Merge branch 'main' into feat/custom-json-marshaling

fix: improve json marshal performance, reduce necessary allocations
chore: update json marshal tests
2026-01-11 21:10:30 +01:00 · 2025-04-17 06:10:37 +08:00 · 2025-04-17 06:10:13 +08:00 · 2025-04-17 05:18:11 +08:00 · 2025-04-16 15:26:01 +08:00 · 2025-04-16 15:20:25 +08:00
251 changed files with 7906 additions and 3268 deletions
--- a/.env.example
+++ b/.env.example
@@ -5,6 +5,9 @@ TZ=ETC/UTC
 # These fields are not required for OIDC authentication
 GODOXY_API_USER=admin
 GODOXY_API_PASSWORD=password
+
+# Enable `secure` cookie flag
+GODOXY_API_JWT_SECURE=true
 # generate secret with `openssl rand -base64 32`
 GODOXY_API_JWT_SECRET=
 # the JWT token time-to-live
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,7 @@ error_pages/
 !examples/error_pages/
 profiles/
 data/
+debug/

 logs/
 log/
--- a/5
+++ b/5
@@ -1,5 +1,5 @@
 # Stage 1: deps
-FROM golang:1.24.1-alpine AS deps
+FROM golang:1.24.2-alpine AS deps
 HEALTHCHECK NONE

 # package version does not matter
@@ -24,6 +24,7 @@ COPY cmd ./cmd
 COPY internal ./internal
 COPY pkg ./pkg
 COPY agent ./agent
+COPY migrations ./migrations

 ARG VERSION
 ENV VERSION=${VERSION}
@@ -59,4 +60,4 @@ ENV DOCKER_HOST=unix:///var/run/docker.sock

 WORKDIR /app

-CMD ["/app/run"]
+CMD ["/app/run"]
--- a/54
+++ b/54
@@ -27,18 +27,16 @@ endif
 ifeq ($(debug), 1)
 	CGO_ENABLED = 0
 	GODOXY_DEBUG = 1
-	BUILD_FLAGS += -gcflags=all='-N -l'
-endif
-
-ifeq ($(pprof), 1)
+	BUILD_FLAGS += -gcflags=all='-N -l' -tags debug
+else ifeq ($(pprof), 1)
 	CGO_ENABLED = 1
 	GORACE = log_path=logs/pprof strip_path_prefix=$(shell pwd)/ halt_on_error=1
-	BUILD_FLAGS = -tags pprof
+	BUILD_FLAGS += -tags pprof
 	VERSION := ${VERSION}-pprof
 else
 	CGO_ENABLED = 0
 	LDFLAGS += -s -w
-	BUILD_FLAGS = -pgo=auto -tags production
+	BUILD_FLAGS += -pgo=auto -tags production
 endif

 BUILD_FLAGS += -ldflags='$(LDFLAGS)'
@@ -52,6 +50,8 @@ export GODEBUG
 export GORACE
 export BUILD_FLAGS

+.PHONY: debug
+
 test:
 	GODOXY_TEST=1 go test ./internal/...

@@ -69,6 +69,10 @@ build:
 run:
 	[ -f .env ] && godotenv -f .env go run ${BUILD_FLAGS} ${CMD_PATH}

+debug:
+	make NAME="godoxy-test" debug=1 build
+	sh -c 'HTTP_ADDR=:81 HTTPS_ADDR=:8443 API_ADDR=:8899 DEBUG=1 bin/godoxy-test'
+
 mtrace:
 	bin/godoxy debug-ls-mtrace > mtrace.json

@@ -90,43 +94,5 @@ cloc:
 link-binary:
 	ln -s /app/${NAME} bin/run

-# To generate schema
-# comment out this part from typescript-json-schema.js#L884
-#
-#	if (indexType.flags !== ts.TypeFlags.Number && !isIndexedObject) {
-#			throw new Error("Not supported: IndexSignatureDeclaration with index symbol other than a number or a string");
-#	}
-
-gen-schema-single:
-	bun --bun run typescript-json-schema --noExtraProps --required --skipLibCheck --tsNodeRegister=true -o schemas/${OUT} schemas/${IN} ${CLASS}
-	# minify
-	python3 -c "import json; f=open('schemas/${OUT}', 'r'); j=json.load(f); f.close(); f=open('schemas/${OUT}', 'w'); json.dump(j, f, separators=(',', ':'));"
-
-gen-schema:
-	cd schemas && bun --bun tsc
-	make IN=config/config.ts \
-			CLASS=Config \
-			OUT=config.schema.json \
-			gen-schema-single
-	make IN=providers/routes.ts \
-			CLASS=Routes \
-			OUT=routes.schema.json \
-			gen-schema-single
-	make IN=middlewares/middleware_compose.ts \
-			CLASS=MiddlewareCompose \
-			OUT=middleware_compose.schema.json \
-			gen-schema-single
-	make IN=docker.ts \
-			CLASS=DockerRoutes \
-			OUT=docker_routes.schema.json \
-			gen-schema-single
-	cd ..
-
-publish-schema:
-	cd schemas && bun publish && cd ..
-
-update-schema-generator:
-	pnpm up -g typescript-json-schema
-
 push-github:
 	git push origin $(shell git rev-parse --abbrev-ref HEAD)
--- a/README.md
+++ b/README.md
@@ -5,6 +5,7 @@
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_godoxy)
 ![GitHub last commit](https://img.shields.io/github/last-commit/yusing/godoxy)
 [![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_godoxy)
+![Demo](https://img.shields.io/website?url=https%3A%2F%2Fgodoxy.demo.6uo.me&label=Demo&link=https%3A%2F%2Fgodoxy.demo.6uo.me)
 [![Discord](https://dcbadge.limes.pink/api/server/umReR62nRd?style=flat)](https://discord.gg/umReR62nRd)

 A lightweight, simple, and [performant](https://github.com/yusing/godoxy/wiki/Benchmarks) reverse proxy with WebUI.
@@ -13,10 +14,6 @@ For full documentation, check out **[Wiki](https://github.com/yusing/godoxy/wiki

 **EN** | <a href="README_CHT.md">中文</a>

-<!-- [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy) -->
-
 <img src="screenshots/webui.jpg" style="max-width: 650">

 </div>
@@ -27,6 +24,7 @@ For full documentation, check out **[Wiki](https://github.com/yusing/godoxy/wiki

 - [GoDoxy](#godoxy)
  - [Table of content](#table-of-content)
+  - [Running demo](#running-demo)
  - [Key Features](#key-features)
  - [Prerequisites](#prerequisites)
  - [How does GoDoxy work](#how-does-godoxy-work)
@@ -38,25 +36,29 @@ For full documentation, check out **[Wiki](https://github.com/yusing/godoxy/wiki
    - [Folder structrue](#folder-structrue)
  - [Build it yourself](#build-it-yourself)

+## Running demo
+
+<https://godoxy.demo.6uo.me>
+
+[![Deployed on Zeabur](https://zeabur.com/deployed-on-zeabur-dark.svg)](https://zeabur.com/referral?referralCode=yusing&utm_source=yusing&utm_campaign=oss)
+
 ## Key Features

 - Easy to use
  - Effortless configuration
  - Simple multi-node setup with GoDoxy agents or Docker Socket Proxies
  - Error messages is clear and detailed, easy troubleshooting
- Auto SSL with Let's Encrypt (See [Supported DNS-01 Challenge Providers](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers))
- Auto hot-reload on container state / config file changes
- Container aware: create routes dynamically from running docker containers
+- **Auto SSL** with Let's Encrypt (See [Supported DNS-01 Challenge Providers](https://github.com/yusing/go-proxy/wiki/Supported-DNS%E2%80%9001-Providers))
+- **Auto hot-reload** on container state / config file changes
+- **Container aware**: create routes dynamically from running docker containers
 - **idlesleeper**: stop and wake containers based on traffic _(optional, see [screenshots](#idlesleeper))_
 - HTTP reserve proxy and TCP/UDP port forwarding
- OpenID Connect integration: SSO and secure your apps easily
+- **OpenID Connect integration**: SSO and secure your apps easily
 - [HTTP middleware](https://github.com/yusing/go-proxy/wiki/Middlewares) and [Custom error pages support](https://github.com/yusing/go-proxy/wiki/Middlewares#custom-error-pages)
 - **Web UI with App dashboard, config editor, _uptime and system metrics_, _docker logs viewer_**
- Supports linux/amd64 and linux/arm64
+- Supports **linux/amd64** and **linux/arm64**
 - Written in **[Go](https://go.dev)**

-[🔼Back to top](#table-of-content)
-
 ## Prerequisites

 Setup Wildcard DNS Record(s) for machine running `GoDoxy`, e.g.
@@ -71,13 +73,17 @@ Setup Wildcard DNS Record(s) for machine running `GoDoxy`, e.g.
 3. Create a route if applicable (a route is like a "Virtual Host" in NPM)
 4. Watch for container / config changes and update automatically

-GoDoxy uses the label `proxy.aliases` as the subdomain(s), if unset it defaults to the `container_name` field in docker compose.
-
-For example, with the label `proxy.aliases: qbt` you can access your app via `qbt.domain.com`.
+> [!NOTE]
+> GoDoxy uses the label `proxy.aliases` as the subdomain(s), if unset it defaults to the `container_name` field in docker compose.
+>
+> For example, with the label `proxy.aliases: qbt` you can access your app via `qbt.domain.com`.

 ## Setup

-**NOTE:** GoDoxy is designed to be (and only works when) running in `host` network mode, do not change it. To change listening ports, modify `.env`.
+> [!NOTE]
+> GoDoxy is designed to be running in `host` network mode, do not change it.
+>
+> To change listening ports, modify `.env`.

 1. Prepare a new directory for docker compose and config files.

@@ -87,11 +93,7 @@ For example, with the label `proxy.aliases: qbt` you can access your app via `qb
    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/godoxy/main/scripts/setup.sh)"
    ```

-3. Start the container `docker compose up -d` and wait for it to be ready
-
-4. You may now do some extra configuration on WebUI `https://godoxy.yourdomain.com`
-
-[🔼Back to top](#table-of-content)
+3. You may now do some extra configuration on WebUI `https://godoxy.yourdomain.com`

 ## Screenshots

@@ -124,8 +126,6 @@ For example, with the label `proxy.aliases: qbt` you can access your app via `qb
  </table>
 </div>

-[🔼Back to top](#table-of-content)
-
 ## Manual Setup

 1. Make `config` directory then grab `config.example.yml` into `config/config.yml`
--- a/README_CHT.md
+++ b/README_CHT.md
@@ -5,16 +5,13 @@
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
 ![GitHub last commit](https://img.shields.io/github/last-commit/yusing/godoxy)
 [![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![](https://dcbadge.limes.pink/api/server/umReR62nRd?style=flat)](https://discord.gg/umReR62nRd)
+![Demo](https://img.shields.io/website?url=https%3A%2F%2Fgodoxy.demo.6uo.me&label=Demo&link=https%3A%2F%2Fgodoxy.demo.6uo.me)
+[![Discord](https://dcbadge.limes.pink/api/server/umReR62nRd?style=flat)](https://discord.gg/umReR62nRd)

 輕量、易用、 [高效能](https://github.com/yusing/godoxy/wiki/Benchmarks)，且帶有主頁和配置面板的反向代理

 完整文檔請查閱 **[Wiki](https://github.com/yusing/godoxy/wiki)**（暫未有中文翻譯）

-<!-- [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy)
-[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=yusing_go-proxy&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=yusing_go-proxy) -->
-
 <a href="README.md">EN</a> | **中文**

 <img src="https://github.com/user-attachments/assets/4bb371f4-6e4c-425c-89b2-b9e962bdd46f" style="max-width: 650">
@@ -27,6 +24,7 @@

 - [GoDoxy](#godoxy)
  - [目錄](#目錄)
+  - [運行示例](#運行示例)
  - [主要特點](#主要特點)
  - [前置需求](#前置需求)
  - [安裝](#安裝)
@@ -37,6 +35,12 @@
    - [監控](#監控)
  - [自行編譯](#自行編譯)

+## 運行示例
+
+<https://godoxy.demo.6uo.me>
+
+[![Deployed on Zeabur](https://zeabur.com/deployed-on-zeabur-dark.svg)](https://zeabur.com/referral?referralCode=yusing&utm_source=yusing&utm_campaign=oss)
+
 ## 主要特點

 - 容易使用
@@ -65,7 +69,10 @@

 ## 安裝

-**注意：** GoDoxy 設計為（且僅在）`host` 網路模式下運作，請勿更改。如需更改監聽埠，請修改 `.env`。
+> [!NOTE]
+> GoDoxy 僅在 `host` 網路模式下運作，請勿更改。
+>
+> 如需更改監聽埠，請修改 `.env`。

 1. 準備一個新目錄用於 docker compose 和配置文件。

@@ -75,9 +82,7 @@
    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/yusing/godoxy/main/scripts/setup.sh)"
    ```

-3. 啟動容器 `docker compose up -d` 並等待就緒
-
-4. 現在可以在 WebUI `https://godoxy.yourdomain.com` 進行額外配置
+3. 現在可以在 WebUI `https://godoxy.yourdomain.com` 進行額外配置

 [🔼回到頂部](#目錄)

--- a/agent/pkg/agent/agents.go
+++ b/agent/pkg/agent/agents.go
@@ -0,0 +1,16 @@
+package agent
+
+import (
+	"github.com/yusing/go-proxy/internal/utils/pool"
+)
+
+type agents struct{ pool.Pool[*AgentConfig] }
+
+var Agents = agents{pool.New[*AgentConfig]("agents")}
+
+func (agents agents) Get(agentAddrOrDockerHost string) (*AgentConfig, bool) {
+	if !IsDockerHostAgent(agentAddrOrDockerHost) {
+		return agents.Base().Load(agentAddrOrDockerHost)
+	}
+	return agents.Base().Load(GetAgentAddrFromDockerHost(agentAddrOrDockerHost))
+}
--- a/agent/pkg/agent/config.go
+++ b/agent/pkg/agent/config.go
@@ -4,20 +4,16 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"encoding/json"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"strings"
 	"time"

-	"github.com/rs/zerolog"
 	"github.com/yusing/go-proxy/agent/pkg/certs"
 	"github.com/yusing/go-proxy/internal/gperr"
-	"github.com/yusing/go-proxy/internal/logging"
-	gphttp "github.com/yusing/go-proxy/internal/net/gphttp"
-	"github.com/yusing/go-proxy/internal/net/types"
-	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/net/gphttp"
 	"github.com/yusing/go-proxy/pkg"
 )

@@ -27,7 +23,6 @@ type AgentConfig struct {
 	httpClient *http.Client
 	tlsConfig  *tls.Config
 	name       string
-	l          zerolog.Logger
 }

 const (
@@ -50,11 +45,20 @@ const (
 )

 var (
-	AgentURL              = types.MustParseURL(APIBaseURL)
-	HTTPProxyURL          = types.MustParseURL(APIBaseURL + EndpointProxyHTTP)
+	AgentURL, _           = url.Parse(APIBaseURL)
+	HTTPProxyURL, _       = url.Parse(APIBaseURL + EndpointProxyHTTP)
 	HTTPProxyURLPrefixLen = len(APIEndpointBase + EndpointProxyHTTP)
 )

+// TestAgentConfig is a helper function to create an AgentConfig for testing purposes.
+// Not used in production.
+func TestAgentConfig(name string, addr string) *AgentConfig {
+	return &AgentConfig{
+		name: name,
+		Addr: addr,
+	}
+}
+
 func IsDockerHostAgent(dockerHost string) bool {
 	return strings.HasPrefix(dockerHost, FakeDockerHostPrefix)
 }
@@ -63,6 +67,11 @@ func GetAgentAddrFromDockerHost(dockerHost string) string {
 	return dockerHost[FakeDockerHostPrefixLen:]
 }

+// Key implements pool.Object
+func (cfg *AgentConfig) Key() string {
+	return cfg.Addr
+}
+
 func (cfg *AgentConfig) FakeDockerHost() string {
 	return FakeDockerHostPrefix + cfg.Addr
 }
@@ -72,15 +81,7 @@ func (cfg *AgentConfig) Parse(addr string) error {
 	return nil
 }

-func withoutBuildTime(version string) string {
-	return strings.Split(version, "-")[0]
-}
-
-func checkVersion(a, b string) bool {
-	return withoutBuildTime(a) == withoutBuildTime(b)
-}
-
-func (cfg *AgentConfig) StartWithCerts(parent task.Parent, ca, crt, key []byte) error {
+func (cfg *AgentConfig) InitWithCerts(ctx context.Context, ca, crt, key []byte) error {
 	clientCert, err := tls.X509KeyPair(crt, key)
 	if err != nil {
 		return err
@@ -102,7 +103,7 @@ func (cfg *AgentConfig) StartWithCerts(parent task.Parent, ca, crt, key []byte)
 	// create transport and http client
 	cfg.httpClient = cfg.NewHTTPClient()

-	ctx, cancel := context.WithTimeout(parent.Context(), 5*time.Second)
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()

 	// check agent version
@@ -111,10 +112,10 @@ func (cfg *AgentConfig) StartWithCerts(parent task.Parent, ca, crt, key []byte)
 		return err
 	}

-	versionStr := string(version)
-	// skip version check for dev versions
-	if strings.HasPrefix(versionStr, "v") && !checkVersion(versionStr, pkg.GetVersion()) {
-		return gperr.Errorf("agent version mismatch: server: %s, agent: %s", pkg.GetVersion(), versionStr)
+	agentVer := pkg.ParseVersion(string(version))
+	serverVer := pkg.GetVersion()
+	if !agentVer.IsEqual(serverVer) {
+		return gperr.Errorf("agent version mismatch: server: %s, agent: %s", serverVer, agentVer)
 	}

 	// get agent name
@@ -124,13 +125,10 @@ func (cfg *AgentConfig) StartWithCerts(parent task.Parent, ca, crt, key []byte)
 	}

 	cfg.name = string(name)
-	cfg.l = logging.With().Str("agent", cfg.name).Logger()
-
-	logging.Info().Msgf("agent %q initialized", cfg.name)
 	return nil
 }

-func (cfg *AgentConfig) Start(parent task.Parent) gperr.Error {
+func (cfg *AgentConfig) Init(ctx context.Context) gperr.Error {
 	filepath, ok := certs.AgentCertsFilepath(cfg.Addr)
 	if !ok {
 		return gperr.New("invalid agent host").Subject(cfg.Addr)
@@ -146,7 +144,7 @@ func (cfg *AgentConfig) Start(parent task.Parent) gperr.Error {
 		return gperr.Wrap(err, "failed to extract agent certs")
 	}

-	return gperr.Wrap(cfg.StartWithCerts(parent, ca, crt, key))
+	return gperr.Wrap(cfg.InitWithCerts(ctx, ca, crt, key))
 }

 func (cfg *AgentConfig) NewHTTPClient() *http.Client {
@@ -174,6 +172,10 @@ func (cfg *AgentConfig) DialContext(ctx context.Context) (net.Conn, error) {
 	return gphttp.DefaultDialer.DialContext(ctx, "tcp", cfg.Addr)
 }

+func (cfg *AgentConfig) IsInitialized() bool {
+	return cfg.name != ""
+}
+
 func (cfg *AgentConfig) Name() string {
 	return cfg.name
 }
@@ -182,9 +184,10 @@ func (cfg *AgentConfig) String() string {
 	return cfg.name + "@" + cfg.Addr
 }

-func (cfg *AgentConfig) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]string{
+// MarshalMap implements pool.Object
+func (cfg *AgentConfig) MarshalMap() map[string]any {
+	return map[string]any{
 		"name": cfg.Name(),
 		"addr": cfg.Addr,
-	})
+	}
 }
--- a/agent/pkg/certs/zip.go
+++ b/agent/pkg/certs/zip.go
@@ -59,7 +59,7 @@ func AgentCertsFilepath(host string) (filepathOut string, ok bool) {
 	if !isValidAgentHost(host) {
 		return "", false
 	}
-	return filepath.Join(common.AgentCertsBasePath, host+".zip"), true
+	return filepath.Join(common.CertsDir, host+".zip"), true
 }

 func ExtractCert(data []byte) (ca, crt, key []byte, err error) {
--- a/agent/pkg/handler/check_health.go
+++ b/agent/pkg/handler/check_health.go
@@ -8,7 +8,6 @@ import (
 	"strings"

 	"github.com/yusing/go-proxy/internal/net/gphttp"
-	"github.com/yusing/go-proxy/internal/net/types"
 	"github.com/yusing/go-proxy/internal/watcher/health"
 	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
 )
@@ -44,11 +43,11 @@ func CheckHealth(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
 			return
 		}
-		result, err = monitor.NewHTTPHealthChecker(types.NewURL(&url.URL{
+		result, err = monitor.NewHTTPHealthMonitor(&url.URL{
 			Scheme: scheme,
 			Host:   host,
 			Path:   path,
-		}), defaultHealthConfig).CheckHealth()
+		}, defaultHealthConfig).CheckHealth()
 	case "tcp", "udp":
 		host := query.Get("host")
 		if host == "" {
@@ -63,10 +62,10 @@ func CheckHealth(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
 			return
 		}
-		result, err = monitor.NewRawHealthChecker(types.NewURL(&url.URL{
+		result, err = monitor.NewRawHealthMonitor(&url.URL{
 			Scheme: scheme,
 			Host:   host,
-		}), defaultHealthConfig).CheckHealth()
+		}, defaultHealthConfig).CheckHealth()
 	}

 	if err != nil {
--- a/agent/pkg/handler/check_health_test.go
+++ b/agent/pkg/handler/check_health_test.go
@@ -1,7 +1,6 @@
 package handler_test

 import (
-	"encoding/json"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -9,6 +8,8 @@ import (
 	"strconv"
 	"testing"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	"github.com/stretchr/testify/require"
 	"github.com/yusing/go-proxy/agent/pkg/agent"
 	"github.com/yusing/go-proxy/agent/pkg/handler"
--- a/agent/pkg/handler/docker_socket.go
+++ b/agent/pkg/handler/docker_socket.go
@@ -9,7 +9,6 @@ import (
 	"github.com/yusing/go-proxy/internal/docker"
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/net/gphttp/reverseproxy"
-	"github.com/yusing/go-proxy/internal/net/types"
 )

 func serviceUnavailable(w http.ResponseWriter, r *http.Request) {
@@ -22,10 +21,10 @@ func DockerSocketHandler() http.HandlerFunc {
 		logging.Warn().Err(err).Msg("failed to connect to docker client")
 		return serviceUnavailable
 	}
-	rp := reverseproxy.NewReverseProxy("docker", types.NewURL(&url.URL{
+	rp := reverseproxy.NewReverseProxy("docker", &url.URL{
 		Scheme: "http",
 		Host:   client.DummyHost,
-	}), dockerClient.HTTPClient().Transport)
+	}, dockerClient.HTTPClient().Transport)

 	return rp.ServeHTTP
 }
--- a/agent/pkg/handler/proxy_http.go
+++ b/agent/pkg/handler/proxy_http.go
@@ -12,7 +12,6 @@ import (
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/net/gphttp"
 	"github.com/yusing/go-proxy/internal/net/gphttp/reverseproxy"
-	"github.com/yusing/go-proxy/internal/net/types"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

@@ -55,9 +54,9 @@ func ProxyHTTP(w http.ResponseWriter, r *http.Request) {

 	logging.Debug().Msgf("proxy http request: %s %s", r.Method, r.URL.String())

-	rp := reverseproxy.NewReverseProxy("agent", types.NewURL(&url.URL{
+	rp := reverseproxy.NewReverseProxy("agent", &url.URL{
 		Scheme: scheme,
 		Host:   host,
-	}), transport)
+	}, transport)
 	rp.ServeHTTP(w, r)
 }
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -6,9 +6,8 @@ import (
 	"os"
 	"sync"

-	"github.com/yusing/go-proxy/internal"
 	"github.com/yusing/go-proxy/internal/api/v1/auth"
-	"github.com/yusing/go-proxy/internal/api/v1/favicon"
+	debugapi "github.com/yusing/go-proxy/internal/api/v1/debug"
 	"github.com/yusing/go-proxy/internal/api/v1/query"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/config"
@@ -21,6 +20,7 @@ import (
 	"github.com/yusing/go-proxy/internal/net/gphttp/middleware"
 	"github.com/yusing/go-proxy/internal/route/routes/routequery"
 	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/migrations"
 	"github.com/yusing/go-proxy/pkg"
 )

@@ -40,6 +40,9 @@ func parallel(fns ...func()) {

 func main() {
 	initProfiling()
+	if err := migrations.RunMigrations(); err != nil {
+		gperr.LogFatal("migration error", err)
+	}
 	args := pkg.GetArgs(common.MainServerCommandValidator{})

 	switch args.Command {
@@ -50,7 +53,7 @@ func main() {
 		rawLogger.Println("ok")
 		return
 	case common.CommandListIcons:
-		icons, err := internal.ListAvailableIcons()
+		icons, err := homepage.ListAvailableIcons()
 		if err != nil {
 			rawLogger.Fatal(err)
 		}
@@ -79,9 +82,9 @@ func main() {
 		logging.Info().Msgf("GoDoxy version %s", pkg.GetVersion())
 		logging.Trace().Msg("trace enabled")
 		parallel(
-			internal.InitIconListCache,
+			homepage.InitIconListCache,
+			homepage.InitIconCache,
 			homepage.InitOverridesConfig,
-			favicon.InitIconCache,
 			systeminfo.Poller.Start,
 		)

@@ -148,6 +151,8 @@ func main() {
 	uptime.Poller.Start()
 	config.WatchChanges()

+	debugapi.StartServer(cfg)
+
 	task.WaitExit(cfg.Value().TimeoutShutdown)
 }

--- a/cmd/pprof_production.go
+++ b/cmd/pprof_production.go
@@ -1,4 +1,4 @@
-//go:build production
+//go:build !pprof

 package main

--- a/go.mod
+++ b/go.mod
@@ -1,84 +1,132 @@
 module github.com/yusing/go-proxy

-go 1.24.1
+go 1.24.2
+
+// misc

 require (
-	github.com/PuerkitoBio/goquery v1.10.2 // parsing HTML for extract fav icon
-	github.com/coder/websocket v1.8.13 // websocket for API and agent
-	github.com/coreos/go-oidc/v3 v3.13.0 // oidc authentication
-	github.com/docker/docker v28.0.4+incompatible // docker daemon
-	github.com/fsnotify/fsnotify v1.8.0 // file watcher
+	github.com/bytedance/sonic v1.13.2 // faster json unmarshal (for marshal it's using custom implementation)
+	github.com/fsnotify/fsnotify v1.9.0 // file watcher
 	github.com/go-acme/lego/v4 v4.22.2 // acme client
-	github.com/go-playground/validator/v10 v10.25.0 // validator
+	github.com/go-playground/validator/v10 v10.26.0 // validator
 	github.com/gobwas/glob v0.2.3 // glob matcher for route rules
-	github.com/golang-jwt/jwt/v5 v5.2.2 // jwt for default auth
+	github.com/goccy/go-yaml v1.17.1 // yaml parsing for different config files
 	github.com/gotify/server/v2 v2.6.1 // reference the Message struct for json response
 	github.com/lithammer/fuzzysearch v1.1.8 // fuzzy search for searching icons and filtering metrics
-	github.com/prometheus/client_golang v1.21.1 // metrics
 	github.com/puzpuzpuz/xsync/v3 v3.5.1 // lock free map for concurrent operations
-	github.com/rs/zerolog v1.34.0 // logging
-	github.com/shirou/gopsutil/v4 v4.25.2 // system info metrics
-	github.com/vincent-petithory/dataurl v1.0.0 // data url for fav icon
-	golang.org/x/crypto v0.36.0 // encrypting password with bcrypt
-	golang.org/x/net v0.38.0 // HTTP header utilities
-	golang.org/x/oauth2 v0.28.0 // oauth2 authentication
-	golang.org/x/text v0.23.0 // string utilities
+	golang.org/x/text v0.24.0 // string utilities
 	golang.org/x/time v0.11.0 // time utilities
-	gopkg.in/yaml.v3 v3.0.1 // yaml parsing for different config files
 )

+// http
+
 require (
-	github.com/docker/cli v28.0.4+incompatible
-	github.com/docker/go-connections v0.5.0
-	github.com/stretchr/testify v1.10.0
+	github.com/coder/websocket v1.8.13 // websocket for API and agent
+	github.com/quic-go/quic-go v0.50.1 // http3 server
+	golang.org/x/net v0.39.0 // HTTP header utilities
 )

