remove next-release.md

- save ACME private key to reuse previous registered ACME account
- properly renew certificate with `Certificate.RenewWithOptions` instead of re-obtaining with `Certificate.Obtain`

.trunk/trunk.yaml

@@ -2,17 +2,17 @@
 # To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
 version: 0.1
 cli:
-  version: 1.22.6
+  version: 1.22.8
 # Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
 plugins:
   sources:
     - id: trunk
-      ref: v1.6.3
+      ref: v1.6.6
       uri: https://github.com/trunk-io/plugins
 # Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
 runtimes:
   enabled:
-    - node@18.12.1
+    - node@18.20.5
     - python@3.10.8
     - go@1.23.2
 # This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
@@ -21,18 +21,18 @@ lint:
     - markdownlint
     - yamllint
   enabled:
-    - hadolint@2.12.0
-    - actionlint@1.7.3
-    - checkov@3.2.257
+    - hadolint@2.12.1-beta
+    - actionlint@1.7.5
+    - checkov@3.2.346
     - git-diff-check
     - gofmt@1.20.4
-    - golangci-lint@1.61.0
-    - osv-scanner@1.9.0
-    - oxipng@9.1.2
-    - prettier@3.3.3
+    - golangci-lint@1.62.2
+    - osv-scanner@1.9.2
+    - oxipng@9.1.3
+    - prettier@3.4.2
     - shellcheck@0.10.0
     - shfmt@3.6.0
-    - trufflehog@3.82.7
+    - trufflehog@3.88.0
 actions:
   disabled:
     - trunk-announce

.vscode/settings.example.json

@@ -1,10 +1,10 @@
 {
   "yaml.schemas": {
-    "https://github.com/yusing/go-proxy/raw/main/schema/config.schema.json": [
+    "https://github.com/yusing/go-proxy/raw/v0.8/schema/config.schema.json": [
       "config.example.yml",
       "config.yml"
     ],
-    "https://github.com/yusing/go-proxy/raw/main/schema/providers.schema.json": [
+    "https://github.com/yusing/go-proxy/raw/v0.8/schema/providers.schema.json": [
       "providers.example.yml"
     ]
   }

Dockerfile

@@ -1,5 +1,9 @@
 # Stage 1: Builder
-FROM golang:1.23.3-alpine AS builder
+FROM golang:1.23.4-alpine AS builder
+HEALTHCHECK NONE
+
+# package version does not matter
+# trunk-ignore(hadolint/DL3018)
 RUN apk add --no-cache tzdata make
 
 WORKDIR /src
@@ -18,12 +22,12 @@ ENV VERSION=${VERSION}
 
 COPY scripts /src/scripts
 COPY Makefile /src/
+COPY cmd /src/cmd
+COPY internal /src/internal
+COPY pkg /src/pkg
 
 RUN --mount=type=cache,target="/go/pkg/mod" \
     --mount=type=cache,target="/root/.cache/go-build" \
-    --mount=type=bind,src=cmd,dst=/src/cmd \
-    --mount=type=bind,src=internal,dst=/src/internal \
-    --mount=type=bind,src=pkg,dst=/src/pkg \
     make build && \
     mkdir -p /app/error_pages /app/certs && \
     mv bin/godoxy /app/godoxy
@@ -40,15 +44,15 @@ COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
 # copy binary
 COPY --from=builder /app /app
 
-# copy schema directory
-COPY schema/ /app/schema/
-
 # copy example config
 COPY config.example.yml /app/config/config.yml
 
 # copy certs
 COPY --from=builder /etc/ssl/certs /etc/ssl/certs
 
+# copy schema
+COPY schema /app/schema
+
 ENV DOCKER_HOST=unix:///var/run/docker.sock
 ENV GODOXY_DEBUG=0
 
@@ -58,4 +62,4 @@ EXPOSE 443
 
 WORKDIR /app
 
-CMD ["/app/godoxy"]
+CMD ["/app/godoxy"]

Makefile

@@ -1,5 +1,6 @@
 VERSION ?= $(shell git describe --tags --abbrev=0)
-BUILD_FLAGS ?= -s -w -X github.com/yusing/go-proxy/pkg.version=${VERSION}
+BUILD_FLAGS ?= -s -w
+BUILD_DATE ?= $(shell date -u +'%Y%m%d-%H%M')
 export VERSION
 export BUILD_FLAGS
 export CGO_ENABLED = 0
@@ -28,10 +29,10 @@ get:
 	go get -u ./cmd && go mod tidy
 
 debug:
-	GODOXY_DEBUG=1 make run
+	GODOXY_DEBUG=1 BUILD_FLAGS="" make run
 
 debug-trace:
-	GODOXY_DEBUG=1 GODOXY_TRACE=1 run
+	GODOXY_TRACE=1 make debug
 
 profile:
 	GODEBUG=gctrace=1 make debug
@@ -43,15 +44,6 @@ run: build
 mtrace:
 	bin/godoxy debug-ls-mtrace > mtrace.json
 
-archive:
-	git archive HEAD -o ../go-proxy-$$(date +"%Y%m%d%H%M").zip
-
-repush:
-	git reset --soft HEAD^
-	git add -A
-	git commit -m "repush"
-	git push gitlab dev --force
-
 rapid-crash:
 	sudo docker run --restart=always --name test_crash -p 80 debian:bookworm-slim /bin/cat &&\
 	sleep 3 &&\
@@ -65,4 +57,17 @@ ci-test:
 	act -n --artifact-server-path /tmp/artifacts -s GITHUB_TOKEN="$$(gh auth token)"
 
 cloc:
-	cloc --not-match-f '_test.go$$' cmd internal pkg
+	cloc --not-match-f '_test.go$$' cmd internal pkg
+
+push-docker-io:
+	BUILDER=build docker buildx build \
+		--platform linux/arm64,linux/amd64 \
+		-f Dockerfile \
+		-t docker.io/yusing/godoxy-nightly \
+		-t docker.io/yusing/godoxy-nightly:${VERSION}-${BUILD_DATE} \
+		--build-arg VERSION="${VERSION}-nightly-${BUILD_DATE}" \
+		--push .
+
+build-docker:
+	docker build -t godoxy-nightly \
+		--build-arg VERSION="${VERSION}-nightly-${BUILD_DATE}" .

README.md

@@ -34,68 +34,70 @@ _Join our [Discord](https://discord.gg/umReR62nRd) for help and discussions_
 
 ## Key Features
 
--   Easy to use
-    -   Effortless configuration
-    -   Simple multi-node setup
-    -   Error messages is clear and detailed, easy troubleshooting
--   Auto SSL cert management (See [Supported DNS-01 Challenge Providers](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers)) 
--   Auto configuration for docker containers
--   Auto hot-reload on container state / config file changes
--   **idlesleeper**: stop containers on idle, wake it up on traffic _(optional, see [screenshots](#idlesleeper))_
--   HTTP(s) reserve proxy
--   [HTTP middleware support](https://github.com/yusing/go-proxy/wiki/Middlewares)
--   [Custom error pages support](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
--   TCP and UDP port forwarding
--   **Web UI with App dashboard**
--   Supports linux/amd64, linux/arm64
--   Written in **[Go](https://go.dev)**
+- Easy to use
+  - Effortless configuration
+  - Simple multi-node setup
+  - Error messages is clear and detailed, easy troubleshooting
+- Auto SSL cert management (See [Supported DNS-01 Challenge Providers](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers))
+- Auto configuration for docker containers
+- Auto hot-reload on container state / config file changes
+- **idlesleeper**: stop containers on idle, wake it up on traffic _(optional, see [screenshots](#idlesleeper))_
+- HTTP(s) reserve proxy
+- [HTTP middleware support](https://github.com/yusing/go-proxy/wiki/Middlewares)
+- [Custom error pages support](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
+- TCP and UDP port forwarding
+- **Web UI with App dashboard and config editor**
+- Supports linux/amd64, linux/arm64
+- Written in **[Go](https://go.dev)**
 
 [🔼Back to top](#table-of-content)
 
 ## Getting Started
 
+For full documentation, **[See Wiki](https://github.com/yusing/go-proxy/wiki)**
+
 ### Prerequisites
 
 Setup DNS Records point to machine which runs `GoDoxy`, e.g.
 
--   A Record: `*.y.z` -> `10.0.10.1`
--   AAAA Record: `*.y.z` -> `::ffff:a00:a01`
+- A Record: `*.y.z` -> `10.0.10.1`
+- AAAA Record: `*.y.z` -> `::ffff:a00:a01`
 
