trim and convert alias and host to lowercase

* cleanup code for URL type

* fix makefile for trace mode

* refactor, merge Entry, RawEntry and Route into one. 

* Implement fileserver.

* refactor: rename HTTPRoute to ReverseProxyRoute to avoid confusion

* refactor: move metrics logger to middleware package

- fix prometheus metrics for load balanced routes
  - route will now fail when health monitor fail to start

* fix extra output of ls-* commands by defer initializaing stuff, speed up start time

* add test for path traversal attack, small fix on FileServer.Start method

* rename rule.on.bypass to pass

* refactor and fixed map-to-map  deserialization

* updated route loading logic

* schemas: add "add_prefix" option to modify_request middleware


* updated route JSONMarshalling

---------

Co-authored-by: yusing <yusing@6uo.me>

.env.example

@@ -0,0 +1,49 @@
+# set timezone to get correct log timestamp
+TZ=ETC/UTC
+
+# API/WebUI user password login credentials (optional)
+# These fields are not required for OIDC authentication
+GODOXY_API_USER=admin
+GODOXY_API_PASSWORD=password
+# generate secret with `openssl rand -base64 32`
+GODOXY_API_JWT_SECRET=
+# the JWT token time-to-live
+GODOXY_API_JWT_TOKEN_TTL=1h
+
+# OIDC Configuration (optional)
+# Uncomment and configure these values to enable OIDC authentication.
+# GODOXY_OIDC_ISSUER_URL=https://accounts.google.com
+# GODOXY_OIDC_CLIENT_ID=your-client-id
+# GODOXY_OIDC_CLIENT_SECRET=your-client-secret
+# Keep /api/auth/callback as the redirect URL, change the domain to match your setup.
+# GODOXY_OIDC_REDIRECT_URL=https://your-domain/api/auth/callback
+# Comma-separated list of scopes
+# GODOXY_OIDC_SCOPES=openid, profile, email
+#
+# User definitions: Uncomment and configure these values to restrict access to specific users or groups.
+# These two fields act as a logical AND operator. For example, given the following membership:
+#   user1, group1
+#   user2, group1
+#   user3, group2
+#   user1, group2
+# You can allow access to user3 AND all users of group1 by providing:
+#   # GODOXY_OIDC_ALLOWED_USERS=user3
+#   # GODOXY_OIDC_ALLOWED_GROUPS=group1
+#
+# Comma-separated list of allowed users.
+# GODOXY_OIDC_ALLOWED_USERS=user1,user2
+# Optional: Comma-separated list of allowed groups.
+# GODOXY_OIDC_ALLOWED_GROUPS=group1,group2
+
+# Proxy listening address
+GODOXY_HTTP_ADDR=:80
+GODOXY_HTTPS_ADDR=:443
+
+# API listening address
+GODOXY_API_ADDR=127.0.0.1:8888
+
+# Prometheus Metrics
+GODOXY_PROMETHEUS_ENABLED=true
+
+# Debug mode
+GODOXY_DEBUG=false

.github/FUNDING.yml

@@ -0,0 +1,15 @@
+# These are supported funding model platforms
+
+github: yusing # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+polar: # Replace with a single Polar username
+buy_me_a_coffee: yusingwysq # Replace with a single Buy Me a Coffee username
+thanks_dev: # Replace with a single thanks.dev username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/workflows/docker-image.yml

@@ -1,21 +1,128 @@
 name: Docker Image CI
 
 on:
-  push:
-    tags:
-      - "*"
-jobs:
-  build_and_push:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set up Docker Build and Push
-        id: docker_build_push
-        uses: GlueOps/github-actions-build-push-containers@v0.3.7
-        with:
-          tags: ${{ github.ref_name }}
+    push:
+        tags: ["*"]
 
-      - name: Tag as latest
-        if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-')
-        run: |
-          docker tag ghcr.io/${{ github.repository }}:${{ github.ref_name }} ghcr.io/${{ github.repository }}:latest
-          docker push ghcr.io/${{ github.repository }}:latest
+env:
+    REGISTRY: ghcr.io
+    IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+    build:
+        name: Build multi-platform Docker image
+        runs-on: ubuntu-22.04
+
+        permissions:
+            contents: read
+            packages: write
+            id-token: write
+            attestations: write
+
+        strategy:
+            fail-fast: false
+            matrix:
+                platform:
+                    - linux/amd64
+                    # - linux/arm/v6
+                    # - linux/arm/v7
+                    - linux/arm64
+        steps:
+            - name: Prepare
+              run: |
+                  platform=${{ matrix.platform }}
+                  echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+            - name: Docker meta
+              id: meta
+              uses: docker/metadata-action@v5
+              with:
+                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@v3
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Login to registry
+              uses: docker/login-action@v3
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Build and push by digest
+              id: build
+              uses: docker/build-push-action@v6
+              with:
+                  platforms: ${{ matrix.platform }}
+                  labels: ${{ steps.meta.outputs.labels }}
+                  outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
+                  cache-from: type=gha
+                  cache-to: type=gha,mode=max
+                  build-args: |
+                      VERSION=${{ github.ref_name }}
+
+            - name: Generate artifact attestation
+              uses: actions/attest-build-provenance@v1
+              with:
+                  subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+                  subject-digest: ${{ steps.build.outputs.digest }}
+                  push-to-registry: true
+
+            - name: Export digest
+              run: |
+                  mkdir -p /tmp/digests
+                  digest="${{ steps.build.outputs.digest }}"
+                  touch "/tmp/digests/${digest#sha256:}"
+
+            - name: Upload digest
+              uses: actions/upload-artifact@v4
+              with:
+                  name: digests-${{ env.PLATFORM_PAIR }}
+                  path: /tmp/digests/*
+                  if-no-files-found: error
+                  retention-days: 1
+    merge:
+        runs-on: ubuntu-22.04
+        needs:
+            - build
+        permissions:
+            contents: read
+            packages: write
+            id-token: write
+        steps:
+            - name: Download digests
+              uses: actions/download-artifact@v4
+              with:
+                  path: /tmp/digests
+                  pattern: digests-*
+                  merge-multiple: true
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Docker meta
+              id: meta
+              uses: docker/metadata-action@v5
+              with:
+                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+            - name: Login to registry
+              uses: docker/login-action@v3
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Create manifest list and push
+              id: push
+              working-directory: /tmp/digests
+              run: |
+                  docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+                    $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
+
+            - name: Inspect image
+              run: |
+                  docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}

.gitignore

@@ -1,10 +1,14 @@
 compose.yml
+*.compose.yml
 
+config
+certs
 config*/
+!schemas/**
 certs*/
 bin/
-
-templates/codemirror/
+error_pages/
+!examples/error_pages/
 
 logs/
 log/
@@ -13,6 +17,16 @@ log/
 
 go.work.sum
 
-!src/**/
+!cmd/**/
+!internal/**/
 
-todo.md
+todo.md
+
+.*.swp
+.aider*
+mtrace.json
+.env
+test.Dockerfile
+
+node_modules/
+tsconfig.tsbuildinfo

.gitlab-ci.yml

@@ -11,5 +11,5 @@ build-image:
     - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
   script:
     - echo building $CI_REGISTRY_IMAGE
-    - docker build --pull -t $CI_REGISTRY_IMAGE .
-    - docker push $CI_REGISTRY_IMAGE
+    - docker build --no-cache --build-arg VERSION=$CI_COMMIT_REF_NAME -t $CI_REGISTRY_IMAGE .
+    - docker push $CI_REGISTRY_IMAGE

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "frontend"]
-	path = frontend
-	url = https://github.com/yusing/go-proxy-frontend

.golangci.yml

@@ -0,0 +1,135 @@
+run:
+  timeout: 10m
+
+linters-settings:
+  govet:
+    enable-all: true
+    disable:
+      - shadow
+      - fieldalignment
+  gocyclo:
+    min-complexity: 14
+  misspell:
+    locale: US
+  funlen:
+    lines: -1
+    statements: 120
+  forbidigo:
+    forbid:
+      - ^print(ln)?$
+  godox:
+    keywords:
+      - FIXME
+  tagalign:
+    align: false
+    sort: true
+    order:
+      - description
+      - json
+      - toml
+      - yaml
+      - yml
+      - label
+      - label-slice-as-struct
+      - file
+      - kv
+      - export
+  stylecheck:
+    dot-import-whitelist:
+      - github.com/yusing/go-proxy/internal/utils/testing # go tests only
+      - github.com/yusing/go-proxy/internal/api/v1/utils # api only
+  revive:
+    rules:
+      - name: struct-tag
+      - name: blank-imports
+      - name: context-as-argument
+      - name: context-keys-type
+      - name: error-return
+      - name: error-strings
+      - name: error-naming
+      - name: exported
+        disabled: true
+      - name: if-return
+      - name: increment-decrement
+      - name: var-naming
+      - name: var-declaration
+      - name: package-comments
+        disabled: true
+      - name: range
+      - name: receiver-naming
+      - name: time-naming
+      - name: unexported-return
+      - name: indent-error-flow
+      - name: errorf
+      - name: empty-block
+      - name: superfluous-else
+      - name: unused-parameter
+        disabled: true
+      - name: unreachable-code
+      - name: redefines-builtin-id
+  gomoddirectives:
+    replace-allow-list:
+      - github.com/abbot/go-http-auth
+      - github.com/gorilla/mux
+      - github.com/mailgun/minheap
+      - github.com/mailgun/multibuf
+      - github.com/jaguilar/vt100
+      - github.com/cucumber/godog
+      - github.com/http-wasm/http-wasm-host-go
+  testifylint:
+    disable:
+      - suite-dont-use-pkg
+      - require-error
+      - go-require
+  staticcheck:
+    checks:
+      - all
+      - -SA1019
+  errcheck:
+    exclude-functions:
+      - fmt.Fprintln
+linters:
+  enable-all: true
+  disable:
+    - execinquery # deprecated
+    - gomnd # deprecated
+    - sqlclosecheck # not relevant (SQL)
+    - rowserrcheck # not relevant (SQL)
+    - cyclop # duplicate of gocyclo
+    - depguard # Not relevant
+    - nakedret # Too strict
+    - lll # Not relevant
+    - gocyclo # must be fixed
+    - gocognit # Too strict
+    - nestif # Too many false-positive.
+    - prealloc # Too many false-positive.
+    - makezero # Not relevant
+    - dupl # Too strict
+    - gci # I don't care
+    - goconst # Too annoying
+    - gosec # Too strict
+    - gochecknoinits
+    - gochecknoglobals
+    - wsl # Too strict
+    - nlreturn # Not relevant
+    - mnd # Too strict
+    - testpackage # Too strict
+    - tparallel # Not relevant
+    - paralleltest # Not relevant
+    - exhaustive # Not relevant
+    - exhaustruct # Not relevant
+    - err113 # Too strict
+    - wrapcheck # Too strict
+    - noctx # Too strict
+    - bodyclose # too many false-positive
+    - forcetypeassert # Too strict
+    - tagliatelle # Too strict
+    - varnamelen # Not relevant
+    - nilnil # Not relevant
+    - ireturn # Not relevant
+    - contextcheck # too many false-positive
+    - containedctx # too many false-positive
+    - maintidx # kind of duplicate of gocyclo
+    - nonamedreturns # Too strict
+    - gosmopolitan # not relevant
+    - exportloopref # Not relevant since go1.22

.trunk/.gitignore

@@ -0,0 +1,9 @@
+*out
+*logs
+*actions
+*notifications
+*tools
+plugins
+user_trunk.yaml
+user.yaml
+tmp

.trunk/trunk.yaml

@@ -0,0 +1,42 @@
+# This file controls the behavior of Trunk: https://docs.trunk.io/cli
+# To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
+version: 0.1
+cli:
+  version: 1.22.9
+# Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
+plugins:
+  sources:
+    - id: trunk
+      ref: v1.6.7
+      uri: https://github.com/trunk-io/plugins
+# Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
+runtimes:
+  enabled:
+    - node@18.20.5
+    - python@3.10.8
+    - go@1.23.2
+# This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
+lint:
+  disabled:
+    - markdownlint
+    - yamllint
+  enabled:
+    - hadolint@2.12.1-beta
+    - actionlint@1.7.7
+    - checkov@3.2.360
+    - git-diff-check
+    - gofmt@1.20.4
+    - golangci-lint@1.63.4
+    - osv-scanner@1.9.2
+    - oxipng@9.1.3
+    - prettier@3.4.2
+    - shellcheck@0.10.0
+    - shfmt@3.6.0
+    - trufflehog@3.88.4
+actions:
+  disabled:
+    - trunk-announce
+    - trunk-check-pre-push
+    - trunk-fmt-pre-commit
+  enabled:
+    - trunk-upgrade-available

.vscode/settings.example.json

@@ -1,13 +1,11 @@
 {
   "yaml.schemas": {
-    "https://github.com/yusing/go-proxy/raw/main/schema/config.schema.json": [
+    "https://github.com/yusing/go-proxy/raw/v0.9/schemas/config.schema.json": [
       "config.example.yml",
       "config.yml"
     ],
-    "https://github.com/yusing/go-proxy/raw/main/schema/providers.schema.json": [
-      "providers.example.yml",
-      "*.providers.yml",
-      "providers.yml"
+    "https://github.com/yusing/go-proxy/raw/v0.9/schemas/routes.schema.json": [
+      "providers.example.yml"
     ]
   }
-}
+}

Dockerfile

@@ -1,28 +1,64 @@
-FROM golang:1.23.1-alpine AS builder
-COPY src /src
-ENV GOCACHE=/root/.cache/go-build
+# Stage 1: Builder
+FROM golang:1.23.5-alpine AS builder
+HEALTHCHECK NONE
+
+# package version does not matter
+# trunk-ignore(hadolint/DL3018)
+RUN apk add --no-cache tzdata make libcap-setcap
+
 WORKDIR /src
+
+# Only copy go.mod and go.sum initially for better caching
+COPY go.mod go.sum /src/
+
+# Utilize build cache
+RUN --mount=type=cache,target="/go/pkg/mod" \
+    go mod download -x
+
+ENV GOCACHE=/root/.cache/go-build
+
+COPY Makefile /src/
+COPY cmd /src/cmd
+COPY internal /src/internal
+COPY pkg /src/pkg
+
+ARG VERSION
+ENV VERSION=${VERSION}
+
+ARG BUILD_FLAGS
+ENV BUILD_FLAGS=${BUILD_FLAGS}
+
 RUN --mount=type=cache,target="/go/pkg/mod" \
     --mount=type=cache,target="/root/.cache/go-build" \
-    go mod download && \
-    CGO_ENABLED=0 GOOS=linux go build -pgo=auto -o go-proxy github.com/yusing/go-proxy
+    make build && \
+    mkdir -p /app/error_pages /app/certs && \
+    mv bin/godoxy /app/godoxy
 
-FROM alpine:3.20
+# Stage 2: Final image
+FROM scratch
 
 LABEL maintainer="yusing@6uo.me"
+LABEL proxy.exclude=1
+
+# copy timezone data
+COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
 
-RUN apk add --no-cache tzdata
 # copy binary
-COPY --from=builder /src/go-proxy /app/
-COPY schema/ /app/schema
+COPY --from=builder /app /app
+
+# copy example config
+COPY config.example.yml /app/config/config.yml
+
+# copy certs
+COPY --from=builder /etc/ssl/certs /etc/ssl/certs
 
-RUN chmod +x /app/go-proxy
 ENV DOCKER_HOST=unix:///var/run/docker.sock
-ENV GOPROXY_DEBUG=0
+ENV GODOXY_DEBUG=0
 
 EXPOSE 80
 EXPOSE 8888
 EXPOSE 443
 
 WORKDIR /app
-CMD ["/app/go-proxy"]
+
+CMD ["/app/godoxy"]

Makefile

@@ -1,47 +1,126 @@
-.PHONY: all build up quick-restart restart logs get udp-server
+export VERSION ?= $(shell git describe --tags --abbrev=0)
+export BUILD_DATE ?= $(shell date -u +'%Y%m%d-%H%M')
+export GOOS = linux
 
-all: build quick-restart logs
+LDFLAGS = -X github.com/yusing/go-proxy/pkg.version=${VERSION}
 
-setup:
-	mkdir -p config certs
-	[ -f config/config.yml ] || cp config.example.yml config/config.yml
-	[ -f config/providers.yml ] || touch config/providers.yml
+ifeq ($(trace), 1)
+	debug = 1
+	GODOXY_TRACE ?= 1
+endif
+
+ifeq ($(debug), 1)
+	CGO_ENABLED = 0
+	GODOXY_DEBUG = 1
+  BUILD_FLAGS = -tags production
+else ifeq ($(pprof), 1)
+	CGO_ENABLED = 1
+	GODEBUG = gctrace=1 inittrace=1 schedtrace=3000
+	GORACE = log_path=logs/pprof strip_path_prefix=$(shell pwd)/
+	BUILD_FLAGS = -race -gcflags=all='-N -l' -tags pprof
+	DOCKER_TAG = pprof
+	VERSION += -pprof
+else
+	CGO_ENABLED = 0
+	LDFLAGS += -s -w
+  BUILD_FLAGS = -pgo=auto -tags production
+	DOCKER_TAG = latest
+endif
+
+BUILD_FLAGS += -ldflags='$(LDFLAGS)'
+
+export CGO_ENABLED
+export GODOXY_DEBUG
+export GODOXY_TRACE
+export GODEBUG
+export GORACE
+export BUILD_FLAGS
+export DOCKER_TAG
+
+test:
+	GODOXY_TEST=1 go test ./internal/...
+
+get:
+	go get -u ./cmd && go mod tidy
 
 build:
 	mkdir -p bin
-	CGO_ENABLED=0 GOOS=linux go build -pgo=auto -o bin/go-proxy github.com/yusing/go-proxy
+	go build ${BUILD_FLAGS} -o bin/godoxy ./cmd
+	if [ $(shell id -u) -eq 0 ]; \
+		then setcap CAP_NET_BIND_SERVICE=+eip bin/godoxy; \
+		else sudo setcap CAP_NET_BIND_SERVICE=+eip bin/godoxy; \
+	fi
 
-test:
-	go test ./src/...
+run:
+	[ -f .env ] && godotenv -f .env go run ${BUILD_FLAGS} ./cmd
 
-up:
-	docker compose up -d
-
-restart:
-	docker compose restart -t 0
-
-logs:
-	docker compose logs -f
-
-get:
-	cd src && go get -u && go mod tidy && cd ..
-
-debug:
-	make build && sudo GOPROXY_DEBUG=1 bin/go-proxy
-
-archive:
-	git archive HEAD -o ../go-proxy-$$(date +"%Y%m%d%H%M").zip
-
-repush:
-	git reset --soft HEAD^
-	git add -A
-	git commit -m "repush"
-	git push gitlab dev --force
+mtrace:
+	bin/godoxy debug-ls-mtrace > mtrace.json
 
 rapid-crash:
-	sudo docker run --restart=always --name test_crash debian:bookworm-slim /bin/cat &&\
+	docker run --restart=always --name test_crash -p 80 debian:bookworm-slim /bin/cat &&\
 	sleep 3 &&\
-	sudo docker rm -f test_crash
+	docker rm -f test_crash
 
 debug-list-containers:
-	bash -c 'echo -e "GET /containers/json HTTP/1.0\r\n" | sudo netcat -U /var/run/docker.sock | tail -n +9 | jq'
+	bash -c 'echo -e "GET /containers/json HTTP/1.0\r\n" | sudo netcat -U /var/run/docker.sock | tail -n +9 | jq'
+
+ci-test:
+	mkdir -p /tmp/artifacts
+	act -n --artifact-server-path /tmp/artifacts -s GITHUB_TOKEN="$$(gh auth token)"
+
+cloc:
+	cloc --not-match-f '_test.go$$' cmd internal pkg
+
+push-docker-io:
+	BUILDER=build docker buildx build \
+		--platform linux/arm64,linux/amd64 \
+		-f Dockerfile \
+		-t docker.io/yusing/godoxy-nightly:${DOCKER_TAG} \
+		-t docker.io/yusing/godoxy-nightly:${VERSION}-${BUILD_DATE} \
+		--build-arg VERSION="${VERSION}-nightly-${BUILD_DATE}" \
+		--build-arg BUILD_FLAGS="${BUILD_FLAGS}" \
+		--push .
+
+build-docker:
+	docker build -t godoxy-nightly \
+		--build-arg VERSION="${VERSION}-nightly-${BUILD_DATE}" \
+		--build-arg BUILD_FLAGS="${BUILD_FLAGS}" \
+		.
+
+# To generate schema
+# comment out this part from typescript-json-schema.js#L884
+#
+#	if (indexType.flags !== ts.TypeFlags.Number && !isIndexedObject) {
+#			throw new Error("Not supported: IndexSignatureDeclaration with index symbol other than a number or a string");
+#	}
+
+gen-schema-single:
+	bun --bun run typescript-json-schema --noExtraProps --required --skipLibCheck --tsNodeRegister=true -o schemas/${OUT} schemas/${IN} ${CLASS}
+	# minify
+	python3 -c "import json; f=open('schemas/${OUT}', 'r'); j=json.load(f); f.close(); f=open('schemas/${OUT}', 'w'); json.dump(j, f, separators=(',', ':'));"
+
+gen-schema:
+	bun --bun tsc
+	make IN=config/config.ts \
+			CLASS=Config \
+			OUT=config.schema.json \
+			gen-schema-single
+	make IN=providers/routes.ts \
+			CLASS=Routes \
+			OUT=routes.schema.json \
+			gen-schema-single
+	make IN=middlewares/middleware_compose.ts \
+			CLASS=MiddlewareCompose \
+			OUT=middleware_compose.schema.json \
+			gen-schema-single
+	make IN=docker.ts \
+			CLASS=DockerRoutes \
+			OUT=docker_routes.schema.json \
+			gen-schema-single
+
+update-schema-generator:
+	pnpm up -g typescript-json-schema
+
+push-github:
+	git push origin $(shell git rev-parse --abbrev-ref HEAD)

README.md

@@ -1,132 +1,131 @@
-# go-proxy
+<div align="center">
+
+# GoDoxy
 
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+![GitHub last commit](https://img.shields.io/github/last-commit/yusing/go-proxy)
 [![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![](https://dcbadge.limes.pink/api/server/umReR62nRd?style=flat)](https://discord.gg/umReR62nRd)
+
+A lightweight, simple, and [performant](https://github.com/yusing/go-proxy/wiki/Benchmarks) reverse proxy with WebUI.
+
+For full documentation, check out **[Wiki](https://github.com/yusing/go-proxy/wiki)**
+
+**EN** | <a href="README_CHT.md">中文</a>
+
+**Currently working on [feat/godoxy-agent](https://github.com/yusing/go-proxy/tree/feat/godoxy-agent).<br/>Fork this instead of default branch.**
+
+<!-- [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
 [![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy) -->
 
-[繁體中文文檔請看此](README_CHT.md)
+<img src="https://github.com/user-attachments/assets/4bb371f4-6e4c-425c-89b2-b9e962bdd46f" style="max-width: 650">
 
-A lightweight, easy-to-use, and [performant](docs/benchmark_result.md) reverse proxy with a web UI.
+</div>
 
 ## Table of content
 
 <!-- TOC -->
 
-- [go-proxy](#go-proxy)
+- [GoDoxy](#godoxy)
   - [Table of content](#table-of-content)
-  - [Key Points](#key-points)
-  - [Getting Started](#getting-started)
-    - [Setup](#setup)
-    - [Commands line arguments](#commands-line-arguments)
-    - [Environment variables](#environment-variables)
-    - [Use JSON Schema in VSCode](#use-json-schema-in-vscode)
-    - [Config File](#config-file)
-    - [Provider File](#provider-file)
-  - [Known issues](#known-issues)
+  - [Key Features](#key-features)
+  - [Prerequisites](#prerequisites)
+  - [Setup](#setup)
+    - [Manual Setup](#manual-setup)
+    - [Folder structrue](#folder-structrue)
+  - [Screenshots](#screenshots)
+    - [idlesleeper](#idlesleeper)
   - [Build it yourself](#build-it-yourself)
 
-## Key Points
+## Key Features
 
 - Easy to use
   - Effortless configuration
+  - Simple multi-node setup
   - Error messages is clear and detailed, easy troubleshooting
-- Auto certificate obtaining and renewal (See [Supported DNS Challenge Providers](docs/dns_providers.md))
+- Auto SSL cert management (See [Supported DNS-01 Challenge Providers](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers))
 - Auto configuration for docker containers
 - Auto hot-reload on container state / config file changes
-- Stop containers on idle, wake it up on traffic _(optional)_
+- **idlesleeper**: stop containers on idle, wake it up on traffic _(optional, see [screenshots](#idlesleeper))_
 - HTTP(s) reserve proxy
+- OpenID Connect support
+- [HTTP middleware support](https://github.com/yusing/go-proxy/wiki/Middlewares)
+- [Custom error pages support](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
 - TCP and UDP port forwarding
-- Web UI for configuration and monitoring (See [screenshots](https://github.com/yusing/go-proxy-frontend?tab=readme-ov-file#screenshots))
+- **Web UI with App dashboard and config editor**
+- Supports linux/amd64, linux/arm64
 - Written in **[Go](https://go.dev)**
 
 [🔼Back to top](#table-of-content)
 
-## Getting Started
+## Prerequisites
 
-### Setup
+Setup DNS Records point to machine which runs `GoDoxy`, e.g.
 
-1. Setup DNS Records, e.g.
+- A Record: `*.y.z` -> `10.0.10.1`
+- AAAA Record: `*.y.z` -> `::ffff:a00:a01`
 
-   - A Record: `*.y.z` -> `10.0.10.1`
-   - AAAA Record: `*.y.z` -> `::ffff:a00:a01`
+## Setup
 
-2. Setup `go-proxy` [See here](docs/docker.md)
+**NOTE:** GoDoxy is designed to be (and only works when) running in `host` network mode, do not change it. To change listening ports, modify `.env`.
 
-3. Setup `docker-socket-proxy` (see [example](docs/docker_socket_proxy.md) other machine that is running docker (if any)
+1.  Pull the latest docker images
 
-4. Configure `go-proxy`
-   - with text editor (e.g. Visual Studio Code)
-   - or with web config editor via `http://gp.y.z`
+    ```shell
+    docker pull ghcr.io/yusing/go-proxy:latest
+    ```
+
+2.  Create new directory, `cd` into it, then run setup, or [set up manually](#manual-setup)
+
+    ```shell
+    docker run --rm -v .:/setup ghcr.io/yusing/go-proxy /app/godoxy setup
+    ```
+
+3.  _(Optional)_ setup `docker-socket-proxy` other docker nodes (see [Multi docker nodes setup](https://github.com/yusing/go-proxy/wiki/Configurations#multi-docker-nodes-setup)) then add them inside `config.yml`
+
+4.  Start the container `docker compose up -d`
+
+5.  You may now do some extra configuration on WebUI `https://godoxy.domain.com`
 
 [🔼Back to top](#table-of-content)
 
-### Commands line arguments
+### Manual Setup
 
-| Argument    | Description                      | Example                    |
-| ----------- | -------------------------------- | -------------------------- |
-| empty       | start proxy server               |                            |
-| `validate`  | validate config and exit         |                            |
-| `reload`    | trigger a force reload of config |                            |
-| `ls-config` | list config and exit             | `go-proxy ls-config \| jq` |
-| `ls-route`  | list proxy entries and exit      | `go-proxy ls-route \| jq`  |
+1. Make `config` directory then grab `config.example.yml` into `config/config.yml`
 
-**run with `docker exec <container_name> /app/go-proxy <command>`**
+   `mkdir -p config && wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/config.example.yml -O config/config.yml`
 
-### Environment variables
+2. Grab `.env.example` into `.env`
 
-| Environment Variable           | Description                                 | Default          | Values        |
-| ------------------------------ | ------------------------------------------- | ---------------- | ------------- |
-| `GOPROXY_NO_SCHEMA_VALIDATION` | disable schema validation                   | `false`          | boolean       |
-| `GOPROXY_DEBUG`                | enable debug behaviors                      | `false`          | boolean       |
-| `GOPROXY_HTTP_ADDR`            | http server listening address               | `:80`            | `[host]:port` |
-| `GOPROXY_HTTPS_ADDR`           | https server listening address (if enabled) | `:443`           | `[host]:port` |
-| `GOPROXY_API_ADDR`             | api server listening address                | `127.0.0.1:8888` | `[host]:port` |
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/.env.example -O .env`
 
-### Use JSON Schema in VSCode
+3. Grab `compose.example.yml` into `compose.yml`
 
-Copy [`.vscode/settings.example.json`](.vscode/settings.example.json) to `.vscode/settings.json` and modify it to fit your needs
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/compose.example.yml -O compose.yml`
 
-[🔼Back to top](#table-of-content)
+### Folder structrue
 
-### Config File
-
-See [config.example.yml](config.example.yml) for more
-
-```yaml
-# autocert configuration
-autocert:
-  email: # ACME Email
-  domains: # a list of domains for cert registration
-  provider: # DNS Challenge provider
-  options: # provider specific options
-    - ...
-# reverse proxy providers configuration
-providers:
-  include:
-    - providers.yml
-    - other_file_1.yml
-    - ...
-  docker:
-    local: $DOCKER_HOST
-    remote-1: tcp://10.0.2.1:2375
-    remote-2: ssh://root:1234@10.0.2.2
+```shell
+├── certs
+│   ├── cert.crt
+│   └── priv.key
+├── compose.yml
+├── config
+│   ├── config.yml
+│   ├── middlewares
+│   │   ├── middleware1.yml
+│   │   ├── middleware2.yml
+│   ├── provider1.yml
+│   └── provider2.yml
+└── .env
 ```
 
-[🔼Back to top](#table-of-content)
+## Screenshots
 
-### Provider File
+### idlesleeper
 
-See [Fields](docs/docker.md#fields)
-
-See [providers.example.yml](providers.example.yml) for examples
-
-[🔼Back to top](#table-of-content)
-
-## Known issues
-
-- `autocert` config is not hot-reloadable
+![idlesleeper](screenshots/idlesleeper.webp)
 
 [🔼Back to top](#table-of-content)
 

README_CHT.md

@@ -1,141 +1,140 @@
-# go-proxy
+<div align="center">
+
+# GoDoxy
 
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+![GitHub last commit](https://img.shields.io/github/last-commit/yusing/go-proxy)
 [![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![](https://dcbadge.limes.pink/api/server/umReR62nRd?style=flat)](https://discord.gg/umReR62nRd)
 
-一個輕量化、易用且[高效](docs/benchmark_result.md)的反向代理和端口轉發工具
+輕量、易用、 [高效能](https://github.com/yusing/go-proxy/wiki/Benchmarks)，且帶有主頁和配置面板的反向代理
+
+完整文檔請查閱 **[Wiki](https://github.com/yusing/go-proxy/wiki)**（暫未有中文翻譯）
+
+<!-- [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
+[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy) -->
+
+<a href="README.md">EN</a> | **中文**
+
+<img src="https://github.com/user-attachments/assets/4bb371f4-6e4c-425c-89b2-b9e962bdd46f" style="max-width: 650">
+
+</div>
 
 ## 目錄
 
 <!-- TOC -->
 
-- [go-proxy](#go-proxy)
+- [GoDoxy](#godoxy)
   - [目錄](#目錄)
-  - [重點](#重點)
-  - [入門指南](#入門指南)
-    - [安裝](#安裝)
-    - [命令行參數](#命令行參數)
-    - [環境變量](#環境變量)
-    - [VSCode 中使用 JSON Schema](#vscode-中使用-json-schema)
-    - [配置文件](#配置文件)
-    - [透過文件配置](#透過文件配置)
-  - [已知問題](#已知問題)
-  - [源碼編譯](#源碼編譯)
+  - [主要特點](#主要特點)
+  - [前置需求](#前置需求)
+  - [安裝](#安裝)
+    - [手動安裝](#手動安裝)
+    - [資料夾結構](#資料夾結構)
+  - [截圖](#截圖)
+    - [閒置休眠](#閒置休眠)
+  - [自行編譯](#自行編譯)
 
-## 重點
+## 主要特點
 
-- 易用
-  - 不需花費太多時間就能輕鬆配置
-  - 除錯簡單
-- 自動處理 HTTPS 證書（參見[可用的 DNS 供應商](docs/dns_providers.md)）
-- 透過 Docker 容器自動配置
-- 容器狀態變更時自動熱重載
-- 容器閒置時自動暫停/停止，入站時自動喚醒
-- HTTP(s)反向代理
-- TCP/UDP 端口轉發
-- 用於配置和監控的前端 Web 面板（[截圖](https://github.com/yusing/go-proxy-frontend?tab=readme-ov-file#screenshots)）
+- 容易使用
+  - 輕鬆配置
+  - 簡單的多節點設置
+  - 錯誤訊息清晰詳細，易於排除故障
+- 自動 SSL 憑證管理（參見 [支援的 DNS-01 驗證提供商](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers)）
+- 自動配置 Docker 容器
+- 容器狀態/配置文件變更時自動熱重載
+- **閒置休眠**：在閒置時停止容器，有流量時喚醒（_可選，參見[截圖](#閒置休眠)_）
+- HTTP(s) 反向代理
+- OpenID Connect 支持
+- [HTTP 中介軟體支援](https://github.com/yusing/go-proxy/wiki/Middlewares)
+- [自訂錯誤頁面支援](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
+- TCP 和 UDP 埠轉發
+- **網頁介面，具有應用儀表板和配置編輯器**
+- 支援 linux/amd64、linux/arm64
 - 使用 **[Go](https://go.dev)** 編寫
 
-[🔼 返回頂部](#目錄)
+[🔼回到頂部](#目錄)
 
-## 入門指南
+## 前置需求
 
-### 安裝
+設置 DNS 記錄指向運行 `GoDoxy` 的機器，例如：
 
-1. 設置 DNS 記錄，例如：
+- A 記錄：`*.y.z` -> `10.0.10.1`
+- AAAA 記錄：`*.y.z` -> `::ffff:a00:a01`
 
-   - A 記錄: `*.y.z` -> `10.0.10.1`
-   - AAAA 記錄: `*.y.z` -> `::ffff:a00:a01`
+## 安裝
 
-2. 安裝 `go-proxy` [參見這裡](docs/docker.md)
+1.  拉取最新的 Docker 映像
 
-3. 配置 `go-proxy`
-   - 使用文本編輯器 (推薦 Visual Studio Code [參見 VSCode 使用 schema](#vscode-中使用-json-schema))
-   - 或通過 `http://gp.y.z` 使用網頁配置編輯器
+    ```shell
+    docker pull ghcr.io/yusing/go-proxy:latest
+    ```
 
-[🔼 返回頂部](#目錄)
+2.  建立新目錄，`cd` 進入後運行安裝，或[手動安裝](#手動安裝)
 
-### 命令行參數
+    ```shell
+    docker run --rm -v .:/setup ghcr.io/yusing/go-proxy /app/godoxy setup
+    ```
 
-| 參數        | 描述           | 示例                       |
-| ----------- | -------------- | -------------------------- |
-| 空          | 啟動代理服務器 |                            |
-| `validate`  | 驗證配置並退出 |                            |
-| `reload`    | 強制刷新配置   |                            |
-| `ls-config` | 列出配置並退出 | `go-proxy ls-config \| jq` |
-| `ls-route`  | 列出路由並退出 | `go-proxy ls-route \| jq`  |
+3.  _（可選）_ 設置其他 Docker 節點的 `docker-socket-proxy`（參見 [多 Docker 節點設置](https://github.com/yusing/go-proxy/wiki/Configurations#multi-docker-nodes-setup)），然後在 `config.yml` 中添加它們
 
-**使用 `docker exec <容器名稱> /app/go-proxy <參數>` 運行**
+4.  啟動容器 `docker compose up -d`
 
-### 環境變量
+5.  大功告成!可前往WebUI `https://gp.domain.com` 進行額外的配置
 
-| 環境變量                       | 描述             | 默認             | 格式          |
-| ------------------------------ | ---------------- | ---------------- | ------------- |
-| `GOPROXY_NO_SCHEMA_VALIDATION` | 禁用 schema 驗證 | `false`          | boolean       |
-| `GOPROXY_DEBUG`                | 啟用調試輸出     | `false`          | boolean       |
-| `GOPROXY_HTTP_ADDR`            | http 收聽地址    | `:80`            | `[host]:port` |
-| `GOPROXY_HTTPS_ADDR`           | https 收聽地址   | `:443`           | `[host]:port` |
-| `GOPROXY_API_ADDR`             | api 收聽地址     | `127.0.0.1:8888` | `[host]:port` |
+[🔼回到頂部](#目錄)
 
-### VSCode 中使用 JSON Schema
+### 手動安裝
 
-複製 [`.vscode/settings.example.json`](.vscode/settings.example.json) 到 `.vscode/settings.json` 並根據需求修改
+1. 建立 `config` 目錄，然後將 `config.example.yml` 下載到 `config/config.yml`
 
-[🔼 返回頂部](#目錄)
+   `mkdir -p config && wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/config.example.yml -O config/config.yml`
 
-### 配置文件
+2. 將 `.env.example` 下載到 `.env`
 
-參見 [config.example.yml](config.example.yml) 了解更多
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/.env.example -O .env`
 
-```yaml
-# autocert 配置
-autocert:
-  email: # ACME 電子郵件
-  domains: # 域名列表
-  provider: # DNS 供應商
-  options: # 供應商個別配置
-    - ...
-# 配置文件 / docker
-providers:
-  include:
-    - providers.yml
-    - other_file_1.yml
-    - ...
-  docker:
-    local: $DOCKER_HOST
-    remote-1: tcp://10.0.2.1:2375
-    remote-2: ssh://root:1234@10.0.2.2
+3. 將 `compose.example.yml` 下載到 `compose.yml`
+
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.9/compose.example.yml -O compose.yml`
+
+### 資料夾結構
+
+```shell
+├── certs
+│   ├── cert.crt
+│   └── priv.key
+├── compose.yml
+├── config
+│   ├── config.yml
+│   ├── middlewares
+│   │   ├── middleware1.yml
+│   │   ├── middleware2.yml
+│   ├── provider1.yml
+│   └── provider2.yml
+└── .env
 ```
 