+// authentication
+
+require (
+	github.com/coreos/go-oidc/v3 v3.14.1 // oidc authentication
+	github.com/golang-jwt/jwt/v5 v5.2.2 // jwt for default auth
+	golang.org/x/crypto v0.37.0 // encrypting password with bcrypt
+	golang.org/x/oauth2 v0.29.0 // oauth2 authentication
+)
+
+// favicon extraction
+require (
+	github.com/PuerkitoBio/goquery v1.10.3 // parsing HTML for extract fav icon
+	github.com/vincent-petithory/dataurl v1.0.0 // data url for fav icon
+)
+
+// docker
+
+require (
+	github.com/docker/cli v28.0.4+incompatible // docker cli
+	github.com/docker/docker v28.0.4+incompatible // docker daemon
+	github.com/docker/go-connections v0.5.0 // docker connection utilities
+)
+
+// logging
+
+require (
+	github.com/rs/zerolog v1.34.0 // logging
+	github.com/samber/slog-zerolog/v2 v2.7.3 // zerlog to slog adapter for quic-go
+)
+
+// metrics
+
+require (
+	github.com/prometheus/client_golang v1.22.0 // metrics
+	github.com/shirou/gopsutil/v4 v4.25.3 // system info metrics
+	github.com/stretchr/testify v1.10.0 // testing utilities
+)
+
+require github.com/luthermonson/go-proxmox v0.2.2
+
 require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/buger/goterm v1.0.4 // indirect
+	github.com/bytedance/sonic/loader v0.2.4 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudflare/cloudflare-go v0.115.0 // indirect
+	github.com/cloudwego/base64x v0.1.5 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/diskfs/go-diskfs v1.6.0 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
+	github.com/djherbis/times v1.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/ebitengine/purego v0.8.2 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
+	github.com/gorilla/websocket v1.5.3 // indirect
+	github.com/jinzhu/copier v0.4.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
+	github.com/magefile/mage v1.15.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/miekg/dns v1.1.64 // indirect
+	github.com/miekg/dns v1.1.65 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nrdcg/porkbun v0.4.0 // indirect
+	github.com/onsi/ginkgo/v2 v2.23.4 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/ovh/go-ovh v1.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.63.0 // indirect
 	github.com/prometheus/procfs v0.16.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/quic-go/qpack v0.5.1 // indirect
+	github.com/samber/lo v1.49.1 // indirect
+	github.com/samber/slog-common v0.18.1 // indirect
+	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
 	github.com/tklauser/go-sysconf v0.3.15 // indirect
 	github.com/tklauser/numcpus v0.10.0 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
@@ -86,11 +134,16 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 // indirect
 	go.opentelemetry.io/otel/metric v1.35.0 // indirect
 	go.opentelemetry.io/otel/trace v1.35.0 // indirect
+	go.uber.org/automaxprocs v1.6.0 // indirect
+	go.uber.org/mock v0.5.1 // indirect
+	golang.org/x/arch v0.16.0 // indirect
+	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
 	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/tools v0.31.0 // indirect
+	golang.org/x/sync v0.13.0 // indirect
+	golang.org/x/sys v0.32.0 // indirect
+	golang.org/x/tools v0.32.0 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools/v3 v3.5.1 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -2,31 +2,45 @@ github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOEl
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/PuerkitoBio/goquery v1.10.2 h1:7fh2BdHcG6VFZsK7toXBT/Bh1z5Wmy8Q9MV9HqT2AM8=
-github.com/PuerkitoBio/goquery v1.10.2/go.mod h1:0guWGjcLu9AYC7C1GHnpysHy056u9aEkUHwhdnePMCU=
+github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
+github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
 github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
 github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY=
+github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE=
+github.com/bytedance/sonic v1.13.2 h1:8/H1FempDZqC4VqjptGo14QQlJx8VdZJegxs6wwfqpQ=
+github.com/bytedance/sonic v1.13.2/go.mod h1:o68xyaF9u2gvVBuGHPlUVCy+ZfmNNO5ETf1+KgkJhz4=
+github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
+github.com/bytedance/sonic/loader v0.2.4 h1:ZWCw4stuXUsn1/+zQDqeE7JKP+QO47tz7QCNan80NzY=
+github.com/bytedance/sonic/loader v0.2.4/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cloudflare/cloudflare-go v0.115.0 h1:84/dxeeXweCc0PN5Cto44iTA8AkG1fyT11yPO5ZB7sM=
 github.com/cloudflare/cloudflare-go v0.115.0/go.mod h1:Ds6urDwn/TF2uIU24mu7H91xkKP8gSAHxQ44DSZgVmU=
+github.com/cloudwego/base64x v0.1.5 h1:XPciSp1xaq2VCSt6lF0phncD4koWyULpl5bUxbfCyP4=
+github.com/cloudwego/base64x v0.1.5/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
+github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
 github.com/coder/websocket v1.8.13 h1:f3QZdXy7uGVz+4uCJy2nTZyM0yTBj8yANEHhqlXZ9FE=
 github.com/coder/websocket v1.8.13/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/coreos/go-oidc/v3 v3.13.0 h1:M66zd0pcc5VxvBNM4pB331Wrsanby+QomQYjN8HamW8=
-github.com/coreos/go-oidc/v3 v3.13.0/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
+github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
+github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/diskfs/go-diskfs v1.6.0 h1:YmK5+vLSfkwC6kKKRTRPGaDGNF+Xh8FXeiNHwryDfu4=
+github.com/diskfs/go-diskfs v1.6.0/go.mod h1:bRFumZeGFCO8C2KNswrQeuj2m1WCVr4Ms5IjWMczMDk=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
+github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
 github.com/docker/cli v28.0.4+incompatible h1:pBJSJeNd9QeIWPjRcV91RVJihd/TXB77q1ef64XEu4A=
 github.com/docker/cli v28.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker v28.0.4+incompatible h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok=
@@ -37,16 +51,18 @@ github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/ebitengine/purego v0.8.2 h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
 github.com/ebitengine/purego v0.8.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab h1:h1UgjJdAAhj+uPL68n7XASS6bU+07ZX1WJvVS2eyoeY=
+github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab/go.mod h1:GLo/8fDswSAniFG+BFIaiSPcK610jyzgEhWYPQwuQdw=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
 github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
 github.com/go-acme/lego/v4 v4.22.2 h1:ck+HllWrV/rZGeYohsKQ5iKNnU/WAZxwOdiu6cxky+0=
 github.com/go-acme/lego/v4 v4.22.2/go.mod h1:E2FndyI3Ekv0usNJt46mFb9LVpV/XBYT+4E3tz02Tzo=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/go-jose/go-jose/v4 v4.1.0 h1:cYSYxd3pw5zd2FSXk2vGdn9igQU2PS8MuxrCOCl0FdY=
+github.com/go-jose/go-jose/v4 v4.1.0/go.mod h1:GG/vqmYm3Von2nYiB2vGTXzdoNKE5tix5tuc6iAd+sw=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -61,12 +77,18 @@ github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/o
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.25.0 h1:5Dh7cjvzR7BRZadnsVOzPhWsrwUr0nmsZJxEAnFLNO8=
-github.com/go-playground/validator/v10 v10.25.0/go.mod h1:GGzBIJMuE98Ic/kJsBXbz1x/7cByt++cQ+YOuDM5wus=
+github.com/go-playground/validator/v10 v10.26.0 h1:SP05Nqhjcvz81uJaRfEV0YBSSSGMc/iMaVtFbr3Sw2k=
+github.com/go-playground/validator/v10 v10.26.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
+github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.17.1 h1:LI34wktB2xEE3ONG/2Ar54+/HJVBriAGJ55PHls4YuY=
+github.com/goccy/go-yaml v1.17.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
@@ -78,18 +100,32 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gotify/server/v2 v2.6.1 h1:Kf7v5fzBxzELzZa/jonWfwJMkqYqh1LBzBpCmt5QIAI=
 github.com/gotify/server/v2 v2.6.1/go.mod h1:Dk8HLyTVDqmXM8YEg6tjROBen6mxyHZFRggJFHTwZLc=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1NhHmEPPzzuhWgcza5M1Ji1I=
+github.com/h2non/gock v1.2.0 h1:K6ol8rfrRkUOefooBC8elXoaNGYkpp7y2qcxGG6BzUE=
+github.com/h2non/gock v1.2.0/go.mod h1:tNhoxHYW2W42cYkYb1WqzdbYIieALC99kpYr7rH/BQk=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI=
 github.com/jarcoal/httpmock v1.3.0 h1:2RJ8GP0IIaWwcC9Fp2BmVi8Kog3v2Hn7VXM3fTd+nuc=
 github.com/jarcoal/httpmock v1.3.0/go.mod h1:3yb8rc4BI7TCBhFY8ng0gjuLKJNquuDNiPaZjnENuYg=
+github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
+github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
+github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -102,6 +138,10 @@ github.com/lithammer/fuzzysearch v1.1.8 h1:/HIuJnjHuXS8bKaiTMeeDlW2/AyIWk2brx1V8
 github.com/lithammer/fuzzysearch v1.1.8/go.mod h1:IdqeyBClc3FFqSzYq/MXESsS4S0FsZ5ajtkr5xPLts4=
 github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 h1:PpXWgLPs+Fqr325bN2FD2ISlRRztXibcX6e8f5FR5Dc=
 github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/luthermonson/go-proxmox v0.2.2 h1:BZ7VEj302wxw2i/EwTcyEiBzQib8teocB2SSkLHyySY=
+github.com/luthermonson/go-proxmox v0.2.2/go.mod h1:oyFgg2WwTEIF0rP6ppjiixOHa5ebK1p8OaRiFhvICBQ=
+github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
+github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
@@ -111,8 +151,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/maxatome/go-testdeep v1.12.0 h1:Ql7Go8Tg0C1D/uMMX59LAoYK7LffeJQ6X2T04nTH68g=
 github.com/maxatome/go-testdeep v1.12.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM=
-github.com/miekg/dns v1.1.64 h1:wuZgD9wwCE6XMT05UU/mlSko71eRSXEAm2EbjQXLKnQ=
-github.com/miekg/dns v1.1.64/go.mod h1:Dzw9769uoKVaLuODMDZz9M6ynFU6Em65csPuoi8G0ck=
+github.com/miekg/dns v1.1.65 h1:0+tIPHzUW0GCge7IiK3guGP57VAw7hoPDfApjkMD1Fc=
+github.com/miekg/dns v1.1.65/go.mod h1:Dzw9769uoKVaLuODMDZz9M6ynFU6Em65csPuoi8G0ck=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
@@ -123,46 +163,75 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nrdcg/porkbun v0.4.0 h1:rWweKlwo1PToQ3H+tEO9gPRW0wzzgmI/Ob3n2Guticw=
 github.com/nrdcg/porkbun v0.4.0/go.mod h1:/QMskrHEIM0IhC/wY7iTCUgINsxdT2WcOphktJ9+Q54=
+github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
+github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
+github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
+github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/ovh/go-ovh v1.7.0 h1:V14nF7FwDjQrZt9g7jzcvAAQ3HN6DNShRFRMC3jLoPw=
 github.com/ovh/go-ovh v1.7.0/go.mod h1:cTVDnl94z4tl8pP1uZ/8jlVxntjSIf09bNcQ5TJSC7c=
+github.com/pierrec/lz4/v4 v4.1.17 h1:kV4Ip+/hUBC+8T6+2EgburRtkE9ef4nbY3f4dFhGjMc=
+github.com/pierrec/lz4/v4 v4.1.17/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/xattr v0.4.9 h1:5883YPCtkSd8LFbs13nXplj9g9tlrwoJRjgpgMu1/fE=
+github.com/pkg/xattr v0.4.9/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_golang v1.21.1 h1:DOvXXTqVzvkIewV/CDPFdejpMCGeMcbGCQ8YOmu+Ibk=
-github.com/prometheus/client_golang v1.21.1/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
+github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
 github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
 github.com/prometheus/procfs v0.16.0 h1:xh6oHhKwnOJKMYiYBDWmkHqQPyiY40sny36Cmx2bbsM=
 github.com/prometheus/procfs v0.16.0/go.mod h1:8veyXUu3nGP7oaCxhX6yeaM5u4stL2FeMXnCqhDthZg=
 github.com/puzpuzpuz/xsync/v3 v3.5.1 h1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=
 github.com/puzpuzpuz/xsync/v3 v3.5.1/go.mod h1:VjzYrABPabuM4KyBh1Ftq6u8nhwY5tBPKP9jpmh0nnA=
+github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
+github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
+github.com/quic-go/quic-go v0.50.1 h1:unsgjFIUqW8a2oopkY7YNONpV1gYND6Nt9hnt1PN94Q=
+github.com/quic-go/quic-go v0.50.1/go.mod h1:Vim6OmUvlYdwBhXP9ZVrtGmCMWa3wEqhq3NgYrI8b4E=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
 github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
-github.com/shirou/gopsutil/v4 v4.25.2 h1:NMscG3l2CqtWFS86kj3vP7soOczqrQYIEhO/pMvvQkk=
-github.com/shirou/gopsutil/v4 v4.25.2/go.mod h1:34gBYJzyqCDT11b6bMHP0XCvWeU3J61XRT7a2EmCRTA=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/samber/lo v1.49.1 h1:4BIFyVfuQSEpluc7Fua+j1NolZHiEHEpaSEKdsH0tew=
+github.com/samber/lo v1.49.1/go.mod h1:dO6KHFzUKXgP8LDhU0oI8d2hekjXnGOu0DB8Jecxd6o=
+github.com/samber/slog-common v0.18.1 h1:c0EipD/nVY9HG5shgm/XAs67mgpWDMF+MmtptdJNCkQ=
+github.com/samber/slog-common v0.18.1/go.mod h1:QNZiNGKakvrfbJ2YglQXLCZauzkI9xZBjOhWFKS3IKk=
+github.com/samber/slog-zerolog/v2 v2.7.3 h1:/MkPDl/tJhijN2GvB1MWwBn2FU8RiL3rQ8gpXkQm2EY=
+github.com/samber/slog-zerolog/v2 v2.7.3/go.mod h1:oWU7WHof4Xp8VguiNO02r1a4VzkgoOyOZhY5CuRke60=
+github.com/shirou/gopsutil/v4 v4.25.3 h1:SeA68lsu8gLggyMbmCn8cmp97V1TI9ld9sVzAUcKcKE=
+github.com/shirou/gopsutil/v4 v4.25.3/go.mod h1:xbuxyoZj+UsgnZrENu3lQivsngRR5BdjbJwf2fv4szA=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
 github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
 github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
 github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
+github.com/ulikunitz/xz v0.5.11 h1:kpFauv27b6ynzBNT/Xy+1k+fK4WswhN/6PN5WhFAGw8=
+github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/vincent-petithory/dataurl v1.0.0 h1:cXw+kPto8NLuJtlMsI152irrVw9fRDX8AbShPRpg2CI=
 github.com/vincent-petithory/dataurl v1.0.0/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -190,6 +259,12 @@ go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt
 go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
 go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
+go.uber.org/mock v0.5.1 h1:ASgazW/qBmR+A32MYFDB6E2POoTgOwT509VP0CT/fjs=
+go.uber.org/mock v0.5.1/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+golang.org/x/arch v0.16.0 h1:foMtLTdyOmIniqWCHjY6+JxuC54XP1fDwx4N0ASyW+U=
+golang.org/x/arch v0.16.0/go.mod h1:JmwW7aLIoRUKgaTzhkiEFxvcEiQGyOg9BMonBJUS7EE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -198,8 +273,10 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
+golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -221,10 +298,10 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
-golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
+golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
+golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -234,16 +311,18 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210331175145-43e1dd70ce54/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -255,8 +334,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
+golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -275,8 +354,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
+golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
 golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
 golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -287,8 +366,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
-golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
+golang.org/x/tools v0.32.0 h1:Q7N1vhpkQv7ybVzLFtTjvQya2ewbwNDZzUgfXGqtMWU=
+golang.org/x/tools v0.32.0/go.mod h1:ZxrU41P/wAbZD8EDa6dDCa6XfpkhJ7HFMjHJXfBDu8s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -312,3 +391,4 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
 gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
+nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
--- a/internal/api/handler.go
+++ b/internal/api/handler.go
@@ -1,7 +1,6 @@
 package api

 import (
-	"fmt"
 	"net/http"

 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -15,58 +14,11 @@ import (
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/logging/memlogger"
 	"github.com/yusing/go-proxy/internal/metrics/uptime"
-	"github.com/yusing/go-proxy/internal/net/gphttp/httpheaders"
-	"github.com/yusing/go-proxy/internal/utils/strutils"
+	"github.com/yusing/go-proxy/internal/net/gphttp/servemux"
 )

-type (
-	ServeMux struct {
-		*http.ServeMux
-		cfg config.ConfigInstance
-	}
-	WithCfgHandler = func(config.ConfigInstance, http.ResponseWriter, *http.Request)
-)
-
-func (mux ServeMux) HandleFunc(methods, endpoint string, h any, requireAuth ...bool) {
-	var handler http.HandlerFunc
-	switch h := h.(type) {
-	case func(http.ResponseWriter, *http.Request):
-		handler = h
-	case http.Handler:
-		handler = h.ServeHTTP
-	case WithCfgHandler:
-		handler = func(w http.ResponseWriter, r *http.Request) {
-			h(mux.cfg, w, r)
-		}
-	default:
-		panic(fmt.Errorf("unsupported handler type: %T", h))
-	}
-
-	matchDomains := mux.cfg.Value().MatchDomains
-	if len(matchDomains) > 0 {
-		origHandler := handler
-		handler = func(w http.ResponseWriter, r *http.Request) {
-			if httpheaders.IsWebsocket(r.Header) {
-				httpheaders.SetWebsocketAllowedDomains(r.Header, matchDomains)
-			}
-			origHandler(w, r)
-		}
-	}
-
-	if len(requireAuth) > 0 && requireAuth[0] {
-		handler = auth.RequireAuth(handler)
-	}
-	if methods == "" {
-		mux.ServeMux.HandleFunc(endpoint, handler)
-	} else {
-		for _, m := range strutils.CommaSeperatedList(methods) {
-			mux.ServeMux.HandleFunc(m+" "+endpoint, handler)
-		}
-	}
-}
-
 func NewHandler(cfg config.ConfigInstance) http.Handler {
-	mux := ServeMux{http.NewServeMux(), cfg}
+	mux := servemux.NewServeMux(cfg)
 	mux.HandleFunc("GET", "/v1", v1.Index)
 	mux.HandleFunc("GET", "/v1/version", v1.GetVersion)

--- a/internal/api/v1/agents.go
+++ b/internal/api/v1/agents.go
@@ -4,21 +4,11 @@ import (
 	"net/http"
 	"time"

-	"github.com/coder/websocket"
-	"github.com/coder/websocket/wsjson"
+	"github.com/yusing/go-proxy/agent/pkg/agent"
 	config "github.com/yusing/go-proxy/internal/config/types"
-	"github.com/yusing/go-proxy/internal/net/gphttp"
 	"github.com/yusing/go-proxy/internal/net/gphttp/gpwebsocket"
-	"github.com/yusing/go-proxy/internal/net/gphttp/httpheaders"
 )

 func ListAgents(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
-	if httpheaders.IsWebsocket(r.Header) {
-		gpwebsocket.Periodic(w, r, 10*time.Second, func(conn *websocket.Conn) error {
-			wsjson.Write(r.Context(), conn, cfg.ListAgents())
-			return nil
-		})
-	} else {
-		gphttp.RespondJSON(w, r, cfg.ListAgents())
-	}
+	gpwebsocket.DynamicJSONHandler(w, r, agent.Agents.Slice, 10*time.Second)
 }
--- a/internal/api/v1/auth/oidc.go
+++ b/internal/api/v1/auth/oidc.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/base64"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -15,6 +14,8 @@ import (
 	"strings"
 	"time"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/net/gphttp"
--- a/internal/api/v1/auth/oidc_test.go
+++ b/internal/api/v1/auth/oidc_test.go
@@ -5,12 +5,13 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"encoding/base64"
-	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/yusing/go-proxy/internal/common"
--- a/internal/api/v1/auth/userpass.go
+++ b/internal/api/v1/auth/userpass.go
@@ -1,11 +1,12 @@
 package auth

 import (
-	"encoding/json"
 	"fmt"
 	"net/http"
 	"time"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/gperr"
--- a/internal/api/v1/auth/userpass_test.go
+++ b/internal/api/v1/auth/userpass_test.go
@@ -2,13 +2,14 @@ package auth

 import (
 	"bytes"
-	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 	"golang.org/x/crypto/bcrypt"
 )
--- a/internal/api/v1/certapi/cert_info.go
+++ b/internal/api/v1/certapi/cert_info.go
@@ -1,9 +1,10 @@
 package certapi

 import (
-	"encoding/json"
 	"net/http"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	config "github.com/yusing/go-proxy/internal/config/types"
 )

--- a/internal/api/v1/config_file.go
+++ b/internal/api/v1/config_file.go
@@ -27,7 +27,7 @@ func fileType(file string) FileType {
 	switch {
 	case strings.HasPrefix(path.Base(file), "config."):
 		return FileTypeConfig
-	case strings.HasPrefix(file, common.MiddlewareComposeBasePath):
+	case strings.HasPrefix(file, common.MiddlewareComposeDir):
 		return FileTypeMiddleware
 	}
 	return FileTypeProvider
@@ -43,9 +43,9 @@ func (t FileType) IsValid() bool {

 func (t FileType) GetPath(filename string) string {
 	if t == FileTypeMiddleware {
-		return path.Join(common.MiddlewareComposeBasePath, filename)
+		return path.Join(common.MiddlewareComposeDir, filename)
 	}
-	return path.Join(common.ConfigBasePath, filename)
+	return path.Join(common.ConfigDir, filename)
 }

 func getArgs(r *http.Request) (fileType FileType, filename string, err error) {
--- a/internal/api/v1/debug/handler.go
+++ b/internal/api/v1/debug/handler.go
@@ -0,0 +1,75 @@
+//go:build debug
+
+package debugapi
+
+import (
+	"iter"
+	"net/http"
+	"sort"
+	"time"
+
+	"github.com/yusing/go-proxy/agent/pkg/agent"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/docker"
+	"github.com/yusing/go-proxy/internal/idlewatcher"
+	"github.com/yusing/go-proxy/internal/net/gphttp/gpwebsocket"
+	"github.com/yusing/go-proxy/internal/net/gphttp/servemux"
+	"github.com/yusing/go-proxy/internal/net/gphttp/server"
+	"github.com/yusing/go-proxy/internal/proxmox"
+	"github.com/yusing/go-proxy/internal/task"
+)
+
+func StartServer(cfg config.ConfigInstance) {
+	srv := server.NewServer(server.Options{
+		Name:     "debug",
+		HTTPAddr: "127.0.0.1:7777",
+		Handler:  newHandler(cfg),
+	})
+	srv.Start(task.RootTask("debug_server", false))
+}
+
+type debuggable interface {
+	MarshalMap() map[string]any
+	Key() string
+}
+
+func toSortedSlice[T debuggable](data iter.Seq2[string, T]) []map[string]any {
+	s := make([]map[string]any, 0)
+	for _, v := range data {
+		m := v.MarshalMap()
+		m["key"] = v.Key()
+		s = append(s, m)
+	}
+	sort.Slice(s, func(i, j int) bool {
+		return s[i]["key"].(string) < s[j]["key"].(string)
+	})
+	return s
+}
+
+func jsonHandler[T debuggable](getData iter.Seq2[string, T]) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		gpwebsocket.DynamicJSONHandler(w, r, func() []map[string]any {
+			return toSortedSlice(getData)
+		}, 200*time.Millisecond)
+	}
+}
+
+func iterMap[K comparable, V debuggable](m func() map[K]V) iter.Seq2[K, V] {
+	return func(yield func(K, V) bool) {
+		for k, v := range m() {
+			if !yield(k, v) {
+				break
+			}
+		}
+	}
+}
+
+func newHandler(cfg config.ConfigInstance) http.Handler {
+	mux := servemux.NewServeMux(cfg)
+	mux.HandleFunc("GET", "/tasks", jsonHandler(task.AllTasks()))
+	mux.HandleFunc("GET", "/idlewatcher", jsonHandler(idlewatcher.Watchers()))
+	mux.HandleFunc("GET", "/agents", jsonHandler(agent.Agents.Iter))
+	mux.HandleFunc("GET", "/proxmox", jsonHandler(proxmox.Clients.Iter))
+	mux.HandleFunc("GET", "/docker", jsonHandler(iterMap(docker.Clients)))
+	return mux
+}
--- a/internal/api/v1/debug/handler_production.go
+++ b/internal/api/v1/debug/handler_production.go
@@ -0,0 +1,11 @@
+//go:build !debug
+
+package debugapi
+
+import (
+	config "github.com/yusing/go-proxy/internal/config/types"
+)
+
+func StartServer(cfg config.ConfigInstance) {
+	// do nothing
+}
--- a/internal/api/v1/dockerapi/containers.go
+++ b/internal/api/v1/dockerapi/containers.go
@@ -18,7 +18,7 @@ type Container struct {
 }

 func Containers(w http.ResponseWriter, r *http.Request) {
-	serveHTTP[Container, []Container](w, r, GetContainers)
+	serveHTTP[Container](w, r, GetContainers)
 }

 func GetContainers(ctx context.Context, dockerClients DockerClients) ([]Container, gperr.Error) {
--- a/internal/api/v1/dockerapi/info.go
+++ b/internal/api/v1/dockerapi/info.go
@@ -2,10 +2,11 @@ package dockerapi

 import (
 	"context"
-	"encoding/json"
 	"net/http"
 	"sort"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	dockerSystem "github.com/docker/docker/api/types/system"
 	"github.com/yusing/go-proxy/internal/gperr"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
@@ -13,8 +14,8 @@ import (

 type dockerInfo dockerSystem.Info

-func (d *dockerInfo) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]any{
+func (d *dockerInfo) MarshalJSONTo(buf []byte) []byte {
+	return json.MarshalTo(map[string]any{
 		"name":    d.Name,
 		"version": d.ServerVersion,
 		"containers": map[string]int{
@@ -25,8 +26,8 @@ func (d *dockerInfo) MarshalJSON() ([]byte, error) {
 		},
 		"images": d.Images,
 		"n_cpu":  d.NCPU,
-		"memory": strutils.FormatByteSizeWithUnit(d.MemTotal),
-	})
+		"memory": strutils.FormatByteSize(d.MemTotal),
+	}, buf)
 }

 func DockerInfo(w http.ResponseWriter, r *http.Request) {
--- a/internal/api/v1/dockerapi/logs.go
+++ b/internal/api/v1/dockerapi/logs.go
@@ -22,7 +22,7 @@ func Logs(w http.ResponseWriter, r *http.Request) {
 	until := query.Get("to")
 	levels := query.Get("levels") // TODO: implement levels

-	dockerClient, found, err := getDockerClient(w, server)
+	dockerClient, found, err := getDockerClient(server)
 	if err != nil {
 		gphttp.BadRequest(w, err.Error())
 		return
--- a/internal/api/v1/dockerapi/utils.go
+++ b/internal/api/v1/dockerapi/utils.go
@@ -2,12 +2,14 @@ package dockerapi

 import (
 	"context"
-	"encoding/json"
 	"net/http"
 	"time"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	"github.com/coder/websocket"
 	"github.com/coder/websocket/wsjson"
+	"github.com/yusing/go-proxy/agent/pkg/agent"
 	config "github.com/yusing/go-proxy/internal/config/types"
 	"github.com/yusing/go-proxy/internal/docker"
 	"github.com/yusing/go-proxy/internal/gperr"
@@ -44,7 +46,7 @@ func getDockerClients() (DockerClients, gperr.Error) {
 		dockerClients[name] = dockerClient
 	}

-	for _, agent := range cfg.ListAgents() {
+	for _, agent := range agent.Agents.Iter {
 		dockerClient, err := docker.NewClient(agent.FakeDockerHost())
 		if err != nil {
 			connErrs.Add(err)
@@ -56,7 +58,7 @@ func getDockerClients() (DockerClients, gperr.Error) {
 	return dockerClients, connErrs.Error()
 }

-func getDockerClient(w http.ResponseWriter, server string) (*docker.SharedClient, bool, error) {
+func getDockerClient(server string) (*docker.SharedClient, bool, error) {
 	cfg := config.GetInstance()
 	var host string
 	for name, h := range cfg.Value().Providers.Docker {
@@ -65,7 +67,7 @@ func getDockerClient(w http.ResponseWriter, server string) (*docker.SharedClient
 			break
 		}
 	}
-	for _, agent := range cfg.ListAgents() {
+	for _, agent := range agent.Agents.Iter {
 		if agent.Name() == server {
 			host = agent.FakeDockerHost()
 			break
@@ -119,6 +121,6 @@ func serveHTTP[V any, T ResultType[V]](w http.ResponseWriter, r *http.Request, g
 		})
 	} else {
 		result, err := getResult(r.Context(), dockerClients)
-		handleResult[V, T](w, err, result)
+		handleResult[V](w, err, result)
 	}
 }
--- a/internal/api/v1/favicon/favicon.go
+++ b/internal/api/v1/favicon/favicon.go
@@ -1,49 +1,13 @@
 package favicon

 import (
-	"bytes"
-	"context"
 	"errors"
-	"io"
 	"net/http"
-	"net/url"
-	"strings"
-	"time"