 ### Setup
 
 1.  Pull the latest docker images
-    
+
     ```shell
     docker pull ghcr.io/yusing/go-proxy:latest
     ```
 
-2.  Create new directory, `cd` into it, then run setup, or [set up manually](#manual-setup) 
+2.  Create new directory, `cd` into it, then run setup, or [set up manually](#manual-setup)
 
     ```shell
     docker run --rm -v .:/setup ghcr.io/yusing/go-proxy /app/godoxy setup
     ```
 
-3. _(Optional)_ setup WebUI login
+3.  _(Optional)_ setup WebUI login
 
     - set random JWT secret
-        ```shell
-        sed -i "s|API_JWT_SECRET=.*|API_JWT_SECRET=$(openssl rand -base64 32)|g" .env
-        ```
+
+      ```shell
+      sed -i "s|API_JWT_SECRET=.*|API_JWT_SECRET=$(openssl rand -base64 32)|g" .env
+      ```
 
     - change username and password for WebUI authentication
-        ```shell
-        sed -i "s|API_USERNAME=.*|API_USERNAME=admin|g" .env
-        sed -i "s|API_PASSWORD=.*|API_PASSWORD=some-strong-password|g" .env
-        ```
+      ```shell
+      sed -i "s|API_USERNAME=.*|API_USERNAME=admin|g" .env
+      sed -i "s|API_PASSWORD=.*|API_PASSWORD=some-strong-password|g" .env
+      ```
 
 4.  _(Optional)_ setup `docker-socket-proxy` other docker nodes (see [Multi docker nodes setup](https://github.com/yusing/go-proxy/wiki/Configurations#multi-docker-nodes-setup)) then add them inside `config.yml`
 
 5.  Start the container `docker compose up -d`
 
 6.  You may now do some extra configuration
-    -   With text editor (e.g. Visual Studio Code)
-    -   With Web UI via `http://localhost:3000` or `https://gp.y.z`
-    -   For more info, [See Wiki]([wiki](https://github.com/yusing/go-proxy/wiki))
+    - With text editor (e.g. Visual Studio Code)
+    - With Web UI via `https://gp.y.z`
 
 [🔼Back to top](#table-of-content)
 
@@ -103,15 +105,15 @@ Setup DNS Records point to machine which runs `GoDoxy`, e.g.
 
 1. Make `config` directory then grab `config.example.yml` into `config/config.yml`
 
-    `mkdir -p config && wget https://raw.githubusercontent.com/yusing/go-proxy/v0.7/config.example.yml -O config/config.yml`
+   `mkdir -p config && wget https://raw.githubusercontent.com/yusing/go-proxy/v0.8/config.example.yml -O config/config.yml`
 
 2. Grab `.env.example` into `.env`
-   
-    `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.7/.env.example -O .env`
+
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.8/.env.example -O .env`
 
 3. Grab `compose.example.yml` into `compose.yml`
-   
-   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.7/compose.example.yml -O compose.yml`
+
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.8/compose.example.yml -O compose.yml`
 
 ### Folder structrue
 
@@ -142,7 +144,6 @@ Copy [`.vscode/settings.example.json`](.vscode/settings.example.json) to `.vscod
 
 ![idlesleeper](screenshots/idlesleeper.webp)
 
-
 [🔼Back to top](#table-of-content)
 
 ## Build it yourself

README_CHT.md

@@ -1,4 +1,4 @@
-# go-proxy
+# GoDoxy
 
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
 [![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
@@ -7,124 +7,155 @@
 [![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
 [![](https://dcbadge.limes.pink/api/server/umReR62nRd)](https://discord.gg/umReR62nRd)
 
-一個輕量化、易用且[高效]([docs/benchmark_result.md](https://github.com/yusing/go-proxy/wiki/Benchmarks)))的反向代理和端口轉發工具
+[English Documentation](README.md)
+
+一個輕量級、易於使用且[高效能](https://github.com/yusing/go-proxy/wiki/Benchmarks)的反向代理，具有網頁介面和儀表板。
+
+![截圖](screenshots/webui.png)
+
+_加入我們的 [Discord](https://discord.gg/umReR62nRd) 獲取幫助和討論_
 
 ## 目錄
 
 <!-- TOC -->
 
-- [go-proxy](#go-proxy)
+- [GoDoxy](#godoxy)
   - [目錄](#目錄)
-  - [重點](#重點)
+  - [主要特點](#主要特點)
   - [入門指南](#入門指南)
+    - [前置需求](#前置需求)
     - [安裝](#安裝)
-    - [命令行參數](#命令行參數)
-    - [環境變量](#環境變量)
-    - [VSCode 中使用 JSON Schema](#vscode-中使用-json-schema)
-  - [展示](#展示)
-    - [idlesleeper](#idlesleeper)
-  - [源碼編譯](#源碼編譯)
+    - [手動安裝](#手動安裝)
+    - [資料夾結構](#資料夾結構)
+    - [在 VSCode 中使用 JSON Schema](#在-vscode-中使用-json-schema)
+  - [截圖](#截圖)
+    - [閒置休眠](#閒置休眠)
+  - [自行編譯](#自行編譯)
 
-## 重點
+## 主要特點
 
--   易用
-    -   不需花費太多時間就能輕鬆配置
-    -   支持多個docker節點
-    -   除錯簡單
--   自動配置 SSL 證書（參見[可用的 DNS 供應商](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers)）
--   透過 Docker 容器自動配置
--   容器狀態變更時自動熱重載
--   **idlesleeper** 容器閒置時自動暫停/停止，入站時自動喚醒 (可選, 參見 [展示](#idlesleeper))
--   HTTP(s) 反向代理
--   [HTTP middleware](https://github.com/yusing/go-proxy/wiki/Middlewares)
--   [自訂 error pages](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
--   TCP/UDP 端口轉發
--   Web 面板 (內置App dashboard)
--   支持 linux/amd64、linux/arm64 平台
--   使用 **[Go](https://go.dev)** 編寫
+- 容易使用
+  - 輕鬆配置
+  - 簡單的多節點設置
+  - 錯誤訊息清晰詳細，易於排除故障
+- 自動 SSL 憑證管理（參見 [支援的 DNS-01 驗證提供商](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers)）
+- 自動配置 Docker 容器
+- 容器狀態/配置文件變更時自動熱重載
+- **閒置休眠**：在閒置時停止容器，有流量時喚醒（_可選，參見[截圖](#閒置休眠)_）
+- HTTP(s) 反向代理
+- [HTTP 中介軟體支援](https://github.com/yusing/go-proxy/wiki/Middlewares)
+- [自訂錯誤頁面支援](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
+- TCP 和 UDP 埠轉發
+- **網頁介面，具有應用儀表板和配置編輯器**
+- 支援 linux/amd64、linux/arm64
+- 使用 **[Go](https://go.dev)** 編寫
 
-[🔼 返回頂部](#目錄)
+[🔼回到頂部](#目錄)
 
 ## 入門指南
 
+完整文檔請參見 **[Wiki](https://github.com/yusing/go-proxy/wiki)**
+
+### 前置需求
+
+設置 DNS 記錄指向運行 `GoDoxy` 的機器，例如：
+
+- A 記錄：`*.y.z` -> `10.0.10.1`
+- AAAA 記錄：`*.y.z` -> `::ffff:a00:a01`
+
 ### 安裝
 
-1. 抓取Docker鏡像
+1.  拉取最新的 Docker 映像
 
     ```shell
     docker pull ghcr.io/yusing/go-proxy:latest
     ```
 
-2. 建立新的目錄，並切換到該目錄，並執行
-   
-   ```shell
-    docker run --rm -v .:/setup ghcr.io/yusing/go-proxy /app/go-proxy setup
+2.  建立新目錄，`cd` 進入後運行安裝，或[手動安裝](#手動安裝)
+
+    ```shell
+    docker run --rm -v .:/setup ghcr.io/yusing/go-proxy /app/godoxy setup
     ```
 
-3. 設置 DNS 記錄，例如：
+3.  _（可選）_ 設置網頁介面登入
 
-    - A 記錄: `*.y.z` -> `10.0.10.1`
-    - AAAA 記錄: `*.y.z` -> `::ffff:a00:a01`
+    - 設置隨機 JWT 密鑰
 
-4. 配置 `docker-socket-proxy` 其他 Docker 節點（如有） (參見 [範例](docs/docker_socket_proxy.md)) 然後加到 `config.yml` 中
+      ```shell
+      sed -i "s|API_JWT_SECRET=.*|API_JWT_SECRET=$(openssl rand -base64 32)|g" .env
+      ```
 
-5. 大功告成，你可以做一些額外的配置
-    - 使用文本編輯器 (推薦 Visual Studio Code [參見 VSCode 使用 schema](#vscode-中使用-json-schema))
-    - 或通過 `http://localhost:3000` 使用網頁配置編輯器
-    - 詳情請參閱 [docker.md](docs/docker.md)
+    - 更改網頁介面認證的使用者名稱和密碼
+      ```shell
+      sed -i "s|API_USERNAME=.*|API_USERNAME=admin|g" .env
+      sed -i "s|API_PASSWORD=.*|API_PASSWORD=some-strong-password|g" .env
+      ```
 
-[🔼 返回頂部](#目錄)
+4.  _（可選）_ 設置其他 Docker 節點的 `docker-socket-proxy`（參見 [多 Docker 節點設置](https://github.com/yusing/go-proxy/wiki/Configurations#multi-docker-nodes-setup)），然後在 `config.yml` 中添加它們
 
-### 命令行參數
+5.  啟動容器 `docker compose up -d`
 
-| 參數                      | 描述                                                                                  | 示例                                |
-| ------------------------- | ------------------------------------------------------------------------------------- | ----------------------------------- |
-| 空                        | 啟動代理服務器                                                                        |                                     |
-| `validate`                | 驗證配置並退出                                                                        |                                     |
-| `reload`                  | 強制刷新配置                                                                          |                                     |
-| `ls-config`               | 列出配置並退出                                                                        | `go-proxy ls-config \| jq`          |
-| `ls-route`                | 列出路由並退出                                                                        | `go-proxy ls-route \| jq`           |
-| `go-proxy ls-route \| jq` |
-| `ls-icons`                | 列出 [dashboard-icons](https://github.com/walkxcode/dashboard-icons/tree/main) 並退出 | `go-proxy ls-icons \| grep adguard` |
-| `debug-ls-mtrace`         | 列出middleware追蹤 **(僅限於 debug 模式)**                                            | `go-proxy debug-ls-mtrace \| jq`    |
+6.  現在您可以進行額外的配置
+    - 使用文字編輯器（如 Visual Studio Code）
+    - 通過網頁介面 `https://gp.y.z`
 
-**使用 `docker exec go-proxy /app/go-proxy <參數>` 運行**
+[🔼回到頂部](#目錄)
 
-### 環境變量
+### 手動安裝
 
-| 環境變量                       | 描述             | 默認             | 格式          |
-| ------------------------------ | ---------------- | ---------------- | ------------- |
-| `GOPROXY_NO_SCHEMA_VALIDATION` | 禁用 schema 驗證 | `false`          | boolean       |
-| `GOPROXY_DEBUG`                | 啟用調試輸出     | `false`          | boolean       |
-| `GOPROXY_HTTP_ADDR`            | http 收聽地址    | `:80`            | `[host]:port` |
-| `GOPROXY_HTTPS_ADDR`           | https 收聽地址   | `:443`           | `[host]:port` |
-| `GOPROXY_API_ADDR`             | api 收聽地址     | `127.0.0.1:8888` | `[host]:port` |
+1. 建立 `config` 目錄，然後將 `config.example.yml` 下載到 `config/config.yml`
 
-### VSCode 中使用 JSON Schema
+   `mkdir -p config && wget https://raw.githubusercontent.com/yusing/go-proxy/v0.8/config.example.yml -O config/config.yml`
 
-複製 [`.vscode/settings.example.json`](.vscode/settings.example.json) 到 `.vscode/settings.json` 並根據需求修改
+2. 將 `.env.example` 下載到 `.env`
 
-[🔼 返回頂部](#目錄)
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.8/.env.example -O .env`
 
+3. 將 `compose.example.yml` 下載到 `compose.yml`
 
-## 展示
+   `wget https://raw.githubusercontent.com/yusing/go-proxy/v0.8/compose.example.yml -O compose.yml`
 
-### idlesleeper
+### 資料夾結構
 
-![idlesleeper](screenshots/idlesleeper.webp)
+```shell
+├── certs
+│   ├── cert.crt
+│   └── priv.key
+├── compose.yml
+├── config
+│   ├── config.yml
+│   ├── middlewares
+│   │   ├── middleware1.yml
+│   │   ├── middleware2.yml
+│   ├── provider1.yml
+│   └── provider2.yml
+└── .env
+```
 
-[🔼 返回頂部](#目錄)
+### 在 VSCode 中使用 JSON Schema
 
-## 源碼編譯
+複製 [`.vscode/settings.example.json`](.vscode/settings.example.json) 到 `.vscode/settings.json` 並根據需要修改
 
-1. 獲取源碼 `git clone https://github.com/yusing/go-proxy --depth=1`
+[🔼回到頂部](#目錄)
 
-2. 安裝/升級 [go 版本 (>=1.22)](https://go.dev/doc/install) 和 `make`（如果尚未安裝）
+## 截圖
 
-3. 如果之前編譯過（go 版本 < 1.22），請使用 `go clean -cache` 清除緩存
+### 閒置休眠
 
-4. 使用 `make get` 獲取依賴項
+![閒置休眠](screenshots/idlesleeper.webp)
 
-5. 使用 `make build` 編譯
+[🔼回到頂部](#目錄)
 
-[🔼 返回頂部](#目錄)
+## 自行編譯
+
+1. 克隆儲存庫 `git clone https://github.com/yusing/go-proxy --depth=1`
+
+2. 如果尚未安裝，請安裝/升級 [go (>=1.22)](https://go.dev/doc/install) 和 `make`
+
+3. 如果之前編譯過（go < 1.22），請使用 `go clean -cache` 清除快取
+
+4. 使用 `make get` 獲取依賴
+
+5. 使用 `make build` 編譯二進制檔案
+
+[🔼回到頂部](#目錄)

cmd/main.go

@@ -14,12 +14,12 @@ import (
 	"github.com/yusing/go-proxy/internal/api/v1/query"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/config"
+	"github.com/yusing/go-proxy/internal/entrypoint"
 	E "github.com/yusing/go-proxy/internal/error"
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/metrics"
 	"github.com/yusing/go-proxy/internal/net/http/middleware"
-	R "github.com/yusing/go-proxy/internal/route"
-	"github.com/yusing/go-proxy/internal/server"
+	"github.com/yusing/go-proxy/internal/net/http/server"
 	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/pkg"
 )
@@ -132,28 +132,25 @@ func main() {
 	}
 
 	server.StartServer(server.Options{
-		Name:            "proxy",
-		CertProvider:    autocert,
-		HTTPAddr:        common.ProxyHTTPAddr,
-		HTTPSAddr:       common.ProxyHTTPSAddr,
-		Handler:         http.HandlerFunc(R.ProxyHandler),
-		RedirectToHTTPS: config.Value().RedirectToHTTPS,
+		Name:         "proxy",
+		CertProvider: autocert,
+		HTTPAddr:     common.ProxyHTTPAddr,
+		HTTPSAddr:    common.ProxyHTTPSAddr,
+		Handler:      http.HandlerFunc(entrypoint.Handler),
 	})
 	server.StartServer(server.Options{
-		Name:            "api",
-		CertProvider:    autocert,
-		HTTPAddr:        common.APIHTTPAddr,
-		Handler:         api.NewHandler(),
-		RedirectToHTTPS: config.Value().RedirectToHTTPS,
+		Name:         "api",
+		CertProvider: autocert,
+		HTTPAddr:     common.APIHTTPAddr,
+		Handler:      api.NewHandler(),
 	})
 
 	if common.PrometheusEnabled {
 		server.StartServer(server.Options{
-			Name:            "metrics",
-			CertProvider:    autocert,
-			HTTPAddr:        common.MetricsHTTPAddr,
-			Handler:         metrics.NewHandler(),
-			RedirectToHTTPS: config.Value().RedirectToHTTPS,
+			Name:         "metrics",
+			CertProvider: autocert,
+			HTTPAddr:     common.MetricsHTTPAddr,
+			Handler:      metrics.NewHandler(),
 		})
 	}
 
@@ -162,8 +159,7 @@ func main() {
 
 	// grafully shutdown
 	logging.Info().Msg("shutting down")
-	task.CancelGlobalContext()
-	task.GlobalContextWait(time.Second * time.Duration(config.Value().TimeoutShutdown))
+	_ = task.GracefulShutdown(time.Second * time.Duration(config.Value().TimeoutShutdown))
 }
 
 func prepareDirectory(dir string) {

compose.example.yml

@@ -1,42 +1,42 @@
 ---
 services:
-    frontend:
-        image: ghcr.io/yusing/go-proxy-frontend:latest
-        container_name: godoxy-frontend
-        restart: unless-stopped
-        network_mode: host
-        env_file: .env
-        depends_on:
-            - app
-        # modify below to fit your needs
-        labels:
-            proxy.aliases: gp
-            proxy.#1.port: 3000
-            proxy.#1.middlewares.cidr_whitelist.status_code: 403
-            proxy.#1.middlewares.cidr_whitelist.message: IP not allowed
-            proxy.#1.middlewares.cidr_whitelist.allow: |
-                - 127.0.0.1
-                - 10.0.0.0/8
-                - 192.168.0.0/16
-                - 172.16.0.0/12
-    app:
-        image: ghcr.io/yusing/go-proxy:latest
-        container_name: godoxy
-        restart: always
-        network_mode: host
-        env_file: .env
-        volumes:
-            - /var/run/docker.sock:/var/run/docker.sock
-            - ./config:/app/config
-            - ./error_pages:/app/error_pages
+  frontend:
+    image: ghcr.io/yusing/go-proxy-frontend:latest
+    container_name: godoxy-frontend
+    restart: unless-stopped
+    network_mode: host
+    env_file: .env
+    depends_on:
+      - app
+    # modify below to fit your needs
+    labels:
+      proxy.aliases: gp
+      proxy.#1.port: 3000
+      # proxy.#1.middlewares.cidr_whitelist.status: 403
+      # proxy.#1.middlewares.cidr_whitelist.message: IP not allowed
+      # proxy.#1.middlewares.cidr_whitelist.allow: |
+      #     - 127.0.0.1
+      #     - 10.0.0.0/8
+      #     - 192.168.0.0/16
+      #     - 172.16.0.0/12
+  app:
+    image: ghcr.io/yusing/go-proxy:latest
+    container_name: godoxy
+    restart: always
+    network_mode: host
+    env_file: .env
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./config:/app/config
+      - ./error_pages:/app/error_pages
 
-            # (Optional) choose one of below to enable https
-            # 1. use existing certificate
+      # (Optional) choose one of below to enable https
+      # 1. use existing certificate
 
-            # - /path/to/certs/cert.crt:/app/certs/cert.crt
-            # - /path/to/certs/priv.key:/app/certs/priv.key
+      # - /path/to/certs/cert.crt:/app/certs/cert.crt
+      # - /path/to/certs/priv.key:/app/certs/priv.key
 
-            # 2. use autocert, certs will be stored in ./certs
-            #    you can also use a docker volume to store it
+      # 2. use autocert, certs will be stored in ./certs
+      #    you can also use a docker volume to store it
 
-            # - ./certs:/app/certs
+      # - ./certs:/app/certs

config.example.yml

@@ -20,6 +20,60 @@
 #
 # 3. other providers, check docs/dns_providers.md for more
 
+entrypoint:
+  middlewares:
+    # this part blocks all non-LAN HTTP traffic
+    # remove if you don't want this
+    - use: CIDRWhitelist
+      allow:
+        - "127.0.0.1"
+        - "10.0.0.0/8"
+        - "172.16.0.0/12"
+        - "192.168.0.0/16"
+      status: 403
+      message: "Forbidden"
+    # end of CIDRWhitelist
+
+    # this part redirects HTTP to HTTPS
+    # remove if you don't want this
+    - use: RedirectHTTP
+
+  # access_log:
+  #   buffer_size: 1024
+  #   path: /var/log/example.log
+  #   filters:
+  #     status_codes:
+  #       values:
+  #         - 200-299
+  #         - 101
+  #     method:
+  #       values:
+  #         - GET
+  #     host:
+  #       values:
+  #         - example.y.z
+  #     headers:
+  #       negative: true
+  #       values:
+  #         - foo=bar
+  #         - baz
+  #     cidr:
+  #       values:
+  #         - 192.168.10.0/24
+  #   fields:
+  #     headers:
+  #       default: keep
+  #       config:
+  #         foo: redact
+  #     query:
+  #       default: drop
+  #       config:
+  #         foo: keep
+  #     cookies:
+  #       default: redact
+  #       config:
+  #         foo: keep
+
 providers:
   # include files are standalone yaml files under `config/` directory
   #
@@ -41,6 +95,28 @@ providers:
     #
     # remote-1: tcp://10.0.2.1:2375
     # remote-2: ssh://root:1234@10.0.2.2
+
+  # notification providers (notify when service health changes)
+  #
+  # notification:
+  #   - name: gotify
+  #     provider: gotify
+  #     url: https://gotify.domain.tld
+  #     token: abcd
+  #   - name: discord
+  #     provider: webhook
+  #     url: https://discord.com/api/webhooks/...
+  #     template: discord
+  #     # payload: | # discord template implies the following
+  #     #   {
+  #     #     "embeds": [
+  #     #       {
+  #     #         "title": $title,
+  #     #         "fields": $fields,
+  #     #         "color": "$color"
+  #     #       }
+  #     #     ]
+  #     #   }
 # if match_domains not defined
 # any host = alias+[any domain] will match
 # i.e. https://app1.y.z       will match alias app1 for any domain y.z
@@ -58,7 +134,6 @@ providers:
 #   - node1.my.app
 
 # homepage config
-#
 homepage:
   # use default app categories detected from alias or docker image name
   use_default_categories: true
@@ -66,10 +141,4 @@ homepage:
 # Below are fixed options (non hot-reloadable)
 
 # timeout for shutdown (in seconds)
-#
 timeout_shutdown: 5
-
-# global setting redirect http requests to https (if https available, otherwise this will be ignored)
-# proxy.<alias>.middlewares.redirect_http will override this
-#
-redirect_to_https: false

examples/docker-compose/n8n.yml

@@ -0,0 +1,27 @@
+---
+services:
+  n8n:
+    image: n8nio/n8n
+    container_name: n8n
+    restart: always
+    expose:
+      - 5678
+    labels:
+      proxy.n8n.middlewares.request.set_headers: |
+        SSLRedirect: true
+        STSSeconds: 315360000
+        browserXSSFilter: true
+        contentTypeNosniff: true
+        forceSTSHeader: true
+        SSLHost: ${DOMAIN_NAME}
+        STSIncludeSubdomains: true
+        STSPreload: true
+    environment:
+      - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
+      - N8N_PORT=5678
+      - N8N_PROTOCOL=https
+      - NODE_ENV=production
+      - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
+      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
+    volumes:
+      - ./data:/home/node/.n8n

go.mod

@@ -1,22 +1,22 @@
 module github.com/yusing/go-proxy
 
-go 1.23.3
+go 1.23.4
 
 require (
 	github.com/coder/websocket v1.8.12
-	github.com/docker/cli v27.3.1+incompatible
-	github.com/docker/docker v27.3.1+incompatible
+	github.com/docker/cli v27.4.1+incompatible
+	github.com/docker/docker v27.4.1+incompatible
 	github.com/fsnotify/fsnotify v1.8.0
-	github.com/go-acme/lego/v4 v4.19.2
+	github.com/go-acme/lego/v4 v4.21.0
+	github.com/go-playground/validator/v10 v10.23.0
 	github.com/golang-jwt/jwt/v5 v5.2.1
-	github.com/gotify/server/v2 v2.5.0
+	github.com/gotify/server/v2 v2.6.1
 	github.com/prometheus/client_golang v1.20.5
 	github.com/puzpuzpuz/xsync/v3 v3.4.0
 	github.com/rs/zerolog v1.33.0
-	github.com/santhosh-tekuri/jsonschema v1.2.4
-	golang.org/x/net v0.30.0
-	golang.org/x/text v0.19.0
-	golang.org/x/time v0.7.0
+	golang.org/x/net v0.33.0
+	golang.org/x/text v0.21.0
+	golang.org/x/time v0.9.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -25,19 +25,23 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cloudflare/cloudflare-go v0.109.0 // indirect
+	github.com/cloudflare/cloudflare-go v0.113.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
 	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/goccy/go-json v0.10.3 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/goccy/go-json v0.10.4 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/miekg/dns v1.1.62 // indirect
@@ -50,23 +54,23 @@ require (
 	github.com/ovh/go-ovh v1.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.60.1 // indirect
+	github.com/prometheus/common v0.61.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/rogpeppe/go-internal v1.13.1 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 // indirect
-	go.opentelemetry.io/otel v1.31.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.33.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 // indirect
-	go.opentelemetry.io/otel/metric v1.31.0 // indirect
+	go.opentelemetry.io/otel/metric v1.33.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.30.0 // indirect
-	go.opentelemetry.io/otel/trace v1.31.0 // indirect
-	golang.org/x/crypto v0.28.0 // indirect
-	golang.org/x/mod v0.21.0 // indirect
-	golang.org/x/oauth2 v0.23.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.26.0 // indirect
-	golang.org/x/tools v0.26.0 // indirect
-	google.golang.org/protobuf v1.35.1 // indirect
+	go.opentelemetry.io/otel/trace v1.33.0 // indirect
+	golang.org/x/crypto v0.31.0 // indirect
+	golang.org/x/mod v0.22.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
+	golang.org/x/sys v0.29.0 // indirect
+	golang.org/x/tools v0.28.0 // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gotest.tools/v3 v3.5.1 // indirect
 )

go.sum

@@ -8,8 +8,8 @@ github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK3
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cloudflare/cloudflare-go v0.109.0 h1:Wjp+RfJD1lidIFUlrTBqUQnCBrUnmVsLxgzWYiURueg=
-github.com/cloudflare/cloudflare-go v0.109.0/go.mod h1:m492eNahT/9MsN7Ppnoge8AaI7QhVFtEgVm3I9HJFeU=
+github.com/cloudflare/cloudflare-go v0.113.0 h1:qnOXmA6RbgZ4rg5gNBK5QGk0Pzbv8pnUYV3C4+8CU6w=
+github.com/cloudflare/cloudflare-go v0.113.0/go.mod h1:Dlm4BAnycHc0i8yLxQZb9b+OlMwYOAoDJsUOEFgpVvo=
 github.com/coder/websocket v1.8.12 h1:5bUXkEPPIbewrnkU8LTCLVaxi4N4J8ahufH2vlo4NAo=
 github.com/coder/websocket v1.8.12/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
@@ -21,10 +21,10 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v27.3.1+incompatible h1:qEGdFBF3Xu6SCvCYhc7CzaQTlBmqDuzxPDpigSyeKQQ=
-github.com/docker/cli v27.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v27.3.1+incompatible h1:KttF0XoteNTicmUtBO0L2tP+J7FGRFTjaEF4k6WdhfI=
-github.com/docker/docker v27.3.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v27.4.1+incompatible h1:VzPiUlRJ/xh+otB75gva3r05isHMo5wXDfPRi5/b4hI=
+github.com/docker/cli v27.4.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v27.4.1+incompatible h1:ZJvcY7gfwHn1JF48PfbyXg7Jyt9ZCWDW+GGXOIxEwp4=
+github.com/docker/docker v27.4.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -33,8 +33,10 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
 github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-acme/lego/v4 v4.19.2 h1:Y8hrmMvWETdqzzkRly7m98xtPJJivWFsgWi8fcvZo+Y=
-github.com/go-acme/lego/v4 v4.19.2/go.mod h1:wtDe3dDkmV4/oI2nydpNXSJpvV10J9RCyZ6MbYxNtlQ=
+github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
+github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/go-acme/lego/v4 v4.21.0 h1:arEW+8o5p7VI8Bk1kr/PDlgD1DrxtTH1gJ4b7mehL8o=
+github.com/go-acme/lego/v4 v4.21.0/go.mod h1:HrSWzm3Ckj45Ie3i+p1zKVobbQoMOaGu9m4up0dUeDI=
 github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
 github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -42,8 +44,16 @@ github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
-github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.23.0 h1:/PwmTwZhS0dPkav3cdK9kV1FsAmrL8sThn8IHr/sO+o=
+github.com/go-playground/validator/v10 v10.23.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
+github.com/goccy/go-json v0.10.4 h1:JSwxQzIqKfmFX1swYPpUThQZp/Ka4wzJdK0LWVytLPM=
+github.com/goccy/go-json v0.10.4/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
@@ -56,8 +66,8 @@ github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gotify/server/v2 v2.5.0 h1:tJd+a5bb17X52f0EV2KxqLuyjQFKmVK1+t/iNUkP16Y=
-github.com/gotify/server/v2 v2.5.0/go.mod h1:DKPMQI/FZ69iKbZvrOL6VWwRaoB9O+HDvJWVd/kiGbc=
+github.com/gotify/server/v2 v2.6.1 h1:Kf7v5fzBxzELzZa/jonWfwJMkqYqh1LBzBpCmt5QIAI=
+github.com/gotify/server/v2 v2.6.1/go.mod h1:Dk8HLyTVDqmXM8YEg6tjROBen6mxyHZFRggJFHTwZLc=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1NhHmEPPzzuhWgcza5M1Ji1I=
 github.com/jarcoal/httpmock v1.3.0 h1:2RJ8GP0IIaWwcC9Fp2BmVi8Kog3v2Hn7VXM3fTd+nuc=
@@ -72,6 +82,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
@@ -105,8 +117,8 @@ github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+
 github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.60.1 h1:FUas6GcOw66yB/73KC+BOZoFJmbo/1pojoILArPAaSc=
-github.com/prometheus/common v0.60.1/go.mod h1:h0LYf1R1deLSKtD4Vdg8gy4RuOvENW2J/h19V5NADQw=
+github.com/prometheus/common v0.61.0 h1:3gv/GThfX0cV2lpO7gkTUwZru38mxevy90Bj8YFSRQQ=
+github.com/prometheus/common v0.61.0/go.mod h1:zr29OCN/2BsJRaFwG8QOBr41D6kkchKbpeNH7pAjb/s=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/puzpuzpuz/xsync/v3 v3.4.0 h1:DuVBAdXuGFHv8adVXjWWZ63pJq+NRXOWVXlKDBZ+mJ4=
@@ -116,54 +128,54 @@ github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWN
 github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8=
 github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
-github.com/santhosh-tekuri/jsonschema v1.2.4 h1:hNhW8e7t+H1vgY+1QeEQpveR6D4+OwKPXCfD2aieJis=
-github.com/santhosh-tekuri/jsonschema v1.2.4/go.mod h1:TEAUOeZSmIxTTuHatJzrvARHiuO9LYd+cIxzgEHCQI4=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 h1:UP6IpuHFkUgOQL9FFQFrZ+5LiwhhYRbi7VZSIx6Nj5s=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0/go.mod h1:qxuZLtbq5QDtdeSHsS7bcf6EH6uO6jUAgk764zd3rhM=
-go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
-go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
+go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
+go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0 h1:lsInsfvhVIfOI6qHVyysXMNDnjO9Npvl7tlDPJFBVd4=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0/go.mod h1:KQsVNh4OjgjTG0G6EiNi1jVpnaeeKsKMRwbLN+f1+8M=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 h1:umZgi92IyxfXd/l4kaDhnKgY8rnN/cZcF1LKc6I8OQ8=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0/go.mod h1:4lVs6obhSVRb1EW5FhOuBTyiQhtRtAnnva9vD3yRfq8=
-go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
-go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
+go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
+go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
 go.opentelemetry.io/otel/sdk v1.30.0 h1:cHdik6irO49R5IysVhdn8oaiR9m8XluDaJAs4DfOrYE=
 go.opentelemetry.io/otel/sdk v1.30.0/go.mod h1:p14X4Ok8S+sygzblytT1nqG98QG2KYKv++HE0LY/mhg=
-go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
-go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
+go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
+go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
 go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
 go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
-golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
-golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
-golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -171,33 +183,33 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
-golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
-golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
-golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
-golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
-golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
+golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
+golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1 h1:BulPr26Jqjnd4eYDVe+YvyR7Yc2vJGkO5/0UxD0/jZU=
-google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 h1:hjSy6tcFQZ171igDaN5QHOw2n6vx40juYbC/x67CEhc=
-google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:qpvKtACPCQhAdu3PyQgV4l3LMXZEtft7y8QcarRsp9I=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1:pPJltXNxVzT4pK9yD8vR9X75DaWYYmLGMsEvBfFQZzQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
-google.golang.org/grpc v1.66.1 h1:hO5qAXR19+/Z44hmvIM4dQFMSYX9XcWsByfoxutBpAM=
-google.golang.org/grpc v1.66.1/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
-google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