-[🔼 返回頂部](#目錄)
+## 截圖
 
-### 透過文件配置
+### 閒置休眠
 
-參見 [Fields](docs/docker.md#fields)
+![閒置休眠](screenshots/idlesleeper.webp)
 
-參見範例 [providers.example.yml](providers.example.yml)
+[🔼回到頂部](#目錄)
 
-[🔼 返回頂部](#目錄)
+## 自行編譯
 
-## 已知問題
+1. 克隆儲存庫 `git clone https://github.com/yusing/go-proxy --depth=1`
 
-- `autocert` 配置不能熱重載
+2. 如果尚未安裝，請安裝/升級 [go (>=1.22)](https://go.dev/doc/install) 和 `make`
 
-[🔼 返回頂部](#目錄)
+3. 如果之前編譯過（go < 1.22），請使用 `go clean -cache` 清除快取
 
-## 源碼編譯
+4. 使用 `make get` 獲取依賴
 
-1. 獲取源碼 `git clone https://github.com/yusing/go-proxy --depth=1`
+5. 使用 `make build` 編譯二進制檔案
 
-2. 安裝/升級 [go 版本 (>=1.22)](https://go.dev/doc/install) 和 `make`（如果尚未安裝）
-
-3. 如果之前編譯過（go 版本 < 1.22），請使用 `go clean -cache` 清除緩存
-
-4. 使用 `make get` 獲取依賴項
-
-5. 使用 `make build` 編譯
-
-[🔼 返回頂部](#目錄)
+[🔼回到頂部](#目錄)

bun.lock

@@ -0,0 +1,120 @@
+{
+  "lockfileVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "godoxy-types",
+      "devDependencies": {
+        "prettier": "^3.4.2",
+        "typescript": "^5.7.3",
+        "typescript-json-schema": "^0.65.1",
+      },
+    },
+  },
+  "packages": {
+    "@cspotcode/source-map-support": ["@cspotcode/source-map-support@0.8.1", "", { "dependencies": { "@jridgewell/trace-mapping": "0.3.9" } }, "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw=="],
+
+    "@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
+
+    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.0", "", {}, "sha512-gv3ZRaISU3fjPAgNsriBRqGWQL6quFx04YMPW/zD8XMLsU32mhCCbfbO6KZFLjvYpCZ8zyDEgqsgf+PwPaM7GQ=="],
+
+    "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.9", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.0.3", "@jridgewell/sourcemap-codec": "^1.4.10" } }, "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ=="],
+
+    "@tsconfig/node10": ["@tsconfig/node10@1.0.11", "", {}, "sha512-DcRjDCujK/kCk/cUe8Xz8ZSpm8mS3mNNpta+jGCA6USEDfktlNvm1+IuZ9eTcDbNk41BHwpHHeW+N1lKCz4zOw=="],
+
+    "@tsconfig/node12": ["@tsconfig/node12@1.0.11", "", {}, "sha512-cqefuRsh12pWyGsIoBKJA9luFu3mRxCA+ORZvA4ktLSzIuCUtWVxGIuXigEwO5/ywWFMZ2QEGKWvkZG1zDMTag=="],
+
+    "@tsconfig/node14": ["@tsconfig/node14@1.0.3", "", {}, "sha512-ysT8mhdixWK6Hw3i1V2AeRqZ5WfXg1G43mqoYlM2nc6388Fq5jcXyr5mRsqViLx/GJYdoL0bfXD8nmF+Zn/Iow=="],
+
+    "@tsconfig/node16": ["@tsconfig/node16@1.0.4", "", {}, "sha512-vxhUy4J8lyeyinH7Azl1pdd43GJhZH/tP2weN8TntQblOY+A0XbT8DJk1/oCPuOOyg/Ja757rG0CgHcWC8OfMA=="],
+
+    "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
+
+    "@types/node": ["@types/node@18.19.74", "", { "dependencies": { "undici-types": "~5.26.4" } }, "sha512-HMwEkkifei3L605gFdV+/UwtpxP6JSzM+xFk2Ia6DNFSwSVBRh9qp5Tgf4lNFOMfPVuU0WnkcWpXZpgn5ufO4A=="],
+
+    "acorn": ["acorn@8.14.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-cl669nCJTZBsL97OF4kUQm5g5hC2uihk0NxY3WENAC0TYdILVkAyHymAntgxGkl7K+t0cXIrH5siy5S4XkFycA=="],
+
+    "acorn-walk": ["acorn-walk@8.3.4", "", { "dependencies": { "acorn": "^8.11.0" } }, "sha512-ueEepnujpqee2o5aIYnvHU6C0A42MNdsIDeqy5BydrkuC5R1ZuUFnm27EeFJGoEHJQgn3uleRvmTXaJgfXbt4g=="],
+
+    "ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+
+    "arg": ["arg@4.1.3", "", {}, "sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA=="],
+
+    "balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
+
+    "brace-expansion": ["brace-expansion@1.1.11", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA=="],
+
+    "cliui": ["cliui@8.0.1", "", { "dependencies": { "string-width": "^4.2.0", "strip-ansi": "^6.0.1", "wrap-ansi": "^7.0.0" } }, "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ=="],
+
+    "color-convert": ["color-convert@2.0.1", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
+
+    "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
+
+    "concat-map": ["concat-map@0.0.1", "", {}, "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="],
+
+    "create-require": ["create-require@1.1.1", "", {}, "sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ=="],
+
+    "diff": ["diff@4.0.2", "", {}, "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A=="],
+
+    "emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
+
+    "fs.realpath": ["fs.realpath@1.0.0", "", {}, "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="],
+
+    "get-caller-file": ["get-caller-file@2.0.5", "", {}, "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg=="],
+
+    "glob": ["glob@7.2.3", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.1.1", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q=="],
+
+    "inflight": ["inflight@1.0.6", "", { "dependencies": { "once": "^1.3.0", "wrappy": "1" } }, "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA=="],
+
+    "inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="],
+
+    "is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
+
+    "make-error": ["make-error@1.3.6", "", {}, "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw=="],
+
+    "minimatch": ["minimatch@3.1.2", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw=="],
+
+    "once": ["once@1.4.0", "", { "dependencies": { "wrappy": "1" } }, "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w=="],
+
+    "path-equal": ["path-equal@1.2.5", "", {}, "sha512-i73IctDr3F2W+bsOWDyyVm/lqsXO47aY9nsFZUjTT/aljSbkxHxxCoyZ9UUrM8jK0JVod+An+rl48RCsvWM+9g=="],
+
+    "path-is-absolute": ["path-is-absolute@1.0.1", "", {}, "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg=="],
+
+    "prettier": ["prettier@3.4.2", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-e9MewbtFo+Fevyuxn/4rrcDAaq0IYxPGLvObpQjiZBMAzB9IGmzlnG9RZy3FFas+eBMu2vA0CszMeduow5dIuQ=="],
+
+    "require-directory": ["require-directory@2.1.1", "", {}, "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q=="],
+
+    "safe-stable-stringify": ["safe-stable-stringify@2.5.0", "", {}, "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA=="],
+
+    "string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "ts-node": ["ts-node@10.9.2", "", { "dependencies": { "@cspotcode/source-map-support": "^0.8.0", "@tsconfig/node10": "^1.0.7", "@tsconfig/node12": "^1.0.7", "@tsconfig/node14": "^1.0.0", "@tsconfig/node16": "^1.0.2", "acorn": "^8.4.1", "acorn-walk": "^8.1.1", "arg": "^4.1.0", "create-require": "^1.1.0", "diff": "^4.0.1", "make-error": "^1.1.1", "v8-compile-cache-lib": "^3.0.1", "yn": "3.1.1" }, "peerDependencies": { "@swc/core": ">=1.2.50", "@swc/wasm": ">=1.2.50", "@types/node": "*", "typescript": ">=2.7" }, "optionalPeers": ["@swc/core", "@swc/wasm"], "bin": { "ts-node": "dist/bin.js", "ts-script": "dist/bin-script-deprecated.js", "ts-node-cwd": "dist/bin-cwd.js", "ts-node-esm": "dist/bin-esm.js", "ts-node-script": "dist/bin-script.js", "ts-node-transpile-only": "dist/bin-transpile.js" } }, "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ=="],
+
+    "typescript": ["typescript@5.7.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-84MVSjMEHP+FQRPy3pX9sTVV/INIex71s9TL2Gm5FG/WG1SqXeKyZ0k7/blY/4FdOzI12CBy1vGc4og/eus0fw=="],
+
+    "typescript-json-schema": ["typescript-json-schema@0.65.1", "", { "dependencies": { "@types/json-schema": "^7.0.9", "@types/node": "^18.11.9", "glob": "^7.1.7", "path-equal": "^1.2.5", "safe-stable-stringify": "^2.2.0", "ts-node": "^10.9.1", "typescript": "~5.5.0", "yargs": "^17.1.1" }, "bin": { "typescript-json-schema": "bin/typescript-json-schema" } }, "sha512-tuGH7ff2jPaUYi6as3lHyHcKpSmXIqN7/mu50x3HlYn0EHzLpmt3nplZ7EuhUkO0eqDRc9GqWNkfjgBPIS9kxg=="],
+
+    "undici-types": ["undici-types@5.26.5", "", {}, "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA=="],
+
+    "v8-compile-cache-lib": ["v8-compile-cache-lib@3.0.1", "", {}, "sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg=="],
+
+    "wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
+
+    "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+
+    "y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="],
+
+    "yargs": ["yargs@17.7.2", "", { "dependencies": { "cliui": "^8.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "require-directory": "^2.1.1", "string-width": "^4.2.3", "y18n": "^5.0.5", "yargs-parser": "^21.1.1" } }, "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w=="],
+
+    "yargs-parser": ["yargs-parser@21.1.1", "", {}, "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="],
+
+    "yn": ["yn@3.1.1", "", {}, "sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q=="],
+
+    "typescript-json-schema/typescript": ["typescript@5.5.4", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-Mtq29sKDAEYP7aljRgtPOpTvOfbwRWlS6dPRzwjdE+C0R4brX/GUyhHSecbHMFLNBLcJIPt9nl9yG5TZ1weH+Q=="],
+  }
+}

cmd/main.go

@@ -0,0 +1,171 @@
+package main
+
+import (
+	"encoding/json"
+	"io"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/yusing/go-proxy/internal"
+	v1 "github.com/yusing/go-proxy/internal/api/v1"
+	"github.com/yusing/go-proxy/internal/api/v1/auth"
+	"github.com/yusing/go-proxy/internal/api/v1/favicon"
+	"github.com/yusing/go-proxy/internal/api/v1/query"
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/config"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/homepage"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
+	"github.com/yusing/go-proxy/internal/route/routes/routequery"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/pkg"
+)
+
+var rawLogger = log.New(os.Stdout, "", 0)
+
+func init() {
+	var out io.Writer = os.Stderr
+	if common.EnableLogStreaming {
+		out = zerolog.MultiLevelWriter(out, v1.GetMemLogger())
+	}
+	logging.InitLogger(out)
+	// logging.AddHook(v1.GetMemLogger())
+}
+
+func main() {
+	initProfiling()
+	args := common.GetArgs()
+
+	switch args.Command {
+	case common.CommandSetup:
+		internal.Setup()
+		return
+	case common.CommandReload:
+		if err := query.ReloadServer(); err != nil {
+			E.LogFatal("server reload error", err)
+		}
+		rawLogger.Println("ok")
+		return
+	case common.CommandListIcons:
+		icons, err := internal.ListAvailableIcons()
+		if err != nil {
+			rawLogger.Fatal(err)
+		}
+		printJSON(icons)
+		return
+	case common.CommandListRoutes:
+		routes, err := query.ListRoutes()
+		if err != nil {
+			log.Printf("failed to connect to api server: %s", err)
+			log.Printf("falling back to config file")
+		} else {
+			printJSON(routes)
+			return
+		}
+	case common.CommandDebugListMTrace:
+		trace, err := query.ListMiddlewareTraces()
+		if err != nil {
+			log.Fatal(err)
+		}
+		printJSON(trace)
+		return
+	}
+
+	if args.Command == common.CommandStart {
+		logging.Info().Msgf("GoDoxy version %s", pkg.GetVersion())
+		logging.Trace().Msg("trace enabled")
+		// logging.AddHook(notif.GetDispatcher())
+	} else {
+		logging.DiscardLogger()
+	}
+
+	if args.Command == common.CommandValidate {
+		data, err := os.ReadFile(common.ConfigPath)
+		if err == nil {
+			err = config.Validate(data)
+		}
+		if err != nil {
+			log.Fatal("config error: ", err)
+		}
+		log.Print("config OK")
+		return
+	}
+
+	for _, dir := range common.RequiredDirectories {
+		prepareDirectory(dir)
+	}
+
+	middleware.LoadComposeFiles()
+
+	var cfg *config.Config
+	var err E.Error
+	if cfg, err = config.Load(); err != nil {
+		E.LogWarn("errors in config", err)
+	}
+
+	switch args.Command {
+	case common.CommandListRoutes:
+		cfg.StartProxyProviders()
+		printJSON(routequery.RoutesByAlias())
+		return
+	case common.CommandListConfigs:
+		printJSON(cfg.Value())
+		return
+	case common.CommandDebugListEntries:
+		printJSON(cfg.DumpRoutes())
+		return
+	case common.CommandDebugListProviders:
+		printJSON(cfg.DumpRouteProviders())
+		return
+	}
+
+	go internal.InitIconListCache()
+	go homepage.InitOverridesConfig()
+	go favicon.InitIconCache()
+
+	cfg.Start(&config.StartServersOptions{
+		Proxy: true,
+	})
+	if err := auth.Initialize(); err != nil {
+		logging.Fatal().Err(err).Msg("failed to initialize authentication")
+	}
+	// API Handler needs to start after auth is initialized.
+	cfg.StartServers(&config.StartServersOptions{
+		API: true,
+	})
+
+	config.WatchChanges()
+
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, syscall.SIGINT)
+	signal.Notify(sig, syscall.SIGTERM)
+	signal.Notify(sig, syscall.SIGHUP)
+
+	// wait for signal
+	<-sig
+
+	// gracefully shutdown
+	logging.Info().Msg("shutting down")
+	_ = task.GracefulShutdown(time.Second * time.Duration(cfg.Value().TimeoutShutdown))
+}
+
+func prepareDirectory(dir string) {
+	if _, err := os.Stat(dir); os.IsNotExist(err) {
+		if err = os.MkdirAll(dir, 0o755); err != nil {
+			logging.Fatal().Msgf("failed to create directory %s: %v", dir, err)
+		}
+	}
+}
+
+func printJSON(obj any) {
+	j, err := json.MarshalIndent(obj, "", "  ")
+	if err != nil {
+		logging.Fatal().Err(err).Send()
+	}
+	rawLogger.Print(string(j)) // raw output for convenience using "jq"
+}

cmd/main_production.go

@@ -0,0 +1,7 @@
+//go:build production
+
+package main
+
+func initProfiling() {
+	// no profiling in production
+}

cmd/main_prof.go

@@ -0,0 +1,20 @@
+//go:build pprof
+
+package main
+
+import (
+	"log"
+	"net/http"
+	_ "net/http/pprof"
+	"runtime"
+	"runtime/debug"
+)
+
+func initProfiling() {
+	runtime.GOMAXPROCS(2)
+	debug.SetMemoryLimit(100 * 1024 * 1024)
+	debug.SetMaxStack(15 * 1024 * 1024)
+	go func() {
+		log.Println(http.ListenAndServe(":7777", nil))
+	}()
+}

compose.example.yml

@@ -1,33 +1,41 @@
+---
 services:
   frontend:
     image: ghcr.io/yusing/go-proxy-frontend:latest
-    container_name: go-proxy-frontend
+    container_name: godoxy-frontend
     restart: unless-stopped
     network_mode: host
-    labels:
-      - proxy.aliases=gp
-      - proxy.gp.port=3000
+    env_file: .env
     depends_on:
       - app
+    # modify below to fit your needs
+    labels:
+      proxy.aliases: godoxy
+      proxy.godoxy.port: 3000
+      # proxy.godoxy.middlewares.cidr_whitelist: |
+      #   status: 403
+      #   message: IP not allowed
+      #   allow:
+      #     - 127.0.0.1
+      #     - 10.0.0.0/8
+      #     - 192.168.0.0/16
+      #     - 172.16.0.0/12
   app:
     image: ghcr.io/yusing/go-proxy:latest
-    container_name: go-proxy
+    container_name: godoxy
     restart: always
     network_mode: host
-    environment:
-      # (Optional) change this to your timezone to get correct log timestamp
-      TZ: ETC/UTC
+    env_file: .env
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./config:/app/config
+      - ./logs:/app/logs
+      - ./error_pages:/app/error_pages
 
-      # (Optional) choose one of below to enable https
-      # 1. use existing certificate
-      # if your cert is not named `cert.crt` change `cert_path` in `config/config.yml`
-      # if your cert key is not named `priv.key` change `key_path` in `config/config.yml`
+      # To use autocert, certs will be stored in "./certs".
+      # You can also use a docker volume to store it
+      - ./certs:/app/certs
 
-      # - /path/to/certs:/app/certs
-
-      # 2. use autocert, certs will be stored in ./certs (or other path you specify)
-
-      # - ./certs:/app/certs
+      # remove "./certs:/app/certs" and uncomment below to use existing certificate
+      # - /path/to/certs/cert.crt:/app/certs/cert.crt
+      # - /path/to/certs/priv.key:/app/certs/priv.key

config.example.yml

@@ -1,37 +1,91 @@
 # Autocert (choose one below and uncomment to enable)
-
+#
 # 1. use existing cert
+
 # autocert:
 #   provider: local
-#   cert_path: certs/cert.crt # optional, uncomment only if you need to change it
-#   key_path: certs/priv.key # optional, uncomment only if you need to change it
 
 # 2. cloudflare
 # autocert:
 #   provider: cloudflare
-#   email: # ACME Email
+#   email: abc@gmail.com # ACME Email
 #   domains: # a list of domains for cert registration
-#     - x.y.z
+#     - "*.domain.com"
+#     - "domain.com"
 #   options:
-#     - auth_token: c1234565789-abcdefghijklmnopqrst # your zone API token
+#     auth_token: c1234565789-abcdefghijklmnopqrst # your zone API token
 
-# 3. other providers, check readme for more
+# 3. other providers, see https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers#supported-dns-01-providers
+
+entrypoint:
+  # Below define an example of middleware config
+  # 1. block non local IP connections
+  # 2. redirect HTTP to HTTPS
+  #
+  # middlewares:
+  #   - use: CIDRWhitelist
+  #     allow:
+  #       - "127.0.0.1"
+  #       - "10.0.0.0/8"
+  #       - "172.16.0.0/12"
+  #       - "192.168.0.0/16"
+  #     status: 403
+  #     message: "Forbidden"
+  #   - use: RedirectHTTP
+
+  # below enables access log
+  access_log:
+    format: combined
+    path: /app/logs/entrypoint.log
 
 providers:
-  include:
-    - providers.yml # config/providers.yml
-    # add some more below if you want
-    # - file1.yml # config/file_1.yml
-    # - file2.yml
+  # include files are standalone yaml files under `config/` directory
+  #
+  # include:
+  #   - file1.yml
+  #   - file2.yml
+
   docker:
-    # for value format, see https://docs.docker.com/reference/cli/dockerd/
-    # $DOCKER_HOST implies unix:///var/run/docker.sock by default
+    # $DOCKER_HOST implies environment variable `DOCKER_HOST` or unix:///var/run/docker.sock by default
     local: $DOCKER_HOST
+
+    # explicit only mode
+    # only containers with explicit aliases will be proxied
+    # add "!" after provider name to enable explicit only mode
+    #
+    # local!: $DOCKER_HOST
+    #
     # add more docker providers if needed
+    # for value format, see https://docs.docker.com/reference/cli/dockerd/
+    #
     # remote-1: tcp://10.0.2.1:2375
     # remote-2: ssh://root:1234@10.0.2.2
 
-# Fixed options (optional, non hot-reloadable)
+  # notification providers (notify when service health changes)
+  #
+  # notification:
+  #   - name: gotify
+  #     provider: gotify
+  #     url: https://gotify.domain.tld
+  #     token: abcd
+  #   - name: discord
+  #     provider: webhook
+  #     url: https://discord.com/api/webhooks/...
+  #     template: discord # this means use payload template from internal/notif/templates/discord.json
 
-# timeout_shutdown: 5
-# redirect_to_https: false
+# Check https://github.com/yusing/go-proxy/wiki/Certificates-and-domain-matching#domain-matching
+# for explaination of `match_domains`
+#
+# match_domains:
+#   - my.site
+#   - node1.my.app
+
+# homepage config
+homepage:
+  # use default app categories detected from alias or docker image name
+  use_default_categories: true
+
+# Below are fixed options (non hot-reloadable)
+
+# timeout for shutdown (in seconds)
+timeout_shutdown: 5

docs/add_dns_provider.md

@@ -1,41 +0,0 @@
-# Adding provider support
-
-## **CloudDNS** as an example
-
-1. Fork this repo, modify [autocert.go](../src/go-proxy/autocert.go#L305)
-
-   ```go
-   var providersGenMap = map[string]ProviderGenerator{
-     "cloudflare": providerGenerator(cloudflare.NewDefaultConfig, cloudflare.NewDNSProviderConfig),
-     // add here, e.g.
-     "clouddns": providerGenerator(clouddns.NewDefaultConfig, clouddns.NewDNSProviderConfig),
-   }
-   ```
-
-2. Go to [https://go-acme.github.io/lego/dns/clouddns](https://go-acme.github.io/lego/dns/clouddns/) and check for required config
-
-3. Build `go-proxy` with `make build`
-
-4. Set required config in `config.yml` `autocert` -> `options` section
-
-   ```shell
-   # From https://go-acme.github.io/lego/dns/clouddns/
-   CLOUDDNS_CLIENT_ID=bLsdFAks23429841238feb177a572aX \
-   CLOUDDNS_EMAIL=you@example.com \
-   CLOUDDNS_PASSWORD=b9841238feb177a84330f \
-   lego --email you@example.com --dns clouddns --domains my.example.org run
-   ```
-
-   Should turn into:
-
-   ```yaml
-   autocert:
-     ...
-     options:
-       client_id: bLsdFAks23429841238feb177a572aX
-       email: you@example.com
-       password: b9841238feb177a84330f
-   ```
-
-5. Run with `GOPROXY_NO_SCHEMA_VALIDATION=1` and test if it works
-6. Commit and create pull request

docs/benchmark_result.md

@@ -1,104 +0,0 @@
-# Benchmarks
-
-Benchmarked with `wrk` and `traefik/whoami`'s `/bench` endpoint
-
-## Remote benchmark
-
-- Direct connection
-
-  ```shell
-  root@yusing-pc:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.100.3:8003/bench
-  Running 10s test @ http://10.0.100.3:8003/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency    94.75ms  199.92ms   1.68s    91.27%
-      Req/Sec     4.24k     1.79k   18.79k    72.13%
-    Latency Distribution
-      50%    1.14ms
-      75%  120.23ms
-      90%  245.63ms
-      99%    1.03s
-    423444 requests in 10.10s, 50.88MB read
-    Socket errors: connect 0, read 0, write 0, timeout 29
-  Requests/sec:  41926.32
-  Transfer/sec:      5.04MB
-  ```
-
-- With reverse proxy
-
-  ```shell
-  root@yusing-pc:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.1.7/bench
-  Running 10s test @ http://10.0.1.7/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency    79.35ms  169.79ms   1.69s    92.55%
-      Req/Sec     4.27k     1.90k   19.61k    75.81%
-    Latency Distribution
-      50%    1.12ms
-      75%  105.66ms
-      90%  200.22ms
-      99%  814.59ms
-    409836 requests in 10.10s, 49.25MB read
-    Socket errors: connect 0, read 0, write 0, timeout 18
-  Requests/sec:  40581.61
-  Transfer/sec:      4.88MB
-  ```
-
-## Local benchmark (client running wrk and `go-proxy` server are under same proxmox host but different LXCs)
-
-- Direct connection
-
-  ```shell
-  root@http-benchmark-client:~# wrk -t 10 -c 200 -d 10s --latency http://10.0.100.1/bench
-  Running 10s test @ http://10.0.100.1/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency   434.08us  539.35us   8.76ms   85.28%
-      Req/Sec    67.71k     6.31k   87.21k    71.20%
-    Latency Distribution
-      50%  153.00us
-      75%  646.00us
-      90%    1.18ms
-      99%    2.38ms
-    6739591 requests in 10.01s, 809.85MB read
-  Requests/sec: 673608.15
-  Transfer/sec:     80.94MB
-  ```
-
-- With `go-proxy` reverse proxy
-
-  ```shell
-  root@http-benchmark-client:~# wrk -t 10 -c 200 -d 10s -H "Host: bench.6uo.me" --latency http://10.0.1.7/bench
-  Running 10s test @ http://10.0.1.7/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency     1.23ms    0.96ms  11.43ms   72.09%
-      Req/Sec    17.48k     1.76k   21.48k    70.20%
-    Latency Distribution
-      50%    0.98ms
-      75%    1.76ms
-      90%    2.54ms
-      99%    4.24ms
-    1739079 requests in 10.01s, 208.97MB read
-  Requests/sec: 173779.44
-  Transfer/sec:     20.88MB
-  ```
-
-- With `traefik-v3`
-
-  ```shell
-  root@traefik-benchmark:~# wrk -t10 -c200 -d10s -H "Host: benchmark.whoami" --latency http://127.0.0.1:8000/bench
-  Running 10s test @ http://127.0.0.1:8000/bench
-    10 threads and 200 connections
-    Thread Stats   Avg      Stdev     Max   +/- Stdev
-      Latency     2.81ms   10.36ms 180.26ms   98.57%
-      Req/Sec    11.35k     1.74k   13.76k    85.54%
-    Latency Distribution
-      50%    1.59ms
-      75%    2.27ms
-      90%    3.17ms
-      99%   37.91ms
-    1125723 requests in 10.01s, 109.50MB read
-  Requests/sec: 112499.59
-  Transfer/sec:     10.94MB
-  ```

docs/dns_providers.md

@@ -1,53 +0,0 @@
-# Supported DNS Providers
-
-<!-- TOC -->
-
-- [Supported DNS Providers](#supported-dns-providers)
-  - [Cloudflare](#cloudflare)
-  - [CloudDNS](#clouddns)
-  - [DuckDNS](#duckdns)
-  - [OVHCloud](#ovhcloud)
-  - [Implement other DNS providers](#implement-other-dns-providers)
-
-## Cloudflare
-
-`auth_token` your zone API token
-
-Follow [this guide](https://cloudkul.com/blog/automcatic-renew-and-generate-ssl-on-your-website-using-lego-client/) to create a new token with `Zone.DNS` read and edit permissions
-
-## CloudDNS
-
-- `client_id`
-
-- `email`
-
-- `password`
-
-## DuckDNS
-
-- `token`: DuckDNS Token
-
-Tested by [earvingad](https://github.com/earvingad)
-
-## OVHCloud
-
-_Note, `application_key` and `oauth2_config` **CANNOT** be used together_
-
-- `api_endpoint`: Endpoint URL, or one of
-  - `ovh-eu`,
-  - `ovh-ca`,
-  - `ovh-us`,
-  - `kimsufi-eu`,
-  - `kimsufi-ca`,
-  - `soyoustart-eu`,
-  - `soyoustart-ca`
-- `application_secret`
-- `application_key`
-- `consumer_key`
-- `oauth2_config`: Client ID and Client Secret
-  - `client_id`
-  - `client_secret`
-
-## Implement other DNS providers
-
-See [add_dns_provider.md](docs/add_dns_provider.md)