-	"github.com/PuerkitoBio/goquery"
-	"github.com/vincent-petithory/dataurl"
 	"github.com/yusing/go-proxy/internal/gperr"
 	"github.com/yusing/go-proxy/internal/homepage"
-	"github.com/yusing/go-proxy/internal/logging"
-	gphttp "github.com/yusing/go-proxy/internal/net/gphttp"
+	"github.com/yusing/go-proxy/internal/net/gphttp"
 	"github.com/yusing/go-proxy/internal/route/routes"
-	route "github.com/yusing/go-proxy/internal/route/types"
-	"github.com/yusing/go-proxy/internal/utils/strutils"
-)
-
-type fetchResult struct {
-	icon        []byte
-	contentType string
-	statusCode  int
-	errMsg      string
-}
-
-func (res *fetchResult) OK() bool {
-	return res.icon != nil
-}
-
-func (res *fetchResult) ContentType() string {
-	if res.contentType == "" {
-		if bytes.HasPrefix(res.icon, []byte("<svg")) || bytes.HasPrefix(res.icon, []byte("<?xml")) {
-			return "image/svg+xml"
-		}
-		return "image/x-icon"
-	}
-	return res.contentType
-}
-
-const (
-	MaxRedirectDepth = 5
 )

 // GetFavIcon returns the favicon of the route
@@ -72,213 +36,42 @@ func GetFavIcon(w http.ResponseWriter, req *http.Request) {
 			gphttp.ClientError(w, err, http.StatusBadRequest)
 			return
 		}
-		fetchResult := getFavIconFromURL(&iconURL)
+		fetchResult := homepage.FetchFavIconFromURL(&iconURL)
 		if !fetchResult.OK() {
-			http.Error(w, fetchResult.errMsg, fetchResult.statusCode)
+			http.Error(w, fetchResult.ErrMsg, fetchResult.StatusCode)
 			return
 		}
 		w.Header().Set("Content-Type", fetchResult.ContentType())
-		gphttp.WriteBody(w, fetchResult.icon)
+		gphttp.WriteBody(w, fetchResult.Icon)
 		return
 	}

-	// try with route.Homepage.Icon
+	// try with route.Icon
 	r, ok := routes.GetHTTPRoute(alias)
 	if !ok {
 		gphttp.ClientError(w, errors.New("no such route"), http.StatusNotFound)
 		return
 	}

-	var result *fetchResult
+	var result *homepage.FetchResult
 	hp := r.HomepageItem()
 	if hp.Icon != nil {
 		if hp.Icon.IconSource == homepage.IconSourceRelative {
-			result = findIcon(r, req, hp.Icon.Value)
+			result = homepage.FindIcon(req.Context(), r, hp.Icon.Value)
 		} else {
-			result = getFavIconFromURL(hp.Icon)
+			result = homepage.FetchFavIconFromURL(hp.Icon)
 		}
 	} else {
 		// try extract from "link[rel=icon]"
-		result = findIcon(r, req, "/")
+		result = homepage.FindIcon(req.Context(), r, "/")
 	}
-	if result.statusCode == 0 {
-		result.statusCode = http.StatusOK
+	if result.StatusCode == 0 {
+		result.StatusCode = http.StatusOK
 	}
 	if !result.OK() {
-		http.Error(w, result.errMsg, result.statusCode)
+		http.Error(w, result.ErrMsg, result.StatusCode)
 		return
 	}
 	w.Header().Set("Content-Type", result.ContentType())
-	gphttp.WriteBody(w, result.icon)
-}
-
-func getFavIconFromURL(iconURL *homepage.IconURL) *fetchResult {
-	switch iconURL.IconSource {
-	case homepage.IconSourceAbsolute:
-		return fetchIconAbsolute(iconURL.URL())
-	case homepage.IconSourceRelative:
-		return &fetchResult{statusCode: http.StatusBadRequest, errMsg: "unexpected relative icon"}
-	case homepage.IconSourceWalkXCode, homepage.IconSourceSelfhSt:
-		return fetchKnownIcon(iconURL)
-	}
-	return &fetchResult{statusCode: http.StatusBadRequest, errMsg: "invalid icon source"}
-}
-
-func fetchIconAbsolute(url string) *fetchResult {
-	if result := loadIconCache(url); result != nil {
-		return result
-	}
-
-	resp, err := gphttp.Get(url)
-	if err != nil || resp.StatusCode != http.StatusOK {
-		if err == nil {
-			err = errors.New(resp.Status)
-		}
-		logging.Error().Err(err).
-			Str("url", url).
-			Msg("failed to get icon")
-		return &fetchResult{statusCode: http.StatusBadGateway, errMsg: "connection error"}
-	}
-
-	defer resp.Body.Close()
-	icon, err := io.ReadAll(resp.Body)
-	if err != nil {
-		logging.Error().Err(err).
-			Str("url", url).
-			Msg("failed to read icon")
-		return &fetchResult{statusCode: http.StatusInternalServerError, errMsg: "internal error"}
-	}
-
-	storeIconCache(url, icon)
-	return &fetchResult{icon: icon}
-}
-
-var nameSanitizer = strings.NewReplacer(
-	"_", "-",
-	" ", "-",
-	"(", "",
-	")", "",
-)
-
-func sanitizeName(name string) string {
-	return strings.ToLower(nameSanitizer.Replace(name))
-}
-
-func fetchKnownIcon(url *homepage.IconURL) *fetchResult {
-	// if icon isn't in the list, no need to fetch
-	if !url.HasIcon() {
-		logging.Debug().
-			Str("value", url.String()).
-			Str("url", url.URL()).
-			Msg("no such icon")
-		return &fetchResult{statusCode: http.StatusNotFound, errMsg: "no such icon"}
-	}
-
-	return fetchIconAbsolute(url.URL())
-}
-
-func fetchIcon(filetype, filename string) *fetchResult {
-	result := fetchKnownIcon(homepage.NewSelfhStIconURL(filename, filetype))
-	if result.icon == nil {
-		return result
-	}
-	return fetchKnownIcon(homepage.NewWalkXCodeIconURL(filename, filetype))
-}
-
-func findIcon(r route.HTTPRoute, req *http.Request, uri string) *fetchResult {
-	key := routeKey(r)
-	if result := loadIconCache(key); result != nil {
-		return result
-	}
-
-	result := fetchIcon("png", sanitizeName(r.TargetName()))
-	cont := r.ContainerInfo()
-	if !result.OK() && cont != nil {
-		result = fetchIcon("png", sanitizeName(cont.Image.Name))
-	}
-	if !result.OK() {
-		// fallback to parse html
-		result = findIconSlow(r, req, uri, 0)
-	}
-	if result.OK() {
-		storeIconCache(key, result.icon)
-	}
-	return result
-}
-
-func findIconSlow(r route.HTTPRoute, req *http.Request, uri string, depth int) *fetchResult {
-	ctx, cancel := context.WithTimeoutCause(req.Context(), 3*time.Second, errors.New("favicon request timeout"))
-	defer cancel()
-	newReq := req.WithContext(ctx)
-	newReq.Header.Set("Accept-Encoding", "identity") // disable compression
-	u, err := url.ParseRequestURI(strutils.SanitizeURI(uri))
-	if err != nil {
-		logging.Error().Err(err).
-			Str("route", r.TargetName()).
-			Str("path", uri).
-			Msg("failed to parse uri")
-		return &fetchResult{statusCode: http.StatusInternalServerError, errMsg: "cannot parse uri"}
-	}
-	newReq.URL.Path = u.Path
-	newReq.URL.RawPath = u.RawPath
-	newReq.URL.RawQuery = u.RawQuery
-	newReq.RequestURI = u.String()
-
-	c := newContent()
-	r.ServeHTTP(c, newReq)
-	if c.status != http.StatusOK {
-		switch c.status {
-		case 0:
-			return &fetchResult{statusCode: http.StatusBadGateway, errMsg: "connection error"}
-		default:
-			if loc := c.Header().Get("Location"); loc != "" {
-				if depth > MaxRedirectDepth {
-					return &fetchResult{statusCode: http.StatusBadGateway, errMsg: "too many redirects"}
-				}
-				loc = strutils.SanitizeURI(loc)
-				if loc == "/" || loc == newReq.URL.Path {
-					return &fetchResult{statusCode: http.StatusBadGateway, errMsg: "circular redirect"}
-				}
-				return findIconSlow(r, req, loc, depth+1)
-			}
-		}
-		return &fetchResult{statusCode: c.status, errMsg: "upstream error: " + string(c.data)}
-	}
-	// return icon data
-	if !gphttp.GetContentType(c.header).IsHTML() {
-		return &fetchResult{icon: c.data, contentType: c.header.Get("Content-Type")}
-	}
-	// try extract from "link[rel=icon]" from path "/"
-	doc, err := goquery.NewDocumentFromReader(bytes.NewBuffer(c.data))
-	if err != nil {
-		logging.Error().Err(err).
-			Str("route", r.TargetName()).
-			Msg("failed to parse html")
-		return &fetchResult{statusCode: http.StatusInternalServerError, errMsg: "internal error"}
-	}
-	ele := doc.Find("head > link[rel=icon]").First()
-	if ele.Length() == 0 {
-		return &fetchResult{statusCode: http.StatusNotFound, errMsg: "icon element not found"}
-	}
-	href := ele.AttrOr("href", "")
-	if href == "" {
-		return &fetchResult{statusCode: http.StatusNotFound, errMsg: "icon href not found"}
-	}
-	// https://en.wikipedia.org/wiki/Data_URI_scheme
-	if strings.HasPrefix(href, "data:image/") {
-		dataURI, err := dataurl.DecodeString(href)
-		if err != nil {
-			logging.Error().Err(err).
-				Str("route", r.TargetName()).
-				Msg("failed to decode favicon")
-			return &fetchResult{statusCode: http.StatusInternalServerError, errMsg: "internal error"}
-		}
-		return &fetchResult{icon: dataURI.Data, contentType: dataURI.ContentType()}
-	}
-	switch {
-	case strings.HasPrefix(href, "http://"), strings.HasPrefix(href, "https://"):
-		return fetchIconAbsolute(href)
-	default:
-		return findIconSlow(r, req, href, 0)
-	}
+	gphttp.WriteBody(w, result.Icon)
 }
--- a/internal/api/v1/health.go
+++ b/internal/api/v1/health.go
@@ -4,20 +4,10 @@ import (
 	"net/http"
 	"time"

-	"github.com/coder/websocket"
-	"github.com/coder/websocket/wsjson"
-	"github.com/yusing/go-proxy/internal/net/gphttp"
 	"github.com/yusing/go-proxy/internal/net/gphttp/gpwebsocket"
-	"github.com/yusing/go-proxy/internal/net/gphttp/httpheaders"
 	"github.com/yusing/go-proxy/internal/route/routes/routequery"
 )

 func Health(w http.ResponseWriter, r *http.Request) {
-	if httpheaders.IsWebsocket(r.Header) {
-		gpwebsocket.Periodic(w, r, 1*time.Second, func(conn *websocket.Conn) error {
-			return wsjson.Write(r.Context(), conn, routequery.HealthMap())
-		})
-	} else {
-		gphttp.RespondJSON(w, r, routequery.HealthMap())
-	}
+	gpwebsocket.DynamicJSONHandler(w, r, routequery.HealthMap, 1*time.Second)
 }
--- a/internal/api/v1/homepage_overrides.go
+++ b/internal/api/v1/homepage_overrides.go
@@ -1,12 +1,12 @@
 package v1

 import (
-	"encoding/json"
 	"io"
 	"net/http"

 	"github.com/yusing/go-proxy/internal/homepage"
 	"github.com/yusing/go-proxy/internal/net/gphttp"
+	"github.com/yusing/go-proxy/pkg/json"
 )

 const (
--- a/internal/api/v1/list.go
+++ b/internal/api/v1/list.go
@@ -6,14 +6,13 @@ import (
 	"strconv"
 	"strings"

-	"github.com/yusing/go-proxy/internal"
 	"github.com/yusing/go-proxy/internal/common"
 	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/homepage"
 	"github.com/yusing/go-proxy/internal/net/gphttp"
 	"github.com/yusing/go-proxy/internal/net/gphttp/middleware"
 	"github.com/yusing/go-proxy/internal/route/routes/routequery"
 	route "github.com/yusing/go-proxy/internal/route/types"
-	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/internal/utils"
 )

@@ -28,7 +27,6 @@ const (
 	ListRouteProviders     = "route_providers"
 	ListHomepageCategories = "homepage_categories"
 	ListIcons              = "icons"
-	ListTasks              = "tasks"
 )

 func List(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
@@ -67,7 +65,7 @@ func List(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			limit = 0
 		}
-		icons, err := internal.SearchIcons(r.FormValue("keyword"), limit)
+		icons, err := homepage.SearchIcons(r.FormValue("keyword"), limit)
 		if err != nil {
 			gphttp.ClientError(w, err)
 			return
@@ -76,8 +74,6 @@ func List(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
 			icons = []string{}
 		}
 		gphttp.RespondJSON(w, r, icons)
-	case ListTasks:
-		gphttp.RespondJSON(w, r, task.DebugTaskList())
 	default:
 		gphttp.BadRequest(w, fmt.Sprintf("invalid what: %s", what))
 	}
@@ -98,7 +94,7 @@ func listRoute(which string) any {
 }

 func listFiles(w http.ResponseWriter, r *http.Request) {
-	files, err := utils.ListFiles(common.ConfigBasePath, 0, true)
+	files, err := utils.ListFiles(common.ConfigDir, 0, true)
 	if err != nil {
 		gphttp.ServerError(w, r, err)
 		return
@@ -111,17 +107,17 @@ func listFiles(w http.ResponseWriter, r *http.Request) {

 	for _, file := range files {
 		t := fileType(file)
-		file = strings.TrimPrefix(file, common.ConfigBasePath+"/")
+		file = strings.TrimPrefix(file, common.ConfigDir+"/")
 		resp[t] = append(resp[t], file)
 	}

-	mids, err := utils.ListFiles(common.MiddlewareComposeBasePath, 0, true)
+	mids, err := utils.ListFiles(common.MiddlewareComposeDir, 0, true)
 	if err != nil {
 		gphttp.ServerError(w, r, err)
 		return
 	}
 	for _, mid := range mids {
-		mid = strings.TrimPrefix(mid, common.MiddlewareComposeBasePath+"/")
+		mid = strings.TrimPrefix(mid, common.MiddlewareComposeDir+"/")
 		resp[FileTypeMiddleware] = append(resp[FileTypeMiddleware], mid)
 	}
 	gphttp.RespondJSON(w, r, resp)
--- a/internal/api/v1/new_agent.go
+++ b/internal/api/v1/new_agent.go
@@ -1,13 +1,14 @@
 package v1

 import (
-	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"os"
 	"strconv"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	_ "embed"

 	"github.com/yusing/go-proxy/agent/pkg/agent"
@@ -40,7 +41,7 @@ func NewAgent(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	hostport := fmt.Sprintf("%s:%d", host, port)
-	if _, ok := config.GetInstance().GetAgent(hostport); ok {
+	if _, ok := agent.Agents.Get(hostport); ok {
 		gphttp.ClientError(w, gphttp.ErrAlreadyExists("agent", hostport), http.StatusConflict)
 		return
 	}
--- a/internal/api/v1/query/query.go
+++ b/internal/api/v1/query/query.go
@@ -1,11 +1,12 @@
 package query

 import (
-	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	v1 "github.com/yusing/go-proxy/internal/api/v1"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/gperr"
@@ -58,7 +59,3 @@ func ListRoutes() (map[string]map[string]any, gperr.Error) {
 func ListMiddlewareTraces() (middleware.Traces, gperr.Error) {
 	return List[middleware.Traces](v1.ListMiddlewareTraces)
 }
-
-func DebugListTasks() (map[string]any, gperr.Error) {
-	return List[map[string]any](v1.ListTasks)
-}
--- a/internal/api/v1/stats.go
+++ b/internal/api/v1/stats.go
@@ -4,30 +4,18 @@ import (
 	"net/http"
 	"time"

-	"github.com/coder/websocket"
-	"github.com/coder/websocket/wsjson"
 	config "github.com/yusing/go-proxy/internal/config/types"
-	"github.com/yusing/go-proxy/internal/net/gphttp"
 	"github.com/yusing/go-proxy/internal/net/gphttp/gpwebsocket"
-	"github.com/yusing/go-proxy/internal/net/gphttp/httpheaders"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

 func Stats(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
-	if httpheaders.IsWebsocket(r.Header) {
-		gpwebsocket.Periodic(w, r, 1*time.Second, func(conn *websocket.Conn) error {
-			return wsjson.Write(r.Context(), conn, getStats(cfg))
-		})
-	} else {
-		gphttp.RespondJSON(w, r, getStats(cfg))
-	}
+	gpwebsocket.DynamicJSONHandler(w, r, func() map[string]any {
+		return map[string]any{
+			"proxies": cfg.Statistics(),
+			"uptime":  strutils.FormatDuration(time.Since(startTime)),
+		}
+	}, 1*time.Second)
 }

 var startTime = time.Now()
-
-func getStats(cfg config.ConfigInstance) map[string]any {
-	return map[string]any{
-		"proxies": cfg.Statistics(),
-		"uptime":  strutils.FormatDuration(time.Since(startTime)),
-	}
-}
--- a/internal/api/v1/system_info.go
+++ b/internal/api/v1/system_info.go
@@ -3,8 +3,8 @@ package v1
 import (
 	"net/http"

+	"github.com/yusing/go-proxy/agent/pkg/agent"
 	agentPkg "github.com/yusing/go-proxy/agent/pkg/agent"
-	config "github.com/yusing/go-proxy/internal/config/types"
 	"github.com/yusing/go-proxy/internal/gperr"
 	"github.com/yusing/go-proxy/internal/metrics/systeminfo"
 	"github.com/yusing/go-proxy/internal/net/gphttp"
@@ -12,7 +12,7 @@ import (
 	"github.com/yusing/go-proxy/internal/net/gphttp/reverseproxy"
 )

-func SystemInfo(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Request) {
+func SystemInfo(w http.ResponseWriter, r *http.Request) {
 	query := r.URL.Query()
 	agentAddr := query.Get("agent_addr")
 	query.Del("agent_addr")
@@ -21,7 +21,7 @@ func SystemInfo(cfg config.ConfigInstance, w http.ResponseWriter, r *http.Reques
 		return
 	}

-	agent, ok := cfg.GetAgent(agentAddr)
+	agent, ok := agent.Agents.Get(agentAddr)
 	if !ok {
 		gphttp.NotFound(w, "agent_addr")
 		return
--- a/internal/api/v1/version.go
+++ b/internal/api/v1/version.go
@@ -8,5 +8,5 @@ import (
 )

 func GetVersion(w http.ResponseWriter, r *http.Request) {
-	gphttp.WriteBody(w, []byte(pkg.GetVersion()))
+	gphttp.WriteBody(w, []byte(pkg.GetVersion().String()))
 }
--- a/internal/autocert/constants.go
+++ b/internal/autocert/constants.go
@@ -1,18 +1,20 @@
 package autocert

 import (
+	"path/filepath"
+
 	"github.com/go-acme/lego/v4/providers/dns/clouddns"
 	"github.com/go-acme/lego/v4/providers/dns/cloudflare"
 	"github.com/go-acme/lego/v4/providers/dns/duckdns"
 	"github.com/go-acme/lego/v4/providers/dns/ovh"
 	"github.com/go-acme/lego/v4/providers/dns/porkbun"
+	"github.com/yusing/go-proxy/internal/common"
 )

-const (
-	certBasePath       = "certs/"
-	CertFileDefault    = certBasePath + "cert.crt"
-	KeyFileDefault     = certBasePath + "priv.key"
-	ACMEKeyFileDefault = certBasePath + "acme.key"
+var (
+	CertFileDefault    = filepath.Join(common.CertsDir, "cert.crt")
+	KeyFileDefault     = filepath.Join(common.CertsDir, "priv.key")
+	ACMEKeyFileDefault = filepath.Join(common.CertsDir, "acme.key")
 )

 const (
--- a/internal/autocert/provider.go
+++ b/internal/autocert/provider.go
@@ -19,7 +19,7 @@ import (
 	"github.com/yusing/go-proxy/internal/gperr"
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/task"
-	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

@@ -329,7 +329,7 @@ func providerGenerator[CT any, PT challenge.Provider](
 ) ProviderGenerator {
 	return func(opt ProviderOpt) (challenge.Provider, gperr.Error) {
 		cfg := defaultCfg()
-		err := U.Deserialize(opt, &cfg)
+		err := utils.MapUnmarshalValidate(opt, &cfg)
 		if err != nil {
 			return nil, err
 		}
--- a/internal/autocert/provider_test/ovh_test.go
+++ b/internal/autocert/provider_test/ovh_test.go
@@ -4,9 +4,9 @@ import (
 	"testing"

 	"github.com/go-acme/lego/v4/providers/dns/ovh"
-	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/goccy/go-yaml"
+	"github.com/yusing/go-proxy/internal/utils"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
-	"gopkg.in/yaml.v3"
 )

 // type Config struct {
@@ -44,7 +44,7 @@ oauth2_config:
 	}
 	testYaml = testYaml[1:] // remove first \n
 	opt := make(map[string]any)
-	ExpectNoError(t, yaml.Unmarshal([]byte(testYaml), opt))
-	ExpectNoError(t, U.Deserialize(opt, cfg))
+	ExpectNoError(t, yaml.Unmarshal([]byte(testYaml), &opt))
+	ExpectNoError(t, utils.MapUnmarshalValidate(opt, cfg))
 	ExpectEqual(t, cfg, cfgExpected)
 }
--- a/internal/common/constants.go
+++ b/internal/common/constants.go
@@ -1,46 +1,10 @@
 package common

-import (
-	"time"
-)
-
-// file, folder structure
-
-const (
-	DotEnvPath        = ".env"
-	DotEnvExamplePath = ".env.example"
-
-	ConfigBasePath         = "config"
-	ConfigFileName         = "config.yml"
-	ConfigExampleFileName  = "config.example.yml"
-	ConfigPath             = ConfigBasePath + "/" + ConfigFileName
-	HomepageJSONConfigPath = ConfigBasePath + "/.homepage.json"
-	IconListCachePath      = ConfigBasePath + "/.icon_list_cache.json"
-	IconCachePath          = ConfigBasePath + "/.icon_cache.json"
-
-	MiddlewareComposeBasePath = ConfigBasePath + "/middlewares"
-
-	ComposeFileName        = "compose.yml"
-	ComposeExampleFileName = "compose.example.yml"
-
-	ErrorPagesBasePath = "error_pages"
-
-	AgentCertsBasePath = "certs"
-)
-
-var RequiredDirectories = []string{
-	ConfigBasePath,
-	ErrorPagesBasePath,
-	MiddlewareComposeBasePath,
-}
+import "time"

 const DockerHostFromEnv = "$DOCKER_HOST"

 const (
 	HealthCheckIntervalDefault = 5 * time.Second
 	HealthCheckTimeoutDefault  = 5 * time.Second
-
-	WakeTimeoutDefault = "30s"
-	StopTimeoutDefault = "30s"
-	StopMethodDefault  = "stop"
 )
--- a/internal/common/env.go
+++ b/internal/common/env.go
@@ -19,6 +19,10 @@ var (
 	IsDebug = GetEnvBool("DEBUG", IsTest)
 	IsTrace = GetEnvBool("TRACE", false) && IsDebug

+	RootDir = GetEnvString("ROOT_DIR", "./")
+
+	HTTP3Enabled = GetEnvBool("HTTP3_ENABLED", true)
+
 	ProxyHTTPAddr,
 	ProxyHTTPHost,
 	ProxyHTTPPort,
--- a/internal/common/paths.go
+++ b/internal/common/paths.go
@@ -0,0 +1,33 @@
+package common
+
+import (
+	"path/filepath"
+)
+
+// file, folder structure
+
+var (
+	ConfigDir             = filepath.Join(RootDir, "config")
+	ConfigFileName        = "config.yml"
+	ConfigExampleFileName = "config.example.yml"
+	ConfigPath            = filepath.Join(ConfigDir, ConfigFileName)
+
+	MiddlewareComposeDir = filepath.Join(ConfigDir, "middlewares")
+	ErrorPagesDir        = filepath.Join(RootDir, "error_pages")
+	CertsDir             = filepath.Join(RootDir, "certs")
+
+	DataDir        = filepath.Join(RootDir, "data")
+	MetricsDataDir = filepath.Join(DataDir, "metrics")
+
+	HomepageJSONConfigPath = filepath.Join(DataDir, "homepage.json")
+	IconListCachePath      = filepath.Join(DataDir, "icon_list_cache.json")
+	IconCachePath          = filepath.Join(DataDir, "icon_cache.json")
+)
+
+var RequiredDirectories = []string{
+	ConfigDir,
+	ErrorPagesDir,
+	MiddlewareComposeDir,
+	DataDir,
+	MetricsDataDir,
+}
--- a/internal/config/agent_pool.go
+++ b/internal/config/agent_pool.go
@@ -1,66 +0,0 @@
-package config
-
-import (
-	"slices"
-
-	"github.com/yusing/go-proxy/agent/pkg/agent"
-	"github.com/yusing/go-proxy/internal/gperr"
-	"github.com/yusing/go-proxy/internal/route/provider"
-	"github.com/yusing/go-proxy/internal/utils/functional"
-)
-
-var agentPool = functional.NewMapOf[string, *agent.AgentConfig]()
-
-func addAgent(agent *agent.AgentConfig) {
-	agentPool.Store(agent.Addr, agent)
-}
-
-func removeAllAgents() {
-	agentPool.Clear()
-}
-
-func GetAgent(addr string) (agent *agent.AgentConfig, ok bool) {
-	agent, ok = agentPool.Load(addr)
-	return
-}
-
-func (cfg *Config) GetAgent(agentAddrOrDockerHost string) (*agent.AgentConfig, bool) {
-	if !agent.IsDockerHostAgent(agentAddrOrDockerHost) {
-		return GetAgent(agentAddrOrDockerHost)
-	}
-	return GetAgent(agent.GetAgentAddrFromDockerHost(agentAddrOrDockerHost))
-}
-
-func (cfg *Config) VerifyNewAgent(host string, ca agent.PEMPair, client agent.PEMPair) (int, gperr.Error) {
-	if slices.ContainsFunc(cfg.value.Providers.Agents, func(a *agent.AgentConfig) bool {
-		return a.Addr == host
-	}) {
-		return 0, gperr.New("agent already exists")
-	}
-
-	var agentCfg agent.AgentConfig
-	agentCfg.Addr = host
-	err := agentCfg.StartWithCerts(cfg.Task(), ca.Cert, client.Cert, client.Key)
-	if err != nil {
-		return 0, gperr.Wrap(err, "failed to start agent")
-	}
-	addAgent(&agentCfg)
-
-	provider := provider.NewAgentProvider(&agentCfg)
-	if err := cfg.errIfExists(provider); err != nil {
-		return 0, err
-	}
-	err = provider.LoadRoutes()
-	if err != nil {
-		return 0, gperr.Wrap(err, "failed to load routes")
-	}
-	return provider.NumRoutes(), nil
-}
-
-func (cfg *Config) ListAgents() []*agent.AgentConfig {
-	agents := make([]*agent.AgentConfig, 0, agentPool.Size())
-	agentPool.RangeAll(func(key string, value *agent.AgentConfig) {
-		agents = append(agents, value)
-	})
-	return agents
-}
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -9,6 +9,7 @@ import (
 	"sync"
 	"time"

+	"github.com/yusing/go-proxy/agent/pkg/agent"
 	"github.com/yusing/go-proxy/internal/api"
 	"github.com/yusing/go-proxy/internal/autocert"
 	"github.com/yusing/go-proxy/internal/common"
@@ -18,6 +19,7 @@ import (
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/net/gphttp/server"
 	"github.com/yusing/go-proxy/internal/notif"
+	"github.com/yusing/go-proxy/internal/proxmox"
 	proxy "github.com/yusing/go-proxy/internal/route/provider"
 	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/internal/utils"
@@ -51,6 +53,8 @@ You may run "ls-config" to show or dump the current config.`

 var Validate = config.Validate

+var ErrProviderNameConflict = gperr.New("provider name conflict")
+
 func newConfig() *Config {
 	return &Config{
 		value:      config.DefaultConfig(),
@@ -80,9 +84,7 @@ func WatchChanges() {
 		t,
 		configEventFlushInterval,
 		OnConfigChange,
-		func(err gperr.Error) {
-			gperr.LogError("config reload error", err)
-		},
+		onReloadError,
 	)
 	eventQueue.Start(cfgWatcher.Events(t.Context()))
 }
@@ -105,6 +107,10 @@ func OnConfigChange(ev []events.Event) {
 	}
 }

+func onReloadError(err gperr.Error) {
+	logging.Error().Msgf("config reload error: %s", err)
+}
+
 func Reload() gperr.Error {
 	// avoid race between config change and API reload request
 	reloadMu.Lock()
@@ -210,23 +216,22 @@ func (cfg *Config) StartServers(opts ...*StartServersOptions) {
 }

 func (cfg *Config) load() gperr.Error {
-	const errMsg = "config load error"
-
 	data, err := os.ReadFile(common.ConfigPath)
 	if err != nil {
-		gperr.LogFatal(errMsg, err)
+		gperr.LogFatal("error reading config", err)
 	}

 	model := config.DefaultConfig()
-	if err := utils.DeserializeYAML(data, model); err != nil {
-		gperr.LogFatal(errMsg, err)
+	if err := utils.UnmarshalValidateYAML(data, model); err != nil {
+		gperr.LogFatal("error unmarshalling config", err)
 	}

