.ensurePort()
-	if err := route.Setup(); err != nil {
-		route.l.Errorf("failed to setup: %v", err)
-		return
-	}
-	route.started = true
-	streamRoutes.Set(route.id, route)
-	route.wg.Add(2)
-	go route.grAcceptConnections()
-	go route.grHandleConnections()
-}
-
-func (route *StreamRouteBase) Stop() {
-	if !route.started {
-		return
-	}
-	l := route.Logger()
-	l.Debug("stopping listening")
-	close(route.stopCh)
-	route.CloseListeners()
-
-	done := make(chan struct{}, 1)
-	go func() {
-		route.wg.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		l.Info("stopped listening")
-	case <-time.After(streamStopListenTimeout):
-		l.Error("timed out waiting for connections")
-	}
-
-	utils.unmarkPortInUse(route.ListeningPort)
-	streamRoutes.Delete(route.id)
-}
-
-func (route *StreamRouteBase) ensurePort() {
-	if route.ListeningPort == 0 {
-		freePort, err := utils.findUseFreePort(20000)
-		if err != nil {
-			route.l.Error(err)
-			return
-		}
-		route.ListeningPort = freePort
-		route.l.Info("listening on free port ", route.ListeningPort)
-		return
-	}
-	route.l.Info("listening on ", route.ListeningUrl())
-}
-
-func (route *StreamRouteBase) grAcceptConnections() {
-	defer route.wg.Done()
-
-	for {
-		select {
-		case <-route.stopCh:
-			return
-		default:
-			conn, err := route.Accept()
-			if err != nil {
-				select {
-				case <-route.stopCh:
-					return
-				default:
-					route.l.Error(err)
-					continue
-				}
-			}
-			route.connCh <- conn
-		}
-	}
-}
-
-func (route *StreamRouteBase) grHandleConnections() {
-	defer route.wg.Done()
-
-	for {
-		select {
-		case <-route.stopCh:
-			return
-		case conn := <-route.connCh:
-			go func() {
-				err := route.Handle(conn)
-				if err != nil {
-					route.l.Error(err)
-				}
-			}()
-		}
-	}
-}
-
-// id    -> target
-type StreamRoutes SafeMap[string, StreamRoute]
-
-var streamRoutes StreamRoutes = NewSafeMapOf[StreamRoutes]()
--- a/src/go-proxy/tcp_route.go
+++ b/src/go-proxy/tcp_route.go
@@ -1,83 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"sync"
-	"time"
-)
-
-const tcpDialTimeout = 5 * time.Second
-
-type Pipes []*BidirectionalPipe
-
-type TCPRoute struct {
-	*StreamRouteBase
-	listener net.Listener
-	pipe     Pipes
-	mu       sync.Mutex
-}
-
-func NewTCPRoute(base *StreamRouteBase) StreamImpl {
-	return &TCPRoute{
-		StreamRouteBase: base,
-		listener:        nil,
-		pipe:            make(Pipes, 0),
-	}
-}
-
-func (route *TCPRoute) Setup() error {
-	in, err := net.Listen("tcp", fmt.Sprintf(":%v", route.ListeningPort))
-	if err != nil {
-		return err
-	}
-	route.listener = in
-	return nil
-}
-
-func (route *TCPRoute) Accept() (interface{}, error) {
-	return route.listener.Accept()
-}
-
-func (route *TCPRoute) Handle(c interface{}) error {
-	clientConn := c.(net.Conn)
-
-	defer clientConn.Close()
-
-	ctx, cancel := context.WithTimeout(context.Background(), tcpDialTimeout)
-	defer cancel()
-
-	serverAddr := fmt.Sprintf("%s:%v", route.TargetHost, route.TargetPort)
-	dialer := &net.Dialer{}
-
-	serverConn, err := dialer.DialContext(ctx, route.TargetScheme, serverAddr)
-	if err != nil {
-		return err
-	}
-
-	pipeCtx, pipeCancel := context.WithCancel(context.Background())
-	go func() {
-		<-route.stopCh
-		pipeCancel()
-	}()
-
-	route.mu.Lock()
-	pipe := NewBidirectionalPipe(pipeCtx, clientConn, serverConn)