-google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 h1:Q3nlH8iSQSRUwOskjbcSMcF2jiYMNiQYZ0c2KEJLKKU=
+google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697 h1:pgr/4QbFyktUv9CtQ/Fq4gzEE6/Xs7iCXbktaGzLHbQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697/go.mod h1:+D9ySVjN8nY8YCVjc5O7PZDIdZporIDY3KaGfJunh88=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
+google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

internal/api/handler.go

@@ -8,8 +8,6 @@ import (
 	"github.com/yusing/go-proxy/internal/api/v1/auth"
 	. "github.com/yusing/go-proxy/internal/api/v1/utils"
 	"github.com/yusing/go-proxy/internal/common"
-	"github.com/yusing/go-proxy/internal/logging"
-	"github.com/yusing/go-proxy/internal/net/http/middleware"
 )
 
 type ServeMux struct{ *http.ServeMux }
@@ -19,7 +17,7 @@ func NewServeMux() ServeMux {
 }
 
 func (mux ServeMux) HandleFunc(method, endpoint string, handler http.HandlerFunc) {
-	mux.ServeMux.HandleFunc(method+" "+endpoint, checkHost(rateLimited(handler)))
+	mux.ServeMux.HandleFunc(method+" "+endpoint, checkHost(handler))
 }
 
 func NewHandler() http.Handler {
@@ -33,10 +31,10 @@ func NewHandler() http.Handler {
 	mux.HandleFunc("GET", "/v1/list", auth.RequireAuth(v1.List))
 	mux.HandleFunc("GET", "/v1/list/{what}", auth.RequireAuth(v1.List))
 	mux.HandleFunc("GET", "/v1/list/{what}/{which}", auth.RequireAuth(v1.List))
-	mux.HandleFunc("GET", "/v1/file", auth.RequireAuth(v1.GetFileContent))
-	mux.HandleFunc("GET", "/v1/file/{filename...}", auth.RequireAuth(v1.GetFileContent))
-	mux.HandleFunc("POST", "/v1/file/{filename...}", auth.RequireAuth(v1.SetFileContent))
-	mux.HandleFunc("PUT", "/v1/file/{filename...}", auth.RequireAuth(v1.SetFileContent))
+	mux.HandleFunc("GET", "/v1/file/{type}/{filename}", auth.RequireAuth(v1.GetFileContent))
+	mux.HandleFunc("POST", "/v1/file/{type}/{filename}", auth.RequireAuth(v1.SetFileContent))
+	mux.HandleFunc("PUT", "/v1/file/{type}/{filename}", auth.RequireAuth(v1.SetFileContent))
+	mux.HandleFunc("GET", "/v1/schema/{filename...}", v1.GetSchemaFile)
 	mux.HandleFunc("GET", "/v1/stats", v1.Stats)
 	mux.HandleFunc("GET", "/v1/stats/ws", v1.StatsWS)
 	return mux
@@ -58,16 +56,3 @@ func checkHost(f http.HandlerFunc) http.HandlerFunc {
 		f(w, r)
 	}
 }
-
-func rateLimited(f http.HandlerFunc) http.HandlerFunc {
-	m, err := middleware.RateLimiter.WithOptionsClone(middleware.OptionsRaw{
-		"average": 10,
-		"burst":   10,
-	})
-	if err != nil {
-		logging.Fatal().Err(err).Msg("unable to create API rate limiter")
-	}
-	return func(w http.ResponseWriter, r *http.Request) {
-		m.ModifyRequest(f, w, r)
-	}
-}

internal/api/v1/auth/auth.go

@@ -104,7 +104,7 @@ func RequireAuth(next http.HandlerFunc) http.HandlerFunc {
 func checkToken(w http.ResponseWriter, r *http.Request) (ok bool) {
 	tokenCookie, err := r.Cookie("token")
 	if err != nil {
-		U.HandleErr(w, r, E.PrependSubject("token", err), http.StatusUnauthorized)
+		U.RespondError(w, E.New("missing token"), http.StatusUnauthorized)
 		return false
 	}
 	var claims Claims
@@ -127,7 +127,7 @@ func checkToken(w http.ResponseWriter, r *http.Request) (ok bool) {
 	}
 
 	if err != nil {
-		U.HandleErr(w, r, err, http.StatusForbidden)
+		U.RespondError(w, err, http.StatusForbidden)
 		return false
 	}
 

internal/api/v1/file.go

@@ -11,15 +11,63 @@ import (
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/config"
 	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
 	"github.com/yusing/go-proxy/internal/route/provider"
 )
 
-func GetFileContent(w http.ResponseWriter, r *http.Request) {
-	filename := r.PathValue("filename")
-	if filename == "" {
-		filename = common.ConfigFileName
+type FileType string
+
+const (
+	FileTypeConfig     FileType = "config"
+	FileTypeProvider   FileType = "provider"
+	FileTypeMiddleware FileType = "middleware"
+)
+
+func fileType(file string) FileType {
+	switch {
+	case strings.HasPrefix(path.Base(file), "config."):
+		return FileTypeConfig
+	case strings.HasPrefix(file, common.MiddlewareComposeBasePath):
+		return FileTypeMiddleware
 	}
-	content, err := os.ReadFile(path.Join(common.ConfigBasePath, filename))
+	return FileTypeProvider
+}
+
+func (t FileType) IsValid() bool {
+	switch t {
+	case FileTypeConfig, FileTypeProvider, FileTypeMiddleware:
+		return true
+	}
+	return false
+}
+
+func (t FileType) GetPath(filename string) string {
+	if t == FileTypeMiddleware {
+		return path.Join(common.MiddlewareComposeBasePath, filename)
+	}
+	return path.Join(common.ConfigBasePath, filename)
+}
+
+func getArgs(r *http.Request) (fileType FileType, filename string, err error) {
+	fileType = FileType(r.PathValue("type"))
+	if !fileType.IsValid() {
+		err = U.ErrInvalidKey("type")
+		return
+	}
+	filename = r.PathValue("filename")
+	if filename == "" {
+		err = U.ErrMissingKey("filename")
+	}
+	return
+}
+
+func GetFileContent(w http.ResponseWriter, r *http.Request) {
+	fileType, filename, err := getArgs(r)
+	if err != nil {
+		U.RespondError(w, err, http.StatusBadRequest)
+		return
+	}
+	content, err := os.ReadFile(fileType.GetPath(filename))
 	if err != nil {
 		U.HandleErr(w, r, err)
 		return
@@ -28,9 +76,9 @@ func GetFileContent(w http.ResponseWriter, r *http.Request) {
 }
 
 func SetFileContent(w http.ResponseWriter, r *http.Request) {
-	filename := r.PathValue("filename")
-	if filename == "" {
-		U.HandleErr(w, r, U.ErrMissingKey("filename"), http.StatusBadRequest)
+	fileType, filename, err := getArgs(r)
+	if err != nil {
+		U.RespondError(w, err, http.StatusBadRequest)
 		return
 	}
 	content, err := io.ReadAll(r.Body)
@@ -40,19 +88,23 @@ func SetFileContent(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var valErr E.Error
-	if filename == common.ConfigFileName {
+	switch fileType {
+	case FileTypeConfig:
 		valErr = config.Validate(content)
-	} else if !strings.HasPrefix(filename, path.Base(common.MiddlewareComposeBasePath)) {
+	case FileTypeMiddleware:
+		errs := E.NewBuilder("middleware errors")
+		middleware.BuildMiddlewaresFromYAML(filename, content, errs)
+		valErr = errs.Error()
+	default:
 		valErr = provider.Validate(content)
 	}
-	// no validation for include files
 
 	if valErr != nil {
-		U.RespondJSON(w, r, valErr, http.StatusBadRequest)
+		U.RespondError(w, valErr, http.StatusBadRequest)
 		return
 	}
 
-	err = os.WriteFile(path.Join(common.ConfigBasePath, filename), content, 0o644)
+	err = os.WriteFile(fileType.GetPath(filename), content, 0o644)
 	if err != nil {
 		U.HandleErr(w, r, err)
 		return

internal/api/v1/list.go

@@ -16,7 +16,7 @@ import (
 const (
 	ListRoute            = "route"
 	ListRoutes           = "routes"
-	ListConfigFiles      = "config_files"
+	ListFiles            = "files"
 	ListMiddlewares      = "middlewares"
 	ListMiddlewareTraces = "middleware_trace"
 	ListMatchDomains     = "match_domains"
@@ -34,15 +34,15 @@ func List(w http.ResponseWriter, r *http.Request) {
 	switch what {
 	case ListRoute:
 		if route := listRoute(which); route == nil {
-			http.Error(w, "not found", http.StatusNotFound)
+			http.NotFound(w, r)
 			return
 		} else {
 			U.RespondJSON(w, r, route)
 		}
 	case ListRoutes:
 		U.RespondJSON(w, r, config.RoutesByAlias(route.RouteType(r.FormValue("type"))))
-	case ListConfigFiles:
-		listConfigFiles(w, r)
+	case ListFiles:
+		listFiles(w, r)
 	case ListMiddlewares:
 		U.RespondJSON(w, r, middleware.All())
 	case ListMiddlewareTraces:
@@ -52,17 +52,14 @@ func List(w http.ResponseWriter, r *http.Request) {
 	case ListHomepageConfig:
 		U.RespondJSON(w, r, config.HomepageConfig())
 	case ListTasks:
-		U.RespondJSON(w, r, task.DebugTaskMap())
+		U.RespondJSON(w, r, task.DebugTaskList())
 	default:
 		U.HandleErr(w, r, U.ErrInvalidKey("what"), http.StatusBadRequest)
 	}
 }
 
 func listRoute(which string) any {
-	if which == "" {
-		which = "all"
-	}
-	if which == "all" {
+	if which == "" || which == "all" {
 		return config.RoutesByAlias()
 	}
 	routes := config.RoutesByAlias()
@@ -73,14 +70,32 @@ func listRoute(which string) any {
 	return route
 }
 
-func listConfigFiles(w http.ResponseWriter, r *http.Request) {
-	files, err := utils.ListFiles(common.ConfigBasePath, 1)
+func listFiles(w http.ResponseWriter, r *http.Request) {
+	files, err := utils.ListFiles(common.ConfigBasePath, 0)
 	if err != nil {
 		U.HandleErr(w, r, err)
 		return
 	}
-	for i := range files {
-		files[i] = strings.TrimPrefix(files[i], common.ConfigBasePath+"/")
+	resp := map[FileType][]string{
+		FileTypeConfig:     make([]string, 0),
+		FileTypeProvider:   make([]string, 0),
+		FileTypeMiddleware: make([]string, 0),
 	}
-	U.RespondJSON(w, r, files)
+
+	for _, file := range files {
+		t := fileType(file)
+		file = strings.TrimPrefix(file, common.ConfigBasePath+"/")
+		resp[t] = append(resp[t], file)
+	}
+
+	mids, err := utils.ListFiles(common.MiddlewareComposeBasePath, 0)
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	for _, mid := range mids {
+		mid = strings.TrimPrefix(mid, common.MiddlewareComposeBasePath+"/")
+		resp[FileTypeMiddleware] = append(resp[FileTypeMiddleware], mid)
+	}
+	U.RespondJSON(w, r, resp)
 }

internal/api/v1/schema.go

@@ -0,0 +1,23 @@
+package v1
+
+import (
+	"net/http"
+	"os"
+	"path"
+
+	U "github.com/yusing/go-proxy/internal/api/v1/utils"
+	"github.com/yusing/go-proxy/internal/common"
+)
+
+func GetSchemaFile(w http.ResponseWriter, r *http.Request) {
+	filename := r.PathValue("filename")
+	if filename == "" {
+		U.RespondError(w, U.ErrMissingKey("filename"), http.StatusBadRequest)
+	}
+	content, err := os.ReadFile(path.Join(common.SchemaBasePath, filename))
+	if err != nil {
+		U.HandleErr(w, r, err)
+		return
+	}
+	U.WriteBody(w, content)
+}

internal/api/v1/utils/error.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils/ansi"
 )
 
 // HandleErr logs the error and returns an HTTP error response to the client.
@@ -11,16 +12,22 @@ import (
 // http.StatusInternalServerError is used.
 //
 // The error is only logged but not returned to the client.
-func HandleErr(w http.ResponseWriter, r *http.Request, origErr error, code ...int) {
-	if origErr == nil {
+func HandleErr(w http.ResponseWriter, r *http.Request, err error, code ...int) {
+	if err == nil {
 		return
 	}
-	LogError(r).Msg(origErr.Error())
-	statusCode := http.StatusInternalServerError
-	if len(code) > 0 {
-		statusCode = code[0]
+	LogError(r).Msg(err.Error())
+	if len(code) == 0 {
+		code = []int{http.StatusInternalServerError}
 	}
-	http.Error(w, http.StatusText(statusCode), statusCode)
+	http.Error(w, http.StatusText(code[0]), code[0])
+}
+
+func RespondError(w http.ResponseWriter, err error, code ...int) {
+	if len(code) == 0 {
+		code = []int{http.StatusBadRequest}
+	}
+	http.Error(w, ansi.StripANSI(err.Error()), code[0])
 }
 
 func ErrMissingKey(k string) error {

internal/api/v1/utils/logging.go

@@ -8,9 +8,10 @@ import (
 )
 
 func reqLogger(r *http.Request, level zerolog.Level) *zerolog.Event {
-	return logging.WithLevel(level).Str("module", "api").
-		Str("method", r.Method).
-		Str("path", r.RequestURI)
+	return logging.WithLevel(level).
+		Str("module", "api").
+		Str("remote", r.RemoteAddr).
+		Str("uri", r.Method+" "+r.RequestURI)
 }
 
 func LogError(r *http.Request) *zerolog.Event { return reqLogger(r, zerolog.ErrorLevel) }

internal/api/v1/utils/utils.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 
 	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/utils/strutils/ansi"
 )
 
 func WriteBody(w http.ResponseWriter, body []byte) {
@@ -27,13 +28,17 @@ func RespondJSON(w http.ResponseWriter, r *http.Request, data any, code ...int)
 		j = []byte(fmt.Sprintf("%q", data))
 	case []byte:
 		j = data
+	case error:
+		j, err = json.Marshal(ansi.StripANSI(data.Error()))
 	default:
 		j, err = json.MarshalIndent(data, "", "  ")
-		if err != nil {
-			logging.Panic().Err(err).Msg("failed to marshal json")
-			return false
-		}
 	}
+
+	if err != nil {
+		logging.Panic().Err(err).Msg("failed to marshal json")
+		return false
+	}
+
 	_, err = w.Write(j)
 	if err != nil {
 		HandleErr(w, r, err)

internal/autocert/config.go

@@ -4,10 +4,13 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/x509"
+	"os"
 
 	"github.com/go-acme/lego/v4/certcrypto"
 	"github.com/go-acme/lego/v4/lego"
 	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/utils"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 
@@ -24,6 +27,9 @@ var (
 )
 
 func NewConfig(cfg *types.AutoCertConfig) *Config {
+	if cfg == nil {
+		cfg = new(types.AutoCertConfig)
+	}
 	if cfg.CertPath == "" {
 		cfg.CertPath = CertFileDefault
 	}
@@ -33,6 +39,9 @@ func NewConfig(cfg *types.AutoCertConfig) *Config {
 	if cfg.Provider == "" {
 		cfg.Provider = ProviderLocal
 	}
+	if cfg.ACMEKeyPath == "" {
+		cfg.ACMEKeyPath = ACMEKeyFileDefault
+	}
 	return (*Config)(cfg)
 }
 
@@ -62,10 +71,21 @@ func (cfg *Config) GetProvider() (*Provider, E.Error) {
 		return nil, b.Error()
 	}
 
-	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		b.Addf("generate private key: %w", err)
-		return nil, b.Error()
+	var privKey *ecdsa.PrivateKey
+	var err error
+
+	if cfg.Provider != ProviderLocal {
+		if privKey, err = cfg.loadACMEKey(); err != nil {
+			logging.Info().Err(err).Msg("load ACME private key failed")
+			logging.Info().Msg("generate new ACME private key")
+			privKey, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+			if err != nil {
+				return nil, E.New("generate ACME private key").With(err)
+			}
+			if err = cfg.saveACMEKey(privKey); err != nil {
+				return nil, E.New("save ACME private key").With(err)
+			}
+		}
 	}
 
 	user := &User{
@@ -82,3 +102,19 @@ func (cfg *Config) GetProvider() (*Provider, E.Error) {
 		legoCfg: legoCfg,
 	}, nil
 }
+
+func (cfg *Config) loadACMEKey() (*ecdsa.PrivateKey, error) {
+	data, err := os.ReadFile(cfg.ACMEKeyPath)
+	if err != nil {
+		return nil, err
+	}
+	return x509.ParseECPrivateKey(data)
+}
+
+func (cfg *Config) saveACMEKey(key *ecdsa.PrivateKey) error {
+	data, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(cfg.ACMEKeyPath, data, 0o600)
+}

internal/autocert/constants.go

@@ -8,10 +8,10 @@ import (
 )
 
 const (
-	certBasePath     = "certs/"
-	CertFileDefault  = certBasePath + "cert.crt"
-	KeyFileDefault   = certBasePath + "priv.key"
-	RegistrationFile = certBasePath + "registration.json"
+	certBasePath       = "certs/"
+	CertFileDefault    = certBasePath + "cert.crt"
+	KeyFileDefault     = certBasePath + "priv.key"
+	ACMEKeyFileDefault = certBasePath + "acme.key"
 )
 
 const (

internal/autocert/provider.go

@@ -28,6 +28,7 @@ type (
 		legoCfg *lego.Config
 		client  *lego.Client
 
+		legoCert     *certificate.Resource
 		tlsCert      *tls.Certificate
 		certExpiries CertExpiries
 	}
@@ -78,14 +79,29 @@ func (p *Provider) ObtainCert() E.Error {
 		}
 	}
 
-	client := p.client
-	req := certificate.ObtainRequest{
-		Domains: p.cfg.Domains,
-		Bundle:  true,
+	var cert *certificate.Resource
+	var err error
+
+	if p.legoCert != nil {
+		cert, err = p.client.Certificate.RenewWithOptions(*p.legoCert, &certificate.RenewOptions{
+			Bundle: true,
+		})
+		if err != nil {
+			p.legoCert = nil
+			logger.Err(err).Msg("cert renew failed, fallback to obtain")
+		} else {
+			p.legoCert = cert
+		}
 	}
-	cert, err := client.Certificate.Obtain(req)
-	if err != nil {
-		return E.From(err)
+
+	if cert == nil {
+		cert, err = p.client.Certificate.Obtain(certificate.ObtainRequest{
+			Domains: p.cfg.Domains,
+			Bundle:  true,
+		})
+		if err != nil {
+			return E.From(err)
+		}
 	}
 
 	if err = p.saveCert(cert); err != nil {
@@ -137,17 +153,22 @@ func (p *Provider) ScheduleRenewal() {
 		return
 	}
 	go func() {
-		task := task.GlobalTask("cert renew scheduler")
-		ticker := time.NewTicker(5 * time.Second)
-		defer ticker.Stop()
-		defer task.Finish("cert renew scheduler stopped")
+		task := task.RootTask("cert-renew-scheduler", true)
+		defer task.Finish(nil)
+
 		for {
+			renewalTime := p.ShouldRenewOn()
+			timer := time.NewTimer(time.Until(renewalTime))
+
 			select {
 			case <-task.Context().Done():
+				timer.Stop()
 				return
-			case <-ticker.C: // check every 5 seconds
+			case <-timer.C:
 				if err := p.renewIfNeeded(); err != nil {
 					E.LogWarn("cert renew failed", err, &logger)
+					// Retry after 1 hour on failure
+					time.Sleep(time.Hour)
 				}
 			}
 		}
@@ -179,12 +200,18 @@ func (p *Provider) registerACME() error {
 	if p.user.Registration != nil {
 		return nil
 	}
+	if reg, err := p.client.Registration.ResolveAccountByKey(); err == nil {
+		p.user.Registration = reg
+		logger.Info().Msg("reused acme registration from private key")
+		return nil
+	}
+
 	reg, err := p.client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
 	if err != nil {
 		return err
 	}
 	p.user.Registration = reg
-
+	logger.Info().Interface("reg", reg).Msg("acme registered")
 	return nil
 }
 

internal/autocert/setup.go

@@ -4,6 +4,7 @@ import (
 	"os"
 
 	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
 func (p *Provider) Setup() (err E.Error) {
@@ -20,7 +21,7 @@ func (p *Provider) Setup() (err E.Error) {
 	p.ScheduleRenewal()
 
 	for _, expiry := range p.GetExpiries() {
-		logger.Info().Msg("certificate expire on " + expiry.String())
+		logger.Info().Msg("certificate expire on " + strutils.FormatTime(expiry))
 		break
 	}
 

internal/common/crypto.go

@@ -1,7 +1,6 @@
 package common
 
 import (
-	"crypto/rand"
 	"crypto/sha512"
 	"encoding/base64"
 
@@ -14,14 +13,6 @@ func HashPassword(pwd string) []byte {
 	return h.Sum(nil)
 }
 
-func generateJWTKey(size int) string {
-	bytes := make([]byte, size)
-	if _, err := rand.Read(bytes); err != nil {
-		log.Panic().Err(err).Msg("failed to generate jwt key")
-	}
-	return base64.StdEncoding.EncodeToString(bytes)
-}
-
 func decodeJWTKey(key string) []byte {
 	if key == "" {
 		return nil

internal/common/env.go

@@ -14,12 +14,11 @@ import (
 var (
 	prefixes = []string{"GODOXY_", "GOPROXY_", ""}
 
-	NoSchemaValidation = GetEnvBool("NO_SCHEMA_VALIDATION", true)
-	IsTest             = GetEnvBool("TEST", false) || strings.HasSuffix(os.Args[0], ".test")
-	IsDebug            = GetEnvBool("DEBUG", IsTest)
-	IsDebugSkipAuth    = GetEnvBool("DEBUG_SKIP_AUTH", false)
-	IsTrace            = GetEnvBool("TRACE", false) && IsDebug
-	IsProduction       = !IsTest && !IsDebug
+	IsTest          = GetEnvBool("TEST", false) || strings.HasSuffix(os.Args[0], ".test")
+	IsDebug         = GetEnvBool("DEBUG", IsTest)
+	IsDebugSkipAuth = GetEnvBool("DEBUG_SKIP_AUTH", false)
+	IsTrace         = GetEnvBool("TRACE", false) && IsDebug
+	IsProduction    = !IsTest && !IsDebug
 
 	ProxyHTTPAddr,
 	ProxyHTTPHost,

internal/config/config.go

@@ -10,24 +10,23 @@ import (
 	"github.com/yusing/go-proxy/internal/autocert"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/entrypoint"
 	E "github.com/yusing/go-proxy/internal/error"
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/notif"
-	"github.com/yusing/go-proxy/internal/route"
 	proxy "github.com/yusing/go-proxy/internal/route/provider"
 	"github.com/yusing/go-proxy/internal/task"
-	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils"
 	F "github.com/yusing/go-proxy/internal/utils/functional"
 	"github.com/yusing/go-proxy/internal/watcher"
 	"github.com/yusing/go-proxy/internal/watcher/events"
-	"gopkg.in/yaml.v3"
 )
 
 type Config struct {
 	value            *types.Config
 	providers        F.Map[string, *proxy.Provider]
 	autocertProvider *autocert.Provider
-	task             task.Task
+	task             *task.Task
 }
 
 var (
@@ -54,7 +53,7 @@ func newConfig() *Config {
 	return &Config{
 		value:     types.DefaultConfig(),
 		providers: F.NewMapOf[string, *proxy.Provider](),
-		task:      task.GlobalTask("config"),
+		task:      task.RootTask("config", false),
 	}
 }
 
@@ -68,7 +67,8 @@ func Load() (*Config, E.Error) {
 }
 
 func Validate(data []byte) E.Error {
-	return U.ValidateYaml(U.GetSchema(common.ConfigSchemaPath), data)
+	var model types.Config
+	return utils.DeserializeYAML(data, &model)
 }
 
 func MatchDomains() []string {
@@ -76,21 +76,19 @@ func MatchDomains() []string {
 }
 
 func WatchChanges() {
-	task := task.GlobalTask("Config watcher")
+	t := task.RootTask("config_watcher", true)
 	eventQueue := events.NewEventQueue(
-		task,
+		t,
 		configEventFlushInterval,
 		OnConfigChange,
 		func(err E.Error) {
 			E.LogError("config reload error", err, &logger)
 		},
 	)
-	eventQueue.Start(cfgWatcher.Events(task.Context()))
+	eventQueue.Start(cfgWatcher.Events(t.Context()))
 }
 
-func OnConfigChange(flushTask task.Task, ev []events.Event) {
-	defer flushTask.Finish("config reload complete")
-
+func OnConfigChange(ev []events.Event) {
 	// no matter how many events during the interval
 	// just reload once and check the last event
 	switch ev[len(ev)-1].Action {
@@ -116,14 +114,14 @@ func Reload() E.Error {
 	newCfg := newConfig()
 	err := newCfg.load()
 	if err != nil {
+		newCfg.task.Finish(err)
 		return err
 	}
 
 	// cancel all current subtasks -> wait
 	// -> replace config -> start new subtasks
 	instance.task.Finish("config changed")
-	instance.task.Wait()
-	*instance = *newCfg
+	instance = newCfg
 	instance.StartProxyProviders()
 	return nil
 }
@@ -136,15 +134,14 @@ func GetAutoCertProvider() *autocert.Provider {
 	return instance.autocertProvider
 }
 
-func (cfg *Config) Task() task.Task {
+func (cfg *Config) Task() *task.Task {
 	return cfg.task
 }
 
 func (cfg *Config) StartProxyProviders() {
 	errs := cfg.providers.CollectErrorsParallel(
 		func(_ string, p *proxy.Provider) error {
-			subtask := cfg.task.Subtask(p.String())
-			return p.Start(subtask)
+			return p.Start(cfg.task)
 		})
 
 	if err := E.Join(errs...); err != nil {
@@ -160,21 +157,17 @@ func (cfg *Config) load() E.Error {
 		E.LogFatal(errMsg, err, &logger)
 	}
 
-	if !common.NoSchemaValidation {
-		if err := Validate(data); err != nil {
-			E.LogFatal(errMsg, err, &logger)
-		}
-	}
-
 	model := types.DefaultConfig()
-	if err := E.From(yaml.Unmarshal(data, model)); err != nil {
+	if err := utils.DeserializeYAML(data, model); err != nil {
 		E.LogFatal(errMsg, err, &logger)
 	}
 
 	// errors are non fatal below
 	errs := E.NewBuilder(errMsg)
+	errs.Add(entrypoint.SetMiddlewares(model.Entrypoint.Middlewares))
+	errs.Add(entrypoint.SetAccessLogger(cfg.task, model.Entrypoint.AccessLog))
 	errs.Add(cfg.initNotification(model.Providers.Notification))
-	errs.Add(cfg.initAutoCert(&model.AutoCert))
+	errs.Add(cfg.initAutoCert(model.AutoCert))
 	errs.Add(cfg.loadRouteProviders(&model.Providers))
 
 	cfg.value = model
@@ -183,18 +176,22 @@ func (cfg *Config) load() E.Error {
 			model.MatchDomains[i] = "." + domain
 		}
 	}
-	route.SetFindMuxDomains(model.MatchDomains)
+	entrypoint.SetFindRouteDomains(model.MatchDomains)
 	return errs.Error()
 }
 
-func (cfg *Config) initNotification(notifCfgMap types.NotificationConfigMap) (err E.Error) {
-	if len(notifCfgMap) == 0 {
+func (cfg *Config) initNotification(notifCfg []types.NotificationConfig) (err E.Error) {
+	if len(notifCfg) == 0 {
 		return
 	}
+	dispatcher := notif.StartNotifDispatcher(cfg.task)
 	errs := E.NewBuilder("notification providers load errors")
-	for name, notifCfg := range notifCfgMap {
-		_, err := notif.RegisterProvider(cfg.task.Subtask(name), notifCfg)
-		errs.Add(err)
+	for i, notifier := range notifCfg {
+		_, err := dispatcher.RegisterProvider(notifier)
+		if err == nil {
+			continue
+		}
+		errs.Add(err.Subjectf("[%d]", i))
 	}
 	return errs.Error()
 }
@@ -209,9 +206,6 @@ func (cfg *Config) initAutoCert(autocertCfg *types.AutoCertConfig) (err E.Error)
 }
 
 func (cfg *Config) loadRouteProviders(providers *types.Providers) E.Error {
-	subtask := cfg.task.Subtask("load route providers")
-	defer subtask.Finish("done")
-
 	errs := E.NewBuilder("route provider errors")
 	results := E.NewBuilder("loaded route providers")
 

internal/config/query.go

@@ -1,19 +1,19 @@
 package config
 
 import (
-	"fmt"
 	"strings"
 
-	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/homepage"
-	"github.com/yusing/go-proxy/internal/proxy/entry"
-	"github.com/yusing/go-proxy/internal/route"
+	route "github.com/yusing/go-proxy/internal/route"
+	"github.com/yusing/go-proxy/internal/route/entry"
 	proxy "github.com/yusing/go-proxy/internal/route/provider"
+	"github.com/yusing/go-proxy/internal/route/routes"
+	"github.com/yusing/go-proxy/internal/route/types"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
-func DumpEntries() map[string]*entry.RawEntry {
-	entries := make(map[string]*entry.RawEntry)
+func DumpEntries() map[string]*types.RawEntry {
+	entries := make(map[string]*types.RawEntry)
 	instance.providers.RangeAll(func(_ string, p *proxy.Provider) {
 		p.RangeRoutes(func(alias string, r *route.Route) {
 			entries[alias] = r.Entry
@@ -31,20 +31,9 @@ func DumpProviders() map[string]*proxy.Provider {
 }
 
 func HomepageConfig() homepage.Config {
-	var proto, port string
-	domains := instance.value.MatchDomains
-	cert, _ := instance.autocertProvider.GetCert(nil)
-	if cert != nil {
-		proto = "https"
-		port = common.ProxyHTTPSPort
-	} else {
-		proto = "http"
-		port = common.ProxyHTTPPort
-	}
-
 	hpCfg := homepage.NewHomePageConfig()
-	route.GetReverseProxies().RangeAll(func(alias string, r *route.HTTPRoute) {
-		en := r.Raw
+	routes.GetHTTPRoutes().RangeAll(func(alias string, r types.HTTPRoute) {
+		en := r.RawEntry()
 		item := en.Homepage
 		if item == nil {
 			item = new(homepage.Item)
@@ -59,6 +48,8 @@ func HomepageConfig() homepage.Config {
 			return
 		}
 
+		item.Alias = alias
+
 		if item.Name == "" {
 			item.Name = strutils.Title(
 				strings.ReplaceAll(
@@ -100,36 +91,30 @@ func HomepageConfig() homepage.Config {
 			item.SourceType = string(proxy.ProviderTypeFile)
 		}
 
-		if item.URL == "" {
-			if len(domains) > 0 {
-				item.URL = fmt.Sprintf("%s://%s%s:%s", proto, strings.ToLower(alias), domains[0], port)
-			}
-		}
 		item.AltURL = r.TargetURL().String()
-
 		hpCfg.Add(item)
 	})
 	return hpCfg
 }
 
 func RoutesByAlias(typeFilter ...route.RouteType) map[string]any {
-	routes := make(map[string]any)
+	rts := make(map[string]any)
 	if len(typeFilter) == 0 || typeFilter[0] == "" {
 		typeFilter = []route.RouteType{route.RouteTypeReverseProxy, route.RouteTypeStream}
 	}
 	for _, t := range typeFilter {
 		switch t {
 		case route.RouteTypeReverseProxy:
-			route.GetReverseProxies().RangeAll(func(alias string, r *route.HTTPRoute) {
-				routes[alias] = r
+			routes.GetHTTPRoutes().RangeAll(func(alias string, r types.HTTPRoute) {
+				rts[alias] = r
 			})
 		case route.RouteTypeStream:
-			route.GetStreamProxies().RangeAll(func(alias string, r *route.StreamRoute) {
-				routes[alias] = r
+			routes.GetStreamRoutes().RangeAll(func(alias string, r types.StreamRoute) {
+				rts[alias] = r
 			})
 		}
 	}
-	return routes
+	return rts
 }
 
 func Statistics() map[string]any {

internal/config/types/autocert_config.go

@@ -2,12 +2,13 @@ package types
 
 type (
 	AutoCertConfig struct {
-		Email    string              `json:"email,omitempty" yaml:"email"`
-		Domains  []string            `json:"domains,omitempty" yaml:",flow"`
-		CertPath string              `json:"cert_path,omitempty" yaml:"cert_path"`
-		KeyPath  string              `json:"key_path,omitempty" yaml:"key_path"`
-		Provider string              `json:"provider,omitempty" yaml:"provider"`
-		Options  AutocertProviderOpt `json:"options,omitempty" yaml:",flow"`
+		Email       string              `json:"email,omitempty" validate:"email"`
+		Domains     []string            `json:"domains,omitempty"`
+		CertPath    string              `json:"cert_path,omitempty" validate:"omitempty,filepath"`
+		KeyPath     string              `json:"key_path,omitempty" validate:"omitempty,filepath"`
+		ACMEKeyPath string              `json:"acme_key_path,omitempty" validate:"omitempty,filepath"`
+		Provider    string              `json:"provider,omitempty"`
+		Options     AutocertProviderOpt `json:"options,omitempty"`
 	}
 	AutocertProviderOpt map[string]any
 )

internal/config/types/config.go

@@ -1,20 +1,29 @@
 package types
 
+import (
+	"github.com/yusing/go-proxy/internal/net/http/accesslog"
+	"github.com/yusing/go-proxy/internal/utils"
+)
+
 type (
 	Config struct {
-		Providers       Providers      `json:"providers" yaml:",flow"`
-		AutoCert        AutoCertConfig `json:"autocert" yaml:",flow"`
-		ExplicitOnly    bool           `json:"explicit_only" yaml:"explicit_only"`
-		MatchDomains    []string       `json:"match_domains" yaml:"match_domains"`
-		Homepage        HomepageConfig `json:"homepage" yaml:"homepage"`
-		TimeoutShutdown int            `json:"timeout_shutdown" yaml:"timeout_shutdown"`
-		RedirectToHTTPS bool           `json:"redirect_to_https" yaml:"redirect_to_https"`
+		AutoCert        *AutoCertConfig `json:"autocert" validate:"omitempty"`
+		Entrypoint      Entrypoint      `json:"entrypoint"`