docs/docker.md

@@ -1,315 +0,0 @@
-# Docker compose guide
-
-## Table of content
-
-<!-- TOC -->
-
-- [Docker compose guide](#docker-compose-guide)
-  - [Table of content](#table-of-content)
-  - [Setup](#setup)
-  - [Labels](#labels)
-    - [Syntax](#syntax)
-    - [Fields](#fields)
-      - [Key-value mapping example](#key-value-mapping-example)
-      - [List example](#list-example)
-  - [Troubleshooting](#troubleshooting)
-  - [Docker compose examples](#docker-compose-examples)
-    - [Services URLs for above examples](#services-urls-for-above-examples)
-
-## Setup
-
-1.  Install `wget` if not already
-
-    - Ubuntu based: `sudo apt install -y wget`
-    - Fedora based: `sudo yum install -y wget`
-    - Arch based: `sudo pacman -Sy wget`
-
-2.  Run setup script
-
-    `bash <(wget -qO- https://github.com/yusing/go-proxy/raw/main/setup-docker.sh)`
-
-    It will setup folder structure and required config files
-
-3.  Verify folder structure and then `cd go-proxy`
-
-    ```plain
-    go-proxy
-    ├── certs
-    ├── compose.yml
-    └── config
-        ├── config.yml
-        └── providers.yml
-    ```
-
-4.  Enable HTTPs _(optional)_
-
-    Mount a folder (to store obtained certs) or (containing existing cert)
-
-    ```yaml
-    services:
-      go-proxy:
-        ...
-        volumes:
-          - ./certs:/app/certs
-    ```
-
-    To use **autocert**, complete that section in `config.yml`, e.g.
-
-    ```yaml
-    autocert:
-      email: john.doe@x.y.z # ACME Email
-      domains: # a list of domains for cert registration
-        - x.y.z
-      provider: cloudflare
-      options:
-        - auth_token: c1234565789-abcdefghijklmnopqrst # your zone API token
-    ```
-
-    To use **existing certificate**, set path for cert and key in `config.yml`, e.g.
-
-    ```yaml
-    autocert:
-      cert_path: /app/certs/cert.crt
-      key_path: /app/certs/priv.key
-    ```
-
-5.  Modify `compose.yml` to fit your needs
-
-6.  Run `docker compose up -d` to start the container
-
-7.  Navigate to Web panel `http://gp.yourdomain.com` or use **Visual Studio Code (provides schema check)** to edit proxy config
-
-[🔼Back to top](#table-of-content)
-
-## Labels
-
-### Syntax
-
-| Label                    | Description                                                           | Default              | Accepted values                                                           |
-| ------------------------ | --------------------------------------------------------------------- | -------------------- | ------------------------------------------------------------------------- |
-| `proxy.aliases`          | comma separated aliases for subdomain and label matching              | `container_name`     | any                                                                       |
-| `proxy.exclude`          | to be excluded from `go-proxy`                                        | false                | boolean                                                                   |
-| `proxy.idle_timeout`     | time for idle (no traffic) before put it into sleep **(http/s only)** | empty **(disabled)** | `number[unit]...`, e.g. `1m30s`                                           |
-| `proxy.wake_timeout`     | time to wait for container to start before responding a loading page  | empty                | `number[unit]...`                                                         |
-| `proxy.stop_method`      | method to stop after `idle_timeout`                                   | `stop`               | `stop`, `pause`, `kill`                                                   |
-| `proxy.stop_timeout`     | time to wait for stop command                                         | `10s`                | `number[unit]...`                                                         |
-| `proxy.stop_signal`      | signal sent to container for `stop` and `kill` methods                | docker's default     | `SIGINT`, `SIGTERM`, `SIGHUP`, `SIGQUIT` and those without **SIG** prefix |
-| `proxy.<alias>.<field>`  | set field for specific alias                                          | N/A                  | N/A                                                                       |
-| `proxy.$<index>.<field>` | set field for specific alias at index (starting from **1**)           | N/A                  | N/A                                                                       |
-| `proxy.*.<field>`        | set field for all aliases                                             | N/A                  | N/A                                                                       |
-
-### Fields
-
-| Field                 | Description                                                                                    | Default                                                                          | Allowed Values / Syntax                                                                                                                                 |
-| --------------------- | ---------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scheme`              | proxy protocol                                                                                 | <ul><li>`http` for numeric port</li><li>`tcp` for `x:y` port</li></ul>           | `http`, `https`, `tcp`, `udp`                                                                                                                           |
-| `host`                | proxy host                                                                                     | <ul><li>Docker: docker client IP / hostname </li><li>File: `localhost`</li></ul> | IP address, hostname                                                                                                                                    |
-| `port`                | proxy port **(http/s)**                                                                        | first port in `ports:`                                                           | number in range of `1 - 65535`                                                                                                                          |
-| `port` **(required)** | proxy port **(tcp/udp)**                                                                       | N/A                                                                              | `x:y` <br><ul><li>x: port for `go-proxy` to listen on</li><li>y: port or [_service name_](../src/common/constants.go#L55) of target container</li></ul> |
-| `no_tls_verify`       | whether skip tls verify **(https only)**                                                       | `false`                                                                          | boolean                                                                                                                                                 |
-| `path_patterns`       | proxy path patterns **(http/s only)**<br> only requests that matched a pattern will be proxied | empty **(proxy all requests)**                                                   | yaml style list[<sup>1</sup>](#list-example) of path patterns ([syntax](https://pkg.go.dev/net/http#hdr-Patterns-ServeMux))                             |
-| `set_headers`         | header to set **(http/s only)**                                                                | empty                                                                            | yaml style key-value mapping[<sup>2</sup>](#key-value-mapping-example) of header-value pairs                                                            |
-| `hide_headers`        | header to hide **(http/s only)**                                                               | empty                                                                            | yaml style list[<sup>1</sup>](#list-example) of headers                                                                                                 |
-
-[🔼Back to top](#table-of-content)
-
-#### Key-value mapping example
-
-Docker Compose
-
-```yaml
-services:
-  nginx:
-    ...
-    labels:
-      # values from duplicated header keys will be combined
-      proxy.nginx.set_headers: | # remember to add the '|'
-        X-Custom-Header1: value1, value2
-        X-Custom-Header2: value3
-        X-Custom-Header2: value4
-      # X-Custom-Header2 will be "value3, value4"
-```
-
-File Provider
-
-```yaml
-service_a:
-  host: service_a.internal
-  set_headers:
-    # do not duplicate header keys, as it is not allowed in YAML
-    X-Custom-Header1: value1, value2
-    X-Custom-Header2: value3
-```
-
-[🔼Back to top](#table-of-content)
-
-#### List example
-
-Docker Compose
-
-```yaml
-services:
-  nginx:
-    ...
-    labels:
-      proxy.nginx.path_patterns: | # remember to add the '|'
-        - GET /
-        - POST /auth
-      proxy.nginx.hide_headers: | # remember to add the '|'
-        - X-Custom-Header1
-        - X-Custom-Header2
-```
-
-File Provider
-
-```yaml
-service_a:
-  host: service_a.internal
-  path_patterns:
-    - GET /
-    - POST /auth
-  hide_headers:
-    - X-Custom-Header1
-    - X-Custom-Header2
-```
-
-[🔼Back to top](#table-of-content)
-
-## Troubleshooting
-
-- Container not showing up in proxies list
-
-  Please check that either `ports` or label `proxy.<alias>.port` is declared, e.g.
-
-  ```yaml
-  services:
-    nginx-1: # Option 1
-      ...
-      ports:
-        - 80
-    nginx-2: # Option 2
-      ...
-      container_name: nginx-2
-      network_mode: host
-      labels:
-        proxy.nginx-2.port: 80
-  ```
-
-- Firewall issues
-
-  If you are using `ufw` with vpn that drop all inbound traffic except vpn, run below:
-
-  `sudo ufw allow from 172.16.0.0/16 to 100.64.0.0/10`
-
-  Explaination:
-
-  Docker network is usually `172.16.0.0/16`
-
-  Tailscale is used as an example, `100.64.0.0/10` will be the CIDR
-
-  You can also list CIDRs of all docker bridge networks by:
-
-  `docker network inspect $(docker network ls | awk '$3 == "bridge" { print $1}') | jq -r '.[] | .Name + " " + .IPAM.Config[0].Subnet' -`
-
-[🔼Back to top](#table-of-content)
-
-## Docker compose examples
-
-More examples in [here](examples/)
-
-```yaml
-volumes:
-  adg-work:
-  adg-conf:
-  mc-data:
-  palworld:
-  nginx:
-services:
-  adg:
-    image: adguard/adguardhome
-    restart: unless-stopped
-    labels:
-      - proxy.aliases=adg,adg-dns,adg-setup
-      - proxy.$1.port=80
-      - proxy.$2.scheme=udp
-      - proxy.$2.port=20000:dns
-      - proxy.$3.port=3000
-    volumes:
-      - adg-work:/opt/adguardhome/work
-      - adg-conf:/opt/adguardhome/conf
-    ports:
-      - 80
-      - 3000
-      - 53/udp
-  mc:
-    image: itzg/minecraft-server
-    tty: true
-    stdin_open: true
-    container_name: mc
-    restart: unless-stopped
-    ports:
-      - 25565
-    labels:
-      - proxy.mc.port=20001:25565
-    environment:
-      - EULA=TRUE
-    volumes:
-      - mc-data:/data
-  palworld:
-    image: thijsvanloef/palworld-server-docker:latest
-    restart: unless-stopped
-    container_name: pal
-    stop_grace_period: 30s
-    ports:
-      - 8211/udp
-      - 27015/udp
-    labels:
-      - proxy.aliases=pal1,pal2
-      - proxy.*.scheme=udp
-      - proxy.$1.port=20002:8211
-      - proxy.$2.port=20003:27015
-    environment: ...
-    volumes:
-      - palworld:/palworld
-  nginx:
-    image: nginx
-    container_name: nginx
-    volumes:
-      - nginx:/usr/share/nginx/html
-    ports:
-      - 80
-    labels:
-      proxy.idle_timeout: 1m
-  go-proxy:
-    image: ghcr.io/yusing/go-proxy:latest
-    container_name: go-proxy
-    restart: always
-    network_mode: host
-    volumes:
-      - ./config:/app/config
-      - /var/run/docker.sock:/var/run/docker.sock
-  go-proxy-frontend:
-    image: ghcr.io/yusing/go-proxy-frontend:latest
-    container_name: go-proxy-frontend
-    restart: unless-stopped
-    network_mode: host
-    labels:
-      - proxy.aliases=gp
-      - proxy.gp.port=3000
-    depends_on:
-      - go-proxy
-```
-
-[🔼Back to top](#table-of-content)
-
-### Services URLs for above examples
-
-- `gp.yourdomain.com`: go-proxy web panel
-- `adg-setup.yourdomain.com`: adguard setup (first time setup)
-- `adg.yourdomain.com`: adguard dashboard
-- `nginx.yourdomain.com`: nginx
-- `yourdomain.com:2000`: adguard dns (udp)
-- `yourdomain.com:20001`: minecraft server
-- `yourdomain.com:20002`: palworld server
-
-[🔼Back to top](#table-of-content)

docs/docker_socket_proxy.md

@@ -1,40 +0,0 @@
-## Docker Socket Proxy
-
-For docker client on other machine, set this up, then add `name: tcp://<machine_ip>:2375` to `config.yml` under `docker` section
-
-```yml
-# compose.yml on remote machine (e.g. server1)
-docker-proxy:
-  container_name: docker-proxy
-  image: tecnativa/docker-socket-proxy
-  privileged: true
-  environment:
-    - ALLOW_START=1
-    - ALLOW_STOP=1
-    - ALLOW_RESTARTS=1
-    - CONTAINERS=1
-    - EVENTS=1
-    - PING=1
-    - POST=1
-    - VERSION=1
-  volumes:
-    - /var/run/docker.sock:/var/run/docker.sock
-  restart: always
-  ports:
-    - 2375:2375
-    # or more secure
-    - <machine_ip>:2375:2375
-```
-
-```yml
-# config.yml on go-proxy machine
-autocert:
-  ... # your config
-
-providers:
-  include:
-    ...
-  docker:
-    ...
-    server1: tcp://<machine_ip>:2375
-```

examples/docker-compose/n8n.yml

@@ -0,0 +1,27 @@
+---
+services:
+  n8n:
+    image: n8nio/n8n
+    container_name: n8n
+    restart: always
+    expose:
+      - 5678
+    labels:
+      proxy.n8n.middlewares.request.set_headers: |
+        SSLRedirect: true
+        STSSeconds: 315360000
+        browserXSSFilter: true
+        contentTypeNosniff: true
+        forceSTSHeader: true
+        SSLHost: ${DOMAIN_NAME}
+        STSIncludeSubdomains: true
+        STSPreload: true
+    environment:
+      - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
+      - N8N_PORT=5678
+      - N8N_PROTOCOL=https
+      - NODE_ENV=production
+      - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
+      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
+    volumes:
+      - ./data:/home/node/.n8n

examples/error_pages/404.css

@@ -0,0 +1,288 @@
+@import url("https://fonts.googleapis.com/css?family=Audiowide&display=swap");
+
+html,
+body {
+    margin: 0px;
+    overflow: hidden;
+}
+
+div {
+    position: absolute;
+    top: 0%;
+    left: 0%;
+    height: 100%;
+    width: 100%;
+    margin: 0px;
+    background: radial-gradient(circle, #240015 0%, #12000b 100%);
+    overflow: hidden;
+}
+
+.wrap {
+    position: absolute;
+    left: 50%;
+    top: 50%;
+    transform: translate(-50%, -50%);
+}
+
+h2 {
+    position: absolute;
+    top: 50%;
+    left: 50%;
+    margin-top: 150px;
+    font-size: 32px;
+    text-transform: uppercase;
+    transform: translate(-50%, -50%);
+    display: block;
+    color: #12000a;
+    font-weight: 300;
+    font-family: Audiowide;
+    text-shadow: 0px 0px 4px #12000a;
+    animation: fadeInText 3s ease-in 3.5s forwards,
+        flicker4 5s linear 7.5s infinite, hueRotate 6s ease-in-out 3s infinite;
+}
+
+#svgWrap_1,
+#svgWrap_2 {
+    position: absolute;
+    height: auto;
+    width: 600px;
+    max-width: 100%;
+    top: 50%;
+    left: 50%;
+    transform: translate(-50%, -50%);
+}
+
+#svgWrap_1,
+#svgWrap_2,
+div {
+    animation: hueRotate 6s ease-in-out 3s infinite;
+}
+
+#id1_1,
+#id2_1,
+#id3_1 {
+    stroke: #ff005d;
+    stroke-width: 3px;
+    fill: transparent;
+    filter: url(#glow);
+}
+
+#id1_2,
+#id2_2,
+#id3_2 {
+    stroke: #12000a;
+    stroke-width: 3px;
+    fill: transparent;
+    filter: url(#glow);
+}
+
+#id3_1 {
+    stroke-dasharray: 940px;
+    stroke-dashoffset: -940px;
+    animation: drawLine3 2.5s ease-in-out 0s forwards,
+        flicker3 4s linear 4s infinite;
+}
+
+#id2_1 {
+    stroke-dasharray: 735px;
+    stroke-dashoffset: -735px;
+    animation: drawLine2 2.5s ease-in-out 0.5s forwards,
+        flicker2 4s linear 4.5s infinite;
+}
+
+#id1_1 {
+    stroke-dasharray: 940px;
+    stroke-dashoffset: -940px;
+    animation: drawLine1 2.5s ease-in-out 1s forwards,
+        flicker1 4s linear 5s infinite;
+}
+
+@keyframes drawLine1 {
+    0% {
+        stroke-dashoffset: -940px;
+    }
+    100% {
+        stroke-dashoffset: 0px;
+    }
+}
+
+@keyframes drawLine2 {
+    0% {
+        stroke-dashoffset: -735px;
+    }
+    100% {
+        stroke-dashoffset: 0px;
+    }
+}
+
+@keyframes drawLine3 {
+    0% {
+        stroke-dashoffset: -940px;
+    }
+    100% {
+        stroke-dashoffset: 0px;
+    }
+}
+
+@keyframes flicker1 {
+    0% {
+        stroke: #ff005d;
+    }
+    1% {
+        stroke: transparent;
+    }
+    3% {
+        stroke: transparent;
+    }
+    4% {
+        stroke: #ff005d;
+    }
+    6% {
+        stroke: #ff005d;
+    }
+    7% {
+        stroke: transparent;
+    }
+    13% {
+        stroke: transparent;
+    }
+    14% {
+        stroke: #ff005d;
+    }
+    100% {
+        stroke: #ff005d;
+    }
+}
+
+@keyframes flicker2 {
+    0% {
+        stroke: #ff005d;
+    }
+    50% {
+        stroke: #ff005d;
+    }
+    51% {
+        stroke: transparent;
+    }
+    61% {
+        stroke: transparent;
+    }
+    62% {
+        stroke: #ff005d;
+    }
+    100% {
+        stroke: #ff005d;
+    }
+}
+
+@keyframes flicker3 {
+    0% {
+        stroke: #ff005d;
+    }
+    1% {
+        stroke: transparent;
+    }
+    10% {
+        stroke: transparent;
+    }
+    11% {
+        stroke: #ff005d;
+    }
+    40% {
+        stroke: #ff005d;
+    }
+    41% {
+        stroke: transparent;
+    }
+    45% {
+        stroke: transparent;
+    }
+    46% {
+        stroke: #ff005d;
+    }
+    100% {
+        stroke: #ff005d;
+    }
+}
+
+@keyframes flicker4 {
+    0% {
+        color: #ff005d;
+        text-shadow: 0px 0px 4px #ff005d;
+    }
+    30% {
+        color: #ff005d;
+        text-shadow: 0px 0px 4px #ff005d;
+    }
+    31% {
+        color: #12000a;
+        text-shadow: 0px 0px 4px #12000a;
+    }
+    32% {
+        color: #ff005d;
+        text-shadow: 0px 0px 4px #ff005d;
+    }
+    36% {
+        color: #ff005d;
+        text-shadow: 0px 0px 4px #ff005d;
+    }
+    37% {
+        color: #12000a;
+        text-shadow: 0px 0px 4px #12000a;
+    }
+    41% {
+        color: #12000a;
+        text-shadow: 0px 0px 4px #12000a;
+    }
+    42% {
+        color: #ff005d;
+        text-shadow: 0px 0px 4px #ff005d;
+    }
+    85% {
+        color: #ff005d;
+        text-shadow: 0px 0px 4px #ff005d;
+    }
+    86% {
+        color: #12000a;
+        text-shadow: 0px 0px 4px #12000a;
+    }
+    95% {
+        color: #12000a;
+        text-shadow: 0px 0px 4px #12000a;
+    }
+    96% {
+        color: #ff005d;
+        text-shadow: 0px 0px 4px #ff005d;
+    }
+    100% {
+        color: #ff005d;
+        text-shadow: 0px 0px 4px #ff005d;
+    }
+}
+
+@keyframes fadeInText {
+    1% {
+        color: #12000a;
+        text-shadow: 0px 0px 4px #12000a;
+    }
+    70% {
+        color: #ff005d;
+        text-shadow: 0px 0px 14px #ff005d;
+    }
+    100% {
+        color: #ff005d;
+        text-shadow: 0px 0px 4px #ff005d;
+    }
+}
+
+@keyframes hueRotate {
+    0% {
+        filter: hue-rotate(0deg);
+    }
+    50% {
+        filter: hue-rotate(-120deg);
+    }
+    100% {
+        filter: hue-rotate(0deg);
+    }
+}

examples/error_pages/404.html

@@ -0,0 +1,51 @@
+{{/* Credit: https://codepen.io/code2rithik/pen/XWpVvYL */}}
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+  <meta charset="UTF-8" />
+  <title>Page Not Found</title>
+  <link rel="stylesheet" href="/$gperrorpage/404.css" type="text/css">
+  <!-- <script src="/$gperrorpage/404.js"> </script> -->
+</head>
+
+<body>
+  <script>0</script>
+  <div></div>
+  <svg id="svgWrap_2" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewBox="0 0 700 250">
+    <g>
+      <path id="id3_2"
+        d="M195.7 232.67h-37.1V149.7H27.76c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98H158.6V29.62h37.1v203.05z" />
+      <path id="id2_2"
+        d="M470.69 147.71c0 8.31-1.06 16.17-3.19 23.58-2.12 7.41-5.12 14.28-8.99 20.6-3.87 6.33-8.45 11.99-13.74 16.99-5.29 5-11.07 9.28-17.35 12.81a85.146 85.146 0 0 1-20.04 8.14 83.637 83.637 0 0 1-21.67 2.83H319.3c-7.46 0-14.73-.94-21.81-2.83-7.08-1.89-13.76-4.6-20.04-8.14a88.292 88.292 0 0 1-17.35-12.81c-5.29-5-9.84-10.67-13.66-16.99-3.82-6.32-6.8-13.19-8.92-20.6-2.12-7.41-3.19-15.27-3.19-23.58v-33.13c0-12.46 2.34-23.88 7.01-34.27 4.67-10.38 10.92-19.33 18.76-26.83 7.83-7.5 16.87-13.36 27.12-17.56 10.24-4.2 20.93-6.3 32.07-6.3h66.41c7.36 0 14.58.94 21.67 2.83 7.08 1.89 13.76 4.6 20.04 8.14a88.292 88.292 0 0 1 17.35 12.81c5.29 5 9.86 10.67 13.74 16.99 3.87 6.33 6.87 13.19 8.99 20.6 2.13 7.41 3.19 15.27 3.19 23.58v33.14zm-37.1-33.13c0-7.27-1.32-13.88-3.96-19.82-2.64-5.95-6.16-11.04-10.55-15.29-4.39-4.25-9.46-7.5-15.22-9.77-5.76-2.27-11.8-3.35-18.13-3.26h-66.41c-6.14-.09-12.11.97-17.91 3.19-5.81 2.22-10.95 5.43-15.44 9.63-4.48 4.2-8.07 9.3-10.76 15.29-2.69 6-4.04 12.67-4.04 20.04v33.13c0 7.36 1.32 14.02 3.96 19.97 2.64 5.95 6.18 11.02 10.62 15.22 4.44 4.2 9.56 7.43 15.36 9.7 5.8 2.27 11.87 3.35 18.2 3.26h66.41c7.27 0 13.85-1.2 19.75-3.61s10.93-5.73 15.08-9.98 7.36-9.32 9.63-15.22c2.27-5.9 3.4-12.34 3.4-19.33v-33.15zm-16-26.91a17.89 17.89 0 0 1 2.83 6.73c.47 2.41.47 4.77 0 7.08-.47 2.31-1.39 4.48-2.76 6.51-1.37 2.03-3.14 3.75-5.31 5.17l-99.4 66.41c-1.61 1.23-3.26 2.08-4.96 2.55-1.7.47-3.45.71-5.24.71-3.02 0-5.9-.71-8.64-2.12-2.74-1.42-4.96-3.44-6.66-6.09a17.89 17.89 0 0 1-2.83-6.73c-.47-2.41-.5-4.77-.07-7.08.43-2.31 1.3-4.48 2.62-6.51 1.32-2.03 3.07-3.75 5.24-5.17l99.69-66.41a17.89 17.89 0 0 1 6.73-2.83c2.41-.47 4.77-.47 7.08 0 2.31.47 4.48 1.37 6.51 2.69 2.03 1.32 3.75 3.02 5.17 5.09z" />
+      <path id="id1_2"
+        d="M688.33 232.67h-37.1V149.7H520.39c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98h112.57V29.62h37.1v203.05z" />
+    </g>
+  </svg>
+  <svg id="svgWrap_1" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewBox="0 0 700 250">
+    <g>
+      <path id="id3_1"
+        d="M195.7 232.67h-37.1V149.7H27.76c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98H158.6V29.62h37.1v203.05z" />
+      <path id="id2_1"
+        d="M470.69 147.71c0 8.31-1.06 16.17-3.19 23.58-2.12 7.41-5.12 14.28-8.99 20.6-3.87 6.33-8.45 11.99-13.74 16.99-5.29 5-11.07 9.28-17.35 12.81a85.146 85.146 0 0 1-20.04 8.14 83.637 83.637 0 0 1-21.67 2.83H319.3c-7.46 0-14.73-.94-21.81-2.83-7.08-1.89-13.76-4.6-20.04-8.14a88.292 88.292 0 0 1-17.35-12.81c-5.29-5-9.84-10.67-13.66-16.99-3.82-6.32-6.8-13.19-8.92-20.6-2.12-7.41-3.19-15.27-3.19-23.58v-33.13c0-12.46 2.34-23.88 7.01-34.27 4.67-10.38 10.92-19.33 18.76-26.83 7.83-7.5 16.87-13.36 27.12-17.56 10.24-4.2 20.93-6.3 32.07-6.3h66.41c7.36 0 14.58.94 21.67 2.83 7.08 1.89 13.76 4.6 20.04 8.14a88.292 88.292 0 0 1 17.35 12.81c5.29 5 9.86 10.67 13.74 16.99 3.87 6.33 6.87 13.19 8.99 20.6 2.13 7.41 3.19 15.27 3.19 23.58v33.14zm-37.1-33.13c0-7.27-1.32-13.88-3.96-19.82-2.64-5.95-6.16-11.04-10.55-15.29-4.39-4.25-9.46-7.5-15.22-9.77-5.76-2.27-11.8-3.35-18.13-3.26h-66.41c-6.14-.09-12.11.97-17.91 3.19-5.81 2.22-10.95 5.43-15.44 9.63-4.48 4.2-8.07 9.3-10.76 15.29-2.69 6-4.04 12.67-4.04 20.04v33.13c0 7.36 1.32 14.02 3.96 19.97 2.64 5.95 6.18 11.02 10.62 15.22 4.44 4.2 9.56 7.43 15.36 9.7 5.8 2.27 11.87 3.35 18.2 3.26h66.41c7.27 0 13.85-1.2 19.75-3.61s10.93-5.73 15.08-9.98 7.36-9.32 9.63-15.22c2.27-5.9 3.4-12.34 3.4-19.33v-33.15zm-16-26.91a17.89 17.89 0 0 1 2.83 6.73c.47 2.41.47 4.77 0 7.08-.47 2.31-1.39 4.48-2.76 6.51-1.37 2.03-3.14 3.75-5.31 5.17l-99.4 66.41c-1.61 1.23-3.26 2.08-4.96 2.55-1.7.47-3.45.71-5.24.71-3.02 0-5.9-.71-8.64-2.12-2.74-1.42-4.96-3.44-6.66-6.09a17.89 17.89 0 0 1-2.83-6.73c-.47-2.41-.5-4.77-.07-7.08.43-2.31 1.3-4.48 2.62-6.51 1.32-2.03 3.07-3.75 5.24-5.17l99.69-66.41a17.89 17.89 0 0 1 6.73-2.83c2.41-.47 4.77-.47 7.08 0 2.31.47 4.48 1.37 6.51 2.69 2.03 1.32 3.75 3.02 5.17 5.09z" />
+      <path id="id1_1"
+        d="M688.33 232.67h-37.1V149.7H520.39c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98h112.57V29.62h37.1v203.05z" />
+    </g>
+  </svg>
+
+  <svg>
+    <defs>
+      <filter id="glow">
+        <fegaussianblur class="blur" result="coloredBlur" stddeviation="4"></fegaussianblur>
+        <femerge>
+          <femergenode in="coloredBlur"></femergenode>
+          <femergenode in="SourceGraphic"></femergenode>
+        </femerge>
+      </filter>
+    </defs>
+  </svg>
+
+  <h2>Page Not Found</h2>
+</body>
+
+</html>

examples/microbin.yml

@@ -1,16 +0,0 @@
-services:
-  app:
-    container_name: microbin
-    cpu_shares: 10
-    deploy:
-      resources:
-        limits:
-          memory: 256M
-    env_file: .env
-    image: docker.i.sh/danielszabo99/microbin:latest
-    ports:
-      - 8080
-    restart: unless-stopped
-    volumes:
-      - ./data:/app/microbin_data
-# microbin.domain.tld

examples/siyuan.yml

@@ -1,16 +0,0 @@
-services:
-  main:
-    image: b3log/siyuan:v3.1.0
-    container_name: siyuan
-    command:
-      - --workspace=/siyuan/workspace/
-      - --accessAuthCode=<some password>
-    user: 1000:1000
-    volumes:
-      - ./workspace:/siyuan/workspace
-    restart: unless-stopped
-    environment:
-      - TZ=Asia/Hong_Kong
-    ports:
-      - 6806
-# siyuan.domain.tld

go.mod

@@ -0,0 +1,83 @@
+module github.com/yusing/go-proxy
+
+go 1.23.5
+
+require (
+	github.com/PuerkitoBio/goquery v1.10.1 // parsing HTML for extract fav icon
+	github.com/coder/websocket v1.8.12 // websocket for API and agent
+	github.com/coreos/go-oidc/v3 v3.12.0 // oidc authentication
+	github.com/docker/cli v27.5.1+incompatible // docker CLI
+	github.com/docker/docker v27.5.1+incompatible // docker daemon
+	github.com/fsnotify/fsnotify v1.8.0 // file watcher
+	github.com/go-acme/lego/v4 v4.21.0 // acme client
+	github.com/go-playground/validator/v10 v10.24.0 // validator
+	github.com/gobwas/glob v0.2.3 // glob matcher for route rules
+	github.com/golang-jwt/jwt/v5 v5.2.1 // jwt for default auth
+	github.com/gotify/server/v2 v2.6.1 // reference the Message struct for json response
+	github.com/lithammer/fuzzysearch v1.1.8 // fuzzy search for searching icons and filtering metrics
+	github.com/prometheus/client_golang v1.20.5 // metrics
+	github.com/puzpuzpuz/xsync/v3 v3.5.0 // lock free map for concurrent operations
+	github.com/rs/zerolog v1.33.0 // logging
+	github.com/vincent-petithory/dataurl v1.0.0 // data url for fav icon
+	golang.org/x/crypto v0.33.0 // encrypting password with bcrypt
+	golang.org/x/net v0.35.0 // HTTP header utilities
+	golang.org/x/oauth2 v0.26.0 // oauth2 authentication
+	golang.org/x/text v0.22.0 // string utilities
+	golang.org/x/time v0.10.0 // time utilities
+	gopkg.in/yaml.v3 v3.0.1 // yaml parsing for different config files
+)
+
+require (
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/andybalholm/cascadia v1.3.3 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cloudflare/cloudflare-go v0.115.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/miekg/dns v1.1.63 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/term v0.5.0 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/nrdcg/porkbun v0.4.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/ovh/go-ovh v1.7.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
+	go.opentelemetry.io/otel v1.34.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 // indirect
+	go.opentelemetry.io/otel/metric v1.34.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.30.0 // indirect
+	go.opentelemetry.io/otel/trace v1.34.0 // indirect
+	golang.org/x/mod v0.23.0 // indirect
+	golang.org/x/sync v0.11.0 // indirect
+	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/tools v0.29.0 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gotest.tools/v3 v3.5.1 // indirect
+)

go.sum

@@ -0,0 +1,291 @@
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/PuerkitoBio/goquery v1.10.1 h1:Y8JGYUkXWTGRB6Ars3+j3kN0xg1YqqlwvdTV8WTFQcU=
+github.com/PuerkitoBio/goquery v1.10.1/go.mod h1:IYiHrOMps66ag56LEH7QYDDupKXyo5A8qrjIx3ZtujY=
+github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
+github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cloudflare/cloudflare-go v0.115.0 h1:84/dxeeXweCc0PN5Cto44iTA8AkG1fyT11yPO5ZB7sM=
+github.com/cloudflare/cloudflare-go v0.115.0/go.mod h1:Ds6urDwn/TF2uIU24mu7H91xkKP8gSAHxQ44DSZgVmU=
+github.com/coder/websocket v1.8.12 h1:5bUXkEPPIbewrnkU8LTCLVaxi4N4J8ahufH2vlo4NAo=
+github.com/coder/websocket v1.8.12/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/coreos/go-oidc/v3 v3.12.0 h1:sJk+8G2qq94rDI6ehZ71Bol3oUHy63qNYmkiSjrc/Jo=
+github.com/coreos/go-oidc/v3 v3.12.0/go.mod h1:gE3LgjOgFoHi9a4ce4/tJczr0Ai2/BoDhf0r5lltWI0=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v27.5.1+incompatible h1:JB9cieUT9YNiMITtIsguaN55PLOHhBSz3LKVc6cqWaY=
+github.com/docker/cli v27.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v27.5.1+incompatible h1:4PYU5dnBYqRQi0294d1FBECqT9ECWeQAIfE8q4YnPY8=
+github.com/docker/docker v27.5.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
+github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
+github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/go-acme/lego/v4 v4.21.0 h1:arEW+8o5p7VI8Bk1kr/PDlgD1DrxtTH1gJ4b7mehL8o=
+github.com/go-acme/lego/v4 v4.21.0/go.mod h1:HrSWzm3Ckj45Ie3i+p1zKVobbQoMOaGu9m4up0dUeDI=
+github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
+github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.24.0 h1:KHQckvo8G6hlWnrPX4NJJ+aBfWNAE/HH+qdL2cBpCmg=
+github.com/go-playground/validator/v10 v10.24.0/go.mod h1:GGzBIJMuE98Ic/kJsBXbz1x/7cByt++cQ+YOuDM5wus=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
+github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gotify/server/v2 v2.6.1 h1:Kf7v5fzBxzELzZa/jonWfwJMkqYqh1LBzBpCmt5QIAI=
+github.com/gotify/server/v2 v2.6.1/go.mod h1:Dk8HLyTVDqmXM8YEg6tjROBen6mxyHZFRggJFHTwZLc=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1NhHmEPPzzuhWgcza5M1Ji1I=
+github.com/jarcoal/httpmock v1.3.0 h1:2RJ8GP0IIaWwcC9Fp2BmVi8Kog3v2Hn7VXM3fTd+nuc=
+github.com/jarcoal/httpmock v1.3.0/go.mod h1:3yb8rc4BI7TCBhFY8ng0gjuLKJNquuDNiPaZjnENuYg=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/lithammer/fuzzysearch v1.1.8 h1:/HIuJnjHuXS8bKaiTMeeDlW2/AyIWk2brx1V8LFgLN4=
+github.com/lithammer/fuzzysearch v1.1.8/go.mod h1:IdqeyBClc3FFqSzYq/MXESsS4S0FsZ5ajtkr5xPLts4=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/maxatome/go-testdeep v1.12.0 h1:Ql7Go8Tg0C1D/uMMX59LAoYK7LffeJQ6X2T04nTH68g=
+github.com/maxatome/go-testdeep v1.12.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM=
+github.com/miekg/dns v1.1.63 h1:8M5aAw6OMZfFXTT7K5V0Eu5YiiL8l7nUAkyN6C9YwaY=
+github.com/miekg/dns v1.1.63/go.mod h1:6NGHfjhpmr5lt3XPLuyfDJi5AXbNIPM9PY6H6sF1Nfs=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/nrdcg/porkbun v0.4.0 h1:rWweKlwo1PToQ3H+tEO9gPRW0wzzgmI/Ob3n2Guticw=
+github.com/nrdcg/porkbun v0.4.0/go.mod h1:/QMskrHEIM0IhC/wY7iTCUgINsxdT2WcOphktJ9+Q54=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
+github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/ovh/go-ovh v1.7.0 h1:V14nF7FwDjQrZt9g7jzcvAAQ3HN6DNShRFRMC3jLoPw=
+github.com/ovh/go-ovh v1.7.0/go.mod h1:cTVDnl94z4tl8pP1uZ/8jlVxntjSIf09bNcQ5TJSC7c=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
+github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/puzpuzpuz/xsync/v3 v3.5.0 h1:i+cMcpEDY1BkNm7lPDkCtE4oElsYLn+EKF8kAu2vXT4=
+github.com/puzpuzpuz/xsync/v3 v3.5.0/go.mod h1:VjzYrABPabuM4KyBh1Ftq6u8nhwY5tBPKP9jpmh0nnA=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8=
+github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/vincent-petithory/dataurl v1.0.0 h1:cXw+kPto8NLuJtlMsI152irrVw9fRDX8AbShPRpg2CI=
+github.com/vincent-petithory/dataurl v1.0.0/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 h1:CV7UdSGJt/Ao6Gp4CXckLxVRRsRgDHoI8XjbL3PDl8s=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0/go.mod h1:FRmFuRJfag1IZ2dPkHnEoSFVgTVPUd2qf5Vi69hLb8I=
+go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
+go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0 h1:lsInsfvhVIfOI6qHVyysXMNDnjO9Npvl7tlDPJFBVd4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0/go.mod h1:KQsVNh4OjgjTG0G6EiNi1jVpnaeeKsKMRwbLN+f1+8M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 h1:umZgi92IyxfXd/l4kaDhnKgY8rnN/cZcF1LKc6I8OQ8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0/go.mod h1:4lVs6obhSVRb1EW5FhOuBTyiQhtRtAnnva9vD3yRfq8=
+go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
+go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
+go.opentelemetry.io/otel/sdk v1.30.0 h1:cHdik6irO49R5IysVhdn8oaiR9m8XluDaJAs4DfOrYE=
+go.opentelemetry.io/otel/sdk v1.30.0/go.mod h1:p14X4Ok8S+sygzblytT1nqG98QG2KYKv++HE0LY/mhg=
+go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
+go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
+go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
+go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
+golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
+golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
+golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
+golang.org/x/oauth2 v0.26.0 h1:afQXWNNaeC4nvZ0Ed9XvCCzXM6UHJG7iCg0W4fPqSBE=
+golang.org/x/oauth2 v0.26.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
+golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
+golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
+golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOskjbcSMcF2jiYMNiQYZ0c2KEJLKKU=
+google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697 h1:pgr/4QbFyktUv9CtQ/Fq4gzEE6/Xs7iCXbktaGzLHbQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697/go.mod h1:+D9ySVjN8nY8YCVjc5O7PZDIdZporIDY3KaGfJunh88=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
+google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
+gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=