-	route.pipe = append(route.pipe, pipe)
-	route.mu.Unlock()
-	return pipe.Start()
-}
-
-func (route *TCPRoute) CloseListeners() {
-	if route.listener == nil {
-		return
-	}
-	route.listener.Close()
-	route.listener = nil
-	for _, pipe := range route.pipe {
-		if err := pipe.Stop(); err != nil {
-			route.l.Error(err)
-		}
-	}
-}
--- a/src/go-proxy/udp_route.go
+++ b/src/go-proxy/udp_route.go
@@ -1,131 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"sync"
-)
-
-type UDPRoute struct {
-	*StreamRouteBase
-
-	connMap      UDPConnMap
-	connMapMutex sync.Mutex
-
-	listeningConn *net.UDPConn
-	targetAddr    *net.UDPAddr
-}
-
-type UDPConn struct {
-	src *net.UDPConn
-	dst *net.UDPConn
-	*BidirectionalPipe
-}
-
-type UDPConnMap map[string]*UDPConn
-
-func NewUDPRoute(base *StreamRouteBase) StreamImpl {
-	return &UDPRoute{
-		StreamRouteBase: base,
-		connMap:         make(UDPConnMap),
-	}
-}
-
-func (route *UDPRoute) Setup() error {
-	laddr, err := net.ResolveUDPAddr(route.ListeningScheme, fmt.Sprintf(":%v", route.ListeningPort))
-	if err != nil {
-		return err
-	}
-	source, err := net.ListenUDP(route.ListeningScheme, laddr)
-	if err != nil {
-		return err
-	}
-	raddr, err := net.ResolveUDPAddr(route.TargetScheme, fmt.Sprintf("%s:%v", route.TargetHost, route.TargetPort))
-	if err != nil {
-		source.Close()
-		return err
-	}
-
-	route.listeningConn = source
-	route.targetAddr = raddr
-	return nil
-}
-
-func (route *UDPRoute) Accept() (interface{}, error) {
-	in := route.listeningConn
-
-	buffer := make([]byte, udpBufferSize)
-	nRead, srcAddr, err := in.ReadFromUDP(buffer)
-
-	if err != nil {
-		return nil, err
-	}
-
-	if nRead == 0 {
-		return nil, io.ErrShortBuffer
-	}
-
-	key := srcAddr.String()
-	conn, ok := route.connMap[key]
-
-	if !ok {
-		route.connMapMutex.Lock()
-		if conn, ok = route.connMap[key]; !ok {
-			srcConn, err := net.DialUDP("udp", nil, srcAddr)
-			if err != nil {
-				return nil, err
-			}
-			dstConn, err := net.DialUDP("udp", nil, route.targetAddr)
-			if err != nil {
-				srcConn.Close()
-				return nil, err
-			}
-			pipeCtx, pipeCancel := context.WithCancel(context.Background())
-			go func() {
-				<-route.stopCh
-				pipeCancel()
-			}()
-			conn = &UDPConn{
-				srcConn,
-				dstConn,
-				NewBidirectionalPipe(pipeCtx, sourceRWCloser{in, dstConn}, sourceRWCloser{in, srcConn}),
-			}
-			route.connMap[key] = conn
-		}
-		route.connMapMutex.Unlock()
-	}
-
-	_, err = conn.dst.Write(buffer[:nRead])
-	return conn, err
-}
-
-func (route *UDPRoute) Handle(c interface{}) error {
-	return c.(*UDPConn).Start()
-}
-
-func (route *UDPRoute) CloseListeners() {
-	if route.listeningConn != nil {
-		route.listeningConn.Close()
-		route.listeningConn = nil
-	}
-	for _, conn := range route.connMap {
-		if err := conn.src.Close(); err != nil {
-			route.l.Errorf("error closing src conn: %w", err)
-		}
-		if err := conn.dst.Close(); err != nil {
-			route.l.Error("error closing dst conn: %w", err)
-		}
-	}
-	route.connMap = make(UDPConnMap)
-}
-
-type sourceRWCloser struct {
-	server *net.UDPConn
-	*net.UDPConn
-}
-
-func (w sourceRWCloser) Write(p []byte) (int, error) {
-	return w.server.WriteToUDP(p, w.RemoteAddr().(*net.UDPAddr)) // TODO: support non udp
-}
--- a/src/go-proxy/utils.go
+++ b/src/go-proxy/utils.go