+		Providers       Providers       `json:"providers"`
+		MatchDomains    []string        `json:"match_domains" validate:"dive,fqdn"`
+		Homepage        HomepageConfig  `json:"homepage"`
+		TimeoutShutdown int             `json:"timeout_shutdown" validate:"gte=0"`
 	}
 	Providers struct {
-		Files        []string              `json:"include" yaml:"include"`
-		Docker       map[string]string     `json:"docker" yaml:"docker"`
-		Notification NotificationConfigMap `json:"notification" yaml:"notification"`
+		Files        []string             `json:"include" validate:"dive,filepath"`
+		Docker       map[string]string    `json:"docker" validate:"dive,unix_addr|url"`
+		Notification []NotificationConfig `json:"notification"`
 	}
+	Entrypoint struct {
+		Middlewares []map[string]any  `json:"middlewares"`
+		AccessLog   *accesslog.Config `json:"access_log" validate:"omitempty"`
+	}
+	NotificationConfig map[string]any
 )
 
 func DefaultConfig() *Config {
@@ -23,6 +32,9 @@ func DefaultConfig() *Config {
 		Homepage: HomepageConfig{
 			UseDefaultCategories: true,
 		},
-		RedirectToHTTPS: false,
 	}
 }
+
+func init() {
+	utils.RegisterDefaultValueFactory(DefaultConfig)
+}

internal/config/types/homepage_config.go

@@ -1,5 +1,5 @@
 package types
 
 type HomepageConfig struct {
-	UseDefaultCategories bool `json:"use_default_categories" yaml:"use_default_categories"`
+	UseDefaultCategories bool `json:"use_default_categories"`
 }

internal/config/types/notif_config.go

@@ -1,5 +0,0 @@
-package types
-
-import "github.com/yusing/go-proxy/internal/notif"
-
-type NotificationConfigMap map[string]notif.ProviderConfig

internal/docker/client.go

@@ -16,7 +16,6 @@ import (
 )
 
 type (
-	Client       = *SharedClient
 	SharedClient struct {
 		*client.Client
 
@@ -28,7 +27,7 @@ type (
 )
 
 var (
-	clientMap   F.Map[string, Client] = F.NewMapOf[string, Client]()
+	clientMap   F.Map[string, *SharedClient] = F.NewMapOf[string, *SharedClient]()
 	clientMapMu sync.Mutex
 
 	clientOptEnvHost = []client.Opt{
@@ -38,8 +37,8 @@ var (
 )
 
 func init() {
-	task.GlobalTask("close docker clients").OnFinished("", func() {
-		clientMap.RangeAllParallel(func(_ string, c Client) {
+	task.OnProgramExit("docker_clients_cleanup", func() {
+		clientMap.RangeAllParallel(func(_ string, c *SharedClient) {
 			if c.Connected() {
 				c.Client.Close()
 			}
@@ -68,7 +67,7 @@ func (c *SharedClient) Close() {
 // Returns:
 //   - Client: the Docker client connection.
 //   - error: an error if the connection failed.
-func ConnectClient(host string) (Client, error) {
+func ConnectClient(host string) (*SharedClient, error) {
 	clientMapMu.Lock()
 	defer clientMapMu.Unlock()
 

internal/docker/container.go

@@ -15,29 +15,29 @@ type (
 	Container   struct {
 		_ U.NoCopy
 
-		DockerHost    string `json:"docker_host" yaml:"-"`
-		ContainerName string `json:"container_name" yaml:"-"`
-		ContainerID   string `json:"container_id" yaml:"-"`
-		ImageName     string `json:"image_name" yaml:"-"`
+		DockerHost    string `json:"docker_host"`
+		ContainerName string `json:"container_name"`
+		ContainerID   string `json:"container_id"`
+		ImageName     string `json:"image_name"`
 
-		Labels map[string]string `json:"-" yaml:"-"`
+		Labels map[string]string `json:"-"`
 
-		PublicPortMapping  PortMapping `json:"public_ports" yaml:"-"`  // non-zero publicPort:types.Port
-		PrivatePortMapping PortMapping `json:"private_ports" yaml:"-"` // privatePort:types.Port
-		PublicIP           string      `json:"public_ip" yaml:"-"`
-		PrivateIP          string      `json:"private_ip" yaml:"-"`
-		NetworkMode        string      `json:"network_mode" yaml:"-"`
+		PublicPortMapping  PortMapping `json:"public_ports"`  // non-zero publicPort:types.Port
+		PrivatePortMapping PortMapping `json:"private_ports"` // privatePort:types.Port
+		PublicIP           string      `json:"public_ip"`
+		PrivateIP          string      `json:"private_ip"`
+		NetworkMode        string      `json:"network_mode"`
 
-		Aliases     []string `json:"aliases" yaml:"-"`
-		IsExcluded  bool     `json:"is_excluded" yaml:"-"`
-		IsExplicit  bool     `json:"is_explicit" yaml:"-"`
-		IsDatabase  bool     `json:"is_database" yaml:"-"`
-		IdleTimeout string   `json:"idle_timeout,omitempty" yaml:"-"`
-		WakeTimeout string   `json:"wake_timeout,omitempty" yaml:"-"`
-		StopMethod  string   `json:"stop_method,omitempty" yaml:"-"`
-		StopTimeout string   `json:"stop_timeout,omitempty" yaml:"-"` // stop_method = "stop" only
-		StopSignal  string   `json:"stop_signal,omitempty" yaml:"-"`  // stop_method = "stop" | "kill" only
-		Running     bool     `json:"running" yaml:"-"`
+		Aliases     []string `json:"aliases"`
+		IsExcluded  bool     `json:"is_excluded"`
+		IsExplicit  bool     `json:"is_explicit"`
+		IsDatabase  bool     `json:"is_database"`
+		IdleTimeout string   `json:"idle_timeout,omitempty"`
+		WakeTimeout string   `json:"wake_timeout,omitempty"`
+		StopMethod  string   `json:"stop_method,omitempty"`
+		StopTimeout string   `json:"stop_timeout,omitempty"` // stop_method = "stop" only
+		StopSignal  string   `json:"stop_signal,omitempty"`  // stop_method = "stop" | "kill" only
+		Running     bool     `json:"running"`
 	}
 )
 

internal/docker/container_helper.go

@@ -33,8 +33,8 @@ func (c containerHelper) getName() string {
 }
 
 func (c containerHelper) getImageName() string {
-	colonSep := strings.Split(c.Image, ":")
-	slashSep := strings.Split(colonSep[0], "/")
+	colonSep := strutils.SplitRune(c.Image, ':')
+	slashSep := strutils.SplitRune(colonSep[0], '/')
 	return slashSep[len(slashSep)-1]
 }
 

internal/docker/idlewatcher/types/config.go

@@ -31,6 +31,12 @@ const (
 	StopMethodKill  StopMethod = "kill"
 )
 
+var validSignals = map[string]struct{}{
+	"":       {},
+	"SIGINT": {}, "SIGTERM": {}, "SIGHUP": {}, "SIGQUIT": {},
+	"INT": {}, "TERM": {}, "HUP": {}, "QUIT": {},
+}
+
 func ValidateConfig(cont *docker.Container) (*Config, E.Error) {
 	if cont == nil {
 		return nil, nil
@@ -83,12 +89,9 @@ func validateDurationPostitive(value string) (time.Duration, error) {
 }
 
 func validateSignal(s string) (Signal, error) {
-	switch s {
-	case "", "SIGINT", "SIGTERM", "SIGHUP", "SIGQUIT",
-		"INT", "TERM", "HUP", "QUIT":
+	if _, ok := validSignals[s]; ok {
 		return Signal(s), nil
 	}
-
 	return "", errors.New("invalid signal " + s)
 }
 

internal/docker/idlewatcher/waker.go

@@ -4,29 +4,32 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/prometheus/client_golang/prometheus"
 	"github.com/yusing/go-proxy/internal/common"
-	. "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
+	"github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
 	E "github.com/yusing/go-proxy/internal/error"
 	"github.com/yusing/go-proxy/internal/metrics"
 	gphttp "github.com/yusing/go-proxy/internal/net/http"
 	net "github.com/yusing/go-proxy/internal/net/types"
-	"github.com/yusing/go-proxy/internal/proxy/entry"
+	route "github.com/yusing/go-proxy/internal/route/types"
 	"github.com/yusing/go-proxy/internal/task"
 	U "github.com/yusing/go-proxy/internal/utils"
 	"github.com/yusing/go-proxy/internal/watcher/health"
+	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
 )
 
-type waker struct {
-	_ U.NoCopy
+type (
+	Waker = types.Waker
+	waker struct {
+		_ U.NoCopy
 
-	rp     *gphttp.ReverseProxy
-	stream net.Stream
-	hc     health.HealthChecker
-	metric *metrics.Gauge
+		rp     *gphttp.ReverseProxy
+		stream net.Stream
+		hc     health.HealthChecker
+		metric *metrics.Gauge
 
-	ready atomic.Bool
-}
+		ready atomic.Bool
+	}
+)
 
 const (
 	idleWakerCheckInterval = 100 * time.Millisecond
@@ -35,32 +38,32 @@ const (
 
 // TODO: support stream
 
-func newWaker(providerSubTask task.Task, entry entry.Entry, rp *gphttp.ReverseProxy, stream net.Stream) (Waker, E.Error) {
-	hcCfg := entry.HealthCheckConfig()
+func newWaker(parent task.Parent, entry route.Entry, rp *gphttp.ReverseProxy, stream net.Stream) (Waker, E.Error) {
+	hcCfg := entry.RawEntry().HealthCheck
 	hcCfg.Timeout = idleWakerCheckTimeout
 
 	waker := &waker{
 		rp:     rp,
 		stream: stream,
 	}
-
-	watcher, err := registerWatcher(providerSubTask, entry, waker)
+	task := parent.Subtask("idlewatcher." + entry.TargetName())
+	watcher, err := registerWatcher(task, entry, waker)
 	if err != nil {
 		return nil, E.Errorf("register watcher: %w", err)
 	}
 
 	switch {
 	case rp != nil:
-		waker.hc = health.NewHTTPHealthChecker(entry.TargetURL(), hcCfg)
+		waker.hc = monitor.NewHTTPHealthChecker(entry.TargetURL(), hcCfg)
 	case stream != nil:
-		waker.hc = health.NewRawHealthChecker(entry.TargetURL(), hcCfg)
+		waker.hc = monitor.NewRawHealthChecker(entry.TargetURL(), hcCfg)
 	default:
 		panic("both nil")
 	}
 
 	if common.PrometheusEnabled {
 		m := metrics.GetServiceMetrics()
-		fqn := providerSubTask.Parent().Name() + "/" + entry.TargetName()
+		fqn := parent.Name() + "/" + entry.TargetName()
 		waker.metric = m.HealthStatus.With(metrics.HealthMetricLabels(fqn))
 		waker.metric.Set(float64(watcher.Status()))
 	}
@@ -68,26 +71,30 @@ func newWaker(providerSubTask task.Task, entry entry.Entry, rp *gphttp.ReversePr
 }
 
 // lifetime should follow route provider.
-func NewHTTPWaker(providerSubTask task.Task, entry entry.Entry, rp *gphttp.ReverseProxy) (Waker, E.Error) {
-	return newWaker(providerSubTask, entry, rp, nil)
+func NewHTTPWaker(parent task.Parent, entry route.Entry, rp *gphttp.ReverseProxy) (Waker, E.Error) {
+	return newWaker(parent, entry, rp, nil)
 }
 
-func NewStreamWaker(providerSubTask task.Task, entry entry.Entry, stream net.Stream) (Waker, E.Error) {
-	return newWaker(providerSubTask, entry, nil, stream)
+func NewStreamWaker(parent task.Parent, entry route.Entry, stream net.Stream) (Waker, E.Error) {
+	return newWaker(parent, entry, nil, stream)
 }
 
 // Start implements health.HealthMonitor.
-func (w *Watcher) Start(routeSubTask task.Task) E.Error {
-	routeSubTask.Finish("ignored")
-	w.task.OnCancel("stop route and cleanup", func() {
-		routeSubTask.Parent().Finish(w.task.FinishCause())
+func (w *Watcher) Start(parent task.Parent) E.Error {
+	w.task.OnCancel("route_cleanup", func() {
+		parent.Finish(w.task.FinishCause())
 		if w.metric != nil {
-			prometheus.Unregister(w.metric)
+			w.metric.Reset()
 		}
 	})
 	return nil
 }
 
+// Task implements health.HealthMonitor.
+func (w *Watcher) Task() *task.Task {
+	return w.task
+}
+
 // Finish implements health.HealthMonitor.
 func (w *Watcher) Finish(reason any) {
 	if w.stream != nil {
@@ -110,6 +117,7 @@ func (w *Watcher) Uptime() time.Duration {
 	return 0
 }
 
+// Status implements health.HealthMonitor.
 func (w *Watcher) Status() health.Status {
 	status := w.getStatusUpdateReady()
 	if w.metric != nil {
@@ -118,7 +126,6 @@ func (w *Watcher) Status() health.Status {
 	return status
 }
 
-// Status implements health.HealthMonitor.
 func (w *Watcher) getStatusUpdateReady() health.Status {
 	if !w.ContainerRunning {
 		return health.StatusNapping
@@ -128,12 +135,12 @@ func (w *Watcher) getStatusUpdateReady() health.Status {
 		return health.StatusHealthy
 	}
 
-	healthy, _, err := w.hc.CheckHealth()
+	result, err := w.hc.CheckHealth()
 	switch {
 	case err != nil:
 		w.ready.Store(false)
 		return health.StatusError
-	case healthy:
+	case result.Healthy:
 		w.ready.Store(true)
 		return health.StatusHealthy
 	default:
@@ -147,7 +154,7 @@ func (w *Watcher) MarshalJSON() ([]byte, error) {
 	if w.hc.URL().Port() != "0" {
 		url = w.hc.URL()
 	}
-	return (&health.JSONRepresentation{
+	return (&monitor.JSONRepresentation{
 		Name:   w.Name(),
 		Status: w.Status(),
 		Config: w.hc.Config(),

internal/docker/idlewatcher/watcher.go

@@ -12,7 +12,7 @@ import (
 	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
 	E "github.com/yusing/go-proxy/internal/error"
 	"github.com/yusing/go-proxy/internal/logging"
-	"github.com/yusing/go-proxy/internal/proxy/entry"
+	route "github.com/yusing/go-proxy/internal/route/types"
 	"github.com/yusing/go-proxy/internal/task"
 	U "github.com/yusing/go-proxy/internal/utils"
 	F "github.com/yusing/go-proxy/internal/utils/functional"
@@ -29,10 +29,10 @@ type (
 		*idlewatcher.Config
 		*waker
 
-		client       D.Client
+		client       *D.SharedClient
 		stopByMethod StopCallback // send a docker command w.r.t. `stop_method`
 		ticker       *time.Ticker
-		task         task.Task
+		task         *task.Task
 	}
 
 	WakeDone     <-chan error
@@ -44,16 +44,18 @@ var (
 	watcherMap   = F.NewMapOf[string, *Watcher]()
 	watcherMapMu sync.Mutex
 
+	errShouldNotReachHere = errors.New("should not reach here")
+
 	logger = logging.With().Str("module", "idle_watcher").Logger()
 )
 
 const dockerReqTimeout = 3 * time.Second
 
-func registerWatcher(providerSubtask task.Task, entry entry.Entry, waker *waker) (*Watcher, error) {
+func registerWatcher(watcherTask *task.Task, entry route.Entry, waker *waker) (*Watcher, error) {
 	cfg := entry.IdlewatcherConfig()
 
 	if cfg.IdleTimeout == 0 {
-		panic("should not reach here")
+		panic(errShouldNotReachHere)
 	}
 
 	watcherMapMu.Lock()
@@ -65,7 +67,7 @@ func registerWatcher(providerSubtask task.Task, entry entry.Entry, waker *waker)
 		w.Config = cfg
 		w.waker = waker
 		w.resetIdleTimer()
-		providerSubtask.Finish("used existing watcher")
+		watcherTask.Finish("used existing watcher")
 		return w, nil
 	}
 
@@ -79,7 +81,7 @@ func registerWatcher(providerSubtask task.Task, entry entry.Entry, waker *waker)
 		Config: cfg,
 		waker:  waker,
 		client: client,
-		task:   providerSubtask,
+		task:   watcherTask,
 		ticker: time.NewTicker(cfg.IdleTimeout),
 	}
 	w.stopByMethod = w.getStopCallback()
@@ -104,10 +106,12 @@ func (w *Watcher) Wake() error {
 
 // WakeDebug logs a debug message related to waking the container.
 func (w *Watcher) WakeDebug() *zerolog.Event {
+	//nolint:zerologlint
 	return w.Debug().Str("action", "wake")
 }
 
 func (w *Watcher) WakeTrace() *zerolog.Event {
+	//nolint:zerologlint
 	return w.Trace().Str("action", "wake")
 }
 
@@ -177,7 +181,7 @@ func (w *Watcher) wakeIfStopped() error {
 	case "running":
 		return nil
 	default:
-		panic("should not reach here")
+		panic(errShouldNotReachHere)
 	}
 }
 
@@ -191,7 +195,7 @@ func (w *Watcher) getStopCallback() StopCallback {
 	case idlewatcher.StopMethodKill:
 		cb = w.containerKill
 	default:
-		panic("should not reach here")
+		panic(errShouldNotReachHere)
 	}
 	return func() error {
 		ctx, cancel := context.WithTimeout(w.task.Context(), time.Duration(w.StopTimeout)*time.Second)
@@ -205,9 +209,8 @@ func (w *Watcher) resetIdleTimer() {
 	w.ticker.Reset(w.IdleTimeout)
 }
 
-func (w *Watcher) getEventCh(dockerWatcher watcher.DockerWatcher) (eventTask task.Task, eventCh <-chan events.Event, errCh <-chan E.Error) {
-	eventTask = w.task.Subtask("docker event watcher")
-	eventCh, errCh = dockerWatcher.EventsWithOptions(eventTask.Context(), watcher.DockerListOptions{
+func (w *Watcher) getEventCh(dockerWatcher watcher.DockerWatcher) (eventCh <-chan events.Event, errCh <-chan E.Error) {
+	eventCh, errCh = dockerWatcher.EventsWithOptions(w.Task().Context(), watcher.DockerListOptions{
 		Filters: watcher.NewDockerFilter(
 			watcher.DockerFilterContainer,
 			watcher.DockerFilterContainerNameID(w.ContainerID),
@@ -236,8 +239,7 @@ func (w *Watcher) getEventCh(dockerWatcher watcher.DockerWatcher) (eventTask tas
 // errors occurred on docker client, or route provider died (mainly caused by config reload).
 func (w *Watcher) watchUntilDestroy() (returnCause error) {
 	dockerWatcher := watcher.NewDockerWatcherWithClient(w.client)
-	eventTask, dockerEventCh, dockerEventErrCh := w.getEventCh(dockerWatcher)
-	defer eventTask.Finish("stopped")
+	dockerEventCh, dockerEventErrCh := w.getEventCh(dockerWatcher)
 
 	for {
 		select {
@@ -276,8 +278,7 @@ func (w *Watcher) watchUntilDestroy() (returnCause error) {
 				w.Debug().Msgf("id changed %s -> %s", w.ContainerID, e.ActorID)
 				w.ContainerID = e.ActorID
 				// recreate event stream
-				eventTask.Finish("recreate event stream")
-				eventTask, dockerEventCh, dockerEventErrCh = w.getEventCh(dockerWatcher)
+				dockerEventCh, dockerEventErrCh = w.getEventCh(dockerWatcher)
 			}
 		case <-w.ticker.C:
 			w.ticker.Stop()

internal/docker/inspect.go

@@ -8,16 +8,15 @@ import (
 
 func Inspect(dockerHost string, containerID string) (*Container, error) {
 	client, err := ConnectClient(dockerHost)
-	defer client.Close()
-
 	if err != nil {
 		return nil, err
 	}
 
+	defer client.Close()
 	return client.Inspect(containerID)
 }
 
-func (c Client) Inspect(containerID string) (*Container, error) {
+func (c *SharedClient) Inspect(containerID string) (*Container, error) {
 	ctx, cancel := context.WithTimeoutCause(context.Background(), 3*time.Second, errors.New("docker container inspect timeout"))
 	defer cancel()
 

internal/docker/label.go

@@ -1,24 +1,25 @@
 package docker
 
 import (
-	"strings"
-
 	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
 type LabelMap = map[string]any
 
+var ErrInvalidLabel = E.New("invalid label")
+
 func ParseLabels(labels map[string]string) (LabelMap, E.Error) {
 	nestedMap := make(LabelMap)
 	errs := E.NewBuilder("labels error")
 
 	for lbl, value := range labels {
-		parts := strings.Split(lbl, ".")
+		parts := strutils.SplitRune(lbl, '.')
 		if parts[0] != NSProxy {
 			continue
 		}
 		if len(parts) == 1 {
-			errs.Add(E.Errorf("invalid label %s", lbl).Subject(lbl))
+			errs.Add(ErrInvalidLabel.Subject(lbl))
 			continue
 		}
 		parts = parts[1:]

internal/entrypoint/entrypoint.go

@@ -0,0 +1,148 @@
+package entrypoint
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+
+	gphttp "github.com/yusing/go-proxy/internal/net/http"
+	"github.com/yusing/go-proxy/internal/net/http/accesslog"
+	"github.com/yusing/go-proxy/internal/net/http/middleware"
+	"github.com/yusing/go-proxy/internal/net/http/middleware/errorpage"
+	"github.com/yusing/go-proxy/internal/route/routes"
+	route "github.com/yusing/go-proxy/internal/route/types"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+var findRouteFunc = findRouteAnyDomain
+
+var (
+	epMiddleware   *middleware.Middleware
+	epMiddlewareMu sync.Mutex
+
+	epAccessLogger   *accesslog.AccessLogger
+	epAccessLoggerMu sync.Mutex
+)
+
+var ErrNoSuchRoute = errors.New("no such route")
+
+func SetFindRouteDomains(domains []string) {
+	if len(domains) == 0 {
+		findRouteFunc = findRouteAnyDomain
+	} else {
+		findRouteFunc = findRouteByDomains(domains)
+	}
+}
+
+func SetMiddlewares(mws []map[string]any) error {
+	epMiddlewareMu.Lock()
+	defer epMiddlewareMu.Unlock()
+
+	if len(mws) == 0 {
+		epMiddleware = nil
+		return nil
+	}
+
+	mid, err := middleware.BuildMiddlewareFromChainRaw("entrypoint", mws)
+	if err != nil {
+		return err
+	}
+	epMiddleware = mid
+
+	logger.Debug().Msg("entrypoint middleware loaded")
+	return nil
+}
+
+func SetAccessLogger(parent task.Parent, cfg *accesslog.Config) (err error) {
+	epAccessLoggerMu.Lock()
+	defer epAccessLoggerMu.Unlock()
+
+	if cfg == nil {
+		epAccessLogger = nil
+		return
+	}
+
+	epAccessLogger, err = accesslog.NewFileAccessLogger(parent, cfg)
+	if err != nil {
+		return
+	}
+	logger.Debug().Msg("entrypoint access logger created")
+	return
+}
+
+func Handler(w http.ResponseWriter, r *http.Request) {
+	mux, err := findRouteFunc(r.Host)
+	if err == nil {
+		if epAccessLogger != nil {
+			epMiddlewareMu.Lock()
+			if epAccessLogger != nil {
+				w = gphttp.NewModifyResponseWriter(w, r, func(resp *http.Response) error {
+					epAccessLogger.Log(r, resp)
+					return nil
+				})
+			}
+			epMiddlewareMu.Unlock()
+		}
+		if epMiddleware != nil {
+			epMiddlewareMu.Lock()
+			if epMiddleware != nil {
+				mid := epMiddleware
+				epMiddlewareMu.Unlock()
+				mid.ServeHTTP(mux.ServeHTTP, w, r)
+				return
+			}
+			epMiddlewareMu.Unlock()
+		}
+		mux.ServeHTTP(w, r)
+		return
+	}
+	// Why use StatusNotFound instead of StatusBadRequest or StatusBadGateway?
+	// On nginx, when route for domain does not exist, it returns StatusBadGateway.
+	// Then scraper / scanners will know the subdomain is invalid.
+	// With StatusNotFound, they won't know whether it's the path, or the subdomain that is invalid.
+	if served := middleware.ServeStaticErrorPageFile(w, r); !served {
+		logger.Err(err).Str("method", r.Method).Str("url", r.URL.String()).Msg("request")
+		errorPage, ok := errorpage.GetErrorPageByStatus(http.StatusNotFound)
+		if ok {
+			w.WriteHeader(http.StatusNotFound)
+			w.Header().Set("Content-Type", "text/html; charset=utf-8")
+			if _, err := w.Write(errorPage); err != nil {
+				logger.Err(err).Msg("failed to write error page")
+			}
+		} else {
+			http.Error(w, err.Error(), http.StatusNotFound)
+		}
+	}
+}
+
+func findRouteAnyDomain(host string) (route.HTTPRoute, error) {
+	hostSplit := strutils.SplitRune(host, '.')
+	target := hostSplit[0]
+
+	if r, ok := routes.GetHTTPRouteOrExact(target, host); ok {
+		return r, nil
+	}
+	return nil, fmt.Errorf("%w: %s", ErrNoSuchRoute, target)
+}
+
+func findRouteByDomains(domains []string) func(host string) (route.HTTPRoute, error) {
+	return func(host string) (route.HTTPRoute, error) {
+		for _, domain := range domains {
+			if strings.HasSuffix(host, domain) {
+				target := strings.TrimSuffix(host, domain)
+				if r, ok := routes.GetHTTPRoute(target); ok {
+					return r, nil
+				}
+			}
+		}
+
+		// fallback to exact match
+		if r, ok := routes.GetHTTPRoute(host); ok {
+			return r, nil
+		}
+		return nil, fmt.Errorf("%w: %s", ErrNoSuchRoute, host)
+	}
+}

internal/entrypoint/entrypoint_test.go

@@ -0,0 +1,120 @@
+package entrypoint
+
+import (
+	"testing"
+
+	"github.com/yusing/go-proxy/internal/route"
+	"github.com/yusing/go-proxy/internal/route/routes"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+var r route.HTTPRoute
+
+func run(t *testing.T, match []string, noMatch []string) {
+	t.Helper()
+	t.Cleanup(routes.TestClear)
+	t.Cleanup(func() {
+		SetFindRouteDomains(nil)
+	})
+
+	for _, test := range match {
+		t.Run(test, func(t *testing.T) {
+			found, err := findRouteFunc(test)
+			ExpectNoError(t, err)
+			ExpectTrue(t, found == &r)
+		})
+	}
+
+	for _, test := range noMatch {
+		t.Run(test, func(t *testing.T) {
+			_, err := findRouteFunc(test)
+			ExpectError(t, ErrNoSuchRoute, err)
+		})
+	}
+}
+
+func TestFindRouteAnyDomain(t *testing.T) {
+	routes.SetHTTPRoute("app1", &r)
+
+	tests := []string{
+		"app1.com",
+		"app1.domain.com",
+		"app1.sub.domain.com",
+	}
+	testsNoMatch := []string{
+		"sub.app1.com",
+		"app2.com",
+		"app2.domain.com",
+		"app2.sub.domain.com",
+	}
+
+	run(t, tests, testsNoMatch)
+}
+
+func TestFindRouteExactHostMatch(t *testing.T) {
+	tests := []string{
+		"app2.com",
+		"app2.domain.com",
+		"app2.sub.domain.com",
+	}
+	testsNoMatch := []string{
+		"sub.app2.com",
+		"app1.com",
+		"app1.domain.com",
+		"app1.sub.domain.com",
+	}
+
+	for _, test := range tests {
+		routes.SetHTTPRoute(test, &r)
+	}
+
+	run(t, tests, testsNoMatch)
+}
+
+func TestFindRouteByDomains(t *testing.T) {
+	SetFindRouteDomains([]string{
+		".domain.com",
+		".sub.domain.com",
+	})
+
+	routes.SetHTTPRoute("app1", &r)
+
+	tests := []string{
+		"app1.domain.com",
+		"app1.sub.domain.com",
+	}
+	testsNoMatch := []string{
+		"sub.app1.com",
+		"app1.com",
+		"app1.domain.co",
+		"app1.domain.com.hk",
+		"app1.sub.domain.co",
+		"app2.domain.com",
+		"app2.sub.domain.com",
+	}
+
+	run(t, tests, testsNoMatch)
+}
+
+func TestFindRouteByDomainsExactMatch(t *testing.T) {
+	SetFindRouteDomains([]string{
+		".domain.com",
+		".sub.domain.com",
+	})
+
+	routes.SetHTTPRoute("app1.foo.bar", &r)
+
+	tests := []string{
+		"app1.foo.bar", // exact match
+		"app1.foo.bar.domain.com",
+		"app1.foo.bar.sub.domain.com",
+	}
+	testsNoMatch := []string{
+		"sub.app1.foo.bar",
+		"sub.app1.foo.bar.com",
+		"app1.domain.com",
+		"app1.sub.domain.com",
+	}
+
+	run(t, tests, testsNoMatch)
+}

internal/entrypoint/logger.go

@@ -0,0 +1,7 @@
+package entrypoint
+
+import (
+	"github.com/yusing/go-proxy/internal/logging"
+)
+
+var logger = logging.With().Str("module", "entrypoint").Logger()

internal/error/base.go

@@ -1,4 +1,4 @@
-package error
+package err
 
 import (
 	"errors"
@@ -6,6 +6,8 @@ import (
 )
 
 // baseError is an immutable wrapper around an error.
+//
+//nolint:recvcheck
 type baseError struct {
 	Err error `json:"err"`
 }

internal/error/builder.go

@@ -1,4 +1,4 @@
-package error
+package err
 
 import (
 	"fmt"
@@ -60,7 +60,7 @@ func (b *Builder) Add(err error) *Builder {
 	b.Lock()
 	defer b.Unlock()
 
-	switch err := err.(type) {
+	switch err := From(err).(type) {
 	case *baseError:
 		b.errs = append(b.errs, err.Err)
 	case *nestedError:
@@ -70,7 +70,7 @@ func (b *Builder) Add(err error) *Builder {
 			b.errs = append(b.errs, err)
 		}
 	default:
-		b.errs = append(b.errs, err)
+		panic("bug: should not reach here")
 	}
 
 	return b

internal/error/builder_test.go

@@ -1,4 +1,4 @@
-package error_test
+package err_test
 
 import (
 	"context"

internal/error/error.go

@@ -1,4 +1,4 @@
-package error
+package err
 
 type Error interface {
 	error
@@ -24,6 +24,8 @@ type Error interface {
 
 // this makes JSON marshaling work,
 // as the builtin one doesn't.
+//
+//nolint:errname
 type errStr string
 
 func (err errStr) Error() string {

internal/error/error_test.go

@@ -1,4 +1,4 @@
-package error
+package err
 
 import (
 	"errors"
@@ -18,11 +18,11 @@ func TestBaseWithSubject(t *testing.T) {
 	withSubjectf := err.Subjectf("%s %s", "foo", "bar")
 
 	ExpectError(t, err, withSubject)
-	ExpectStrEqual(t, withSubject.Error(), "foo: error")
+	ExpectEqual(t, withSubject.Error(), "foo: error")
 	ExpectTrue(t, withSubject.Is(err))
 
 	ExpectError(t, err, withSubjectf)
-	ExpectStrEqual(t, withSubjectf.Error(), "foo bar: error")
+	ExpectEqual(t, withSubjectf.Error(), "foo bar: error")
 	ExpectTrue(t, withSubjectf.Is(err))
 }
 
@@ -81,10 +81,10 @@ func TestErrorImmutability(t *testing.T) {
 
 	for range 3 {
 		// t.Logf("%d: %v %T %s", i, errors.Unwrap(err), err, err)
-		err.Subject("foo")
+		_ = err.Subject("foo")
 		ExpectFalse(t, strings.Contains(err.Error(), "foo"))
 
-		err.With(err2)
+		_ = err.With(err2)
 		ExpectFalse(t, strings.Contains(err.Error(), "extra"))
 		ExpectFalse(t, err.Is(err2))
 
@@ -102,7 +102,7 @@ func TestErrorWith(t *testing.T) {
 	ExpectTrue(t, err3.Is(err1))
 	ExpectTrue(t, err3.Is(err2))
 
-	err2.Subject("foo")
+	_ = err2.Subject("foo")
 
 	ExpectTrue(t, err3.Is(err1))
 	ExpectTrue(t, err3.Is(err2))
@@ -114,9 +114,9 @@ func TestErrorWith(t *testing.T) {
 func TestErrorStringSimple(t *testing.T) {
 	errFailure := New("generic failure")
 	ne := errFailure.Subject("foo bar")
-	ExpectStrEqual(t, ne.Error(), "foo bar: generic failure")
+	ExpectEqual(t, ne.Error(), "foo bar: generic failure")
 	ne = ne.Subject("baz")
-	ExpectStrEqual(t, ne.Error(), "baz > foo bar: generic failure")
+	ExpectEqual(t, ne.Error(), "baz > foo bar: generic failure")
 }
 
 func TestErrorStringNested(t *testing.T) {
@@ -153,5 +153,5 @@ func TestErrorStringNested(t *testing.T) {
       • action 3 > inner3: generic failure
         • 3
         • 3`
-	ExpectStrEqual(t, ne.Error(), want)
+	ExpectEqual(t, ne.Error(), want)
 }

internal/error/log.go

@@ -1,4 +1,4 @@
-package error
+package err
 
 import (
 	"github.com/rs/zerolog"

internal/error/nested_error.go

@@ -1,11 +1,13 @@
-package error
+package err
 
 import (
 	"errors"
 	"fmt"
-	"strings"
+
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
+//nolint:recvcheck
 type nestedError struct {
 	Err    error   `json:"err"`
 	Extras []error `json:"extras"`
@@ -66,7 +68,18 @@ func (err *nestedError) Is(other error) bool {
 }
 
 func (err *nestedError) Error() string {
-	return buildError(err, 0)
+	if err == nil {
+		return makeLine("<nil>", 0)
+	}
+
+	lines := make([]string, 0, 1+len(err.Extras))
+	if err.Err != nil {
+		lines = append(lines, makeLine(err.Err.Error(), 0))
+	}
+	if extras := makeLines(err.Extras, 1); len(extras) > 0 {
+		lines = append(lines, extras...)
+	}
+	return strutils.JoinLines(lines)
 }
 
 //go:inline
@@ -86,7 +99,7 @@ func makeLines(errs []error, level int) []string {
 	}
 	lines := make([]string, 0, len(errs))
 	for _, err := range errs {
-		switch err := err.(type) {
+		switch err := From(err).(type) {
 		case *nestedError:
 			if err.Err != nil {
 				lines = append(lines, makeLine(err.Err.Error(), level))
@@ -100,21 +113,3 @@ func makeLines(errs []error, level int) []string {
 	}
 	return lines
 }
-
-func buildError(err error, level int) string {
-	switch err := err.(type) {
-	case nil:
-		return makeLine("<nil>", level)
-	case *nestedError:
-		lines := make([]string, 0, 1+len(err.Extras))
-		if err.Err != nil {
-			lines = append(lines, makeLine(err.Err.Error(), level))
-		}
-		if extras := makeLines(err.Extras, level+1); len(extras) > 0 {
-			lines = append(lines, extras...)
-		}