go.work

@@ -1,5 +0,0 @@
-go 1.22.0
-
-toolchain go1.23.1
-
-use ./src

internal/api/handler.go

@@ -0,0 +1,70 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	v1 "github.com/yusing/go-proxy/internal/api/v1"
+	"github.com/yusing/go-proxy/internal/api/v1/auth"
+	"github.com/yusing/go-proxy/internal/api/v1/favicon"
+	"github.com/yusing/go-proxy/internal/common"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type ServeMux struct{ *http.ServeMux }
+
+func (mux ServeMux) HandleFunc(methods, endpoint string, handler http.HandlerFunc) {
+	for _, m := range strutils.CommaSeperatedList(methods) {
+		mux.ServeMux.HandleFunc(m+" "+endpoint, handler)
+	}
+}
+
+func NewHandler(cfg config.ConfigInstance) http.Handler {
+	mux := ServeMux{http.NewServeMux()}
+	mux.HandleFunc("GET", "/v1", v1.Index)
+	mux.HandleFunc("GET", "/v1/version", v1.GetVersion)
+	mux.HandleFunc("POST", "/v1/reload", useCfg(cfg, v1.Reload))
+	mux.HandleFunc("GET", "/v1/list", auth.RequireAuth(useCfg(cfg, v1.List)))
+	mux.HandleFunc("GET", "/v1/list/{what}", auth.RequireAuth(useCfg(cfg, v1.List)))
+	mux.HandleFunc("GET", "/v1/list/{what}/{which}", auth.RequireAuth(useCfg(cfg, v1.List)))
+	mux.HandleFunc("GET", "/v1/file/{type}/{filename}", auth.RequireAuth(v1.GetFileContent))
+	mux.HandleFunc("POST,PUT", "/v1/file/{type}/{filename}", auth.RequireAuth(v1.SetFileContent))
+	mux.HandleFunc("POST", "/v1/file/validate/{type}", auth.RequireAuth(v1.ValidateFile))
+	mux.HandleFunc("GET", "/v1/stats", useCfg(cfg, v1.Stats))
+	mux.HandleFunc("GET", "/v1/stats/ws", useCfg(cfg, v1.StatsWS))
+	mux.HandleFunc("GET", "/v1/health/ws", auth.RequireAuth(useCfg(cfg, v1.HealthWS)))
+	mux.HandleFunc("GET", "/v1/logs/ws", auth.RequireAuth(useCfg(cfg, v1.LogsWS())))
+	mux.HandleFunc("GET", "/v1/favicon", auth.RequireAuth(favicon.GetFavIcon))
+	mux.HandleFunc("POST", "/v1/homepage/set", auth.RequireAuth(v1.SetHomePageOverrides))
+
+	if common.PrometheusEnabled {
+		mux.Handle("GET /v1/metrics", promhttp.Handler())
+		logging.Info().Msg("prometheus metrics enabled")
+	}
+
+	defaultAuth := auth.GetDefaultAuth()
+	if defaultAuth != nil {
+		mux.HandleFunc("GET", "/v1/auth/redirect", defaultAuth.RedirectLoginPage)
+		mux.HandleFunc("GET", "/v1/auth/check", func(w http.ResponseWriter, r *http.Request) {
+			if err := defaultAuth.CheckToken(r); err != nil {
+				http.Error(w, err.Error(), http.StatusUnauthorized)
+				return
+			}
+		})
+		mux.HandleFunc("GET,POST", "/v1/auth/callback", defaultAuth.LoginCallbackHandler)
+		mux.HandleFunc("GET,POST", "/v1/auth/logout", defaultAuth.LogoutCallbackHandler)
+	} else {
+		mux.HandleFunc("GET", "/v1/auth/check", func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		})
+	}
+	return mux
+}
+
+func useCfg(cfg config.ConfigInstance, handler func(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request)) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		handler(cfg, w, r)
+	}
+}

internal/api/v1/auth/auth.go

@@ -0,0 +1,54 @@
+package auth
+
+import (
+	"net/http"
+
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/logging"
+)
+
+var defaultAuth Provider
+
+// Initialize sets up authentication providers.
+func Initialize() error {
+	if !IsEnabled() {
+		logging.Warn().Msg("authentication is disabled, please set API_JWT_SECRET or OIDC_* to enable authentication")
+		return nil
+	}
+
+	var err error
+	// Initialize OIDC if configured.
+	if common.OIDCIssuerURL != "" {
+		defaultAuth, err = NewOIDCProviderFromEnv()
+	} else {
+		defaultAuth, err = NewUserPassAuthFromEnv()
+	}
+
+	return err
+}
+
+func GetDefaultAuth() Provider {
+	return defaultAuth
+}
+
+func IsEnabled() bool {
+	return common.APIJWTSecret != nil || IsOIDCEnabled()
+}
+
+func IsOIDCEnabled() bool {
+	return common.OIDCIssuerURL != ""
+}
+
+func RequireAuth(next http.HandlerFunc) http.HandlerFunc {
+	if IsEnabled() {
+		return func(w http.ResponseWriter, r *http.Request) {
+			if err := defaultAuth.CheckToken(r); err != nil {
+				U.RespondError(w, err, http.StatusUnauthorized)
+			} else {
+				next(w, r)
+			}
+		}
+	}
+	return next
+}

internal/api/v1/auth/oidc.go

@@ -0,0 +1,274 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"slices"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+	E "github.com/yusing/go-proxy/internal/error"
+	CE "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+	"golang.org/x/oauth2"
+)
+
+type OIDCProvider struct {
+	oauthConfig   *oauth2.Config
+	oidcProvider  *oidc.Provider
+	oidcVerifier  *oidc.IDTokenVerifier
+	oidcLogoutURL *url.URL
+	allowedUsers  []string
+	allowedGroups []string
+	isMiddleware  bool
+}
+
+const CookieOauthState = "godoxy_oidc_state"
+
+const (
+	OIDCMiddlewareCallbackPath = "/auth/callback"
+	OIDCLogoutPath             = "/auth/logout"
+)
+
+func NewOIDCProvider(issuerURL, clientID, clientSecret, redirectURL, logoutURL string, allowedUsers, allowedGroups []string) (*OIDCProvider, error) {
+	if len(allowedUsers)+len(allowedGroups) == 0 {
+		return nil, errors.New("OIDC users, groups, or both must not be empty")
+	}
+
+	var logout *url.URL
+	var err error
+	if logoutURL != "" {
+		logout, err = url.Parse(logoutURL)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse logout URL: %w", err)
+		}
+	}
+
+	provider, err := oidc.NewProvider(context.Background(), issuerURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize OIDC provider: %w", err)
+	}
+
+	return &OIDCProvider{
+		oauthConfig: &oauth2.Config{
+			ClientID:     clientID,
+			ClientSecret: clientSecret,
+			RedirectURL:  redirectURL,
+			Endpoint:     provider.Endpoint(),
+			Scopes:       strutils.CommaSeperatedList(common.OIDCScopes),
+		},
+		oidcProvider: provider,
+		oidcVerifier: provider.Verifier(&oidc.Config{
+			ClientID: clientID,
+		}),
+		oidcLogoutURL: logout,
+		allowedUsers:  allowedUsers,
+		allowedGroups: allowedGroups,
+	}, nil
+}
+
+// NewOIDCProviderFromEnv creates a new OIDCProvider from environment variables.
+func NewOIDCProviderFromEnv() (*OIDCProvider, error) {
+	return NewOIDCProvider(
+		common.OIDCIssuerURL,
+		common.OIDCClientID,
+		common.OIDCClientSecret,
+		common.OIDCRedirectURL,
+		common.OIDCLogoutURL,
+		common.OIDCAllowedUsers,
+		common.OIDCAllowedGroups,
+	)
+}
+
+func (auth *OIDCProvider) TokenCookieName() string {
+	return "godoxy_oidc_token"
+}
+
+func (auth *OIDCProvider) SetIsMiddleware(enabled bool) {
+	auth.isMiddleware = enabled
+	auth.oauthConfig.RedirectURL = ""
+}
+
+func (auth *OIDCProvider) SetAllowedUsers(users []string) {
+	auth.allowedUsers = users
+}
+
+func (auth *OIDCProvider) SetAllowedGroups(groups []string) {
+	auth.allowedGroups = groups
+}
+
+func (auth *OIDCProvider) CheckToken(r *http.Request) error {
+	token, err := r.Cookie(auth.TokenCookieName())
+	if err != nil {
+		return ErrMissingToken
+	}
+
+	// checks for Expiry, Audience == ClientID, Issuer, etc.
+	idToken, err := auth.oidcVerifier.Verify(r.Context(), token.Value)
+	if err != nil {
+		return fmt.Errorf("failed to verify ID token: %w: %w", ErrInvalidToken, err)
+	}
+
+	if len(idToken.Audience) == 0 {
+		return ErrInvalidToken
+	}
+
+	var claims struct {
+		Email    string   `json:"email"`
+		Username string   `json:"preferred_username"`
+		Groups   []string `json:"groups"`
+	}
+	if err := idToken.Claims(&claims); err != nil {
+		return fmt.Errorf("failed to parse claims: %w", err)
+	}
+
+	// Logical AND between allowed users and groups.
+	allowedUser := slices.Contains(auth.allowedUsers, claims.Username)
+	allowedGroup := len(CE.Intersect(claims.Groups, auth.allowedGroups)) > 0
+	if !allowedUser && !allowedGroup {
+		return ErrUserNotAllowed.Subject(claims.Username)
+	}
+	return nil
+}
+
+// generateState generates a random string for OIDC state.
+const oidcStateLength = 32
+
+func generateState() (string, error) {
+	b := make([]byte, oidcStateLength)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(b)[:oidcStateLength], nil
+}
+
+// RedirectOIDC initiates the OIDC login flow.
+func (auth *OIDCProvider) RedirectLoginPage(w http.ResponseWriter, r *http.Request) {
+	state, err := generateState()
+	if err != nil {
+		U.HandleErr(w, r, err, http.StatusInternalServerError)
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:     CookieOauthState,
+		Value:    state,
+		MaxAge:   300,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+		Secure:   true,
+		Path:     "/",
+	})
+
+	redirURL := auth.oauthConfig.AuthCodeURL(state)
+	if auth.isMiddleware {
+		u, err := r.URL.Parse(redirURL)
+		if err != nil {
+			U.HandleErr(w, r, err, http.StatusInternalServerError)
+			return
+		}
+		q := u.Query()
+		q.Set("redirect_uri", "https://"+r.Host+OIDCMiddlewareCallbackPath+q.Get("redirect_uri"))
+		u.RawQuery = q.Encode()
+		redirURL = u.String()
+	}
+	http.Redirect(w, r, redirURL, http.StatusTemporaryRedirect)
+}
+
+func (auth *OIDCProvider) exchange(r *http.Request) (*oauth2.Token, error) {
+	if auth.isMiddleware {
+		cfg := *auth.oauthConfig
+		cfg.RedirectURL = "https://" + r.Host + OIDCMiddlewareCallbackPath
+		return cfg.Exchange(r.Context(), r.URL.Query().Get("code"))
+	}
+	return auth.oauthConfig.Exchange(r.Context(), r.URL.Query().Get("code"))
+}
+
+// OIDCCallbackHandler handles the OIDC callback.
+func (auth *OIDCProvider) LoginCallbackHandler(w http.ResponseWriter, r *http.Request) {
+	// For testing purposes, skip provider verification
+	if common.IsTest {
+		auth.handleTestCallback(w, r)
+		return
+	}
+
+	state, err := r.Cookie(CookieOauthState)
+	if err != nil {
+		U.HandleErr(w, r, E.New("missing state cookie"), http.StatusBadRequest)
+		return
+	}
+
+	query := r.URL.Query()
+	if query.Get("state") != state.Value {
+		U.HandleErr(w, r, E.New("invalid oauth state"), http.StatusBadRequest)
+		return
+	}
+
+	oauth2Token, err := auth.exchange(r)
+	if err != nil {
+		U.HandleErr(w, r, fmt.Errorf("failed to exchange token: %w", err), http.StatusInternalServerError)
+		return
+	}
+
+	rawIDToken, ok := oauth2Token.Extra("id_token").(string)
+	if !ok {
+		U.HandleErr(w, r, E.New("missing id_token"), http.StatusInternalServerError)
+		return
+	}
+
+	idToken, err := auth.oidcVerifier.Verify(r.Context(), rawIDToken)
+	if err != nil {
+		U.HandleErr(w, r, fmt.Errorf("failed to verify ID token: %w", err), http.StatusInternalServerError)
+		return
+	}
+
+	setTokenCookie(w, r, auth.TokenCookieName(), rawIDToken, time.Until(idToken.Expiry))
+
+	// Redirect to home page
+	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
+}
+
+func (auth *OIDCProvider) LogoutCallbackHandler(w http.ResponseWriter, r *http.Request) {
+	if auth.oidcLogoutURL == nil {
+		DefaultLogoutCallbackHandler(auth, w, r)
+		return
+	}
+
+	token, err := r.Cookie(auth.TokenCookieName())
+	if err != nil {
+		U.HandleErr(w, r, E.New("missing token cookie"), http.StatusBadRequest)
+		return
+	}
+	clearTokenCookie(w, r, auth.TokenCookieName())
+
+	logoutURL := *auth.oidcLogoutURL
+	logoutURL.Query().Add("id_token_hint", token.Value)
+
+	http.Redirect(w, r, logoutURL.String(), http.StatusFound)
+}
+
+// handleTestCallback handles OIDC callback in test environment.
+func (auth *OIDCProvider) handleTestCallback(w http.ResponseWriter, r *http.Request) {
+	state, err := r.Cookie(CookieOauthState)
+	if err != nil {
+		U.HandleErr(w, r, E.New("missing state cookie"), http.StatusBadRequest)
+		return
+	}
+
+	if r.URL.Query().Get("state") != state.Value {
+		U.HandleErr(w, r, E.New("invalid oauth state"), http.StatusBadRequest)
+		return
+	}
+
+	// Create test JWT token
+	setTokenCookie(w, r, auth.TokenCookieName(), "test", time.Hour)
+
+	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
+}

internal/api/v1/auth/oidc_test.go

@@ -0,0 +1,454 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/yusing/go-proxy/internal/common"
+	"golang.org/x/oauth2"
+
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+// setupMockOIDC configures mock OIDC provider for testing.
+func setupMockOIDC(t *testing.T) {
+	t.Helper()
+
+	provider := (&oidc.ProviderConfig{}).NewProvider(context.TODO())
+	defaultAuth = &OIDCProvider{
+		oauthConfig: &oauth2.Config{
+			ClientID:     "test-client",
+			ClientSecret: "test-secret",
+			RedirectURL:  "http://localhost/callback",
+			Endpoint: oauth2.Endpoint{
+				AuthURL:  "http://mock-provider/auth",
+				TokenURL: "http://mock-provider/token",
+			},
+			Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+		},
+		oidcProvider: provider,
+		oidcVerifier: provider.Verifier(&oidc.Config{
+			ClientID: "test-client",
+		}),
+		allowedUsers:  []string{"test-user"},
+		allowedGroups: []string{"test-group1", "test-group2"},
+	}
+}
+
+// discoveryDocument returns a mock OIDC discovery document.
+func discoveryDocument(t *testing.T, server *httptest.Server) map[string]any {
+	t.Helper()
+
+	discovery := map[string]any{
+		"issuer":                 server.URL,
+		"authorization_endpoint": server.URL + "/auth",
+		"token_endpoint":         server.URL + "/token",
+	}
+
+	return discovery
+}
+
+const (
+	keyID    = "test-key-id"
+	clientID = "test-client-id"
+)
+
+type provider struct {
+	ts       *httptest.Server
+	key      *rsa.PrivateKey
+	verifier *oidc.IDTokenVerifier
+}
+
+func (j *provider) SignClaims(t *testing.T, claims jwt.Claims) string {
+	t.Helper()
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	token.Header["kid"] = keyID
+	signed, err := token.SignedString(j.key)
+	ExpectNoError(t, err)
+	return signed
+}
+
+func setupProvider(t *testing.T) *provider {
+	t.Helper()
+
+	// Generate an RSA key pair for the test.
+	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	ExpectNoError(t, err)
+
+	// Build the matching public JWK that will be served by the endpoint.
+	jwk := buildRSAJWK(t, &privKey.PublicKey, keyID)
+
+	// Start a test server that serves the JWKS endpoint.
+	ts := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/.well-known/jwks.json":
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"keys": []any{jwk},
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(ts.Close)
+
+	// Create a test OIDCProvider.
+	providerCtx := oidc.ClientContext(context.Background(), ts.Client())
+	keySet := oidc.NewRemoteKeySet(providerCtx, ts.URL+"/.well-known/jwks.json")
+
+	return &provider{
+		ts:  ts,
+		key: privKey,
+		verifier: oidc.NewVerifier(ts.URL, keySet, &oidc.Config{
+			ClientID: clientID, // matches audience in the token
+		}),
+	}
+}
+
+// buildRSAJWK is a helper to construct a minimal JWK for the JWKS endpoint.
+func buildRSAJWK(t *testing.T, pub *rsa.PublicKey, kid string) map[string]any {
+	t.Helper()
+
+	nBytes := pub.N.Bytes()
+	eBytes := []byte{0x01, 0x00, 0x01} // Usually 65537
+
+	return map[string]any{
+		"kty": "RSA",
+		"alg": "RS256",
+		"use": "sig",
+		"kid": kid,
+		"n":   base64.RawURLEncoding.EncodeToString(nBytes),
+		"e":   base64.RawURLEncoding.EncodeToString(eBytes),
+	}
+}
+
+func cleanup() {
+	defaultAuth = nil
+}
+
+func TestOIDCLoginHandler(t *testing.T) {
+	// Setup
+	common.APIJWTSecret = []byte("test-secret")
+	t.Cleanup(cleanup)
+	setupMockOIDC(t)
+
+	tests := []struct {
+		name         string
+		wantStatus   int
+		wantRedirect bool
+	}{
+		{
+			name:         "Success - Redirects to provider",
+			wantStatus:   http.StatusTemporaryRedirect,
+			wantRedirect: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "/auth/redirect", nil)
+			w := httptest.NewRecorder()
+
+			defaultAuth.RedirectLoginPage(w, req)
+
+			if got := w.Code; got != tt.wantStatus {
+				t.Errorf("OIDCLoginHandler() status = %v, want %v", got, tt.wantStatus)
+			}
+
+			if tt.wantRedirect {
+				if loc := w.Header().Get("Location"); loc == "" {
+					t.Error("OIDCLoginHandler() missing redirect location")
+				}
+
+				cookie := w.Header().Get("Set-Cookie")
+				if cookie == "" {
+					t.Error("OIDCLoginHandler() missing state cookie")
+				}
+			}
+		})
+	}
+}
+
+func TestOIDCCallbackHandler(t *testing.T) {
+	// Setup
+	common.APIJWTSecret = []byte("test-secret")
+	t.Cleanup(cleanup)
+	tests := []struct {
+		name       string
+		state      string
+		code       string
+		setupMocks bool
+		wantStatus int
+	}{
+		{
+			name:       "Success - Valid callback",
+			state:      "valid-state",
+			code:       "valid-code",
+			setupMocks: true,
+			wantStatus: http.StatusTemporaryRedirect,
+		},
+		{
+			name:       "Failure - Missing state",
+			code:       "valid-code",
+			setupMocks: true,
+			wantStatus: http.StatusBadRequest,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.setupMocks {
+				setupMockOIDC(t)
+			}
+
+			req := httptest.NewRequest(http.MethodGet, "/auth/callback?code="+tt.code+"&state="+tt.state, nil)
+			if tt.state != "" {
+				req.AddCookie(&http.Cookie{
+					Name:  CookieOauthState,
+					Value: tt.state,
+				})
+			}
+			w := httptest.NewRecorder()
+
+			defaultAuth.LoginCallbackHandler(w, req)
+
+			if got := w.Code; got != tt.wantStatus {
+				t.Errorf("OIDCCallbackHandler() status = %v, want %v", got, tt.wantStatus)
+			}
+
+			if tt.wantStatus == http.StatusTemporaryRedirect {
+				setCookie := Must(http.ParseSetCookie(w.Header().Get("Set-Cookie")))
+				ExpectEqual(t, setCookie.Name, defaultAuth.TokenCookieName())
+				ExpectTrue(t, setCookie.Value != "")
+				ExpectEqual(t, setCookie.Path, "/")
+				ExpectEqual(t, setCookie.SameSite, http.SameSiteLaxMode)
+				ExpectEqual(t, setCookie.HttpOnly, true)
+			}
+		})
+	}
+}
+
+func TestInitOIDC(t *testing.T) {
+	setupMockOIDC(t)
+	// Create a test server that serves the discovery document
+	var server *httptest.Server
+	mux := http.NewServeMux()
+	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		ExpectNoError(t, json.NewEncoder(w).Encode(discoveryDocument(t, server)))
+	})
+	server = httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+	t.Cleanup(cleanup)
+
+	tests := []struct {
+		name          string
+		issuerURL     string
+		clientID      string
+		clientSecret  string
+		redirectURL   string
+		logoutURL     string
+		allowedUsers  []string
+		allowedGroups []string
+		wantErr       bool
+	}{
+		{
+			name:    "Fail - Empty configuration",
+			wantErr: true,
+		},
+		{
+			name:         "Success - Valid configuration with users",
+			issuerURL:    server.URL,
+			clientID:     "client_id",
+			clientSecret: "client_secret",
+			redirectURL:  "https://example.com/callback",
+			allowedUsers: []string{"user1", "user2"},
+			wantErr:      false,
+		},
+		{
+			name:          "Success - Valid configuration with groups",
+			issuerURL:     server.URL,
+			clientID:      "client_id",
+			clientSecret:  "client_secret",
+			redirectURL:   "https://example.com/callback",
+			allowedGroups: []string{"group1", "group2"},
+			wantErr:       false,
+		},
+		{
+			name:          "Success - Valid configuration with users, groups and logout URL",
+			issuerURL:     server.URL,
+			clientID:      "client_id",
+			clientSecret:  "client_secret",
+			redirectURL:   "https://example.com/callback",
+			logoutURL:     "https://example.com/logout",
+			allowedUsers:  []string{"user1", "user2"},
+			allowedGroups: []string{"group1", "group2"},
+			wantErr:       false,
+		},
+		{
+			name:         "Fail - No allowed users or allowed groups",
+			issuerURL:    "https://example.com",
+			clientID:     "client_id",
+			clientSecret: "client_secret",
+			redirectURL:  "https://example.com/callback",
+			wantErr:      true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := NewOIDCProvider(tt.issuerURL, tt.clientID, tt.clientSecret, tt.redirectURL, tt.logoutURL, tt.allowedUsers, tt.allowedGroups)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("InitOIDC() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestCheckToken(t *testing.T) {
+	provider := setupProvider(t)
+
+	tests := []struct {
+		name          string
+		allowedUsers  []string
+		allowedGroups []string
+		claims        jwt.Claims
+		wantErr       error
+	}{
+		{
+			name:         "Success - Valid token with allowed user",
+			allowedUsers: []string{"user1"},
+			claims: jwt.MapClaims{
+				"iss":                provider.ts.URL,
+				"aud":                clientID,
+				"exp":                time.Now().Add(time.Hour).Unix(),
+				"preferred_username": "user1",
+				"groups":             []string{"group1"},
+			},
+		},
+		{
+			name:          "Success - Valid token with allowed group",
+			allowedGroups: []string{"group1"},
+			claims: jwt.MapClaims{
+				"iss":                provider.ts.URL,
+				"aud":                clientID,
+				"exp":                time.Now().Add(time.Hour).Unix(),
+				"preferred_username": "user1",
+				"groups":             []string{"group1"},
+			},
+		},
+		{
+			name:         "Success - Server omits groups, but user is allowed",
+			allowedUsers: []string{"user1"},
+			claims: jwt.MapClaims{
+				"iss":                provider.ts.URL,
+				"aud":                clientID,
+				"exp":                time.Now().Add(time.Hour).Unix(),
+				"preferred_username": "user1",
+			},
+		},
+		{
+			name:          "Success - Server omits preferred_username, but group is allowed",
+			allowedGroups: []string{"group1"},
+			claims: jwt.MapClaims{
+				"iss":    provider.ts.URL,
+				"aud":    clientID,
+				"exp":    time.Now().Add(time.Hour).Unix(),
+				"groups": []string{"group1"},
+			},
+		},
+		{
+			name:          "Success - Valid token with allowed user and group",
+			allowedUsers:  []string{"user1"},
+			allowedGroups: []string{"group1"},
+			claims: jwt.MapClaims{
+				"iss":                provider.ts.URL,
+				"aud":                clientID,
+				"exp":                time.Now().Add(time.Hour).Unix(),
+				"preferred_username": "user1",
+				"groups":             []string{"group1"},
+			},
+		},
+		{
+			name:          "Error - User not allowed",
+			allowedUsers:  []string{"user2", "user3"},
+			allowedGroups: []string{"group2", "group3"},
+			claims: jwt.MapClaims{
+				"iss":                provider.ts.URL,
+				"aud":                clientID,
+				"exp":                time.Now().Add(time.Hour).Unix(),
+				"preferred_username": "user1",
+				"groups":             []string{"group1"},
+			},
+			wantErr: ErrUserNotAllowed,
+		},
+		{
+			name: "Error - Server returns incorrect issuer",
+			claims: jwt.MapClaims{
+				"iss":                "https://example.com",
+				"aud":                clientID,
+				"exp":                time.Now().Add(time.Hour).Unix(),
+				"preferred_username": "user1",
+				"groups":             []string{"group1"},
+			},
+			wantErr: ErrInvalidToken,
+		},
+		{
+			name: "Error - Server returns incorrect audience",
+			claims: jwt.MapClaims{
+				"iss":                provider.ts.URL,
+				"aud":                "some-other-audience",
+				"exp":                time.Now().Add(time.Hour).Unix(),
+				"preferred_username": "user1",
+				"groups":             []string{"group1"},
+			},
+			wantErr: ErrInvalidToken,
+		},
+		{
+			name: "Error - Server returns expired token",
+			claims: jwt.MapClaims{
+				"iss":                provider.ts.URL,
+				"aud":                clientID,
+				"exp":                time.Now().Add(-time.Hour).Unix(),
+				"preferred_username": "user1",
+				"groups":             []string{"group1"},
+			},
+			wantErr: ErrInvalidToken,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create the Auth Provider.
+			auth := &OIDCProvider{
+				oidcVerifier:  provider.verifier,
+				allowedUsers:  tc.allowedUsers,
+				allowedGroups: tc.allowedGroups,
+			}
+			// Sign the claims to create a token.
+			signedToken := provider.SignClaims(t, tc.claims)
+			// Craft a test HTTP request that includes the token as a cookie.
+			req := httptest.NewRequest(http.MethodGet, "/", nil)
+			req.AddCookie(&http.Cookie{
+				Name:  auth.TokenCookieName(),
+				Value: signedToken,
+			})
+
+			// Call CheckToken and verify the result.
+			err := auth.CheckToken(req)
+			if tc.wantErr == nil {
+				ExpectNoError(t, err)
+			} else {
+				ExpectError(t, tc.wantErr, err)
+			}
+		})
+	}
+}

internal/api/v1/auth/provider.go

@@ -0,0 +1,13 @@
+package auth
+
+import (
+	"net/http"
+)
+
+type Provider interface {
+	TokenCookieName() string
+	CheckToken(r *http.Request) error
+	RedirectLoginPage(w http.ResponseWriter, r *http.Request)
+	LoginCallbackHandler(w http.ResponseWriter, r *http.Request)
+	LogoutCallbackHandler(w http.ResponseWriter, r *http.Request)
+}

internal/api/v1/auth/userpass.go

@@ -0,0 +1,143 @@
+package auth
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+	"golang.org/x/crypto/bcrypt"
+)
+
+var (
+	ErrInvalidUsername = E.New("invalid username")
+	ErrInvalidPassword = E.New("invalid password")
+)
+
+type (
+	UserPassAuth struct {
+		username string
+		pwdHash  []byte
+		secret   []byte
+		tokenTTL time.Duration
+	}
+	UserPassClaims struct {
+		Username string `json:"username"`
+		jwt.RegisteredClaims
+	}
+)
+
+func NewUserPassAuth(username, password string, secret []byte, tokenTTL time.Duration) (*UserPassAuth, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, err
+	}
+	return &UserPassAuth{
+		username: username,
+		pwdHash:  hash,
+		secret:   secret,
+		tokenTTL: tokenTTL,
+	}, nil
+}
+
+func NewUserPassAuthFromEnv() (*UserPassAuth, error) {
+	return NewUserPassAuth(
+		common.APIUser,
+		common.APIPassword,
+		common.APIJWTSecret,
+		common.APIJWTTokenTTL,
+	)
+}
+
+func (auth *UserPassAuth) TokenCookieName() string {
+	return "godoxy_token"
+}
+
+func (auth *UserPassAuth) NewToken() (token string, err error) {
+	claim := &UserPassClaims{
+		Username: auth.username,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(auth.tokenTTL)),
+		},
+	}
+	tok := jwt.NewWithClaims(jwt.SigningMethodHS512, claim)
+	token, err = tok.SignedString(auth.secret)
+	if err != nil {
+		return "", err
+	}
+	return token, nil
+}
+
+func (auth *UserPassAuth) CheckToken(r *http.Request) error {
+	jwtCookie, err := r.Cookie(auth.TokenCookieName())
+	if err != nil {
+		return ErrMissingToken
+	}
+	var claims UserPassClaims
+	token, err := jwt.ParseWithClaims(jwtCookie.Value, &claims, func(t *jwt.Token) (interface{}, error) {
+		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
+		}
+		return auth.secret, nil
+	})
+	if err != nil {
+		return err
+	}
+	switch {
+	case !token.Valid:
+		return ErrInvalidToken
+	case claims.Username != auth.username:
+		return ErrUserNotAllowed.Subject(claims.Username)
+	case claims.ExpiresAt.Before(time.Now()):
+		return E.Errorf("token expired on %s", strutils.FormatTime(claims.ExpiresAt.Time))
+	}
+
+	return nil
+}
+
+func (auth *UserPassAuth) RedirectLoginPage(w http.ResponseWriter, r *http.Request) {
+	http.Redirect(w, r, "/login", http.StatusTemporaryRedirect)
+}
+
+func (auth *UserPassAuth) LoginCallbackHandler(w http.ResponseWriter, r *http.Request) {
+	var creds struct {
+		User string `json:"username"`
+		Pass string `json:"password"`
+	}
+	err := json.NewDecoder(r.Body).Decode(&creds)
+	if err != nil {
+		U.HandleErr(w, r, err, http.StatusBadRequest)
+		return
+	}
+	if err := auth.validatePassword(creds.User, creds.Pass); err != nil {
+		U.LogError(r).Err(err).Msg("auth: invalid credentials")
+		U.RespondError(w, E.New("invalid credentials"), http.StatusUnauthorized)
+		return
+	}
+	token, err := auth.NewToken()
+	if err != nil {
+		U.HandleErr(w, r, err, http.StatusInternalServerError)
+		return
+	}
+	setTokenCookie(w, r, auth.TokenCookieName(), token, auth.tokenTTL)
+	w.WriteHeader(http.StatusOK)
+}
+
+func (auth *UserPassAuth) LogoutCallbackHandler(w http.ResponseWriter, r *http.Request) {
+	DefaultLogoutCallbackHandler(auth, w, r)
+}
+
+func (auth *UserPassAuth) validatePassword(user, pass string) error {
+	if user != auth.username {
+		return ErrInvalidUsername.Subject(user)
+	}
+	if err := bcrypt.CompareHashAndPassword(auth.pwdHash, []byte(pass)); err != nil {
+		return ErrInvalidPassword.With(err).Subject(pass)
+	}
+	return nil
+}

internal/api/v1/auth/userpass_test.go

@@ -0,0 +1,115 @@
+package auth
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func newMockUserPassAuth() *UserPassAuth {
+	return &UserPassAuth{
+		username: "username",
+		pwdHash:  Must(bcrypt.GenerateFromPassword([]byte("password"), bcrypt.DefaultCost)),
+		secret:   []byte("abcdefghijklmnopqrstuvwxyz"),
+		tokenTTL: time.Hour,
+	}
+}
+
+func TestUserPassValidateCredentials(t *testing.T) {
+	auth := newMockUserPassAuth()
+	err := auth.validatePassword("username", "password")
+	ExpectNoError(t, err)
+	err = auth.validatePassword("username", "wrong-password")
+	ExpectError(t, ErrInvalidPassword, err)
+	err = auth.validatePassword("wrong-username", "password")
+	ExpectError(t, ErrInvalidUsername, err)
+}
+
+func TestUserPassCheckToken(t *testing.T) {
+	auth := newMockUserPassAuth()
+	token, err := auth.NewToken()
+	ExpectNoError(t, err)
+	tests := []struct {
+		token   string
+		wantErr bool
+	}{
+		{
+			token:   token,
+			wantErr: false,
+		},
+		{
+			token:   "invalid-token",
+			wantErr: true,
+		},
+		{
+			token:   "",
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		req := &http.Request{Header: http.Header{}}
+		if tt.token != "" {
+			req.Header.Set("Cookie", auth.TokenCookieName()+"="+tt.token)
+		}
+		err = auth.CheckToken(req)
+		if tt.wantErr {
+			ExpectTrue(t, err != nil)
+		} else {
+			ExpectNoError(t, err)
+		}
+	}
+}
+
+func TestUserPassLoginCallbackHandler(t *testing.T) {
+	type cred struct {
+		User string `json:"username"`
+		Pass string `json:"password"`
+	}
+	auth := newMockUserPassAuth()
+	tests := []struct {
+		creds   cred
+		wantErr bool
+	}{
+		{
+			creds: cred{
+				User: "username",
+				Pass: "password",
+			},
+			wantErr: false,
+		},
+		{
+			creds: cred{
+				User: "username",
+				Pass: "wrong-password",
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		w := httptest.NewRecorder()
+		req := &http.Request{
+			Host: "app.example.com",
+			Body: io.NopCloser(bytes.NewReader(Must(json.Marshal(tt.creds)))),
+		}
+		auth.LoginCallbackHandler(w, req)
+		if tt.wantErr {
+			ExpectEqual(t, w.Code, http.StatusUnauthorized)
+		} else {
+			setCookie := Must(http.ParseSetCookie(w.Header().Get("Set-Cookie")))
+			ExpectTrue(t, setCookie.Name == auth.TokenCookieName())
+			ExpectTrue(t, setCookie.Value != "")
+			ExpectEqual(t, setCookie.Domain, "example.com")
+			ExpectEqual(t, setCookie.Path, "/")
+			ExpectEqual(t, setCookie.SameSite, http.SameSiteLaxMode)
+			ExpectEqual(t, setCookie.HttpOnly, true)
+			ExpectEqual(t, w.Code, http.StatusOK)
+		}
+	}
+}

internal/api/v1/auth/utils.go

@@ -0,0 +1,69 @@
+package auth
+
+import (
+	"net"
+	"net/http"
+	"time"
+
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+var (
+	ErrMissingToken   = E.New("missing token")
+	ErrInvalidToken   = E.New("invalid token")
+	ErrUserNotAllowed = E.New("user not allowed")
+)
+
+// cookieFQDN returns the fully qualified domain name of the request host
+// with subdomain stripped.
+//
+// If the request host does not have a subdomain,
+// an empty string is returned
+//
+//	"abc.example.com" -> "example.com"
+//	"example.com" -> ""
+func cookieFQDN(r *http.Request) string {
+	host, _, err := net.SplitHostPort(r.Host)
+	if err != nil {
+		host = r.Host
+	}
+	parts := strutils.SplitRune(host, '.')
+	if len(parts) < 2 {
+		return ""
+	}
+	parts[0] = ""
+	return strutils.JoinRune(parts, '.')
+}
+
+func setTokenCookie(w http.ResponseWriter, r *http.Request, name, value string, ttl time.Duration) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     name,
+		Value:    value,
+		MaxAge:   int(ttl.Seconds()),
+		Domain:   cookieFQDN(r),
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteLaxMode,
+		Path:     "/",
+	})
+}
+
+func clearTokenCookie(w http.ResponseWriter, r *http.Request, name string) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     name,
+		Value:    "",
+		MaxAge:   -1,
+		Domain:   cookieFQDN(r),
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteLaxMode,
+		Path:     "/",
+	})
+}
+
+// DefaultLogoutCallbackHandler clears the token cookie and redirects to the login page..
+func DefaultLogoutCallbackHandler(auth Provider, w http.ResponseWriter, r *http.Request) {
+	clearTokenCookie(w, r, auth.TokenCookieName())
+	auth.RedirectLoginPage(w, r)
+}