 	// errors are non fatal below
-	errs := gperr.NewBuilder(errMsg)
+	errs := gperr.NewBuilder()
 	errs.Add(cfg.entrypoint.SetMiddlewares(model.Entrypoint.Middlewares))
 	errs.Add(cfg.entrypoint.SetAccessLogger(cfg.task, model.Entrypoint.AccessLog))
 	cfg.initNotification(model.Providers.Notification)
+	errs.Add(cfg.initProxmox(model.Providers.Proxmox))
 	errs.Add(cfg.initAutoCert(model.AutoCert))
 	errs.Add(cfg.loadRouteProviders(&model.Providers))

@@ -251,6 +256,18 @@ func (cfg *Config) initNotification(notifCfg []notif.NotificationConfig) {
 	}
 }

+func (cfg *Config) initProxmox(proxmoxCfgs []proxmox.Config) (err gperr.Error) {
+	errs := gperr.NewBuilder("proxmox config errors")
+	for _, proxmoxCfg := range proxmoxCfgs {
+		if err := proxmoxCfg.Init(); err != nil {
+			errs.Add(err.Subject(proxmoxCfg.URL))
+		} else {
+			proxmox.Clients.Add(proxmoxCfg.Client())
+		}
+	}
+	return errs.Error()
+}
+
 func (cfg *Config) initAutoCert(autocertCfg *autocert.AutocertConfig) (err gperr.Error) {
 	if cfg.autocertProvider != nil {
 		return
@@ -261,56 +278,70 @@ func (cfg *Config) initAutoCert(autocertCfg *autocert.AutocertConfig) (err gperr
 }

 func (cfg *Config) errIfExists(p *proxy.Provider) gperr.Error {
-	if _, ok := cfg.providers.Load(p.String()); ok {
-		return gperr.Errorf("provider %s already exists", p.String())
+	if conflict, ok := cfg.providers.Load(p.String()); ok {
+		return ErrProviderNameConflict.
+			Subject(p.String()).
+			Withf("one is %q", conflict.Type()).
+			Withf("the other is %q", p.Type())
 	}
 	return nil
 }

-func (cfg *Config) storeProvider(p *proxy.Provider) {
-	cfg.providers.Store(p.String(), p)
+func (cfg *Config) initAgents(agentCfgs []*agent.AgentConfig) gperr.Error {
+	var wg sync.WaitGroup
+
+	errs := gperr.NewBuilderWithConcurrency()
+	wg.Add(len(agentCfgs))
+	for _, agentCfg := range agentCfgs {
+		go func(agentCfg *agent.AgentConfig) {
+			defer wg.Done()
+			if err := agentCfg.Init(cfg.task.Context()); err != nil {
+				errs.Add(err.Subject(agentCfg.String()))
+			} else {
+				agent.Agents.Add(agentCfg)
+			}
+		}(agentCfg)
+	}
+	wg.Wait()
+	return errs.Error()
 }

 func (cfg *Config) loadRouteProviders(providers *config.Providers) gperr.Error {
 	errs := gperr.NewBuilder("route provider errors")
 	results := gperr.NewBuilder("loaded route providers")

-	removeAllAgents()
+	agent.Agents.Clear()

-	for _, agent := range providers.Agents {
-		if err := agent.Start(cfg.task); err != nil {
-			errs.Add(err.Subject(agent.String()))
+	n := len(providers.Agents) + len(providers.Docker) + len(providers.Files)
+	if n == 0 {
+		return nil
+	}
+
+	routeProviders := make([]*proxy.Provider, 0, n)
+
+	errs.Add(cfg.initAgents(providers.Agents))
+
+	for _, a := range providers.Agents {
+		if !a.IsInitialized() { // failed to initialize
 			continue
 		}
-		addAgent(agent)
-		p := proxy.NewAgentProvider(agent)
-		if err := cfg.errIfExists(p); err != nil {
-			errs.Add(err.Subject(p.String()))
-			continue
-		}
-		cfg.storeProvider(p)
+		agent.Agents.Add(a)
+		routeProviders = append(routeProviders, proxy.NewAgentProvider(a))
 	}
 	for _, filename := range providers.Files {
-		p, err := proxy.NewFileProvider(filename)
-		if err == nil {
-			err = cfg.errIfExists(p)
-		}
-		if err != nil {
-			errs.Add(gperr.PrependSubject(filename, err))
-			continue
-		}
-		cfg.storeProvider(p)
+		routeProviders = append(routeProviders, proxy.NewFileProvider(filename))
 	}
 	for name, dockerHost := range providers.Docker {
-		p := proxy.NewDockerProvider(name, dockerHost)
+		routeProviders = append(routeProviders, proxy.NewDockerProvider(name, dockerHost))
+	}
+
+	// check if all providers are unique (should not happen but just in case)
+	for _, p := range routeProviders {
 		if err := cfg.errIfExists(p); err != nil {
-			errs.Add(err.Subject(p.String()))
+			errs.Add(err)
 			continue
 		}
-		cfg.storeProvider(p)
-	}
-	if cfg.providers.Size() == 0 {
-		return nil
+		cfg.providers.Store(p.String(), p)
 	}

 	lenLongestName := 0
@@ -319,6 +350,8 @@ func (cfg *Config) loadRouteProviders(providers *config.Providers) gperr.Error {
 			lenLongestName = len(k)
 		}
 	})
+	errs.EnableConcurrency()
+	results.EnableConcurrency()
 	cfg.providers.RangeAllParallel(func(_ string, p *proxy.Provider) {
 		if err := p.LoadRoutes(); err != nil {
 			errs.Add(err.Subject(p.String()))
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -0,0 +1,202 @@
+package config
+
+import (
+	"os"
+	"path"
+	"testing"
+
+	"github.com/goccy/go-yaml"
+	"github.com/stretchr/testify/assert"
+	"github.com/yusing/go-proxy/agent/pkg/agent"
+	"github.com/yusing/go-proxy/internal/common"
+	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/route/provider"
+	"github.com/yusing/go-proxy/internal/utils"
+	. "github.com/yusing/go-proxy/internal/utils/testing"
+)
+
+func TestFileProviderValidate(t *testing.T) {
+	tests := []struct {
+		name                  string
+		filenames             []string
+		init, cleanup         func(filepath string) error
+		expectedErrorContains string
+	}{
+		{
+			name:                  "file not exists",
+			filenames:             []string{"not_exists.yaml"},
+			expectedErrorContains: "config_file_exists",
+		},
+		{
+			name:                  "file is a directory",
+			filenames:             []string{"testdata"},
+			expectedErrorContains: "config_file_exists",
+		},
+		{
+			name:                  "same file exists multiple times",
+			filenames:             []string{"test.yml", "test.yml"},
+			expectedErrorContains: "unique",
+		},
+		{
+			name:      "file ok",
+			filenames: []string{"routes.yaml"},
+			init: func(filepath string) error {
+				os.MkdirAll(path.Dir(filepath), 0755)
+				_, err := os.Create(filepath)
+				return err
+			},
+			cleanup: func(filepath string) error {
+				return os.RemoveAll(path.Dir(filepath))
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := config.DefaultConfig()
+			if tt.init != nil {
+				for _, filename := range tt.filenames {
+					filepath := path.Join(common.ConfigDir, filename)
+					assert.NoError(t, tt.init(filepath))
+				}
+			}
+			err := utils.UnmarshalValidateYAML(Must(yaml.Marshal(map[string]any{
+				"providers": map[string]any{
+					"include": tt.filenames,
+				},
+			})), cfg)
+			if tt.cleanup != nil {
+				for _, filename := range tt.filenames {
+					filepath := path.Join(common.ConfigDir, filename)
+					assert.NoError(t, tt.cleanup(filepath))
+				}
+			}
+			if tt.expectedErrorContains != "" {
+				assert.ErrorContains(t, err, tt.expectedErrorContains)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestLoadRouteProviders(t *testing.T) {
+	tests := []struct {
+		name          string
+		providers     *config.Providers
+		expectedError bool
+	}{
+		{
+			name: "duplicate file provider",
+			providers: &config.Providers{
+				Files: []string{"routes.yaml", "routes.yaml"},
+			},
+			expectedError: true,
+		},
+		{
+			name: "duplicate docker provider",
+			providers: &config.Providers{
+				Docker: map[string]string{
+					"docker1": "unix:///var/run/docker.sock",
+					"docker2": "unix:///var/run/docker.sock",
+				},
+			},
+			expectedError: true,
+		},
+		{
+			name: "docker provider with different hosts",
+			providers: &config.Providers{
+				Docker: map[string]string{
+					"docker1": "unix:///var/run/docker1.sock",
+					"docker2": "unix:///var/run/docker2.sock",
+				},
+			},
+			expectedError: false,
+		},
+		{
+			name: "duplicate agent addresses",
+			providers: &config.Providers{
+				Agents: []*agent.AgentConfig{
+					{Addr: "192.168.1.100:8080"},
+					{Addr: "192.168.1.100:8080"},
+				},
+			},
+			expectedError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := utils.Validate(tt.providers)
+			if tt.expectedError {
+				assert.ErrorContains(t, err, "unique")
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestProviderNameUniqueness(t *testing.T) {
+	file := provider.NewFileProvider("routes.yaml")
+	docker := provider.NewDockerProvider("routes", "unix:///var/run/docker.sock")
+	agent := provider.NewAgentProvider(agent.TestAgentConfig("routes", "192.168.1.100:8080"))
+
+	assert.True(t, file.String() != docker.String())
+	assert.True(t, file.String() != agent.String())
+	assert.True(t, docker.String() != agent.String())
+}
+
+func TestFileProviderNameFromFilename(t *testing.T) {
+	tests := []struct {
+		filename     string
+		expectedName string
+	}{
+		{"routes.yaml", "routes"},
+		{"service.yml", "service"},
+		{"complex-name.yaml", "complex-name"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.filename, func(t *testing.T) {
+			p := provider.NewFileProvider(tt.filename)
+			assert.Equal(t, tt.expectedName, p.ShortName())
+		})
+	}
+}
+
+func TestDockerProviderString(t *testing.T) {
+	tests := []struct {
+		name       string
+		dockerHost string
+		expected   string
+	}{
+		{"docker1", "unix:///var/run/docker.sock", "docker@docker1"},
+		{"host2", "tcp://192.168.1.100:2375", "docker@host2"},
+		{"explicit!", "unix:///var/run/docker.sock", "docker@explicit!"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p := provider.NewDockerProvider(tt.name, tt.dockerHost)
+			assert.Equal(t, tt.expected, p.String())
+		})
+	}
+}
+
+func TestExplicitOnlyProvider(t *testing.T) {
+	tests := []struct {
+		name         string
+		expectedFlag bool
+	}{
+		{"docker", false},
+		{"explicit!", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p := provider.NewDockerProvider(tt.name, "unix:///var/run/docker.sock")
+			assert.Equal(t, tt.expectedFlag, p.IsExplicitOnly())
+		})
+	}
+}
--- a/internal/config/query.go
+++ b/internal/config/query.go
@@ -1,6 +1,10 @@
 package config

 import (
+	"slices"
+
+	"github.com/yusing/go-proxy/agent/pkg/agent"
+	"github.com/yusing/go-proxy/internal/gperr"
 	"github.com/yusing/go-proxy/internal/route"
 	"github.com/yusing/go-proxy/internal/route/provider"
 )
@@ -51,3 +55,32 @@ func (cfg *Config) Statistics() map[string]any {
 		"providers":       providerStats,
 	}
 }
+
+func (cfg *Config) VerifyNewAgent(host string, ca agent.PEMPair, client agent.PEMPair) (int, gperr.Error) {
+	if slices.ContainsFunc(cfg.value.Providers.Agents, func(a *agent.AgentConfig) bool {
+		return a.Addr == host
+	}) {
+		return 0, gperr.New("agent already exists")
+	}
+
+	agentCfg := new(agent.AgentConfig)
+	agentCfg.Addr = host
+	err := agentCfg.InitWithCerts(cfg.task.Context(), ca.Cert, client.Cert, client.Key)
+	if err != nil {
+		return 0, gperr.Wrap(err, "failed to start agent")
+	}
+	// must add it first to let LoadRoutes() reference from it
+	agent.Agents.Add(agentCfg)
+
+	provider := provider.NewAgentProvider(agentCfg)
+	if err := cfg.errIfExists(provider); err != nil {
+		agent.Agents.Del(agentCfg)
+		return 0, err
+	}
+	err = provider.LoadRoutes()
+	if err != nil {
+		agent.Agents.Del(agentCfg)
+		return 0, gperr.Wrap(err, "failed to load routes")
+	}
+	return provider.NumRoutes(), nil
+}
--- a/internal/config/types/config.go
+++ b/internal/config/types/config.go
@@ -1,16 +1,20 @@
-package types
+package config

 import (
 	"context"
+	"os"
+	"path"
 	"regexp"
 	"sync"

 	"github.com/go-playground/validator/v10"
 	"github.com/yusing/go-proxy/agent/pkg/agent"
 	"github.com/yusing/go-proxy/internal/autocert"
+	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/gperr"
 	"github.com/yusing/go-proxy/internal/net/gphttp/accesslog"
 	"github.com/yusing/go-proxy/internal/notif"
+	"github.com/yusing/go-proxy/internal/proxmox"
 	"github.com/yusing/go-proxy/internal/utils"
 )

@@ -24,10 +28,11 @@ type (
 		TimeoutShutdown int                      `json:"timeout_shutdown" validate:"gte=0"`
 	}
 	Providers struct {
-		Files        []string                   `json:"include" yaml:"include,omitempty" validate:"dive,filepath"`
-		Docker       map[string]string          `json:"docker" yaml:"docker,omitempty" validate:"non_empty_docker_keys,dive,unix_addr|url"`
-		Agents       []*agent.AgentConfig       `json:"agents" yaml:"agents,omitempty"`
-		Notification []notif.NotificationConfig `json:"notification" yaml:"notification,omitempty"`
+		Files        []string                   `json:"include" validate:"unique,dive,config_file_exists"`
+		Docker       map[string]string          `json:"docker" validate:"unique,dive,unix_addr|url"`
+		Proxmox      []proxmox.Config           `json:"proxmox"`
+		Agents       []*agent.AgentConfig       `json:"agents" validate:"unique=Addr"`
+		Notification []notif.NotificationConfig `json:"notification" validate:"unique=ProviderName"`
 	}
 	Entrypoint struct {
 		Middlewares []map[string]any  `json:"middlewares"`
@@ -40,9 +45,7 @@ type (
 		Statistics() map[string]any
 		RouteProviderList() []string
 		Context() context.Context
-		GetAgent(agentAddrOrDockerHost string) (*agent.AgentConfig, bool)
 		VerifyNewAgent(host string, ca agent.PEMPair, client agent.PEMPair) (int, gperr.Error)
-		ListAgents() []*agent.AgentConfig
 		AutoCertProvider() *autocert.Provider
 	}
 )
@@ -81,7 +84,7 @@ func HasInstance() bool {

 func Validate(data []byte) gperr.Error {
 	var model Config
-	return utils.DeserializeYAML(data, &model)
+	return utils.UnmarshalValidateYAML(data, &model)
 }

 var matchDomainsRegex = regexp.MustCompile(`^[^\.]?([\w\d\-_]\.?)+[^\.]?$`)
@@ -97,13 +100,9 @@ func init() {
 		}
 		return true
 	})
-	utils.MustRegisterValidation("non_empty_docker_keys", func(fl validator.FieldLevel) bool {
-		m := fl.Field().Interface().(map[string]string)
-		for k := range m {
-			if k == "" {
-				return false
-			}
-		}
-		return true
+	utils.MustRegisterValidation("config_file_exists", func(fl validator.FieldLevel) bool {
+		filename := fl.Field().Interface().(string)
+		info, err := os.Stat(path.Join(common.ConfigDir, filename))
+		return err == nil && !info.IsDir()
 	})
 }
--- a/internal/config/types/homepage_config.go
+++ b/internal/config/types/homepage_config.go
@@ -1,4 +1,4 @@
-package types
+package config

 type HomepageConfig struct {
 	UseDefaultCategories bool `json:"use_default_categories"`
--- a/internal/docker/client.go
+++ b/internal/docker/client.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"maps"
 	"net"
 	"net/http"
 	"sync"
@@ -14,19 +15,19 @@ import (
 	"github.com/docker/docker/client"
 	"github.com/yusing/go-proxy/agent/pkg/agent"
 	"github.com/yusing/go-proxy/internal/common"
-	config "github.com/yusing/go-proxy/internal/config/types"
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

 type (
 	SharedClient struct {
 		*client.Client

-		key      string
 		refCount uint32
 		closedOn int64

+		key  string
 		addr string
 		dial func(ctx context.Context) (net.Conn, error)
 	}
@@ -66,7 +67,7 @@ func initClientCleaner() {
 		defer clientMapMu.Unlock()

 		for _, c := range clientMap {
-			delete(clientMap, c.key)
+			delete(clientMap, c.Key())
 			c.Client.Close()
 		}
 	})
@@ -80,30 +81,20 @@ func closeTimedOutClients() {

 	for _, c := range clientMap {
 		if atomic.LoadUint32(&c.refCount) == 0 && now-atomic.LoadInt64(&c.closedOn) > clientTTLSecs {
-			delete(clientMap, c.key)
+			delete(clientMap, c.Key())
 			c.Client.Close()
-			logging.Debug().Str("host", c.key).Msg("docker client closed")
+			logging.Debug().Str("host", c.DaemonHost()).Msg("docker client closed")
 		}
 	}
 }

-func (c *SharedClient) Address() string {
-	return c.addr
-}
+func Clients() map[string]*SharedClient {
+	clientMapMu.RLock()
+	defer clientMapMu.RUnlock()

-func (c *SharedClient) CheckConnection(ctx context.Context) error {
-	conn, err := c.dial(ctx)
-	if err != nil {
-		return err
-	}
-	conn.Close()
-	return nil
-}
-
-// if the client is still referenced, this is no-op.
-func (c *SharedClient) Close() {
-	atomic.StoreInt64(&c.closedOn, time.Now().Unix())
-	atomic.AddUint32(&c.refCount, ^uint32(0))
+	clients := make(map[string]*SharedClient, len(clientMap))
+	maps.Copy(clients, clientMap)
+	return clients
 }

 // NewClient creates a new Docker client connection to the specified host.
@@ -134,7 +125,7 @@ func NewClient(host string) (*SharedClient, error) {
 	var dial func(ctx context.Context) (net.Conn, error)

 	if agent.IsDockerHostAgent(host) {
-		cfg, ok := config.GetInstance().GetAgent(host)
+		cfg, ok := agent.Agents.Get(host)
 		if !ok {
 			panic(fmt.Errorf("agent %q not found", host))
 		}
@@ -187,9 +178,9 @@ func NewClient(host string) (*SharedClient, error) {

 	c := &SharedClient{
 		Client:   client,
-		key:      host,
 		refCount: 1,
 		addr:     addr,
+		key:      host,
 		dial:     dial,
 	}

@@ -197,9 +188,44 @@ func NewClient(host string) (*SharedClient, error) {
 	if c.dial == nil {
 		c.dial = client.Dialer()
 	}
+	if c.addr == "" {
+		c.addr = c.Client.DaemonHost()
+	}

 	defer logging.Debug().Str("host", host).Msg("docker client initialized")

-	clientMap[c.key] = c
+	clientMap[c.Key()] = c
 	return c, nil
 }
+
+func (c *SharedClient) Key() string {
+	return c.key
+}
+
+func (c *SharedClient) Address() string {
+	return c.addr
+}
+
+func (c *SharedClient) CheckConnection(ctx context.Context) error {
+	conn, err := c.dial(ctx)
+	if err != nil {
+		return err
+	}
+	conn.Close()
+	return nil
+}
+
+// if the client is still referenced, this is no-op.
+func (c *SharedClient) Close() {
+	atomic.StoreInt64(&c.closedOn, time.Now().Unix())
+	atomic.AddUint32(&c.refCount, ^uint32(0))
+}
+
+func (c *SharedClient) MarshalMap() map[string]any {
+	return map[string]any{
+		"host":      c.DaemonHost(),
+		"addr":      c.addr,
+		"ref_count": c.refCount,
+		"closed_on": strutils.FormatUnixTime(c.closedOn),
+	}
+}
--- a/internal/docker/container.go
+++ b/internal/docker/container.go
@@ -8,16 +8,17 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/go-connections/nat"
 	"github.com/yusing/go-proxy/agent/pkg/agent"
-	config "github.com/yusing/go-proxy/internal/config/types"
+	"github.com/yusing/go-proxy/internal/gperr"
+	idlewatcher "github.com/yusing/go-proxy/internal/idlewatcher/types"
 	"github.com/yusing/go-proxy/internal/logging"
-	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

 type (
-	PortMapping = map[int]container.Port
+	PortMapping = map[int]*container.Port
 	Container   struct {
-		_ U.NoCopy
+		_ utils.NoCopy

 		DockerHost    string          `json:"docker_host"`
 		Image         *ContainerImage `json:"image"`
@@ -26,7 +27,8 @@ type (

 		Agent *agent.AgentConfig `json:"agent"`

-		Labels map[string]string `json:"-"`
+		RouteConfig       map[string]string   `json:"route_config"`
+		IdlewatcherConfig *idlewatcher.Config `json:"idlewatcher_config"`

 		Mounts []string `json:"mounts"`

@@ -35,16 +37,10 @@ type (
 		PublicHostname     string      `json:"public_hostname"`
 		PrivateHostname    string      `json:"private_hostname"`

-		Aliases       []string `json:"aliases"`
-		IsExcluded    bool     `json:"is_excluded"`
-		IsExplicit    bool     `json:"is_explicit"`
-		IdleTimeout   string   `json:"idle_timeout,omitempty"`
-		WakeTimeout   string   `json:"wake_timeout,omitempty"`
-		StopMethod    string   `json:"stop_method,omitempty"`
-		StopTimeout   string   `json:"stop_timeout,omitempty"` // stop_method = "stop" only
-		StopSignal    string   `json:"stop_signal,omitempty"`  // stop_method = "stop" | "kill" only
-		StartEndpoint string   `json:"start_endpoint,omitempty"`
-		Running       bool     `json:"running"`
+		Aliases    []string `json:"aliases"`
+		IsExcluded bool     `json:"is_excluded"`
+		IsExplicit bool     `json:"is_explicit"`
+		Running    bool     `json:"running"`
 	}
 	ContainerImage struct {
 		Author string `json:"author,omitempty"`
@@ -58,41 +54,26 @@ var DummyContainer = new(Container)
 func FromDocker(c *container.Summary, dockerHost string) (res *Container) {
 	isExplicit := false
 	helper := containerHelper{c}
-	for lbl := range c.Labels {
-		if strings.HasPrefix(lbl, NSProxy+".") {
-			isExplicit = true
-		} else {
-			delete(c.Labels, lbl)
-		}
-	}
 	res = &Container{
 		DockerHost:    dockerHost,
 		Image:         helper.parseImage(),
 		ContainerName: helper.getName(),
 		ContainerID:   c.ID,

-		Labels: c.Labels,
-
 		Mounts: helper.getMounts(),

 		PublicPortMapping:  helper.getPublicPortMapping(),
 		PrivatePortMapping: helper.getPrivatePortMapping(),

-		Aliases:       helper.getAliases(),
-		IsExcluded:    strutils.ParseBool(helper.getDeleteLabel(LabelExclude)),
-		IsExplicit:    isExplicit,
-		IdleTimeout:   helper.getDeleteLabel(LabelIdleTimeout),
-		WakeTimeout:   helper.getDeleteLabel(LabelWakeTimeout),
-		StopMethod:    helper.getDeleteLabel(LabelStopMethod),
-		StopTimeout:   helper.getDeleteLabel(LabelStopTimeout),
-		StopSignal:    helper.getDeleteLabel(LabelStopSignal),
-		StartEndpoint: helper.getDeleteLabel(LabelStartEndpoint),
-		Running:       c.Status == "running" || c.State == "running",
+		Aliases:    helper.getAliases(),
+		IsExcluded: strutils.ParseBool(helper.getDeleteLabel(LabelExclude)),
+		IsExplicit: isExplicit,
+		Running:    c.Status == "running" || c.State == "running",
 	}

 	if agent.IsDockerHostAgent(dockerHost) {
 		var ok bool
-		res.Agent, ok = config.GetInstance().GetAgent(dockerHost)
+		res.Agent, ok = agent.Agents.Get(dockerHost)
 		if !ok {
 			logging.Error().Msgf("agent %q not found", dockerHost)
 		}
@@ -100,11 +81,21 @@ func FromDocker(c *container.Summary, dockerHost string) (res *Container) {

 	res.setPrivateHostname(helper)
 	res.setPublicHostname()
+	res.loadDeleteIdlewatcherLabels(helper)
+
+	for lbl := range c.Labels {
+		if strings.HasPrefix(lbl, NSProxy+".") {
+			isExplicit = true
+		} else {
+			delete(c.Labels, lbl)
+		}
+	}
+	res.RouteConfig = utils.FitMap(c.Labels)
 	return
 }

 func FromInspectResponse(json container.InspectResponse, dockerHost string) *Container {
-	ports := make([]container.Port, 0)
+	ports := make([]container.Port, 0, len(json.NetworkSettings.Ports))
 	for k, bindings := range json.NetworkSettings.Ports {
 		proto, privPortStr := nat.SplitProtoPort(string(k))
 		privPort, _ := strconv.ParseUint(privPortStr, 10, 16)
@@ -200,3 +191,31 @@ func (c *Container) setPrivateHostname(helper containerHelper) {
 		return
 	}
 }
+
+func (c *Container) loadDeleteIdlewatcherLabels(helper containerHelper) {
+	cfg := map[string]any{
+		"idle_timeout":   helper.getDeleteLabel(LabelIdleTimeout),
+		"wake_timeout":   helper.getDeleteLabel(LabelWakeTimeout),
+		"stop_method":    helper.getDeleteLabel(LabelStopMethod),
+		"stop_timeout":   helper.getDeleteLabel(LabelStopTimeout),
+		"stop_signal":    helper.getDeleteLabel(LabelStopSignal),
+		"start_endpoint": helper.getDeleteLabel(LabelStartEndpoint),
+	}
+	// set only if idlewatcher is enabled
+	idleTimeout := cfg["idle_timeout"]
+	if idleTimeout != "" {
+		idwCfg := &idlewatcher.Config{
+			Docker: &idlewatcher.DockerConfig{
+				DockerHost:    c.DockerHost,
+				ContainerID:   c.ContainerID,
+				ContainerName: c.ContainerName,
+			},
+		}
+		err := utils.MapUnmarshalValidate(cfg, idwCfg)
+		if err != nil {
+			gperr.LogWarn("invalid idlewatcher config", gperr.PrependSubject(c.ContainerName, err))
+		} else {
+			c.IdlewatcherConfig = idwCfg
+		}
+	}
+}
--- a/internal/docker/container_helper.go
+++ b/internal/docker/container_helper.go
@@ -4,6 +4,7 @@ import (
 	"strings"

 	"github.com/docker/docker/api/types/container"
+	"github.com/yusing/go-proxy/internal/utils"
 	"github.com/yusing/go-proxy/internal/utils/strutils"
 )