@@ -1,244 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"os"
-	"path"
-	"path/filepath"
-	"reflect"
-	"regexp"
-	"strings"
-	"sync"
-
-	"github.com/santhosh-tekuri/jsonschema"
-	"github.com/sirupsen/logrus"
-	xhtml "golang.org/x/net/html"
-	"gopkg.in/yaml.v3"
-)
-
-type Utils struct {
-	portsInUse      map[int]bool
-	portsInUseMutex sync.Mutex
-}
-
-var utils = &Utils{
-	portsInUse:      make(map[int]bool),
-	portsInUseMutex: sync.Mutex{},
-}
-
-func (u *Utils) findUseFreePort(startingPort int) (int, error) {
-	u.portsInUseMutex.Lock()
-	defer u.portsInUseMutex.Unlock()
-	for port := startingPort; port <= startingPort+100 && port <= 65535; port++ {
-		if u.portsInUse[port] {
-			continue
-		}
-		addr := fmt.Sprintf(":%d", port)
-		l, err := net.Listen("tcp", addr)
-		if err == nil {
-			u.portsInUse[port] = true
-			l.Close()
-			return port, nil
-		}
-	}
-	l, err := net.Listen("tcp", ":0")
-	if err == nil {
-		// NOTE: may not be after 20000
-		port := l.Addr().(*net.TCPAddr).Port
-		u.portsInUse[port] = true
-		l.Close()
-		return port, nil
-	}
-	return -1, NewNestedError("unable to find free port").With(err)
-}
-
-func (u *Utils) markPortInUse(port int) {
-	u.portsInUseMutex.Lock()
-	u.portsInUse[port] = true
-	u.portsInUseMutex.Unlock()
-}
-
-func (u *Utils) unmarkPortInUse(port int) {
-	u.portsInUseMutex.Lock()
-	delete(u.portsInUse, port)
-	u.portsInUseMutex.Unlock()
-}
-
-func (*Utils) healthCheckHttp(targetUrl string) error {
-	// try HEAD first
-	// if HEAD is not allowed, try GET
-	resp, err := healthCheckHttpClient.Head(targetUrl)
-	if resp != nil {
-		resp.Body.Close()
-	}
-	if err != nil && resp != nil && resp.StatusCode == http.StatusMethodNotAllowed {
-		_, err = healthCheckHttpClient.Get(targetUrl)
-	}
-	if resp != nil {
-		resp.Body.Close()
-	}
-	return err
-}
-
-func (*Utils) healthCheckStream(scheme, host string) error {
-	conn, err := net.DialTimeout(scheme, host, streamDialTimeout)
-	if err != nil {
-		return err
-	}
-	conn.Close()
-	return nil
-}
-
-func (*Utils) reloadServer() error {
-	resp, err := healthCheckHttpClient.Post("http://localhost:8080/reload", "", nil)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return NewNestedError("server reload failed").Subjectf("%d", resp.StatusCode)
-	}
-	return nil
-}
-
-func (*Utils) snakeToPascal(s string) string {
-	toHyphenCamel := http.CanonicalHeaderKey(strings.ReplaceAll(s, "_", "-"))
-	return strings.ReplaceAll(toHyphenCamel, "-", "")
-}
-
-func tryAppendPathPrefixImpl(pOrig, pAppend string) string {
-	switch {
-	case strings.Contains(pOrig, "://"):
-		return pOrig
-	case pOrig == "", pOrig == "#", pOrig == "/":
-		return pAppend
-	case filepath.IsLocal(pOrig) && !strings.HasPrefix(pOrig, pAppend):
-		return path.Join(pAppend, pOrig)
-	default:
-		return pOrig
-	}
-}
-
-var tryAppendPathPrefix func(string, string) string
-var _ = func() int {
-	if logLevel == logrus.DebugLevel {
-		tryAppendPathPrefix = func(s1, s2 string) string {
-			replaced := tryAppendPathPrefixImpl(s1, s2)
-			return replaced
-		}
-	} else {
-		tryAppendPathPrefix = tryAppendPathPrefixImpl
-	}
-	return 1
-}()
-
-func htmlNodesSubPath(n *xhtml.Node, p string) {
-	if n.Type == xhtml.ElementNode {
-		for i, attr := range n.Attr {
-			switch attr.Key {
-			case "src", "href", "action": // img, script, link, form etc.