internal/api/v1/favicon/cache.go

@@ -0,0 +1,136 @@
+package favicon
+
+import (
+	"encoding/json"
+	"sync"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/logging"
+	route "github.com/yusing/go-proxy/internal/route/types"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/utils"
+)
+
+type cacheEntry struct {
+	Icon       []byte    `json:"icon"`
+	LastAccess time.Time `json:"lastAccess"`
+}
+
+// cache key can be absolute url or route name.
+var (
+	iconCache   = make(map[string]*cacheEntry)
+	iconCacheMu sync.RWMutex
+)
+
+const (
+	iconCacheTTL    = 24 * time.Hour
+	cleanUpInterval = time.Hour
+)
+
+func InitIconCache() {
+	iconCacheMu.Lock()
+	defer iconCacheMu.Unlock()
+
+	err := utils.LoadJSONIfExist(common.IconCachePath, &iconCache)
+	if err != nil {
+		logging.Error().Err(err).Msg("failed to load icon cache")
+	} else {
+		logging.Info().Msgf("icon cache loaded (%d icons)", len(iconCache))
+	}
+
+	go func() {
+		cleanupTicker := time.NewTicker(cleanUpInterval)
+		defer cleanupTicker.Stop()
+		for {
+			select {
+			case <-task.RootContextCanceled():
+				return
+			case <-cleanupTicker.C:
+				pruneExpiredIconCache()
+			}
+		}
+	}()
+
+	task.OnProgramExit("save_favicon_cache", func() {
+		iconCacheMu.Lock()
+		defer iconCacheMu.Unlock()
+
+		if len(iconCache) == 0 {
+			return
+		}
+
+		if err := utils.SaveJSON(common.IconCachePath, &iconCache, 0o644); err != nil {
+			logging.Error().Err(err).Msg("failed to save icon cache")
+		}
+	})
+}
+
+func pruneExpiredIconCache() {
+	iconCacheMu.Lock()
+	defer iconCacheMu.Unlock()
+
+	nPruned := 0
+	for key, icon := range iconCache {
+		if icon.IsExpired() {
+			delete(iconCache, key)
+			nPruned++
+		}
+	}
+	logging.Info().Int("pruned", nPruned).Msg("pruned expired icon cache")
+}
+
+func routeKey(r route.HTTPRoute) string {
+	return r.ProviderName() + ":" + r.TargetName()
+}
+
+func PruneRouteIconCache(route route.HTTPRoute) {
+	iconCacheMu.Lock()
+	defer iconCacheMu.Unlock()
+	delete(iconCache, routeKey(route))
+}
+
+func loadIconCache(key string) *fetchResult {
+	iconCacheMu.RLock()
+	defer iconCacheMu.RUnlock()
+
+	icon, ok := iconCache[key]
+	if ok && icon != nil {
+		logging.Debug().
+			Str("key", key).
+			Msg("icon found in cache")
+		icon.LastAccess = time.Now()
+		return &fetchResult{icon: icon.Icon}
+	}
+	return nil
+}
+
+func storeIconCache(key string, icon []byte) {
+	iconCacheMu.Lock()
+	defer iconCacheMu.Unlock()
+	iconCache[key] = &cacheEntry{Icon: icon, LastAccess: time.Now()}
+}
+
+func (e *cacheEntry) IsExpired() bool {
+	return time.Since(e.LastAccess) > iconCacheTTL
+}
+
+func (e *cacheEntry) UnmarshalJSON(data []byte) error {
+	attempt := struct {
+		Icon       []byte    `json:"icon"`
+		LastAccess time.Time `json:"lastAccess"`
+	}{}
+	err := json.Unmarshal(data, &attempt)
+	if err == nil {
+		e.Icon = attempt.Icon
+		e.LastAccess = attempt.LastAccess
+		return nil
+	}
+	// fallback to bytes
+	err = json.Unmarshal(data, &e.Icon)
+	if err == nil {
+		e.LastAccess = time.Now()
+		return nil
+	}
+	return err
+}

internal/api/v1/favicon/content.go

@@ -0,0 +1,37 @@
+package favicon
+
+import (
+	"bufio"
+	"errors"
+	"net"
+	"net/http"
+)
+
+type content struct {
+	header http.Header
+	data   []byte
+	status int
+}
+
+func newContent() *content {
+	return &content{
+		header: make(http.Header),
+	}
+}
+
+func (c *content) Header() http.Header {
+	return c.header
+}
+
+func (c *content) Write(data []byte) (int, error) {
+	c.data = append(c.data, data...)
+	return len(data), nil
+}
+
+func (c *content) WriteHeader(statusCode int) {
+	c.status = statusCode
+}
+
+func (c *content) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	return nil, nil, errors.New("not supported")
+}

internal/api/v1/favicon/favicon.go

@@ -0,0 +1,284 @@
+package favicon
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/PuerkitoBio/goquery"
+	"github.com/vincent-petithory/dataurl"
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/homepage"
+	"github.com/yusing/go-proxy/internal/logging"
+	gphttp "github.com/yusing/go-proxy/internal/net/http"
+	"github.com/yusing/go-proxy/internal/route/routes"
+	route "github.com/yusing/go-proxy/internal/route/types"
+)
+
+type fetchResult struct {
+	icon        []byte
+	contentType string
+	statusCode  int
+	errMsg      string
+}
+
+func (res *fetchResult) OK() bool {
+	return res.icon != nil
+}
+
+func (res *fetchResult) ContentType() string {
+	if res.contentType == "" {
+		if bytes.HasPrefix(res.icon, []byte("<svg")) || bytes.HasPrefix(res.icon, []byte("<?xml")) {
+			return "image/svg+xml"
+		} else {
+			return "image/x-icon"
+		}
+	}
+	return res.contentType
+}
+
+// GetFavIcon returns the favicon of the route
+//
+// Returns:
+//   - 200 OK: if icon found
+//   - 400 Bad Request: if alias is empty or route is not HTTPRoute
+//   - 404 Not Found: if route or icon not found
+//   - 500 Internal Server Error: if internal error
+//   - others: depends on route handler response
+func GetFavIcon(w http.ResponseWriter, req *http.Request) {
+	url, alias := req.FormValue("url"), req.FormValue("alias")
+	if url == "" && alias == "" {
+		U.RespondError(w, U.ErrMissingKey("url or alias"), http.StatusBadRequest)
+		return
+	}
+	if url != "" && alias != "" {
+		U.RespondError(w, U.ErrInvalidKey("url and alias are mutually exclusive"), http.StatusBadRequest)
+		return
+	}
+
+	// try with url
+	if url != "" {
+		var iconURL homepage.IconURL
+		if err := iconURL.Parse(url); err != nil {
+			U.RespondError(w, err, http.StatusBadRequest)
+			return
+		}
+		fetchResult := getFavIconFromURL(&iconURL)
+		if !fetchResult.OK() {
+			http.Error(w, fetchResult.errMsg, fetchResult.statusCode)
+			return
+		}
+		w.Header().Set("Content-Type", fetchResult.ContentType())
+		U.WriteBody(w, fetchResult.icon)
+		return
+	}
+
+	// try with route.Homepage.Icon
+	r, ok := routes.GetHTTPRoute(alias)
+	if !ok {
+		U.RespondError(w, errors.New("no such route"), http.StatusNotFound)
+		return
+	}
+
+	var result *fetchResult
+	hp := r.HomepageConfig().GetOverride()
+	if !hp.IsEmpty() && hp.Icon != nil {
+		if hp.Icon.IconSource == homepage.IconSourceRelative {
+			result = findIcon(r, req, hp.Icon.Value)
+		} else {
+			result = getFavIconFromURL(hp.Icon)
+		}
+	} else {
+		// try extract from "link[rel=icon]"
+		result = findIcon(r, req, "/")
+	}
+	if result.statusCode == 0 {
+		result.statusCode = http.StatusOK
+	}
+	if !result.OK() {
+		http.Error(w, result.errMsg, result.statusCode)
+		return
+	}
+	w.Header().Set("Content-Type", result.ContentType())
+	U.WriteBody(w, result.icon)
+}
+
+func getFavIconFromURL(iconURL *homepage.IconURL) *fetchResult {
+	switch iconURL.IconSource {
+	case homepage.IconSourceAbsolute:
+		return fetchIconAbsolute(iconURL.URL())
+	case homepage.IconSourceRelative:
+		return &fetchResult{statusCode: http.StatusBadRequest, errMsg: "unexpected relative icon"}
+	case homepage.IconSourceWalkXCode, homepage.IconSourceSelfhSt:
+		return fetchKnownIcon(iconURL)
+	}
+	return &fetchResult{statusCode: http.StatusBadRequest, errMsg: "invalid icon source"}
+}
+
+func fetchIconAbsolute(url string) *fetchResult {
+	if result := loadIconCache(url); result != nil {
+		return result
+	}
+
+	resp, err := U.Get(url)
+	if err != nil || resp.StatusCode != http.StatusOK {
+		if err == nil {
+			err = errors.New(resp.Status)
+		}
+		logging.Error().Err(err).
+			Str("url", url).
+			Msg("failed to get icon")
+		return &fetchResult{statusCode: http.StatusBadGateway, errMsg: "connection error"}
+	}
+
+	defer resp.Body.Close()
+	icon, err := io.ReadAll(resp.Body)
+	if err != nil {
+		logging.Error().Err(err).
+			Str("url", url).
+			Msg("failed to read icon")
+		return &fetchResult{statusCode: http.StatusInternalServerError, errMsg: "internal error"}
+	}
+
+	storeIconCache(url, icon)
+	return &fetchResult{icon: icon}
+}
+
+var nameSanitizer = strings.NewReplacer(
+	"_", "-",
+	" ", "-",
+	"(", "",
+	")", "",
+)
+
+func sanitizeName(name string) string {
+	return strings.ToLower(nameSanitizer.Replace(name))
+}
+
+func fetchKnownIcon(url *homepage.IconURL) *fetchResult {
+	// if icon isn't in the list, no need to fetch
+	if !url.HasIcon() {
+		logging.Debug().
+			Str("value", url.String()).
+			Str("url", url.URL()).
+			Msg("no such icon")
+		return &fetchResult{statusCode: http.StatusNotFound, errMsg: "no such icon"}
+	}
+
+	return fetchIconAbsolute(url.URL())
+}
+
+func fetchIcon(filetype, filename string) *fetchResult {
+	result := fetchKnownIcon(homepage.NewSelfhStIconURL(filename, filetype))
+	if result.icon == nil {
+		return result
+	}
+	return fetchKnownIcon(homepage.NewWalkXCodeIconURL(filename, filetype))
+}
+
+func findIcon(r route.HTTPRoute, req *http.Request, uri string) *fetchResult {
+	key := routeKey(r)
+	if result := loadIconCache(key); result != nil {
+		return result
+	}
+
+	result := fetchIcon("png", sanitizeName(r.TargetName()))
+	cont := r.ContainerInfo()
+	if !result.OK() && cont != nil {
+		result = fetchIcon("png", sanitizeName(cont.ImageName))
+	}
+	if !result.OK() {
+		// fallback to parse html
+		result = findIconSlow(r, req, uri)
+	}
+	if result.OK() {
+		storeIconCache(key, result.icon)
+	}
+	return result
+}
+
+func findIconSlow(r route.HTTPRoute, req *http.Request, uri string) *fetchResult {
+	ctx, cancel := context.WithTimeoutCause(req.Context(), 3*time.Second, errors.New("favicon request timeout"))
+	defer cancel()
+	newReq := req.WithContext(ctx)
+	newReq.Header.Set("Accept-Encoding", "identity") // disable compression
+	if !strings.HasPrefix(uri, "/") {
+		uri = "/" + uri
+	}
+	u, err := url.ParseRequestURI(uri)
+	if err != nil {
+		logging.Error().Err(err).
+			Str("route", r.TargetName()).
+			Str("path", uri).
+			Msg("failed to parse uri")
+		return &fetchResult{statusCode: http.StatusInternalServerError, errMsg: "cannot parse uri"}
+	}
+	newReq.URL.Path = u.Path
+	newReq.URL.RawPath = u.RawPath
+	newReq.URL.RawQuery = u.RawQuery
+	newReq.RequestURI = u.String()
+
+	c := newContent()
+	r.ServeHTTP(c, newReq)
+	if c.status != http.StatusOK {
+		switch c.status {
+		case 0:
+			return &fetchResult{statusCode: http.StatusBadGateway, errMsg: "connection error"}
+		default:
+			if loc := c.Header().Get("Location"); loc != "" {
+				loc = path.Clean(loc)
+				if !strings.HasPrefix(loc, "/") {
+					loc = "/" + loc
+				}
+				if loc == newReq.URL.Path {
+					return &fetchResult{statusCode: http.StatusBadGateway, errMsg: "circular redirect"}
+				}
+				return findIconSlow(r, req, loc)
+			}
+		}
+		return &fetchResult{statusCode: c.status, errMsg: "upstream error: " + string(c.data)}
+	}
+	// return icon data
+	if !gphttp.GetContentType(c.header).IsHTML() {
+		return &fetchResult{icon: c.data, contentType: c.header.Get("Content-Type")}
+	}
+	// try extract from "link[rel=icon]" from path "/"
+	doc, err := goquery.NewDocumentFromReader(bytes.NewBuffer(c.data))
+	if err != nil {
+		logging.Error().Err(err).
+			Str("route", r.TargetName()).
+			Msg("failed to parse html")
+		return &fetchResult{statusCode: http.StatusInternalServerError, errMsg: "internal error"}
+	}
+	ele := doc.Find("head > link[rel=icon]").First()
+	if ele.Length() == 0 {
+		return &fetchResult{statusCode: http.StatusNotFound, errMsg: "icon element not found"}
+	}
+	href := ele.AttrOr("href", "")
+	if href == "" {
+		return &fetchResult{statusCode: http.StatusNotFound, errMsg: "icon href not found"}
+	}
+	// https://en.wikipedia.org/wiki/Data_URI_scheme
+	if strings.HasPrefix(href, "data:image/") {
+		dataURI, err := dataurl.DecodeString(href)
+		if err != nil {
+			logging.Error().Err(err).
+				Str("route", r.TargetName()).
+				Msg("failed to decode favicon")
+			return &fetchResult{statusCode: http.StatusInternalServerError, errMsg: "internal error"}
+		}
+		return &fetchResult{icon: dataURI.Data, contentType: dataURI.ContentType()}
+	}
+	switch {
+	case strings.HasPrefix(href, "http://"), strings.HasPrefix(href, "https://"):
+		return fetchIconAbsolute(href)
+	default:
+		return findIconSlow(r, req, path.Clean(href))
+	}
+}

internal/api/v1/file.go

@@ -0,0 +1,133 @@
+package v1
+
+import (
+	"io"
+	"net/http"
+	"os"
+	"path"
+	"strings"
+
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
+	"github.com/yusing/go-proxy/internal/route/provider"
+)
+
+type FileType string
+
+const (
+	FileTypeConfig     FileType = "config"
+	FileTypeProvider   FileType = "provider"
+	FileTypeMiddleware FileType = "middleware"
+)
+
+func fileType(file string) FileType {
+	switch {
+	case strings.HasPrefix(path.Base(file), "config."):
+		return FileTypeConfig
+	case strings.HasPrefix(file, common.MiddlewareComposeBasePath):
+		return FileTypeMiddleware
+	}
+	return FileTypeProvider
+}
+
+func (t FileType) IsValid() bool {
+	switch t {
+	case FileTypeConfig, FileTypeProvider, FileTypeMiddleware:
+		return true
+	}
+	return false
+}
+
+func (t FileType) GetPath(filename string) string {
+	if t == FileTypeMiddleware {
+		return path.Join(common.MiddlewareComposeBasePath, filename)
+	}
+	return path.Join(common.ConfigBasePath, filename)
+}
+
+func getArgs(r *http.Request) (fileType FileType, filename string, err error) {
+	fileType = FileType(r.PathValue("type"))
+	if !fileType.IsValid() {
+		err = U.ErrInvalidKey("type")
+		return
+	}
+	filename = r.PathValue("filename")
+	if filename == "" {
+		err = U.ErrMissingKey("filename")
+	}
+	return
+}
+
+func GetFileContent(w http.ResponseWriter, r *http.Request) {
+	fileType, filename, err := getArgs(r)
+	if err != nil {
+		U.RespondError(w, err, http.StatusBadRequest)
+		return
+	}
+	content, err := os.ReadFile(fileType.GetPath(filename))
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	U.WriteBody(w, content)
+}
+
+func validateFile(fileType FileType, content []byte) error {
+	switch fileType {
+	case FileTypeConfig:
+		return config.Validate(content)
+	case FileTypeMiddleware:
+		errs := E.NewBuilder("middleware errors")
+		middleware.BuildMiddlewaresFromYAML("", content, errs)
+		return errs.Error()
+	}
+	return provider.Validate(content)
+}
+
+func ValidateFile(w http.ResponseWriter, r *http.Request) {
+	fileType := FileType(r.PathValue("type"))
+	if !fileType.IsValid() {
+		U.RespondError(w, U.ErrInvalidKey("type"), http.StatusBadRequest)
+		return
+	}
+	content, err := io.ReadAll(r.Body)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	r.Body.Close()
+	err = validateFile(fileType, content)
+	if err != nil {
+		U.RespondError(w, err, http.StatusBadRequest)
+		return
+	}
+	w.WriteHeader(http.StatusOK)
+}
+
+func SetFileContent(w http.ResponseWriter, r *http.Request) {
+	fileType, filename, err := getArgs(r)
+	if err != nil {
+		U.RespondError(w, err, http.StatusBadRequest)
+		return
+	}
+	content, err := io.ReadAll(r.Body)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+
+	if valErr := validateFile(fileType, content); valErr != nil {
+		U.RespondError(w, valErr, http.StatusBadRequest)
+		return
+	}
+
+	err = os.WriteFile(fileType.GetPath(filename), content, 0o644)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	w.WriteHeader(http.StatusOK)
+}

internal/api/v1/health.go

@@ -0,0 +1,18 @@
+package v1
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/coder/websocket"
+	"github.com/coder/websocket/wsjson"
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/route/routes/routequery"
+)
+
+func HealthWS(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
+	U.PeriodicWS(cfg, w, r, 1*time.Second, func(conn *websocket.Conn) error {
+		return wsjson.Write(r.Context(), conn, routequery.HealthMap())
+	})
+}

internal/api/v1/homepage_overrides.go

@@ -0,0 +1,90 @@
+package v1
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+
+	"github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/homepage"
+)
+
+const (
+	HomepageOverrideItem          = "item"
+	HomepageOverrideItemsBatch    = "items_batch"
+	HomepageOverrideCategoryOrder = "category_order"
+	HomepageOverrideItemVisible   = "item_visible"
+)
+
+type (
+	HomepageOverrideItemParams struct {
+		Which string              `json:"which"`
+		Value homepage.ItemConfig `json:"value"`
+	}
+	HomepageOverrideItemsBatchParams struct {
+		Value map[string]*homepage.ItemConfig `json:"value"`
+	}
+	HomepageOverrideCategoryOrderParams struct {
+		Which string `json:"which"`
+		Value int    `json:"value"`
+	}
+	HomepageOverrideItemVisibleParams struct {
+		Which []string `json:"which"`
+		Value bool     `json:"value"`
+	}
+)
+
+func SetHomePageOverrides(w http.ResponseWriter, r *http.Request) {
+	what := r.FormValue("what")
+	if what == "" {
+		http.Error(w, "missing what or which", http.StatusBadRequest)
+		return
+	}
+
+	data, err := io.ReadAll(r.Body)
+	if err != nil {
+		utils.RespondError(w, err, http.StatusBadRequest)
+		return
+	}
+	r.Body.Close()
+
+	overrides := homepage.GetOverrideConfig()
+	switch what {
+	case HomepageOverrideItem:
+		var params HomepageOverrideItemParams
+		if err := json.Unmarshal(data, &params); err != nil {
+			utils.RespondError(w, err, http.StatusBadRequest)
+			return
+		}
+		overrides.OverrideItem(params.Which, &params.Value)
+	case HomepageOverrideItemsBatch:
+		var params HomepageOverrideItemsBatchParams
+		if err := json.Unmarshal(data, &params); err != nil {
+			utils.RespondError(w, err, http.StatusBadRequest)
+			return
+		}
+		overrides.OverrideItems(params.Value)
+	case HomepageOverrideItemVisible: // POST /v1/item_visible [a,b,c], false => hide a, b, c
+		var params HomepageOverrideItemVisibleParams
+		if err := json.Unmarshal(data, &params); err != nil {
+			utils.RespondError(w, err, http.StatusBadRequest)
+			return
+		}
+		if params.Value {
+			overrides.UnhideItems(params.Which...)
+		} else {
+			overrides.HideItems(params.Which...)
+		}
+	case HomepageOverrideCategoryOrder:
+		var params HomepageOverrideCategoryOrderParams
+		if err := json.Unmarshal(data, &params); err != nil {
+			utils.RespondError(w, err, http.StatusBadRequest)
+			return
+		}
+		overrides.SetCategoryOrder(params.Which, params.Value)
+	default:
+		http.Error(w, "invalid what", http.StatusBadRequest)
+		return
+	}
+	w.WriteHeader(http.StatusOK)
+}

internal/api/v1/index.go

@@ -0,0 +1,11 @@
+package v1
+
+import (
+	"net/http"
+
+	. "github.com/yusing/go-proxy/internal/api/v1/utils"
+)
+
+func Index(w http.ResponseWriter, r *http.Request) {
+	WriteBody(w, []byte("API ready"))
+}

internal/api/v1/list.go

@@ -0,0 +1,127 @@
+package v1
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/yusing/go-proxy/internal"
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
+	"github.com/yusing/go-proxy/internal/route/routes/routequery"
+	route "github.com/yusing/go-proxy/internal/route/types"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/utils"
+)
+
+const (
+	ListRoute              = "route"
+	ListRoutes             = "routes"
+	ListFiles              = "files"
+	ListMiddlewares        = "middlewares"
+	ListMiddlewareTraces   = "middleware_trace"
+	ListMatchDomains       = "match_domains"
+	ListHomepageConfig     = "homepage_config"
+	ListRouteProviders     = "route_providers"
+	ListHomepageCategories = "homepage_categories"
+	ListIcons              = "icons"
+	ListTasks              = "tasks"
+)
+
+func List(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
+	what := r.PathValue("what")
+	if what == "" {
+		what = ListRoutes
+	}
+	which := r.PathValue("which")
+
+	switch what {
+	case ListRoute:
+		if route := listRoute(which); route == nil {
+			http.NotFound(w, r)
+			return
+		} else {
+			U.RespondJSON(w, r, route)
+		}
+	case ListRoutes:
+		U.RespondJSON(w, r, routequery.RoutesByAlias(route.RouteType(r.FormValue("type"))))
+	case ListFiles:
+		listFiles(w, r)
+	case ListMiddlewares:
+		U.RespondJSON(w, r, middleware.All())
+	case ListMiddlewareTraces:
+		U.RespondJSON(w, r, middleware.GetAllTrace())
+	case ListMatchDomains:
+		U.RespondJSON(w, r, cfg.Value().MatchDomains)
+	case ListHomepageConfig:
+		U.RespondJSON(w, r, routequery.HomepageConfig(cfg.Value().Homepage.UseDefaultCategories, r.FormValue("category"), r.FormValue("provider")))
+	case ListRouteProviders:
+		U.RespondJSON(w, r, cfg.RouteProviderList())
+	case ListHomepageCategories:
+		U.RespondJSON(w, r, routequery.HomepageCategories())
+	case ListIcons:
+		limit, err := strconv.Atoi(r.FormValue("limit"))
+		if err != nil {
+			limit = 0
+		}
+		icons, err := internal.SearchIcons(r.FormValue("keyword"), limit)
+		if err != nil {
+			U.RespondError(w, err)
+			return
+		}
+		if icons == nil {
+			icons = []string{}
+		}
+		U.RespondJSON(w, r, icons)
+	case ListTasks:
+		U.RespondJSON(w, r, task.DebugTaskList())
+	default:
+		U.HandleErr(w, r, U.ErrInvalidKey("what"), http.StatusBadRequest)
+	}
+}
+
+// if which is "all" or empty, return map[string]Route of all routes
+// otherwise, return a single Route with alias which or nil if not found.
+func listRoute(which string) any {
+	if which == "" || which == "all" {
+		return routequery.RoutesByAlias()
+	}
+	routes := routequery.RoutesByAlias()
+	route, ok := routes[which]
+	if !ok {
+		return nil
+	}
+	return route
+}
+
+func listFiles(w http.ResponseWriter, r *http.Request) {
+	files, err := utils.ListFiles(common.ConfigBasePath, 0, true)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	resp := map[FileType][]string{
+		FileTypeConfig:     make([]string, 0),
+		FileTypeProvider:   make([]string, 0),
+		FileTypeMiddleware: make([]string, 0),
+	}
+
+	for _, file := range files {
+		t := fileType(file)
+		file = strings.TrimPrefix(file, common.ConfigBasePath+"/")
+		resp[t] = append(resp[t], file)
+	}
+
+	mids, err := utils.ListFiles(common.MiddlewareComposeBasePath, 0, true)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	for _, mid := range mids {
+		mid = strings.TrimPrefix(mid, common.MiddlewareComposeBasePath+"/")
+		resp[FileTypeMiddleware] = append(resp[FileTypeMiddleware], mid)
+	}
+	U.RespondJSON(w, r, resp)
+}

internal/api/v1/mem_logger.go

@@ -0,0 +1,233 @@
+package v1
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/coder/websocket"
+	"github.com/rs/zerolog"
+	"github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/task"
+	F "github.com/yusing/go-proxy/internal/utils/functional"
+)
+
+type logEntryRange struct {
+	Start, End int
+}
+
+type memLogger struct {
+	bytes.Buffer
+	sync.RWMutex
+	notifyLock sync.RWMutex
+	connChans  F.Map[chan *logEntryRange, struct{}]
+
+	bufPool sync.Pool // used in hook mode
+}
+
+type MemLogger interface {
+	io.Writer
+	// TODO: hook does not pass in fields, looking for a workaround to do server side log rendering
+	zerolog.Hook
+}
+
+type buffer struct {
+	data []byte
+}
+
+const (
+	maxMemLogSize         = 16 * 1024
+	truncateSize          = maxMemLogSize / 2
+	initialWriteChunkSize = 4 * 1024
+	hookModeBufSize       = 256
+)
+
+var memLoggerInstance = &memLogger{
+	connChans: F.NewMapOf[chan *logEntryRange, struct{}](),
+	bufPool: sync.Pool{
+		New: func() any {
+			return &buffer{
+				data: make([]byte, 0, hookModeBufSize),
+			}
+		},
+	},
+}
+
+func init() {
+	if !common.EnableLogStreaming {
+		return
+	}
+	memLoggerInstance.Grow(maxMemLogSize)
+
+	if common.DebugMemLogger {
+		ticker := time.NewTicker(1 * time.Second)
+
+		go func() {
+			defer ticker.Stop()
+
+			for {
+				select {
+				case <-task.RootContextCanceled():
+					return
+				case <-ticker.C:
+					logging.Info().Msgf("mem logger size: %d, active conns: %d",
+						memLoggerInstance.Len(),
+						memLoggerInstance.connChans.Size())
+				}
+			}
+		}()
+	}
+}
+
+func LogsWS() func(config config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
+	return memLoggerInstance.ServeHTTP
+}
+
+func GetMemLogger() MemLogger {
+	return memLoggerInstance
+}
+
+func (m *memLogger) truncateIfNeeded(n int) {
+	m.RLock()
+	needTruncate := m.Len()+n > maxMemLogSize
+	m.RUnlock()
+
+	if needTruncate {
+		m.Lock()
+		defer m.Unlock()
+		needTruncate = m.Len()+n > maxMemLogSize
+		if !needTruncate {
+			return
+		}
+
+		m.Truncate(truncateSize)
+	}
+}
+
+func (m *memLogger) notifyWS(pos, n int) {
+	if m.connChans.Size() > 0 {
+		timeout := time.NewTimer(1 * time.Second)
+		defer timeout.Stop()
+
+		m.notifyLock.RLock()
+		defer m.notifyLock.RUnlock()
+		m.connChans.Range(func(ch chan *logEntryRange, _ struct{}) bool {
+			select {
+			case ch <- &logEntryRange{pos, pos + n}:
+				return true
+			case <-timeout.C:
+				logging.Warn().Msg("mem logger: timeout logging to channel")
+				return false
+			}
+		})
+		return
+	}
+}
+
+func (m *memLogger) writeBuf(b []byte) (pos int, err error) {
+	m.Lock()
+	defer m.Unlock()
+	pos = m.Len()
+	_, err = m.Buffer.Write(b)
+	return
+}
+
+// Run implements zerolog.Hook.
+func (m *memLogger) Run(e *zerolog.Event, level zerolog.Level, message string) {
+	bufStruct := m.bufPool.Get().(*buffer)
+	buf := bufStruct.data
+	defer func() {
+		bufStruct.data = bufStruct.data[:0]
+		m.bufPool.Put(bufStruct)
+	}()
+
+	buf = logging.FormatLogEntryHTML(level, message, buf)
+	n := len(buf)
+
+	m.truncateIfNeeded(n)
+
+	pos, err := m.writeBuf(buf)
+	if err != nil {
+		// not logging the error here, it will cause Run to be called again = infinite loop
+		return
+	}
+
+	m.notifyWS(pos, n)
+}
+
+// Write implements io.Writer.
+func (m *memLogger) Write(p []byte) (n int, err error) {
+	n = len(p)
+	m.truncateIfNeeded(n)
+
+	pos, err := m.writeBuf(p)
+	if err != nil {
+		// not logging the error here, it will cause Run to be called again = infinite loop
+		return
+	}
+
+	m.notifyWS(pos, n)
+	return
+}
+
+func (m *memLogger) ServeHTTP(config config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
+	conn, err := utils.InitiateWS(config, w, r)
+	if err != nil {
+		utils.HandleErr(w, r, err)
+		return
+	}
+
+	logCh := make(chan *logEntryRange)
+	m.connChans.Store(logCh, struct{}{})
+
+	/* trunk-ignore(golangci-lint/errcheck) */
+	defer func() {
+		_ = conn.CloseNow()
+
+		m.notifyLock.Lock()
+		m.connChans.Delete(logCh)
+		close(logCh)
+		m.notifyLock.Unlock()
+	}()
+
+	if err := m.wsInitial(r.Context(), conn); err != nil {
+		utils.HandleErr(w, r, err)
+		return
+	}
+
+	m.wsStreamLog(r.Context(), conn, logCh)
+}
+
+func (m *memLogger) writeBytes(ctx context.Context, conn *websocket.Conn, b []byte) error {
+	return conn.Write(ctx, websocket.MessageText, b)
+}
+
+func (m *memLogger) wsInitial(ctx context.Context, conn *websocket.Conn) error {
+	m.Lock()
+	defer m.Unlock()
+
+	return m.writeBytes(ctx, conn, m.Buffer.Bytes())
+}
+
+func (m *memLogger) wsStreamLog(ctx context.Context, conn *websocket.Conn, ch <-chan *logEntryRange) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case logRange := <-ch:
+			m.RLock()
+			msg := m.Buffer.Bytes()[logRange.Start:logRange.End]
+			err := m.writeBytes(ctx, conn, msg)
+			m.RUnlock()
+			if err != nil {
+				return
+			}
+		}
+	}
+}

internal/api/v1/query/query.go

@@ -0,0 +1,64 @@
+package query
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	v1 "github.com/yusing/go-proxy/internal/api/v1"
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
+)
+
+func ReloadServer() E.Error {
+	resp, err := U.Post(common.APIHTTPURL+"/v1/reload", "", nil)
+	if err != nil {
+		return E.From(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		failure := E.Errorf("server reload status %v", resp.StatusCode)
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return failure.With(err)
+		}
+		reloadErr := string(body)
+		return failure.Withf(reloadErr)
+	}
+	return nil
+}
+
+func List[T any](what string) (_ T, outErr E.Error) {
+	resp, err := U.Get(fmt.Sprintf("%s/v1/list/%s", common.APIHTTPURL, what))
+	if err != nil {
+		outErr = E.From(err)
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		outErr = E.Errorf("list %s: failed, status %v", what, resp.StatusCode)
+		return
+	}
+	var res T
+	err = json.NewDecoder(resp.Body).Decode(&res)
+	if err != nil {
+		outErr = E.From(err)
+		return
+	}
+	return res, nil
+}
+
+func ListRoutes() (map[string]map[string]any, E.Error) {
+	return List[map[string]map[string]any](v1.ListRoutes)
+}
+
+func ListMiddlewareTraces() (middleware.Traces, E.Error) {
+	return List[middleware.Traces](v1.ListMiddlewareTraces)
+}
+
+func DebugListTasks() (map[string]any, E.Error) {
+	return List[map[string]any](v1.ListTasks)
+}

internal/api/v1/reload.go

@@ -0,0 +1,16 @@
+package v1
+
+import (
+	"net/http"
+
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	config "github.com/yusing/go-proxy/internal/config/types"
+)
+
+func Reload(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
+	if err := cfg.Reload(); err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	U.WriteBody(w, []byte("OK"))
+}

internal/api/v1/stats.go

@@ -0,0 +1,31 @@
+package v1
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/coder/websocket"
+	"github.com/coder/websocket/wsjson"
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+func Stats(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
+	U.RespondJSON(w, r, getStats(cfg))
+}
+
+func StatsWS(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
+	U.PeriodicWS(cfg, w, r, 1*time.Second, func(conn *websocket.Conn) error {
+		return wsjson.Write(r.Context(), conn, getStats(cfg))
+	})
+}
+
+var startTime = time.Now()
+
+func getStats(cfg config.ConfigInstance) map[string]any {
+	return map[string]any{
+		"proxies": cfg.Statistics(),
+		"uptime":  strutils.FormatDuration(time.Since(startTime)),
+	}
+}

