增加简化版的创建TCP网站API

build/configs/db.template.yaml

@@ -12,4 +12,5 @@ dbs:
 
 
 fields:
-  bool: [ "uamIsOn", "followPort", "requestHostExcludingPort", "autoRemoteStart", "autoInstallNftables" ]
+  bool: [ "uamIsOn", "followPort", "requestHostExcludingPort", "autoRemoteStart", "autoInstallNftables", "enableIPLists", "detectAgents", "checkingPorts", "enableRecordHealthCheck", "offlineIsNotified", "http2Enabled", "http3Enabled" ]
+

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/andybalholm/brotli v1.0.4
 	github.com/cespare/xxhash v1.1.0
 	github.com/cespare/xxhash/v2 v2.1.1
-	github.com/go-acme/lego/v4 v4.9.0
+	github.com/go-acme/lego/v4 v4.10.2
 	github.com/go-sql-driver/mysql v1.7.0
 	github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible
 	github.com/iwind/TeaGo v0.0.0-20230304012706-c1f4a4e27470
@@ -20,15 +20,16 @@ require (
 	github.com/pkg/sftp v1.12.0
 	github.com/shirou/gopsutil/v3 v3.22.2
 	github.com/smartwalle/alipay/v3 v3.1.7
-	golang.org/x/crypto v0.1.0
+	golang.org/x/crypto v0.5.0
 	golang.org/x/net v0.8.0
-	golang.org/x/sys v0.6.0
+	golang.org/x/sys v0.8.0
 	google.golang.org/grpc v1.45.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	github.com/cenkalti/backoff/v4 v4.1.3 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
+	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect

go.sum

@@ -12,8 +12,8 @@ github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY
 github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
-github.com/cenkalti/backoff/v4 v4.1.3 h1:cFAlzYUlVYDysBEH2T5hyJZMh3+5+WCBvSnK6Q8UtC4=
-github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
+github.com/cenkalti/backoff/v4 v4.2.0 h1:HN5dHm3WBOgndBH6E8V0q2jIYIR3s9yglV8k/+MN3u4=
+github.com/cenkalti/backoff/v4 v4.2.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
@@ -38,6 +38,8 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
+github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
@@ -162,8 +164,8 @@ golang.org/x/crypto v0.0.0-20190506204251-e1dfcc566284/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
+golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE=
+golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20200513190911-00229845015e/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw=
@@ -222,8 +224,11 @@ golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210816074244-15123e1e1f71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220111092808-5a964db01320/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.6.0 h1:clScbb1cHjoCkyRbWwBEUZ5H/tIFu5TAXIqaZD0Gcjw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

internal/const/const.go

@@ -1,7 +1,7 @@
 package teaconst
 
 const (
-	Version = "1.0.4"
+	Version = "1.2.0"
 
 	ProductName   = "Edge API"
 	ProcessName   = "edge-api"
@@ -18,7 +18,7 @@ const (
 
 	// 其他节点版本号，用来检测是否有需要升级的节点
 
-	NodeVersion = "1.0.4"
+	NodeVersion = "1.2.0"
 
 	// SQLVersion SQL版本号
 	SQLVersion = "11"

internal/db/models/api_node_dao.go

@@ -335,6 +335,7 @@ func (this *APINodeDAO) UpdateAPINodeStatus(tx *dbs.Tx, apiNodeId int64, statusJ
 func (this *APINodeDAO) CountAllLowerVersionNodes(tx *dbs.Tx, version string) (int64, error) {
 	return this.Query(tx).
 		State(APINodeStateEnabled).
+		Attr("isOn", true).
 		Where("status IS NOT NULL").
 		Where("(JSON_EXTRACT(status, '$.buildVersionCode') IS NULL OR JSON_EXTRACT(status, '$.buildVersionCode')<:version)").
 		Param("version", utils.VersionToLong(version)).

internal/db/models/authority/authority_node_dao.go

@@ -210,6 +210,7 @@ func (this *AuthorityNodeDAO) UpdateNodeStatus(tx *dbs.Tx, nodeId int64, nodeSta
 func (this *AuthorityNodeDAO) CountAllLowerVersionNodes(tx *dbs.Tx, version string) (int64, error) {
 	return this.Query(tx).
 		State(AuthorityNodeStateEnabled).
+		Attr("isOn", true).
 		Where("status IS NOT NULL").
 		Where("(JSON_EXTRACT(status, '$.buildVersionCode') IS NULL OR JSON_EXTRACT(status, '$.buildVersionCode')<:version)").
 		Param("version", utils.VersionToLong(version)).

internal/db/models/dns/dns_task_dao.go

@@ -12,7 +12,8 @@ import (
 type DNSTaskType = string
 
 const (
-	DNSTaskTypeClusterChange       DNSTaskType = "clusterChange"
+	DNSTaskTypeClusterChange       DNSTaskType = "clusterChange"       // 集群节点、服务发生变化
+	DNSTaskTypeClusterNodesChange  DNSTaskType = "clusterNodesChange"  // 集群中节点发生变化
 	DNSTaskTypeClusterRemoveDomain DNSTaskType = "clusterRemoveDomain" // 从集群中移除域名
 	DNSTaskTypeNodeChange          DNSTaskType = "nodeChange"
 	DNSTaskTypeServerChange        DNSTaskType = "serverChange"