-				n.Attr[i].Val = tryAppendPathPrefix(attr.Val, p)
-			}
-		}
-	}
-
-	for c := n.FirstChild; c != nil; c = c.NextSibling {
-		htmlNodesSubPath(c, p)
-	}
-}
-
-func (*Utils) respHTMLSubPath(r *http.Response, p string) error {
-	// remove all path prefix from relative path in script, img, a, ...
-	doc, err := xhtml.Parse(r.Body)
-
-	if err != nil {
-		return err
-	}
-
-	if p[0] == '/' {
-		p = p[1:]
-	}
-	htmlNodesSubPath(doc, p)
-
-	var buf bytes.Buffer
-	err = xhtml.Render(&buf, doc)
-
-	if err != nil {
-		return err
-	}
-
-	r.Body = io.NopCloser(strings.NewReader(buf.String()))
-
-	return nil
-}
-
-func (*Utils) respJSSubPath(r *http.Response, p string) error {
-	var buf bytes.Buffer
-
-	_, err := buf.ReadFrom(r.Body)
-	if err != nil {
-		return err
-	}
-
-	if p[0] == '/' {
-		p = p[1:]
-	}
-
-	js := buf.String()
-
-	re := regexp.MustCompile(`fetch\(["'].+["']\)`)
-	replace := func(match string) string {
-		match = match[7 : len(match)-2]
-		replaced := tryAppendPathPrefix(match, p)
-		return fmt.Sprintf(`fetch(%q)`, replaced)
-	}
-	js = re.ReplaceAllStringFunc(js, replace)
-
-	r.Body = io.NopCloser(strings.NewReader(js))
-	return nil
-}
-
-func (*Utils) fileOK(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}
-
-func setFieldFromSnake[T interface{}, VT interface{}](obj *T, field string, value VT) error {
-	field = utils.snakeToPascal(field)
-	prop := reflect.ValueOf(obj).Elem().FieldByName(field)
-	if prop.Kind() == 0 {
-		return NewNestedError("unknown field").Subject(field)
-	}
-	prop.Set(reflect.ValueOf(value))
-	return nil
-}
-
-func validateYaml(schema *jsonschema.Schema, data []byte) error {
-	var i interface{}
-
-	err := yaml.Unmarshal(data, &i)
-	if err != nil {
-		return NewNestedError("unable to unmarshal yaml").With(err)
-	}
-
-	m, err := json.Marshal(i)
-	if err != nil {
-		return NewNestedError("unable to marshal json").With(err)
-	}
-
-	err = schema.Validate(bytes.NewReader(m))
-	if err != nil {
-		valErr := err.(*jsonschema.ValidationError)
-		ne := NewNestedError("validation error")
-		for _, e := range valErr.Causes {
-			ne.ExtraError(e)
-		}
-		return ne
-	}
-	return nil
-}
--- a/src/go-proxy/watcher.go
+++ b/src/go-proxy/watcher.go
@@ -1,229 +0,0 @@
-package main
-
-import (
-	"path"
-	"sync"
-	"time"
-
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/events"
-	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/client"
-	"github.com/fsnotify/fsnotify"
-	"github.com/sirupsen/logrus"
-
-	"golang.org/x/net/context"
-)
-
-type Watcher interface {
-	Start()
-	Stop()
-	Dispose()
-}
-
-type watcherBase struct {
-	name     string // for log / error output
-	kind     string // for log / error output
-	onChange func()
-	l        logrus.FieldLogger
-	sync.Mutex
-}
-
-type fileWatcher struct {
-	*watcherBase
-	path     string
-	onDelete func()
-}
-
-type dockerWatcher struct {
-	*watcherBase
-	client *client.Client
-	stopCh chan struct{}
-	wg     sync.WaitGroup
-}
-
-func newWatcher(kind string, name string, onChange func()) *watcherBase {
-	return &watcherBase{
-		kind:     kind,