@@ -62,15 +63,15 @@ func (c containerHelper) getPublicPortMapping() PortMapping {
 		if v.PublicPort == 0 {
 			continue
 		}
-		res[int(v.PublicPort)] = v
+		res[int(v.PublicPort)] = &v
 	}
-	return res
+	return utils.FitMap(res)
 }

 func (c containerHelper) getPrivatePortMapping() PortMapping {
-	res := make(PortMapping)
+	res := make(PortMapping, len(c.Ports))
 	for _, v := range c.Ports {
-		res[int(v.PrivatePort)] = v
+		res[int(v.PrivatePort)] = &v
 	}
 	return res
 }
--- a/internal/docker/idlewatcher/container.go
+++ b/internal/docker/idlewatcher/container.go
@@ -1,60 +0,0 @@
-package idlewatcher
-
-import (
-	"context"
-	"errors"
-
-	"github.com/docker/docker/api/types/container"
-)
-
-type (
-	containerMeta struct {
-		ContainerID, ContainerName string
-	}
-	containerState struct {
-		running bool
-		ready   bool
-		err     error
-	}
-)
-
-func (w *Watcher) ContainerID() string {
-	return w.route.ContainerInfo().ContainerID
-}
-
-func (w *Watcher) ContainerName() string {
-	return w.route.ContainerInfo().ContainerName
-}
-
-func (w *Watcher) containerStop(ctx context.Context) error {
-	return w.client.ContainerStop(ctx, w.ContainerID(), container.StopOptions{
-		Signal:  string(w.Config().StopSignal),
-		Timeout: &w.Config().StopTimeout,
-	})
-}
-
-func (w *Watcher) containerPause(ctx context.Context) error {
-	return w.client.ContainerPause(ctx, w.ContainerID())
-}
-
-func (w *Watcher) containerKill(ctx context.Context) error {
-	return w.client.ContainerKill(ctx, w.ContainerID(), string(w.Config().StopSignal))
-}
-
-func (w *Watcher) containerUnpause(ctx context.Context) error {
-	return w.client.ContainerUnpause(ctx, w.ContainerID())
-}
-
-func (w *Watcher) containerStart(ctx context.Context) error {
-	return w.client.ContainerStart(ctx, w.ContainerID(), container.StartOptions{})
-}
-
-func (w *Watcher) containerStatus() (string, error) {
-	ctx, cancel := context.WithTimeoutCause(w.task.Context(), dockerReqTimeout, errors.New("docker request timeout"))
-	defer cancel()
-	json, err := w.client.ContainerInspect(ctx, w.ContainerID())
-	if err != nil {
-		return "", err
-	}
-	return json.State.Status, nil
-}
--- a/internal/docker/idlewatcher/state.go
+++ b/internal/docker/idlewatcher/state.go
@@ -1,39 +0,0 @@
-package idlewatcher
-
-func (w *Watcher) running() bool {
-	return w.state.Load().running
-}
-
-func (w *Watcher) ready() bool {
-	return w.state.Load().ready
-}
-
-func (w *Watcher) error() error {
-	return w.state.Load().err
-}
-
-func (w *Watcher) setReady() {
-	w.state.Store(&containerState{
-		running: true,
-		ready:   true,
-	})
-}
-
-func (w *Watcher) setStarting() {
-	w.state.Store(&containerState{
-		running: true,
-		ready:   false,
-	})
-}
-
-func (w *Watcher) setNapping() {
-	w.setError(nil)
-}
-
-func (w *Watcher) setError(err error) {
-	w.state.Store(&containerState{
-		running: false,
-		ready:   false,
-		err:     err,
-	})
-}
--- a/internal/docker/idlewatcher/types/config.go
+++ b/internal/docker/idlewatcher/types/config.go
@@ -1,110 +0,0 @@
-package types
-
-import (
-	"errors"
-	"net/url"
-	"strings"
-	"time"
-
-	"github.com/yusing/go-proxy/internal/docker"
-	"github.com/yusing/go-proxy/internal/gperr"
-)
-
-type (
-	Config struct {
-		IdleTimeout   time.Duration `json:"idle_timeout,omitempty"`
-		WakeTimeout   time.Duration `json:"wake_timeout,omitempty"`
-		StopTimeout   int           `json:"stop_timeout,omitempty"` // docker api takes integer seconds for timeout argument
-		StopMethod    StopMethod    `json:"stop_method,omitempty"`
-		StopSignal    Signal        `json:"stop_signal,omitempty"`
-		StartEndpoint string        `json:"start_endpoint,omitempty"` // Optional path that must be hit to start container
-	}
-	StopMethod string
-	Signal     string
-)
-
-const (
-	StopMethodPause StopMethod = "pause"
-	StopMethodStop  StopMethod = "stop"
-	StopMethodKill  StopMethod = "kill"
-)
-
-var validSignals = map[string]struct{}{
-	"":       {},
-	"SIGINT": {}, "SIGTERM": {}, "SIGHUP": {}, "SIGQUIT": {},
-	"INT": {}, "TERM": {}, "HUP": {}, "QUIT": {},
-}
-
-func ValidateConfig(cont *docker.Container) (*Config, gperr.Error) {
-	if cont == nil || cont.IdleTimeout == "" {
-		return nil, nil
-	}
-
-	errs := gperr.NewBuilder("invalid idlewatcher config")
-
-	idleTimeout := gperr.Collect(errs, validateDurationPostitive, cont.IdleTimeout)
-	wakeTimeout := gperr.Collect(errs, validateDurationPostitive, cont.WakeTimeout)
-	stopTimeout := gperr.Collect(errs, validateDurationPostitive, cont.StopTimeout)
-	stopMethod := gperr.Collect(errs, validateStopMethod, cont.StopMethod)
-	signal := gperr.Collect(errs, validateSignal, cont.StopSignal)
-	startEndpoint := gperr.Collect(errs, validateStartEndpoint, cont.StartEndpoint)
-
-	if errs.HasError() {
-		return nil, errs.Error()
-	}
-
-	return &Config{
-		IdleTimeout:   idleTimeout,
-		WakeTimeout:   wakeTimeout,
-		StopTimeout:   int(stopTimeout.Seconds()),
-		StopMethod:    stopMethod,
-		StopSignal:    signal,
-		StartEndpoint: startEndpoint,
-	}, nil
-}
-
-func validateDurationPostitive(value string) (time.Duration, error) {
-	d, err := time.ParseDuration(value)
-	if err != nil {
-		return 0, err
-	}
-	if d < 0 {
-		return 0, errors.New("duration must be positive")
-	}
-	return d, nil
-}
-
-func validateSignal(s string) (Signal, error) {
-	if _, ok := validSignals[s]; ok {
-		return Signal(s), nil
-	}
-	return "", errors.New("invalid signal " + s)
-}
-
-func validateStopMethod(s string) (StopMethod, error) {
-	sm := StopMethod(s)
-	switch sm {
-	case StopMethodPause, StopMethodStop, StopMethodKill:
-		return sm, nil
-	default:
-		return "", errors.New("invalid stop method " + s)
-	}
-}
-
-func validateStartEndpoint(s string) (string, error) {
-	if s == "" {
-		return "", nil
-	}
-	// checks needed as of Go 1.6 because of change https://github.com/golang/go/commit/617c93ce740c3c3cc28cdd1a0d712be183d0b328#diff-6c2d018290e298803c0c9419d8739885L195
-	// emulate browser and strip the '#' suffix prior to validation. see issue-#237
-	if i := strings.Index(s, "#"); i > -1 {
-		s = s[:i]
-	}
-	if len(s) == 0 {
-		return "", errors.New("start endpoint must not be empty if defined")
-	}
-	if _, err := url.ParseRequestURI(s); err != nil {
-		return "", err
-	}
-	return s, nil
-}
--- a/internal/docker/idlewatcher/waker.go
+++ b/internal/docker/idlewatcher/waker.go
@@ -1,181 +0,0 @@
-package idlewatcher
-
-import (
-	"time"
-
-	"github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
-	"github.com/yusing/go-proxy/internal/gperr"
-	"github.com/yusing/go-proxy/internal/metrics"
-	"github.com/yusing/go-proxy/internal/net/gphttp/reverseproxy"
-	net "github.com/yusing/go-proxy/internal/net/types"
-	route "github.com/yusing/go-proxy/internal/route/types"
-	"github.com/yusing/go-proxy/internal/task"
-	U "github.com/yusing/go-proxy/internal/utils"
-	"github.com/yusing/go-proxy/internal/watcher/health"
-	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
-)
-
-type (
-	Waker = types.Waker
-	waker struct {
-		_ U.NoCopy
-
-		rp     *reverseproxy.ReverseProxy
-		stream net.Stream
-		hc     health.HealthChecker
-		metric *metrics.Gauge
-	}
-)
-
-const (
-	idleWakerCheckInterval = 100 * time.Millisecond
-	idleWakerCheckTimeout  = time.Second
-)
-
-// TODO: support stream
-
-func newWaker(parent task.Parent, route route.Route, rp *reverseproxy.ReverseProxy, stream net.Stream) (Waker, gperr.Error) {
-	hcCfg := route.HealthCheckConfig()
-	hcCfg.Timeout = idleWakerCheckTimeout
-
-	waker := &waker{
-		rp:     rp,
-		stream: stream,
-	}
-	watcher, err := registerWatcher(parent, route, waker)
-	if err != nil {
-		return nil, gperr.Errorf("register watcher: %w", err)
-	}
-
-	switch {
-	case route.IsAgent():
-		waker.hc = monitor.NewAgentProxiedMonitor(route.Agent(), hcCfg, monitor.AgentTargetFromURL(route.TargetURL()))
-	case rp != nil:
-		waker.hc = monitor.NewHTTPHealthChecker(route.TargetURL(), hcCfg)
-	case stream != nil:
-		waker.hc = monitor.NewRawHealthChecker(route.TargetURL(), hcCfg)
-	default:
-		panic("both nil")
-	}
-
-	return watcher, nil
-}
-
-// lifetime should follow route provider.
-func NewHTTPWaker(parent task.Parent, route route.Route, rp *reverseproxy.ReverseProxy) (Waker, gperr.Error) {
-	return newWaker(parent, route, rp, nil)
-}
-
-func NewStreamWaker(parent task.Parent, route route.Route, stream net.Stream) (Waker, gperr.Error) {
-	return newWaker(parent, route, nil, stream)
-}
-
-// Start implements health.HealthMonitor.
-func (w *Watcher) Start(parent task.Parent) gperr.Error {
-	w.task.OnCancel("route_cleanup", func() {
-		parent.Finish(w.task.FinishCause())
-		if w.metric != nil {
-			w.metric.Reset()
-		}
-	})
-	return nil
-}
-
-// Task implements health.HealthMonitor.
-func (w *Watcher) Task() *task.Task {
-	return w.task
-}
-
-// Finish implements health.HealthMonitor.
-func (w *Watcher) Finish(reason any) {
-	if w.stream != nil {
-		w.stream.Close()
-	}
-}
-
-// Name implements health.HealthMonitor.
-func (w *Watcher) Name() string {
-	return w.String()
-}
-
-// String implements health.HealthMonitor.
-func (w *Watcher) String() string {
-	return w.ContainerName()
-}
-
-// Uptime implements health.HealthMonitor.
-func (w *Watcher) Uptime() time.Duration {
-	return 0
-}
-
-// Latency implements health.HealthMonitor.
-func (w *Watcher) Latency() time.Duration {
-	return 0
-}
-
-// Status implements health.HealthMonitor.
-func (w *Watcher) Status() health.Status {
-	state := w.state.Load()
-	if state.err != nil {
-		return health.StatusError
-	}
-	if state.ready {
-		return health.StatusHealthy
-	}
-	if state.running {
-		return health.StatusStarting
-	}
-	return health.StatusNapping
-}
-
-func (w *Watcher) checkUpdateState() (ready bool, err error) {
-	// already ready
-	if w.ready() {
-		return true, nil
-	}
-
-	if !w.running() {
-		return false, nil
-	}
-
-	if w.metric != nil {
-		defer w.metric.Set(float64(w.Status()))
-	}
-
-	// the new container info not yet updated
-	if w.hc.URL().Host == "" {
-		return false, nil
-	}
-
-	res, err := w.hc.CheckHealth()
-	if err != nil {
-		w.setError(err)
-		return false, err
-	}
-
-	if res.Healthy {
-		w.setReady()
-		return true, nil
-	}
-	w.setStarting()
-	return false, nil
-}
-
-// MarshalJSON implements health.HealthMonitor.
-func (w *Watcher) MarshalJSON() ([]byte, error) {
-	var url *net.URL
-	if w.hc.URL().Port() != "0" {
-		url = w.hc.URL()
-	}
-	var detail string
-	if err := w.error(); err != nil {
-		detail = err.Error()
-	}
-	return (&monitor.JSONRepresentation{
-		Name:   w.Name(),
-		Status: w.Status(),
-		Config: w.hc.Config(),
-		URL:    url,
-		Detail: detail,
-	}).MarshalJSON()
-}
--- a/internal/docker/idlewatcher/watcher.go
+++ b/internal/docker/idlewatcher/watcher.go
@@ -1,279 +0,0 @@
-package idlewatcher
-
-import (
-	"context"
-	"errors"
-	"sync"
-	"time"
-
-	"github.com/rs/zerolog"
-	"github.com/yusing/go-proxy/internal/docker"
-	idlewatcher "github.com/yusing/go-proxy/internal/docker/idlewatcher/types"
-	"github.com/yusing/go-proxy/internal/gperr"
-	"github.com/yusing/go-proxy/internal/logging"
-	route "github.com/yusing/go-proxy/internal/route/types"
-	"github.com/yusing/go-proxy/internal/task"
-	U "github.com/yusing/go-proxy/internal/utils"
-	"github.com/yusing/go-proxy/internal/utils/atomic"
-	"github.com/yusing/go-proxy/internal/watcher"
-	"github.com/yusing/go-proxy/internal/watcher/events"
-)
-
-type (
-	Watcher struct {
-		_ U.NoCopy
-
-		zerolog.Logger
-
-		*waker
-
-		route route.Route
-
-		client *docker.SharedClient
-		state  atomic.Value[*containerState]
-
-		stopByMethod StopCallback // send a docker command w.r.t. `stop_method`
-		ticker       *time.Ticker
-		lastReset    time.Time
-		task         *task.Task
-	}
-
-	StopCallback func() error
-)
-
-var (
-	watcherMap   = make(map[string]*Watcher)
-	watcherMapMu sync.RWMutex
-
-	errShouldNotReachHere = errors.New("should not reach here")
-)
-
-const dockerReqTimeout = 3 * time.Second
-
-func registerWatcher(parent task.Parent, route route.Route, waker *waker) (*Watcher, error) {
-	cfg := route.IdlewatcherConfig()
-	cont := route.ContainerInfo()
-	key := cont.ContainerID
-
-	watcherMapMu.Lock()
-	defer watcherMapMu.Unlock()
-	w, ok := watcherMap[key]
-	if !ok {
-		client, err := docker.NewClient(cont.DockerHost)
-		if err != nil {
-			return nil, err
-		}
-
-		w = &Watcher{
-			Logger: logging.With().Str("name", cont.ContainerName).Logger(),
-			client: client,
-			task:   parent.Subtask("idlewatcher." + cont.ContainerName),
-			ticker: time.NewTicker(cfg.IdleTimeout),
-		}
-	}
-
-	// FIXME: possible race condition here
-	w.waker = waker
-	w.route = route
-	w.ticker.Reset(cfg.IdleTimeout)
-
-	if cont.Running {
-		w.setStarting()
-	} else {
-		w.setNapping()
-	}
-
-	if !ok {
-		w.stopByMethod = w.getStopCallback()
-		watcherMap[key] = w
-
-		go func() {
-			cause := w.watchUntilDestroy()
-
-			watcherMapMu.Lock()
-			defer watcherMapMu.Unlock()
-			delete(watcherMap, key)
-
-			w.ticker.Stop()
-			w.client.Close()
-			w.task.Finish(cause)
-		}()
-	}
-
-	return w, nil
-}
-
-func (w *Watcher) Config() *idlewatcher.Config {
-	return w.route.IdlewatcherConfig()
-}
-
-func (w *Watcher) Wake() error {
-	return w.wakeIfStopped()
-}
-
-// WakeDebug logs a debug message related to waking the container.
-func (w *Watcher) WakeDebug() *zerolog.Event {
-	//nolint:zerologlint
-	return w.Debug().Str("action", "wake")
-}
-
-func (w *Watcher) WakeTrace() *zerolog.Event {
-	//nolint:zerologlint
-	return w.Trace().Str("action", "wake")
-}
-
-func (w *Watcher) WakeError(err error) {
-	w.Err(err).Str("action", "wake").Msg("error")
-}
-
-func (w *Watcher) wakeIfStopped() error {
-	if w.running() {
-		return nil
-	}
-
-	status, err := w.containerStatus()
-	if err != nil {
-		return err
-	}
-
-	ctx, cancel := context.WithTimeout(w.task.Context(), w.Config().WakeTimeout)
-	defer cancel()
-
-	// !Hard coded here since theres no constants from Docker API
-	switch status {
-	case "exited", "dead":
-		return w.containerStart(ctx)
-	case "paused":
-		return w.containerUnpause(ctx)
-	case "running":
-		return nil
-	default:
-		return gperr.Errorf("unexpected container status: %s", status)
-	}
-}
-
-func (w *Watcher) getStopCallback() StopCallback {
-	var cb func(context.Context) error
-	switch w.Config().StopMethod {
-	case idlewatcher.StopMethodPause:
-		cb = w.containerPause
-	case idlewatcher.StopMethodStop:
-		cb = w.containerStop
-	case idlewatcher.StopMethodKill:
-		cb = w.containerKill
-	default:
-		panic(errShouldNotReachHere)
-	}
-	return func() error {
-		ctx, cancel := context.WithTimeout(w.task.Context(), time.Duration(w.Config().StopTimeout)*time.Second)
-		defer cancel()
-		return cb(ctx)
-	}
-}
-
-func (w *Watcher) resetIdleTimer() {
-	w.Trace().Msg("reset idle timer")
-	w.ticker.Reset(w.Config().IdleTimeout)
-	w.lastReset = time.Now()
-}
-
-func (w *Watcher) expires() time.Time {
-	return w.lastReset.Add(w.Config().IdleTimeout)
-}
-
-func (w *Watcher) getEventCh(ctx context.Context, dockerWatcher *watcher.DockerWatcher) (eventCh <-chan events.Event, errCh <-chan gperr.Error) {
-	eventCh, errCh = dockerWatcher.EventsWithOptions(ctx, watcher.DockerListOptions{
-		Filters: watcher.NewDockerFilter(
-			watcher.DockerFilterContainer,
-			watcher.DockerFilterContainerNameID(w.route.ContainerInfo().ContainerID),
-			watcher.DockerFilterStart,
-			watcher.DockerFilterStop,
-			watcher.DockerFilterDie,
-			watcher.DockerFilterKill,
-			watcher.DockerFilterDestroy,
-			watcher.DockerFilterPause,
-			watcher.DockerFilterUnpause,
-		),
-	})
-	return
-}
-
-// watchUntilDestroy waits for the container to be created, started, or unpaused,
-// and then reset the idle timer.
-//
-// When the container is stopped, paused,
-// or killed, the idle timer is stopped and the ContainerRunning flag is set to false.
-//
-// When the idle timer fires, the container is stopped according to the
-// stop method.
-//
-// it exits only if the context is canceled, the container is destroyed,
-// errors occurred on docker client, or route provider died (mainly caused by config reload).
-func (w *Watcher) watchUntilDestroy() (returnCause error) {
-	eventCtx, eventCancel := context.WithCancel(w.task.Context())
-	defer eventCancel()
-
-	dockerWatcher := watcher.NewDockerWatcher(w.client.DaemonHost())
-	dockerEventCh, dockerEventErrCh := w.getEventCh(eventCtx, dockerWatcher)
-
-	for {
-		select {
-		case <-w.task.Context().Done():
-			return w.task.FinishCause()
-		case err := <-dockerEventErrCh:
-			if !err.Is(context.Canceled) {
-				gperr.LogError("idlewatcher error", err, &w.Logger)
-			}
-			return err
-		case e := <-dockerEventCh:
-			switch {
-			case e.Action == events.ActionContainerDestroy:
-				w.setError(errors.New("container destroyed"))
-				w.Info().Str("reason", "container destroyed").Msg("watcher stopped")
-				return errors.New("container destroyed")
-			// create / start / unpause
-			case e.Action.IsContainerWake():
-				w.setStarting()
-				w.resetIdleTimer()
-				w.Info().Msg("awaken")
-			case e.Action.IsContainerSleep(): // stop / pause / kil
-				w.setNapping()
-				w.resetIdleTimer()
-				w.ticker.Stop()
-			default:
-				w.Error().Msg("unexpected docker event: " + e.String())
-			}
-			// container name changed should also change the container id
-			// if w.ContainerName != e.ActorName {
-			// 	w.Debug().Msgf("renamed %s -> %s", w.ContainerName, e.ActorName)
-			// 	w.ContainerName = e.ActorName
-			// }
-			// if w.ContainerID != e.ActorID {
-			// 	w.Debug().Msgf("id changed %s -> %s", w.ContainerID, e.ActorID)
-			// 	w.ContainerID = e.ActorID
-			// 	// recreate event stream
-			// 	eventCancel()
-
-			// 	eventCtx, eventCancel = context.WithCancel(w.task.Context())
-			// 	defer eventCancel()
-			// 	dockerEventCh, dockerEventErrCh = w.getEventCh(eventCtx, dockerWatcher)
-			// }
-		case <-w.ticker.C:
-			w.ticker.Stop()
-			if w.running() {
-				err := w.stopByMethod()
-				switch {
-				case errors.Is(err, context.Canceled):
-					continue
-				case err != nil:
-					if errors.Is(err, context.DeadlineExceeded) {
-						err = errors.New("timeout waiting for container to stop, please set a higher value for `stop_timeout`")
-					}
-					w.Err(err).Msgf("container stop with method %q failed", w.Config().StopMethod)
-				default:
-					w.Info().Str("reason", "idle timeout").Msg("container stopped")
-				}
-			}
-		}
-	}
-}
--- a/internal/docker/inspect.go
+++ b/internal/docker/inspect.go
@@ -24,5 +24,5 @@ func (c *SharedClient) Inspect(containerID string) (*Container, error) {
 	if err != nil {
 		return nil, err
 	}
-	return FromInspectResponse(json, c.key), nil
+	return FromInspectResponse(json, c.DaemonHost()), nil
 }
--- a/internal/entrypoint/entrypoint.go
+++ b/internal/entrypoint/entrypoint.go
@@ -61,7 +61,7 @@ func (ep *Entrypoint) SetAccessLogger(parent task.Parent, cfg *accesslog.Config)
 		return
 	}

-	ep.accessLogger, err = accesslog.NewFileAccessLogger(parent, cfg)
+	ep.accessLogger, err = accesslog.NewAccessLogger(parent, cfg)
 	if err != nil {
 		return
 	}
--- a/internal/gperr/base.go
+++ b/internal/gperr/base.go
@@ -1,9 +1,10 @@
 package gperr

 import (
-	"encoding/json"
 	"errors"
 	"fmt"
+
+	"github.com/yusing/go-proxy/pkg/json"
 )

 // baseError is an immutable wrapper around an error.
@@ -48,17 +49,6 @@ func (err *baseError) Error() string {
 	return err.Err.Error()
 }

-// MarshalJSON implements the json.Marshaler interface.
-func (err *baseError) MarshalJSON() ([]byte, error) {
-	//nolint:errorlint
-	switch err := err.Err.(type) {
-	case Error, *withSubject:
-		return json.Marshal(err)
-	case json.Marshaler:
-		return err.MarshalJSON()
-	case interface{ MarshalText() ([]byte, error) }:
-		return err.MarshalText()
-	default:
-		return json.Marshal(err.Error())
-	}
+func (err *baseError) MarshalJSONTo(buf []byte) []byte {
+	return json.MarshalTo(err.Err, buf)
 }
--- a/internal/gperr/builder.go
+++ b/internal/gperr/builder.go
@@ -5,44 +5,69 @@ import (
 	"sync"
 )

+type noLock struct{}
+
+func (noLock) Lock()    {}
+func (noLock) Unlock()  {}
+func (noLock) RLock()   {}
+func (noLock) RUnlock() {}
+
+type rwLock interface {
+	sync.Locker
+	RLock()
+	RUnlock()
+}
+
 type Builder struct {
 	about string
 	errs  []error
-	sync.Mutex
+	rwLock
 }

-func NewBuilder(about string) *Builder {
-	return &Builder{about: about}
+type multiline struct {
+	*Builder
+}
+
+// NewBuilder creates a new Builder.
+//
+// If about is not provided, the Builder will not have a subject
+// and will expand when adding to another builder.
+func NewBuilder(about ...string) *Builder {
+	if len(about) == 0 {
+		return &Builder{rwLock: noLock{}}
+	}
+	return &Builder{about: about[0], rwLock: noLock{}}
+}
+
+func NewBuilderWithConcurrency(about ...string) *Builder {
+	if len(about) == 0 {
+		return &Builder{rwLock: new(sync.RWMutex)}
+	}
+	return &Builder{about: about[0], rwLock: new(sync.RWMutex)}
+}
+
+func (b *Builder) EnableConcurrency() {
+	b.rwLock = new(sync.RWMutex)
 }

 func (b *Builder) About() string {
-	if !b.HasError() {
-		return ""
-	}
 	return b.about
 }

-//go:inline
 func (b *Builder) HasError() bool {
+	// no need to lock, when this is called, the Builder is not used anymore
 	return len(b.errs) > 0
 }

-func (b *Builder) error() Error {
-	if !b.HasError() {
+func (b *Builder) Error() Error {
+	if len(b.errs) == 0 {
 		return nil
 	}
 	return &nestedError{Err: New(b.about), Extras: b.errs}
 }

-func (b *Builder) Error() Error {
-	if len(b.errs) == 1 {
-		return wrap(b.errs[0])
-	}
-	return b.error()
-}
-
 func (b *Builder) String() string {
-	err := b.error()
+	err := b.Error()
 	if err == nil {
 		return ""
 	}
@@ -60,7 +85,12 @@ func (b *Builder) Add(err error) *Builder {
 	b.Lock()
 	defer b.Unlock()

-	switch err := wrap(err).(type) {
+	b.add(err)
+	return b
+}
+
+func (b *Builder) add(err error) {
+	switch err := err.(type) {
 	case *baseError:
 		b.errs = append(b.errs, err.Err)
 	case *nestedError:
@@ -69,11 +99,11 @@ func (b *Builder) Add(err error) *Builder {
 		} else {
 			b.errs = append(b.errs, err)
 		}
+	case *MultilineError:
+		b.add(&err.nestedError)
 	default:
-		panic("bug: should not reach here")
+		b.errs = append(b.errs, err)
 	}
-
-	return b
 }

 func (b *Builder) Adds(err string) *Builder {
@@ -105,26 +135,34 @@ func (b *Builder) AddFrom(other *Builder, flatten bool) *Builder {
 	if flatten {
 		b.errs = append(b.errs, other.errs...)
 	} else {
-		b.errs = append(b.errs, other.error())
+		b.errs = append(b.errs, other.Error())
 	}
 	return b
 }

 func (b *Builder) AddRange(errs ...error) *Builder {
-	b.Lock()
-	defer b.Unlock()
-
+	nonNilErrs := make([]error, 0, len(errs))
 	for _, err := range errs {
 		if err != nil {
-			b.errs = append(b.errs, err)
+			nonNilErrs = append(nonNilErrs, err)
 		}
 	}

+	b.Lock()
+	defer b.Unlock()
+
+	for _, err := range nonNilErrs {
+		b.add(err)
+	}
 	return b
 }

 func (b *Builder) ForEach(fn func(error)) {
-	for _, err := range b.errs {
+	b.RLock()
+	errs := b.errs
+	b.RUnlock()
+
+	for _, err := range errs {
 		fn(err)
 	}
 }
--- a/internal/gperr/error_test.go
+++ b/internal/gperr/error_test.go
@@ -5,6 +5,7 @@ import (
 	"strings"
 	"testing"

+	"github.com/yusing/go-proxy/internal/utils/strutils/ansi"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
 )

@@ -18,11 +19,11 @@ func TestBaseWithSubject(t *testing.T) {
 	withSubjectf := err.Subjectf("%s %s", "foo", "bar")

 	ExpectError(t, err, withSubject)
-	ExpectEqual(t, withSubject.Error(), "foo: error")
+	ExpectEqual(t, ansi.StripANSI(withSubject.Error()), "foo: error")
 	ExpectTrue(t, withSubject.Is(err))

 	ExpectError(t, err, withSubjectf)
-	ExpectEqual(t, withSubjectf.Error(), "foo bar: error")
+	ExpectEqual(t, ansi.StripANSI(withSubjectf.Error()), "foo bar: error")
 	ExpectTrue(t, withSubjectf.Is(err))
 }

@@ -114,9 +115,9 @@ func TestErrorWith(t *testing.T) {
 func TestErrorStringSimple(t *testing.T) {
 	errFailure := New("generic failure")
 	ne := errFailure.Subject("foo bar")
-	ExpectEqual(t, ne.Error(), "foo bar: generic failure")
+	ExpectEqual(t, ansi.StripANSI(ne.Error()), "foo bar: generic failure")
 	ne = ne.Subject("baz")
-	ExpectEqual(t, ne.Error(), "baz > foo bar: generic failure")
+	ExpectEqual(t, ansi.StripANSI(ne.Error()), "baz > foo bar: generic failure")
 }

 func TestErrorStringNested(t *testing.T) {
@@ -153,5 +154,5 @@ func TestErrorStringNested(t *testing.T) {
      • action 3 > inner3: generic failure
        • 3
        • 3`
-	ExpectEqual(t, ne.Error(), want)
+	ExpectEqual(t, ansi.StripANSI(ne.Error()), want)
 }
--- a/internal/gperr/log.go
+++ b/internal/gperr/log.go
@@ -6,14 +6,14 @@ import (
 	"github.com/yusing/go-proxy/internal/logging"
 )