internal/db/models/dns/dnsutils/dns_utils.go

@@ -162,17 +162,36 @@ func CheckClusterDNS(tx *dbs.Tx, cluster *models.NodeCluster, checkNodeIssues bo
 				return nil, err
 			}
 			if len(ipAddr) == 0 {
-				issues = append(issues, &pb.DNSIssue{
-					Target:      node.Name,
-					TargetId:    nodeId,
-					Type:        "node",
-					Description: "没有设置IP地址",
-					Params: map[string]string{
-						"clusterName": cluster.Name,
-						"clusterId":   numberutils.FormatInt64(clusterId),
-					},
-					MustFix: true,
-				})
+				// 检查是否有离线
+				anyIPAddr, _, err := models.SharedNodeIPAddressDAO.FindFirstNodeAccessIPAddress(tx, nodeId, false, nodeconfigs.NodeRoleNode)
+				if err != nil {
+					return nil, err
+				}
+				if len(anyIPAddr) > 0 {
+					issues = append(issues, &pb.DNSIssue{
+						Target:      node.Name,
+						TargetId:    nodeId,
+						Type:        "node",
+						Description: "节点所有IP地址处于离线状态",
+						Params: map[string]string{
+							"clusterName": cluster.Name,
+							"clusterId":   numberutils.FormatInt64(clusterId),
+						},
+						MustFix: true,
+					})
+				} else {
+					issues = append(issues, &pb.DNSIssue{
+						Target:      node.Name,
+						TargetId:    nodeId,
+						Type:        "node",
+						Description: "没有设置可用的IP地址",
+						Params: map[string]string{
+							"clusterName": cluster.Name,
+							"clusterId":   numberutils.FormatInt64(clusterId),
+						},
+						MustFix: true,
+					})
+				}
 				continue
 			}
 

internal/db/models/http_firewall_policy_dao.go

@@ -132,7 +132,7 @@ func (this *HTTPFirewallPolicyDAO) CreateFirewallPolicy(tx *dbs.Tx, userId int64
 		op.Outbound = outboundJSON
 	}
 
-	if userId <= 0 && serverGroupId <=0 && serverId <= 0 {
+	if userId <= 0 && serverGroupId <= 0 && serverId <= 0 {
 		// synFlood
 		var synFloodConfig = firewallconfigs.DefaultSYNFloodConfig()
 		synFloodJSON, err := json.Marshal(synFloodConfig)
@@ -611,6 +611,10 @@ func (this *HTTPFirewallPolicyDAO) UpdateFirewallPolicyServerId(tx *dbs.Tx, poli
 
 // FindFirewallPolicyIdsWithServerId 查找服务独立关联的策略IDs
 func (this *HTTPFirewallPolicyDAO) FindFirewallPolicyIdsWithServerId(tx *dbs.Tx, serverId int64) ([]int64, error) {
+	if serverId <= 0 {
+		return nil, nil
+	}
+
 	var result = []int64{}
 	ones, err := this.Query(tx).
 		Attr("serverId", serverId).

internal/db/models/http_header_policy_dao.go

@@ -157,6 +157,9 @@ func (this *HTTPHeaderPolicyDAO) UpdateDeletingHeaders(tx *dbs.Tx, policyId int6
 		return errors.New("invalid policyId")
 	}
 
+	if headerNames == nil {
+		headerNames = []string{}
+	}
 	namesJSON, err := json.Marshal(headerNames)
 	if err != nil {
 		return err
@@ -164,7 +167,31 @@ func (this *HTTPHeaderPolicyDAO) UpdateDeletingHeaders(tx *dbs.Tx, policyId int6
 
 	var op = NewHTTPHeaderPolicyOperator()
 	op.Id = policyId
-	op.DeleteHeaders = string(namesJSON)
+	op.DeleteHeaders = namesJSON
+	err = this.Save(tx, op)
+	if err != nil {
+		return err
+	}
+	return this.NotifyUpdate(tx, policyId)
+}
+
+// UpdateNonStandardHeaders 修改非标Headers
+func (this *HTTPHeaderPolicyDAO) UpdateNonStandardHeaders(tx *dbs.Tx, policyId int64, headerNames []string) error {
+	if policyId <= 0 {
+		return errors.New("invalid policyId")
+	}
+
+	if headerNames == nil {
+		headerNames = []string{}
+	}
+	namesJSON, err := json.Marshal(headerNames)
+	if err != nil {
+		return err
+	}
+
+	var op = NewHTTPHeaderPolicyOperator()
+	op.Id = policyId
+	op.NonStandardHeaders = namesJSON
 	err = this.Save(tx, op)
 	if err != nil {
 		return err
@@ -220,9 +247,19 @@ func (this *HTTPHeaderPolicyDAO) ComposeHeaderPolicyConfig(tx *dbs.Tx, headerPol
 		config.DeleteHeaders = headers
 	}
 
+	// Non-Standard Headers
+	if IsNotNull(policy.NonStandardHeaders) {
+		var headers = []string{}
+		err = json.Unmarshal(policy.NonStandardHeaders, &headers)
+		if err != nil {
+			return nil, err
+		}
+		config.NonStandardHeaders = headers
+	}
+
 	// CORS
 	if IsNotNull(policy.Cors) {
-		var corsConfig = &shared.HTTPCORSHeaderConfig{}
+		var corsConfig = shared.NewHTTPCORSHeaderConfig()
 		err = json.Unmarshal(policy.Cors, corsConfig)
 		if err != nil {
 			return nil, err

internal/db/models/http_header_policy_model.go

@@ -4,35 +4,37 @@ import "github.com/iwind/TeaGo/dbs"
 