-		name:     name,
-		onChange: onChange,
-		l:        wlog.WithFields(logrus.Fields{"kind": kind, "name": name}),
-	}
-}
-func NewFileWatcher(p string, onChange func(), onDelete func()) Watcher {
-	return &fileWatcher{
-		watcherBase: newWatcher("File", path.Base(p), onChange),
-		path:        p,
-		onDelete:    onDelete,
-	}
-}
-
-func NewDockerWatcher(c *client.Client, onChange func()) Watcher {
-	return &dockerWatcher{
-		watcherBase: newWatcher("Docker", c.DaemonHost(), onChange),
-		client:      c,
-		stopCh:      make(chan struct{}, 1),
-	}
-}
-
-func (w *fileWatcher) Start() {
-	w.Lock()
-	defer w.Unlock()
-	if fsWatcher == nil {
-		return
-	}
-	err := fsWatcher.Add(w.path)
-	if err != nil {
-		w.l.Error("failed to start: ", err)
-		return
-	}
-	fileWatchMap.Set(w.path, w)
-}
-
-func (w *fileWatcher) Stop() {
-	w.Lock()
-	defer w.Unlock()
-	if fsWatcher == nil {
-		return
-	}
-	fileWatchMap.Delete(w.path)
-	err := fsWatcher.Remove(w.path)
-	if err != nil {
-		w.l.Error(err)
-	}
-}
-
-func (w *fileWatcher) Dispose() {
-	w.Stop()
-}
-
-func (w *dockerWatcher) Start() {
-	w.Lock()
-	defer w.Unlock()
-	dockerWatchMap.Set(w.name, w)
-	w.wg.Add(1)
-	go w.watch()
-}
-
-func (w *dockerWatcher) Stop() {
-	w.Lock()
-	defer w.Unlock()
-	if w.stopCh == nil {
-		return
-	}
-	close(w.stopCh)
-	w.wg.Wait()
-	w.stopCh = nil
-	dockerWatchMap.Delete(w.name)
-}
-
-func (w *dockerWatcher) Dispose() {
-	w.Stop()
-	w.client.Close()
-}
-
-func InitFSWatcher() {
-	w, err := fsnotify.NewWatcher()
-	if err != nil {
-		wlog.Errorf("unable to create file watcher: %v", err)
-		return
-	}
-	fsWatcher = w
-	fsWatcherWg.Add(1)
-	go watchFiles()
-}
-
-func StopFSWatcher() {
-	close(fsWatcherStop)
-	fsWatcherWg.Wait()
-}
-
-func StopDockerWatcher() {
-	ParallelForEachValue(
-		dockerWatchMap.Iterator(),
-		(*dockerWatcher).Dispose,
-	)
-}
-
-func watchFiles() {
-	defer fsWatcher.Close()
-	defer fsWatcherWg.Done()
-
-	for {
-		select {
-		case <-fsWatcherStop:
-			return
-		case event, ok := <-fsWatcher.Events:
-			if !ok {
-				wlog.Error("file watcher channel closed")
-				return
-			}
-			w, ok := fileWatchMap.UnsafeGet(event.Name)
-			if !ok {
-				wlog.Errorf("watcher for %s not found", event.Name)
-			}
-			switch {
-			case event.Has(fsnotify.Write):
-				w.l.Info("file changed")
-				go w.onChange()
-			case event.Has(fsnotify.Remove), event.Has(fsnotify.Rename):
-				w.l.Info("file renamed / deleted")
-				go w.onDelete()
-			}
-		case err := <-fsWatcher.Errors:
-			wlog.Error(err)
-		}
-	}
-}
-
-func (w *dockerWatcher) watch() {
-	defer w.wg.Done()
-
-	filter := filters.NewArgs(
-		filters.Arg("type", "container"),
-		filters.Arg("event", "start"),
-		filters.Arg("event", "die"), // 'stop' already triggering 'die'
-	)
-	listen := func() (<-chan events.Message, <-chan error) {
-		return w.client.Events(context.Background(), types.EventsOptions{Filters: filter})
-	}
-	msgChan, errChan := listen()
-
-	for {
-		select {
-		case <-w.stopCh:
-			return
-		case msg := <-msgChan:
-			w.l.Infof("container %s %s", msg.Actor.Attributes["name"], msg.Action)