-		return strings.Join(lines, "\n")
-	default:
-		return makeLine(err.Error(), level)
-	}
-}

internal/error/subject.go

@@ -1,4 +1,4 @@
-package error
+package err
 
 import (
 	"strings"
@@ -6,6 +6,7 @@ import (
 	"github.com/yusing/go-proxy/internal/utils/strutils/ansi"
 )
 
+//nolint:errname
 type withSubject struct {
 	Subject string `json:"subject"`
 	Err     error  `json:"err"`
@@ -18,23 +19,26 @@ func highlight(subject string) string {
 }
 
 func PrependSubject(subject string, err error) error {
-	switch err := err.(type) {
-	case nil:
+	if err == nil {
 		return nil
+	}
+
+	//nolint:errorlint
+	switch err := err.(type) {
 	case *withSubject:
 		return err.Prepend(subject)
 	case Error:
 		return err.Subject(subject)
-	default:
-		return &withSubject{subject, err}
 	}
+	return &withSubject{subject, err}
 }
 
-func (err withSubject) Prepend(subject string) *withSubject {
+func (err *withSubject) Prepend(subject string) *withSubject {
+	clone := *err
 	if subject != "" {
-		err.Subject = subject + subjectSep + err.Subject
+		clone.Subject = subject + subjectSep + clone.Subject
 	}
-	return &err
+	return &clone
 }
 
 func (err *withSubject) Is(other error) bool {

internal/error/utils.go

@@ -1,4 +1,4 @@
-package error
+package err
 
 import (
 	"fmt"
@@ -23,7 +23,11 @@ func From(err error) Error {
 	if err == nil {
 		return nil
 	}
-	if err, ok := err.(Error); ok {
+	//nolint:errorlint
+	switch err := err.(type) {
+	case *baseError:
+		return err
+	case *nestedError:
 		return err
 	}
 	return &baseError{err}
@@ -46,10 +50,12 @@ func Join(errors ...error) Error {
 	if n == 0 {
 		return nil
 	}
-	errs := make([]error, 0, n)
+	errs := make([]error, n)
+	i := 0
 	for _, err := range errors {
 		if err != nil {
-			errs = append(errs, err)
+			errs[i] = err
+			i++
 		}
 	}
 	return &nestedError{Extras: errs}

internal/homepage/categories.go

@@ -1,6 +1,6 @@
 package homepage
 
-// PredefinedCategories by alias or docker image name
+// PredefinedCategories by alias or docker image name.
 var PredefinedCategories = map[string]string{
 	"sonarr":       "Torrenting",
 	"radarr":       "Torrenting",

internal/homepage/homepage.go

@@ -1,20 +1,22 @@
 package homepage
 
 type (
+	//nolint:recvcheck
 	Config   map[string]Category
 	Category []*Item
 
 	Item struct {
-		Show         bool           `json:"show" yaml:"show"`
-		Name         string         `json:"name" yaml:"name"`
-		Icon         string         `json:"icon" yaml:"icon"`
-		URL          string         `json:"url" yaml:"url"` // alias + domain
-		Category     string         `json:"category" yaml:"category"`
-		Description  string         `json:"description" yaml:"description"`
-		WidgetConfig map[string]any `json:"widget_config" yaml:",flow"`
+		Show         bool           `json:"show"`
+		Name         string         `json:"name"` // display name
+		Icon         string         `json:"icon"`
+		URL          string         `json:"url"` // alias + domain
+		Category     string         `json:"category"`
+		Description  string         `json:"description" aliases:"desc"`
+		WidgetConfig map[string]any `json:"widget_config" aliases:"widget"`
 
-		SourceType string `json:"source_type" yaml:"-"`
-		AltURL     string `json:"alt_url" yaml:"-"` // original proxy target
+		Alias      string `json:"alias"` // proxy alias
+		SourceType string `json:"source_type"`
+		AltURL     string `json:"alt_url"` // original proxy target
 	}
 )
 

internal/logging/logging.go

@@ -1,3 +1,4 @@
+//nolint:zerologlint
 package logging
 
 import (
@@ -6,6 +7,7 @@ import (
 
 	"github.com/rs/zerolog"
 	"github.com/yusing/go-proxy/internal/common"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
 var logger zerolog.Logger
@@ -38,14 +40,14 @@ func init() {
 			FieldsExclude: exclude,
 			FormatMessage: func(msgI interface{}) string { // pad spaces for each line
 				msg := msgI.(string)
-				lines := strings.Split(msg, "\n")
+				lines := strutils.SplitRune(msg, '\n')
 				if len(lines) == 1 {
 					return msg
 				}
 				for i := 1; i < len(lines); i++ {
 					lines[i] = prefix + lines[i]
 				}
-				return strings.Join(lines, "\n")
+				return strutils.JoinRune(lines, '\n')
 			},
 		},
 	).Level(level).With().Timestamp().Logger()

internal/metrics/metric.go

@@ -56,6 +56,14 @@ func (c *Counter) With(l Labels) *Counter {
 	return &Counter{mv: c.mv, collector: c.mv.With(l.toPromLabels())}
 }
 
+func (c *Counter) Delete(l Labels) {
+	c.mv.Delete(l.toPromLabels())
+}
+
+func (c *Counter) Reset() {
+	c.mv.Reset()
+}
+
 func (g *Gauge) Collect(ch chan<- prometheus.Metric) {
 	g.mv.Collect(ch)
 }
@@ -71,3 +79,11 @@ func (g *Gauge) Set(v float64) {
 func (g *Gauge) With(l Labels) *Gauge {
 	return &Gauge{mv: g.mv, collector: g.mv.With(l.toPromLabels())}
 }
+
+func (g *Gauge) Delete(l Labels) {
+	g.mv.Delete(l.toPromLabels())
+}
+
+func (g *Gauge) Reset() {
+	g.mv.Reset()
+}

internal/metrics/metrics.go

@@ -43,10 +43,10 @@ func GetServiceMetrics() *ServiceMetrics {
 
 func (rm *RouteMetrics) UnregisterService(service string) {
 	lbls := &HTTPRouteMetricLabels{Service: service}
-	prometheus.Unregister(rm.HTTP2xx3xx.With(lbls))
-	prometheus.Unregister(rm.HTTP4xx.With(lbls))
-	prometheus.Unregister(rm.HTTP5xx.With(lbls))
-	prometheus.Unregister(rm.HTTPReqElapsed.With(lbls))
+	rm.HTTP2xx3xx.Delete(lbls)
+	rm.HTTP4xx.Delete(lbls)
+	rm.HTTP5xx.Delete(lbls)
+	rm.HTTPReqElapsed.Delete(lbls)
 }
 
 func init() {
@@ -65,7 +65,7 @@ func initRouteMetrics() {
 			Namespace: routerNamespace,
 			Subsystem: routerHTTPSubsystem,
 			Name:      "req_total",
-			Help:      "How many requests processed" + partitionsHelp,
+			Help:      "How many requests processed in total",
 		}),
 		HTTP2xx3xx: NewCounter(prometheus.CounterOpts{
 			Namespace: routerNamespace,

internal/net/http/accesslog/access_logger.go

@@ -0,0 +1,174 @@
+package accesslog
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"sync"
+	"time"
+
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/task"
+)
+
+type (
+	AccessLogger struct {
+		task *task.Task
+		cfg  *Config
+		io   AccessLogIO
+
+		buf     bytes.Buffer // buffer for non-flushed log
+		bufMu   sync.Mutex   // protect buf
+		bufPool sync.Pool    // buffer pool for formatting a single log line
+
+		flushThreshold int
+
+		Formatter
+	}
+
+	AccessLogIO interface {
+		io.ReadWriteCloser
+		io.ReadWriteSeeker
+		io.ReaderAt
+		sync.Locker
+		Name() string // file name or path
+		Truncate(size int64) error
+	}
+
+	Formatter interface {
+		// Format writes a log line to line without a trailing newline
+		Format(line *bytes.Buffer, req *http.Request, res *http.Response)
+		SetGetTimeNow(getTimeNow func() time.Time)
+	}
+)
+
+var logger = logging.With().Str("module", "accesslog").Logger()
+
+func NewAccessLogger(parent task.Parent, io AccessLogIO, cfg *Config) *AccessLogger {
+	l := &AccessLogger{
+		task: parent.Subtask("accesslog"),
+		cfg:  cfg,
+		io:   io,
+	}
+	if cfg.BufferSize < 1024 {
+		cfg.BufferSize = DefaultBufferSize
+	}
+
+	fmt := CommonFormatter{cfg: &l.cfg.Fields, GetTimeNow: time.Now}
+	switch l.cfg.Format {
+	case FormatCommon:
+		l.Formatter = &fmt
+	case FormatCombined:
+		l.Formatter = &CombinedFormatter{fmt}
+	case FormatJSON:
+		l.Formatter = &JSONFormatter{fmt}
+	default: // should not happen, validation has done by validate tags
+		panic("invalid access log format")
+	}
+
+	l.flushThreshold = int(cfg.BufferSize * 4 / 5) // 80%
+	l.buf.Grow(int(cfg.BufferSize))
+	l.bufPool.New = func() any {
+		return new(bytes.Buffer)
+	}
+	go l.start()
+	return l
+}
+
+func (l *AccessLogger) checkKeep(req *http.Request, res *http.Response) bool {
+	if !l.cfg.Filters.StatusCodes.CheckKeep(req, res) ||
+		!l.cfg.Filters.Method.CheckKeep(req, res) ||
+		!l.cfg.Filters.Headers.CheckKeep(req, res) ||
+		!l.cfg.Filters.CIDR.CheckKeep(req, res) {
+		return false
+	}
+	return true
+}
+
+func (l *AccessLogger) Log(req *http.Request, res *http.Response) {
+	if !l.checkKeep(req, res) {
+		return
+	}
+
+	line := l.bufPool.Get().(*bytes.Buffer)
+	l.Format(line, req, res)
+	line.WriteRune('\n')
+
+	l.bufMu.Lock()
+	l.buf.Write(line.Bytes())
+	line.Reset()
+	l.bufPool.Put(line)
+	l.bufMu.Unlock()
+}
+
+func (l *AccessLogger) LogError(req *http.Request, err error) {
+	l.Log(req, &http.Response{StatusCode: http.StatusInternalServerError, Status: err.Error()})
+}
+
+func (l *AccessLogger) Config() *Config {
+	return l.cfg
+}
+
+func (l *AccessLogger) Rotate() error {
+	if l.cfg.Retention == nil {
+		return nil
+	}
+	l.io.Lock()
+	defer l.io.Unlock()
+
+	return l.cfg.Retention.rotateLogFile(l.io)
+}
+
+func (l *AccessLogger) Flush(force bool) {
+	if l.buf.Len() == 0 {
+		return
+	}
+	if force || l.buf.Len() >= l.flushThreshold {
+		l.bufMu.Lock()
+		l.write(l.buf.Bytes())
+		l.buf.Reset()
+		l.bufMu.Unlock()
+		logger.Debug().Msg("access log flushed to " + l.io.Name())
+	}
+}
+
+func (l *AccessLogger) handleErr(err error) {
+	E.LogError("failed to write access log", err, &logger)
+}
+
+func (l *AccessLogger) start() {
+	defer func() {
+		if l.buf.Len() > 0 { // flush last
+			l.write(l.buf.Bytes())
+		}
+		l.io.Close()
+		l.task.Finish(nil)
+	}()
+
+	// periodic flush + threshold flush
+	periodic := time.NewTicker(5 * time.Second)
+	threshold := time.NewTicker(time.Second)
+	defer periodic.Stop()
+	defer threshold.Stop()
+
+	for {
+		select {
+		case <-l.task.Context().Done():
+			return
+		case <-periodic.C:
+			l.Flush(true)
+		case <-threshold.C:
+			l.Flush(false)
+		}
+	}
+}
+
+func (l *AccessLogger) write(data []byte) {
+	l.io.Lock() // prevent concurrent write, i.e. log rotation, other access loggers
+	_, err := l.io.Write(data)
+	l.io.Unlock()
+	if err != nil {
+		l.handleErr(err)
+	}
+}

internal/net/http/accesslog/access_logger_test.go

@@ -0,0 +1,128 @@
+package accesslog_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	E "github.com/yusing/go-proxy/internal/error"
+	. "github.com/yusing/go-proxy/internal/net/http/accesslog"
+	"github.com/yusing/go-proxy/internal/task"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+const (
+	remote        = "192.168.1.1"
+	host          = "example.com"
+	uri           = "/?bar=baz&foo=bar"
+	uriRedacted   = "/?bar=" + RedactedValue + "&foo=" + RedactedValue
+	referer       = "https://www.google.com/"
+	proto         = "HTTP/1.1"
+	ua            = "Go-http-client/1.1"
+	status        = http.StatusOK
+	contentLength = 100
+	method        = http.MethodGet
+)
+
+var (
+	testTask = task.RootTask("test", false)
+	testURL  = E.Must(url.Parse("http://" + host + uri))
+	req      = &http.Request{
+		RemoteAddr: remote,
+		Method:     method,
+		Proto:      proto,
+		Host:       testURL.Host,
+		URL:        testURL,
+		Header: http.Header{
+			"User-Agent": []string{ua},
+			"Referer":    []string{referer},
+			"Cookie": []string{
+				"foo=bar",
+				"bar=baz",
+			},
+		},
+	}
+	resp = &http.Response{
+		StatusCode:    status,
+		ContentLength: contentLength,
+		Header:        http.Header{"Content-Type": []string{"text/plain"}},
+	}
+)
+
+func fmtLog(cfg *Config) (ts string, line string) {
+	var buf bytes.Buffer
+
+	t := time.Now()
+	logger := NewAccessLogger(testTask, nil, cfg)
+	logger.Formatter.SetGetTimeNow(func() time.Time {
+		return t
+	})
+	logger.Format(&buf, req, resp)
+	return t.Format(LogTimeFormat), buf.String()
+}
+
+func TestAccessLoggerCommon(t *testing.T) {
+	config := DefaultConfig()
+	config.Format = FormatCommon
+	ts, log := fmtLog(config)
+	ExpectEqual(t, log,
+		fmt.Sprintf("%s %s - - [%s] \"%s %s %s\" %d %d",
+			host, remote, ts, method, uri, proto, status, contentLength,
+		),
+	)
+}
+
+func TestAccessLoggerCombined(t *testing.T) {
+	config := DefaultConfig()
+	config.Format = FormatCombined
+	ts, log := fmtLog(config)
+	ExpectEqual(t, log,
+		fmt.Sprintf("%s %s - - [%s] \"%s %s %s\" %d %d \"%s\" \"%s\"",
+			host, remote, ts, method, uri, proto, status, contentLength, referer, ua,
+		),
+	)
+}
+
+func TestAccessLoggerRedactQuery(t *testing.T) {
+	config := DefaultConfig()
+	config.Format = FormatCommon
+	config.Fields.Query.Default = FieldModeRedact
+	ts, log := fmtLog(config)
+	ExpectEqual(t, log,
+		fmt.Sprintf("%s %s - - [%s] \"%s %s %s\" %d %d",
+			host, remote, ts, method, uriRedacted, proto, status, contentLength,
+		),
+	)
+}
+
+func getJSONEntry(t *testing.T, config *Config) JSONLogEntry {
+	t.Helper()
+	config.Format = FormatJSON
+	var entry JSONLogEntry
+	_, log := fmtLog(config)
+	err := json.Unmarshal([]byte(log), &entry)
+	ExpectNoError(t, err)
+	return entry
+}
+
+func TestAccessLoggerJSON(t *testing.T) {
+	config := DefaultConfig()
+	entry := getJSONEntry(t, config)
+	ExpectEqual(t, entry.IP, remote)
+	ExpectEqual(t, entry.Method, method)
+	ExpectEqual(t, entry.Scheme, "http")
+	ExpectEqual(t, entry.Host, testURL.Host)
+	ExpectEqual(t, entry.URI, testURL.RequestURI())
+	ExpectEqual(t, entry.Protocol, proto)
+	ExpectEqual(t, entry.Status, status)
+	ExpectEqual(t, entry.ContentType, "text/plain")
+	ExpectEqual(t, entry.Size, contentLength)
+	ExpectEqual(t, entry.Referer, referer)
+	ExpectEqual(t, entry.UserAgent, ua)
+	ExpectEqual(t, len(entry.Headers), 0)
+	ExpectEqual(t, len(entry.Cookies), 0)
+}

internal/net/http/accesslog/config.go

@@ -0,0 +1,57 @@
+package accesslog
+
+import "github.com/yusing/go-proxy/internal/utils"
+
+type (
+	Format  string
+	Filters struct {
+		StatusCodes LogFilter[*StatusCodeRange] `json:"status_codes"`
+		Method      LogFilter[HTTPMethod]       `json:"method"`
+		Host        LogFilter[Host]             `json:"host"`
+		Headers     LogFilter[*HTTPHeader]      `json:"headers"` // header exists or header == value
+		CIDR        LogFilter[*CIDR]            `json:"cidr"`
+	}
+	Fields struct {
+		Headers FieldConfig `json:"headers"`
+		Query   FieldConfig `json:"query"`
+		Cookies FieldConfig `json:"cookies"`
+	}
+	Config struct {
+		BufferSize uint       `json:"buffer_size" validate:"gte=1"`
+		Format     Format     `json:"format" validate:"oneof=common combined json"`
+		Path       string     `json:"path" validate:"required"`
+		Filters    Filters    `json:"filters"`
+		Fields     Fields     `json:"fields"`
+		Retention  *Retention `json:"retention"`
+	}
+)
+
+var (
+	FormatCommon   Format = "common"
+	FormatCombined Format = "combined"
+	FormatJSON     Format = "json"
+)
+
+const DefaultBufferSize = 64 * 1024 // 64KB
+
+func DefaultConfig() *Config {
+	return &Config{
+		BufferSize: DefaultBufferSize,
+		Format:     FormatCombined,
+		Fields: Fields{
+			Headers: FieldConfig{
+				Default: FieldModeDrop,
+			},
+			Query: FieldConfig{
+				Default: FieldModeKeep,
+			},
+			Cookies: FieldConfig{
+				Default: FieldModeDrop,
+			},
+		},
+	}
+}
+
+func init() {
+	utils.RegisterDefaultValueFactory(DefaultConfig)
+}

internal/net/http/accesslog/config_test.go

@@ -0,0 +1,53 @@
+package accesslog_test
+
+import (
+	"testing"
+
+	"github.com/yusing/go-proxy/internal/docker"
+	. "github.com/yusing/go-proxy/internal/net/http/accesslog"
+	"github.com/yusing/go-proxy/internal/utils"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+func TestNewConfig(t *testing.T) {
+	labels := map[string]string{
+		"proxy.buffer_size":                 "10",
+		"proxy.format":                      "combined",
+		"proxy.path":                        "/tmp/access.log",
+		"proxy.filters.status_codes.values": "200-299",
+		"proxy.filters.method.values":       "GET, POST",
+		"proxy.filters.headers.values":      "foo=bar, baz",
+		"proxy.filters.headers.negative":    "true",
+		"proxy.filters.cidr.values":         "192.168.10.0/24",
+		"proxy.fields.headers.default":      "keep",
+		"proxy.fields.headers.config.foo":   "redact",
+		"proxy.fields.query.default":        "drop",
+		"proxy.fields.query.config.foo":     "keep",
+		"proxy.fields.cookies.default":      "redact",
+		"proxy.fields.cookies.config.foo":   "keep",
+	}
+	parsed, err := docker.ParseLabels(labels)
+	ExpectNoError(t, err)
+
+	var config Config
+	err = utils.Deserialize(parsed, &config)
+	ExpectNoError(t, err)
+
+	ExpectEqual(t, config.BufferSize, 10)
+	ExpectEqual(t, config.Format, FormatCombined)
+	ExpectEqual(t, config.Path, "/tmp/access.log")
+	ExpectDeepEqual(t, config.Filters.StatusCodes.Values, []*StatusCodeRange{{Start: 200, End: 299}})
+	ExpectEqual(t, len(config.Filters.Method.Values), 2)
+	ExpectDeepEqual(t, config.Filters.Method.Values, []HTTPMethod{"GET", "POST"})
+	ExpectEqual(t, len(config.Filters.Headers.Values), 2)
+	ExpectDeepEqual(t, config.Filters.Headers.Values, []*HTTPHeader{{Key: "foo", Value: "bar"}, {Key: "baz", Value: ""}})
+	ExpectTrue(t, config.Filters.Headers.Negative)
+	ExpectEqual(t, len(config.Filters.CIDR.Values), 1)
+	ExpectEqual(t, config.Filters.CIDR.Values[0].String(), "192.168.10.0/24")
+	ExpectEqual(t, config.Fields.Headers.Default, FieldModeKeep)
+	ExpectEqual(t, config.Fields.Headers.Config["foo"], FieldModeRedact)
+	ExpectEqual(t, config.Fields.Query.Default, FieldModeDrop)
+	ExpectEqual(t, config.Fields.Query.Config["foo"], FieldModeKeep)
+	ExpectEqual(t, config.Fields.Cookies.Default, FieldModeRedact)
+	ExpectEqual(t, config.Fields.Cookies.Config["foo"], FieldModeKeep)
+}

internal/net/http/accesslog/fields.go

@@ -0,0 +1,103 @@
+package accesslog
+
+import (
+	"net/http"
+	"net/url"
+)
+
+type (
+	FieldConfig struct {
+		Default FieldMode            `json:"default" validate:"oneof=keep drop redact"`
+		Config  map[string]FieldMode `json:"config" validate:"dive,oneof=keep drop redact"`
+	}
+	FieldMode string
+)
+
+const (
+	FieldModeKeep   FieldMode = "keep"
+	FieldModeDrop   FieldMode = "drop"
+	FieldModeRedact FieldMode = "redact"
+
+	RedactedValue = "REDACTED"
+)
+
+func processMap[V any](cfg *FieldConfig, m map[string]V, redactedV V) map[string]V {
+	if len(cfg.Config) == 0 {
+		switch cfg.Default {
+		case FieldModeKeep:
+			return m
+		case FieldModeDrop:
+			return nil
+		case FieldModeRedact:
+			redacted := make(map[string]V)
+			for k := range m {
+				redacted[k] = redactedV
+			}
+			return redacted
+		}
+	}
+
+	if len(m) == 0 {
+		return m
+	}
+
+	newMap := make(map[string]V, len(m))
+	for k := range m {
+		var mode FieldMode
+		var ok bool
+		if mode, ok = cfg.Config[k]; !ok {
+			mode = cfg.Default
+		}
+		switch mode {
+		case FieldModeKeep:
+			newMap[k] = m[k]
+		case FieldModeRedact:
+			newMap[k] = redactedV
+		}
+	}
+	return newMap
+}
+
+func processSlice[V any, VReturn any](cfg *FieldConfig, s []V, getKey func(V) string, convert func(V) VReturn, redact func(V) VReturn) map[string]VReturn {
+	if len(s) == 0 ||
+		len(cfg.Config) == 0 && cfg.Default == FieldModeDrop {
+		return nil
+	}
+	newMap := make(map[string]VReturn, len(s))
+	for _, v := range s {
+		var mode FieldMode
+		var ok bool
+		k := getKey(v)
+		if mode, ok = cfg.Config[k]; !ok {
+			mode = cfg.Default
+		}
+		switch mode {
+		case FieldModeKeep:
+			newMap[k] = convert(v)
+		case FieldModeRedact:
+			newMap[k] = redact(v)
+		}
+	}
+	return newMap
+}
+
+func (cfg *FieldConfig) ProcessHeaders(headers http.Header) http.Header {
+	return processMap(cfg, headers, []string{RedactedValue})
+}
+
+func (cfg *FieldConfig) ProcessQuery(q url.Values) url.Values {
+	return processMap(cfg, q, []string{RedactedValue})
+}
+
+func (cfg *FieldConfig) ProcessCookies(cookies []*http.Cookie) map[string]string {
+	return processSlice(cfg, cookies,
+		func(c *http.Cookie) string {
+			return c.Name
+		},
+		func(c *http.Cookie) string {
+			return c.Value
+		},
+		func(c *http.Cookie) string {
+			return RedactedValue
+		})
+}

internal/net/http/accesslog/fields_test.go

@@ -0,0 +1,96 @@
+package accesslog_test
+
+import (
+	"testing"
+
+	. "github.com/yusing/go-proxy/internal/net/http/accesslog"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+// Cookie header should be removed,
+// stored in JSONLogEntry.Cookies instead.
+func TestAccessLoggerJSONKeepHeaders(t *testing.T) {
+	config := DefaultConfig()
+	config.Fields.Headers.Default = FieldModeKeep
+	entry := getJSONEntry(t, config)
+	for k, v := range req.Header {
+		if k != "Cookie" {
+			ExpectDeepEqual(t, entry.Headers[k], v)
+		}
+	}
+
+	config.Fields.Headers.Config = map[string]FieldMode{
+		"Referer":    FieldModeRedact,
+		"User-Agent": FieldModeDrop,
+	}
+	entry = getJSONEntry(t, config)
+	ExpectDeepEqual(t, entry.Headers["Referer"], []string{RedactedValue})
+	ExpectDeepEqual(t, entry.Headers["User-Agent"], nil)
+}
+
+func TestAccessLoggerJSONDropHeaders(t *testing.T) {
+	config := DefaultConfig()
+	config.Fields.Headers.Default = FieldModeDrop
+	entry := getJSONEntry(t, config)
+	for k := range req.Header {
+		ExpectDeepEqual(t, entry.Headers[k], nil)
+	}
+
+	config.Fields.Headers.Config = map[string]FieldMode{
+		"Referer":    FieldModeKeep,
+		"User-Agent": FieldModeRedact,
+	}
+	entry = getJSONEntry(t, config)
+	ExpectDeepEqual(t, entry.Headers["Referer"], []string{req.Header.Get("Referer")})
+	ExpectDeepEqual(t, entry.Headers["User-Agent"], []string{RedactedValue})
+}
+
+func TestAccessLoggerJSONRedactHeaders(t *testing.T) {
+	config := DefaultConfig()
+	config.Fields.Headers.Default = FieldModeRedact
+	entry := getJSONEntry(t, config)
+	ExpectEqual(t, len(entry.Headers["Cookie"]), 0)
+	for k := range req.Header {
+		if k != "Cookie" {
+			ExpectDeepEqual(t, entry.Headers[k], []string{RedactedValue})
+		}
+	}
+}
+
+func TestAccessLoggerJSONKeepCookies(t *testing.T) {
+	config := DefaultConfig()
+	config.Fields.Headers.Default = FieldModeKeep
+	config.Fields.Cookies.Default = FieldModeKeep
+	entry := getJSONEntry(t, config)
+	ExpectEqual(t, len(entry.Headers["Cookie"]), 0)
+	for _, cookie := range req.Cookies() {
+		ExpectEqual(t, entry.Cookies[cookie.Name], cookie.Value)
+	}
+}
+
+func TestAccessLoggerJSONRedactCookies(t *testing.T) {
+	config := DefaultConfig()
+	config.Fields.Headers.Default = FieldModeKeep
+	config.Fields.Cookies.Default = FieldModeRedact
+	entry := getJSONEntry(t, config)
+	ExpectEqual(t, len(entry.Headers["Cookie"]), 0)
+	for _, cookie := range req.Cookies() {
+		ExpectEqual(t, entry.Cookies[cookie.Name], RedactedValue)
+	}
+}
+
+func TestAccessLoggerJSONDropQuery(t *testing.T) {
+	config := DefaultConfig()
+	config.Fields.Query.Default = FieldModeDrop
+	entry := getJSONEntry(t, config)
+	ExpectDeepEqual(t, entry.Query["foo"], nil)
+	ExpectDeepEqual(t, entry.Query["bar"], nil)
+}
+
+func TestAccessLoggerJSONRedactQuery(t *testing.T) {
+	config := DefaultConfig()
+	config.Fields.Query.Default = FieldModeRedact
+	entry := getJSONEntry(t, config)
+	ExpectDeepEqual(t, entry.Query["foo"], []string{RedactedValue})
+	ExpectDeepEqual(t, entry.Query["bar"], []string{RedactedValue})
+}

internal/net/http/accesslog/file_logger.go

@@ -0,0 +1,38 @@
+package accesslog
+
+import (
+	"fmt"
+	"os"
+	"sync"
+
+	"github.com/yusing/go-proxy/internal/task"
+)
+
+type File struct {
+	*os.File
+	sync.Mutex
+}
+
+var (
+	openedFiles   = make(map[string]AccessLogIO)
+	openedFilesMu sync.Mutex
+)
+
+func NewFileAccessLogger(parent task.Parent, cfg *Config) (*AccessLogger, error) {
+	openedFilesMu.Lock()
+
+	var io AccessLogIO
+	if opened, ok := openedFiles[cfg.Path]; ok {
+		io = opened
+	} else {
+		f, err := os.OpenFile(cfg.Path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+		if err != nil {
+			return nil, fmt.Errorf("access log open error: %w", err)
+		}
+		io = &File{File: f}
+		openedFiles[cfg.Path] = io
+	}
+
+	openedFilesMu.Unlock()
+	return NewAccessLogger(parent, io, cfg), nil
+}

internal/net/http/accesslog/file_logger_test.go

@@ -0,0 +1,95 @@
+package accesslog
+
+import (
+	"net/http"
+	"os"
+	"sync"
+	"testing"
+
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+
+	"github.com/yusing/go-proxy/internal/task"
+)
+
+func TestConcurrentFileLoggersShareSameAccessLogIO(t *testing.T) {
+	var wg sync.WaitGroup
+
+	cfg := DefaultConfig()
+	cfg.Path = "test.log"
+	parent := task.RootTask("test", false)
+
+	loggerCount := 10
+	accessLogIOs := make([]AccessLogIO, loggerCount)
+
+	// make test log file
+	file, err := os.Create(cfg.Path)
+	ExpectNoError(t, err)
+	file.Close()
+	t.Cleanup(func() {
+		ExpectNoError(t, os.Remove(cfg.Path))
+	})
+
+	for i := range loggerCount {
+		wg.Add(1)
+		go func(index int) {
+			defer wg.Done()
+			logger, err := NewFileAccessLogger(parent, cfg)
+			ExpectNoError(t, err)
+			accessLogIOs[index] = logger.io
+		}(i)
+	}
+
+	wg.Wait()
+
+	firstIO := accessLogIOs[0]
+	for _, io := range accessLogIOs {
+		ExpectEqual(t, io, firstIO)
+	}
+}
+
+func TestConcurrentAccessLoggerLogAndFlush(t *testing.T) {
+	var file MockFile
+
+	cfg := DefaultConfig()
+	cfg.BufferSize = 1024
+	parent := task.RootTask("test", false)
+
+	loggerCount := 5
+	logCountPerLogger := 10
+	loggers := make([]*AccessLogger, loggerCount)
+
+	for i := range loggerCount {
+		loggers[i] = NewAccessLogger(parent, &file, cfg)
+	}
+
+	var wg sync.WaitGroup
+	req, _ := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	resp := &http.Response{StatusCode: http.StatusOK}
+
+	for _, logger := range loggers {
+		wg.Add(1)
+		go func(l *AccessLogger) {
+			defer wg.Done()
+			parallelLog(l, req, resp, logCountPerLogger)
+			l.Flush(true)
+		}(logger)
+	}
+
+	wg.Wait()
+
+	expected := loggerCount * logCountPerLogger
+	actual := file.Count()
+	ExpectEqual(t, actual, expected)
+}
+
+func parallelLog(logger *AccessLogger, req *http.Request, resp *http.Response, n int) {
+	var wg sync.WaitGroup
+	wg.Add(n)
+	for range n {
+		go func() {
+			defer wg.Done()
+			logger.Log(req, resp)
+		}()
+	}
+	wg.Wait()
+}

internal/net/http/accesslog/filter.go

@@ -0,0 +1,99 @@
+package accesslog
+
+import (
+	"net"
+	"net/http"
+	"strings"
+
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/net/types"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type (
+	LogFilter[T Filterable] struct {
+		Negative bool
+		Values   []T
+	}
+	Filterable interface {
+		comparable
+		Fulfill(req *http.Request, res *http.Response) bool
+	}
+	HTTPMethod string
+	HTTPHeader struct {
+		Key, Value string
+	}
+	Host string
+	CIDR struct{ types.CIDR }
+)
+
+var ErrInvalidHTTPHeaderFilter = E.New("invalid http header filter")
+
+func (f *LogFilter[T]) CheckKeep(req *http.Request, res *http.Response) bool {
+	if len(f.Values) == 0 {
+		return !f.Negative
+	}
+	for _, check := range f.Values {
+		if check.Fulfill(req, res) {
+			return !f.Negative
+		}
+	}
+	return f.Negative
+}
+
+func (r *StatusCodeRange) Fulfill(req *http.Request, res *http.Response) bool {
+	return r.Includes(res.StatusCode)
+}
+
+func (method HTTPMethod) Fulfill(req *http.Request, res *http.Response) bool {
+	return req.Method == string(method)
+}
+
+// Parse implements strutils.Parser.
+func (k *HTTPHeader) Parse(v string) error {
+	split := strutils.SplitRune(v, '=')
+	switch len(split) {
+	case 1:
+		split = append(split, "")
+	case 2:
+	default:
+		return ErrInvalidHTTPHeaderFilter.Subject(v)
+	}
+	k.Key = split[0]
+	k.Value = split[1]
+	return nil
+}
+
+func (k *HTTPHeader) Fulfill(req *http.Request, res *http.Response) bool {
+	wanted := k.Value
+	// non canonical key matching
+	got, ok := req.Header[k.Key]
+	if wanted == "" {
+		return ok
+	}
+	if !ok {
+		return false
+	}
+	for _, v := range got {
+		if strings.EqualFold(v, wanted) {
+			return true
+		}
+	}
+	return false
+}
+
+func (h Host) Fulfill(req *http.Request, res *http.Response) bool {
+	return req.Host == string(h)
+}
+
+func (cidr CIDR) Fulfill(req *http.Request, res *http.Response) bool {
+	ip, _, err := net.SplitHostPort(req.RemoteAddr)
+	if err != nil {
+		ip = req.RemoteAddr
+	}
+	netIP := net.ParseIP(ip)
+	if netIP == nil {
+		return false
+	}
+	return cidr.Contains(netIP)
+}

internal/net/http/accesslog/filter_test.go

@@ -0,0 +1,188 @@
+package accesslog_test
+
+import (
+	"net/http"
+	"testing"
+
+	. "github.com/yusing/go-proxy/internal/net/http/accesslog"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+func TestStatusCodeFilter(t *testing.T) {
+	values := []*StatusCodeRange{
+		strutils.MustParse[*StatusCodeRange]("200-308"),
+	}
+	t.Run("positive", func(t *testing.T) {
+		filter := &LogFilter[*StatusCodeRange]{}
+		ExpectTrue(t, filter.CheckKeep(nil, nil))
+
+		// keep any 2xx 3xx (inclusive)
+		filter.Values = values
+		ExpectFalse(t, filter.CheckKeep(nil, &http.Response{
+			StatusCode: http.StatusForbidden,
+		}))
+		ExpectTrue(t, filter.CheckKeep(nil, &http.Response{
+			StatusCode: http.StatusOK,
+		}))
+		ExpectTrue(t, filter.CheckKeep(nil, &http.Response{
+			StatusCode: http.StatusMultipleChoices,
+		}))
+		ExpectTrue(t, filter.CheckKeep(nil, &http.Response{
+			StatusCode: http.StatusPermanentRedirect,
+		}))
+	})
+
+	t.Run("negative", func(t *testing.T) {
+		filter := &LogFilter[*StatusCodeRange]{
+			Negative: true,
+		}
+		ExpectFalse(t, filter.CheckKeep(nil, nil))
+
+		// drop any 2xx 3xx (inclusive)
+		filter.Values = values
+		ExpectTrue(t, filter.CheckKeep(nil, &http.Response{
+			StatusCode: http.StatusForbidden,