 // HTTPHeaderPolicy Header定义
 type HTTPHeaderPolicy struct {
-	Id             uint32   `field:"id"`             // ID
-	IsOn           bool     `field:"isOn"`           // 是否启用
-	State          uint8    `field:"state"`          // 状态
-	AdminId        uint32   `field:"adminId"`        // 管理员ID
-	UserId         uint32   `field:"userId"`         // 用户ID
-	CreatedAt      uint64   `field:"createdAt"`      // 创建时间
-	AddHeaders     dbs.JSON `field:"addHeaders"`     // 添加的Header
-	AddTrailers    dbs.JSON `field:"addTrailers"`    // 添加的Trailers
-	SetHeaders     dbs.JSON `field:"setHeaders"`     // 设置Header
-	ReplaceHeaders dbs.JSON `field:"replaceHeaders"` // 替换Header内容
-	Expires        dbs.JSON `field:"expires"`        // Expires单独设置
-	DeleteHeaders  dbs.JSON `field:"deleteHeaders"`  // 删除的Headers
-	Cors           dbs.JSON `field:"cors"`           // CORS配置
+	Id                 uint32   `field:"id"`                 // ID
+	IsOn               bool     `field:"isOn"`               // 是否启用
+	State              uint8    `field:"state"`              // 状态
+	AdminId            uint32   `field:"adminId"`            // 管理员ID
+	UserId             uint32   `field:"userId"`             // 用户ID
+	CreatedAt          uint64   `field:"createdAt"`          // 创建时间
+	AddHeaders         dbs.JSON `field:"addHeaders"`         // 添加的Header
+	AddTrailers        dbs.JSON `field:"addTrailers"`        // 添加的Trailers
+	SetHeaders         dbs.JSON `field:"setHeaders"`         // 设置Header
+	ReplaceHeaders     dbs.JSON `field:"replaceHeaders"`     // 替换Header内容
+	Expires            dbs.JSON `field:"expires"`            // Expires单独设置
+	DeleteHeaders      dbs.JSON `field:"deleteHeaders"`      // 删除的Headers
+	NonStandardHeaders dbs.JSON `field:"nonStandardHeaders"` // 非标Headers
+	Cors               dbs.JSON `field:"cors"`               // CORS配置
 }
 
 type HTTPHeaderPolicyOperator struct {
-	Id             any // ID
-	IsOn           any // 是否启用
-	State          any // 状态
-	AdminId        any // 管理员ID
-	UserId         any // 用户ID
-	CreatedAt      any // 创建时间
-	AddHeaders     any // 添加的Header
-	AddTrailers    any // 添加的Trailers
-	SetHeaders     any // 设置Header
-	ReplaceHeaders any // 替换Header内容
-	Expires        any // Expires单独设置
-	DeleteHeaders  any // 删除的Headers
-	Cors           any // CORS配置
+	Id                 any // ID
+	IsOn               any // 是否启用
+	State              any // 状态
+	AdminId            any // 管理员ID
+	UserId             any // 用户ID
+	CreatedAt          any // 创建时间
+	AddHeaders         any // 添加的Header
+	AddTrailers        any // 添加的Trailers
+	SetHeaders         any // 设置Header
+	ReplaceHeaders     any // 替换Header内容
+	Expires            any // Expires单独设置
+	DeleteHeaders      any // 删除的Headers
+	NonStandardHeaders any // 非标Headers
+	Cors               any // CORS配置
 }
 
 func NewHTTPHeaderPolicyOperator() *HTTPHeaderPolicyOperator {

internal/db/models/http_web_dao.go

@@ -512,7 +512,7 @@ func (this *HTTPWebDAO) ComposeWebConfig(tx *dbs.Tx, webId int64, isLocationOrGr
 
 	// Referers
 	if IsNotNull(web.Referers) {
-		var referersConfig = &serverconfigs.ReferersConfig{}
+		var referersConfig = serverconfigs.NewReferersConfig()
 		err = json.Unmarshal(web.Referers, referersConfig)
 		if err != nil {
 			return nil, err

internal/db/models/ip_item_dao.go

@@ -82,8 +82,11 @@ func (this *IPItemDAO) DisableIPItem(tx *dbs.Tx, id int64, sourceUserId int64) e
 	}
 
 	var query = this.Query(tx)
+
+	// 检查权限
 	if sourceUserId > 0 {
-		query.Attr("sourceUserId", sourceUserId)
+		query.Where("(sourceUserId=:sourceUserId OR listId IN (SELECT id FROM " + SharedIPListDAO.Table + "  WHERE userId=:sourceUserId AND state=1))")
+		query.Param("sourceUserId", sourceUserId)
 	}
 