-			go w.onChange()
-		case err := <-errChan:
-			switch {
-			case client.IsErrConnectionFailed(err):
-				w.l.Error(NewNestedError("connection failed").Subject(w.name))
-			case client.IsErrNotFound(err):
-				w.l.Error(NewNestedError("endpoint not found").Subject(w.name))
-			default:
-				w.l.Error(NewNestedErrorFrom(err).Subject(w.name))
-			}
-			time.Sleep(1 * time.Second)
-			msgChan, errChan = listen()
-		}
-	}
-}
-
-type (
-	FileWatcherMap   = SafeMap[string, *fileWatcher]
-	DockerWatcherMap = SafeMap[string, *dockerWatcher]
-)
-
-var fsWatcher *fsnotify.Watcher
-var (
-	fileWatchMap   FileWatcherMap   = NewSafeMapOf[FileWatcherMap]()
-	dockerWatchMap DockerWatcherMap = NewSafeMapOf[DockerWatcherMap]()
-)
-var (
-	fsWatcherStop = make(chan struct{}, 1)
-)
-var (
-	fsWatcherWg sync.WaitGroup
-)
--- a/src/go.mod
+++ b/src/go.mod
@@ -1,53 +1,56 @@
 module github.com/yusing/go-proxy

-go 1.22
+go 1.22.0

 require (
-	github.com/docker/cli v26.0.0+incompatible
-	github.com/docker/docker v26.0.0+incompatible
+	github.com/docker/cli v27.3.1+incompatible
+	github.com/docker/docker v27.3.1+incompatible
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/go-acme/lego/v4 v4.16.1
+	github.com/go-acme/lego/v4 v4.18.0
+	github.com/puzpuzpuz/xsync/v3 v3.4.0
 	github.com/santhosh-tekuri/jsonschema v1.2.4
 	github.com/sirupsen/logrus v1.9.3
-	golang.org/x/net v0.22.0
+	golang.org/x/net v0.29.0
 	gopkg.in/yaml.v3 v3.0.1
 )

 require (
-	github.com/Microsoft/go-winio v0.4.14 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
-	github.com/cloudflare/cloudflare-go v0.86.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cloudflare/cloudflare-go v0.104.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.1 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/goccy/go-json v0.10.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
-	github.com/miekg/dns v1.1.58 // indirect
+	github.com/miekg/dns v1.1.62 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/ovh/go-ovh v1.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
-	go.opentelemetry.io/otel v1.24.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.55.0 // indirect
+	go.opentelemetry.io/otel v1.30.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.24.0 // indirect
-	go.opentelemetry.io/otel/metric v1.24.0 // indirect
+	go.opentelemetry.io/otel/metric v1.30.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.24.0 // indirect
-	go.opentelemetry.io/otel/trace v1.24.0 // indirect
-	golang.org/x/crypto v0.21.0 // indirect
-	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.17.0 // indirect
+	go.opentelemetry.io/otel/trace v1.30.0 // indirect
+	golang.org/x/crypto v0.27.0 // indirect
+	golang.org/x/mod v0.21.0 // indirect
+	golang.org/x/oauth2 v0.23.0 // indirect
+	golang.org/x/sync v0.8.0 // indirect
+	golang.org/x/sys v0.25.0 // indirect
+	golang.org/x/text v0.18.0 // indirect
+	golang.org/x/time v0.6.0 // indirect
+	golang.org/x/tools v0.25.0 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gotest.tools/v3 v3.5.1 // indirect