-func log(msg string, err error, level zerolog.Level, logger ...*zerolog.Logger) {
+func log(_ string, err error, level zerolog.Level, logger ...*zerolog.Logger) {
 	var l *zerolog.Logger
 	if len(logger) > 0 {
 		l = logger[0]
 	} else {
 		l = logging.GetLogger()
 	}
-	l.WithLevel(level).Msg(msg + ": " + err.Error())
+	l.WithLevel(level).Msg(err.Error())
 }

 func LogFatal(msg string, err error, logger ...*zerolog.Logger) {
--- a/internal/gperr/multiline.go
+++ b/internal/gperr/multiline.go
@@ -0,0 +1,45 @@
+package gperr
+
+import (
+	"fmt"
+	"reflect"
+)
+
+type MultilineError struct {
+	nestedError
+}
+
+func Multiline() *MultilineError {
+	return &MultilineError{}
+}
+
+func (m *MultilineError) add(err error) {
+	m.Extras = append(m.Extras, err)
+}
+
+func (m *MultilineError) Addf(format string, args ...any) *MultilineError {
+	m.add(fmt.Errorf(format, args...))
+	return m
+}
+
+func (m *MultilineError) Adds(s string) *MultilineError {
+	m.add(newError(s))
+	return m
+}
+
+func (m *MultilineError) AddLines(lines any) *MultilineError {
+	v := reflect.ValueOf(lines)
+	if v.Kind() == reflect.Slice {
+		for i := range v.Len() {
+			switch v := v.Index(i).Interface().(type) {
+			case string:
+				m.add(newError(v))
+			case error:
+				m.add(v)
+			default:
+				m.add(fmt.Errorf("%v", v))
+			}
+		}
+	}
+	return m
+}
--- a/internal/gperr/multiline_test.go
+++ b/internal/gperr/multiline_test.go
@@ -0,0 +1,38 @@
+package gperr
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMultiline(t *testing.T) {
+	multiline := Multiline()
+	multiline.Addf("line 1 %s", "test")
+	multiline.Adds("line 2")
+	multiline.AddLines([]any{1, "2", 3.0, net.IPv4(127, 0, 0, 1)})
+	t.Error(New("result").With(multiline))
+	t.Error(multiline.Subject("subject").Withf("inner"))
+}
+
+func TestWrapMultiline(t *testing.T) {
+	multiline := Multiline()
+	var wrapper error = wrap(multiline)
+	_, ok := wrapper.(*MultilineError)
+	if !ok {
+		t.Errorf("wrapper is not a MultilineError")
+	}
+}
+
+func TestPrependSubjectMultiline(t *testing.T) {
+	multiline := Multiline()
+	multiline.Addf("line 1 %s", "test")
+	multiline.Adds("line 2")
+	multiline.AddLines([]any{1, "2", 3.0, net.IPv4(127, 0, 0, 1)})
+	multiline.Subject("subject")
+
+	builder := NewBuilder()
+	builder.Add(multiline)
+	require.Equal(t, len(builder.errs), len(multiline.Extras), builder.errs)
+}
--- a/internal/gperr/nested_error.go
+++ b/internal/gperr/nested_error.go
@@ -15,7 +15,7 @@ type nestedError struct {

 func (err nestedError) Subject(subject string) Error {
 	if err.Err == nil {
-		err.Err = newError(subject)
+		err.Err = PrependSubject(subject, errStr(""))
 	} else {
 		err.Err = PrependSubject(subject, err.Err)
 	}
@@ -72,14 +72,13 @@ func (err *nestedError) Error() string {
 		return makeLine("<nil>", 0)
 	}

-	lines := make([]string, 0, 1+len(err.Extras))
 	if err.Err != nil {
+		lines := make([]string, 0, 1+len(err.Extras))
 		lines = append(lines, makeLine(err.Err.Error(), 0))
 		lines = append(lines, makeLines(err.Extras, 1)...)
-	} else {
-		lines = append(lines, makeLines(err.Extras, 0)...)
+		return strutils.JoinLines(lines)
 	}
-	return strutils.JoinLines(lines)
+	return strutils.JoinLines(makeLines(err.Extras, 0))
 }

 //go:inline
@@ -103,8 +102,10 @@ func makeLines(errs []error, level int) []string {
 		case *nestedError:
 			if err.Err != nil {
 				lines = append(lines, makeLine(err.Err.Error(), level))
+				lines = append(lines, makeLines(err.Extras, level+1)...)
+			} else {
+				lines = append(lines, makeLines(err.Extras, level)...)
 			}
-			lines = append(lines, makeLines(err.Extras, level+1)...)
 		default:
 			lines = append(lines, makeLine(err.Error(), level))
 		}
--- a/internal/gperr/subject.go
+++ b/internal/gperr/subject.go
@@ -1,9 +1,11 @@
 package gperr

 import (
-	"encoding/json"
+	"errors"
+	"slices"
 	"strings"

+	"github.com/yusing/go-proxy/pkg/json"
 	"github.com/yusing/go-proxy/internal/utils/strutils/ansi"
 )

@@ -26,6 +28,10 @@ func PrependSubject(subject string, err error) error {
 		return nil
 	}

+	if subject == "" {
+		return err
+	}
+
 	//nolint:errorlint
 	switch err := err.(type) {
 	case *withSubject:
@@ -59,7 +65,7 @@ func (err *withSubject) Prepend(subject string) *withSubject {
 }

 func (err *withSubject) Is(other error) bool {
-	return err.Err == other
+	return errors.Is(other, err.Err)
 }

 func (err *withSubject) Unwrap() error {
@@ -87,19 +93,13 @@ func (err *withSubject) Error() string {
 	return sb.String()
 }

-// MarshalJSON implements the json.Marshaler interface.
-func (err *withSubject) MarshalJSON() ([]byte, error) {
-	subjects := make([]string, len(err.Subjects))
-	for i, s := range err.Subjects {
-		subjects[len(err.Subjects)-i-1] = s
-	}
-	reversed := struct {
-		Subjects []string `json:"subjects"`
-		Err      error    `json:"err"`
-	}{
-		Subjects: subjects,
-		Err:      err.Err,
-	}
+func (err *withSubject) MarshalJSONTo(buf []byte) []byte {
+	subjects := slices.Clone(err.Subjects)
+	slices.Reverse(subjects)

-	return json.Marshal(reversed)
+	reversed := map[string]any{
+		"subjects": subjects,
+		"err":      err.Err,
+	}
+	return json.MarshalTo(reversed, buf)
 }
--- a/internal/gperr/utils.go
+++ b/internal/gperr/utils.go
@@ -1,9 +1,10 @@
 package gperr

 import (
-	"encoding/json"
 	"errors"
 	"fmt"
+
+	stdJSON "encoding/json"
 )

 func newError(message string) error {
@@ -41,6 +42,18 @@ func Wrap(err error, message ...string) Error {
 	return &baseError{fmt.Errorf("%s: %w", message[0], err)}
 }

+func Unwrap(err error) Error {
+	//nolint:errorlint
+	switch err := err.(type) {
+	case interface{ Unwrap() []error }:
+		return &nestedError{Extras: err.Unwrap()}
+	case interface{ Unwrap() error }:
+		return &baseError{err.Unwrap()}
+	default:
+		return &baseError{err}
+	}
+}
+
 func wrap(err error) Error {
 	if err == nil {
 		return nil
@@ -60,7 +73,7 @@ func IsJSONMarshallable(err error) bool {
 	case *baseError:
 		return IsJSONMarshallable(err.Err)
 	default:
-		var v json.Marshaler
+		var v stdJSON.Marshaler
 		return errors.As(err, &v)
 	}
 }
--- a/internal/api/v1/favicon/content.go
+++ b/internal/api/v1/favicon/content.go
@@ -1,4 +1,4 @@
-package favicon
+package homepage

 import (
 	"bufio"
--- a/internal/homepage/favicon.go
+++ b/internal/homepage/favicon.go
@@ -0,0 +1,195 @@
+package homepage
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/PuerkitoBio/goquery"
+	"github.com/vincent-petithory/dataurl"
+	gphttp "github.com/yusing/go-proxy/internal/net/gphttp"
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type FetchResult struct {
+	Icon       []byte
+	StatusCode int
+	ErrMsg     string
+
+	contentType string
+}
+
+func (res *FetchResult) OK() bool {
+	return res.Icon != nil
+}
+
+func (res *FetchResult) ContentType() string {
+	if res.contentType == "" {
+		if bytes.HasPrefix(res.Icon, []byte("<svg")) || bytes.HasPrefix(res.Icon, []byte("<?xml")) {
+			return "image/svg+xml"
+		}
+		return "image/x-icon"
+	}
+	return res.contentType
+}
+
+const maxRedirectDepth = 5
+
+func FetchFavIconFromURL(iconURL *IconURL) *FetchResult {
+	switch iconURL.IconSource {
+	case IconSourceAbsolute:
+		return fetchIconAbsolute(iconURL.URL())
+	case IconSourceRelative:
+		return &FetchResult{StatusCode: http.StatusBadRequest, ErrMsg: "unexpected relative icon"}
+	case IconSourceWalkXCode, IconSourceSelfhSt:
+		return fetchKnownIcon(iconURL)
+	}
+	return &FetchResult{StatusCode: http.StatusBadRequest, ErrMsg: "invalid icon source"}
+}
+
+func fetchIconAbsolute(url string) *FetchResult {
+	if result := loadIconCache(url); result != nil {
+		return result
+	}
+
+	resp, err := gphttp.Get(url)
+	if err != nil || resp.StatusCode != http.StatusOK {
+		if err == nil {
+			err = errors.New(resp.Status)
+		}
+		return &FetchResult{StatusCode: http.StatusBadGateway, ErrMsg: "connection error"}
+	}
+
+	defer resp.Body.Close()
+	icon, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return &FetchResult{StatusCode: http.StatusInternalServerError, ErrMsg: "internal error"}
+	}
+
+	storeIconCache(url, icon)
+	return &FetchResult{Icon: icon}
+}
+
+var nameSanitizer = strings.NewReplacer(
+	"_", "-",
+	" ", "-",
+	"(", "",
+	")", "",
+)
+
+func sanitizeName(name string) string {
+	return strings.ToLower(nameSanitizer.Replace(name))
+}
+
+func fetchKnownIcon(url *IconURL) *FetchResult {
+	// if icon isn't in the list, no need to fetch
+	if !url.HasIcon() {
+		return &FetchResult{StatusCode: http.StatusNotFound, ErrMsg: "no such icon"}
+	}
+
+	return fetchIconAbsolute(url.URL())
+}
+
+func fetchIcon(filetype, filename string) *FetchResult {
+	result := fetchKnownIcon(NewSelfhStIconURL(filename, filetype))
+	if result.Icon == nil {
+		return result
+	}
+	return fetchKnownIcon(NewWalkXCodeIconURL(filename, filetype))
+}
+
+func FindIcon(ctx context.Context, r route, uri string) *FetchResult {
+	key := routeKey(r)
+	if result := loadIconCache(key); result != nil {
+		return result
+	}
+
+	result := fetchIcon("png", sanitizeName(r.Reference()))
+	if !result.OK() {
+		if r, ok := r.(httpRoute); ok {
+			// fallback to parse html
+			result = findIconSlow(ctx, r, uri, 0)
+		}
+	}
+	if result.OK() {
+		storeIconCache(key, result.Icon)
+	}
+	return result
+}
+
+func findIconSlow(ctx context.Context, r httpRoute, uri string, depth int) *FetchResult {
+	ctx, cancel := context.WithTimeoutCause(ctx, 3*time.Second, errors.New("favicon request timeout"))
+	defer cancel()
+
+	newReq, err := http.NewRequestWithContext(ctx, "GET", r.TargetURL().String(), nil)
+	if err != nil {
+		return &FetchResult{StatusCode: http.StatusInternalServerError, ErrMsg: "cannot create request"}
+	}
+	newReq.Header.Set("Accept-Encoding", "identity") // disable compression
+
+	u, err := url.ParseRequestURI(strutils.SanitizeURI(uri))
+	if err != nil {
+		return &FetchResult{StatusCode: http.StatusInternalServerError, ErrMsg: "cannot parse uri"}
+	}
+	newReq.URL.Path = u.Path
+	newReq.URL.RawPath = u.RawPath
+	newReq.URL.RawQuery = u.RawQuery
+	newReq.RequestURI = u.String()
+
+	c := newContent()
+	r.ServeHTTP(c, newReq)
+	if c.status != http.StatusOK {
+		switch c.status {
+		case 0:
+			return &FetchResult{StatusCode: http.StatusBadGateway, ErrMsg: "connection error"}
+		default:
+			if loc := c.Header().Get("Location"); loc != "" {
+				if depth > maxRedirectDepth {
+					return &FetchResult{StatusCode: http.StatusBadGateway, ErrMsg: "too many redirects"}
+				}
+				loc = strutils.SanitizeURI(loc)
+				if loc == "/" || loc == newReq.URL.Path {
+					return &FetchResult{StatusCode: http.StatusBadGateway, ErrMsg: "circular redirect"}
+				}
+				return findIconSlow(ctx, r, loc, depth+1)
+			}
+		}
+		return &FetchResult{StatusCode: c.status, ErrMsg: "upstream error: " + string(c.data)}
+	}
+	// return icon data
+	if !gphttp.GetContentType(c.header).IsHTML() {
+		return &FetchResult{Icon: c.data, contentType: c.header.Get("Content-Type")}
+	}
+	// try extract from "link[rel=icon]" from path "/"
+	doc, err := goquery.NewDocumentFromReader(bytes.NewBuffer(c.data))
+	if err != nil {
+		return &FetchResult{StatusCode: http.StatusInternalServerError, ErrMsg: "failed to parse html"}
+	}
+	ele := doc.Find("head > link[rel=icon]").First()
+	if ele.Length() == 0 {
+		return &FetchResult{StatusCode: http.StatusNotFound, ErrMsg: "icon element not found"}
+	}
+	href := ele.AttrOr("href", "")
+	if href == "" {
+		return &FetchResult{StatusCode: http.StatusNotFound, ErrMsg: "icon href not found"}
+	}
+	// https://en.wikipedia.org/wiki/Data_URI_scheme
+	if strings.HasPrefix(href, "data:image/") {
+		dataURI, err := dataurl.DecodeString(href)
+		if err != nil {
+			return &FetchResult{StatusCode: http.StatusInternalServerError, ErrMsg: "failed to decode favicon"}
+		}
+		return &FetchResult{Icon: dataURI.Data, contentType: dataURI.ContentType()}
+	}
+	switch {
+	case strings.HasPrefix(href, "http://"), strings.HasPrefix(href, "https://"):
+		return fetchIconAbsolute(href)
+	default:
+		return findIconSlow(ctx, r, href, 0)
+	}
+}
--- a/internal/homepage/homepage.go
+++ b/internal/homepage/homepage.go
@@ -1,9 +1,10 @@
 package homepage

 import (
-	"encoding/json"
 	"strings"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	config "github.com/yusing/go-proxy/internal/config/types"
 	"github.com/yusing/go-proxy/internal/utils"
 )
@@ -42,7 +43,7 @@ func (cfg *ItemConfig) GetOverride(alias string) *ItemConfig {
 	return overrideConfigInstance.GetOverride(alias, cfg)
 }

-func (item *Item) MarshalJSON() ([]byte, error) {
+func (item *Item) MarshalJSONTo(buf []byte) []byte {
 	var url *string
 	if !strings.ContainsRune(item.Alias, '.') {
 		godoxyCfg := config.GetInstance().Value()
@@ -55,7 +56,7 @@ func (item *Item) MarshalJSON() ([]byte, error) {
 	} else {
 		url = &item.Alias
 	}
-	return json.Marshal(map[string]any{
+	return json.MarshalTo(map[string]any{
 		"show":          item.Show,
 		"alias":         item.Alias,
 		"provider":      item.Provider,
@@ -66,7 +67,7 @@ func (item *Item) MarshalJSON() ([]byte, error) {
 		"description":   item.Description,
 		"sort_order":    item.SortOrder,
 		"widget_config": item.WidgetConfig,
-	})
+	}, buf)
 }

 func (c Homepage) Add(item *Item) {
--- a/internal/api/v1/favicon/cache.go
+++ b/internal/api/v1/favicon/cache.go
@@ -1,13 +1,13 @@
-package favicon
+package homepage

 import (
-	"encoding/json"
 	"sync"
 	"time"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/logging"
-	route "github.com/yusing/go-proxy/internal/route/types"
 	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/internal/utils"
 )
@@ -82,17 +82,17 @@ func pruneExpiredIconCache() {
 	}
 }

-func routeKey(r route.HTTPRoute) string {
+func routeKey(r route) string {
 	return r.ProviderName() + ":" + r.TargetName()
 }

-func PruneRouteIconCache(route route.HTTPRoute) {
+func PruneRouteIconCache(route route) {
 	iconCacheMu.Lock()
 	defer iconCacheMu.Unlock()
 	delete(iconCache, routeKey(route))
 }

-func loadIconCache(key string) *fetchResult {
+func loadIconCache(key string) *FetchResult {
 	iconCacheMu.RLock()
 	defer iconCacheMu.RUnlock()

@@ -102,7 +102,7 @@ func loadIconCache(key string) *fetchResult {
 			Str("key", key).
 			Msg("icon found in cache")
 		icon.LastAccess = time.Now()
-		return &fetchResult{icon: icon.Icon}
+		return &FetchResult{Icon: icon.Icon}
 	}
 	return nil
 }
--- a/internal/homepage/icon_url.go
+++ b/internal/homepage/icon_url.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"strings"

-	"github.com/yusing/go-proxy/internal"
 	"github.com/yusing/go-proxy/internal/gperr"
 )

@@ -62,10 +61,10 @@ func NewWalkXCodeIconURL(name, format string) *IconURL {
 // otherwise returns true.
 func (u *IconURL) HasIcon() bool {
 	if u.IconSource == IconSourceSelfhSt {
-		return internal.HasSelfhstIcon(u.Extra.Name, u.Extra.FileType)
+		return HasSelfhstIcon(u.Extra.Name, u.Extra.FileType)
 	}
 	if u.IconSource == IconSourceWalkXCode {
-		return internal.HasWalkxCodeIcon(u.Extra.Name, u.Extra.FileType)
+		return HasWalkxCodeIcon(u.Extra.Name, u.Extra.FileType)
 	}
 	return true
 }
--- a/internal/homepage/list-icons.go
+++ b/internal/homepage/list-icons.go
@@ -1,12 +1,13 @@
-package internal
+package homepage

 import (
-	"encoding/json"
 	"io"
 	"net/http"
 	"sync"
 	"time"

+	"github.com/yusing/go-proxy/pkg/json"
+
 	"github.com/lithammer/fuzzysearch/fuzzy"
 	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/logging"
@@ -59,15 +60,15 @@ func InitIconListCache() {
 		DisplayNames: make(ReferenceDisplayNameMap),
 		IconList:     []string{},
 	}
-	err := utils.LoadJSONIfExist(common.IconListCachePath, iconsCache)
-	if err != nil {
-		logging.Error().Err(err).Msg("failed to load icon list cache config")
-	} else if len(iconsCache.IconList) > 0 {
-		logging.Info().
-			Int("icons", len(iconsCache.IconList)).
-			Int("display_names", len(iconsCache.DisplayNames)).
-			Msg("icon list cache loaded")
-	}
+	// err := utils.LoadJSONIfExist(common.IconListCachePath, iconsCache)
+	// if err != nil {
+	// 	logging.Error().Err(err).Msg("failed to load icon list cache config")
+	// } else if len(iconsCache.IconList) > 0 {
+	// 	logging.Info().
+	// 		Int("icons", len(iconsCache.IconList)).
+	// 		Int("display_names", len(iconsCache.DisplayNames)).
+	// 		Msg("icon list cache loaded")
+	// }
 }

 func ListAvailableIcons() (*Cache, error) {
--- a/internal/homepage/route.go
+++ b/internal/homepage/route.go
@@ -0,0 +1,18 @@
+package homepage
+
+import (
+	"net/http"
+	"net/url"
+)
+
+type route interface {
+	TargetName() string
+	ProviderName() string
+	Reference() string
+	TargetURL() *url.URL
+}
+
+type httpRoute interface {
+	route
+	http.Handler
+}
--- a/internal/idlewatcher/common.go
+++ b/internal/idlewatcher/common.go
@@ -0,0 +1,13 @@
+package idlewatcher
+
+import "context"
+
+func (w *Watcher) cancelled(reqCtx context.Context) bool {
+	select {
+	case <-reqCtx.Done():
+		w.l.Debug().AnErr("cause", context.Cause(reqCtx)).Msg("wake canceled")
+		return true
+	default:
+		return false
+	}
+}
--- a/internal/idlewatcher/debug.go
+++ b/internal/idlewatcher/debug.go
@@ -0,0 +1,40 @@
+package idlewatcher
+
+import (
+	"iter"
+	"strconv"
+
+	"github.com/yusing/go-proxy/internal/utils/strutils"
+)
+
+type watcherDebug struct {
+	*Watcher
+}
+
+func (w watcherDebug) MarshalMap() map[string]any {
+	state := w.state.Load()
+	return map[string]any{
+		"name": w.Name(),
+		"state": map[string]string{
+			"status": string(state.status),
+			"ready":  strconv.FormatBool(state.ready),
+			"err":    fmtErr(state.err),
+		},
+		"expires":    strutils.FormatTime(w.expires()),
+		"last_reset": strutils.FormatTime(w.lastReset.Load()),
+		"config":     w.cfg,
+	}
+}
+
+func Watchers() iter.Seq2[string, watcherDebug] {
+	return func(yield func(string, watcherDebug) bool) {
+		watcherMapMu.RLock()
+		defer watcherMapMu.RUnlock()
+
+		for k, w := range watcherMap {
+			if !yield(k, watcherDebug{w}) {
+				return
+			}
+		}
+	}
+}
--- a/internal/docker/idlewatcher/waker_http.go
+++ b/internal/docker/idlewatcher/waker_http.go
@@ -42,20 +42,6 @@ func (w *Watcher) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
 	}
 }

-func (w *Watcher) cancelled(reqCtx context.Context, rw http.ResponseWriter) bool {
-	select {
-	case <-reqCtx.Done():
-		w.WakeDebug().Str("cause", context.Cause(reqCtx).Error()).Msg("canceled")
-		return true
-	case <-w.task.Context().Done():
-		w.WakeDebug().Str("cause", w.task.FinishCause().Error()).Msg("canceled")
-		http.Error(rw, "Service unavailable", http.StatusServiceUnavailable)
-		return true
-	default:
-		return false
-	}
-}
-
 func isFaviconPath(path string) bool {
 	return path == "/favicon.ico"
 }
@@ -70,13 +56,13 @@ func (w *Watcher) wakeFromHTTP(rw http.ResponseWriter, r *http.Request) (shouldN

 	// handle favicon request
 	if isFaviconPath(r.URL.Path) {
-		r.URL.RawQuery = "alias=" + w.route.TargetName()
+		r.URL.RawQuery = "alias=" + w.rp.TargetName
 		favicon.GetFavIcon(rw, r)
 		return false
 	}

 	// Check if start endpoint is configured and request path matches
-	if w.Config().StartEndpoint != "" && r.URL.Path != w.Config().StartEndpoint {
+	if w.cfg.StartEndpoint != "" && r.URL.Path != w.cfg.StartEndpoint {
 		http.Error(rw, "Forbidden: Container can only be started via configured start endpoint", http.StatusForbidden)
 		return false
 	}
@@ -95,44 +81,48 @@ func (w *Watcher) wakeFromHTTP(rw http.ResponseWriter, r *http.Request) (shouldN
 		rw.Header().Add("Cache-Control", "must-revalidate")
 		rw.Header().Add("Connection", "close")
 		if _, err := rw.Write(body); err != nil {
-			w.Err(err).Msg("error writing http response")
+			return false
 		}
 		return false
 	}

-	ctx, cancel := context.WithTimeoutCause(r.Context(), w.Config().WakeTimeout, errors.New("wake timeout"))
+	ctx, cancel := context.WithTimeoutCause(r.Context(), w.cfg.WakeTimeout, errors.New("wake timeout"))
 	defer cancel()

-	if w.cancelled(ctx, rw) {
+	if w.cancelled(ctx) {
+		gphttp.ServerError(rw, r, context.Cause(ctx), http.StatusServiceUnavailable)
 		return false
 	}

-	w.WakeTrace().Msg("signal received")
+	w.l.Trace().Msg("signal received")
 	err := w.wakeIfStopped()
 	if err != nil {
-		w.WakeError(err)
-		http.Error(rw, "Error waking container", http.StatusInternalServerError)
+		gphttp.ServerError(rw, r, err)
 		return false
 	}

+	var ready bool
+
 	for {
-		if w.cancelled(ctx, rw) {
+		w.resetIdleTimer()
+
+		if w.cancelled(ctx) {
+			gphttp.ServerError(rw, r, context.Cause(ctx), http.StatusServiceUnavailable)
 			return false
 		}

-		ready, err := w.checkUpdateState()
+		w, ready, err = checkUpdateState(w.Key())
 		if err != nil {
-			http.Error(rw, "Error waking container", http.StatusInternalServerError)
+			gphttp.ServerError(rw, r, err)
 			return false
 		}
 		if ready {
-			w.resetIdleTimer()
 			if isCheckRedirect {
-				w.Debug().Msgf("redirecting to %s ...", w.hc.URL())
+				w.l.Debug().Stringer("url", w.hc.URL()).Msg("container is ready, redirecting")
 				rw.WriteHeader(http.StatusOK)
 				return false
 			}
-			w.Debug().Msgf("passing through to %s ...", w.hc.URL())
+			w.l.Debug().Stringer("url", w.hc.URL()).Msg("container is ready, passing through")
 			return true
 		}

--- a/internal/docker/idlewatcher/waker_stream.go
+++ b/internal/docker/idlewatcher/waker_stream.go
@@ -3,11 +3,10 @@ package idlewatcher
 import (
 	"context"
 	"errors"
-	"fmt"
 	"net"
 	"time"

-	"github.com/yusing/go-proxy/internal/net/types"
+	gpnet "github.com/yusing/go-proxy/internal/net/types"
 )

 // Setup implements types.Stream.
@@ -21,19 +20,19 @@ func (w *Watcher) Setup() error {
 }

 // Accept implements types.Stream.
-func (w *Watcher) Accept() (conn types.StreamConn, err error) {
+func (w *Watcher) Accept() (conn gpnet.StreamConn, err error) {
 	conn, err = w.stream.Accept()
 	if err != nil {
 		return
 	}
 	if wakeErr := w.wakeFromStream(); wakeErr != nil {
-		w.WakeError(wakeErr)
+		w.l.Err(wakeErr).Msg("error waking container")
 	}
 	return
 }

 // Handle implements types.Stream.
-func (w *Watcher) Handle(conn types.StreamConn) error {
+func (w *Watcher) Handle(conn gpnet.StreamConn) error {
 	if err := w.wakeFromStream(); err != nil {
 		return err
 	}
@@ -53,35 +52,29 @@ func (w *Watcher) wakeFromStream() error {
 		return nil
 	}

-	w.WakeDebug().Msg("wake signal received")
-	wakeErr := w.wakeIfStopped()
-	if wakeErr != nil {
-		wakeErr = fmt.Errorf("%s failed: %w", w.String(), wakeErr)
-		w.WakeError(wakeErr)
-		return wakeErr
+	w.l.Debug().Msg("wake signal received")
+	err := w.wakeIfStopped()
+	if err != nil {
+		return err
 	}

-	ctx, cancel := context.WithTimeoutCause(w.task.Context(), w.Config().WakeTimeout, errors.New("wake timeout"))
+	ctx, cancel := context.WithTimeoutCause(w.task.Context(), w.cfg.WakeTimeout, errors.New("wake timeout"))
 	defer cancel()

+	var ready bool
+
 	for {
-		select {
-		case <-w.task.Context().Done():
-			cause := w.task.FinishCause()
-			w.WakeDebug().Str("cause", cause.Error()).Msg("canceled")
-			return cause
-		case <-ctx.Done():
-			cause := context.Cause(ctx)
-			w.WakeDebug().Str("cause", cause.Error()).Msg("timeout")
-			return cause
-		default:
+		if w.cancelled(ctx) {
+			return context.Cause(ctx)
 		}

-		if ready, err := w.checkUpdateState(); err != nil {
+		w, ready, err = checkUpdateState(w.Key())
+		if err != nil {
 			return err
-		} else if ready {
+		}
+		if ready {
 			w.resetIdleTimer()
-			w.Debug().Msg("container is ready, passing through to " + w.hc.URL().String())
+			w.l.Debug().Stringer("url", w.hc.URL()).Msg("container is ready, passing through")
 			return nil
 		}