 	_, err = query.
@@ -365,7 +368,9 @@ func (this *IPItemDAO) CountIPItemsWithListId(tx *dbs.Tx, listId int64, sourceUs
 		State(IPItemStateEnabled).
 		Attr("listId", listId)
 	if sourceUserId > 0 {
-		query.Attr("sourceUserId", sourceUserId)
+		if listId <= 0 || listId == firewallconfigs.GlobalListId {
+			query.Attr("sourceUserId", sourceUserId)
+		}
 	}
 	if len(keyword) > 0 {
 		query.Where("(ipFrom LIKE :keyword OR ipTo LIKE :keyword)").
@@ -389,7 +394,9 @@ func (this *IPItemDAO) ListIPItemsWithListId(tx *dbs.Tx, listId int64, sourceUse
 		State(IPItemStateEnabled).
 		Attr("listId", listId)
 	if sourceUserId > 0 {
-		query.Attr("sourceUserId", sourceUserId)
+		if listId <= 0 || listId == firewallconfigs.GlobalListId {
+			query.Attr("sourceUserId", sourceUserId)
+		}
 	}
 	if len(keyword) > 0 {
 		query.Where("(ipFrom LIKE :keyword OR ipTo LIKE :keyword)").
@@ -482,8 +489,13 @@ func (this *IPItemDAO) ExistsEnabledItem(tx *dbs.Tx, itemId int64) (bool, error)
 func (this *IPItemDAO) CountAllEnabledIPItems(tx *dbs.Tx, sourceUserId int64, keyword string, ip string, listId int64, unread bool, eventLevel string, listType string) (int64, error) {
 	var query = this.Query(tx)
 	if sourceUserId > 0 {
-		query.Attr("sourceUserId", sourceUserId)
-		query.UseIndex("sourceUserId")
+		if listId <= 0 {
+			query.Where("((listId=" + types.String(firewallconfigs.GlobalListId) + " AND sourceUserId=:sourceUserId) OR listId IN (SELECT id FROM " + SharedIPListDAO.Table + " WHERE userId=:sourceUserId AND state=1))")
+			query.Param("sourceUserId", sourceUserId)
+		} else if listId == firewallconfigs.GlobalListId {
+			query.Attr("sourceUserId", sourceUserId)
+			query.UseIndex("sourceUserId")
+		}
 	}
 	if len(keyword) > 0 {
 		query.Like("ipFrom", dbutils.QuoteLike(keyword))
@@ -519,8 +531,13 @@ func (this *IPItemDAO) CountAllEnabledIPItems(tx *dbs.Tx, sourceUserId int64, ke
 func (this *IPItemDAO) ListAllEnabledIPItems(tx *dbs.Tx, sourceUserId int64, keyword string, ip string, listId int64, unread bool, eventLevel string, listType string, offset int64, size int64) (result []*IPItem, err error) {
 	var query = this.Query(tx)
 	if sourceUserId > 0 {
-		query.Attr("sourceUserId", sourceUserId)
-		query.UseIndex("sourceUserId")
+		if listId <= 0 {
+			query.Where("((listId=" + types.String(firewallconfigs.GlobalListId) + " AND sourceUserId=:sourceUserId) OR listId IN (SELECT id FROM " + SharedIPListDAO.Table + " WHERE userId=:sourceUserId AND state=1))")
+			query.Param("sourceUserId", sourceUserId)
+		} else if listId == firewallconfigs.GlobalListId {
+			query.Attr("sourceUserId", sourceUserId)
+			query.UseIndex("sourceUserId")
+		}
 	}
 	if len(keyword) > 0 {
 		query.Like("ipFrom", dbutils.QuoteLike(keyword))

internal/db/models/message_dao.go

@@ -52,7 +52,9 @@ const (
 
 	MessageTypeReportNodeInactive MessageType = "ReportNodeInactive" // 区域监控节点节点不活跃
 	MessageTypeReportNodeActive   MessageType = "ReportNodeActive"   // 区域监控节点活跃
-	MessageTypeConnectivity       MessageType = "Connectivity"
+	MessageTypeConnectivity       MessageType = "Connectivity"       // 连通性
+	MessageTypeNodeSchedule       MessageType = "NodeSchedule"       // 节点调度信息
+	MessageTypeNodeOfflineDay     MessageType = "NodeOfflineDay"     // 节点到下线日期
 )
 
 type MessageDAO dbs.DAO

internal/db/models/monitor_node_dao.go

@@ -207,6 +207,7 @@ func (this *MonitorNodeDAO) UpdateNodeStatus(tx *dbs.Tx, nodeId int64, statusJSO
 func (this *MonitorNodeDAO) CountAllLowerVersionNodes(tx *dbs.Tx, version string) (int64, error) {
 	return this.Query(tx).
 		State(MonitorNodeStateEnabled).
+		Attr("isOn", true).
 		Where("status IS NOT NULL").
 		Where("(JSON_EXTRACT(status, '$.buildVersionCode') IS NULL OR JSON_EXTRACT(status, '$.buildVersionCode')<:version)").
 		Param("version", utils.VersionToLong(version)).

internal/db/models/nameservers/ns_domain_dao.go

@@ -0,0 +1,33 @@
+package nameservers
+
+import (
+	_ "github.com/go-sql-driver/mysql"
+	"github.com/iwind/TeaGo/Tea"
+	"github.com/iwind/TeaGo/dbs"
+)
+
+const (
+	NSDomainStateEnabled  = 1 // 已启用
+	NSDomainStateDisabled = 0 // 已禁用
+)
+
+type NSDomainDAO dbs.DAO
+
+func NewNSDomainDAO() *NSDomainDAO {
+	return dbs.NewDAO(&NSDomainDAO{
+		DAOObject: dbs.DAOObject{
+			DB:     Tea.Env,
+			Table:  "edgeNSDomains",
+			Model:  new(NSDomain),
+			PkName: "id",
+		},
+	}).(*NSDomainDAO)
+}
+
+var SharedNSDomainDAO *NSDomainDAO
+
+func init() {
+	dbs.OnReady(func() {
+		SharedNSDomainDAO = NewNSDomainDAO()
+	})
+}

internal/db/models/nameservers/ns_domain_dao_test.go

@@ -0,0 +1,6 @@
+package nameservers_test
+
+import (
+	_ "github.com/go-sql-driver/mysql"
+	_ "github.com/iwind/TeaGo/bootstrap"
+)

internal/db/models/nameservers/ns_domain_model.go

@@ -4,35 +4,37 @@ import "github.com/iwind/TeaGo/dbs"
 