 )
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
yusing	99216ffe59	fixed subdomain matching for sub-sub-subdomain and so on, now return 404 when subdomain is missing	2024-09-24 18:30:25 +08:00
yusing	f426dbc9cf	removed save registration.json since it does not work properly	2024-09-24 18:18:37 +08:00
yusing	1c611cc9b9	example fix	2024-09-24 03:13:39 +08:00
yusing	dc43e26770	Format README for better clarity in setup instructions	2024-09-24 03:09:50 +08:00
yusing	79ae26f1b5	new simpler setup method, readme and doc update	2024-09-23 22:10:13 +08:00
yusing	109c2460fa	fixed container being excluded in host network_mode	2024-09-23 20:34:46 +08:00
yusing	71e8e4a462	smarter scheme and port detection	2024-09-23 20:16:38 +08:00
yusing	8e2cc56afb	Fixed nil dereferencing and added missing fields validation	2024-09-23 16:14:34 +08:00
yusing	6728bc39d2	fixed nil dereferencing	2024-09-23 07:19:47 +08:00
yusing	daca4b7735	shrink docker image size in half, adding back ForceColor for logrus	2024-09-23 05:34:50 +08:00
yusing	3b597eea29	support '0' listening port, readme update, showcase added	2024-09-23 04:09:56 +08:00
yusing	090b73d287	fixed tcp/udp I/O, deadlock, nil dereference; improved docker watcher, idlewatcher, loading page	2024-09-23 00:49:46 +08:00
yusing	96bce79e4b	changed env GOPROXY__PORT to GOPROXY__ADDR, changed api server default to listen on localhost only, readme update	2024-09-22 06:06:24 +08:00
yusing	d9fd399e43	fix stuck loading in some scenerios for ls-* command line options	2024-09-22 05:01:36 +08:00
yusing	46281aa3b0	renamed ProxyEntry to RawEntry to avoid confusion with src/proxy/entry.go	2024-09-22 04:13:42 +08:00
yusing	d39b68bfd8	fixed possible resource leak	2024-09-22 04:11:02 +08:00
yusing	a11ce46028	added some docker compose examples; fixed defaults to wrong host; updated watcher behavior to retry connection every 3 secs until success or until cancelled	2024-09-22 04:00:08 +08:00
yusing	6388d9d44d	fixed outputing error in ls-config, ls-routes, etc.	2024-09-21 18:47:38 +08:00
yusing	69361aea1b	fixed host set to localhost even on remote docker, fixed one error in provider causing all routes not to load	2024-09-21 18:23:20 +08:00
yusing	26e2154c64	fixed startup crash for file provider	2024-09-21 17:22:17 +08:00
Yuzerion	a29bf880bc	Update docker.md Too sleepy...	2024-09-21 16:08:11 +08:00
Yuzerion	1f6d03bdbb	Update compose.example.yml	2024-09-21 16:07:12 +08:00
Yuzerion	4a7d898b8e	Update docker.md	2024-09-21 16:06:32 +08:00
Yuzerion	521b694aec	Update docker.md	2024-09-21 15:56:39 +08:00
yusing	a351de7441	github CI fix attempt	2024-09-21 14:32:52 +08:00
yusing	ab2dc26b76	fixing udp stream listening on wrong port	2024-09-21 14:18:29 +08:00
yusing	9a81b13b67	fixing tcp/udp error on closing	2024-09-21 13:40:20 +08:00
yusing	626bd9666b	check release	2024-09-21 12:45:56 +08:00
yusing	d7eab2ebcd	fixing idlewatcher	2024-09-21 09:42:40 +08:00
yusing	e48b9bbb0a	新增繁中README (未完成)	2024-09-19 21:16:38 +08:00
yusing	339411530b	v0.5.0-rc5: merge	2024-09-19 20:42:12 +08:00