--- a/internal/idlewatcher/health.go
+++ b/internal/idlewatcher/health.go
@@ -0,0 +1,122 @@
+package idlewatcher
+
+import (
+	"errors"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/gperr"
+	idlewatcher "github.com/yusing/go-proxy/internal/idlewatcher/types"
+	"github.com/yusing/go-proxy/internal/task"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+)
+
+// Start implements health.HealthMonitor.
+func (w *Watcher) Start(parent task.Parent) gperr.Error {
+	w.task.OnCancel("route_cleanup", func() {
+		parent.Finish(w.task.FinishCause())
+	})
+	return nil
+}
+
+// Task implements health.HealthMonitor.
+func (w *Watcher) Task() *task.Task {
+	return w.task
+}
+
+// Finish implements health.HealthMonitor.
+func (w *Watcher) Finish(reason any) {
+	if w.stream != nil {
+		w.stream.Close()
+	}
+}
+
+// Name implements health.HealthMonitor.
+func (w *Watcher) Name() string {
+	return w.cfg.ContainerName()
+}
+
+// String implements health.HealthMonitor.
+func (w *Watcher) String() string {
+	return w.Name()
+}
+
+// Uptime implements health.HealthMonitor.
+func (w *Watcher) Uptime() time.Duration {
+	return 0
+}
+
+// Latency implements health.HealthMonitor.
+func (w *Watcher) Latency() time.Duration {
+	return 0
+}
+
+// Status implements health.HealthMonitor.
+func (w *Watcher) Status() health.Status {
+	state := w.state.Load()
+	if state.err != nil {
+		return health.StatusError
+	}
+	if state.ready {
+		return health.StatusHealthy
+	}
+	if state.status == idlewatcher.ContainerStatusRunning {
+		return health.StatusStarting
+	}
+	return health.StatusNapping
+}
+
+func checkUpdateState(key string) (w *Watcher, ready bool, err error) {
+	watcherMapMu.RLock()
+	w, ok := watcherMap[key]
+	if !ok {
+		watcherMapMu.RUnlock()
+		return nil, false, errors.New("watcher not found")
+	}
+	watcherMapMu.RUnlock()
+
+	// already ready
+	if w.ready() {
+		return w, true, nil
+	}
+
+	if !w.running() {
+		return w, false, nil
+	}
+
+	// the new container info not yet updated
+	if w.hc.URL().Host == "" {
+		return w, false, nil
+	}
+
+	res, err := w.hc.CheckHealth()
+	if err != nil {
+		w.setError(err)
+		return w, false, err
+	}
+
+	if res.Healthy {
+		w.setReady()
+		return w, true, nil
+	}
+	w.setStarting()
+	return w, false, nil
+}
+
+// MarshalMap implements health.HealthMonitor.
+func (w *Watcher) MarshalMap() map[string]any {
+	url := w.hc.URL()
+	if url.Port() == "0" {
+		url = nil
+	}
+	var detail string
+	if err := w.error(); err != nil {
+		detail = err.Error()
+	}
+	return (&health.JSONRepresentation{
+		Name:   w.Name(),
+		Status: w.Status(),
+		Config: dummyHealthCheckConfig,
+		URL:    url,
+		Detail: detail,
+	}).MarshalMap()
+}
--- a/internal/docker/idlewatcher/html/loading_page.html
+++ b/internal/docker/idlewatcher/html/loading_page.html
--- a/internal/docker/idlewatcher/loading_page.go
+++ b/internal/docker/idlewatcher/loading_page.go
@@ -19,11 +19,11 @@ var loadingPage []byte
 var loadingPageTmpl = template.Must(template.New("loading_page").Parse(string(loadingPage)))

 func (w *Watcher) makeLoadingPageBody() []byte {
-	msg := w.ContainerName() + " is starting..."
+	msg := w.cfg.ContainerName() + " is starting..."

 	data := new(templateData)
 	data.CheckRedirectHeader = httpheaders.HeaderGoDoxyCheckRedirect
-	data.Title = w.route.HomepageItem().Name
+	data.Title = w.cfg.ContainerName()
 	data.Message = msg

 	buf := bytes.NewBuffer(make([]byte, len(loadingPage)+len(data.Title)+len(data.Message)+len(httpheaders.HeaderGoDoxyCheckRedirect)))
--- a/internal/idlewatcher/provider/docker.go
+++ b/internal/idlewatcher/provider/docker.go
@@ -0,0 +1,90 @@
+package provider
+
+import (
+	"context"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/yusing/go-proxy/internal/docker"
+	"github.com/yusing/go-proxy/internal/gperr"
+	idlewatcher "github.com/yusing/go-proxy/internal/idlewatcher/types"
+	"github.com/yusing/go-proxy/internal/watcher"
+)
+
+type DockerProvider struct {
+	client      *docker.SharedClient
+	watcher     *watcher.DockerWatcher
+	containerID string
+}
+
+var startOptions = container.StartOptions{}
+
+func NewDockerProvider(dockerHost, containerID string) (idlewatcher.Provider, error) {
+	client, err := docker.NewClient(dockerHost)
+	if err != nil {
+		return nil, err
+	}
+	return &DockerProvider{
+		client:      client,
+		watcher:     watcher.NewDockerWatcher(dockerHost),
+		containerID: containerID,
+	}, nil
+}
+
+func (p *DockerProvider) ContainerPause(ctx context.Context) error {
+	return p.client.ContainerPause(ctx, p.containerID)
+}
+
+func (p *DockerProvider) ContainerUnpause(ctx context.Context) error {
+	return p.client.ContainerUnpause(ctx, p.containerID)
+}
+
+func (p *DockerProvider) ContainerStart(ctx context.Context) error {
+	return p.client.ContainerStart(ctx, p.containerID, startOptions)
+}
+
+func (p *DockerProvider) ContainerStop(ctx context.Context, signal idlewatcher.Signal, timeout int) error {
+	return p.client.ContainerStop(ctx, p.containerID, container.StopOptions{
+		Signal:  string(signal),
+		Timeout: &timeout,
+	})
+}
+
+func (p *DockerProvider) ContainerKill(ctx context.Context, signal idlewatcher.Signal) error {
+	return p.client.ContainerKill(ctx, p.containerID, string(signal))
+}
+
+func (p *DockerProvider) ContainerStatus(ctx context.Context) (idlewatcher.ContainerStatus, error) {
+	status, err := p.client.ContainerInspect(ctx, p.containerID)
+	if err != nil {
+		return idlewatcher.ContainerStatusError, err
+	}
+	switch status.State.Status {
+	case "running":
+		return idlewatcher.ContainerStatusRunning, nil
+	case "exited", "dead", "restarting":
+		return idlewatcher.ContainerStatusStopped, nil
+	case "paused":
+		return idlewatcher.ContainerStatusPaused, nil
+	}
+	return idlewatcher.ContainerStatusError, idlewatcher.ErrUnexpectedContainerStatus.Subject(status.State.Status)
+}
+
+func (p *DockerProvider) Watch(ctx context.Context) (eventCh <-chan watcher.Event, errCh <-chan gperr.Error) {
+	return p.watcher.EventsWithOptions(ctx, watcher.DockerListOptions{
+		Filters: watcher.NewDockerFilter(
+			watcher.DockerFilterContainer,
+			watcher.DockerFilterContainerNameID(p.containerID),
+			watcher.DockerFilterStart,
+			watcher.DockerFilterStop,
+			watcher.DockerFilterDie,
+			watcher.DockerFilterKill,
+			watcher.DockerFilterDestroy,
+			watcher.DockerFilterPause,
+			watcher.DockerFilterUnpause,
+		),
+	})
+}
+
+func (p *DockerProvider) Close() {
+	p.client.Close()
+}
--- a/internal/idlewatcher/provider/proxmox.go
+++ b/internal/idlewatcher/provider/proxmox.go
@@ -0,0 +1,129 @@
+package provider
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/gperr"
+	idlewatcher "github.com/yusing/go-proxy/internal/idlewatcher/types"
+	"github.com/yusing/go-proxy/internal/proxmox"
+	"github.com/yusing/go-proxy/internal/watcher"
+	"github.com/yusing/go-proxy/internal/watcher/events"
+)
+
+type ProxmoxProvider struct {
+	*proxmox.Node
+	vmid    int
+	lxcName string
+	running bool
+}
+
+const proxmoxStateCheckInterval = 1 * time.Second
+
+var ErrNodeNotFound = gperr.New("node not found in pool")
+
+func NewProxmoxProvider(nodeName string, vmid int) (idlewatcher.Provider, error) {
+	node, ok := proxmox.Nodes.Get(nodeName)
+	if !ok {
+		return nil, ErrNodeNotFound.Subject(nodeName).
+			Withf("available nodes: %s", proxmox.AvailableNodeNames())
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	lxcName, err := node.LXCName(ctx, vmid)
+	if err != nil {
+		return nil, err
+	}
+	return &ProxmoxProvider{Node: node, vmid: vmid, lxcName: lxcName}, nil
+}
+
+func (p *ProxmoxProvider) ContainerPause(ctx context.Context) error {
+	return p.LXCAction(ctx, p.vmid, proxmox.LXCSuspend)
+}
+
+func (p *ProxmoxProvider) ContainerUnpause(ctx context.Context) error {
+	return p.LXCAction(ctx, p.vmid, proxmox.LXCResume)
+}
+
+func (p *ProxmoxProvider) ContainerStart(ctx context.Context) error {
+	return p.LXCAction(ctx, p.vmid, proxmox.LXCStart)
+}
+
+func (p *ProxmoxProvider) ContainerStop(ctx context.Context, _ idlewatcher.Signal, _ int) error {
+	return p.LXCAction(ctx, p.vmid, proxmox.LXCShutdown)
+}
+
+func (p *ProxmoxProvider) ContainerKill(ctx context.Context, _ idlewatcher.Signal) error {
+	return p.LXCAction(ctx, p.vmid, proxmox.LXCShutdown)
+}
+
+func (p *ProxmoxProvider) ContainerStatus(ctx context.Context) (idlewatcher.ContainerStatus, error) {
+	status, err := p.LXCStatus(ctx, p.vmid)
+	if err != nil {
+		return idlewatcher.ContainerStatusError, err
+	}
+	switch status {
+	case proxmox.LXCStatusRunning:
+		return idlewatcher.ContainerStatusRunning, nil
+	case proxmox.LXCStatusStopped:
+		return idlewatcher.ContainerStatusStopped, nil
+	}
+	return idlewatcher.ContainerStatusError, idlewatcher.ErrUnexpectedContainerStatus.Subject(string(status))
+}
+
+func (p *ProxmoxProvider) Watch(ctx context.Context) (<-chan watcher.Event, <-chan gperr.Error) {
+	eventCh := make(chan watcher.Event)
+	errCh := make(chan gperr.Error)
+
+	go func() {
+		defer close(eventCh)
+		defer close(errCh)
+
+		var err error
+		p.running, err = p.LXCIsRunning(ctx, p.vmid)
+		if err != nil {
+			errCh <- gperr.Wrap(err)
+			return
+		}
+
+		ticker := time.NewTicker(proxmoxStateCheckInterval)
+		defer ticker.Stop()
+
+		event := watcher.Event{
+			Type:      events.EventTypeDocker,
+			ActorID:   strconv.Itoa(p.vmid),
+			ActorName: p.lxcName,
+		}
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				status, err := p.ContainerStatus(ctx)
+				if err != nil {
+					errCh <- gperr.Wrap(err)
+					return
+				}
+				running := status == idlewatcher.ContainerStatusRunning
+				if p.running != running {
+					p.running = running
+					if running {
+						event.Action = events.ActionContainerStart
+					} else {
+						event.Action = events.ActionContainerStop
+					}
+					eventCh <- event
+				}
+			}
+		}
+	}()
+
+	return eventCh, errCh
+}
+
+func (p *ProxmoxProvider) Close() {
+	// noop
+}
--- a/internal/idlewatcher/state.go
+++ b/internal/idlewatcher/state.go
@@ -0,0 +1,44 @@
+package idlewatcher
+
+import idlewatcher "github.com/yusing/go-proxy/internal/idlewatcher/types"
+
+func (w *Watcher) running() bool {
+	return w.state.Load().status == idlewatcher.ContainerStatusRunning
+}
+
+func (w *Watcher) ready() bool {
+	return w.state.Load().ready
+}
+
+func (w *Watcher) error() error {
+	return w.state.Load().err
+}
+
+func (w *Watcher) setReady() {
+	w.state.Store(&containerState{
+		status: idlewatcher.ContainerStatusRunning,
+		ready:  true,
+	})
+}
+
+func (w *Watcher) setStarting() {
+	w.state.Store(&containerState{
+		status: idlewatcher.ContainerStatusRunning,
+		ready:  false,
+	})
+}
+
+func (w *Watcher) setNapping(status idlewatcher.ContainerStatus) {
+	w.state.Store(&containerState{
+		status: status,
+		ready:  false,
+	})
+}
+
+func (w *Watcher) setError(err error) {
+	w.state.Store(&containerState{
+		status: idlewatcher.ContainerStatusError,
+		ready:  false,
+		err:    err,
+	})
+}
--- a/internal/idlewatcher/types/config.go
+++ b/internal/idlewatcher/types/config.go
@@ -0,0 +1,128 @@
+package idlewatcher
+
+import (
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/yusing/go-proxy/internal/gperr"
+)
+
+type (
+	Config struct {
+		Proxmox *ProxmoxConfig `json:"proxmox,omitempty"`
+		Docker  *DockerConfig  `json:"docker,omitempty"`
+
+		IdleTimeout   time.Duration `json:"idle_timeout"`
+		WakeTimeout   time.Duration `json:"wake_timeout"`
+		StopTimeout   time.Duration `json:"stop_timeout"`
+		StopMethod    StopMethod    `json:"stop_method"`
+		StopSignal    Signal        `json:"stop_signal,omitempty"`
+		StartEndpoint string        `json:"start_endpoint,omitempty"` // Optional path that must be hit to start container
+	}
+	StopMethod string
+	Signal     string
+
+	DockerConfig struct {
+		DockerHost    string `json:"docker_host" validate:"required"`
+		ContainerID   string `json:"container_id" validate:"required"`
+		ContainerName string `json:"container_name" validate:"required"`
+	}
+	ProxmoxConfig struct {
+		Node string `json:"node" validate:"required"`
+		VMID int    `json:"vmid" validate:"required"`
+	}
+)
+
+const (
+	WakeTimeoutDefault = 30 * time.Second
+	StopTimeoutDefault = 1 * time.Minute
+
+	StopMethodPause StopMethod = "pause"
+	StopMethodStop  StopMethod = "stop"
+	StopMethodKill  StopMethod = "kill"
+)
+
+func (c *Config) Key() string {
+	if c.Docker != nil {
+		return c.Docker.ContainerID
+	}
+	return c.Proxmox.Node + ":" + strconv.Itoa(c.Proxmox.VMID)
+}
+
+func (c *Config) ContainerName() string {
+	if c.Docker != nil {
+		return c.Docker.ContainerName
+	}
+	return "lxc " + strconv.Itoa(c.Proxmox.VMID)
+}
+
+func (c *Config) Validate() gperr.Error {
+	if c.IdleTimeout == 0 { // no idle timeout means no idle watcher
+		return nil
+	}
+	errs := gperr.NewBuilder("idlewatcher config validation error")
+	errs.AddRange(
+		c.validateProvider(),
+		c.validateTimeouts(),
+		c.validateStopMethod(),
+		c.validateStopSignal(),
+		c.validateStartEndpoint(),
+	)
+	return errs.Error()
+}
+
+func (c *Config) validateProvider() error {
+	if c.Docker == nil && c.Proxmox == nil {
+		return gperr.New("missing idlewatcher provider config")
+	}
+	return nil
+}
+
+func (c *Config) validateTimeouts() error {
+	if c.WakeTimeout == 0 {
+		c.WakeTimeout = WakeTimeoutDefault
+	}
+	if c.StopTimeout == 0 {
+		c.StopTimeout = StopTimeoutDefault
+	}
+	return nil
+}
+
+func (c *Config) validateStopMethod() error {
+	switch c.StopMethod {
+	case "":
+		c.StopMethod = StopMethodStop
+		return nil
+	case StopMethodPause, StopMethodStop, StopMethodKill:
+		return nil
+	default:
+		return gperr.New("invalid stop method").Subject(string(c.StopMethod))
+	}
+}
+
+func (c *Config) validateStopSignal() error {
+	switch c.StopSignal {
+	case "", "SIGINT", "SIGTERM", "SIGQUIT", "SIGHUP", "INT", "TERM", "QUIT", "HUP":
+		return nil
+	default:
+		return gperr.New("invalid stop signal").Subject(string(c.StopSignal))
+	}
+}
+
+func (c *Config) validateStartEndpoint() error {
+	if c.StartEndpoint == "" {
+		return nil
+	}
+	// checks needed as of Go 1.6 because of change https://github.com/golang/go/commit/617c93ce740c3c3cc28cdd1a0d712be183d0b328#diff-6c2d018290e298803c0c9419d8739885L195
+	// emulate browser and strip the '#' suffix prior to validation. see issue-#237
+	if i := strings.Index(c.StartEndpoint, "#"); i > -1 {
+		c.StartEndpoint = c.StartEndpoint[:i]
+	}
+	if len(c.StartEndpoint) == 0 {
+		return gperr.New("start endpoint must not be empty if defined")
+	}
+	_, err := url.ParseRequestURI(c.StartEndpoint)
+	return err
+}
--- a/internal/docker/idlewatcher/types/config_test.go
+++ b/internal/docker/idlewatcher/types/config_test.go
@@ -1,4 +1,4 @@
-package types
+package idlewatcher

 import (
 	"testing"
@@ -35,9 +35,10 @@ func TestValidateStartEndpoint(t *testing.T) {
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			s, err := validateStartEndpoint(tc.input)
+			cfg := Config{StartEndpoint: tc.input}
+			err := cfg.validateStartEndpoint()
 			if err == nil {
-				ExpectEqual(t, s, tc.input)
+				ExpectEqual(t, cfg.StartEndpoint, tc.input)
 			}
 			if (err != nil) != tc.wantErr {
 				t.Errorf("validateStartEndpoint() error = %v, wantErr %t", err, tc.wantErr)
--- a/internal/idlewatcher/types/container_status.go
+++ b/internal/idlewatcher/types/container_status.go
@@ -0,0 +1,14 @@
+package idlewatcher
+
+import "github.com/yusing/go-proxy/internal/gperr"
+
+type ContainerStatus string
+
+const (
+	ContainerStatusError   ContainerStatus = "error"
+	ContainerStatusRunning ContainerStatus = "running"
+	ContainerStatusPaused  ContainerStatus = "paused"
+	ContainerStatusStopped ContainerStatus = "stopped"
+)
+
+var ErrUnexpectedContainerStatus = gperr.New("unexpected container status")
--- a/internal/idlewatcher/types/provider.go
+++ b/internal/idlewatcher/types/provider.go
@@ -0,0 +1,19 @@
+package idlewatcher
+
+import (
+	"context"
+
+	"github.com/yusing/go-proxy/internal/gperr"
+	"github.com/yusing/go-proxy/internal/watcher/events"
+)
+
+type Provider interface {
+	ContainerPause(ctx context.Context) error
+	ContainerUnpause(ctx context.Context) error
+	ContainerStart(ctx context.Context) error
+	ContainerStop(ctx context.Context, signal Signal, timeout int) error
+	ContainerKill(ctx context.Context, signal Signal) error
+	ContainerStatus(ctx context.Context) (ContainerStatus, error)
+	Watch(ctx context.Context) (eventCh <-chan events.Event, errCh <-chan gperr.Error)
+	Close()
+}
--- a/internal/docker/idlewatcher/types/waker.go
+++ b/internal/docker/idlewatcher/types/waker.go
@@ -1,4 +1,4 @@
-package types
+package idlewatcher

 import (
 	"net/http"
--- a/internal/idlewatcher/watcher.go
+++ b/internal/idlewatcher/watcher.go
@@ -0,0 +1,306 @@
+package idlewatcher
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/yusing/go-proxy/internal/gperr"
+	"github.com/yusing/go-proxy/internal/idlewatcher/provider"
+	idlewatcher "github.com/yusing/go-proxy/internal/idlewatcher/types"
+	"github.com/yusing/go-proxy/internal/logging"
+	"github.com/yusing/go-proxy/internal/net/gphttp/reverseproxy"
+	net "github.com/yusing/go-proxy/internal/net/types"
+	route "github.com/yusing/go-proxy/internal/route/types"
+	"github.com/yusing/go-proxy/internal/task"
+	U "github.com/yusing/go-proxy/internal/utils"
+	"github.com/yusing/go-proxy/internal/utils/atomic"
+	"github.com/yusing/go-proxy/internal/watcher/events"
+	"github.com/yusing/go-proxy/internal/watcher/health"
+	"github.com/yusing/go-proxy/internal/watcher/health/monitor"
+)
+
+type (
+	routeHelper struct {
+		rp     *reverseproxy.ReverseProxy
+		stream net.Stream
+		hc     health.HealthChecker
+	}
+
+	containerState struct {
+		status idlewatcher.ContainerStatus
+		ready  bool
+		err    error
+	}
+
+	Watcher struct {
+		_ U.NoCopy
+		routeHelper
+
+		l zerolog.Logger
+
+		cfg *idlewatcher.Config
+
+		provider idlewatcher.Provider
+
+		state     atomic.Value[*containerState]
+		lastReset atomic.Value[time.Time]
+
+		ticker *time.Ticker
+		task   *task.Task
+	}
+
+	StopCallback func() error
+)
+
+const ContextKey = "idlewatcher.watcher"
+
+var (
+	watcherMap   = make(map[string]*Watcher)
+	watcherMapMu sync.RWMutex
+)
+
+const (
+	idleWakerCheckInterval = 100 * time.Millisecond
+	idleWakerCheckTimeout  = time.Second
+)
+
+var dummyHealthCheckConfig = &health.HealthCheckConfig{
+	Interval: idleWakerCheckInterval,
+	Timeout:  idleWakerCheckTimeout,
+}
+
+var (
+	causeReload           = gperr.New("reloaded")
+	causeContainerDestroy = gperr.New("container destroyed")
+)
+
+const reqTimeout = 3 * time.Second
+
+// TODO: fix stream type
+func NewWatcher(parent task.Parent, r route.Route) (*Watcher, error) {
+	cfg := r.IdlewatcherConfig()
+	key := cfg.Key()
+
+	watcherMapMu.RLock()
+	// if the watcher already exists, finish it
+	w, exists := watcherMap[key]
+	if exists {
+		if w.cfg == cfg {
+			// same address, likely two routes from the same container
+			return w, nil
+		}
+		w.task.Finish(causeReload)
+	}
+	watcherMapMu.RUnlock()
+
+	w = &Watcher{
+		ticker: time.NewTicker(cfg.IdleTimeout),
+		cfg:    cfg,
+		routeHelper: routeHelper{
+			hc: monitor.NewMonitor(r),
+		},
+	}
+
+	var p idlewatcher.Provider
+	var providerType string
+	var err error
+	switch {
+	case cfg.Docker != nil:
+		p, err = provider.NewDockerProvider(cfg.Docker.DockerHost, cfg.Docker.ContainerID)
+		providerType = "docker"
+	default:
+		p, err = provider.NewProxmoxProvider(cfg.Proxmox.Node, cfg.Proxmox.VMID)
+		providerType = "proxmox"
+	}
+
+	if err != nil {
+		return nil, err
+	}
+	w.provider = p
+	w.l = logging.With().
+		Str("provider", providerType).
+		Str("container", cfg.ContainerName()).
+		Logger()
+
+	switch r := r.(type) {
+	case route.ReverseProxyRoute:
+		w.rp = r.ReverseProxy()
+	case route.StreamRoute:
+		w.stream = r
+	default:
+		return nil, gperr.New("unexpected route type")
+	}
+
+	ctx, cancel := context.WithTimeout(parent.Context(), reqTimeout)
+	defer cancel()
+	status, err := w.provider.ContainerStatus(ctx)
+	if err != nil {
+		w.provider.Close()
+		return nil, gperr.Wrap(err, "failed to get container status")
+	}
+
+	switch p := w.provider.(type) {
+	case *provider.ProxmoxProvider:
+		shutdownTimeout := max(time.Second, cfg.StopTimeout-idleWakerCheckTimeout)
+		err = p.LXCSetShutdownTimeout(ctx, cfg.Proxmox.VMID, shutdownTimeout)
+		if err != nil {
+			w.l.Warn().Err(err).Msg("failed to set shutdown timeout")
+		}
+	}
+
+	w.state.Store(&containerState{status: status})
+
+	w.task = parent.Subtask("idlewatcher."+r.TargetName(), true)
+
+	watcherMapMu.Lock()
+	defer watcherMapMu.Unlock()
+	watcherMap[key] = w
+	go func() {
+		cause := w.watchUntilDestroy()
+		if cause.Is(causeContainerDestroy) {
+			watcherMapMu.Lock()
+			defer watcherMapMu.Unlock()
+			delete(watcherMap, key)
+			w.l.Info().Msg("idlewatcher stopped")
+		} else if !cause.Is(causeReload) {
+			gperr.LogError("idlewatcher stopped unexpectedly", cause, &w.l)
+		}
+
+		w.ticker.Stop()
+		w.provider.Close()
+		w.task.Finish(cause)
+	}()
+	w.l.Info().Msg("idlewatcher started")
+	return w, nil
+}
+
+func (w *Watcher) Key() string {
+	return w.cfg.Key()
+}
+
+func (w *Watcher) Wake() error {
+	return w.wakeIfStopped()
+}
+
+func (w *Watcher) wakeIfStopped() error {
+	state := w.state.Load()
+	if state.status == idlewatcher.ContainerStatusRunning {
+		w.l.Debug().Msg("container is already running")
+		return nil
+	}
+
+	ctx, cancel := context.WithTimeout(w.task.Context(), w.cfg.WakeTimeout)
+	defer cancel()
+	switch state.status {
+	case idlewatcher.ContainerStatusStopped:
+		w.l.Info().Msg("starting container")
+		return w.provider.ContainerStart(ctx)
+	case idlewatcher.ContainerStatusPaused:
+		w.l.Info().Msg("unpausing container")
+		return w.provider.ContainerUnpause(ctx)
+	default:
+		return gperr.Errorf("unexpected container status: %s", state.status)
+	}
+}
+
+func (w *Watcher) stopByMethod() error {
+	if !w.running() {
+		return nil
+	}
+
+	cfg := w.cfg
+	ctx, cancel := context.WithTimeout(w.task.Context(), cfg.StopTimeout)
+	defer cancel()
+
+	switch cfg.StopMethod {
+	case idlewatcher.StopMethodPause:
+		return w.provider.ContainerPause(ctx)
+	case idlewatcher.StopMethodStop:
+		return w.provider.ContainerStop(ctx, cfg.StopSignal, int(cfg.StopTimeout.Seconds()))
+	case idlewatcher.StopMethodKill:
+		return w.provider.ContainerKill(ctx, cfg.StopSignal)
+	default:
+		return gperr.Errorf("unexpected stop method: %q", cfg.StopMethod)
+	}
+}
+
+func (w *Watcher) resetIdleTimer() {
+	w.ticker.Reset(w.cfg.IdleTimeout)
+	w.lastReset.Store(time.Now())
+}
+
+func (w *Watcher) expires() time.Time {
+	if !w.running() {
+		return time.Time{}
+	}
+	return w.lastReset.Load().Add(w.cfg.IdleTimeout)
+}
+
+// watchUntilDestroy waits for the container to be created, started, or unpaused,
+// and then reset the idle timer.
+//
+// When the container is stopped, paused,
+// or killed, the idle timer is stopped and the ContainerRunning flag is set to false.
+//
+// When the idle timer fires, the container is stopped according to the
+// stop method.
+//
+// it exits only if the context is canceled, the container is destroyed,
+// errors occurred on docker client, or route provider died (mainly caused by config reload).
+func (w *Watcher) watchUntilDestroy() (returnCause gperr.Error) {
+	eventCh, errCh := w.provider.Watch(w.Task().Context())
+
+	for {
+		select {
+		case <-w.task.Context().Done():
+			return gperr.Wrap(w.task.FinishCause())
+		case err := <-errCh:
+			return err
+		case e := <-eventCh:
+			w.l.Debug().Stringer("action", e.Action).Msg("state changed")
+			if e.Action == events.ActionContainerDestroy {
+				return causeContainerDestroy
+			}
+			w.resetIdleTimer()
+			switch {
+			case e.Action.IsContainerStart(): // create / start / unpause
+				w.setStarting()
+				w.l.Info().Msg("awaken")
+			case e.Action.IsContainerStop(): // stop / kill / die
+				w.setNapping(idlewatcher.ContainerStatusStopped)
+				w.ticker.Stop()
+			case e.Action.IsContainerPause(): // pause
+				w.setNapping(idlewatcher.ContainerStatusPaused)
+				w.ticker.Stop()
+			default:
+				w.l.Error().Stringer("action", e.Action).Msg("unexpected container action")
+			}
+		case <-w.ticker.C:
+			w.ticker.Stop()
+			if w.running() {
+				err := w.stopByMethod()
+				switch {
+				case errors.Is(err, context.Canceled):
+					continue
+				case err != nil:
+					if errors.Is(err, context.DeadlineExceeded) {
+						err = errors.New("timeout waiting for container to stop, please set a higher value for `stop_timeout`")
+					}
+					w.l.Err(err).Msgf("container stop with method %q failed", w.cfg.StopMethod)
+				default:
+					w.l.Info().Str("reason", "idle timeout").Msg("container stopped")
+				}
+			}
+		}
+	}
+}
+
+func fmtErr(err error) string {
+	if err == nil {
+		return ""
+	}
+	return err.Error()
+}
--- a/internal/metrics/metrics.go
+++ b/internal/metrics/metrics.go
@@ -15,16 +15,9 @@ type (
 		HTTP5xx *Counter
 		HTTPReqElapsed *Gauge
 	}
-
-	ServiceMetrics struct {
-		HealthStatus *Gauge
-	}
 )