 // NSDomain DNS域名
 type NSDomain struct {
-	Id              uint64   `field:"id"`              // ID
-	ClusterId       uint32   `field:"clusterId"`       // 集群ID
-	UserId          uint32   `field:"userId"`          // 用户ID
-	IsOn            bool     `field:"isOn"`            // 是否启用
-	Name            string   `field:"name"`            // 域名
-	GroupIds        dbs.JSON `field:"groupIds"`        // 分组ID
-	Tsig            dbs.JSON `field:"tsig"`            // TSIG配置
-	VerifyTXT       string   `field:"verifyTXT"`       // 验证用的TXT
-	VerifyExpiresAt uint64   `field:"verifyExpiresAt"` // 验证TXT过期时间
-	CreatedAt       uint64   `field:"createdAt"`       // 创建时间
-	Version         uint64   `field:"version"`         // 版本号
-	Status          string   `field:"status"`          // 状态：none|verified
-	State           uint8    `field:"state"`           // 状态
+	Id                 uint64   `field:"id"`                 // ID
+	ClusterId          uint32   `field:"clusterId"`          // 集群ID
+	UserId             uint32   `field:"userId"`             // 用户ID
+	IsOn               bool     `field:"isOn"`               // 是否启用
+	Name               string   `field:"name"`               // 域名
+	GroupIds           dbs.JSON `field:"groupIds"`           // 分组ID
+	Tsig               dbs.JSON `field:"tsig"`               // TSIG配置
+	VerifyTXT          string   `field:"verifyTXT"`          // 验证用的TXT
+	VerifyExpiresAt    uint64   `field:"verifyExpiresAt"`    // 验证TXT过期时间
+	RecordsHealthCheck dbs.JSON `field:"recordsHealthCheck"` // 记录健康检查设置
+	CreatedAt          uint64   `field:"createdAt"`          // 创建时间
+	Version            uint64   `field:"version"`            // 版本号
+	Status             string   `field:"status"`             // 状态：none|verified
+	State              uint8    `field:"state"`              // 状态
 }
 
 type NSDomainOperator struct {
-	Id              any // ID
-	ClusterId       any // 集群ID
-	UserId          any // 用户ID
-	IsOn            any // 是否启用
-	Name            any // 域名
-	GroupIds        any // 分组ID
-	Tsig            any // TSIG配置
-	VerifyTXT       any // 验证用的TXT
-	VerifyExpiresAt any // 验证TXT过期时间
-	CreatedAt       any // 创建时间
-	Version         any // 版本号
-	Status          any // 状态：none|verified
-	State           any // 状态
+	Id                 any // ID
+	ClusterId          any // 集群ID
+	UserId             any // 用户ID
+	IsOn               any // 是否启用
+	Name               any // 域名
+	GroupIds           any // 分组ID
+	Tsig               any // TSIG配置
+	VerifyTXT          any // 验证用的TXT
+	VerifyExpiresAt    any // 验证TXT过期时间
+	RecordsHealthCheck any // 记录健康检查设置
+	CreatedAt          any // 创建时间
+	Version            any // 版本号
+	Status             any // 状态：none|verified
+	State              any // 状态
 }
 
 func NewNSDomainOperator() *NSDomainOperator {

internal/db/models/nameservers/ns_record_model.go

@@ -20,6 +20,10 @@ type NSRecord struct {
 	Ttl         uint32   `field:"ttl"`         // TTL（秒）
 	Weight      uint32   `field:"weight"`      // 权重
 	RouteIds    dbs.JSON `field:"routeIds"`    // 线路
+	HealthCheck dbs.JSON `field:"healthCheck"` // 健康检查配置
+	CountUp     uint32   `field:"countUp"`     // 连续上线次数
+	CountDown   uint32   `field:"countDown"`   // 连续离线次数
+	IsUp        bool     `field:"isUp"`        // 是否在线
 	CreatedAt   uint64   `field:"createdAt"`   // 创建时间
 	Version     uint64   `field:"version"`     // 版本号
 	State       uint8    `field:"state"`       // 状态
@@ -42,6 +46,10 @@ type NSRecordOperator struct {
 	Ttl         any // TTL（秒）
 	Weight      any // 权重
 	RouteIds    any // 线路
+	HealthCheck any // 健康检查配置
+	CountUp     any // 连续上线次数
+	CountDown   any // 连续离线次数
+	IsUp        any // 是否在线
 	CreatedAt   any // 创建时间
 	Version     any // 版本号
 	State       any // 状态

internal/db/models/node_action_dao.go

@@ -0,0 +1,63 @@
+package models
+
+import (
+	_ "github.com/go-sql-driver/mysql"
+	"github.com/iwind/TeaGo/Tea"
+	"github.com/iwind/TeaGo/dbs"
+)
+
+const (
+	NodeActionStateEnabled  = 1 // 已启用
+	NodeActionStateDisabled = 0 // 已禁用
+)
+
+type NodeActionDAO dbs.DAO
+
+func NewNodeActionDAO() *NodeActionDAO {
+	return dbs.NewDAO(&NodeActionDAO{
+		DAOObject: dbs.DAOObject{
+			DB:     Tea.Env,
+			Table:  "edgeNodeActions",
+			Model:  new(NodeAction),
+			PkName: "id",
+		},
+	}).(*NodeActionDAO)
+}
+
+var SharedNodeActionDAO *NodeActionDAO
+
+func init() {
+	dbs.OnReady(func() {
+		SharedNodeActionDAO = NewNodeActionDAO()
+	})
+}
+
+// EnableNodeAction 启用条目
+func (this *NodeActionDAO) EnableNodeAction(tx *dbs.Tx, id uint64) error {
+	_, err := this.Query(tx).
+		Pk(id).
+		Set("state", NodeActionStateEnabled).
+		Update()
+	return err
+}
+
+// DisableNodeAction 禁用条目
+func (this *NodeActionDAO) DisableNodeAction(tx *dbs.Tx, id int64) error {
+	_, err := this.Query(tx).
+		Pk(id).
+		Set("state", NodeActionStateDisabled).
+		Update()
+	return err
+}
+
+// FindEnabledNodeAction 查找启用中的条目
+func (this *NodeActionDAO) FindEnabledNodeAction(tx *dbs.Tx, id int64) (*NodeAction, error) {
+	result, err := this.Query(tx).
+		Pk(id).
+		State(NodeActionStateEnabled).
+		Find()
+	if result == nil {
+		return nil, err
+	}
+	return result.(*NodeAction), err
+}

internal/db/models/node_action_dao_test.go

@@ -0,0 +1,6 @@
+package models_test
+
+import (
+	_ "github.com/go-sql-driver/mysql"
+	_ "github.com/iwind/TeaGo/bootstrap"
+)