yusing	4a2d42bfa9	v0.5.0-rc5: check release	2024-09-19 20:40:03 +08:00
Yuzerion	81da9ad83a	small fix	2024-09-18 09:10:41 +08:00
yusing	be7a766cb2	v0.5.0-rc5: added proxy.exclude label, refactored some code	2024-09-17 17:56:41 +08:00
yusing	83d1d027c6	added TZ env to docker compose example	2024-09-17 12:36:13 +08:00
yusing	21fcceb391	v0.5.0-rc4: initial support for ovh, provider generator implementation update, replaced all interface{} to any	2024-09-17 12:06:58 +08:00
yusing	82f06374f7	v0.5.0-rc4: fixing autocert issue, cache ACME registration, added ls-config option	2024-09-17 08:41:36 +08:00
yusing	04fd6543fd	README update for sonarcloud badges, simplify some test code, fixed some sonarlint issues	2024-09-17 04:51:26 +08:00
yusing	409a18df38	update default branch for setup script	2024-09-17 03:54:55 +08:00
yusing	4e5a8d0985	v0.5-rc3: version bump	2024-09-17 03:19:21 +08:00
yusing	16b507bc7c	v0.5-rc3: update docker port detect mechanism, docker compose file and doc update	2024-09-17 03:11:04 +08:00
yusing	1120991019	v0.5-rc2: fixed port being overridden to 80 or 443	2024-09-17 00:30:26 +08:00
yusing	c0ebd9f8c0	v0.5-rc2: added reload cooldown, fixed auto reload, updated API	2024-09-17 00:10:25 +08:00
yusing	996b418ea9	v0.5-rc1: updated Dockerfile to conform latest format	2024-09-16 13:24:53 +08:00
yusing	4cddd4ff71	v0.5-rc1: schema fixes, provider file example update	2024-09-16 13:19:24 +08:00
yusing	7a0478164f	v0.5: (BREAKING) replacing path with path_patterns, improved docker monitoring mechanism, bug fixes	2024-09-16 13:05:04 +08:00
yusing	2e7ba51521	v0.5: (BREAKING) new syntax for set_headers and hide_headers, updated label parser, error.Nil().String() will now return 'nil', better readme	2024-09-16 07:21:45 +08:00
yusing	5be8659a99	v0.5: (BREAKING) simplified config format, improved output formatting, fixed docker watcher	2024-09-16 03:48:39 +08:00
default	719693deb7	v0.5: (BREAKING) simplified config format, improved error output, updated proxy entry default value for 'port'	2024-08-14 02:41:11 +08:00
default	23e7d06081	v0.5: removed system service env, log output format fix	2024-08-13 06:00:22 +08:00
default	85fb637551	v0.5: fixed nil dereference for empty autocert config, fixed and simplified 'error' module, small readme and docs update	2024-08-13 04:59:34 +08:00
default	2fc82c3790	v0.5: remove binary build	2024-08-09 07:09:42 +08:00
default	a5a31a0d63	v0.5: readme and dockerfile update, removed old panel sources, added new frontend as submodule	2024-08-09 07:03:24 +08:00
default	73e481bc96	v0.5: dependencies update, EOF fix for PUT/POST /v1/file	2024-08-09 02:10:48 +08:00
default	93359110a2	preparing for v0.5	2024-08-01 10:06:42 +08:00
yusing	24778d1093	doc fix	2024-04-09 06:53:54 +00:00
yusing	830d0bdadd	revert github workflow	2024-04-08 05:34:41 +00:00
yusing w	e12b356d0d	Merge branch 'dev' into 'main' Dev See merge request yusing/go-proxy!3	2024-04-08 05:07:27 +00:00
yusing w	52549b6446	Dev	2024-04-08 05:07:27 +00:00
yusing	8694987ef9	version bump	2024-04-01 04:09:22 +00:00
yusing	b125b14bf6	added license	2024-04-01 04:08:48 +00:00