+		}))
+		ExpectFalse(t, filter.CheckKeep(nil, &http.Response{
+			StatusCode: http.StatusOK,
+		}))
+		ExpectFalse(t, filter.CheckKeep(nil, &http.Response{
+			StatusCode: http.StatusMultipleChoices,
+		}))
+		ExpectFalse(t, filter.CheckKeep(nil, &http.Response{
+			StatusCode: http.StatusPermanentRedirect,
+		}))
+	})
+}
+
+func TestMethodFilter(t *testing.T) {
+	t.Run("positive", func(t *testing.T) {
+		filter := &LogFilter[HTTPMethod]{}
+		ExpectTrue(t, filter.CheckKeep(&http.Request{
+			Method: http.MethodGet,
+		}, nil))
+		ExpectTrue(t, filter.CheckKeep(&http.Request{
+			Method: http.MethodPost,
+		}, nil))
+
+		// keep get only
+		filter.Values = []HTTPMethod{http.MethodGet}
+		ExpectTrue(t, filter.CheckKeep(&http.Request{
+			Method: http.MethodGet,
+		}, nil))
+		ExpectFalse(t, filter.CheckKeep(&http.Request{
+			Method: http.MethodPost,
+		}, nil))
+	})
+
+	t.Run("negative", func(t *testing.T) {
+		filter := &LogFilter[HTTPMethod]{
+			Negative: true,
+		}
+		ExpectFalse(t, filter.CheckKeep(&http.Request{
+			Method: http.MethodGet,
+		}, nil))
+		ExpectFalse(t, filter.CheckKeep(&http.Request{
+			Method: http.MethodPost,
+		}, nil))
+
+		// drop post only
+		filter.Values = []HTTPMethod{http.MethodPost}
+		ExpectFalse(t, filter.CheckKeep(&http.Request{
+			Method: http.MethodPost,
+		}, nil))
+		ExpectTrue(t, filter.CheckKeep(&http.Request{
+			Method: http.MethodGet,
+		}, nil))
+	})
+}
+
+func TestHeaderFilter(t *testing.T) {
+	fooBar := &http.Request{
+		Header: http.Header{
+			"Foo": []string{"bar"},
+		},
+	}
+	fooBaz := &http.Request{
+		Header: http.Header{
+			"Foo": []string{"baz"},
+		},
+	}
+	headerFoo := []*HTTPHeader{
+		strutils.MustParse[*HTTPHeader]("Foo"),
+	}
+	ExpectEqual(t, headerFoo[0].Key, "Foo")
+	ExpectEqual(t, headerFoo[0].Value, "")
+	headerFooBar := []*HTTPHeader{
+		strutils.MustParse[*HTTPHeader]("Foo=bar"),
+	}
+	ExpectEqual(t, headerFooBar[0].Key, "Foo")
+	ExpectEqual(t, headerFooBar[0].Value, "bar")
+
+	t.Run("positive", func(t *testing.T) {
+		filter := &LogFilter[*HTTPHeader]{}
+		ExpectTrue(t, filter.CheckKeep(fooBar, nil))
+		ExpectTrue(t, filter.CheckKeep(fooBaz, nil))
+
+		// keep any foo
+		filter.Values = headerFoo
+		ExpectTrue(t, filter.CheckKeep(fooBar, nil))
+		ExpectTrue(t, filter.CheckKeep(fooBaz, nil))
+
+		// keep foo == bar
+		filter.Values = headerFooBar
+		ExpectTrue(t, filter.CheckKeep(fooBar, nil))
+		ExpectFalse(t, filter.CheckKeep(fooBaz, nil))
+	})
+	t.Run("negative", func(t *testing.T) {
+		filter := &LogFilter[*HTTPHeader]{
+			Negative: true,
+		}
+		ExpectFalse(t, filter.CheckKeep(fooBar, nil))
+		ExpectFalse(t, filter.CheckKeep(fooBaz, nil))
+
+		// drop any foo
+		filter.Values = headerFoo
+		ExpectFalse(t, filter.CheckKeep(fooBar, nil))
+		ExpectFalse(t, filter.CheckKeep(fooBaz, nil))
+
+		// drop foo == bar
+		filter.Values = headerFooBar
+		ExpectFalse(t, filter.CheckKeep(fooBar, nil))
+		ExpectTrue(t, filter.CheckKeep(fooBaz, nil))
+	})
+}
+
+func TestCIDRFilter(t *testing.T) {
+	cidr := []*CIDR{
+		strutils.MustParse[*CIDR]("192.168.10.0/24"),
+	}
+	ExpectEqual(t, cidr[0].String(), "192.168.10.0/24")
+	inCIDR := &http.Request{
+		RemoteAddr: "192.168.10.1",
+	}
+	notInCIDR := &http.Request{
+		RemoteAddr: "192.168.11.1",
+	}
+
+	t.Run("positive", func(t *testing.T) {
+		filter := &LogFilter[*CIDR]{}
+		ExpectTrue(t, filter.CheckKeep(inCIDR, nil))
+		ExpectTrue(t, filter.CheckKeep(notInCIDR, nil))
+
+		filter.Values = cidr
+		ExpectTrue(t, filter.CheckKeep(inCIDR, nil))
+		ExpectFalse(t, filter.CheckKeep(notInCIDR, nil))
+	})
+
+	t.Run("negative", func(t *testing.T) {
+		filter := &LogFilter[*CIDR]{Negative: true}
+		ExpectFalse(t, filter.CheckKeep(inCIDR, nil))
+		ExpectFalse(t, filter.CheckKeep(notInCIDR, nil))
+
+		filter.Values = cidr
+		ExpectFalse(t, filter.CheckKeep(inCIDR, nil))
+		ExpectTrue(t, filter.CheckKeep(notInCIDR, nil))
+	})
+}

internal/net/http/accesslog/formatter.go

@@ -0,0 +1,142 @@
+package accesslog
+
+import (
+	"bytes"
+	"encoding/json"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+	"time"
+)
+
+type (
+	CommonFormatter struct {
+		cfg        *Fields
+		GetTimeNow func() time.Time // for testing purposes only
+	}
+	CombinedFormatter struct{ CommonFormatter }
+	JSONFormatter     struct{ CommonFormatter }
+
+	JSONLogEntry struct {
+		Time        string              `json:"time"`
+		IP          string              `json:"ip"`
+		Method      string              `json:"method"`
+		Scheme      string              `json:"scheme"`
+		Host        string              `json:"host"`
+		URI         string              `json:"uri"`
+		Protocol    string              `json:"protocol"`
+		Status      int                 `json:"status"`
+		Error       string              `json:"error,omitempty"`
+		ContentType string              `json:"type"`
+		Size        int64               `json:"size"`
+		Referer     string              `json:"referer"`
+		UserAgent   string              `json:"useragent"`
+		Query       map[string][]string `json:"query,omitempty"`
+		Headers     map[string][]string `json:"headers,omitempty"`
+		Cookies     map[string]string   `json:"cookies,omitempty"`
+	}
+)
+
+const LogTimeFormat = "02/Jan/2006:15:04:05 -0700"
+
+func scheme(req *http.Request) string {
+	if req.TLS != nil {
+		return "https"
+	}
+	return "http"
+}
+
+func requestURI(u *url.URL, query url.Values) string {
+	uri := u.EscapedPath()
+	if len(query) > 0 {
+		uri += "?" + query.Encode()
+	}
+	return uri
+}
+
+func clientIP(req *http.Request) string {
+	clientIP, _, err := net.SplitHostPort(req.RemoteAddr)
+	if err == nil {
+		return clientIP
+	}
+	return req.RemoteAddr
+}
+
+// debug only.
+func (f *CommonFormatter) SetGetTimeNow(getTimeNow func() time.Time) {
+	f.GetTimeNow = getTimeNow
+}
+
+func (f *CommonFormatter) Format(line *bytes.Buffer, req *http.Request, res *http.Response) {
+	query := f.cfg.Query.ProcessQuery(req.URL.Query())
+
+	line.WriteString(req.Host)
+	line.WriteRune(' ')
+
+	line.WriteString(clientIP(req))
+	line.WriteString(" - - [")
+
+	line.WriteString(f.GetTimeNow().Format(LogTimeFormat))
+	line.WriteString("] \"")
+
+	line.WriteString(req.Method)
+	line.WriteRune(' ')
+	line.WriteString(requestURI(req.URL, query))
+	line.WriteRune(' ')
+	line.WriteString(req.Proto)
+	line.WriteString("\" ")
+
+	line.WriteString(strconv.Itoa(res.StatusCode))
+	line.WriteRune(' ')
+	line.WriteString(strconv.FormatInt(res.ContentLength, 10))
+}
+
+func (f *CombinedFormatter) Format(line *bytes.Buffer, req *http.Request, res *http.Response) {
+	f.CommonFormatter.Format(line, req, res)
+	line.WriteString(" \"")
+	line.WriteString(req.Referer())
+	line.WriteString("\" \"")
+	line.WriteString(req.UserAgent())
+	line.WriteRune('"')
+}
+
+func (f *JSONFormatter) Format(line *bytes.Buffer, req *http.Request, res *http.Response) {
+	query := f.cfg.Query.ProcessQuery(req.URL.Query())
+	headers := f.cfg.Headers.ProcessHeaders(req.Header)
+	headers.Del("Cookie")
+	cookies := f.cfg.Cookies.ProcessCookies(req.Cookies())
+
+	entry := JSONLogEntry{
+		Time:        f.GetTimeNow().Format(LogTimeFormat),
+		IP:          clientIP(req),
+		Method:      req.Method,
+		Scheme:      scheme(req),
+		Host:        req.Host,
+		URI:         requestURI(req.URL, query),
+		Protocol:    req.Proto,
+		Status:      res.StatusCode,
+		ContentType: res.Header.Get("Content-Type"),
+		Size:        res.ContentLength,
+		Referer:     req.Referer(),
+		UserAgent:   req.UserAgent(),
+		Query:       query,
+		Headers:     headers,
+		Cookies:     cookies,
+	}
+
+	if res.StatusCode >= 400 {
+		entry.Error = res.Status
+	}
+
+	if entry.ContentType == "" {
+		// try to get content type from request
+		entry.ContentType = req.Header.Get("Content-Type")
+	}
+
+	marshaller := json.NewEncoder(line)
+	err := marshaller.Encode(entry)
+	if err != nil {
+		logger.Err(err).Msg("failed to marshal json log")
+	}
+}

internal/net/http/accesslog/mock_file.go

@@ -0,0 +1,74 @@
+package accesslog
+
+import (
+	"bytes"
+	"io"
+	"sync"
+)
+
+type MockFile struct {
+	data     []byte
+	position int64
+	sync.Mutex
+}
+
+func (m *MockFile) Seek(offset int64, whence int) (int64, error) {
+	switch whence {
+	case io.SeekStart:
+		m.position = offset
+	case io.SeekCurrent:
+		m.position += offset
+	case io.SeekEnd:
+		m.position = int64(len(m.data)) + offset
+	}
+	return m.position, nil
+}
+
+func (m *MockFile) Write(p []byte) (n int, err error) {
+	m.data = append(m.data, p...)
+	n = len(p)
+	m.position += int64(n)
+	return
+}
+
+func (m *MockFile) Name() string {
+	return "mock"
+}
+
+func (m *MockFile) Read(p []byte) (n int, err error) {
+	if m.position >= int64(len(m.data)) {
+		return 0, io.EOF
+	}
+	n = copy(p, m.data[m.position:])
+	m.position += int64(n)
+	return n, nil
+}
+
+func (m *MockFile) ReadAt(p []byte, off int64) (n int, err error) {
+	if off >= int64(len(m.data)) {
+		return 0, io.EOF
+	}
+	n = copy(p, m.data[off:])
+	m.position += int64(n)
+	return n, nil
+}
+
+func (m *MockFile) Close() error {
+	return nil
+}
+
+func (m *MockFile) Truncate(size int64) error {
+	m.data = m.data[:size]
+	m.position = size
+	return nil
+}
+
+func (m *MockFile) Count() int {
+	m.Lock()
+	defer m.Unlock()
+	return bytes.Count(m.data[:m.position], []byte("\n"))
+}
+
+func (m *MockFile) Len() int64 {
+	return m.position
+}

internal/net/http/accesslog/retention.go

@@ -0,0 +1,198 @@
+package accesslog
+
+import (
+	"bufio"
+	"bytes"
+	"io"
+	"strconv"
+	"time"
+
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type Retention struct {
+	Days uint64 `json:"days"`
+	Last uint64 `json:"last"`
+}
+
+const chunkSizeMax int64 = 128 * 1024 // 128KB
+
+var (
+	ErrInvalidSyntax = E.New("invalid syntax")
+	ErrZeroValue     = E.New("zero value")
+)
+
+// Syntax:
+//
+// <N> days|weeks|months
+//
+// last <N>
+//
+// Parse implements strutils.Parser.
+func (r *Retention) Parse(v string) (err error) {
+	split := strutils.SplitSpace(v)
+	if len(split) != 2 {
+		return ErrInvalidSyntax.Subject(v)
+	}
+	switch split[0] {
+	case "last":
+		r.Last, err = strconv.ParseUint(split[1], 10, 64)
+	default: // <N> days|weeks|months
+		r.Days, err = strconv.ParseUint(split[0], 10, 64)
+		if err != nil {
+			return
+		}
+		switch split[1] {
+		case "days":
+		case "weeks":
+			r.Days *= 7
+		case "months":
+			r.Days *= 30
+		default:
+			return ErrInvalidSyntax.Subject("unit " + split[1])
+		}
+	}
+	if r.Days == 0 && r.Last == 0 {
+		return ErrZeroValue
+	}
+	return
+}
+
+func (r *Retention) rotateLogFile(file AccessLogIO) (err error) {
+	lastN := int(r.Last)
+	days := int(r.Days)
+
+	// Seek to end to get file size
+	size, err := file.Seek(0, io.SeekEnd)
+	if err != nil {
+		return err
+	}
+
+	// Initialize ring buffer for last N lines
+	lines := make([][]byte, 0, lastN|(days*1000))
+	pos := size
+	unprocessed := 0
+
+	var chunk [chunkSizeMax]byte
+	var lastLine []byte
+
+	var shouldStop func() bool
+	if days > 0 {
+		cutoff := time.Now().AddDate(0, 0, -days)
+		shouldStop = func() bool {
+			return len(lastLine) > 0 && !parseLogTime(lastLine).After(cutoff)
+		}
+	} else {
+		shouldStop = func() bool {
+			return len(lines) == lastN
+		}
+	}
+
+	// Read backwards until we have enough lines or reach start of file
+	for pos > 0 {
+		if pos > chunkSizeMax {
+			pos -= chunkSizeMax
+		} else {
+			pos = 0
+		}
+
+		// Seek to the current chunk
+		if _, err = file.Seek(pos, io.SeekStart); err != nil {
+			return err
+		}
+
+		var nRead int
+		// Read the chunk
+		if nRead, err = file.Read(chunk[unprocessed:]); err != nil {
+			return err
+		}
+
+		// last unprocessed bytes + read bytes
+		curChunk := chunk[:unprocessed+nRead]
+		unprocessed = len(curChunk)
+
+		// Split into lines
+		scanner := bufio.NewScanner(bytes.NewReader(curChunk))
+		for !shouldStop() && scanner.Scan() {
+			lastLine = scanner.Bytes()
+			lines = append(lines, lastLine)
+			unprocessed -= len(lastLine)
+		}
+		if shouldStop() {
+			break
+		}
+
+		// move unprocessed bytes to the beginning for next iteration
+		copy(chunk[:], curChunk[unprocessed:])
+	}
+
+	if days > 0 {
+		// truncate to the end of the log within last N days
+		return file.Truncate(pos)
+	}
+
+	// write lines to buffer in reverse order
+	// since we read them backwards
+	var buf bytes.Buffer
+	for i := len(lines) - 1; i >= 0; i-- {
+		buf.Write(lines[i])
+		buf.WriteRune('\n')
+	}
+
+	return writeTruncate(file, &buf)
+}
+
+func writeTruncate(file AccessLogIO, buf *bytes.Buffer) (err error) {
+	// Seek to beginning and truncate
+	if _, err := file.Seek(0, 0); err != nil {
+		return err
+	}
+
+	buffered := bufio.NewWriter(file)
+	// Write buffer back to file
+	nWritten, err := buffered.Write(buf.Bytes())
+	if err != nil {
+		return err
+	}
+	if err = buffered.Flush(); err != nil {
+		return err
+	}
+
+	// Truncate file
+	if err = file.Truncate(int64(nWritten)); err != nil {
+		return err
+	}
+
+	// check bytes written == buffer size
+	if nWritten != buf.Len() {
+		return io.ErrShortWrite
+	}
+	return
+}
+
+func parseLogTime(line []byte) (t time.Time) {
+	if len(line) == 0 {
+		return
+	}
+
+	var start, end int
+	const jsonStart = len(`{"time":"`)
+	const jsonEnd = jsonStart + len(LogTimeFormat)
+
+	if len(line) == '{' { // possibly json log
+		start = jsonStart
+		end = jsonEnd
+	} else { // possibly common or combined format
+		// Format: <virtual host> <host ip> - - [02/Jan/2006:15:04:05 -0700] ...
+		start = bytes.IndexRune(line, '[')
+		end = bytes.IndexRune(line[start+1:], ']')
+		if start == -1 || end == -1 || start >= end {
+			return
+		}
+	}
+
+	timeStr := line[start+1 : end]
+	t, _ = time.Parse(LogTimeFormat, string(timeStr)) // ignore error
+	return
+}

internal/net/http/accesslog/retention_test.go

@@ -0,0 +1,81 @@
+package accesslog_test
+
+import (
+	"testing"
+	"time"
+
+	. "github.com/yusing/go-proxy/internal/net/http/accesslog"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+func TestParseRetention(t *testing.T) {
+	tests := []struct {
+		input     string
+		expected  *Retention
+		shouldErr bool
+	}{
+		{"30 days", &Retention{Days: 30}, false},
+		{"2 weeks", &Retention{Days: 14}, false},
+		{"last 5", &Retention{Last: 5}, false},
+		{"invalid input", &Retention{}, true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			r := &Retention{}
+			err := r.Parse(test.input)
+			if !test.shouldErr {
+				ExpectNoError(t, err)
+			} else {
+				ExpectDeepEqual(t, r, test.expected)
+			}
+		})
+	}
+}
+
+func TestRetentionCommonFormat(t *testing.T) {
+	var file MockFile
+	logger := NewAccessLogger(task.RootTask("test", false), &file, &Config{
+		Format:     FormatCommon,
+		BufferSize: 1024,
+	})
+	for range 10 {
+		logger.Log(req, resp)
+	}
+	logger.Flush(true)
+	// test.Finish(nil)
+
+	ExpectEqual(t, logger.Config().Retention, nil)
+	ExpectTrue(t, file.Len() > 0)
+	ExpectEqual(t, file.Count(), 10)
+
+	t.Run("keep last", func(t *testing.T) {
+		logger.Config().Retention = strutils.MustParse[*Retention]("last 5")
+		ExpectEqual(t, logger.Config().Retention.Days, 0)
+		ExpectEqual(t, logger.Config().Retention.Last, 5)
+		ExpectNoError(t, logger.Rotate())
+		ExpectEqual(t, file.Count(), 5)
+	})
+
+	_ = file.Truncate(0)
+
+	timeNow := time.Now()
+	for i := range 10 {
+		logger.Formatter.(*CommonFormatter).GetTimeNow = func() time.Time {
+			return timeNow.AddDate(0, 0, -i)
+		}
+		logger.Log(req, resp)
+	}
+	logger.Flush(true)
+
+	// FIXME: keep days does not work
+	t.Run("keep days", func(t *testing.T) {
+		logger.Config().Retention = strutils.MustParse[*Retention]("3 days")
+		ExpectEqual(t, logger.Config().Retention.Days, 3)
+		ExpectEqual(t, logger.Config().Retention.Last, 0)
+		ExpectNoError(t, logger.Rotate())
+		ExpectEqual(t, file.Count(), 3)
+	})
+}

internal/net/http/accesslog/status_code_range.go

@@ -0,0 +1,52 @@
+package accesslog
+
+import (
+	"strconv"
+
+	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type StatusCodeRange struct {
+	Start int
+	End   int
+}
+
+var ErrInvalidStatusCodeRange = E.New("invalid status code range")
+
+func (r *StatusCodeRange) Includes(code int) bool {
+	return r.Start <= code && code <= r.End
+}
+
+// Parse implements strutils.Parser.
+func (r *StatusCodeRange) Parse(v string) error {
+	split := strutils.SplitRune(v, '-')
+	switch len(split) {
+	case 1:
+		start, err := strconv.Atoi(split[0])
+		if err != nil {
+			return E.From(err)
+		}
+		r.Start = start
+		r.End = start
+		return nil
+	case 2:
+		start, errStart := strconv.Atoi(split[0])
+		end, errEnd := strconv.Atoi(split[1])
+		if err := E.Join(errStart, errEnd); err != nil {
+			return err
+		}
+		r.Start = start
+		r.End = end
+		return nil
+	default:
+		return ErrInvalidStatusCodeRange.Subject(v)
+	}
+}
+
+func (r *StatusCodeRange) String() string {
+	if r.Start == r.End {
+		return strconv.Itoa(r.Start)
+	}
+	return strconv.Itoa(r.Start) + "-" + strconv.Itoa(r.End)
+}

internal/net/http/common.go

@@ -9,16 +9,20 @@ import (
 
 var (
 	defaultDialer = net.Dialer{
-		Timeout:   60 * time.Second,
-		KeepAlive: 60 * time.Second,
+		Timeout: 60 * time.Second,
 	}
 	DefaultTransport = &http.Transport{
 		Proxy:                 http.ProxyFromEnvironment,
 		DialContext:           defaultDialer.DialContext,
 		ForceAttemptHTTP2:     true,
 		MaxIdleConnsPerHost:   100,
+		IdleConnTimeout:       90 * time.Second,
 		TLSHandshakeTimeout:   10 * time.Second,
 		ExpectContinueTimeout: 1 * time.Second,
+		DisableCompression:    true, // Prevent double compression
+		ResponseHeaderTimeout: 30 * time.Second,
+		WriteBufferSize:       16 * 1024, // 16KB
+		ReadBufferSize:        16 * 1024, // 16KB
 	}
 	DefaultTransportNoTLS = func() *http.Transport {
 		clone := DefaultTransport.Clone()

internal/net/http/header_utils.go

@@ -4,6 +4,24 @@ import (
 	"net/http"
 )
 
+const (
+	HeaderXForwardedMethod = "X-Forwarded-Method"
+	HeaderXForwardedFor    = "X-Forwarded-For"
+	HeaderXForwardedProto  = "X-Forwarded-Proto"
+	HeaderXForwardedHost   = "X-Forwarded-Host"
+	HeaderXForwardedPort   = "X-Forwarded-Port"
+	HeaderXForwardedURI    = "X-Forwarded-Uri"
+	HeaderXRealIP          = "X-Real-IP"
+
+	HeaderUpstreamName   = "X-GoDoxy-Upstream-Name"
+	HeaderUpstreamScheme = "X-GoDoxy-Upstream-Scheme"
+	HeaderUpstreamHost   = "X-GoDoxy-Upstream-Host"
+	HeaderUpstreamPort   = "X-GoDoxy-Upstream-Port"
+
+	HeaderContentType   = "Content-Type"
+	HeaderContentLength = "Content-Length"
+)
+
 func RemoveHop(h http.Header) {
 	reqUpType := UpgradeType(h)
 	RemoveHopByHopHeaders(h)

internal/net/http/loadbalancer/ip_hash.go

@@ -14,7 +14,7 @@ type ipHash struct {
 	*LoadBalancer
 
 	realIP *middleware.Middleware
-	pool   servers
+	pool   Servers
 	mu     sync.Mutex
 }
 
@@ -24,9 +24,9 @@ func (lb *LoadBalancer) newIPHash() impl {
 		return impl
 	}
 	var err E.Error
-	impl.realIP, err = middleware.NewRealIP(lb.Options)
+	impl.realIP, err = middleware.RealIP.New(lb.Options)
 	if err != nil {
-		E.LogError("invalid real_ip options, ignoring", err, &impl.Logger)
+		E.LogError("invalid real_ip options, ignoring", err, &impl.l)
 	}
 	return impl
 }
@@ -60,7 +60,7 @@ func (impl *ipHash) OnRemoveServer(srv *Server) {
 	}
 }
 
-func (impl *ipHash) ServeHTTP(_ servers, rw http.ResponseWriter, r *http.Request) {
+func (impl *ipHash) ServeHTTP(_ Servers, rw http.ResponseWriter, r *http.Request) {
 	if impl.realIP != nil {
 		impl.realIP.ModifyRequest(impl.serveHTTP, rw, r)
 	} else {
@@ -72,7 +72,7 @@ func (impl *ipHash) serveHTTP(rw http.ResponseWriter, r *http.Request) {
 	ip, _, err := net.SplitHostPort(r.RemoteAddr)
 	if err != nil {
 		http.Error(rw, "Internal error", http.StatusInternalServerError)
-		impl.Err(err).Msg("invalid remote address " + r.RemoteAddr)
+		impl.l.Err(err).Msg("invalid remote address " + r.RemoteAddr)
 		return
 	}
 	idx := hashIP(ip) % uint32(len(impl.pool))

internal/net/http/loadbalancer/least_conn.go

@@ -27,18 +27,18 @@ func (impl *leastConn) OnRemoveServer(srv *Server) {
 	impl.nConn.Delete(srv)
 }
 
-func (impl *leastConn) ServeHTTP(srvs servers, rw http.ResponseWriter, r *http.Request) {
+func (impl *leastConn) ServeHTTP(srvs Servers, rw http.ResponseWriter, r *http.Request) {
 	srv := srvs[0]
 	minConn, ok := impl.nConn.Load(srv)
 	if !ok {
-		impl.Error().Msgf("[BUG] server %s not found", srv.Name)
+		impl.l.Error().Msgf("[BUG] server %s not found", srv.Name)
 		http.Error(rw, "Internal error", http.StatusInternalServerError)
 	}
 
 	for i := 1; i < len(srvs); i++ {
 		nConn, ok := impl.nConn.Load(srvs[i])
 		if !ok {
-			impl.Error().Msgf("[BUG] server %s not found", srv.Name)
+			impl.l.Error().Msgf("[BUG] server %s not found", srv.Name)
 			http.Error(rw, "Internal error", http.StatusInternalServerError)
 		}
 		if nConn.Load() < minConn.Load() {

internal/net/http/loadbalancer/loadbalancer.go

@@ -7,72 +7,73 @@ import (
 
 	"github.com/rs/zerolog"
 	"github.com/yusing/go-proxy/internal/common"
-	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
 	E "github.com/yusing/go-proxy/internal/error"
-	"github.com/yusing/go-proxy/internal/net/http/middleware"
+	"github.com/yusing/go-proxy/internal/net/http/loadbalancer/types"
+	"github.com/yusing/go-proxy/internal/route/routes"
 	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/internal/watcher/health"
+	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
 )
 
 // TODO: stats of each server.
 // TODO: support weighted mode.
 type (
 	impl interface {
-		ServeHTTP(srvs servers, rw http.ResponseWriter, r *http.Request)
+		ServeHTTP(srvs Servers, rw http.ResponseWriter, r *http.Request)
 		OnAddServer(srv *Server)
 		OnRemoveServer(srv *Server)
 	}
-	Config struct {
-		Link    string                `json:"link" yaml:"link"`
-		Mode    Mode                  `json:"mode" yaml:"mode"`
-		Weight  weightType            `json:"weight" yaml:"weight"`
-		Options middleware.OptionsRaw `json:"options,omitempty" yaml:"options,omitempty"`
-	}
-	LoadBalancer struct {
-		zerolog.Logger
 
+	LoadBalancer struct {
 		impl
 		*Config
 
-		task task.Task
+		task *task.Task
 
 		pool   Pool
 		poolMu sync.Mutex
 
-		sumWeight weightType
+		sumWeight Weight
 		startTime time.Time
-	}
 
-	weightType uint16
+		l zerolog.Logger
+	}
 )
 
-const maxWeight weightType = 100
+const maxWeight Weight = 100
 
 func New(cfg *Config) *LoadBalancer {
 	lb := &LoadBalancer{
-		Logger: logger.With().Str("name", cfg.Link).Logger(),
 		Config: new(Config),
-		pool:   newPool(),
+		pool:   types.NewServerPool(),
+		l:      logger.With().Str("name", cfg.Link).Logger(),
 	}
 	lb.UpdateConfigIfNeeded(cfg)
 	return lb
 }
 
 // Start implements task.TaskStarter.
-func (lb *LoadBalancer) Start(routeSubtask task.Task) E.Error {
+func (lb *LoadBalancer) Start(parent task.Parent) E.Error {
 	lb.startTime = time.Now()
-	lb.task = routeSubtask
-	lb.task.OnFinished("loadbalancer cleanup", func() {
+	lb.task = parent.Subtask("loadbalancer."+lb.Link, false)
+	parent.OnCancel("lb_remove_route", func() {
+		routes.DeleteHTTPRoute(lb.Link)
+	})
+	lb.task.OnFinished("cleanup", func() {
 		if lb.impl != nil {
 			lb.pool.RangeAll(func(k string, v *Server) {
 				lb.impl.OnRemoveServer(v)
 			})
 		}
-		lb.pool.Clear()
 	})
 	return nil
 }
 
+// Task implements task.TaskStarter.
+func (lb *LoadBalancer) Task() *task.Task {
+	return lb.task
+}
+
 // Finish implements task.TaskFinisher.
 func (lb *LoadBalancer) Finish(reason any) {
 	lb.task.Finish(reason)
@@ -80,11 +81,11 @@ func (lb *LoadBalancer) Finish(reason any) {
 
 func (lb *LoadBalancer) updateImpl() {
 	switch lb.Mode {
-	case Unset, RoundRobin:
+	case types.ModeUnset, types.ModeRoundRobin:
 		lb.impl = lb.newRoundRobin()
-	case LeastConn:
+	case types.ModeLeastConn:
 		lb.impl = lb.newLeastConn()
-	case IPHash:
+	case types.ModeIPHash:
 		lb.impl = lb.newIPHash()
 	default: // should happen in test only
 		lb.impl = lb.newRoundRobin()
@@ -101,10 +102,10 @@ func (lb *LoadBalancer) UpdateConfigIfNeeded(cfg *Config) {
 
 		lb.Link = cfg.Link
 
-		if lb.Mode == Unset && cfg.Mode != Unset {
+		if lb.Mode == types.ModeUnset && cfg.Mode != types.ModeUnset {
 			lb.Mode = cfg.Mode
 			if !lb.Mode.ValidateUpdate() {
-				lb.Error().Msgf("invalid mode %q, fallback to %q", cfg.Mode, lb.Mode)
+				lb.l.Error().Msgf("invalid mode %q, fallback to %q", cfg.Mode, lb.Mode)
 			}
 			lb.updateImpl()
 		}
@@ -134,7 +135,7 @@ func (lb *LoadBalancer) AddServer(srv *Server) {
 	lb.rebalance()
 	lb.impl.OnAddServer(srv)
 
-	lb.Debug().
+	lb.l.Debug().
 		Str("action", "add").
 		Str("server", srv.Name).
 		Msgf("%d servers available", lb.pool.Size())
@@ -154,7 +155,7 @@ func (lb *LoadBalancer) RemoveServer(srv *Server) {
 	lb.rebalance()
 	lb.impl.OnRemoveServer(srv)
 
-	lb.Debug().
+	lb.l.Debug().
 		Str("action", "remove").
 		Str("server", srv.Name).
 		Msgf("%d servers left", lb.pool.Size())
@@ -169,12 +170,14 @@ func (lb *LoadBalancer) rebalance() {
 	if lb.sumWeight == maxWeight {
 		return
 	}
-	if lb.pool.Size() == 0 {
+
+	poolSize := lb.pool.Size()
+	if poolSize == 0 {
 		return
 	}
 	if lb.sumWeight == 0 { // distribute evenly
-		weightEach := maxWeight / weightType(lb.pool.Size())
-		remainder := maxWeight % weightType(lb.pool.Size())
+		weightEach := maxWeight / Weight(poolSize)
+		remainder := maxWeight % Weight(poolSize)
 		lb.pool.RangeAll(func(_ string, s *Server) {
 			s.Weight = weightEach
 			lb.sumWeight += weightEach
@@ -191,7 +194,7 @@ func (lb *LoadBalancer) rebalance() {
 	lb.sumWeight = 0
 
 	lb.pool.RangeAll(func(_ string, s *Server) {
-		s.Weight = weightType(float64(s.Weight) * scaleFactor)
+		s.Weight = Weight(float64(s.Weight) * scaleFactor)
 		lb.sumWeight += s.Weight
 	})
 
@@ -225,12 +228,8 @@ func (lb *LoadBalancer) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
 	if r.Header.Get(common.HeaderCheckRedirect) != "" {
 		// wake all servers
 		for _, srv := range srvs {
-			// wake only if server implements Waker
-			waker, ok := srv.handler.(idlewatcher.Waker)
-			if ok {
-				if err := waker.Wake(); err != nil {
-					lb.Err(err).Msgf("failed to wake server %s", srv.Name)
-				}
+			if err := srv.TryWake(); err != nil {
+				lb.l.Warn().Err(err).Str("server", srv.Name).Msg("failed to wake server")
 			}
 		}
 	}
@@ -245,10 +244,10 @@ func (lb *LoadBalancer) Uptime() time.Duration {
 func (lb *LoadBalancer) MarshalJSON() ([]byte, error) {
 	extra := make(map[string]any)
 	lb.pool.RangeAll(func(k string, v *Server) {
-		extra[v.Name] = v.healthMon
+		extra[v.Name] = v.HealthMonitor()
 	})
 
-	return (&health.JSONRepresentation{
+	return (&monitor.JSONRepresentation{
 		Name:    lb.Name(),
 		Status:  lb.Status(),
 		Started: lb.startTime,

internal/net/http/loadbalancer/loadbalancer_test.go

@@ -3,13 +3,14 @@ package loadbalancer
 import (
 	"testing"
 
+	loadbalance "github.com/yusing/go-proxy/internal/net/http/loadbalancer/types"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )
 
 func TestRebalance(t *testing.T) {
 	t.Parallel()
 	t.Run("zero", func(t *testing.T) {
-		lb := New(new(Config))
+		lb := New(new(loadbalance.Config))
 		for range 10 {
 			lb.AddServer(&Server{})
 		}
@@ -17,25 +18,25 @@ func TestRebalance(t *testing.T) {
 		ExpectEqual(t, lb.sumWeight, maxWeight)
 	})
 	t.Run("less", func(t *testing.T) {
-		lb := New(new(Config))
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .1)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .2)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .3)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .2)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .1)})
+		lb := New(new(loadbalance.Config))
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .1)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .2)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .3)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .2)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .1)})
 		lb.rebalance()
 		// t.Logf("%s", U.Must(json.MarshalIndent(lb.pool, "", "  ")))
 		ExpectEqual(t, lb.sumWeight, maxWeight)
 	})
 	t.Run("more", func(t *testing.T) {
-		lb := New(new(Config))
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .1)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .2)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .3)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .4)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .3)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .2)})
-		lb.AddServer(&Server{Weight: weightType(float64(maxWeight) * .1)})
+		lb := New(new(loadbalance.Config))
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .1)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .2)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .3)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .4)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .3)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .2)})
+		lb.AddServer(&Server{Weight: loadbalance.Weight(float64(maxWeight) * .1)})