internal/db/models/node_action_model.go

@@ -0,0 +1,32 @@
+package models
+
+import "github.com/iwind/TeaGo/dbs"
+
+// NodeAction 节点智能调度设置
+type NodeAction struct {
+	Id       uint64   `field:"id"`       // ID
+	NodeId   uint64   `field:"nodeId"`   // 节点ID
+	Role     string   `field:"role"`     // 角色
+	IsOn     bool     `field:"isOn"`     // 是否启用
+	Conds    dbs.JSON `field:"conds"`    // 条件
+	Action   dbs.JSON `field:"action"`   // 动作
+	Duration dbs.JSON `field:"duration"` // 持续时间
+	Order    uint32   `field:"order"`    // 排序
+	State    uint8    `field:"state"`    // 状态
+}
+
+type NodeActionOperator struct {
+	Id       any // ID
+	NodeId   any // 节点ID
+	Role     any // 角色
+	IsOn     any // 是否启用
+	Conds    any // 条件
+	Action   any // 动作
+	Duration any // 持续时间
+	Order    any // 排序
+	State    any // 状态
+}
+
+func NewNodeActionOperator() *NodeActionOperator {
+	return &NodeActionOperator{}
+}

internal/db/models/node_action_model_ext.go

@@ -0,0 +1 @@
+package models

internal/db/models/node_cluster_dao.go

@@ -996,7 +996,7 @@ func (this *NodeClusterDAO) FindClusterBasicInfo(tx *dbs.Tx, clusterId int64, ca
 	cluster, err := this.Query(tx).
 		Pk(clusterId).
 		State(NodeClusterStateEnabled).
-		Result("id", "name", "timeZone", "nodeMaxThreads", "cachePolicyId", "httpFirewallPolicyId", "autoOpenPorts", "webp", "uam", "isOn", "ddosProtection", "clock", "globalServerConfig", "autoInstallNftables").
+		Result("id", "name", "timeZone", "nodeMaxThreads", "cachePolicyId", "httpFirewallPolicyId", "autoOpenPorts", "webp", "uam", "cc", "httpPages", "http3", "isOn", "ddosProtection", "clock", "globalServerConfig", "autoInstallNftables").
 		Find()
 	if err != nil || cluster == nil {
 		return nil, err
@@ -1095,7 +1095,7 @@ func (this *NodeClusterDAO) UpdateClusterUAMPolicy(tx *dbs.Tx, clusterId int64,
 	return this.NotifyUAMUpdate(tx, clusterId)
 }
 
-// FindClusterUAMPolicy 查询设置
+// FindClusterUAMPolicy 查询UAM设置
 func (this *NodeClusterDAO) FindClusterUAMPolicy(tx *dbs.Tx, clusterId int64, cacheMap *utils.CacheMap) (*nodeconfigs.UAMPolicy, error) {
 	var cacheKey = this.Table + ":FindClusterUAMPolicy:" + types.String(clusterId)
 	if cacheMap != nil {
@@ -1125,6 +1125,205 @@ func (this *NodeClusterDAO) FindClusterUAMPolicy(tx *dbs.Tx, clusterId int64, ca
 	return policy, nil
 }
 