internal/api/v1/utils/error.go

@@ -0,0 +1,55 @@
+package utils
+
+import (
+	"encoding/json"
+	"net/http"
+
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils/ansi"
+)
+
+// HandleErr logs the error and returns an error code to the client.
+// If code is specified, it will be used as the HTTP status code; otherwise,
+// http.StatusInternalServerError is used.
+//
+// The error is only logged but not returned to the client.
+func HandleErr(w http.ResponseWriter, r *http.Request, err error, code ...int) {
+	if err == nil {
+		return
+	}
+	LogError(r).Msg(err.Error())
+	if len(code) == 0 {
+		code = []int{http.StatusInternalServerError}
+	}
+	http.Error(w, http.StatusText(code[0]), code[0])
+}
+
+// RespondError returns error details to the client.
+// If code is specified, it will be used as the HTTP status code; otherwise,
+// http.StatusBadRequest is used.
+func RespondError(w http.ResponseWriter, err error, code ...int) {
+	if len(code) == 0 {
+		code = []int{http.StatusBadRequest}
+	}
+	buf, err := json.Marshal(err)
+	if err != nil { // just in case
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		http.Error(w, ansi.StripANSI(err.Error()), code[0])
+		return
+	}
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(code[0])
+	_, _ = w.Write(buf)
+}
+
+func ErrMissingKey(k string) error {
+	return E.New("missing key '" + k + "' in query or request body")
+}
+
+func ErrInvalidKey(k string) error {
+	return E.New("invalid key '" + k + "' in query or request body")
+}
+
+func ErrNotFound(k, v string) error {
+	return E.Errorf("key %q with value %q not found", k, v)
+}

internal/api/v1/utils/http_client.go

@@ -0,0 +1,28 @@
+package utils
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+
+	"github.com/yusing/go-proxy/internal/common"
+)
+
+var (
+	httpClient = &http.Client{
+		Timeout: common.ConnectionTimeout,
+		Transport: &http.Transport{
+			DisableKeepAlives: true,
+			ForceAttemptHTTP2: false,
+			DialContext: (&net.Dialer{
+				Timeout:   common.DialTimeout,
+				KeepAlive: common.KeepAlive, // this is different from DisableKeepAlives
+			}).DialContext,
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		},
+	}
+
+	Get  = httpClient.Get
+	Post = httpClient.Post
+	Head = httpClient.Head
+)

internal/api/v1/utils/logging.go

@@ -0,0 +1,21 @@
+package utils
+
+import (
+	"net/http"
+
+	"github.com/rs/zerolog"
+	"github.com/yusing/go-proxy/internal/logging"
+)
+
+func reqLogger(r *http.Request, level zerolog.Level) *zerolog.Event {
+	return logging.WithLevel(level).
+		Str("module", "api").
+		Str("remote", r.RemoteAddr).
+		Str("host", r.Host).
+		Str("uri", r.Method+" "+r.RequestURI)
+}
+
+func LogError(r *http.Request) *zerolog.Event { return reqLogger(r, zerolog.ErrorLevel) }
+func LogWarn(r *http.Request) *zerolog.Event  { return reqLogger(r, zerolog.WarnLevel) }
+func LogInfo(r *http.Request) *zerolog.Event  { return reqLogger(r, zerolog.InfoLevel) }
+func LogDebug(r *http.Request) *zerolog.Event { return reqLogger(r, zerolog.DebugLevel) }

internal/api/v1/utils/utils.go

@@ -0,0 +1,48 @@
+package utils
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/utils/strutils/ansi"
+)
+
+func WriteBody(w http.ResponseWriter, body []byte) {
+	if _, err := w.Write(body); err != nil {
+		logging.Err(err).Msg("failed to write body")
+	}
+}
+
+func RespondJSON(w http.ResponseWriter, r *http.Request, data any, code ...int) (canProceed bool) {
+	if len(code) > 0 {
+		w.WriteHeader(code[0])
+	}
+	w.Header().Set("Content-Type", "application/json")
+	var j []byte
+	var err error
+
+	switch data := data.(type) {
+	case string:
+		j = []byte(fmt.Sprintf("%q", data))
+	case []byte:
+		j = data
+	case error:
+		j, err = json.Marshal(ansi.StripANSI(data.Error()))
+	default:
+		j, err = json.MarshalIndent(data, "", "  ")
+	}
+
+	if err != nil {
+		logging.Panic().Err(err).Msg("failed to marshal json")
+		return false
+	}
+
+	_, err = w.Write(j)
+	if err != nil {
+		HandleErr(w, r, err)
+		return false
+	}
+	return true
+}

internal/api/v1/utils/ws.go

@@ -0,0 +1,68 @@
+package utils
+
+import (
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/coder/websocket"
+	"github.com/yusing/go-proxy/internal/common"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/logging"
+)
+
+func warnNoMatchDomains() {
+	logging.Warn().Msg("no match domains configured, accepting websocket API request from all origins")
+}
+
+var warnNoMatchDomainOnce sync.Once
+
+func InitiateWS(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) (*websocket.Conn, error) {
+	var originPats []string
+
+	localAddresses := []string{"127.0.0.1", "10.0.*.*", "172.16.*.*", "192.168.*.*"}
+
+	if len(cfg.Value().MatchDomains) == 0 {
+		warnNoMatchDomainOnce.Do(warnNoMatchDomains)
+		originPats = []string{"*"}
+	} else {
+		originPats = make([]string, len(cfg.Value().MatchDomains))
+		for i, domain := range cfg.Value().MatchDomains {
+			originPats[i] = "*" + domain
+		}
+		originPats = append(originPats, localAddresses...)
+	}
+	if common.IsDebug {
+		originPats = []string{"*"}
+	}
+	return websocket.Accept(w, r, &websocket.AcceptOptions{
+		OriginPatterns: originPats,
+	})
+}
+
+func PeriodicWS(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request, interval time.Duration, do func(conn *websocket.Conn) error) {
+	conn, err := InitiateWS(cfg, w, r)
+	if err != nil {
+		HandleErr(w, r, err)
+		return
+	}
+	/* trunk-ignore(golangci-lint/errcheck) */
+	defer conn.CloseNow()
+
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-cfg.Context().Done():
+			return
+		case <-r.Context().Done():
+			return
+		case <-ticker.C:
+			if err := do(conn); err != nil {
+				LogError(r).Msg(err.Error())
+				return
+			}
+		}
+	}
+}

internal/api/v1/version.go

@@ -0,0 +1,12 @@
+package v1
+
+import (
+	"net/http"
+
+	. "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/pkg"
+)
+
+func GetVersion(w http.ResponseWriter, r *http.Request) {
+	WriteBody(w, []byte(pkg.GetVersion()))
+}

internal/autocert/config.go

@@ -0,0 +1,147 @@
+package autocert
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"os"
+	"regexp"
+
+	"github.com/go-acme/lego/v4/certcrypto"
+	"github.com/go-acme/lego/v4/lego"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type (
+	AutocertConfig struct {
+		Email       string      `json:"email,omitempty"`
+		Domains     []string    `json:"domains,omitempty"`
+		CertPath    string      `json:"cert_path,omitempty"`
+		KeyPath     string      `json:"key_path,omitempty"`
+		ACMEKeyPath string      `json:"acme_key_path,omitempty"`
+		Provider    string      `json:"provider,omitempty"`
+		Options     ProviderOpt `json:"options,omitempty"`
+	}
+	ProviderOpt map[string]any
+)
+
+var (
+	ErrMissingDomain   = E.New("missing field 'domains'")
+	ErrMissingEmail    = E.New("missing field 'email'")
+	ErrMissingProvider = E.New("missing field 'provider'")
+	ErrInvalidDomain   = E.New("invalid domain")
+	ErrUnknownProvider = E.New("unknown provider")
+)
+
+var domainOrWildcardRE = regexp.MustCompile(`^\*?([^.]+\.)+[^.]+$`)
+
+// Validate implements the utils.CustomValidator interface.
+func (cfg *AutocertConfig) Validate() E.Error {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Provider == "" {
+		cfg.Provider = ProviderLocal
+		return nil
+	}
+
+	b := E.NewBuilder("autocert errors")
+	if cfg.Provider != ProviderLocal {
+		if len(cfg.Domains) == 0 {
+			b.Add(ErrMissingDomain)
+		}
+		if cfg.Email == "" {
+			b.Add(ErrMissingEmail)
+		}
+		for i, d := range cfg.Domains {
+			if !domainOrWildcardRE.MatchString(d) {
+				b.Add(ErrInvalidDomain.Subjectf("domains[%d]", i))
+			}
+		}
+		// check if provider is implemented
+		providerConstructor, ok := providersGenMap[cfg.Provider]
+		if !ok {
+			b.Add(ErrUnknownProvider.
+				Subject(cfg.Provider).
+				Withf(strutils.DoYouMean(utils.NearestField(cfg.Provider, providersGenMap))))
+		} else {
+			_, err := providerConstructor(cfg.Options)
+			if err != nil {
+				b.Add(err)
+			}
+		}
+	}
+	return b.Error()
+}
+
+func (cfg *AutocertConfig) GetProvider() (*Provider, E.Error) {
+	if cfg == nil {
+		cfg = new(AutocertConfig)
+	}
+
+	if err := cfg.Validate(); err != nil {
+		return nil, err
+	}
+
+	if cfg.CertPath == "" {
+		cfg.CertPath = CertFileDefault
+	}
+	if cfg.KeyPath == "" {
+		cfg.KeyPath = KeyFileDefault
+	}
+	if cfg.ACMEKeyPath == "" {
+		cfg.ACMEKeyPath = ACMEKeyFileDefault
+	}
+
+	var privKey *ecdsa.PrivateKey
+	var err error
+
+	if cfg.Provider != ProviderLocal {
+		if privKey, err = cfg.loadACMEKey(); err != nil {
+			logging.Info().Err(err).Msg("load ACME private key failed")
+			logging.Info().Msg("generate new ACME private key")
+			privKey, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+			if err != nil {
+				return nil, E.New("generate ACME private key").With(err)
+			}
+			if err = cfg.saveACMEKey(privKey); err != nil {
+				return nil, E.New("save ACME private key").With(err)
+			}
+		}
+	}
+
+	user := &User{
+		Email: cfg.Email,
+		key:   privKey,
+	}
+
+	legoCfg := lego.NewConfig(user)
+	legoCfg.Certificate.KeyType = certcrypto.RSA2048
+
+	return &Provider{
+		cfg:     cfg,
+		user:    user,
+		legoCfg: legoCfg,
+	}, nil
+}
+
+func (cfg *AutocertConfig) loadACMEKey() (*ecdsa.PrivateKey, error) {
+	data, err := os.ReadFile(cfg.ACMEKeyPath)
+	if err != nil {
+		return nil, err
+	}
+	return x509.ParseECPrivateKey(data)
+}
+
+func (cfg *AutocertConfig) saveACMEKey(key *ecdsa.PrivateKey) error {
+	data, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(cfg.ACMEKeyPath, data, 0o600)
+}

internal/autocert/constants.go

@@ -1,20 +1,18 @@
 package autocert
 
 import (
-	"errors"
-
 	"github.com/go-acme/lego/v4/providers/dns/clouddns"
 	"github.com/go-acme/lego/v4/providers/dns/cloudflare"
 	"github.com/go-acme/lego/v4/providers/dns/duckdns"
 	"github.com/go-acme/lego/v4/providers/dns/ovh"
-	"github.com/sirupsen/logrus"
+	"github.com/go-acme/lego/v4/providers/dns/porkbun"
 )
 
 const (
-	certBasePath     = "certs/"
-	CertFileDefault  = certBasePath + "cert.crt"
-	KeyFileDefault   = certBasePath + "priv.key"
-	RegistrationFile = certBasePath + "registration.json"
+	certBasePath       = "certs/"
+	CertFileDefault    = certBasePath + "cert.crt"
+	KeyFileDefault     = certBasePath + "priv.key"
+	ACMEKeyFileDefault = certBasePath + "acme.key"
 )
 
 const (
@@ -23,6 +21,7 @@ const (
 	ProviderClouddns   = "clouddns"
 	ProviderDuckdns    = "duckdns"
 	ProviderOVH        = "ovh"
+	ProviderPorkbun    = "porkbun"
 )
 
 var providersGenMap = map[string]ProviderGenerator{
@@ -31,10 +30,5 @@ var providersGenMap = map[string]ProviderGenerator{
 	ProviderClouddns:   providerGenerator(clouddns.NewDefaultConfig, clouddns.NewDNSProviderConfig),
 	ProviderDuckdns:    providerGenerator(duckdns.NewDefaultConfig, duckdns.NewDNSProviderConfig),
 	ProviderOVH:        providerGenerator(ovh.NewDefaultConfig, ovh.NewDNSProviderConfig),
+	ProviderPorkbun:    providerGenerator(porkbun.NewDefaultConfig, porkbun.NewDNSProviderConfig),
 }
-
-var (
-	ErrGetCertFailure = errors.New("get certificate failed")
-)
-
-var logger = logrus.WithField("module", "autocert")

internal/autocert/provider.go

@@ -0,0 +1,324 @@
+package autocert
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"os"
+	"path"
+	"reflect"
+	"sort"
+	"time"
+
+	"github.com/go-acme/lego/v4/certificate"
+	"github.com/go-acme/lego/v4/challenge"
+	"github.com/go-acme/lego/v4/lego"
+	"github.com/go-acme/lego/v4/registration"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/task"
+	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type (
+	Provider struct {
+		cfg     *AutocertConfig
+		user    *User
+		legoCfg *lego.Config
+		client  *lego.Client
+
+		legoCert     *certificate.Resource
+		tlsCert      *tls.Certificate
+		certExpiries CertExpiries
+	}
+	ProviderGenerator func(ProviderOpt) (challenge.Provider, E.Error)
+
+	CertExpiries map[string]time.Time
+)
+
+var ErrGetCertFailure = errors.New("get certificate failed")
+
+func (p *Provider) GetCert(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	if p.tlsCert == nil {
+		return nil, ErrGetCertFailure
+	}
+	return p.tlsCert, nil
+}
+
+func (p *Provider) GetName() string {
+	return p.cfg.Provider
+}
+
+func (p *Provider) GetCertPath() string {
+	return p.cfg.CertPath
+}
+
+func (p *Provider) GetKeyPath() string {
+	return p.cfg.KeyPath
+}
+
+func (p *Provider) GetExpiries() CertExpiries {
+	return p.certExpiries
+}
+
+func (p *Provider) ObtainCert() E.Error {
+	if p.cfg.Provider == ProviderLocal {
+		return nil
+	}
+
+	if p.client == nil {
+		if err := p.initClient(); err != nil {
+			return err
+		}
+	}
+
+	if p.user.Registration == nil {
+		if err := p.registerACME(); err != nil {
+			return E.From(err)
+		}
+	}
+
+	var cert *certificate.Resource
+	var err error
+
+	if p.legoCert != nil {
+		cert, err = p.client.Certificate.RenewWithOptions(*p.legoCert, &certificate.RenewOptions{
+			Bundle: true,
+		})
+		if err != nil {
+			p.legoCert = nil
+			logging.Err(err).Msg("cert renew failed, fallback to obtain")
+		} else {
+			p.legoCert = cert
+		}
+	}
+
+	if cert == nil {
+		cert, err = p.client.Certificate.Obtain(certificate.ObtainRequest{
+			Domains: p.cfg.Domains,
+			Bundle:  true,
+		})
+		if err != nil {
+			return E.From(err)
+		}
+	}
+
+	if err = p.saveCert(cert); err != nil {
+		return E.From(err)
+	}
+
+	tlsCert, err := tls.X509KeyPair(cert.Certificate, cert.PrivateKey)
+	if err != nil {
+		return E.From(err)
+	}
+
+	expiries, err := getCertExpiries(&tlsCert)
+	if err != nil {
+		return E.From(err)
+	}
+	p.tlsCert = &tlsCert
+	p.certExpiries = expiries
+
+	return nil
+}
+
+func (p *Provider) LoadCert() E.Error {
+	cert, err := tls.LoadX509KeyPair(p.cfg.CertPath, p.cfg.KeyPath)
+	if err != nil {
+		return E.Errorf("load SSL certificate: %w", err)
+	}
+	expiries, err := getCertExpiries(&cert)
+	if err != nil {
+		return E.Errorf("parse SSL certificate: %w", err)
+	}
+	p.tlsCert = &cert
+	p.certExpiries = expiries
+
+	logging.Info().Msgf("next renewal in %v", strutils.FormatDuration(time.Until(p.ShouldRenewOn())))
+	return p.renewIfNeeded()
+}
+
+// ShouldRenewOn returns the time at which the certificate should be renewed.
+func (p *Provider) ShouldRenewOn() time.Time {
+	for _, expiry := range p.certExpiries {
+		return expiry.AddDate(0, -1, 0) // 1 month before
+	}
+	// this line should never be reached
+	panic("no certificate available")
+}
+
+func (p *Provider) ScheduleRenewal(parent task.Parent) {
+	if p.GetName() == ProviderLocal {
+		return
+	}
+	go func() {
+		lastErrOn := time.Time{}
+		renewalTime := p.ShouldRenewOn()
+		timer := time.NewTimer(time.Until(renewalTime))
+		defer timer.Stop()
+
+		task := parent.Subtask("cert-renew-scheduler")
+		defer task.Finish(nil)
+
+		for {
+			select {
+			case <-task.Context().Done():
+				return
+			case <-timer.C:
+				// Retry after 1 hour on failure
+				if !lastErrOn.IsZero() && time.Now().Before(lastErrOn.Add(time.Hour)) {
+					continue
+				}
+				if err := p.renewIfNeeded(); err != nil {
+					E.LogWarn("cert renew failed", err)
+					lastErrOn = time.Now()
+					continue
+				}
+				// Reset on success
+				lastErrOn = time.Time{}
+				renewalTime = p.ShouldRenewOn()
+				timer.Reset(time.Until(renewalTime))
+			}
+		}
+	}()
+}
+
+func (p *Provider) initClient() E.Error {
+	legoClient, err := lego.NewClient(p.legoCfg)
+	if err != nil {
+		return E.From(err)
+	}
+
+	generator := providersGenMap[p.cfg.Provider]
+	legoProvider, pErr := generator(p.cfg.Options)
+	if pErr != nil {
+		return pErr
+	}
+
+	err = legoClient.Challenge.SetDNS01Provider(legoProvider)
+	if err != nil {
+		return E.From(err)
+	}
+
+	p.client = legoClient
+	return nil
+}
+
+func (p *Provider) registerACME() error {
+	if p.user.Registration != nil {
+		return nil
+	}
+	if reg, err := p.client.Registration.ResolveAccountByKey(); err == nil {
+		p.user.Registration = reg
+		logging.Info().Msg("reused acme registration from private key")
+		return nil
+	}
+
+	reg, err := p.client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
+	if err != nil {
+		return err
+	}
+	p.user.Registration = reg
+	logging.Info().Interface("reg", reg).Msg("acme registered")
+	return nil
+}
+
+func (p *Provider) saveCert(cert *certificate.Resource) error {
+	/* This should have been done in setup
+	but double check is always a good choice.*/
+	_, err := os.Stat(path.Dir(p.cfg.CertPath))
+	if err != nil {
+		if os.IsNotExist(err) {
+			if err = os.MkdirAll(path.Dir(p.cfg.CertPath), 0o755); err != nil {
+				return err
+			}
+		} else {
+			return err
+		}
+	}
+	err = os.WriteFile(p.cfg.KeyPath, cert.PrivateKey, 0o600) // -rw-------
+	if err != nil {
+		return err
+	}
+
+	err = os.WriteFile(p.cfg.CertPath, cert.Certificate, 0o644) // -rw-r--r--
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func (p *Provider) certState() CertState {
+	if time.Now().After(p.ShouldRenewOn()) {
+		return CertStateExpired
+	}
+
+	certDomains := make([]string, len(p.certExpiries))
+	wantedDomains := make([]string, len(p.cfg.Domains))
+	i := 0
+	for domain := range p.certExpiries {
+		certDomains[i] = domain
+		i++
+	}
+	copy(wantedDomains, p.cfg.Domains)
+	sort.Strings(wantedDomains)
+	sort.Strings(certDomains)
+
+	if !reflect.DeepEqual(certDomains, wantedDomains) {
+		logging.Info().Msgf("cert domains mismatch: %v != %v", certDomains, p.cfg.Domains)
+		return CertStateMismatch
+	}
+
+	return CertStateValid
+}
+
+func (p *Provider) renewIfNeeded() E.Error {
+	if p.cfg.Provider == ProviderLocal {
+		return nil
+	}
+
+	switch p.certState() {
+	case CertStateExpired:
+		logging.Info().Msg("certs expired, renewing")
+	case CertStateMismatch:
+		logging.Info().Msg("cert domains mismatch with config, renewing")
+	default:
+		return nil
+	}
+
+	return p.ObtainCert()
+}
+
+func getCertExpiries(cert *tls.Certificate) (CertExpiries, error) {
+	r := make(CertExpiries, len(cert.Certificate))
+	for _, cert := range cert.Certificate {
+		x509Cert, err := x509.ParseCertificate(cert)
+		if err != nil {
+			return nil, err
+		}
+		if x509Cert.IsCA {
+			continue
+		}
+		r[x509Cert.Subject.CommonName] = x509Cert.NotAfter
+		for i := range x509Cert.DNSNames {
+			r[x509Cert.DNSNames[i]] = x509Cert.NotAfter
+		}
+	}
+	return r, nil
+}
+
+func providerGenerator[CT any, PT challenge.Provider](
+	defaultCfg func() *CT,
+	newProvider func(*CT) (PT, error),
+) ProviderGenerator {
+	return func(opt ProviderOpt) (challenge.Provider, E.Error) {
+		cfg := defaultCfg()
+		err := U.Deserialize(opt, &cfg)
+		if err != nil {
+			return nil, err
+		}
+		p, pErr := newProvider(cfg)
+		return p, E.From(pErr)
+	}
+}

internal/autocert/provider_test/ovh_test.go

@@ -4,8 +4,8 @@ import (
 	"testing"
 
 	"github.com/go-acme/lego/v4/providers/dns/ovh"
-	U "github.com/yusing/go-proxy/utils"
-	. "github.com/yusing/go-proxy/utils/testing"
+	U "github.com/yusing/go-proxy/internal/utils"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
 	"gopkg.in/yaml.v3"
 )
 
@@ -45,6 +45,6 @@ oauth2_config:
 	testYaml = testYaml[1:] // remove first \n
 	opt := make(map[string]any)
 	ExpectNoError(t, yaml.Unmarshal([]byte(testYaml), opt))
-	ExpectTrue(t, U.Deserialize(opt, cfg).NoError())
+	ExpectNoError(t, U.Deserialize(opt, cfg))
 	ExpectDeepEqual(t, cfg, cfgExpected)
 }

internal/autocert/setup.go

@@ -0,0 +1,28 @@
+package autocert
+
+import (
+	"os"
+
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+func (p *Provider) Setup() (err E.Error) {
+	if err = p.LoadCert(); err != nil {
+		if !err.Is(os.ErrNotExist) { // ignore if cert doesn't exist
+			return err
+		}
+		logging.Debug().Msg("obtaining cert due to error loading cert")
+		if err = p.ObtainCert(); err != nil {
+			return err
+		}
+	}
+
+	for _, expiry := range p.GetExpiries() {
+		logging.Info().Msg("certificate expire on " + strutils.FormatTime(expiry))
+		break
+	}
+
+	return nil
+}

internal/autocert/state.go

@@ -0,0 +1,9 @@
+package autocert
+
+type CertState int
+
+const (
+	CertStateValid CertState = iota
+	CertStateExpired
+	CertStateMismatch
+)

internal/autocert/user.go

@@ -1,8 +1,9 @@
 package autocert
 
 import (
-	"github.com/go-acme/lego/v4/registration"
 	"crypto"
+
+	"github.com/go-acme/lego/v4/registration"
 )
 
 type User struct {
@@ -14,9 +15,11 @@ type User struct {
 func (u *User) GetEmail() string {
 	return u.Email
 }
+
 func (u *User) GetRegistration() *registration.Resource {
 	return u.Registration
 }
+
 func (u *User) GetPrivateKey() crypto.PrivateKey {
 	return u.key
-}
+}

internal/common/args.go

@@ -2,9 +2,8 @@ package common
 
 import (
 	"flag"
-
-	"github.com/sirupsen/logrus"
-	E "github.com/yusing/go-proxy/error"
+	"fmt"
+	"log"
 )
 
 type Args struct {
@@ -13,39 +12,45 @@ type Args struct {
 
 const (
 	CommandStart              = ""
+	CommandSetup              = "setup"
 	CommandValidate           = "validate"
 	CommandListConfigs        = "ls-config"
 	CommandListRoutes         = "ls-routes"
+	CommandListIcons          = "ls-icons"
 	CommandReload             = "reload"
 	CommandDebugListEntries   = "debug-ls-entries"
 	CommandDebugListProviders = "debug-ls-providers"
+	CommandDebugListMTrace    = "debug-ls-mtrace"
 )
 
 var ValidCommands = []string{
 	CommandStart,
+	CommandSetup,
 	CommandValidate,
 	CommandListConfigs,
 	CommandListRoutes,
+	CommandListIcons,
 	CommandReload,
 	CommandDebugListEntries,
 	CommandDebugListProviders,
+	CommandDebugListMTrace,
 }
 
 func GetArgs() Args {
 	var args Args
 	flag.Parse()
 	args.Command = flag.Arg(0)
-	if err := validateArg(args.Command); err.HasError() {
-		logrus.Fatal(err)
+	if err := validateArg(args.Command); err != nil {
+		log.Fatalf("invalid command: %s", err)
 	}
 	return args
 }
 
-func validateArg(arg string) E.NestedError {
+func validateArg(arg string) error {
 	for _, v := range ValidCommands {
 		if arg == v {
 			return nil
 		}
 	}
-	return E.Invalid("argument", arg)
+	return fmt.Errorf("invalid command %q", arg)
 }

internal/common/constants.go

@@ -0,0 +1,52 @@
+package common
+
+import (
+	"time"
+)
+
+const (
+	ConnectionTimeout = 5 * time.Second
+	DialTimeout       = 3 * time.Second
+	KeepAlive         = 60 * time.Second
+)
+
+// file, folder structure
+
+const (
+	DotEnvPath        = ".env"
+	DotEnvExamplePath = ".env.example"
+
+	ConfigBasePath         = "config"
+	ConfigFileName         = "config.yml"
+	ConfigExampleFileName  = "config.example.yml"
+	ConfigPath             = ConfigBasePath + "/" + ConfigFileName
+	HomepageJSONConfigPath = ConfigBasePath + "/.homepage.json"
+	IconListCachePath      = ConfigBasePath + "/.icon_list_cache.json"
+	IconCachePath          = ConfigBasePath + "/.icon_cache.json"
+
+	MiddlewareComposeBasePath = ConfigBasePath + "/middlewares"
+
+	ComposeFileName        = "compose.yml"
+	ComposeExampleFileName = "compose.example.yml"
+
+	ErrorPagesBasePath = "error_pages"
+)
+
+var RequiredDirectories = []string{
+	ConfigBasePath,
+	ErrorPagesBasePath,
+	MiddlewareComposeBasePath,
+}
+
+const DockerHostFromEnv = "$DOCKER_HOST"
+
+const (
+	HealthCheckIntervalDefault = 5 * time.Second
+	HealthCheckTimeoutDefault  = 5 * time.Second
+
+	WakeTimeoutDefault = "30s"
+	StopTimeoutDefault = "30s"
+	StopMethodDefault  = "stop"
+)
+
+const HeaderCheckRedirect = "X-Goproxy-Check-Redirect"

internal/common/crypto.go

@@ -0,0 +1,18 @@
+package common
+
+import (
+	"encoding/base64"
+
+	"github.com/rs/zerolog/log"
+)
+
+func decodeJWTKey(key string) []byte {
+	if key == "" {
+		return nil
+	}
+	bytes, err := base64.StdEncoding.DecodeString(key)
+	if err != nil {
+		log.Panic().Err(err).Msg("failed to decode jwt key")
+	}
+	return bytes
+}

internal/common/env.go

@@ -0,0 +1,111 @@
+package common
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+var (
+	prefixes = []string{"GODOXY_", "GOPROXY_", ""}
+
+	IsTest       = GetEnvBool("TEST", false) || strings.HasSuffix(os.Args[0], ".test")
+	IsDebug      = GetEnvBool("DEBUG", IsTest)
+	IsTrace      = GetEnvBool("TRACE", false) && IsDebug
+	IsProduction = !IsTest && !IsDebug
+
+	EnableLogStreaming = GetEnvBool("LOG_STREAMING", true)
+	DebugMemLogger     = GetEnvBool("DEBUG_MEM_LOGGER", false) && EnableLogStreaming
+
+	ProxyHTTPAddr,
+	ProxyHTTPHost,
+	ProxyHTTPPort,
+	ProxyHTTPURL = GetAddrEnv("HTTP_ADDR", ":80", "http")
+
+	ProxyHTTPSAddr,
+	ProxyHTTPSHost,
+	ProxyHTTPSPort,
+	ProxyHTTPSURL = GetAddrEnv("HTTPS_ADDR", ":443", "https")
+
+	APIHTTPAddr,
+	APIHTTPHost,
+	APIHTTPPort,
+	APIHTTPURL = GetAddrEnv("API_ADDR", "127.0.0.1:8888", "http")
+
+	PrometheusEnabled = GetEnvBool("PROMETHEUS_ENABLED", false)
+
+	APIJWTSecret   = decodeJWTKey(GetEnvString("API_JWT_SECRET", ""))
+	APIJWTTokenTTL = GetDurationEnv("API_JWT_TOKEN_TTL", time.Hour)
+	APIUser        = GetEnvString("API_USER", "admin")
+	APIPassword    = GetEnvString("API_PASSWORD", "password")
+
+	// OIDC Configuration.
+	OIDCIssuerURL     = GetEnvString("OIDC_ISSUER_URL", "")
+	OIDCLogoutURL     = GetEnvString("OIDC_LOGOUT_URL", "")
+	OIDCClientID      = GetEnvString("OIDC_CLIENT_ID", "")
+	OIDCClientSecret  = GetEnvString("OIDC_CLIENT_SECRET", "")
+	OIDCRedirectURL   = GetEnvString("OIDC_REDIRECT_URL", "")
+	OIDCScopes        = GetEnvString("OIDC_SCOPES", "openid, profile, email")
+	OIDCAllowedUsers  = GetCommaSepEnv("OIDC_ALLOWED_USERS", "")
+	OIDCAllowedGroups = GetCommaSepEnv("OIDC_ALLOWED_GROUPS", "")
+)
+
+func GetEnv[T any](key string, defaultValue T, parser func(string) (T, error)) T {
+	var value string
+	var ok bool
+	for _, prefix := range prefixes {
+		value, ok = os.LookupEnv(prefix + key)
+		if ok && value != "" {
+			break
+		}
+	}
+	if !ok || value == "" {
+		return defaultValue
+	}
+	parsed, err := parser(value)
+	if err == nil {
+		return parsed
+	}
+	log.Fatal().Err(err).Msgf("env %s: invalid %T value: %s", key, parsed, value)
+	return defaultValue
+}
+
+func GetEnvString(key string, defaultValue string) string {
+	return GetEnv(key, defaultValue, func(s string) (string, error) {
+		return s, nil
+	})
+}
+
+func GetEnvBool(key string, defaultValue bool) bool {
+	return GetEnv(key, defaultValue, strconv.ParseBool)
+}
+
+func GetAddrEnv(key, defaultValue, scheme string) (addr, host, port, fullURL string) {
+	addr = GetEnvString(key, defaultValue)
+	if addr == "" {
+		return
+	}
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		log.Fatal().Msgf("env %s: invalid address: %s", key, addr)
+	}
+	if host == "" {
+		host = "localhost"
+	}
+	fullURL = fmt.Sprintf("%s://%s:%s", scheme, host, port)
+	return
+}
+
+func GetDurationEnv(key string, defaultValue time.Duration) time.Duration {
+	return GetEnv(key, defaultValue, time.ParseDuration)
+}
+
+func GetCommaSepEnv(key string, defaultValue string) []string {
+	return strutils.CommaSeperatedList(GetEnvString(key, defaultValue))
+}

internal/common/ports.go

@@ -0,0 +1,75 @@
+package common
+
+var (
+	WellKnownHTTPPorts = map[string]bool{
+		"80":   true,
+		"8000": true,
+		"8008": true,
+		"8080": true,
+		"3000": true,
+	}
+
+	ServiceNamePortMapTCP = map[string]int{
+		"mssql":            1433,
+		"mysql":            3306,
+		"mariadb":          3306,
+		"postgres":         5432,
+		"rabbitmq":         5672,
+		"redis":            6379,
+		"memcached":        11211,
+		"mongo":            27017,
+		"minecraft-server": 25565,
+
+		"ssh":  22,
+		"ftp":  21,
+		"smtp": 25,
+		"dns":  53,
+		"pop3": 110,
+		"imap": 143,
+	}
+
+	ImageNamePortMap = func() (m map[string]int) {
+		m = make(map[string]int, len(ServiceNamePortMapTCP)+len(imageNamePortMap))
+		for k, v := range ServiceNamePortMapTCP {
+			m[k] = v
+		}
+		for k, v := range imageNamePortMap {
+			m[k] = v
+		}
+		return
+	}()
+
+	imageNamePortMap = map[string]int{
+		"adguardhome":         3000,
+		"bazarr":              6767,
+		"calibre-web":         8083,
+		"changedetection.io":  3000,
+		"dockge":              5001,
+		"gitea":               3000,
+		"gogs":                3000,
+		"grafana":             3000,
+		"home-assistant":      8123,
+		"homebridge":          8581,
+		"httpd":               80,
+		"immich":              3001,
+		"jellyfin":            8096,
+		"lidarr":              8686,
+		"microbin":            8080,
+		"nginx":               80,
+		"nginx-proxy-manager": 81,
+		"open-webui":          8080,
+		"plex":                32400,
+		"portainer-be":        9443,
+		"portainer-ce":        9443,
+		"prometheus":          9090,
+		"prowlarr":            9696,
+		"radarr":              7878,
+		"radarr-sma":          7878,
+		"rsshub":              1200,
+		"rss-bridge":          80,
+		"sonarr":              8989,
+		"sonarr-sma":          8989,
+		"uptime-kuma":         3001,
+		"whisparr":            6969,
+	}
+)