 		lb.rebalance()
 		// t.Logf("%s", U.Must(json.MarshalIndent(lb.pool, "", "  ")))
 		ExpectEqual(t, lb.sumWeight, maxWeight)

internal/net/http/loadbalancer/mode.go

@@ -1,32 +0,0 @@
-package loadbalancer
-
-import (
-	"github.com/yusing/go-proxy/internal/utils/strutils"
-)
-
-type Mode string
-
-const (
-	Unset      Mode = ""
-	RoundRobin Mode = "roundrobin"
-	LeastConn  Mode = "leastconn"
-	IPHash     Mode = "iphash"
-)
-
-func (mode *Mode) ValidateUpdate() bool {
-	switch strutils.ToLowerNoSnake(string(*mode)) {
-	case "":
-		return true
-	case string(RoundRobin):
-		*mode = RoundRobin
-		return true
-	case string(LeastConn):
-		*mode = LeastConn
-		return true
-	case string(IPHash):
-		*mode = IPHash
-		return true
-	}
-	*mode = RoundRobin
-	return false
-}

internal/net/http/loadbalancer/round_robin.go

@@ -13,7 +13,7 @@ func (*LoadBalancer) newRoundRobin() impl         { return &roundRobin{} }
 func (lb *roundRobin) OnAddServer(srv *Server)    {}
 func (lb *roundRobin) OnRemoveServer(srv *Server) {}
 
-func (lb *roundRobin) ServeHTTP(srvs servers, rw http.ResponseWriter, r *http.Request) {
+func (lb *roundRobin) ServeHTTP(srvs Servers, rw http.ResponseWriter, r *http.Request) {
 	index := lb.index.Add(1) % uint32(len(srvs))
 	srvs[index].ServeHTTP(rw, r)
 	if lb.index.Load() >= 2*uint32(len(srvs)) {

internal/net/http/loadbalancer/types.go

@@ -0,0 +1,14 @@
+package loadbalancer
+
+import (
+	"github.com/yusing/go-proxy/internal/net/http/loadbalancer/types"
+)
+
+type (
+	Server  = types.Server
+	Servers = types.Servers
+	Pool    = types.Pool
+	Weight  = types.Weight
+	Config  = types.Config
+	Mode    = types.Mode
+)

internal/net/http/loadbalancer/types/config.go

@@ -0,0 +1,8 @@
+package types
+
+type Config struct {
+	Link    string         `json:"link"`
+	Mode    Mode           `json:"mode"`
+	Weight  Weight         `json:"weight"`
+	Options map[string]any `json:"options,omitempty"`
+}

internal/net/http/loadbalancer/types/mode.go

@@ -0,0 +1,32 @@
+package types
+
+import (
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type Mode string
+
+const (
+	ModeUnset      Mode = ""
+	ModeRoundRobin Mode = "roundrobin"
+	ModeLeastConn  Mode = "leastconn"
+	ModeIPHash     Mode = "iphash"
+)
+
+func (mode *Mode) ValidateUpdate() bool {
+	switch strutils.ToLowerNoSnake(string(*mode)) {
+	case "":
+		return true
+	case string(ModeRoundRobin):
+		*mode = ModeRoundRobin
+		return true
+	case string(ModeLeastConn):
+		*mode = ModeLeastConn
+		return true
+	case string(ModeIPHash):
+		*mode = ModeIPHash
+		return true
+	}
+	*mode = ModeRoundRobin
+	return false
+}

internal/net/http/loadbalancer/types/server.go

@@ -1,9 +1,10 @@
-package loadbalancer
+package types
 
 import (
 	"net/http"
 	"time"
 
+	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
 	"github.com/yusing/go-proxy/internal/net/types"
 	U "github.com/yusing/go-proxy/internal/utils"
 	F "github.com/yusing/go-proxy/internal/utils/functional"
@@ -16,18 +17,18 @@ type (
 
 		Name   string
 		URL    types.URL
-		Weight weightType
+		Weight Weight
 
 		handler   http.Handler
 		healthMon health.HealthMonitor
 	}
-	servers = []*Server
+	Servers = []*Server
 	Pool    = F.Map[string, *Server]
 )
 
-var newPool = F.NewMap[Pool]
+var NewServerPool = F.NewMap[Pool]
 
-func NewServer(name string, url types.URL, weight weightType, handler http.Handler, healthMon health.HealthMonitor) *Server {
+func NewServer(name string, url types.URL, weight Weight, handler http.Handler, healthMon health.HealthMonitor) *Server {
 	srv := &Server{
 		Name:      name,
 		URL:       url,
@@ -53,3 +54,17 @@ func (srv *Server) Status() health.Status {
 func (srv *Server) Uptime() time.Duration {
 	return srv.healthMon.Uptime()
 }
+
+func (srv *Server) TryWake() error {
+	waker, ok := srv.handler.(idlewatcher.Waker)
+	if ok {
+		if err := waker.Wake(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (srv *Server) HealthMonitor() health.HealthMonitor {
+	return srv.healthMon
+}

internal/net/http/loadbalancer/types/weight.go

@@ -0,0 +1,3 @@
+package types
+
+type Weight uint16

internal/net/http/middleware/cidr_whitelist.go

@@ -4,51 +4,45 @@ import (
 	"net"
 	"net/http"
 
-	E "github.com/yusing/go-proxy/internal/error"
 	"github.com/yusing/go-proxy/internal/net/types"
 	F "github.com/yusing/go-proxy/internal/utils/functional"
 )
 
-type cidrWhitelist struct {
-	cidrWhitelistOpts
-	m          *Middleware
-	cachedAddr F.Map[string, bool] // cache for trusted IPs
-}
-
-type cidrWhitelistOpts struct {
-	Allow      []*types.CIDR `json:"allow"`
-	StatusCode int           `json:"statusCode"`
-	Message    string        `json:"message"`
-}
+type (
+	cidrWhitelist struct {
+		CIDRWhitelistOpts
+		Tracer
+		cachedAddr F.Map[string, bool] // cache for trusted IPs
+	}
+	CIDRWhitelistOpts struct {
+		Allow      []*types.CIDR `validate:"min=1"`
+		StatusCode int           `json:"status_code" aliases:"status" validate:"omitempty,gte=400,lte=599"`
+		Message    string
+	}
+)
 
 var (
-	CIDRWhiteList         = &Middleware{withOptions: NewCIDRWhitelist}
-	cidrWhitelistDefaults = cidrWhitelistOpts{
+	CIDRWhiteList         = NewMiddleware[cidrWhitelist]()
+	cidrWhitelistDefaults = CIDRWhitelistOpts{
 		Allow:      []*types.CIDR{},
 		StatusCode: http.StatusForbidden,
 		Message:    "IP not allowed",
 	}
 )
 
-func NewCIDRWhitelist(opts OptionsRaw) (*Middleware, E.Error) {
-	wl := new(cidrWhitelist)
-	wl.m = &Middleware{
-		impl:   wl,
-		before: wl.checkIP,
-	}
-	wl.cidrWhitelistOpts = cidrWhitelistDefaults
+// setup implements MiddlewareWithSetup.
+func (wl *cidrWhitelist) setup() {
+	wl.CIDRWhitelistOpts = cidrWhitelistDefaults
 	wl.cachedAddr = F.NewMapOf[string, bool]()
-	err := Deserialize(opts, &wl.cidrWhitelistOpts)
-	if err != nil {
-		return nil, err
-	}
-	if len(wl.cidrWhitelistOpts.Allow) == 0 {
-		return nil, E.New("no allowed CIDRs")
-	}
-	return wl.m, nil
 }
 
-func (wl *cidrWhitelist) checkIP(next http.HandlerFunc, w ResponseWriter, r *Request) {
+// before implements RequestModifier.
+func (wl *cidrWhitelist) before(w http.ResponseWriter, r *http.Request) bool {
+	return wl.checkIP(w, r)
+}
+
+// checkIP checks if the IP address is allowed.
+func (wl *cidrWhitelist) checkIP(w http.ResponseWriter, r *http.Request) bool {
 	var allow, ok bool
 	if allow, ok = wl.cachedAddr.Load(r.RemoteAddr); !ok {
 		ipStr, _, err := net.SplitHostPort(r.RemoteAddr)
@@ -56,24 +50,23 @@ func (wl *cidrWhitelist) checkIP(next http.HandlerFunc, w ResponseWriter, r *Req
 			ipStr = r.RemoteAddr
 		}
 		ip := net.ParseIP(ipStr)
-		for _, cidr := range wl.cidrWhitelistOpts.Allow {
+		for _, cidr := range wl.CIDRWhitelistOpts.Allow {
 			if cidr.Contains(ip) {
 				wl.cachedAddr.Store(r.RemoteAddr, true)
 				allow = true
-				wl.m.AddTracef("client %s is allowed", ipStr).With("allowed CIDR", cidr)
+				wl.AddTracef("client %s is allowed", ipStr).With("allowed CIDR", cidr)
 				break
 			}
 		}
 		if !allow {
 			wl.cachedAddr.Store(r.RemoteAddr, false)
-			wl.m.AddTracef("client %s is forbidden", ipStr).With("allowed CIDRs", wl.cidrWhitelistOpts.Allow)
+			wl.AddTracef("client %s is forbidden", ipStr).With("allowed CIDRs", wl.CIDRWhitelistOpts.Allow)
 		}
 	}
 	if !allow {
-		w.WriteHeader(wl.StatusCode)
-		w.Write([]byte(wl.Message))
-		return
+		http.Error(w, wl.Message, wl.StatusCode)
+		return false
 	}
 
-	next(w, r)
+	return true
 }

internal/net/http/middleware/cidr_whitelist_test.go

@@ -2,10 +2,13 @@ package middleware
 
 import (
 	_ "embed"
+	"net"
 	"net/http"
+	"strings"
 	"testing"
 
 	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/utils"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )
 
@@ -13,6 +16,38 @@ import (
 var testCIDRWhitelistCompose []byte
 var deny, accept *Middleware
 
+func TestCIDRWhitelistValidation(t *testing.T) {
+	const testMessage = "test-message"
+	t.Run("valid", func(t *testing.T) {
+		_, err := CIDRWhiteList.New(OptionsRaw{
+			"allow":   []string{"192.168.2.100/32"},
+			"message": testMessage,
+		})
+		ExpectNoError(t, err)
+	})
+	t.Run("missing allow", func(t *testing.T) {
+		_, err := CIDRWhiteList.New(OptionsRaw{
+			"message": testMessage,
+		})
+		ExpectError(t, utils.ErrValidationError, err)
+	})
+	t.Run("invalid cidr", func(t *testing.T) {
+		_, err := CIDRWhiteList.New(OptionsRaw{
+			"allow":   []string{"192.168.2.100/123"},
+			"message": testMessage,
+		})
+		ExpectErrorT[*net.ParseError](t, err)
+	})
+	t.Run("invalid status code", func(t *testing.T) {
+		_, err := CIDRWhiteList.New(OptionsRaw{
+			"allow":       []string{"192.168.2.100/32"},
+			"status_code": 600,
+			"message":     testMessage,
+		})
+		ExpectError(t, utils.ErrValidationError, err)
+	})
+}
+
 func TestCIDRWhitelist(t *testing.T) {
 	errs := E.NewBuilder("")
 	mids := BuildMiddlewaresFromYAML("", testCIDRWhitelistCompose, errs)
@@ -24,15 +59,17 @@ func TestCIDRWhitelist(t *testing.T) {
 	}
 
 	t.Run("deny", func(t *testing.T) {
+		t.Parallel()
 		for range 10 {
 			result, err := newMiddlewareTest(deny, nil)
 			ExpectNoError(t, err)
 			ExpectEqual(t, result.ResponseStatus, cidrWhitelistDefaults.StatusCode)
-			ExpectEqual(t, string(result.Data), cidrWhitelistDefaults.Message)
+			ExpectEqual(t, strings.TrimSpace(string(result.Data)), cidrWhitelistDefaults.Message)
 		}
 	})
 
 	t.Run("accept", func(t *testing.T) {
+		t.Parallel()
 		for range 10 {
 			result, err := newMiddlewareTest(accept, nil)
 			ExpectNoError(t, err)

internal/net/http/middleware/cloudflare_real_ip.go

@@ -6,16 +6,20 @@ import (
 	"io"
 	"net"
 	"net/http"
-	"strings"
 	"sync"
 	"time"
 
 	"github.com/yusing/go-proxy/internal/common"
-	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/net/types"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
+type cloudflareRealIP struct {
+	realIP    realIP
+	Recursive bool
+}
+
 const (
 	cfIPv4CIDRsEndpoint        = "https://www.cloudflare.com/ips-v4"
 	cfIPv6CIDRsEndpoint        = "https://www.cloudflare.com/ips-v6"
@@ -29,26 +33,31 @@ var (
 	cfCIDRsLogger     = logger.With().Str("name", "CloudflareRealIP").Logger()
 )
 
-var CloudflareRealIP = &Middleware{withOptions: NewCloudflareRealIP}
+var CloudflareRealIP = NewMiddleware[cloudflareRealIP]()
 
-func NewCloudflareRealIP(_ OptionsRaw) (*Middleware, E.Error) {
-	cri := new(realIP)
-	cri.m = &Middleware{
-		impl: cri,
-		before: func(next http.HandlerFunc, w ResponseWriter, r *Request) {
-			cidrs := tryFetchCFCIDR()
-			if cidrs != nil {
-				cri.From = cidrs
-			}
-			cri.setRealIP(r)
-			next(w, r)
-		},
+// setup implements MiddlewareWithSetup.
+func (cri *cloudflareRealIP) setup() {
+	cri.realIP.RealIPOpts = RealIPOpts{
+		Header:    "Cf-Connecting-Ip",
+		Recursive: cri.Recursive,
 	}
-	cri.realIPOpts = realIPOpts{
-		Header:    "CF-Connecting-IP",
-		Recursive: true,
+}
+
+// before implements RequestModifier.
+func (cri *cloudflareRealIP) before(w http.ResponseWriter, r *http.Request) bool {
+	cidrs := tryFetchCFCIDR()
+	if cidrs != nil {
+		cri.realIP.From = cidrs
 	}
-	return cri.m, nil
+	return cri.realIP.before(w, r)
+}
+
+func (cri *cloudflareRealIP) enableTrace() {
+	cri.realIP.enableTrace()
+}
+
+func (cri *cloudflareRealIP) getTracer() *Tracer {
+	return cri.realIP.getTracer()
 }
 
 func tryFetchCFCIDR() (cfCIDRs []*types.CIDR) {
@@ -73,14 +82,17 @@ func tryFetchCFCIDR() (cfCIDRs []*types.CIDR) {
 	} else {
 		cfCIDRs = make([]*types.CIDR, 0, 30)
 		err := errors.Join(
-			fetchUpdateCFIPRange(cfIPv4CIDRsEndpoint, cfCIDRs),
-			fetchUpdateCFIPRange(cfIPv6CIDRsEndpoint, cfCIDRs),
+			fetchUpdateCFIPRange(cfIPv4CIDRsEndpoint, &cfCIDRs),
+			fetchUpdateCFIPRange(cfIPv6CIDRsEndpoint, &cfCIDRs),
 		)
 		if err != nil {
 			cfCIDRsLastUpdate = time.Now().Add(-cfCIDRsUpdateRetryInterval - cfCIDRsUpdateInterval)
 			cfCIDRsLogger.Err(err).Msg("failed to update cloudflare range, retry in " + strutils.FormatDuration(cfCIDRsUpdateRetryInterval))
 			return nil
 		}
+		if len(cfCIDRs) == 0 {
+			logging.Warn().Msg("cloudflare CIDR range is empty")
+		}
 	}
 
 	cfCIDRsLastUpdate = time.Now()
@@ -88,7 +100,7 @@ func tryFetchCFCIDR() (cfCIDRs []*types.CIDR) {
 	return
 }
 
-func fetchUpdateCFIPRange(endpoint string, cfCIDRs []*types.CIDR) error {
+func fetchUpdateCFIPRange(endpoint string, cfCIDRs *[]*types.CIDR) error {
 	resp, err := http.Get(endpoint)
 	if err != nil {
 		return err
@@ -100,7 +112,7 @@ func fetchUpdateCFIPRange(endpoint string, cfCIDRs []*types.CIDR) error {
 		return err
 	}
 
-	for _, line := range strings.Split(string(body), "\n") {
+	for _, line := range strutils.SplitLine(string(body)) {
 		if line == "" {
 			continue
 		}
@@ -109,7 +121,7 @@ func fetchUpdateCFIPRange(endpoint string, cfCIDRs []*types.CIDR) error {
 			return fmt.Errorf("cloudflare responeded an invalid CIDR: %s", line)
 		}
 
-		cfCIDRs = append(cfCIDRs, (*types.CIDR)(cidr))
+		*cfCIDRs = append(*cfCIDRs, (*types.CIDR)(cidr))
 	}
 
 	return nil

internal/net/http/middleware/custom_error_page.go

@@ -12,45 +12,38 @@ import (
 	"github.com/yusing/go-proxy/internal/net/http/middleware/errorpage"
 )
 
-var CustomErrorPage *Middleware
+type customErrorPage struct{}
 
-func init() {
-	CustomErrorPage = customErrorPage()
+var CustomErrorPage = NewMiddleware[customErrorPage]()
+
+// before implements RequestModifier.
+func (customErrorPage) before(w http.ResponseWriter, r *http.Request) (proceed bool) {
+	return !ServeStaticErrorPageFile(w, r)
 }
 
-func customErrorPage() *Middleware {
-	m := &Middleware{
-		before: func(next http.HandlerFunc, w ResponseWriter, r *Request) {
-			if !ServeStaticErrorPageFile(w, r) {
-				next(w, r)
-			}
-		},
-	}
-	m.modifyResponse = func(resp *Response) error {
-		// only handles non-success status code and html/plain content type
-		contentType := gphttp.GetContentType(resp.Header)
-		if !gphttp.IsSuccess(resp.StatusCode) && (contentType.IsHTML() || contentType.IsPlainText()) {
-			errorPage, ok := errorpage.GetErrorPageByStatus(resp.StatusCode)
-			if ok {
-				CustomErrorPage.Debug().Msgf("error page for status %d loaded", resp.StatusCode)
-				/* trunk-ignore(golangci-lint/errcheck) */
-				io.Copy(io.Discard, resp.Body) // drain the original body
-				resp.Body.Close()
-				resp.Body = io.NopCloser(bytes.NewReader(errorPage))
-				resp.ContentLength = int64(len(errorPage))
-				resp.Header.Set("Content-Length", strconv.Itoa(len(errorPage)))
-				resp.Header.Set("Content-Type", "text/html; charset=utf-8")
-			} else {
-				CustomErrorPage.Error().Msgf("unable to load error page for status %d", resp.StatusCode)
-			}
-			return nil
+// modifyResponse implements ResponseModifier.
+func (customErrorPage) modifyResponse(resp *http.Response) error {
+	// only handles non-success status code and html/plain content type
+	contentType := gphttp.GetContentType(resp.Header)
+	if !gphttp.IsSuccess(resp.StatusCode) && (contentType.IsHTML() || contentType.IsPlainText()) {
+		errorPage, ok := errorpage.GetErrorPageByStatus(resp.StatusCode)
+		if ok {
+			logger.Debug().Msgf("error page for status %d loaded", resp.StatusCode)
+			_, _ = io.Copy(io.Discard, resp.Body) // drain the original body
+			resp.Body.Close()
+			resp.Body = io.NopCloser(bytes.NewReader(errorPage))
+			resp.ContentLength = int64(len(errorPage))
+			resp.Header.Set(gphttp.HeaderContentLength, strconv.Itoa(len(errorPage)))
+			resp.Header.Set(gphttp.HeaderContentType, "text/html; charset=utf-8")
+		} else {
+			logger.Error().Msgf("unable to load error page for status %d", resp.StatusCode)
 		}
 		return nil
 	}
-	return m
+	return nil
 }
 
-func ServeStaticErrorPageFile(w http.ResponseWriter, r *http.Request) bool {
+func ServeStaticErrorPageFile(w http.ResponseWriter, r *http.Request) (served bool) {
 	path := r.URL.Path
 	if path != "" && path[0] != '/' {
 		path = "/" + path
@@ -65,11 +58,11 @@ func ServeStaticErrorPageFile(w http.ResponseWriter, r *http.Request) bool {
 		ext := filepath.Ext(filename)
 		switch ext {
 		case ".html":
-			w.Header().Set("Content-Type", "text/html; charset=utf-8")
+			w.Header().Set(gphttp.HeaderContentType, "text/html; charset=utf-8")
 		case ".js":
-			w.Header().Set("Content-Type", "application/javascript; charset=utf-8")
+			w.Header().Set(gphttp.HeaderContentType, "application/javascript; charset=utf-8")
 		case ".css":
-			w.Header().Set("Content-Type", "text/css; charset=utf-8")
+			w.Header().Set(gphttp.HeaderContentType, "text/css; charset=utf-8")
 		default:
 			logger.Error().Msgf("unexpected file type %q for %s", ext, filename)
 		}

internal/net/http/middleware/errorpage/error_page.go

@@ -32,10 +32,10 @@ func setup() {
 		return
 	}
 
-	task := task.GlobalTask("error page")
-	dirWatcher = W.NewDirectoryWatcher(task.Subtask("dir watcher"), errPagesBasePath)
+	t := task.RootTask("error_page", false)
+	dirWatcher = W.NewDirectoryWatcher(t, errPagesBasePath)
 	loadContent()
-	go watchDir(task)
+	go watchDir()
 }
 
 func GetStaticFile(filename string) ([]byte, bool) {
@@ -73,11 +73,11 @@ func loadContent() {
 	}
 }
 
-func watchDir(task task.Task) {
-	eventCh, errCh := dirWatcher.Events(task.Context())
+func watchDir() {
+	eventCh, errCh := dirWatcher.Events(task.RootContext())
 	for {
 		select {
-		case <-task.Context().Done():
+		case <-task.RootContextCanceled():
 			return
 		case event, ok := <-eventCh:
 			if !ok {

internal/net/http/middleware/errors.go

@@ -1,5 +0,0 @@
-package middleware
-
-import E "github.com/yusing/go-proxy/internal/error"
-
-var ErrZeroValue = E.New("cannot be zero")

internal/net/http/middleware/forward_auth.go

@@ -8,76 +8,62 @@ import (
 	"io"
 	"net"
 	"net/http"
-	"net/url"
 	"slices"
 	"strings"
 	"time"
 
-	E "github.com/yusing/go-proxy/internal/error"
 	gphttp "github.com/yusing/go-proxy/internal/net/http"
+	F "github.com/yusing/go-proxy/internal/utils/functional"
 )
 
 type (
 	forwardAuth struct {
-		forwardAuthOpts
-		m      *Middleware
-		client http.Client
+		ForwardAuthOpts
+		Tracer
+		reqCookiesMap F.Map[*http.Request, []*http.Cookie]
 	}
-	forwardAuthOpts struct {
-		Address                  string   `json:"address"`
-		TrustForwardHeader       bool     `json:"trustForwardHeader"`
-		AuthResponseHeaders      []string `json:"authResponseHeaders"`
-		AddAuthCookiesToResponse []string `json:"addAuthCookiesToResponse"`
-
-		transport http.RoundTripper
+	ForwardAuthOpts struct {
+		Address                  string `validate:"url,required"`
+		TrustForwardHeader       bool
+		AuthResponseHeaders      []string
+		AddAuthCookiesToResponse []string
 	}
 )
 
-var ForwardAuth = &Middleware{withOptions: NewForwardAuthfunc}
+var ForwardAuth = NewMiddleware[forwardAuth]()
 
-func NewForwardAuthfunc(optsRaw OptionsRaw) (*Middleware, E.Error) {
-	fa := new(forwardAuth)
-	if err := Deserialize(optsRaw, &fa.forwardAuthOpts); err != nil {
-		return nil, err
-	}
-	if _, err := url.Parse(fa.Address); err != nil {
-		return nil, E.From(err)
-	}
-
-	fa.m = &Middleware{
-		impl:   fa,
-		before: fa.forward,
-	}
-
-	// TODO: use tr from reverse proxy
-	tr, ok := fa.transport.(*http.Transport)
-	if ok {
-		tr = tr.Clone()
-	} else {
-		tr = gphttp.DefaultTransport.Clone()
-	}
-
-	fa.client = http.Client{
-		CheckRedirect: func(r *Request, via []*Request) error {
-			return http.ErrUseLastResponse
-		},
-		Timeout:   30 * time.Second,
-		Transport: tr,
-	}
-	return fa.m, nil
+var faHTTPClient = &http.Client{
+	Timeout: 30 * time.Second,
+	CheckRedirect: func(r *http.Request, via []*http.Request) error {
+		return http.ErrUseLastResponse
+	},
 }
 
-func (fa *forwardAuth) forward(next http.HandlerFunc, w ResponseWriter, req *Request) {
+// setup implements MiddlewareWithSetup.
+func (fa *forwardAuth) setup() {
+	fa.reqCookiesMap = F.NewMapOf[*http.Request, []*http.Cookie]()
+}
+
+// before implements RequestModifier.
+func (fa *forwardAuth) before(w http.ResponseWriter, req *http.Request) (proceed bool) {
 	gphttp.RemoveHop(req.Header)
 
+	// Construct original URL for the redirect
+	scheme := "http"
+	if req.TLS != nil {
+		scheme = "https"
+	}
+	originalURL := scheme + "://" + req.Host + req.RequestURI
+
+	url := fa.Address
 	faReq, err := http.NewRequestWithContext(
 		req.Context(),
 		http.MethodGet,
-		fa.Address,
+		url,
 		nil,
 	)
 	if err != nil {
-		fa.m.AddTracef("new request err to %s", fa.Address).WithError(err)
+		fa.AddTracef("new request err to %s", url).WithError(err)
 		w.WriteHeader(http.StatusInternalServerError)
 		return
 	}
@@ -87,11 +73,13 @@ func (fa *forwardAuth) forward(next http.HandlerFunc, w ResponseWriter, req *Req
 
 	faReq.Header = gphttp.FilterHeaders(faReq.Header, fa.AuthResponseHeaders)
 	fa.setAuthHeaders(req, faReq)
-	fa.m.AddTraceRequest("forward auth request", faReq)
+	// Set headers needed by Authentik
+	faReq.Header.Set("X-Original-Url", originalURL)
+	fa.AddTraceRequest("forward auth request", faReq)
 
-	faResp, err := fa.client.Do(faReq)
+	faResp, err := faHTTPClient.Do(faReq)
 	if err != nil {
-		fa.m.AddTracef("failed to call %s", fa.Address).WithError(err)
+		fa.AddTracef("failed to call %s", url).WithError(err)
 		w.WriteHeader(http.StatusInternalServerError)
 		return
 	}
@@ -99,30 +87,30 @@ func (fa *forwardAuth) forward(next http.HandlerFunc, w ResponseWriter, req *Req
 
 	body, err := io.ReadAll(faResp.Body)
 	if err != nil {
-		fa.m.AddTracef("failed to read response body from %s", fa.Address).WithError(err)
+		fa.AddTracef("failed to read response body from %s", url).WithError(err)
 		w.WriteHeader(http.StatusInternalServerError)
 		return
 	}
 
 	if faResp.StatusCode < http.StatusOK || faResp.StatusCode >= http.StatusMultipleChoices {
-		fa.m.AddTraceResponse("forward auth response", faResp)
+		fa.AddTraceResponse("forward auth response", faResp)
 		gphttp.CopyHeader(w.Header(), faResp.Header)
 		gphttp.RemoveHop(w.Header())
 
 		redirectURL, err := faResp.Location()
 		if err != nil {
-			fa.m.AddTracef("failed to get location from %s", fa.Address).WithError(err).WithResponse(faResp)
+			fa.AddTracef("failed to get location from %s", url).WithError(err).WithResponse(faResp)
 			w.WriteHeader(http.StatusInternalServerError)
 			return
 		} else if redirectURL.String() != "" {
 			w.Header().Set("Location", redirectURL.String())
-			fa.m.AddTracef("redirect to %q", redirectURL.String()).WithResponse(faResp)
+			fa.AddTracef("%s", "redirect to "+redirectURL.String())
 		}
 
 		w.WriteHeader(faResp.StatusCode)
 
 		if _, err = w.Write(body); err != nil {
-			fa.m.AddTracef("failed to write response body from %s", fa.Address).WithError(err).WithResponse(faResp)
+			fa.AddTracef("failed to write response body from %s", url).WithError(err).WithResponse(faResp)
 		}
 		return
 	}
@@ -139,18 +127,22 @@ func (fa *forwardAuth) forward(next http.HandlerFunc, w ResponseWriter, req *Req
 
 	authCookies := faResp.Cookies()
 
-	if len(authCookies) == 0 {
-		next.ServeHTTP(w, req)
-		return
+	if len(authCookies) > 0 {
+		fa.reqCookiesMap.Store(req, authCookies)
 	}
-
-	next.ServeHTTP(gphttp.NewModifyResponseWriter(w, req, func(resp *Response) error {
-		fa.setAuthCookies(resp, authCookies)
-		return nil
-	}), req)
+	return true
 }
 
-func (fa *forwardAuth) setAuthCookies(resp *Response, authCookies []*Cookie) {
+// modifyResponse implements ResponseModifier.
+func (fa *forwardAuth) modifyResponse(resp *http.Response) error {
+	if cookies, ok := fa.reqCookiesMap.Load(resp.Request); ok {
+		fa.setAuthCookies(resp, cookies)
+		fa.reqCookiesMap.Delete(resp.Request)
+	}
+	return nil
+}
+
+func (fa *forwardAuth) setAuthCookies(resp *http.Response, authCookies []*http.Cookie) {
 	if len(fa.AddAuthCookiesToResponse) == 0 {
 		return
 	}
@@ -173,57 +165,57 @@ func (fa *forwardAuth) setAuthCookies(resp *Response, authCookies []*Cookie) {
 	}
 }
 
-func (fa *forwardAuth) setAuthHeaders(req, faReq *Request) {
+func (fa *forwardAuth) setAuthHeaders(req, faReq *http.Request) {
 	if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
 		if fa.TrustForwardHeader {
-			if prior, ok := req.Header[xForwardedFor]; ok {
+			if prior, ok := req.Header[gphttp.HeaderXForwardedFor]; ok {
 				clientIP = strings.Join(prior, ", ") + ", " + clientIP
 			}
 		}
-		faReq.Header.Set(xForwardedFor, clientIP)
+		faReq.Header.Set(gphttp.HeaderXForwardedFor, clientIP)
 	}
 
-	xMethod := req.Header.Get(xForwardedMethod)
+	xMethod := req.Header.Get(gphttp.HeaderXForwardedMethod)
 	switch {
 	case xMethod != "" && fa.TrustForwardHeader:
-		faReq.Header.Set(xForwardedMethod, xMethod)
+		faReq.Header.Set(gphttp.HeaderXForwardedMethod, xMethod)
 	case req.Method != "":
-		faReq.Header.Set(xForwardedMethod, req.Method)
+		faReq.Header.Set(gphttp.HeaderXForwardedMethod, req.Method)
 	default:
-		faReq.Header.Del(xForwardedMethod)
+		faReq.Header.Del(gphttp.HeaderXForwardedMethod)
 	}
 
-	xfp := req.Header.Get(xForwardedProto)
+	xfp := req.Header.Get(gphttp.HeaderXForwardedProto)
 	switch {
 	case xfp != "" && fa.TrustForwardHeader:
-		faReq.Header.Set(xForwardedProto, xfp)
+		faReq.Header.Set(gphttp.HeaderXForwardedProto, xfp)
 	case req.TLS != nil:
-		faReq.Header.Set(xForwardedProto, "https")
+		faReq.Header.Set(gphttp.HeaderXForwardedProto, "https")
 	default:
-		faReq.Header.Set(xForwardedProto, "http")
+		faReq.Header.Set(gphttp.HeaderXForwardedProto, "http")
 	}
 
-	if xfp := req.Header.Get(xForwardedPort); xfp != "" && fa.TrustForwardHeader {
-		faReq.Header.Set(xForwardedPort, xfp)
+	if xfp := req.Header.Get(gphttp.HeaderXForwardedPort); xfp != "" && fa.TrustForwardHeader {
+		faReq.Header.Set(gphttp.HeaderXForwardedPort, xfp)
 	}
 
-	xfh := req.Header.Get(xForwardedHost)
+	xfh := req.Header.Get(gphttp.HeaderXForwardedHost)
 	switch {
 	case xfh != "" && fa.TrustForwardHeader:
-		faReq.Header.Set(xForwardedHost, xfh)
+		faReq.Header.Set(gphttp.HeaderXForwardedHost, xfh)
 	case req.Host != "":
-		faReq.Header.Set(xForwardedHost, req.Host)
+		faReq.Header.Set(gphttp.HeaderXForwardedHost, req.Host)
 	default:
-		faReq.Header.Del(xForwardedHost)
+		faReq.Header.Del(gphttp.HeaderXForwardedHost)
 	}
 
-	xfURI := req.Header.Get(xForwardedURI)
+	xfURI := req.Header.Get(gphttp.HeaderXForwardedURI)
 	switch {
 	case xfURI != "" && fa.TrustForwardHeader:
-		faReq.Header.Set(xForwardedURI, xfURI)
+		faReq.Header.Set(gphttp.HeaderXForwardedURI, xfURI)
 	case req.URL.RequestURI() != "":
-		faReq.Header.Set(xForwardedURI, req.URL.RequestURI())
+		faReq.Header.Set(gphttp.HeaderXForwardedURI, req.URL.RequestURI())
 	default:
-		faReq.Header.Del(xForwardedURI)
+		faReq.Header.Del(gphttp.HeaderXForwardedURI)
 	}
 }

internal/net/http/middleware/middleware.go

@@ -3,70 +3,115 @@ package middleware
 import (
 	"encoding/json"
 	"net/http"
+	"reflect"
+	"strings"
 
-	"github.com/rs/zerolog"
 	E "github.com/yusing/go-proxy/internal/error"
+	"github.com/yusing/go-proxy/internal/logging"
 	gphttp "github.com/yusing/go-proxy/internal/net/http"
-	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils"
 )
 
 type (
 	Error = E.Error
 
-	ReverseProxy   = gphttp.ReverseProxy
-	ProxyRequest   = gphttp.ProxyRequest
-	Request        = http.Request
-	Response       = http.Response
-	ResponseWriter = http.ResponseWriter
-	Header         = http.Header
-	Cookie         = http.Cookie
+	ReverseProxy = gphttp.ReverseProxy
+	ProxyRequest = gphttp.ProxyRequest
 
-	BeforeFunc         func(next http.HandlerFunc, w ResponseWriter, r *Request)
-	RewriteFunc        func(req *Request)
-	ModifyResponseFunc func(resp *Response) error
-	CloneWithOptFunc   func(opts OptionsRaw) (*Middleware, E.Error)
-
-	OptionsRaw = map[string]any
+	ImplNewFunc = func() any
+	OptionsRaw  = map[string]any
 
 	Middleware struct {
-		_ U.NoCopy
+		name      string
+		construct ImplNewFunc
+		impl      any
+	}
 
-		zerolog.Logger
-
-		name string
-
-		before         BeforeFunc         // runs before ReverseProxy.ServeHTTP
-		modifyResponse ModifyResponseFunc // runs after ReverseProxy.ModifyResponse
-
-		withOptions CloneWithOptFunc
-		impl        any
-
-		parent   *Middleware
-		children []*Middleware
-		trace    bool
+	RequestModifier interface {
+		before(w http.ResponseWriter, r *http.Request) (proceed bool)
+	}
+	ResponseModifier     interface{ modifyResponse(r *http.Response) error }
+	MiddlewareWithSetup  interface{ setup() }
+	MiddlewareFinalizer  interface{ finalize() }
+	MiddlewareWithTracer interface {
+		enableTrace()
+		getTracer() *Tracer
 	}
 )
 
-var Deserialize = U.Deserialize
-
-func Rewrite(r RewriteFunc) BeforeFunc {
-	return func(next http.HandlerFunc, w ResponseWriter, req *Request) {
-		r(req)
-		next(w, req)
+func NewMiddleware[ImplType any]() *Middleware {
+	// type check
+	switch any(new(ImplType)).(type) {
+	case RequestModifier:
+	case ResponseModifier:
+	default:
+		panic("must implement RequestModifier or ResponseModifier")
 	}
+	return &Middleware{
+		name:      strings.ToLower(reflect.TypeFor[ImplType]().Name()),