+// UpdateClusterHTTPCCPolicy 修改CC策略设置
+func (this *NodeClusterDAO) UpdateClusterHTTPCCPolicy(tx *dbs.Tx, clusterId int64, httpCCPolicy *nodeconfigs.HTTPCCPolicy) error {
+	if httpCCPolicy == nil {
+		err := this.Query(tx).
+			Pk(clusterId).
+			Set("cc", dbs.SQL("null")).
+			UpdateQuickly()
+		if err != nil {
+			return err
+		}
+
+		return this.NotifyHTTPCCUpdate(tx, clusterId)
+	}
+
+	httpCCPolicyJSON, err := json.Marshal(httpCCPolicy)
+	if err != nil {
+		return err
+	}
+	err = this.Query(tx).
+		Pk(clusterId).
+		Set("cc", httpCCPolicyJSON).
+		UpdateQuickly()
+	if err != nil {
+		return err
+	}
+
+	return this.NotifyHTTPCCUpdate(tx, clusterId)
+}
+
+// FindClusterHTTPCCPolicy 查询CC策略设置
+func (this *NodeClusterDAO) FindClusterHTTPCCPolicy(tx *dbs.Tx, clusterId int64, cacheMap *utils.CacheMap) (*nodeconfigs.HTTPCCPolicy, error) {
+	var cacheKey = this.Table + ":FindClusterHTTPCCPolicy:" + types.String(clusterId)
+	if cacheMap != nil {
+		cache, ok := cacheMap.Get(cacheKey)
+		if ok {
+			return cache.(*nodeconfigs.HTTPCCPolicy), nil
+		}
+	}
+
+	httpCCJSON, err := this.Query(tx).
+		Pk(clusterId).
+		Result("cc").
+		FindJSONCol()
+	if err != nil {
+		return nil, err
+	}
+
+	if IsNull(httpCCJSON) {
+		return nodeconfigs.NewHTTPCCPolicy(), nil
+	}
+
+	var policy = nodeconfigs.NewHTTPCCPolicy()
+	err = json.Unmarshal(httpCCJSON, policy)
+	if err != nil {
+		return nil, err
+	}
+	return policy, nil
+}
+
+// UpdateClusterHTTP3Policy 修改HTTP3策略设置
+func (this *NodeClusterDAO) UpdateClusterHTTP3Policy(tx *dbs.Tx, clusterId int64, http3Policy *nodeconfigs.HTTP3Policy) error {
+	if http3Policy == nil {
+		err := this.Query(tx).
+			Pk(clusterId).
+			Set("http3", dbs.SQL("null")).
+			UpdateQuickly()
+		if err != nil {
+			return err
+		}
+
+		return this.NotifyHTTP3Update(tx, clusterId)
+	}
+
+	http3PolicyJSON, err := json.Marshal(http3Policy)
+	if err != nil {
+		return err
+	}
+	err = this.Query(tx).
+		Pk(clusterId).
+		Set("http3", http3PolicyJSON).
+		UpdateQuickly()
+	if err != nil {
+		return err
+	}
+
+	return this.NotifyHTTP3Update(tx, clusterId)
+}
+
+// FindClusterHTTP3Policy 查询HTTP3策略设置
+func (this *NodeClusterDAO) FindClusterHTTP3Policy(tx *dbs.Tx, clusterId int64, cacheMap *utils.CacheMap) (*nodeconfigs.HTTP3Policy, error) {
+	var cacheKey = this.Table + ":FindClusterHTTP3Policy:" + types.String(clusterId)
+	if cacheMap != nil {
+		cache, ok := cacheMap.Get(cacheKey)
+		if ok {
+			return cache.(*nodeconfigs.HTTP3Policy), nil
+		}
+	}
+
+	http3PolicyJSON, err := this.Query(tx).
+		Pk(clusterId).
+		Result("http3").
+		FindJSONCol()
+	if err != nil {
+		return nil, err
+	}
+
+	if IsNull(http3PolicyJSON) {
+		return nodeconfigs.NewHTTP3Policy(), nil
+	}
+
+	var policy = nodeconfigs.NewHTTP3Policy()
+	err = json.Unmarshal(http3PolicyJSON, policy)
+	if err != nil {
+		return nil, err
+	}
+	return policy, nil
+}
+
+// UpdateClusterHTTPPagesPolicy 修改自定义页面设置
+func (this *NodeClusterDAO) UpdateClusterHTTPPagesPolicy(tx *dbs.Tx, clusterId int64, httpPagesPolicy *nodeconfigs.HTTPPagesPolicy) error {
+	if httpPagesPolicy == nil {
+		err := this.Query(tx).
+			Pk(clusterId).
+			Set("httpPages", dbs.SQL("null")).
+			UpdateQuickly()
+		if err != nil {
+			return err
+		}
+
+		return this.NotifyHTTPPagesPolicyUpdate(tx, clusterId)
+	}
+
+	// 移除不需要保存的内容
+	var newPages = []*serverconfigs.HTTPPageConfig{}
+	for _, page := range httpPagesPolicy.Pages {
+		newPages = append(newPages, &serverconfigs.HTTPPageConfig{Id: page.Id})
+	}
+	httpPagesPolicy.Pages = newPages
+
+	httpPagesPolicyJSON, err := json.Marshal(httpPagesPolicy)
+	if err != nil {
+		return err
+	}
+	err = this.Query(tx).
+		Pk(clusterId).
+		Set("httpPages", httpPagesPolicyJSON).
+		UpdateQuickly()
+	if err != nil {
+		return err
+	}
+
+	return this.NotifyHTTPPagesPolicyUpdate(tx, clusterId)
+}
+
+// FindClusterHTTPPagesPolicy 查询自定义页面设置
+func (this *NodeClusterDAO) FindClusterHTTPPagesPolicy(tx *dbs.Tx, clusterId int64, cacheMap *utils.CacheMap) (*nodeconfigs.HTTPPagesPolicy, error) {
+	var cacheKey = this.Table + ":FindClusterHTTPPagesPolicy:" + types.String(clusterId)
+	if cacheMap != nil {
+		cache, ok := cacheMap.Get(cacheKey)
+		if ok {
+			return cache.(*nodeconfigs.HTTPPagesPolicy), nil
+		}
+	}
+
+	pagesJSON, err := this.Query(tx).
+		Pk(clusterId).
+		Result("httpPages").
+		FindJSONCol()
+	if err != nil {
+		return nil, err
+	}
+
+	if IsNull(pagesJSON) {
+		return nodeconfigs.NewHTTPPagesPolicy(), nil
+	}
+
+	var policy = nodeconfigs.NewHTTPPagesPolicy()
+	err = json.Unmarshal(pagesJSON, policy)
+	if err != nil {
+		return nil, err
+	}
+
+	// 读取Page信息
+	var newPages = []*serverconfigs.HTTPPageConfig{}
+	for _, page := range policy.Pages {
+		pageConfig, err := SharedHTTPPageDAO.ComposePageConfig(tx, page.Id, cacheMap)
+		if err != nil {
+			return nil, err
+		}
+		if pageConfig == nil {
+			continue
+		}
+		newPages = append(newPages, pageConfig)
+	}
+	policy.Pages = newPages
+
+	return policy, nil
+}
+
 // FindClusterDDoSProtection 获取集群的DDoS设置
 func (this *NodeClusterDAO) FindClusterDDoSProtection(tx *dbs.Tx, clusterId int64) (*ddosconfigs.ProtectionConfig, error) {
 	one, err := this.Query(tx).
@@ -1217,6 +1416,21 @@ func (this *NodeClusterDAO) NotifyUAMUpdate(tx *dbs.Tx, clusterId int64) error {
 	return SharedNodeTaskDAO.CreateClusterTask(tx, nodeconfigs.NodeRoleNode, clusterId, 0, 0, NodeTaskTypeUAMPolicyChanged)
 }
 