internal/config/config.go

@@ -0,0 +1,298 @@
+package config
+
+import (
+	"context"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/api"
+	"github.com/yusing/go-proxy/internal/autocert"
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/entrypoint"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/net/http/server"
+	"github.com/yusing/go-proxy/internal/notif"
+	proxy "github.com/yusing/go-proxy/internal/route/provider"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/utils"
+	F "github.com/yusing/go-proxy/internal/utils/functional"
+	"github.com/yusing/go-proxy/internal/watcher"
+	"github.com/yusing/go-proxy/internal/watcher/events"
+)
+
+type Config struct {
+	value            *types.Config
+	providers        F.Map[string, *proxy.Provider]
+	autocertProvider *autocert.Provider
+	entrypoint       *entrypoint.Entrypoint
+
+	task *task.Task
+}
+
+var (
+	instance   *Config
+	cfgWatcher watcher.Watcher
+	reloadMu   sync.Mutex
+)
+
+const configEventFlushInterval = 500 * time.Millisecond
+
+const (
+	cfgRenameWarn = `Config file renamed, not reloading.
+Make sure you rename it back before next time you start.`
+	cfgDeleteWarn = `Config file deleted, not reloading.
+You may run "ls-config" to show or dump the current config.`
+)
+
+var Validate = types.Validate
+
+func GetInstance() *Config {
+	return instance
+}
+
+func newConfig() *Config {
+	return &Config{
+		value:      types.DefaultConfig(),
+		providers:  F.NewMapOf[string, *proxy.Provider](),
+		entrypoint: entrypoint.NewEntrypoint(),
+		task:       task.RootTask("config", false),
+	}
+}
+
+func Load() (*Config, E.Error) {
+	if instance != nil {
+		return instance, nil
+	}
+	instance = newConfig()
+	cfgWatcher = watcher.NewConfigFileWatcher(common.ConfigFileName)
+	return instance, instance.load()
+}
+
+func MatchDomains() []string {
+	return instance.value.MatchDomains
+}
+
+func WatchChanges() {
+	t := task.RootTask("config_watcher", true)
+	eventQueue := events.NewEventQueue(
+		t,
+		configEventFlushInterval,
+		OnConfigChange,
+		func(err E.Error) {
+			E.LogError("config reload error", err)
+		},
+	)
+	eventQueue.Start(cfgWatcher.Events(t.Context()))
+}
+
+func OnConfigChange(ev []events.Event) {
+	// no matter how many events during the interval
+	// just reload once and check the last event
+	switch ev[len(ev)-1].Action {
+	case events.ActionFileRenamed:
+		logging.Warn().Msg(cfgRenameWarn)
+		return
+	case events.ActionFileDeleted:
+		logging.Warn().Msg(cfgDeleteWarn)
+		return
+	}
+
+	if err := Reload(); err != nil {
+		// recovered in event queue
+		panic(err)
+	}
+}
+
+func Reload() E.Error {
+	// avoid race between config change and API reload request
+	reloadMu.Lock()
+	defer reloadMu.Unlock()
+
+	newCfg := newConfig()
+	err := newCfg.load()
+	if err != nil {
+		newCfg.task.Finish(err)
+		return E.New("using last config").With(err)
+	}
+
+	// cancel all current subtasks -> wait
+	// -> replace config -> start new subtasks
+	instance.task.Finish("config changed")
+	instance = newCfg
+	instance.Start(StartAllServers)
+	return nil
+}
+
+func (cfg *Config) Value() *types.Config {
+	return instance.value
+}
+
+func (cfg *Config) Reload() E.Error {
+	return Reload()
+}
+
+func (cfg *Config) AutoCertProvider() *autocert.Provider {
+	return instance.autocertProvider
+}
+
+func (cfg *Config) Task() *task.Task {
+	return cfg.task
+}
+
+func (cfg *Config) Context() context.Context {
+	return cfg.task.Context()
+}
+
+func (cfg *Config) Start(opts ...*StartServersOptions) {
+	cfg.StartAutoCert()
+	cfg.StartProxyProviders()
+	cfg.StartServers(opts...)
+}
+
+func (cfg *Config) StartAutoCert() {
+	autocert := cfg.autocertProvider
+	if autocert == nil {
+		logging.Info().Msg("autocert not configured")
+		return
+	}
+
+	if err := autocert.Setup(); err != nil {
+		E.LogFatal("autocert setup error", err)
+	} else {
+		autocert.ScheduleRenewal(cfg.task)
+	}
+}
+
+func (cfg *Config) StartProxyProviders() {
+	errs := cfg.providers.CollectErrorsParallel(
+		func(_ string, p *proxy.Provider) error {
+			return p.Start(cfg.task)
+		})
+
+	if err := E.Join(errs...); err != nil {
+		E.LogError("route provider errors", err)
+	}
+}
+
+type StartServersOptions struct {
+	Proxy, API bool
+}
+
+var StartAllServers = &StartServersOptions{true, true}
+
+func (cfg *Config) StartServers(opts ...*StartServersOptions) {
+	if len(opts) == 0 {
+		opts = append(opts, &StartServersOptions{})
+	}
+	opt := opts[0]
+	if opt.Proxy {
+		server.StartServer(cfg.task, server.Options{
+			Name:         "proxy",
+			CertProvider: cfg.AutoCertProvider(),
+			HTTPAddr:     common.ProxyHTTPAddr,
+			HTTPSAddr:    common.ProxyHTTPSAddr,
+			Handler:      cfg.entrypoint,
+		})
+	}
+	if opt.API {
+		server.StartServer(cfg.task, server.Options{
+			Name:         "api",
+			CertProvider: cfg.AutoCertProvider(),
+			HTTPAddr:     common.APIHTTPAddr,
+			Handler:      api.NewHandler(cfg),
+		})
+	}
+}
+
+func (cfg *Config) load() E.Error {
+	const errMsg = "config load error"
+
+	data, err := os.ReadFile(common.ConfigPath)
+	if err != nil {
+		E.LogFatal(errMsg, err)
+	}
+
+	model := types.DefaultConfig()
+	if err := utils.DeserializeYAML(data, model); err != nil {
+		E.LogFatal(errMsg, err)
+	}
+
+	// errors are non fatal below
+	errs := E.NewBuilder(errMsg)
+	errs.Add(cfg.entrypoint.SetMiddlewares(model.Entrypoint.Middlewares))
+	errs.Add(cfg.entrypoint.SetAccessLogger(cfg.task, model.Entrypoint.AccessLog))
+	cfg.initNotification(model.Providers.Notification)
+	errs.Add(cfg.initAutoCert(model.AutoCert))
+	errs.Add(cfg.loadRouteProviders(&model.Providers))
+
+	cfg.value = model
+	for i, domain := range model.MatchDomains {
+		if !strings.HasPrefix(domain, ".") {
+			model.MatchDomains[i] = "." + domain
+		}
+	}
+	cfg.entrypoint.SetFindRouteDomains(model.MatchDomains)
+
+	return errs.Error()
+}
+
+func (cfg *Config) initNotification(notifCfg []notif.NotificationConfig) {
+	if len(notifCfg) == 0 {
+		return
+	}
+	dispatcher := notif.StartNotifDispatcher(cfg.task)
+	for _, notifier := range notifCfg {
+		dispatcher.RegisterProvider(&notifier)
+	}
+}
+
+func (cfg *Config) initAutoCert(autocertCfg *autocert.AutocertConfig) (err E.Error) {
+	if cfg.autocertProvider != nil {
+		return
+	}
+
+	cfg.autocertProvider, err = autocertCfg.GetProvider()
+	return
+}
+
+func (cfg *Config) loadRouteProviders(providers *types.Providers) E.Error {
+	errs := E.NewBuilder("route provider errors")
+	results := E.NewBuilder("loaded route providers")
+
+	lenLongestName := 0
+	for _, filename := range providers.Files {
+		p, err := proxy.NewFileProvider(filename)
+		if err != nil {
+			errs.Add(E.PrependSubject(filename, err))
+			continue
+		}
+		cfg.providers.Store(p.String(), p)
+		if len(p.String()) > lenLongestName {
+			lenLongestName = len(p.String())
+		}
+	}
+	for name, dockerHost := range providers.Docker {
+		p, err := proxy.NewDockerProvider(name, dockerHost)
+		if err != nil {
+			errs.Add(E.PrependSubject(name, err))
+			continue
+		}
+		cfg.providers.Store(p.String(), p)
+		if len(p.String()) > lenLongestName {
+			lenLongestName = len(p.String())
+		}
+	}
+	cfg.providers.RangeAllParallel(func(_ string, p *proxy.Provider) {
+		if err := p.LoadRoutes(); err != nil {
+			errs.Add(err.Subject(p.String()))
+		}
+		results.Addf("%-"+strconv.Itoa(lenLongestName)+"s %d routes", p.String(), p.NumRoutes())
+	})
+	logging.Info().Msg(results.String())
+	return errs.Error()
+}

internal/config/query.go

@@ -0,0 +1,53 @@
+package config
+
+import (
+	"github.com/yusing/go-proxy/internal/route"
+	"github.com/yusing/go-proxy/internal/route/provider"
+)
+
+func (cfg *Config) DumpRoutes() map[string]*route.Route {
+	entries := make(map[string]*route.Route)
+	cfg.providers.RangeAll(func(_ string, p *provider.Provider) {
+		p.RangeRoutes(func(alias string, r *route.Route) {
+			entries[alias] = r
+		})
+	})
+	return entries
+}
+
+func (cfg *Config) DumpRouteProviders() map[string]*provider.Provider {
+	entries := make(map[string]*provider.Provider)
+	cfg.providers.RangeAll(func(_ string, p *provider.Provider) {
+		entries[p.ShortName()] = p
+	})
+	return entries
+}
+
+func (cfg *Config) RouteProviderList() []string {
+	var list []string
+	cfg.providers.RangeAll(func(_ string, p *provider.Provider) {
+		list = append(list, p.ShortName())
+	})
+	return list
+}
+
+func (cfg *Config) Statistics() map[string]any {
+	var rps, streams provider.RouteStats
+	var total uint16
+	providerStats := make(map[string]provider.ProviderStats)
+
+	cfg.providers.RangeAll(func(_ string, p *provider.Provider) {
+		stats := p.Statistics()
+		providerStats[p.ShortName()] = stats
+		rps.AddOther(stats.RPs)
+		streams.AddOther(stats.Streams)
+		total += stats.RPs.Total + stats.Streams.Total
+	})
+
+	return map[string]any{
+		"total":           total,
+		"reverse_proxies": rps,
+		"streams":         streams,
+		"providers":       providerStats,
+	}
+}

internal/config/types/config.go

@@ -0,0 +1,71 @@
+package types
+
+import (
+	"context"
+	"regexp"
+
+	"github.com/go-playground/validator/v10"
+	"github.com/yusing/go-proxy/internal/autocert"
+	"github.com/yusing/go-proxy/internal/net/http/accesslog"
+	"github.com/yusing/go-proxy/internal/notif"
+	"github.com/yusing/go-proxy/internal/utils"
+
+	E "github.com/yusing/go-proxy/internal/error"
+)
+
+type (
+	Config struct {
+		AutoCert        *autocert.AutocertConfig `json:"autocert"`
+		Entrypoint      Entrypoint               `json:"entrypoint"`
+		Providers       Providers                `json:"providers"`
+		MatchDomains    []string                 `json:"match_domains" validate:"domain_name"`
+		Homepage        HomepageConfig           `json:"homepage"`
+		TimeoutShutdown int                      `json:"timeout_shutdown" validate:"gte=0"`
+	}
+	Providers struct {
+		Files        []string                   `json:"include" validate:"dive,filepath"`
+		Docker       map[string]string          `json:"docker" validate:"dive,unix_addr|url"`
+		Notification []notif.NotificationConfig `json:"notification"`
+	}
+	Entrypoint struct {
+		Middlewares []map[string]any  `json:"middlewares"`
+		AccessLog   *accesslog.Config `json:"access_log" validate:"omitempty"`
+	}
+
+	ConfigInstance interface {
+		Value() *Config
+		Reload() E.Error
+		Statistics() map[string]any
+		RouteProviderList() []string
+		Context() context.Context
+	}
+)
+
+func DefaultConfig() *Config {
+	return &Config{
+		TimeoutShutdown: 3,
+		Homepage: HomepageConfig{
+			UseDefaultCategories: true,
+		},
+	}
+}
+
+func Validate(data []byte) E.Error {
+	var model Config
+	return utils.DeserializeYAML(data, &model)
+}
+
+var matchDomainsRegex = regexp.MustCompile(`^[^\.]?([\w\d\-_]\.?)+[^\.]?$`)
+
+func init() {
+	utils.RegisterDefaultValueFactory(DefaultConfig)
+	utils.MustRegisterValidation("domain_name", func(fl validator.FieldLevel) bool {
+		domains := fl.Field().Interface().([]string)
+		for _, domain := range domains {
+			if !matchDomainsRegex.MatchString(domain) {
+				return false
+			}
+		}
+		return true
+	})
+}

internal/config/types/homepage_config.go

@@ -0,0 +1,5 @@
+package types
+
+type HomepageConfig struct {
+	UseDefaultCategories bool `json:"use_default_categories"`
+}

internal/docker/client.go

@@ -0,0 +1,141 @@
+package docker
+
+import (
+	"errors"
+	"net/http"
+	"sync"
+
+	"github.com/docker/cli/cli/connhelper"
+	"github.com/docker/docker/client"
+	"github.com/rs/zerolog"
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/task"
+	U "github.com/yusing/go-proxy/internal/utils"
+)
+
+type (
+	SharedClient struct {
+		*client.Client
+
+		key      string
+		refCount *U.RefCount
+
+		l zerolog.Logger
+	}
+)
+
+var (
+	clientMap   = make(map[string]*SharedClient, 5)
+	clientMapMu sync.Mutex
+
+	clientOptEnvHost = []client.Opt{
+		client.WithHostFromEnv(),
+		client.WithAPIVersionNegotiation(),
+	}
+)
+
+func init() {
+	task.OnProgramExit("docker_clients_cleanup", func() {
+		clientMapMu.Lock()
+		defer clientMapMu.Unlock()
+
+		for _, c := range clientMap {
+			if c.Connected() {
+				c.Client.Close()
+			}
+		}
+	})
+}
+
+func (c *SharedClient) Connected() bool {
+	return c != nil && c.Client != nil
+}
+
+// if the client is still referenced, this is no-op.
+func (c *SharedClient) Close() {
+	if c.Connected() {
+		c.refCount.Sub()
+	}
+}
+
+// ConnectClient creates a new Docker client connection to the specified host.
+//
+// Returns existing client if available.
+//
+// Parameters:
+//   - host: the host to connect to (either a URL or common.DockerHostFromEnv).
+//
+// Returns:
+//   - Client: the Docker client connection.
+//   - error: an error if the connection failed.
+func ConnectClient(host string) (*SharedClient, error) {
+	clientMapMu.Lock()
+	defer clientMapMu.Unlock()
+
+	if client, ok := clientMap[host]; ok {
+		client.refCount.Add()
+		return client, nil
+	}
+
+	// create client
+	var opt []client.Opt
+
+	switch host {
+	case "":
+		return nil, errors.New("empty docker host")
+	case common.DockerHostFromEnv:
+		opt = clientOptEnvHost
+	default:
+		helper, err := connhelper.GetConnectionHelper(host)
+		if err != nil {
+			logging.Panic().Err(err).Msg("failed to get connection helper")
+		}
+		if helper != nil {
+			httpClient := &http.Client{
+				Transport: &http.Transport{
+					DialContext: helper.Dialer,
+				},
+			}
+			opt = []client.Opt{
+				client.WithHTTPClient(httpClient),
+				client.WithHost(helper.Host),
+				client.WithAPIVersionNegotiation(),
+				client.WithDialContext(helper.Dialer),
+			}
+		} else {
+			opt = []client.Opt{
+				client.WithHost(host),
+				client.WithAPIVersionNegotiation(),
+			}
+		}
+	}
+
+	client, err := client.NewClientWithOpts(opt...)
+	if err != nil {
+		return nil, err
+	}
+
+	c := &SharedClient{
+		Client:   client,
+		key:      host,
+		refCount: U.NewRefCounter(),
+		l:        logging.With().Str("address", client.DaemonHost()).Logger(),
+	}
+	c.l.Trace().Msg("client connected")
+
+	clientMap[host] = c
+
+	go func() {
+		<-c.refCount.Zero()
+		clientMapMu.Lock()
+		delete(clientMap, c.key)
+		clientMapMu.Unlock()
+
+		if c.Connected() {
+			c.Client.Close()
+			c.l.Trace().Msg("client closed")
+		}
+	}()
+	return c, nil
+}

internal/docker/container.go

@@ -0,0 +1,153 @@
+package docker
+
+import (
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/docker/docker/api/types"
+	"github.com/yusing/go-proxy/internal/logging"
+	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type (
+	PortMapping = map[int]types.Port
+	Container   struct {
+		_ U.NoCopy
+
+		DockerHost    string `json:"docker_host"`
+		ContainerName string `json:"container_name"`
+		ContainerID   string `json:"container_id"`
+		ImageName     string `json:"image_name"`
+
+		Labels map[string]string `json:"-"`
+
+		PublicPortMapping  PortMapping `json:"public_ports"`  // non-zero publicPort:types.Port
+		PrivatePortMapping PortMapping `json:"private_ports"` // privatePort:types.Port
+		PublicIP           string      `json:"public_ip"`
+		PrivateIP          string      `json:"private_ip"`
+		NetworkMode        string      `json:"network_mode"`
+
+		Aliases       []string `json:"aliases"`
+		IsExcluded    bool     `json:"is_excluded"`
+		IsExplicit    bool     `json:"is_explicit"`
+		IsDatabase    bool     `json:"is_database"`
+		IdleTimeout   string   `json:"idle_timeout,omitempty"`
+		WakeTimeout   string   `json:"wake_timeout,omitempty"`
+		StopMethod    string   `json:"stop_method,omitempty"`
+		StopTimeout   string   `json:"stop_timeout,omitempty"` // stop_method = "stop" only
+		StopSignal    string   `json:"stop_signal,omitempty"`  // stop_method = "stop" | "kill" only
+		StartEndpoint string   `json:"start_endpoint,omitempty"`
+		Running       bool     `json:"running"`
+	}
+)
+
+var DummyContainer = new(Container)
+
+func FromDocker(c *types.Container, dockerHost string) (res *Container) {
+	isExplicit := false
+	helper := containerHelper{c}
+	for lbl := range c.Labels {
+		if strings.HasPrefix(lbl, NSProxy+".") {
+			isExplicit = true
+			break
+		}
+	}
+	res = &Container{
+		DockerHost:    dockerHost,
+		ContainerName: helper.getName(),
+		ContainerID:   c.ID,
+		ImageName:     helper.getImageName(),
+
+		Labels: c.Labels,
+
+		PublicPortMapping:  helper.getPublicPortMapping(),
+		PrivatePortMapping: helper.getPrivatePortMapping(),
+		NetworkMode:        c.HostConfig.NetworkMode,
+
+		Aliases:       helper.getAliases(),
+		IsExcluded:    strutils.ParseBool(helper.getDeleteLabel(LabelExclude)),
+		IsExplicit:    isExplicit,
+		IsDatabase:    helper.isDatabase(),
+		IdleTimeout:   helper.getDeleteLabel(LabelIdleTimeout),
+		WakeTimeout:   helper.getDeleteLabel(LabelWakeTimeout),
+		StopMethod:    helper.getDeleteLabel(LabelStopMethod),
+		StopTimeout:   helper.getDeleteLabel(LabelStopTimeout),
+		StopSignal:    helper.getDeleteLabel(LabelStopSignal),
+		StartEndpoint: helper.getDeleteLabel(LabelStartEndpoint),
+		Running:       c.Status == "running" || c.State == "running",
+	}
+	res.setPrivateIP(helper)
+	res.setPublicIP()
+	return
+}
+
+func FromJSON(json types.ContainerJSON, dockerHost string) *Container {
+	ports := make([]types.Port, 0)
+	for k, bindings := range json.NetworkSettings.Ports {
+		privPortStr, proto := k.Port(), k.Proto()
+		privPort, _ := strconv.ParseUint(privPortStr, 10, 16)
+		ports = append(ports, types.Port{
+			PrivatePort: uint16(privPort),
+			Type:        proto,
+		})
+		for _, v := range bindings {
+			pubPort, _ := strconv.ParseUint(v.HostPort, 10, 16)
+			ports = append(ports, types.Port{
+				IP:          v.HostIP,
+				PublicPort:  uint16(pubPort),
+				PrivatePort: uint16(privPort),
+				Type:        proto,
+			})
+		}
+	}
+	cont := FromDocker(&types.Container{
+		ID:     json.ID,
+		Names:  []string{strings.TrimPrefix(json.Name, "/")},
+		Image:  json.Image,
+		Ports:  ports,
+		Labels: json.Config.Labels,
+		State:  json.State.Status,
+		Status: json.State.Status,
+		Mounts: json.Mounts,
+		NetworkSettings: &types.SummaryNetworkSettings{
+			Networks: json.NetworkSettings.Networks,
+		},
+	}, dockerHost)
+	cont.NetworkMode = string(json.HostConfig.NetworkMode)
+	return cont
+}
+
+func (c *Container) setPublicIP() {
+	if !c.Running {
+		return
+	}
+	if strings.HasPrefix(c.DockerHost, "unix://") {
+		c.PublicIP = "127.0.0.1"
+		return
+	}
+	url, err := url.Parse(c.DockerHost)
+	if err != nil {
+		logging.Err(err).Msgf("invalid docker host %q, falling back to 127.0.0.1", c.DockerHost)
+		c.PublicIP = "127.0.0.1"
+		return
+	}
+	c.PublicIP = url.Hostname()
+}
+
+func (c *Container) setPrivateIP(helper containerHelper) {
+	if !strings.HasPrefix(c.DockerHost, "unix://") {
+		return
+	}
+	if helper.NetworkSettings == nil {
+		return
+	}
+	for _, v := range helper.NetworkSettings.Networks {
+		if v.IPAddress == "" {
+			continue
+		}
+		c.PrivateIP = v.IPAddress
+		return
+	}
+}

internal/docker/container_helper.go

@@ -0,0 +1,84 @@
+package docker
+
+import (
+	"strings"
+
+	"github.com/docker/docker/api/types"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type containerHelper struct {
+	*types.Container
+}
+
+// getDeleteLabel gets the value of a label and then deletes it from the container.
+// If the label does not exist, an empty string is returned.
+func (c containerHelper) getDeleteLabel(label string) string {
+	if l, ok := c.Labels[label]; ok {
+		delete(c.Labels, label)
+		return l
+	}
+	return ""
+}
+
+func (c containerHelper) getAliases() []string {
+	if l := c.getDeleteLabel(LabelAliases); l != "" {
+		return strutils.CommaSeperatedList(l)
+	}
+	return []string{c.getName()}
+}
+
+func (c containerHelper) getName() string {
+	return strings.TrimPrefix(c.Names[0], "/")
+}
+
+func (c containerHelper) getImageName() string {
+	colonSep := strutils.SplitRune(c.Image, ':')
+	slashSep := strutils.SplitRune(colonSep[0], '/')
+	return slashSep[len(slashSep)-1]
+}
+
+func (c containerHelper) getPublicPortMapping() PortMapping {
+	res := make(PortMapping)
+	for _, v := range c.Ports {
+		if v.PublicPort == 0 {
+			continue
+		}
+		res[int(v.PublicPort)] = v
+	}
+	return res
+}
+
+func (c containerHelper) getPrivatePortMapping() PortMapping {
+	res := make(PortMapping)
+	for _, v := range c.Ports {
+		res[int(v.PrivatePort)] = v
+	}
+	return res
+}
+
+var databaseMPs = map[string]struct{}{
+	"/var/lib/postgresql/data": {},
+	"/var/lib/mysql":           {},
+	"/var/lib/mongodb":         {},
+	"/var/lib/mariadb":         {},
+	"/var/lib/memcached":       {},
+	"/var/lib/rabbitmq":        {},
+}
+
+func (c containerHelper) isDatabase() bool {
+	for _, m := range c.Mounts {
+		if _, ok := databaseMPs[m.Destination]; ok {
+			return true
+		}
+	}
+
+	for _, v := range c.Ports {
+		switch v.PrivatePort {
+		// postgres, mysql or mariadb, redis, memcached, mongodb
+		case 5432, 3306, 6379, 11211, 27017:
+			return true
+		}
+	}
+	return false
+}

internal/docker/container_test.go

@@ -0,0 +1,43 @@
+package docker
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+func TestContainerExplicit(t *testing.T) {
+	tests := []struct {
+		name       string
+		labels     map[string]string
+		isExplicit bool
+	}{
+		{
+			name: "explicit",
+			labels: map[string]string{
+				"proxy.aliases": "foo",
+			},
+			isExplicit: true,
+		},
+		{
+			name: "explicit2",
+			labels: map[string]string{
+				"proxy.idle_timeout": "1s",
+			},
+			isExplicit: true,
+		},
+		{
+			name:       "not explicit",
+			labels:     map[string]string{},
+			isExplicit: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := FromDocker(&types.Container{Names: []string{"test"}, State: "test", Labels: tt.labels}, "")
+			ExpectEqual(t, c.IsExplicit, tt.isExplicit)
+		})
+	}
+}

internal/docker/idlewatcher/html/loading_page.html

@@ -66,22 +66,23 @@
     <body>
         <script>
             window.onload = async function () {
-                let result = await fetch(window.location.href, {
+                let resp = await fetch(window.location.href, {
                     headers: {
-                        {{ range $key, $value := .RequestHeaders }}
-                        '{{ $key }}' : {{ $value }}
-                        {{ end }}
+                        "{{.CheckRedirectHeader}}": "1",
                     },
-                }).then((resp) => resp.text())
-                    .catch((err) => {
-                        document.getElementById("message").innerText = err;
-                    });
-                if (result) {
-                    document.documentElement.innerHTML = result
+                });
+                if (resp.ok) {
+                    window.location.href = resp.url;
+                } else {
+                    document.getElementById("message").innerText =
+                        await resp.text();
+                    document
+                        .getElementById("spinner")
+                        .classList.replace("spinner", "error");
                 }
             };
         </script>
-        <div class="{{.SpinnerClass}}"></div>
-        <div class="message">{{.Message}}</div>
+        <div id="spinner" class="spinner"></div>
+        <div id="message" class="message">{{.Message}}</div>
     </body>
 </html>

internal/docker/idlewatcher/loading_page.go

@@ -0,0 +1,36 @@
+package idlewatcher
+
+import (
+	"bytes"
+	_ "embed"
+	"strings"
+	"text/template"
+
+	"github.com/yusing/go-proxy/internal/common"
+)
+
+type templateData struct {
+	CheckRedirectHeader string
+	Title               string
+	Message             string
+}
+
+//go:embed html/loading_page.html
+var loadingPage []byte
+var loadingPageTmpl = template.Must(template.New("loading_page").Parse(string(loadingPage)))
+
+func (w *Watcher) makeLoadingPageBody() []byte {
+	msg := w.ContainerName + " is starting..."
+
+	data := new(templateData)
+	data.CheckRedirectHeader = common.HeaderCheckRedirect
+	data.Title = w.ContainerName
+	data.Message = strings.ReplaceAll(msg, " ", " ")
+
+	buf := bytes.NewBuffer(make([]byte, len(loadingPage)+len(data.Title)+len(data.Message)+len(common.HeaderCheckRedirect)))
+	err := loadingPageTmpl.Execute(buf, data)
+	if err != nil { // should never happen in production
+		panic(err)
+	}
+	return buf.Bytes()
+}

internal/docker/idlewatcher/types/config.go

@@ -0,0 +1,129 @@
+package types
+
+import (
+	"errors"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/docker"
+	E "github.com/yusing/go-proxy/internal/error"
+)
+
+type (
+	Config struct {
+		IdleTimeout   time.Duration `json:"idle_timeout,omitempty"`
+		WakeTimeout   time.Duration `json:"wake_timeout,omitempty"`
+		StopTimeout   int           `json:"stop_timeout,omitempty"` // docker api takes integer seconds for timeout argument
+		StopMethod    StopMethod    `json:"stop_method,omitempty"`
+		StopSignal    Signal        `json:"stop_signal,omitempty"`
+		StartEndpoint string        `json:"start_endpoint,omitempty"` // Optional path that must be hit to start container
+
+		DockerHost       string `json:"docker_host,omitempty"`
+		ContainerName    string `json:"container_name,omitempty"`
+		ContainerID      string `json:"container_id,omitempty"`
+		ContainerRunning bool   `json:"container_running,omitempty"`
+	}
+	StopMethod string
+	Signal     string
+)
+
+const (
+	StopMethodPause StopMethod = "pause"
+	StopMethodStop  StopMethod = "stop"
+	StopMethodKill  StopMethod = "kill"
+)
+
+var validSignals = map[string]struct{}{
+	"":       {},
+	"SIGINT": {}, "SIGTERM": {}, "SIGHUP": {}, "SIGQUIT": {},
+	"INT": {}, "TERM": {}, "HUP": {}, "QUIT": {},
+}
+
+func ValidateConfig(cont *docker.Container) (*Config, E.Error) {
+	if cont == nil {
+		return nil, nil
+	}
+
+	if cont.IdleTimeout == "" {
+		return &Config{
+			DockerHost:       cont.DockerHost,
+			ContainerName:    cont.ContainerName,
+			ContainerID:      cont.ContainerID,
+			ContainerRunning: cont.Running,
+		}, nil
+	}
+
+	errs := E.NewBuilder("invalid idlewatcher config")
+
+	idleTimeout := E.Collect(errs, validateDurationPostitive, cont.IdleTimeout)
+	wakeTimeout := E.Collect(errs, validateDurationPostitive, cont.WakeTimeout)
+	stopTimeout := E.Collect(errs, validateDurationPostitive, cont.StopTimeout)
+	stopMethod := E.Collect(errs, validateStopMethod, cont.StopMethod)
+	signal := E.Collect(errs, validateSignal, cont.StopSignal)
+	startEndpoint := E.Collect(errs, validateStartEndpoint, cont.StartEndpoint)
+
+	if errs.HasError() {
+		return nil, errs.Error()
+	}
+
+	return &Config{
+		IdleTimeout:   idleTimeout,
+		WakeTimeout:   wakeTimeout,
+		StopTimeout:   int(stopTimeout.Seconds()),
+		StopMethod:    stopMethod,
+		StopSignal:    signal,
+		StartEndpoint: startEndpoint,
+
+		DockerHost:       cont.DockerHost,
+		ContainerName:    cont.ContainerName,
+		ContainerID:      cont.ContainerID,
+		ContainerRunning: cont.Running,
+	}, nil
+}
+
+func validateDurationPostitive(value string) (time.Duration, error) {
+	d, err := time.ParseDuration(value)
+	if err != nil {
+		return 0, err
+	}
+	if d < 0 {
+		return 0, errors.New("duration must be positive")
+	}
+	return d, nil
+}
+
+func validateSignal(s string) (Signal, error) {
+	if _, ok := validSignals[s]; ok {
+		return Signal(s), nil
+	}
+	return "", errors.New("invalid signal " + s)
+}
+
+func validateStopMethod(s string) (StopMethod, error) {
+	sm := StopMethod(s)
+	switch sm {
+	case StopMethodPause, StopMethodStop, StopMethodKill:
+		return sm, nil
+	default:
+		return "", errors.New("invalid stop method " + s)
+	}
+}
+
+func validateStartEndpoint(s string) (string, error) {
+	if s == "" {
+		return "", nil
+	}
+	// checks needed as of Go 1.6 because of change https://github.com/golang/go/commit/617c93ce740c3c3cc28cdd1a0d712be183d0b328#diff-6c2d018290e298803c0c9419d8739885L195
+	// emulate browser and strip the '#' suffix prior to validation. see issue-#237
+	if i := strings.Index(s, "#"); i > -1 {
+		s = s[:i]
+	}
+	if len(s) == 0 {
+		return "", errors.New("start endpoint must not be empty if defined")
+	}
+	if _, err := url.ParseRequestURI(s); err != nil {
+		return "", err
+	}
+	return s, nil
+}

internal/docker/idlewatcher/types/config_test.go

@@ -0,0 +1,47 @@
+package types
+
+import (
+	"testing"
+
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+func TestValidateStartEndpoint(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		wantErr bool
+	}{
+		{
+			name:    "valid",
+			input:   "/start",
+			wantErr: false,
+		},
+		{
+			name:    "invalid",
+			input:   "../foo",
+			wantErr: true,
+		},
+		{
+			name:    "single fragment",
+			input:   "#",
+			wantErr: true,
+		},
+		{
+			name:    "empty",
+			input:   "",
+			wantErr: false,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			s, err := validateStartEndpoint(tc.input)
+			if err == nil {
+				ExpectEqual(t, s, tc.input)
+			}
+			if (err != nil) != tc.wantErr {
+				t.Errorf("validateStartEndpoint() error = %v, wantErr %t", err, tc.wantErr)
+			}
+		})
+	}
+}

internal/docker/idlewatcher/types/waker.go

@@ -0,0 +1,15 @@
+package types
+
+import (
+	"net/http"
+
+	net "github.com/yusing/go-proxy/internal/net/types"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+)
+
+type Waker interface {
+	health.HealthMonitor
+	http.Handler
+	net.Stream
+	Wake() error
+}

internal/docker/idlewatcher/waker.go

@@ -0,0 +1,168 @@
+package idlewatcher
+
+import (
+	"sync/atomic"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/metrics"
+	"github.com/yusing/go-proxy/internal/net/http/reverseproxy"
+	net "github.com/yusing/go-proxy/internal/net/types"
+	route "github.com/yusing/go-proxy/internal/route/types"
+	"github.com/yusing/go-proxy/internal/task"
+	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
+)
+
+type (
+	Waker = types.Waker
+	waker struct {
+		_ U.NoCopy
+
+		rp     *reverseproxy.ReverseProxy
+		stream net.Stream
+		hc     health.HealthChecker
+		metric *metrics.Gauge
+
+		ready atomic.Bool
+	}
+)
+
+const (
+	idleWakerCheckInterval = 100 * time.Millisecond
+	idleWakerCheckTimeout  = time.Second
+)
+
+// TODO: support stream
+
+func newWaker(parent task.Parent, route route.Route, rp *reverseproxy.ReverseProxy, stream net.Stream) (Waker, E.Error) {
+	hcCfg := route.HealthCheckConfig()
+	hcCfg.Timeout = idleWakerCheckTimeout
+
+	waker := &waker{
+		rp:     rp,
+		stream: stream,
+	}
+	task := parent.Subtask("idlewatcher." + route.TargetName())
+	watcher, err := registerWatcher(task, route, waker)
+	if err != nil {
+		return nil, E.Errorf("register watcher: %w", err)
+	}
+
+	switch {
+	case rp != nil:
+		waker.hc = monitor.NewHTTPHealthChecker(route.TargetURL(), hcCfg)
+	case stream != nil:
+		waker.hc = monitor.NewRawHealthChecker(route.TargetURL(), hcCfg)
+	default:
+		panic("both nil")
+	}
+
+	if common.PrometheusEnabled {
+		m := metrics.GetServiceMetrics()
+		fqn := parent.Name() + "/" + route.TargetName()
+		waker.metric = m.HealthStatus.With(metrics.HealthMetricLabels(fqn))
+		waker.metric.Set(float64(watcher.Status()))
+	}
+	return watcher, nil
+}
+
+// lifetime should follow route provider.
+func NewHTTPWaker(parent task.Parent, route route.Route, rp *reverseproxy.ReverseProxy) (Waker, E.Error) {
+	return newWaker(parent, route, rp, nil)
+}
+
+func NewStreamWaker(parent task.Parent, route route.Route, stream net.Stream) (Waker, E.Error) {
+	return newWaker(parent, route, nil, stream)
+}
+
+// Start implements health.HealthMonitor.
+func (w *Watcher) Start(parent task.Parent) E.Error {
+	w.task.OnCancel("route_cleanup", func() {
+		parent.Finish(w.task.FinishCause())
+		if w.metric != nil {
+			w.metric.Reset()
+		}
+	})
+	return nil
+}
+
+// Task implements health.HealthMonitor.
+func (w *Watcher) Task() *task.Task {
+	return w.task
+}
+
+// Finish implements health.HealthMonitor.
+func (w *Watcher) Finish(reason any) {
+	if w.stream != nil {
+		w.stream.Close()
+	}
+}
+
+// Name implements health.HealthMonitor.
+func (w *Watcher) Name() string {
+	return w.String()
+}
+
+// String implements health.HealthMonitor.
+func (w *Watcher) String() string {
+	return w.ContainerName
+}
+
+// Uptime implements health.HealthMonitor.
+func (w *Watcher) Uptime() time.Duration {
+	return 0
+}
+
+// Latency implements health.HealthMonitor.
+func (w *Watcher) Latency() time.Duration {
+	return 0
+}
+
+// Status implements health.HealthMonitor.
+func (w *Watcher) Status() health.Status {
+	status := w.getStatusUpdateReady()
+	if w.metric != nil {
+		w.metric.Set(float64(status))
+	}
+	return status
+}
+
+func (w *Watcher) getStatusUpdateReady() health.Status {
+	if !w.ContainerRunning {
+		return health.StatusNapping
+	}
+
+	if w.ready.Load() {
+		return health.StatusHealthy
+	}
+
+	result, err := w.hc.CheckHealth()
+	switch {
+	case err != nil:
+		w.ready.Store(false)
+		return health.StatusError
+	case result.Healthy:
+		w.ready.Store(true)
+		return health.StatusHealthy
+	default:
+		return health.StatusStarting
+	}
+}
+
+// MarshalJSON implements health.HealthMonitor.
+func (w *Watcher) MarshalJSON() ([]byte, error) {
+	var url *net.URL
+	if w.hc.URL().Port() != "0" {
+		url = w.hc.URL()
+	}
+	return (&monitor.JSONRepresentation{
+		Name:   w.Name(),
+		Status: w.Status(),
+		Config: w.hc.Config(),
+		URL:    url,
+	}).MarshalJSON()
+}