+		construct: func() any { return new(ImplType) },
+	}
+}
+
+func (m *Middleware) enableTrace() {
+	if tracer, ok := m.impl.(MiddlewareWithTracer); ok {
+		tracer.enableTrace()
+		logging.Debug().Msgf("middleware %s enabled trace", m.name)
+	}
+}
+
+func (m *Middleware) getTracer() *Tracer {
+	if tracer, ok := m.impl.(MiddlewareWithTracer); ok {
+		return tracer.getTracer()
+	}
+	return nil
+}
+
+func (m *Middleware) setParent(parent *Middleware) {
+	if tracer := m.getTracer(); tracer != nil {
+		tracer.SetParent(parent.getTracer())
+	}
+}
+
+func (m *Middleware) setup() {
+	if setup, ok := m.impl.(MiddlewareWithSetup); ok {
+		setup.setup()
+	}
+}
+
+func (m *Middleware) apply(optsRaw OptionsRaw) E.Error {
+	if len(optsRaw) == 0 {
+		return nil
+	}
+	return utils.Deserialize(optsRaw, m.impl)
+}
+
+func (m *Middleware) finalize() {
+	if finalizer, ok := m.impl.(MiddlewareFinalizer); ok {
+		finalizer.finalize()
+	}
+}
+
+func (m *Middleware) New(optsRaw OptionsRaw) (*Middleware, E.Error) {
+	if m.construct == nil {
+		if optsRaw != nil {
+			panic("bug: middleware already constructed")
+		}
+		return m, nil
+	}
+	mid := &Middleware{name: m.name, impl: m.construct()}
+	mid.setup()
+	if err := mid.apply(optsRaw); err != nil {
+		return nil, err
+	}
+	mid.finalize()
+	return mid, nil
 }
 
 func (m *Middleware) Name() string {
 	return m.name
 }
 
-func (m *Middleware) Fullname() string {
-	if m.parent != nil {
-		return m.parent.Fullname() + "." + m.name
-	}
-	return m.name
-}
-
 func (m *Middleware) String() string {
 	return m.name
 }
@@ -78,44 +123,38 @@ func (m *Middleware) MarshalJSON() ([]byte, error) {
 	}, "", "  ")
 }
 
-func (m *Middleware) WithOptionsClone(optsRaw OptionsRaw) (*Middleware, E.Error) {
-	if m.withOptions != nil {
-		m, err := m.withOptions(optsRaw)
-		if err != nil {
-			return nil, err
+func (m *Middleware) ModifyRequest(next http.HandlerFunc, w http.ResponseWriter, r *http.Request) {
+	if exec, ok := m.impl.(RequestModifier); ok {
+		if proceed := exec.before(w, r); !proceed {
+			return
 		}
-		m.Logger = logger.With().Str("name", m.name).Logger()
-		return m, nil
 	}
-
-	// WithOptionsClone is called only once
-	// set withOptions and labelParser will not be used after that
-	return &Middleware{
-		Logger:         logger.With().Str("name", m.name).Logger(),
-		name:           m.name,
-		before:         m.before,
-		modifyResponse: m.modifyResponse,
-		impl:           m.impl,
-		parent:         m.parent,
-		children:       m.children,
-	}, nil
+	next(w, r)
 }
 
-func (m *Middleware) ModifyRequest(next http.HandlerFunc, w ResponseWriter, r *Request) {
-	if m.before != nil {
-		m.before(next, w, r)
-	}
-}
-
-func (m *Middleware) ModifyResponse(resp *Response) error {
-	if m.modifyResponse != nil {
-		return m.modifyResponse(resp)
+func (m *Middleware) ModifyResponse(resp *http.Response) error {
+	if exec, ok := m.impl.(ResponseModifier); ok {
+		return exec.modifyResponse(resp)
 	}
 	return nil
 }
 
+func (m *Middleware) ServeHTTP(next http.HandlerFunc, w http.ResponseWriter, r *http.Request) {
+	if exec, ok := m.impl.(ResponseModifier); ok {
+		w = gphttp.NewModifyResponseWriter(w, r, func(resp *http.Response) error {
+			return exec.modifyResponse(resp)
+		})
+	}
+	if exec, ok := m.impl.(RequestModifier); ok {
+		if proceed := exec.before(w, r); !proceed {
+			return
+		}
+	}
+	next(w, r)
+}
+
 // TODO: check conflict or duplicates.
-func createMiddlewares(middlewaresMap map[string]OptionsRaw) ([]*Middleware, E.Error) {
+func compileMiddlewares(middlewaresMap map[string]OptionsRaw) ([]*Middleware, E.Error) {
 	middlewares := make([]*Middleware, 0, len(middlewaresMap))
 
 	errs := E.NewBuilder("middlewares compile error")
@@ -128,7 +167,7 @@ func createMiddlewares(middlewaresMap map[string]OptionsRaw) ([]*Middleware, E.E
 			continue
 		}
 
-		m, err = m.WithOptionsClone(opts)
+		m, err = m.New(opts)
 		if err != nil {
 			invalidOpts.Add(err.Subject(name))
 			continue
@@ -142,37 +181,41 @@ func createMiddlewares(middlewaresMap map[string]OptionsRaw) ([]*Middleware, E.E
 	return middlewares, errs.Error()
 }
 
-func PatchReverseProxy(rpName string, rp *ReverseProxy, middlewaresMap map[string]OptionsRaw) (err E.Error) {
+func PatchReverseProxy(rp *ReverseProxy, middlewaresMap map[string]OptionsRaw) (err E.Error) {
 	var middlewares []*Middleware
-	middlewares, err = createMiddlewares(middlewaresMap)
+	middlewares, err = compileMiddlewares(middlewaresMap)
 	if err != nil {
 		return
 	}
-	patchReverseProxy(rpName, rp, middlewares)
+	patchReverseProxy(rp, middlewares)
 	return
 }
 
-func patchReverseProxy(rpName string, rp *ReverseProxy, middlewares []*Middleware) {
-	mid := BuildMiddlewareFromChain(rpName, middlewares)
+func patchReverseProxy(rp *ReverseProxy, middlewares []*Middleware) {
+	middlewares = append([]*Middleware{newSetUpstreamHeaders(rp)}, middlewares...)
 
-	if mid.before != nil {
-		ori := rp.HandlerFunc
+	mid := NewMiddlewareChain(rp.TargetName, middlewares)
+
+	if before, ok := mid.impl.(RequestModifier); ok {
+		next := rp.HandlerFunc
 		rp.HandlerFunc = func(w http.ResponseWriter, r *http.Request) {
-			mid.before(ori, w, r)
+			if proceed := before.before(w, r); proceed {
+				next(w, r)
+			}
 		}
 	}
 
-	if mid.modifyResponse != nil {
+	if mr, ok := mid.impl.(ResponseModifier); ok {
 		if rp.ModifyResponse != nil {
 			ori := rp.ModifyResponse
 			rp.ModifyResponse = func(res *http.Response) error {
-				if err := mid.modifyResponse(res); err != nil {
+				if err := mr.modifyResponse(res); err != nil {
 					return err
 				}
 				return ori(res)
 			}
 		} else {
-			rp.ModifyResponse = mid.modifyResponse
+			rp.ModifyResponse = mr.modifyResponse
 		}
 	}
 }

internal/net/http/middleware/middleware_builder.go

@@ -2,15 +2,15 @@ package middleware
 
 import (
 	"fmt"
-	"net/http"
 	"os"
 	"path"
 
-	"github.com/yusing/go-proxy/internal/common"
 	E "github.com/yusing/go-proxy/internal/error"
 	"gopkg.in/yaml.v3"
 )
 
+var ErrMissingMiddlewareUse = E.New("missing middleware 'use' field")
+
 func BuildMiddlewaresFromComposeFile(filePath string, eb *E.Builder) map[string]*Middleware {
 	fileContent, err := os.ReadFile(filePath)
 	if err != nil {
@@ -29,84 +29,41 @@ func BuildMiddlewaresFromYAML(source string, data []byte, eb *E.Builder) map[str
 	}
 	middlewares := make(map[string]*Middleware)
 	for name, defs := range rawMap {
-		chainErr := E.NewBuilder("")
-		chain := make([]*Middleware, 0, len(defs))
-		for i, def := range defs {
-			if def["use"] == nil || def["use"] == "" {
-				chainErr.Addf("item %d: missing field 'use'", i)
-				continue
-			}
-			baseName := def["use"].(string)
-			base, err := Get(baseName)
-			if err != nil {
-				chainErr.Add(err.Subjectf("%s[%d]", name, i))
-				continue
-			}
-			delete(def, "use")
-			m, err := base.WithOptionsClone(def)
-			if err != nil {
-				chainErr.Add(err.Subjectf("%s[%d]", name, i))
-				continue
-			}
-			m.name = fmt.Sprintf("%s[%d]", name, i)
-			chain = append(chain, m)
-		}
-		if chainErr.HasError() {
-			eb.Add(chainErr.Error().Subject(source))
+		chain, err := BuildMiddlewareFromChainRaw(name, defs)
+		if err != nil {
+			eb.Add(err.Subject(source))
 		} else {
-			middlewares[name+"@file"] = BuildMiddlewareFromChain(name, chain)
+			middlewares[name+"@file"] = chain
 		}
 	}
 	return middlewares
 }
 
-// TODO: check conflict or duplicates.
-func BuildMiddlewareFromChain(name string, chain []*Middleware) *Middleware {
-	m := &Middleware{name: name, children: chain}
-
-	var befores []*Middleware
-	var modResps []*Middleware
-
-	for _, comp := range chain {
-		if comp.before != nil {
-			befores = append(befores, comp)
+func BuildMiddlewareFromChainRaw(name string, defs []map[string]any) (*Middleware, E.Error) {
+	chainErr := E.NewBuilder("")
+	chain := make([]*Middleware, 0, len(defs))
+	for i, def := range defs {
+		if def["use"] == nil || def["use"] == "" {
+			chainErr.Add(ErrMissingMiddlewareUse.Subjectf("%s[%d]", name, i))
+			continue
 		}
-		if comp.modifyResponse != nil {
-			modResps = append(modResps, comp)
+		baseName := def["use"].(string)
+		base, err := Get(baseName)
+		if err != nil {
+			chainErr.Add(err.Subjectf("%s[%d]", name, i))
+			continue
 		}
-		comp.parent = m
-	}
-
-	if len(befores) > 0 {
-		m.before = buildBefores(befores)
-	}
-	if len(modResps) > 0 {
-		m.modifyResponse = func(res *Response) error {
-			errs := E.NewBuilder("modify response errors")
-			for _, mr := range modResps {
-				if err := mr.modifyResponse(res); err != nil {
-					errs.Add(E.From(err).Subject(mr.name))
-				}
-			}
-			return errs.Error()
+		delete(def, "use")
+		m, err := base.New(def)
+		if err != nil {
+			chainErr.Add(err.Subjectf("%s[%d]", name, i))
+			continue
 		}
+		m.name = fmt.Sprintf("%s[%d]", name, i)
+		chain = append(chain, m)
 	}
-
-	if common.IsDebug {
-		m.EnableTrace()
-		m.AddTracef("middleware created")
-	}
-	return m
-}
-
-func buildBefores(befores []*Middleware) BeforeFunc {
-	if len(befores) == 1 {
-		return befores[0].before
-	}
-	nextBefores := buildBefores(befores[1:])
-	return func(next http.HandlerFunc, w ResponseWriter, r *Request) {
-		befores[0].before(func(w ResponseWriter, r *Request) {
-			nextBefores(next, w, r)
-		}, w, r)
+	if chainErr.HasError() {
+		return nil, chainErr.Error()
 	}
+	return NewMiddlewareChain(name, chain), nil
 }

internal/net/http/middleware/middleware_chain.go

@@ -0,0 +1,61 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/yusing/go-proxy/internal/common"
+	E "github.com/yusing/go-proxy/internal/error"
+)
+
+type middlewareChain struct {
+	befores  []RequestModifier
+	modResps []ResponseModifier
+}
+
+// TODO: check conflict or duplicates.
+func NewMiddlewareChain(name string, chain []*Middleware) *Middleware {
+	chainMid := &middlewareChain{befores: []RequestModifier{}, modResps: []ResponseModifier{}}
+	m := &Middleware{name: name, impl: chainMid}
+
+	for _, comp := range chain {
+		if before, ok := comp.impl.(RequestModifier); ok {
+			chainMid.befores = append(chainMid.befores, before)
+		}
+		if mr, ok := comp.impl.(ResponseModifier); ok {
+			chainMid.modResps = append(chainMid.modResps, mr)
+		}
+		comp.setParent(m)
+	}
+
+	if common.IsDebug {
+		for _, child := range chain {
+			child.enableTrace()
+		}
+		m.enableTrace()
+	}
+	return m
+}
+
+// before implements RequestModifier.
+func (m *middlewareChain) before(w http.ResponseWriter, r *http.Request) (proceedNext bool) {
+	for _, b := range m.befores {
+		if proceedNext = b.before(w, r); !proceedNext {
+			return false
+		}
+	}
+	return true
+}
+
+// modifyResponse implements ResponseModifier.
+func (m *middlewareChain) modifyResponse(resp *http.Response) error {
+	if len(m.modResps) == 0 {
+		return nil
+	}
+	errs := E.NewBuilder("modify response errors")
+	for i, mr := range m.modResps {
+		if err := mr.modifyResponse(resp); err != nil {
+			errs.Add(E.From(err).Subjectf("%d", i))
+		}
+	}
+	return errs.Error()
+}

internal/net/http/middleware/middlewares.go

@@ -1,10 +1,7 @@
 package middleware
 
 import (
-	"fmt"
-	"net/http"
 	"path"
-	"strings"
 
 	"github.com/yusing/go-proxy/internal/common"
 	E "github.com/yusing/go-proxy/internal/error"
@@ -12,7 +9,31 @@ import (
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 )
 
-var allMiddlewares map[string]*Middleware
+// snakes and cases will be stripped on `Get`
+// so keys are lowercase without snake.
+var allMiddlewares = map[string]*Middleware{
+	"redirecthttp": RedirectHTTP,
+
+	"request":        ModifyRequest,
+	"modifyrequest":  ModifyRequest,
+	"response":       ModifyResponse,
+	"modifyresponse": ModifyResponse,
+	"setxforwarded":  SetXForwarded,
+	"hidexforwarded": HideXForwarded,
+
+	"errorpage":       CustomErrorPage,
+	"customerrorpage": CustomErrorPage,
+
+	"realip":           RealIP,
+	"cloudflarerealip": CloudflareRealIP,
+
+	"cidrwhitelist": CIDRWhiteList,
+	"ratelimit":     RateLimiter,
+
+	// !experimental
+	"forwardauth": ForwardAuth,
+	// "oauth2":      OAuth2.m,
+}
 
 var (
 	ErrUnknownMiddleware    = E.New("unknown middleware")
@@ -33,40 +54,6 @@ func All() map[string]*Middleware {
 	return allMiddlewares
 }
 
-// initialize middleware names and label parsers.
-func init() {
-	// snakes and cases will be stripped on `Get`
-	// so keys are lowercase without snake.
-	allMiddlewares = map[string]*Middleware{
-		"setxforwarded":    SetXForwarded,
-		"hidexforwarded":   HideXForwarded,
-		"redirecthttp":     RedirectHTTP,
-		"modifyresponse":   ModifyResponse,
-		"modifyrequest":    ModifyRequest,
-		"errorpage":        CustomErrorPage,
-		"customerrorpage":  CustomErrorPage,
-		"realip":           RealIP,
-		"cloudflarerealip": CloudflareRealIP,
-		"cidrwhitelist":    CIDRWhiteList,
-		"ratelimit":        RateLimiter,
-
-		// !experimental
-		"forwardauth": ForwardAuth,
-		// "oauth2":      OAuth2.m,
-	}
-	names := make(map[*Middleware][]string)
-	for name, m := range allMiddlewares {
-		names[m] = append(names[m], http.CanonicalHeaderKey(name))
-	}
-	for m, names := range names {
-		if len(names) > 1 {
-			m.name = fmt.Sprintf("%s (a.k.a. %s)", names[0], strings.Join(names[1:], ", "))
-		} else {
-			m.name = names[0]
-		}
-	}
-}
-
 func LoadComposeFiles() {
 	errs := E.NewBuilder("middleware compile errors")
 	middlewareDefs, err := utils.ListFiles(common.MiddlewareComposeBasePath, 0)
@@ -86,8 +73,8 @@ func LoadComposeFiles() {
 			}
 			allMiddlewares[strutils.ToLowerNoSnake(name)] = m
 			logger.Info().
-				Str("name", name).
 				Str("src", path.Base(defFile)).
+				Str("name", name).
 				Msg("middleware loaded")
 		}
 	}

internal/net/http/middleware/modify_request.go

@@ -2,60 +2,78 @@ package middleware
 
 import (
 	"net/http"
-
-	"github.com/yusing/go-proxy/internal/common"
-	E "github.com/yusing/go-proxy/internal/error"
+	"strings"
 )
 
 type (
 	modifyRequest struct {
-		modifyRequestOpts
-		m *Middleware
+		ModifyRequestOpts
+		Tracer
 	}
 	// order: set_headers -> add_headers -> hide_headers
-	modifyRequestOpts struct {
-		SetHeaders  map[string]string `json:"setHeaders"`
-		AddHeaders  map[string]string `json:"addHeaders"`
-		HideHeaders []string          `json:"hideHeaders"`
+	ModifyRequestOpts struct {
+		SetHeaders  map[string]string
+		AddHeaders  map[string]string
+		HideHeaders []string
+
+		needVarSubstitution bool
 	}
 )
 
-var ModifyRequest = &Middleware{withOptions: NewModifyRequest}
+var ModifyRequest = NewMiddleware[modifyRequest]()
 
-func NewModifyRequest(optsRaw OptionsRaw) (*Middleware, E.Error) {
-	mr := new(modifyRequest)
-	mrFunc := mr.modifyRequest
-	if common.IsDebug {
-		mrFunc = mr.modifyRequestWithTrace
-	}
-	mr.m = &Middleware{
-		impl:   mr,
-		before: Rewrite(mrFunc),
-	}
-	err := Deserialize(optsRaw, &mr.modifyRequestOpts)
-	if err != nil {
-		return nil, err
-	}
-	return mr.m, nil
+// finalize implements MiddlewareFinalizer.
+func (mr *ModifyRequestOpts) finalize() {
+	mr.checkVarSubstitution()
 }
 
-func (mr *modifyRequest) modifyRequest(req *Request) {
-	for k, v := range mr.SetHeaders {
-		if http.CanonicalHeaderKey(k) == "Host" {
-			req.Host = v
+// before implements RequestModifier.
+func (mr *modifyRequest) before(w http.ResponseWriter, r *http.Request) (proceed bool) {
+	mr.AddTraceRequest("before modify request", r)
+	mr.modifyHeaders(r, nil, r.Header)
+	mr.AddTraceRequest("after modify request", r)
+	return true
+}
+
+func (mr *ModifyRequestOpts) checkVarSubstitution() {
+	for _, m := range []map[string]string{mr.SetHeaders, mr.AddHeaders} {
+		for _, v := range m {
+			if strings.ContainsRune(v, '$') {
+				mr.needVarSubstitution = true
+				return
+			}
 		}
-		req.Header.Set(k, v)
-	}
-	for k, v := range mr.AddHeaders {
-		req.Header.Add(k, v)
-	}
-	for _, k := range mr.HideHeaders {
-		req.Header.Del(k)
 	}
 }
 
-func (mr *modifyRequest) modifyRequestWithTrace(req *Request) {
-	mr.m.AddTraceRequest("before modify request", req)
-	mr.modifyRequest(req)
-	mr.m.AddTraceRequest("after modify request", req)
+func (mr *ModifyRequestOpts) modifyHeaders(req *http.Request, resp *http.Response, headers http.Header) {
+	if !mr.needVarSubstitution {
+		for k, v := range mr.SetHeaders {
+			if req != nil && strings.EqualFold(k, "host") {
+				defer func() {
+					req.Host = v
+				}()
+			}
+			headers[k] = []string{v}
+		}
+		for k, v := range mr.AddHeaders {
+			headers[k] = append(headers[k], v)
+		}
+	} else {
+		for k, v := range mr.SetHeaders {
+			if req != nil && strings.EqualFold(k, "host") {
+				defer func() {
+					req.Host = varReplace(req, resp, v)
+				}()
+			}
+			headers[k] = []string{varReplace(req, resp, v)}
+		}
+		for k, v := range mr.AddHeaders {
+			headers[k] = append(headers[k], varReplace(req, resp, v))
+		}
+	}
+
+	for _, k := range mr.HideHeaders {
+		delete(headers, k)
+	}
 }

internal/net/http/middleware/modify_request_test.go

@@ -1,24 +1,49 @@
 package middleware
 
 import (
+	"bytes"
+	"net"
+	"net/http"
 	"slices"
 	"testing"
 
+	"github.com/yusing/go-proxy/internal/net/types"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )
 
-func TestSetModifyRequest(t *testing.T) {
+func TestModifyRequest(t *testing.T) {
 	opts := OptionsRaw{
 		"set_headers": map[string]string{
-			"User-Agent": "go-proxy/v0.5.0",
-			"Host":       "test.example.com",
+			"User-Agent":                 "go-proxy/v0.5.0",
+			"Host":                       VarUpstreamAddr,
+			"X-Test-Req-Method":          VarRequestMethod,
+			"X-Test-Req-Scheme":          VarRequestScheme,
+			"X-Test-Req-Host":            VarRequestHost,
+			"X-Test-Req-Port":            VarRequestPort,
+			"X-Test-Req-Addr":            VarRequestAddr,
+			"X-Test-Req-Path":            VarRequestPath,
+			"X-Test-Req-Query":           VarRequestQuery,
+			"X-Test-Req-Url":             VarRequestURL,
+			"X-Test-Req-Uri":             VarRequestURI,
+			"X-Test-Req-Content-Type":    VarRequestContentType,
+			"X-Test-Req-Content-Length":  VarRequestContentLen,
+			"X-Test-Remote-Host":         VarRemoteHost,
+			"X-Test-Remote-Port":         VarRemotePort,
+			"X-Test-Remote-Addr":         VarRemoteAddr,
+			"X-Test-Upstream-Scheme":     VarUpstreamScheme,
+			"X-Test-Upstream-Host":       VarUpstreamHost,
+			"X-Test-Upstream-Port":       VarUpstreamPort,
+			"X-Test-Upstream-Addr":       VarUpstreamAddr,
+			"X-Test-Upstream-Url":        VarUpstreamURL,
+			"X-Test-Header-Content-Type": "$header(Content-Type)",
+			"X-Test-Arg-Arg_1":           "$arg(arg_1)",
 		},
 		"add_headers":  map[string]string{"Accept-Encoding": "test-value"},
 		"hide_headers": []string{"Accept"},
 	}
 
 	t.Run("set_options", func(t *testing.T) {
-		mr, err := ModifyRequest.WithOptionsClone(opts)
+		mr, err := ModifyRequest.New(opts)
 		ExpectNoError(t, err)
 		ExpectDeepEqual(t, mr.impl.(*modifyRequest).SetHeaders, opts["set_headers"].(map[string]string))
 		ExpectDeepEqual(t, mr.impl.(*modifyRequest).AddHeaders, opts["add_headers"].(map[string]string))
@@ -26,13 +51,48 @@ func TestSetModifyRequest(t *testing.T) {
 	})
 
 	t.Run("request_headers", func(t *testing.T) {
+		reqURL := types.MustParseURL("https://my.app/?arg_1=b")
+		upstreamURL := types.MustParseURL("http://test.example.com")
 		result, err := newMiddlewareTest(ModifyRequest, &testArgs{
 			middlewareOpt: opts,
+			reqURL:        reqURL,
+			upstreamURL:   upstreamURL,
+			body:          bytes.Repeat([]byte("a"), 100),
+			headers: http.Header{
+				"Content-Type": []string{"application/json"},
+			},
 		})
 		ExpectNoError(t, err)
 		ExpectEqual(t, result.RequestHeaders.Get("User-Agent"), "go-proxy/v0.5.0")
 		ExpectEqual(t, result.RequestHeaders.Get("Host"), "test.example.com")
 		ExpectTrue(t, slices.Contains(result.RequestHeaders.Values("Accept-Encoding"), "test-value"))
 		ExpectEqual(t, result.RequestHeaders.Get("Accept"), "")
+
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Method"), "GET")
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Scheme"), reqURL.Scheme)
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Host"), reqURL.Hostname())
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Port"), reqURL.Port())
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Addr"), reqURL.Host)
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Path"), reqURL.Path)
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Query"), reqURL.RawQuery)
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Url"), reqURL.String())
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Uri"), reqURL.RequestURI())
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Content-Type"), "application/json")
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Req-Content-Length"), "100")
+
+		remoteHost, remotePort, _ := net.SplitHostPort(result.RemoteAddr)
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Remote-Host"), remoteHost)
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Remote-Port"), remotePort)
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Remote-Addr"), result.RemoteAddr)
+
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Upstream-Scheme"), upstreamURL.Scheme)
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Upstream-Host"), upstreamURL.Hostname())
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Upstream-Port"), upstreamURL.Port())
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Upstream-Addr"), upstreamURL.Host)
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Upstream-Url"), upstreamURL.String())
+
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Header-Content-Type"), "application/json")
+
+		ExpectEqual(t, result.RequestHeaders.Get("X-Test-Arg-Arg_1"), "b")
 	})
 }

internal/net/http/middleware/modify_response.go

@@ -2,53 +2,19 @@ package middleware
 
 import (
 	"net/http"
-
-	"github.com/yusing/go-proxy/internal/common"
-	E "github.com/yusing/go-proxy/internal/error"
 )
 
-type (
-	modifyResponse struct {
-		modifyResponseOpts
-		m *Middleware
-	}
-	// order: set_headers -> add_headers -> hide_headers
-	modifyResponseOpts = modifyRequestOpts
-)
-
-var ModifyResponse = &Middleware{withOptions: NewModifyResponse}
-
-func NewModifyResponse(optsRaw OptionsRaw) (*Middleware, E.Error) {
-	mr := new(modifyResponse)
-	mr.m = &Middleware{impl: mr}
-	if common.IsDebug {
-		mr.m.modifyResponse = mr.modifyResponseWithTrace
-	} else {
-		mr.m.modifyResponse = mr.modifyResponse
-	}
-	err := Deserialize(optsRaw, &mr.modifyResponseOpts)
-	if err != nil {
-		return nil, err
-	}
-	return mr.m, nil
+type modifyResponse struct {
+	ModifyRequestOpts
+	Tracer
 }
 
+var ModifyResponse = NewMiddleware[modifyResponse]()
+
+// modifyResponse implements ResponseModifier.
 func (mr *modifyResponse) modifyResponse(resp *http.Response) error {
-	for k, v := range mr.SetHeaders {
-		resp.Header.Set(k, v)
-	}
-	for k, v := range mr.AddHeaders {
-		resp.Header.Add(k, v)
-	}
-	for _, k := range mr.HideHeaders {
-		resp.Header.Del(k)
-	}
+	mr.AddTraceResponse("before modify response", resp)
+	mr.modifyHeaders(resp.Request, resp, resp.Header)
+	mr.AddTraceResponse("after modify response", resp)
 	return nil
 }
-
-func (mr *modifyResponse) modifyResponseWithTrace(resp *http.Response) error {
-	mr.m.AddTraceResponse("before modify response", resp)
-	err := mr.modifyResponse(resp)
-	mr.m.AddTraceResponse("after modify response", resp)
-	return err
-}

internal/net/http/middleware/modify_response_test.go

@@ -1,35 +1,108 @@
 package middleware
 
 import (
+	"bytes"
+	"net"
+	"net/http"
 	"slices"
 	"testing"
 
+	"github.com/yusing/go-proxy/internal/net/types"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )
 
-func TestSetModifyResponse(t *testing.T) {
+func TestModifyResponse(t *testing.T) {
 	opts := OptionsRaw{
-		"set_headers":  map[string]string{"User-Agent": "go-proxy/v0.5.0"},
+		"set_headers": map[string]string{
+			"X-Test-Resp-Status":              VarRespStatusCode,
+			"X-Test-Resp-Content-Type":        VarRespContentType,
+			"X-Test-Resp-Content-Length":      VarRespContentLen,
+			"X-Test-Resp-Header-Content-Type": "$resp_header(Content-Type)",
+
+			"X-Test-Req-Method":          VarRequestMethod,
+			"X-Test-Req-Scheme":          VarRequestScheme,
+			"X-Test-Req-Host":            VarRequestHost,
+			"X-Test-Req-Port":            VarRequestPort,
+			"X-Test-Req-Addr":            VarRequestAddr,
+			"X-Test-Req-Path":            VarRequestPath,
+			"X-Test-Req-Query":           VarRequestQuery,
+			"X-Test-Req-Url":             VarRequestURL,
+			"X-Test-Req-Uri":             VarRequestURI,
+			"X-Test-Req-Content-Type":    VarRequestContentType,
+			"X-Test-Req-Content-Length":  VarRequestContentLen,
+			"X-Test-Remote-Host":         VarRemoteHost,
+			"X-Test-Remote-Port":         VarRemotePort,
+			"X-Test-Remote-Addr":         VarRemoteAddr,
+			"X-Test-Upstream-Scheme":     VarUpstreamScheme,
+			"X-Test-Upstream-Host":       VarUpstreamHost,
+			"X-Test-Upstream-Port":       VarUpstreamPort,
+			"X-Test-Upstream-Addr":       VarUpstreamAddr,
+			"X-Test-Upstream-Url":        VarUpstreamURL,
+			"X-Test-Header-Content-Type": "$header(Content-Type)",
+			"X-Test-Arg-Arg_1":           "$arg(arg_1)",
+		},
 		"add_headers":  map[string]string{"Accept-Encoding": "test-value"},
 		"hide_headers": []string{"Accept"},
 	}
 
 	t.Run("set_options", func(t *testing.T) {
-		mr, err := ModifyResponse.WithOptionsClone(opts)
+		mr, err := ModifyResponse.New(opts)
 		ExpectNoError(t, err)
 		ExpectDeepEqual(t, mr.impl.(*modifyResponse).SetHeaders, opts["set_headers"].(map[string]string))
 		ExpectDeepEqual(t, mr.impl.(*modifyResponse).AddHeaders, opts["add_headers"].(map[string]string))
 		ExpectDeepEqual(t, mr.impl.(*modifyResponse).HideHeaders, opts["hide_headers"].([]string))
 	})
 
-	t.Run("request_headers", func(t *testing.T) {
+	t.Run("response_headers", func(t *testing.T) {
+		reqURL := types.MustParseURL("https://my.app/?arg_1=b")
+		upstreamURL := types.MustParseURL("http://test.example.com")
 		result, err := newMiddlewareTest(ModifyResponse, &testArgs{
 			middlewareOpt: opts,
+			reqURL:        reqURL,
+			upstreamURL:   upstreamURL,
+			body:          bytes.Repeat([]byte("a"), 100),
+			headers: http.Header{
+				"Content-Type": []string{"application/json"},
+			},
+			respHeaders: http.Header{
+				"Content-Type": []string{"application/json"},
+			},
+			respBody:   bytes.Repeat([]byte("a"), 50),
+			respStatus: http.StatusOK,
 		})
 		ExpectNoError(t, err)
-		ExpectEqual(t, result.ResponseHeaders.Get("User-Agent"), "go-proxy/v0.5.0")
-		t.Log(result.ResponseHeaders.Get("Accept-Encoding"))
 		ExpectTrue(t, slices.Contains(result.ResponseHeaders.Values("Accept-Encoding"), "test-value"))
 		ExpectEqual(t, result.ResponseHeaders.Get("Accept"), "")
+
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Resp-Status"), "200")
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Resp-Content-Type"), "application/json")
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Resp-Content-Length"), "50")
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Resp-Header-Content-Type"), "application/json")
+
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Method"), http.MethodGet)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Scheme"), reqURL.Scheme)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Host"), reqURL.Hostname())
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Port"), reqURL.Port())
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Addr"), reqURL.Host)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Path"), reqURL.Path)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Query"), reqURL.RawQuery)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Url"), reqURL.String())
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Uri"), reqURL.RequestURI())
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Content-Type"), "application/json")
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Req-Content-Length"), "100")
+
+		remoteHost, remotePort, _ := net.SplitHostPort(result.RemoteAddr)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Remote-Host"), remoteHost)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Remote-Port"), remotePort)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Remote-Addr"), result.RemoteAddr)
+
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Upstream-Scheme"), upstreamURL.Scheme)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Upstream-Host"), upstreamURL.Hostname())
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Upstream-Port"), upstreamURL.Port())
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Upstream-Addr"), upstreamURL.Host)
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Upstream-Url"), upstreamURL.String())
+
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Header-Content-Type"), "application/json")
+		ExpectEqual(t, result.ResponseHeaders.Get("X-Test-Arg-Arg_1"), "b")
 	})
 }