-var (
-	rm RouteMetrics
-	sm ServiceMetrics
-)
+var rm RouteMetrics

 const (
 	routerNamespace     = "router"
@@ -37,10 +30,6 @@ func GetRouteMetrics() *RouteMetrics {
 	return &rm
 }

-func GetServiceMetrics() *ServiceMetrics {
-	return &sm
-}
-
 func (rm *RouteMetrics) UnregisterService(service string) {
 	lbls := &HTTPRouteMetricLabels{Service: service}
 	rm.HTTP2xx3xx.Delete(lbls)
@@ -54,7 +43,6 @@ func init() {
 		return
 	}
 	initRouteMetrics()
-	initServiceMetrics()
 }

 func initRouteMetrics() {
@@ -93,13 +81,3 @@ func initRouteMetrics() {
 		}, lbls...),
 	}
 }
-
-func initServiceMetrics() {
-	sm = ServiceMetrics{
-		HealthStatus: NewGauge(prometheus.GaugeOpts{
-			Namespace: serviceNamespace,
-			Name:      "health_status",
-			Help:      "The health status of the router by service",
-		}, "service"),
-	}
-}
--- a/internal/metrics/period/entries.go
+++ b/internal/metrics/period/entries.go
@@ -1,8 +1,9 @@
 package period

 import (
-	"encoding/json"
 	"time"
+
+	"github.com/yusing/go-proxy/pkg/json"
 )

 type Entries[T any] struct {
@@ -48,11 +49,11 @@ func (e *Entries[T]) Get() []*T {
 	return res
 }

-func (e *Entries[T]) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]any{
+func (e *Entries[T]) MarshalJSONTo(buf []byte) []byte {
+	return json.MarshalTo(map[string]any{
 		"entries":  e.Get(),
 		"interval": e.interval,
-	})
+	}, buf)
 }

 func (e *Entries[T]) UnmarshalJSON(data []byte) error {
--- a/internal/metrics/period/poller.go
+++ b/internal/metrics/period/poller.go
@@ -2,7 +2,6 @@ package period

 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"net/url"
 	"os"
@@ -10,10 +9,12 @@ import (
 	"sync"
 	"time"

+	"github.com/yusing/go-proxy/internal/common"
 	"github.com/yusing/go-proxy/internal/gperr"
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/task"
 	"github.com/yusing/go-proxy/internal/utils/atomic"
+	"github.com/yusing/go-proxy/pkg/json"
 )

 type (
@@ -39,14 +40,12 @@ const (
 	pollInterval       = 1 * time.Second
 	gatherErrsInterval = 30 * time.Second
 	saveInterval       = 5 * time.Minute
-
-	saveBaseDir = "data/metrics"
 )

 var initDataDirOnce sync.Once

 func initDataDir() {
-	if err := os.MkdirAll(saveBaseDir, 0o755); err != nil {
+	if err := os.MkdirAll(common.MetricsDataDir, 0o755); err != nil {
 		logging.Error().Err(err).Msg("failed to create metrics data directory")
 	}
 }
@@ -65,7 +64,7 @@ func NewPoller[T any, AggregateT json.Marshaler](
 }

 func (p *Poller[T, AggregateT]) savePath() string {
-	return filepath.Join(saveBaseDir, fmt.Sprintf("%s.json", p.name))
+	return filepath.Join(common.MetricsDataDir, fmt.Sprintf("%s.json", p.name))
 }

 func (p *Poller[T, AggregateT]) load() error {
--- a/internal/metrics/period/tests.go
+++ b/internal/metrics/period/tests.go
@@ -0,0 +1,71 @@
+package period
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/yusing/go-proxy/pkg/json"
+)
+
+func (p *Poller[T, AggregateT]) Test(t *testing.T, query url.Values) {
+	t.Helper()
+	for range 3 {
+		require.NoError(t, p.testPoll())
+	}
+	t.Run("periods", func(t *testing.T) {
+		assert.NoError(t, p.testMarshalPeriods(query))
+	})
+	t.Run("no period", func(t *testing.T) {
+		assert.NoError(t, p.testMarshalNoPeriod())
+	})
+}
+
+func (p *Poller[T, AggregateT]) testPeriod(period string, query url.Values) (any, error) {
+	query.Set("period", period)
+	return p.getRespData(&http.Request{URL: &url.URL{RawQuery: query.Encode()}})
+}
+
+func (p *Poller[T, AggregateT]) testPoll() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	data, err := p.poll(ctx, p.lastResult.Load())
+	if err != nil {
+		return err
+	}
+	for _, period := range p.period.Entries {
+		period.Add(time.Now(), data)
+	}
+	p.lastResult.Store(data)
+	return nil
+}
+
+func (p *Poller[T, AggregateT]) testMarshalPeriods(query url.Values) error {
+	for period := range p.period.Entries {
+		data, err := p.testPeriod(string(period), query)
+		if err != nil {
+			return err
+		}
+		_, err = json.Marshal(data)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (p *Poller[T, AggregateT]) testMarshalNoPeriod() error {
+	data, err := p.getRespData(&http.Request{URL: &url.URL{}})
+	if err != nil {
+		return err
+	}
+	_, err = json.Marshal(data)
+	if err != nil {
+		return err
+	}
+	return nil
+}
--- a/internal/metrics/systeminfo/system_info.go
+++ b/internal/metrics/systeminfo/system_info.go
@@ -3,7 +3,6 @@ package systeminfo
 import (
 	"bytes"
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"net/url"
@@ -20,6 +19,7 @@ import (
 	"github.com/yusing/go-proxy/internal/gperr"
 	"github.com/yusing/go-proxy/internal/logging"
 	"github.com/yusing/go-proxy/internal/metrics/period"
+	"github.com/yusing/go-proxy/pkg/json"
 )

 // json tags are left for tests
@@ -55,7 +55,7 @@ type (
 		DownloadSpeed float64 `json:"download_speed"`
 	}
 	Sensors    []sensors.TemperatureStat
-	Aggregated []map[string]any
+	Aggregated = json.MapSlice[any]
 )

 type SystemInfo struct {
@@ -172,6 +172,45 @@ func (s *SystemInfo) collectMemoryInfo(ctx context.Context) error {
 	return nil
 }

+func shouldExcludeDisk(name string) bool {
+	// include only sd* and nvme* disk devices
+	// but not partitions like nvme0p1
+
+	if len(name) < 3 {
+		return true
+	}
+	switch {
+	case strings.HasPrefix(name, "nvme"),
+		strings.HasPrefix(name, "mmcblk"): // NVMe/SD/MMC
+		s := name[len(name)-2]
+		// skip namespaces/partitions
+		switch s {
+		case 'p', 'n':
+			return true
+		default:
+			return false
+		}
+	}
+	switch name[0] {
+	case 's', 'h', 'v': // SCSI/SATA/virtio disks
+		if name[1] != 'd' {
+			return true
+		}
+	case 'x': // Xen virtual disks
+		if name[1:3] != "vd" {
+			return true
+		}
+	default:
+		return true
+	}
+	last := name[len(name)-1]
+	if last >= '0' && last <= '9' {
+		// skip partitions
+		return true
+	}
+	return false
+}
+
 func (s *SystemInfo) collectDisksInfo(ctx context.Context, lastResult *SystemInfo) error {
 	ioCounters, err := disk.IOCountersWithContext(ctx)
 	if err != nil {
@@ -179,34 +218,9 @@ func (s *SystemInfo) collectDisksInfo(ctx context.Context, lastResult *SystemInf
 	}
 	s.DisksIO = make(map[string]*DiskIO, len(ioCounters))
 	for name, io := range ioCounters {
-		// include only /dev/sd* and /dev/nvme* disk devices
-		if len(name) < 3 {
+		if shouldExcludeDisk(name) {
 			continue
 		}
-		switch {
-		case strings.HasPrefix(name, "nvme"),
-			strings.HasPrefix(name, "mmcblk"): // NVMe/SD/MMC
-			if name[len(name)-2] == 'p' {
-				continue // skip partitions
-			}
-		default:
-			switch name[0] {
-			case 's', 'h', 'v': // SCSI/SATA/virtio disks
-				if name[1] != 'd' {
-					continue
-				}
-			case 'x': // Xen virtual disks
-				if name[1:3] != "vd" {
-					continue
-				}
-			default:
-				continue
-			}
-			last := name[len(name)-1]
-			if last >= '0' && last <= '9' {
-				continue // skip partitions
-			}
-		}
 		s.DisksIO[name] = &DiskIO{
 			ReadBytes:  io.ReadBytes,
 			WriteBytes: io.WriteBytes,
@@ -281,8 +295,8 @@ func (s *SystemInfo) collectSensorsInfo(ctx context.Context) error {
 }

 // explicitly implement MarshalJSON to avoid reflection
-func (s *SystemInfo) MarshalJSON() ([]byte, error) {
-	b := bytes.NewBuffer(make([]byte, 0, 1024))
+func (s *SystemInfo) MarshalJSONTo(buf []byte) []byte {
+	b := bytes.NewBuffer(buf)

 	b.WriteRune('{')

@@ -301,7 +315,7 @@ func (s *SystemInfo) MarshalJSON() ([]byte, error) {
 	// memory
 	b.WriteString(`,"memory":`)
 	if s.Memory != nil {
-		b.WriteString(fmt.Sprintf(
+		b.Write(fmt.Appendf(nil,
 			`{"total":%d,"available":%d,"used":%d,"used_percent":%s}`,
 			s.Memory.Total,
 			s.Memory.Available,
@@ -315,13 +329,13 @@ func (s *SystemInfo) MarshalJSON() ([]byte, error) {
 	// disk
 	b.WriteString(`,"disks":`)
 	if len(s.Disks) > 0 {
-		b.WriteString("{")
+		b.WriteRune('{')
 		first := true
 		for device, disk := range s.Disks {
 			if !first {
 				b.WriteRune(',')
 			}
-			b.WriteString(fmt.Sprintf(
+			b.Write(fmt.Appendf(nil,
 				`"%s":{"device":%q,"path":%q,"fstype":%q,"total":%d,"free":%d,"used":%d,"used_percent":%s}`,
 				device,
 				device,
@@ -348,7 +362,7 @@ func (s *SystemInfo) MarshalJSON() ([]byte, error) {
 			if !first {
 				b.WriteRune(',')
 			}
-			b.WriteString(fmt.Sprintf(
+			b.Write(fmt.Appendf(nil,
 				`"%s":{"name":%q,"read_bytes":%d,"write_bytes":%d,"read_speed":%s,"write_speed":%s,"iops":%d}`,
 				name,
 				name,
@@ -368,7 +382,7 @@ func (s *SystemInfo) MarshalJSON() ([]byte, error) {
 	// network
 	b.WriteString(`,"network":`)
 	if s.Network != nil {
-		b.WriteString(fmt.Sprintf(
+		b.Write(fmt.Appendf(nil,
 			`{"bytes_sent":%d,"bytes_recv":%d,"upload_speed":%s,"download_speed":%s}`,
 			s.Network.BytesSent,
 			s.Network.BytesRecv,
@@ -382,13 +396,13 @@ func (s *SystemInfo) MarshalJSON() ([]byte, error) {
 	// sensors
 	b.WriteString(`,"sensors":`)
 	if len(s.Sensors) > 0 {
-		b.WriteString("{")
+		b.WriteRune('{')
 		first := true
 		for _, sensor := range s.Sensors {
 			if !first {
 				b.WriteRune(',')
 			}
-			b.WriteString(fmt.Sprintf(
+			b.Write(fmt.Appendf(nil,
 				`%q:{"name":%q,"temperature":%s,"high":%s,"critical":%s}`,
 				sensor.SensorKey,
 				sensor.SensorKey,
@@ -404,7 +418,7 @@ func (s *SystemInfo) MarshalJSON() ([]byte, error) {
 	}

 	b.WriteRune('}')
-	return []byte(b.String()), nil
+	return b.Bytes()
 }

 func (s *Sensors) UnmarshalJSON(data []byte) error {
@@ -546,43 +560,3 @@ func aggregate(entries []*SystemInfo, query url.Values) (total int, result Aggre
 	}
 	return len(aggregated), aggregated
 }
-
-func (result Aggregated) MarshalJSON() ([]byte, error) {
-	buf := bytes.NewBuffer(make([]byte, 0, 1024))
-
-	buf.WriteByte('[')
-	i := 0
-	n := len(result)
-	for _, entry := range result {
-		buf.WriteRune('{')
-		j := 0
-		m := len(entry)
-		for k, v := range entry {
-			buf.WriteByte('"')
-			buf.WriteString(k)
-			buf.WriteByte('"')
-			buf.WriteByte(':')
-			switch v := v.(type) {
-			case float64:
-				buf.WriteString(strconv.FormatFloat(v, 'f', 2, 64))
-			case uint64:
-				buf.WriteString(strconv.FormatUint(v, 10))
-			case int64:
-				buf.WriteString(strconv.FormatInt(v, 10))
-			default:
-				panic(fmt.Sprintf("unexpected type: %T", v))
-			}
-			if j != m-1 {
-				buf.WriteByte(',')
-			}
-			j++
-		}
-		buf.WriteByte('}')
-		if i != n-1 {
-			buf.WriteByte(',')
-		}
-		i++
-	}
-	buf.WriteByte(']')
-	return buf.Bytes(), nil
-}
--- a/internal/metrics/systeminfo/system_info_test.go
+++ b/internal/metrics/systeminfo/system_info_test.go
@@ -1,15 +1,82 @@
 package systeminfo

 import (
-	"encoding/json"
 	"net/url"
 	"reflect"
 	"testing"

 	"github.com/shirou/gopsutil/v4/sensors"
 	. "github.com/yusing/go-proxy/internal/utils/testing"
+	"github.com/yusing/go-proxy/pkg/json"
 )

+func TestExcludeDisks(t *testing.T) {
+	tests := []struct {
+		name          string
+		shouldExclude bool
+	}{
+		{
+			name:          "nvme0",
+			shouldExclude: false,
+		},
+		{
+			name:          "nvme0n1",
+			shouldExclude: true,
+		},
+		{
+			name:          "nvme0n1p1",
+			shouldExclude: true,
+		},
+		{
+			name:          "sda",
+			shouldExclude: false,
+		},
+		{
+			name:          "sda1",
+			shouldExclude: true,
+		},
+		{
+			name:          "hda",
+			shouldExclude: false,
+		},
+		{
+			name:          "vda",
+			shouldExclude: false,
+		},
+		{
+			name:          "xvda",
+			shouldExclude: false,
+		},
+		{
+			name:          "xva",
+			shouldExclude: true,
+		},
+		{
+			name:          "loop0",
+			shouldExclude: true,
+		},
+		{
+			name:          "mmcblk0",
+			shouldExclude: false,
+		},
+		{
+			name:          "mmcblk0p1",
+			shouldExclude: true,
+		},
+		{
+			name:          "ab",
+			shouldExclude: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := shouldExcludeDisk(tt.name)
+			ExpectEqual(t, result, tt.shouldExclude)
+		})
+	}
+}
+
 // Create test data
 var cpuAvg = 45.67
 var testInfo = &SystemInfo{
@@ -118,14 +185,13 @@ func TestSystemInfo(t *testing.T) {

 func TestSerialize(t *testing.T) {
 	entries := make([]*SystemInfo, 5)
-	for i := 0; i < 5; i++ {
+	for i := range 5 {
 		entries[i] = testInfo
 	}
 	for _, query := range allQueries {
 		t.Run(query, func(t *testing.T) {
 			_, result := aggregate(entries, url.Values{"aggregate": []string{query}})
-			s, err := result.MarshalJSON()
-			ExpectNoError(t, err)
+			s := result.MarshalJSONTo(nil)
 			var v []map[string]any
 			ExpectNoError(t, json.Unmarshal(s, &v))
 			ExpectEqual(t, len(v), len(result))
@@ -139,31 +205,3 @@ func TestSerialize(t *testing.T) {
 		})
 	}
 }
-
-func BenchmarkSerialize(b *testing.B) {
-	entries := make([]*SystemInfo, b.N)
-	for i := 0; i < b.N; i++ {
-		entries[i] = testInfo
-	}
-	queries := map[string]Aggregated{}
-	for _, query := range allQueries {
-		_, result := aggregate(entries, url.Values{"aggregate": []string{query}})
-		queries[query] = result
-	}
-	b.ReportAllocs()
-	b.ResetTimer()
-	b.Run("optimized", func(b *testing.B) {
-		for i := 0; i < b.N; i++ {
-			for _, query := range allQueries {
-				_, _ = queries[query].MarshalJSON()
-			}
-		}
-	})
-	b.Run("json", func(b *testing.B) {
-		for i := 0; i < b.N; i++ {
-			for _, query := range allQueries {
-				_, _ = json.Marshal([]map[string]any(queries[query]))
-			}
-		}
-	})
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
yusing	7730585bc2	Merge branch 'main' into feat/custom-json-marshaling	2025-04-17 06:10:37 +08:00
yusing	e2717c9e44	fix: improve json marshal performance, reduce necessary allocations	2025-04-17 06:10:13 +08:00
yusing	af8bf197c9	chore: update json marshal tests	2025-04-17 05:18:11 +08:00
yusing	25d5fee05f	Merge branch 'main' into feat/custom-json-marshaling	2025-04-16 15:26:01 +08:00
yusing	d7f8359f27	fix: docker clients not caching properly	2025-04-16 15:20:25 +08:00
yusing	81a6ef9745	fix: non-struct anonymous field unmarshaling	2025-04-16 15:15:22 +08:00
yusing	973a44ee07	fix: version parsing	2025-04-16 15:14:41 +08:00
Yuzerion	80bc018a7f	feat: custom json marshaling implementation, replace json and yaml library (#89 ) * chore: replace gopkg.in/yaml.v3 vs goccy/go-yaml; replace encoding/json with bytedance/sonic * fix: yaml unmarshal panic * feat: custom json marshaler implementation * chore: fix import and err marshal handling --------- Co-authored-by: yusing <yusing@6uo.me>	2025-04-16 15:02:11 +08:00
Yuzerion	24118fa57c	Merge branch 'main' into feat/custom-json-marshaling	2025-04-16 14:58:11 +08:00
Yuzerion	57292f0fe8	feat: proxmox idlewatcher (#88 ) * feat: idle sleep for proxmox LXCs * refactor: replace deprecated docker api types * chore(api): remove debug task list endpoint * refactor: move servemux to gphttp/servemux; favicon.go to v1/favicon * refactor: introduce Pool interface, move agent_pool to agent module * refactor: simplify api code * feat: introduce debug api * refactor: remove net.URL and net.CIDR types, improved unmarshal handling * chore: update Makefile for debug build tag, update README * chore: add gperr.Unwrap method * feat: relative time and duration formatting * chore: add ROOT_DIR environment variable, refactor * migration: move homepage override and icon cache to $BASE_DIR/data, add migration code * fix: nil dereference on marshalling service health * fix: wait for route deletion * chore: enhance tasks debuggability * feat: stdout access logger and MultiWriter * fix(agent): remove agent properly on verify error * fix(metrics): disk exclusion logic and added corresponding tests * chore: update schema and prettify, fix package.json and Makefile * fix: I/O buffer not being shrunk before putting back to pool * feat: enhanced error handling module * chore: deps upgrade * feat: better value formatting and handling --------- Co-authored-by: yusing <yusing@6uo.me>	2025-04-16 14:52:33 +08:00
yusing	54e4969d26	chore: fix import and err marshal handling	2025-04-16 14:44:31 +08:00
yusing	feb9947543	Merge branch 'feat/proxmox-idlewatcher' into feat/custom-json-marshaling	2025-04-16 14:43:49 +08:00
yusing	c2b606e63e	refactor: refactor to adapt new custom json marshaler	2025-04-16 14:39:26 +08:00
yusing	cdfc9d553b	feat: custom json marshaler implementation	2025-04-16 14:36:27 +08:00
yusing	75fd8d1fdc	chore: increase websocket interval for debug api	2025-04-16 14:29:45 +08:00
yusing	57f80344bc	fix: yaml unmarshal panic	2025-04-16 14:25:06 +08:00
yusing	c286275f7e	chore: replace gopkg.in/yaml.v3 vs goccy/go-yaml; replace encoding/json with bytedance/sonic	2025-04-16 14:17:57 +08:00
Yuzerion	88f3a95b61	chore: add migrations directory to Dockerfile	2025-04-16 12:56:17 +08:00
yusing	104e1b1d0a	feat: better value formatting and handling	2025-04-16 12:21:05 +08:00
yusing	82f48d1248	refactor: code cleanup	2025-04-16 12:12:46 +08:00
yusing	47fb07fe4d	chore: deps upgrade	2025-04-16 12:11:19 +08:00
yusing	4615d7dd4e	feat: enhanced error handling module	2025-04-16 12:10:54 +08:00
yusing	18ab6c52ec	fix: io buffer not shrinked before putting back to pool	2025-04-16 12:10:11 +08:00
yusing	3b4deccd8e	feat: idle sleep for proxmox LXCs	2025-04-16 12:08:46 +08:00
yusing	7e56fce4c9	chore: update schema and prettify, fix package.json and Makefile	2025-04-16 05:46:37 +08:00
yusing	49d062a94b	fix: version file logic	2025-04-16 00:13:49 +08:00
yusing	4e7684d67d	chore: fix directory preparation	2025-04-16 00:10:03 +08:00
yusing	76b0505b88	fix(metrics): disk exclusion logic and added corresponding tests	2025-04-15 06:20:48 +08:00
yusing	4d88d59100	fix(agent): remove agent properly on verify error	2025-04-15 05:33:09 +08:00
yusing	08b262d94b	refactor: move favicon.go to v1/favicon	2025-04-14 16:27:31 +08:00
yusing	69bc3acf15	chore: cont `fa16f415`	2025-04-14 15:36:24 +08:00
yusing	82e2705f44	feat: stdout access logger and MultiWriter	2025-04-14 07:15:15 +08:00
yusing	dc1102905b	chore: cont `fa16f415`	2025-04-14 06:40:10 +08:00
yusing	eb7495b02a	fix: unmarshal	2025-04-14 06:32:16 +08:00
yusing	2ec1de96d5	chore: cont. `d8eff90`	2025-04-14 06:31:04 +08:00
yusing	57da345335	chore: enhance tasks debuggability	2025-04-14 06:30:16 +08:00
yusing	53a78706e4	fix: wait for route deletion	2025-04-14 06:29:10 +08:00
yusing	dcd21b2374	chore: change debug api addr to localhost:7777, fix makefile	2025-04-14 06:28:23 +08:00
yusing	a2e253591c	fix: nil dereference on marshalling service health	2025-04-14 06:27:19 +08:00
yusing	fa16f4150a	chore: move homepage override and icon cache to $BASE_DIR/data, add migration code	2025-04-14 06:26:26 +08:00
yusing	d8eff90acc	chore: add ROOT_DIR environment variable, refactor	2025-04-14 06:25:06 +08:00
yusing	5cdbe81beb	fix: revert rename	2025-04-13 12:28:13 +08:00
yusing	ffea5fb3da	feat: relative time and duration formatting	2025-04-13 12:24:31 +08:00
yusing	3f2dfe14b5	fix: unmarshal and some tests	2025-04-13 12:24:11 +08:00
yusing	be87d47ebb	chore: add gperr.Unwrap method	2025-04-13 07:07:43 +08:00
yusing	8c6fe38edb	chore: update README	2025-04-13 07:07:23 +08:00
yusing	a478dab97b	chore: update Makefile for debug build tag	2025-04-13 07:07:07 +08:00
yusing	fce96ff3be	refactor: remove net.URL and net.CIDR types, improved unmarshal handling	2025-04-13 07:06:21 +08:00
yusing	1eac48e899	feat: debug api	2025-04-13 06:17:41 +08:00
yusing	fdbf1ad787	refactor: simplify api code	2025-04-13 06:13:17 +08:00
yusing	90214ff752	refactor: introduce Pool interface, move agent_pool to agent module	2025-04-13 06:11:06 +08:00
yusing	12a63a66f6	refactor: move servemux to gphttp/servemux	2025-04-13 05:59:26 +08:00
yusing	2b44ac5bcb	chore(api): remove debug task list endpoint	2025-04-13 05:56:25 +08:00
yusing	0d859cc36f	refactor: replace deprecated docker api types	2025-04-13 05:22:12 +08:00
yusing	65c063a838	feat: enhance setup script with authentication options and DNS provider selection, fix not setting api user correctly	2025-04-11 10:02:00 +08:00
yusing	a2c9e47557	chore: add GODOXY_API_JWT_SECURE to .env.example	2025-04-11 07:44:40 +08:00
yusing	1380b58141	fix: nil dereference in docker health checker	2025-04-11 03:23:29 +08:00
yusing	d1524c1013	fix display url of file server rouie, refactor	2025-04-10 06:17:16 +08:00
yusing	3cd9e47fd0	refactor: make lock in error Builder optional	2025-04-10 06:08:37 +08:00
yusing	e3699b406c	fix: error formatting	2025-04-10 06:06:44 +08:00
yusing	6a5d324733	refactor: move favicon into homepage module	2025-04-10 06:04:14 +08:00
yusing	fb075a24d7	refactor: simplify health monitor code	2025-04-10 05:03:01 +08:00
yusing	5d2b700cb2	chore: reduce memory usage of docker container info	2025-04-10 04:56:50 +08:00
yusing	49ee9c908a	chore: better error formatting	2025-04-10 04:52:44 +08:00
yusing	658332005d	chore: deps upgrade	2025-04-10 00:53:28 +08:00
yusing	1e8cb04b7c	chore: moved demo link below toc, added zeabur badge	2025-04-10 00:29:58 +08:00
yusing	1c892a35f7	fix(route): wildcard labels not applied properly	2025-04-09 16:26:09 +08:00
yusing	de2383eed7	chore: add demo site to README, remove commented badges	2025-04-09 00:42:02 +08:00
yusing	c59567ae8f	refactor: rename module route/types to route	2025-04-08 05:04:49 +08:00
yusing	8ed63fe4b0	refactor: rename module config/types from "types" to "config"	2025-04-07 13:33:28 +08:00
yusing	111d767d46	chore(prometheus): drop service health metrics	2025-04-07 12:51:20 +08:00
yusing	5da9dd6082	refactor: move docker/idlewatcher to idlewatcher	2025-04-06 04:05:26 +08:00
yusing	edb4b59254	fix: Makefile	2025-04-05 14:29:12 +08:00
yusing	e823172c31	fix: correct error formatting for error builder	2025-04-05 14:19:59 +08:00
yusing	4d030d2e16	refactor(gperr): simplify JSON marshaling in withSubject by using slices package for cloning and reversing subjects	2025-04-05 14:05:32 +08:00
yusing	fb217cf80e	feat(config): initialize agents in parallel, speed up config loading	2025-04-05 14:04:11 +08:00
yusing	3689e72eff	refactor(provider): rename route/provider/types to provider	2025-04-05 13:42:20 +08:00
yusing	26bea0d21d	fix(tests): fix tests for gperr module by stripping ANSI color codes from error messages	2025-04-05 13:31:53 +08:00
yusing	9a5553a5b8	refactor(provider): simplify provider initializations, initialize watcher only when needed	2025-04-05 13:31:09 +08:00
yusing	df24acb4af	feat(config): add implement file provider validation tests	2025-04-05 13:30:54 +08:00
yusing	b53dd17b84	refactor(config): enhance provider conflict error messages, streamline provider loading, and improve validation for config files, rename provider.GetType() to Type()	2025-04-05 13:30:24 +08:00
yusing	73a5c57d67	refactor(agent): update logging message format in agent initialization, rename Start* to Init*	2025-04-05 12:00:52 +08:00
yusing	253e06923d	refactor: rename Deserialize* to UnmarshalValidate*	2025-04-05 11:58:11 +08:00
yusing	2c0d58f692	refactor: move config reload error logging to separate method	2025-04-04 03:51:09 +08:00
yusing	864a43266d	refactor: simplify JSON marshaling in withSubject by using a map	2025-04-04 00:50:17 +08:00
yusing	477ddb6241	refactor: remove unused code	2025-04-04 00:47:36 +08:00
yusing	fdac2853af	chore: update set/map parallel logic	2025-04-04 00:46:24 +08:00
Yuzerion	8e37627371	Feat/http3 (#84 ) * chore(deps): update go-playground/validator to v10.26.0 * chore(deps): update Go version to 1.24.2 and dependencies, reorganize dependencies into categorized sections * chore(deps): update Go version to 1.24.2 in Dockerfile * refactor(agent): replace deprecated context import with standard context package * feat(http3): add HTTP/3 support and refactor server handling code into utility functions --------- Co-authored-by: yusing <yusing@6uo.me>	2025-04-04 00:18:15 +08:00