internal/docker/idlewatcher/waker_http.go

@@ -0,0 +1,130 @@
+package idlewatcher
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/common"
+	gphttp "github.com/yusing/go-proxy/internal/net/http"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+)
+
+type ForceCacheControl struct {
+	expires string
+	http.ResponseWriter
+}
+
+func (f *ForceCacheControl) WriteHeader(code int) {
+	f.ResponseWriter.Header().Set("Cache-Control", "must-revalidate")
+	f.ResponseWriter.Header().Set("Expires", f.expires)
+	f.ResponseWriter.WriteHeader(code)
+}
+
+func (f *ForceCacheControl) Unwrap() http.ResponseWriter {
+	return f.ResponseWriter
+}
+
+// ServeHTTP implements http.Handler.
+func (w *Watcher) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	shouldNext := w.wakeFromHTTP(rw, r)
+	if !shouldNext {
+		return
+	}
+	select {
+	case <-r.Context().Done():
+		return
+	default:
+		f := &ForceCacheControl{expires: w.expires().Format(http.TimeFormat), ResponseWriter: rw}
+		w.rp.ServeHTTP(f, r)
+	}
+}
+
+func (w *Watcher) wakeFromHTTP(rw http.ResponseWriter, r *http.Request) (shouldNext bool) {
+	w.resetIdleTimer()
+
+	// pass through if container is already ready
+	if w.ready.Load() {
+		return true
+	}
+
+	// Check if start endpoint is configured and request path matches
+	if w.StartEndpoint != "" && r.URL.Path != w.StartEndpoint {
+		http.Error(rw, "Forbidden: Container can only be started via configured start endpoint", http.StatusForbidden)
+		return false
+	}
+
+	if r.Body != nil {
+		defer r.Body.Close()
+	}
+
+	accept := gphttp.GetAccept(r.Header)
+	acceptHTML := (r.Method == http.MethodGet && accept.AcceptHTML() || r.RequestURI == "/" && accept.IsEmpty())
+
+	isCheckRedirect := r.Header.Get(common.HeaderCheckRedirect) != ""
+	if !isCheckRedirect && acceptHTML {
+		// Send a loading response to the client
+		body := w.makeLoadingPageBody()
+		rw.Header().Set("Content-Type", "text/html; charset=utf-8")
+		rw.Header().Set("Content-Length", strconv.Itoa(len(body)))
+		rw.Header().Set("Cache-Control", "no-cache")
+		rw.Header().Add("Cache-Control", "no-store")
+		rw.Header().Add("Cache-Control", "must-revalidate")
+		rw.Header().Add("Connection", "close")
+		if _, err := rw.Write(body); err != nil {
+			w.Err(err).Msg("error writing http response")
+		}
+		return false
+	}
+
+	ctx, cancel := context.WithTimeoutCause(r.Context(), w.WakeTimeout, errors.New("wake timeout"))
+	defer cancel()
+
+	checkCanceled := func() (canceled bool) {
+		select {
+		case <-ctx.Done():
+			w.WakeDebug().Str("cause", context.Cause(ctx).Error()).Msg("canceled")
+			return true
+		case <-w.task.Context().Done():
+			w.WakeDebug().Str("cause", w.task.FinishCause().Error()).Msg("canceled")
+			http.Error(rw, "Service unavailable", http.StatusServiceUnavailable)
+			return true
+		default:
+			return false
+		}
+	}
+
+	if checkCanceled() {
+		return false
+	}
+
+	w.WakeTrace().Msg("signal received")
+	err := w.wakeIfStopped()
+	if err != nil {
+		w.WakeError(err)
+		http.Error(rw, "Error waking container", http.StatusInternalServerError)
+		return false
+	}
+
+	for {
+		if checkCanceled() {
+			return false
+		}
+
+		if w.Status() == health.StatusHealthy {
+			w.resetIdleTimer()
+			if isCheckRedirect {
+				w.Debug().Msgf("redirecting to %s ...", w.hc.URL())
+				rw.WriteHeader(http.StatusOK)
+				return false
+			}
+			w.Debug().Msgf("passing through to %s ...", w.hc.URL())
+			return true
+		}
+
+		// retry until the container is ready or timeout
+		time.Sleep(idleWakerCheckInterval)
+	}
+}

internal/docker/idlewatcher/waker_stream.go

@@ -0,0 +1,90 @@
+package idlewatcher
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/net/types"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+)
+
+// Setup implements types.Stream.
+func (w *Watcher) Addr() net.Addr {
+	return w.stream.Addr()
+}
+
+// Setup implements types.Stream.
+func (w *Watcher) Setup() error {
+	return w.stream.Setup()
+}
+
+// Accept implements types.Stream.
+func (w *Watcher) Accept() (conn types.StreamConn, err error) {
+	conn, err = w.stream.Accept()
+	if err != nil {
+		return
+	}
+	if wakeErr := w.wakeFromStream(); wakeErr != nil {
+		w.WakeError(wakeErr)
+	}
+	return
+}
+
+// Handle implements types.Stream.
+func (w *Watcher) Handle(conn types.StreamConn) error {
+	if err := w.wakeFromStream(); err != nil {
+		return err
+	}
+	return w.stream.Handle(conn)
+}
+
+// Close implements types.Stream.
+func (w *Watcher) Close() error {
+	return w.stream.Close()
+}
+
+func (w *Watcher) wakeFromStream() error {
+	w.resetIdleTimer()
+
+	// pass through if container is already ready
+	if w.ready.Load() {
+		return nil
+	}
+
+	w.WakeDebug().Msg("wake signal received")
+	wakeErr := w.wakeIfStopped()
+	if wakeErr != nil {
+		wakeErr = fmt.Errorf("%s failed: %w", w.String(), wakeErr)
+		w.WakeError(wakeErr)
+		return wakeErr
+	}
+
+	ctx, cancel := context.WithTimeoutCause(w.task.Context(), w.WakeTimeout, errors.New("wake timeout"))
+	defer cancel()
+
+	for {
+		select {
+		case <-w.task.Context().Done():
+			cause := w.task.FinishCause()
+			w.WakeDebug().Str("cause", cause.Error()).Msg("canceled")
+			return cause
+		case <-ctx.Done():
+			cause := context.Cause(ctx)
+			w.WakeDebug().Str("cause", cause.Error()).Msg("timeout")
+			return cause
+		default:
+		}
+
+		if w.Status() == health.StatusHealthy {
+			w.resetIdleTimer()
+			w.Debug().Msg("container is ready, passing through to " + w.hc.URL().String())
+			return nil
+		}
+
+		// retry until the container is ready or timeout
+		time.Sleep(idleWakerCheckInterval)
+	}
+}

internal/docker/idlewatcher/watcher.go

@@ -0,0 +1,305 @@
+package idlewatcher
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/rs/zerolog"
+	D "github.com/yusing/go-proxy/internal/docker"
+	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
+	route "github.com/yusing/go-proxy/internal/route/types"
+	"github.com/yusing/go-proxy/internal/task"
+	U "github.com/yusing/go-proxy/internal/utils"
+	F "github.com/yusing/go-proxy/internal/utils/functional"
+	"github.com/yusing/go-proxy/internal/watcher"
+	"github.com/yusing/go-proxy/internal/watcher/events"
+)
+
+type (
+	Watcher struct {
+		_ U.NoCopy
+
+		zerolog.Logger
+
+		*idlewatcher.Config
+		*waker
+
+		client       *D.SharedClient
+		stopByMethod StopCallback // send a docker command w.r.t. `stop_method`
+		ticker       *time.Ticker
+		lastReset    time.Time
+		task         *task.Task
+	}
+
+	WakeDone     <-chan error
+	WakeFunc     func() WakeDone
+	StopCallback func() error
+)
+
+var (
+	watcherMap   = F.NewMapOf[string, *Watcher]()
+	watcherMapMu sync.Mutex
+
+	errShouldNotReachHere = errors.New("should not reach here")
+)
+
+const dockerReqTimeout = 3 * time.Second
+
+func registerWatcher(watcherTask *task.Task, route route.Route, waker *waker) (*Watcher, error) {
+	cfg := route.IdlewatcherConfig()
+
+	if cfg.IdleTimeout == 0 {
+		panic(errShouldNotReachHere)
+	}
+
+	watcherMapMu.Lock()
+	defer watcherMapMu.Unlock()
+
+	key := cfg.ContainerID
+
+	if w, ok := watcherMap.Load(key); ok {
+		w.Config = cfg
+		w.waker = waker
+		w.resetIdleTimer()
+		watcherTask.Finish("used existing watcher")
+		return w, nil
+	}
+
+	client, err := D.ConnectClient(cfg.DockerHost)
+	if err != nil {
+		return nil, err
+	}
+
+	w := &Watcher{
+		Logger: logging.With().Str("name", cfg.ContainerName).Logger(),
+		Config: cfg,
+		waker:  waker,
+		client: client,
+		task:   watcherTask,
+		ticker: time.NewTicker(cfg.IdleTimeout),
+	}
+	w.stopByMethod = w.getStopCallback()
+	watcherMap.Store(key, w)
+
+	go func() {
+		cause := w.watchUntilDestroy()
+
+		watcherMap.Delete(w.ContainerID)
+
+		w.ticker.Stop()
+		w.client.Close()
+		w.task.Finish(cause)
+	}()
+
+	return w, nil
+}
+
+func (w *Watcher) Wake() error {
+	return w.wakeIfStopped()
+}
+
+// WakeDebug logs a debug message related to waking the container.
+func (w *Watcher) WakeDebug() *zerolog.Event {
+	//nolint:zerologlint
+	return w.Debug().Str("action", "wake")
+}
+
+func (w *Watcher) WakeTrace() *zerolog.Event {
+	//nolint:zerologlint
+	return w.Trace().Str("action", "wake")
+}
+
+func (w *Watcher) WakeError(err error) {
+	w.Err(err).Str("action", "wake").Msg("error")
+}
+
+func (w *Watcher) LogReason(action, reason string) {
+	w.Info().Str("reason", reason).Msg(action)
+}
+
+func (w *Watcher) containerStop(ctx context.Context) error {
+	return w.client.ContainerStop(ctx, w.ContainerID, container.StopOptions{
+		Signal:  string(w.StopSignal),
+		Timeout: &w.StopTimeout,
+	})
+}
+
+func (w *Watcher) containerPause(ctx context.Context) error {
+	return w.client.ContainerPause(ctx, w.ContainerID)
+}
+
+func (w *Watcher) containerKill(ctx context.Context) error {
+	return w.client.ContainerKill(ctx, w.ContainerID, string(w.StopSignal))
+}
+
+func (w *Watcher) containerUnpause(ctx context.Context) error {
+	return w.client.ContainerUnpause(ctx, w.ContainerID)
+}
+
+func (w *Watcher) containerStart(ctx context.Context) error {
+	return w.client.ContainerStart(ctx, w.ContainerID, container.StartOptions{})
+}
+
+func (w *Watcher) containerStatus() (string, error) {
+	if !w.client.Connected() {
+		return "", errors.New("docker client not connected")
+	}
+	ctx, cancel := context.WithTimeoutCause(w.task.Context(), dockerReqTimeout, errors.New("docker request timeout"))
+	defer cancel()
+	json, err := w.client.ContainerInspect(ctx, w.ContainerID)
+	if err != nil {
+		return "", err
+	}
+	return json.State.Status, nil
+}
+
+func (w *Watcher) wakeIfStopped() error {
+	if w.ContainerRunning {
+		return nil
+	}
+
+	status, err := w.containerStatus()
+	if err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithTimeout(w.task.Context(), w.WakeTimeout)
+	defer cancel()
+
+	// !Hard coded here since theres no constants from Docker API
+	switch status {
+	case "exited", "dead":
+		return w.containerStart(ctx)
+	case "paused":
+		return w.containerUnpause(ctx)
+	case "running":
+		return nil
+	default:
+		return E.Errorf("unexpected container status: %s", status)
+	}
+}
+
+func (w *Watcher) getStopCallback() StopCallback {
+	var cb func(context.Context) error
+	switch w.StopMethod {
+	case idlewatcher.StopMethodPause:
+		cb = w.containerPause
+	case idlewatcher.StopMethodStop:
+		cb = w.containerStop
+	case idlewatcher.StopMethodKill:
+		cb = w.containerKill
+	default:
+		panic(errShouldNotReachHere)
+	}
+	return func() error {
+		ctx, cancel := context.WithTimeout(w.task.Context(), time.Duration(w.StopTimeout)*time.Second)
+		defer cancel()
+		return cb(ctx)
+	}
+}
+
+func (w *Watcher) resetIdleTimer() {
+	w.Trace().Msg("reset idle timer")
+	w.ticker.Reset(w.IdleTimeout)
+	w.lastReset = time.Now()
+}
+
+func (w *Watcher) expires() time.Time {
+	return w.lastReset.Add(w.IdleTimeout)
+}
+
+func (w *Watcher) getEventCh(dockerWatcher watcher.DockerWatcher) (eventCh <-chan events.Event, errCh <-chan E.Error) {
+	eventCh, errCh = dockerWatcher.EventsWithOptions(w.Task().Context(), watcher.DockerListOptions{
+		Filters: watcher.NewDockerFilter(
+			watcher.DockerFilterContainer,
+			watcher.DockerFilterContainerNameID(w.ContainerID),
+			watcher.DockerFilterStart,
+			watcher.DockerFilterStop,
+			watcher.DockerFilterDie,
+			watcher.DockerFilterKill,
+			watcher.DockerFilterDestroy,
+			watcher.DockerFilterPause,
+			watcher.DockerFilterUnpause,
+		),
+	})
+	return
+}
+
+// watchUntilDestroy waits for the container to be created, started, or unpaused,
+// and then reset the idle timer.
+//
+// When the container is stopped, paused,
+// or killed, the idle timer is stopped and the ContainerRunning flag is set to false.
+//
+// When the idle timer fires, the container is stopped according to the
+// stop method.
+//
+// it exits only if the context is canceled, the container is destroyed,
+// errors occurred on docker client, or route provider died (mainly caused by config reload).
+func (w *Watcher) watchUntilDestroy() (returnCause error) {
+	dockerWatcher := watcher.NewDockerWatcherWithClient(w.client)
+	dockerEventCh, dockerEventErrCh := w.getEventCh(dockerWatcher)
+
+	for {
+		select {
+		case <-w.task.Context().Done():
+			return w.task.FinishCause()
+		case err := <-dockerEventErrCh:
+			if !err.Is(context.Canceled) {
+				E.LogError("idlewatcher error", err, &w.Logger)
+			}
+			return err
+		case e := <-dockerEventCh:
+			switch {
+			case e.Action == events.ActionContainerDestroy:
+				w.ContainerRunning = false
+				w.ready.Store(false)
+				w.LogReason("watcher stopped", "container destroyed")
+				return errors.New("container destroyed")
+			// create / start / unpause
+			case e.Action.IsContainerWake():
+				w.ContainerRunning = true
+				w.resetIdleTimer()
+				w.Info().Msg("awaken")
+			case e.Action.IsContainerSleep(): // stop / pause / kil
+				w.ContainerRunning = false
+				w.ready.Store(false)
+				w.ticker.Stop()
+			default:
+				w.Error().Msg("unexpected docker event: " + e.String())
+			}
+			// container name changed should also change the container id
+			if w.ContainerName != e.ActorName {
+				w.Debug().Msgf("renamed %s -> %s", w.ContainerName, e.ActorName)
+				w.ContainerName = e.ActorName
+			}
+			if w.ContainerID != e.ActorID {
+				w.Debug().Msgf("id changed %s -> %s", w.ContainerID, e.ActorID)
+				w.ContainerID = e.ActorID
+				// recreate event stream
+				dockerEventCh, dockerEventErrCh = w.getEventCh(dockerWatcher)
+			}
+		case <-w.ticker.C:
+			w.ticker.Stop()
+			if w.ContainerRunning {
+				err := w.stopByMethod()
+				switch {
+				case errors.Is(err, context.Canceled):
+					continue
+				case err != nil:
+					if errors.Is(err, context.DeadlineExceeded) {
+						err = errors.New("timeout waiting for container to stop, please set a higher value for `stop_timeout`")
+					}
+					w.Err(err).Msgf("container stop with method %q failed", w.StopMethod)
+				default:
+					w.LogReason("container stopped", "idle timeout")
+				}
+			}
+		}
+	}
+}

internal/docker/inspect.go

@@ -0,0 +1,28 @@
+package docker
+
+import (
+	"context"
+	"errors"
+	"time"
+)
+
+func Inspect(dockerHost string, containerID string) (*Container, error) {
+	client, err := ConnectClient(dockerHost)
+	if err != nil {
+		return nil, err
+	}
+
+	defer client.Close()
+	return client.Inspect(containerID)
+}
+
+func (c *SharedClient) Inspect(containerID string) (*Container, error) {
+	ctx, cancel := context.WithTimeoutCause(context.Background(), 3*time.Second, errors.New("docker container inspect timeout"))
+	defer cancel()
+
+	json, err := c.ContainerInspect(ctx, containerID)
+	if err != nil {
+		return nil, err
+	}
+	return FromJSON(json, c.key), nil
+}

internal/docker/label.go

@@ -0,0 +1,52 @@
+package docker
+
+import (
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type LabelMap = map[string]any
+
+var ErrInvalidLabel = E.New("invalid label")
+
+func ParseLabels(labels map[string]string) (LabelMap, E.Error) {
+	nestedMap := make(LabelMap)
+	errs := E.NewBuilder("labels error")
+
+	for lbl, value := range labels {
+		parts := strutils.SplitRune(lbl, '.')
+		if parts[0] != NSProxy {
+			continue
+		}
+		if len(parts) == 1 {
+			errs.Add(ErrInvalidLabel.Subject(lbl))
+			continue
+		}
+		parts = parts[1:]
+		currentMap := nestedMap
+
+		for i, k := range parts {
+			if i == len(parts)-1 {
+				// Last element, set the value
+				currentMap[k] = value
+			} else {
+				// If the key doesn't exist, create a new map
+				if _, exists := currentMap[k]; !exists {
+					currentMap[k] = make(LabelMap)
+				}
+				// Move deeper into the nested map
+				m, ok := currentMap[k].(LabelMap)
+				if !ok && currentMap[k] != "" {
+					errs.Add(E.Errorf("expect mapping, got %T", currentMap[k]).Subject(lbl))
+					continue
+				} else if !ok {
+					m = make(LabelMap)
+					currentMap[k] = m
+				}
+				currentMap = m
+			}
+		}
+	}
+
+	return nestedMap, errs.Error()
+}

internal/docker/label_test.go

@@ -0,0 +1,18 @@
+package docker_test
+
+import (
+	"testing"
+
+	"github.com/yusing/go-proxy/internal/docker"
+)
+
+func BenchmarkParseLabels(b *testing.B) {
+	for range b.N {
+		_, _ = docker.ParseLabels(map[string]string{
+			"proxy.a.host":   "localhost",
+			"proxy.a.port":   "4444",
+			"proxy.a.scheme": "http",
+			"proxy.a.middlewares.request.hide_headers": "X-Header1,X-Header2",
+		})
+	}
+}

internal/docker/labels.go

@@ -0,0 +1,16 @@
+package docker
+
+const (
+	WildcardAlias = "*"
+
+	NSProxy = "proxy"
+
+	LabelAliases       = NSProxy + ".aliases"
+	LabelExclude       = NSProxy + ".exclude"
+	LabelIdleTimeout   = NSProxy + ".idle_timeout"
+	LabelWakeTimeout   = NSProxy + ".wake_timeout"
+	LabelStopMethod    = NSProxy + ".stop_method"
+	LabelStopTimeout   = NSProxy + ".stop_timeout"
+	LabelStopSignal    = NSProxy + ".stop_signal"
+	LabelStartEndpoint = NSProxy + ".start_endpoint"
+)

internal/docker/list_containers.go

@@ -0,0 +1,44 @@
+package docker
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/client"
+)
+
+var listOptions = container.ListOptions{
+	// created|restarting|running|removing|paused|exited|dead
+	// Filters: filters.NewArgs(
+	// 	filters.Arg("status", "created"),
+	// 	filters.Arg("status", "restarting"),
+	// 	filters.Arg("status", "running"),
+	// 	filters.Arg("status", "paused"),
+	// 	filters.Arg("status", "exited"),
+	// ),
+	All: true,
+}
+
+func ListContainers(clientHost string) ([]types.Container, error) {
+	dockerClient, err := ConnectClient(clientHost)
+	if err != nil {
+		return nil, err
+	}
+	defer dockerClient.Close()
+
+	ctx, cancel := context.WithTimeoutCause(context.Background(), 3*time.Second, errors.New("list containers timeout"))
+	defer cancel()
+
+	containers, err := dockerClient.ContainerList(ctx, listOptions)
+	if err != nil {
+		return nil, err
+	}
+	return containers, nil
+}
+
+func IsErrConnectionFailed(err error) bool {
+	return client.IsErrConnectionFailed(err)
+}

internal/entrypoint/entrypoint.go

@@ -0,0 +1,138 @@
+package entrypoint
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/yusing/go-proxy/internal/logging"
+	gphttp "github.com/yusing/go-proxy/internal/net/http"
+	"github.com/yusing/go-proxy/internal/net/http/accesslog"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
+	"github.com/yusing/go-proxy/internal/net/http/middleware/errorpage"
+	"github.com/yusing/go-proxy/internal/route/routes"
+	route "github.com/yusing/go-proxy/internal/route/types"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type Entrypoint struct {
+	middleware    *middleware.Middleware
+	accessLogger  *accesslog.AccessLogger
+	findRouteFunc func(host string) (route.HTTPRoute, error)
+}
+
+var ErrNoSuchRoute = errors.New("no such route")
+
+func NewEntrypoint() *Entrypoint {
+	return &Entrypoint{
+		findRouteFunc: findRouteAnyDomain,
+	}
+}
+
+func (ep *Entrypoint) SetFindRouteDomains(domains []string) {
+	if len(domains) == 0 {
+		ep.findRouteFunc = findRouteAnyDomain
+	} else {
+		ep.findRouteFunc = findRouteByDomains(domains)
+	}
+}
+
+func (ep *Entrypoint) SetMiddlewares(mws []map[string]any) error {
+	if len(mws) == 0 {
+		ep.middleware = nil
+		return nil
+	}
+
+	mid, err := middleware.BuildMiddlewareFromChainRaw("entrypoint", mws)
+	if err != nil {
+		return err
+	}
+	ep.middleware = mid
+
+	logging.Debug().Msg("entrypoint middleware loaded")
+	return nil
+}
+
+func (ep *Entrypoint) SetAccessLogger(parent task.Parent, cfg *accesslog.Config) (err error) {
+	if cfg == nil {
+		ep.accessLogger = nil
+		return
+	}
+
+	ep.accessLogger, err = accesslog.NewFileAccessLogger(parent, cfg)
+	if err != nil {
+		return
+	}
+	logging.Debug().Msg("entrypoint access logger created")
+	return
+}
+
+func (ep *Entrypoint) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	mux, err := ep.findRouteFunc(r.Host)
+	if err == nil {
+		if ep.accessLogger != nil {
+			w = gphttp.NewModifyResponseWriter(w, r, func(resp *http.Response) error {
+				ep.accessLogger.Log(r, resp)
+				return nil
+			})
+		}
+		if ep.middleware != nil {
+			ep.middleware.ServeHTTP(mux.ServeHTTP, w, r)
+			return
+		}
+		mux.ServeHTTP(w, r)
+		return
+	}
+	// Why use StatusNotFound instead of StatusBadRequest or StatusBadGateway?
+	// On nginx, when route for domain does not exist, it returns StatusBadGateway.
+	// Then scraper / scanners will know the subdomain is invalid.
+	// With StatusNotFound, they won't know whether it's the path, or the subdomain that is invalid.
+	if served := middleware.ServeStaticErrorPageFile(w, r); !served {
+		logging.Err(err).
+			Str("method", r.Method).
+			Str("url", r.URL.String()).
+			Str("remote", r.RemoteAddr).
+			Msg("request")
+		errorPage, ok := errorpage.GetErrorPageByStatus(http.StatusNotFound)
+		if ok {
+			w.WriteHeader(http.StatusNotFound)
+			w.Header().Set("Content-Type", "text/html; charset=utf-8")
+			if _, err := w.Write(errorPage); err != nil {
+				logging.Err(err).Msg("failed to write error page")
+			}
+		} else {
+			http.Error(w, err.Error(), http.StatusNotFound)
+		}
+	}
+}
+
+func findRouteAnyDomain(host string) (route.HTTPRoute, error) {
+	hostSplit := strutils.SplitRune(host, '.')
+	target := hostSplit[0]
+
+	if r, ok := routes.GetHTTPRouteOrExact(target, host); ok {
+		return r, nil
+	}
+	return nil, fmt.Errorf("%w: %s", ErrNoSuchRoute, target)
+}
+
+func findRouteByDomains(domains []string) func(host string) (route.HTTPRoute, error) {
+	return func(host string) (route.HTTPRoute, error) {
+		for _, domain := range domains {
+			if strings.HasSuffix(host, domain) {
+				target := strings.TrimSuffix(host, domain)
+				if r, ok := routes.GetHTTPRoute(target); ok {
+					return r, nil
+				}
+			}
+		}
+
+		// fallback to exact match
+		if r, ok := routes.GetHTTPRoute(host); ok {
+			return r, nil
+		}
+		return nil, fmt.Errorf("%w: %s", ErrNoSuchRoute, host)
+	}
+}

internal/entrypoint/entrypoint_test.go

@@ -0,0 +1,121 @@
+package entrypoint
+
+import (
+	"testing"
+
+	"github.com/yusing/go-proxy/internal/route"
+	"github.com/yusing/go-proxy/internal/route/routes"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+var (
+	r  route.ReveseProxyRoute
+	ep = NewEntrypoint()
+)
+
+func run(t *testing.T, match []string, noMatch []string) {
+	t.Helper()
+	t.Cleanup(routes.TestClear)
+	t.Cleanup(func() { ep.SetFindRouteDomains(nil) })
+
+	for _, test := range match {
+		t.Run(test, func(t *testing.T) {
+			found, err := ep.findRouteFunc(test)
+			ExpectNoError(t, err)
+			ExpectTrue(t, found == &r)
+		})
+	}
+
+	for _, test := range noMatch {
+		t.Run(test, func(t *testing.T) {
+			_, err := ep.findRouteFunc(test)
+			ExpectError(t, ErrNoSuchRoute, err)
+		})
+	}
+}
+
+func TestFindRouteAnyDomain(t *testing.T) {
+	routes.SetHTTPRoute("app1", &r)
+
+	tests := []string{
+		"app1.com",
+		"app1.domain.com",
+		"app1.sub.domain.com",
+	}
+	testsNoMatch := []string{
+		"sub.app1.com",
+		"app2.com",
+		"app2.domain.com",
+		"app2.sub.domain.com",
+	}
+
+	run(t, tests, testsNoMatch)
+}
+
+func TestFindRouteExactHostMatch(t *testing.T) {
+	tests := []string{
+		"app2.com",
+		"app2.domain.com",
+		"app2.sub.domain.com",
+	}
+	testsNoMatch := []string{
+		"sub.app2.com",
+		"app1.com",
+		"app1.domain.com",
+		"app1.sub.domain.com",
+	}
+
+	for _, test := range tests {
+		routes.SetHTTPRoute(test, &r)
+	}
+
+	run(t, tests, testsNoMatch)
+}
+
+func TestFindRouteByDomains(t *testing.T) {
+	ep.SetFindRouteDomains([]string{
+		".domain.com",
+		".sub.domain.com",
+	})
+
+	routes.SetHTTPRoute("app1", &r)
+
+	tests := []string{
+		"app1.domain.com",
+		"app1.sub.domain.com",
+	}
+	testsNoMatch := []string{
+		"sub.app1.com",
+		"app1.com",
+		"app1.domain.co",
+		"app1.domain.com.hk",
+		"app1.sub.domain.co",
+		"app2.domain.com",
+		"app2.sub.domain.com",
+	}
+
+	run(t, tests, testsNoMatch)
+}
+
+func TestFindRouteByDomainsExactMatch(t *testing.T) {
+	ep.SetFindRouteDomains([]string{
+		".domain.com",
+		".sub.domain.com",
+	})
+
+	routes.SetHTTPRoute("app1.foo.bar", &r)
+
+	tests := []string{
+		"app1.foo.bar", // exact match
+		"app1.foo.bar.domain.com",
+		"app1.foo.bar.sub.domain.com",
+	}
+	testsNoMatch := []string{
+		"sub.app1.foo.bar",
+		"sub.app1.foo.bar.com",
+		"app1.domain.com",
+		"app1.sub.domain.com",
+	}
+
+	run(t, tests, testsNoMatch)
+}

internal/error/base.go

@@ -0,0 +1,64 @@
+package err
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+)
+
+// baseError is an immutable wrapper around an error.
+//
+//nolint:recvcheck
+type baseError struct {
+	Err error `json:"err"`
+}
+
+func (err *baseError) Unwrap() error {
+	return err.Err
+}
+
+func (err *baseError) Is(other error) bool {
+	if other, ok := other.(*baseError); ok {
+		return errors.Is(err.Err, other.Err)
+	}
+	return errors.Is(err.Err, other)
+}
+
+func (err baseError) Subject(subject string) Error {
+	err.Err = PrependSubject(subject, err.Err)
+	return &err
+}
+
+func (err *baseError) Subjectf(format string, args ...any) Error {
+	if len(args) > 0 {
+		return err.Subject(fmt.Sprintf(format, args...))
+	}
+	return err.Subject(format)
+}
+
+func (err baseError) With(extra error) Error {
+	return &nestedError{&err, []error{extra}}
+}
+
+func (err baseError) Withf(format string, args ...any) Error {
+	return &nestedError{&err, []error{fmt.Errorf(format, args...)}}
+}
+
+func (err *baseError) Error() string {
+	return err.Err.Error()
+}
+
+// MarshalJSON implements the json.Marshaler interface.
+func (err *baseError) MarshalJSON() ([]byte, error) {
+	//nolint:errorlint
+	switch err := err.Err.(type) {
+	case Error, *withSubject:
+		return json.Marshal(err)
+	case json.Marshaler:
+		return err.MarshalJSON()
+	case interface{ MarshalText() ([]byte, error) }:
+		return err.MarshalText()
+	default:
+		return json.Marshal(err.Error())
+	}
+}

internal/error/builder.go

@@ -0,0 +1,124 @@
+package err
+
+import (
+	"fmt"
+	"sync"
+)
+
+type Builder struct {
+	about string
+	errs  []error
+	sync.Mutex
+}
+
+func NewBuilder(about string) *Builder {
+	return &Builder{about: about}
+}
+
+func (b *Builder) About() string {
+	if !b.HasError() {
+		return ""
+	}
+	return b.about
+}
+
+//go:inline
+func (b *Builder) HasError() bool {
+	return len(b.errs) > 0
+}
+
+func (b *Builder) error() Error {
+	if !b.HasError() {
+		return nil
+	}
+	return &nestedError{Err: New(b.about), Extras: b.errs}
+}
+
+func (b *Builder) Error() Error {
+	if len(b.errs) == 1 {
+		return From(b.errs[0])
+	}
+	return b.error()
+}
+
+func (b *Builder) String() string {
+	err := b.error()
+	if err == nil {
+		return ""
+	}
+	return err.Error()
+}
+
+// Add adds an error to the Builder.
+//
+// adding nil is no-op.
+func (b *Builder) Add(err error) *Builder {
+	if err == nil {
+		return b
+	}
+
+	b.Lock()
+	defer b.Unlock()
+
+	switch err := From(err).(type) {
+	case *baseError:
+		b.errs = append(b.errs, err.Err)
+	case *nestedError:
+		if err.Err == nil {
+			b.errs = append(b.errs, err.Extras...)
+		} else {
+			b.errs = append(b.errs, err)
+		}
+	default:
+		panic("bug: should not reach here")
+	}
+
+	return b
+}
+
+func (b *Builder) Adds(err string) *Builder {
+	b.Lock()
+	defer b.Unlock()
+	b.errs = append(b.errs, newError(err))
+	return b
+}
+
+func (b *Builder) Addf(format string, args ...any) *Builder {
+	if len(args) > 0 {
+		b.Lock()
+		defer b.Unlock()
+		b.errs = append(b.errs, fmt.Errorf(format, args...))
+	} else {
+		b.Adds(format)
+	}
+
+	return b
+}
+
+func (b *Builder) AddFrom(other *Builder, flatten bool) *Builder {
+	if other == nil || !other.HasError() {
+		return b
+	}
+
+	b.Lock()
+	defer b.Unlock()
+	if flatten {
+		b.errs = append(b.errs, other.errs...)
+	} else {
+		b.errs = append(b.errs, other.error())
+	}
+	return b
+}
+
+func (b *Builder) AddRange(errs ...error) *Builder {
+	b.Lock()
+	defer b.Unlock()
+
+	for _, err := range errs {
+		if err != nil {
+			b.errs = append(b.errs, err)
+		}
+	}
+
+	return b
+}