+// NotifyHTTPCCUpdate 通知HTTP CC更新
+func (this *NodeClusterDAO) NotifyHTTPCCUpdate(tx *dbs.Tx, clusterId int64) error {
+	return SharedNodeTaskDAO.CreateClusterTask(tx, nodeconfigs.NodeRoleNode, clusterId, 0, 0, NodeTaskTypeHTTPCCPolicyChanged)
+}
+
+// NotifyHTTP3Update 通知HTTP3更新
+func (this *NodeClusterDAO) NotifyHTTP3Update(tx *dbs.Tx, clusterId int64) error {
+	return SharedNodeTaskDAO.CreateClusterTask(tx, nodeconfigs.NodeRoleNode, clusterId, 0, 0, NodeTaskTypeHTTP3PolicyChanged)
+}
+
+// NotifyHTTPPagesPolicyUpdate 通知HTTP Pages更新
+func (this *NodeClusterDAO) NotifyHTTPPagesPolicyUpdate(tx *dbs.Tx, clusterId int64) error {
+	return SharedNodeTaskDAO.CreateClusterTask(tx, nodeconfigs.NodeRoleNode, clusterId, 0, 0, NodeTaskTypeHTTPPagesPolicyChanged)
+}
+
 // NotifyDNSUpdate 通知DNS更新
 // TODO 更新新的DNS解析记录的同时，需要删除老的DNS解析记录
 func (this *NodeClusterDAO) NotifyDNSUpdate(tx *dbs.Tx, clusterId int64) error {

internal/db/models/node_cluster_model.go

@@ -41,6 +41,9 @@ type NodeCluster struct {
 	AutoRemoteStart      bool     `field:"autoRemoteStart"`      // 自动远程启动
 	AutoInstallNftables  bool     `field:"autoInstallNftables"`  // 自动安装nftables
 	IsAD                 bool     `field:"isAD"`                 // 是否为高防集群
+	HttpPages            dbs.JSON `field:"httpPages"`            // 自定义页面设置
+	Cc                   dbs.JSON `field:"cc"`                   // CC设置
+	Http3                dbs.JSON `field:"http3"`                // HTTP3设置
 }
 
 type NodeClusterOperator struct {
@@ -81,6 +84,9 @@ type NodeClusterOperator struct {
 	AutoRemoteStart      any // 自动远程启动
 	AutoInstallNftables  any // 自动安装nftables
 	IsAD                 any // 是否为高防集群
+	HttpPages            any // 自定义页面设置
+	Cc                   any // CC设置
+	Http3                any // HTTP3设置
 }
 
 func NewNodeClusterOperator() *NodeClusterOperator {

internal/db/models/node_dao.go

@@ -295,6 +295,7 @@ func (this *NodeDAO) CountAllEnabledNodes(tx *dbs.Tx) (int64, error) {
 func (this *NodeDAO) CountAllEnabledOfflineNodes(tx *dbs.Tx) (int64, error) {
 	return this.Query(tx).
 		State(NodeStateEnabled).
+		Attr("isOn", true).
 		Where("clusterId IN (SELECT id FROM "+SharedNodeClusterDAO.Table+" WHERE state=:clusterState)").
 		Param("clusterState", NodeClusterStateEnabled).
 		Where("(status IS NULL OR NOT JSON_EXTRACT(status, '$.isActive') OR UNIX_TIMESTAMP()-JSON_EXTRACT(status, '$.updatedAt')>60)").
@@ -1085,6 +1086,9 @@ func (this *NodeDAO) ComposeNodeConfig(tx *dbs.Tx, nodeId int64, dataMap *shared
 	var clusterIndex = 0
 	config.WebPImagePolicies = map[int64]*nodeconfigs.WebPImagePolicy{}
 	config.UAMPolicies = map[int64]*nodeconfigs.UAMPolicy{}
+	config.HTTPCCPolicies = map[int64]*nodeconfigs.HTTPCCPolicy{}
+	config.HTTP3Policies = map[int64]*nodeconfigs.HTTP3Policy{}
+	config.HTTPPagesPolicies = map[int64]*nodeconfigs.HTTPPagesPolicy{}
 	var allowIPMaps = map[string]bool{}
 	for _, clusterId := range clusterIds {
 		nodeCluster, err := SharedNodeClusterDAO.FindClusterBasicInfo(tx, clusterId, cacheMap)
@@ -1178,6 +1182,59 @@ func (this *NodeDAO) ComposeNodeConfig(tx *dbs.Tx, nodeId int64, dataMap *shared
 			config.UAMPolicies[clusterId] = uamPolicy
 		}
 
+		// HTTP CC Policy
+		if IsNotNull(nodeCluster.Cc) {
+			var ccPolicy = nodeconfigs.NewHTTPCCPolicy()
+			err = json.Unmarshal(nodeCluster.Cc, ccPolicy)
+			if err != nil {
+				return nil, err
+			}
+
+			// 集成默认设置
+			for i := 0; i < len(serverconfigs.DefaultHTTPCCThresholds); i++ {
+				if i < len(ccPolicy.Thresholds) {
+					ccPolicy.Thresholds[i].MergeIfEmpty(serverconfigs.DefaultHTTPCCThresholds[i])
+				}
+			}
+
+			config.HTTPCCPolicies[clusterId] = ccPolicy
+		}
+
+		// HTTP3 Policy
+		if IsNotNull(nodeCluster.Http3) {
+			var http3Policy = nodeconfigs.NewHTTP3Policy()
+			err = json.Unmarshal(nodeCluster.Http3, http3Policy)
+			if err != nil {
+				return nil, err
+			}
+			config.HTTP3Policies[clusterId] = http3Policy
+		}
+
+		// HTTP Pages Policy
+		if IsNotNull(nodeCluster.HttpPages) {
+			var httpPagesPolicy = nodeconfigs.NewHTTPPagesPolicy()
+			err = json.Unmarshal(nodeCluster.HttpPages, httpPagesPolicy)
+			if err != nil {
+				return nil, err
+			}
+			if httpPagesPolicy.IsOn {
+				var newPages = []*serverconfigs.HTTPPageConfig{}
+				for _, page := range httpPagesPolicy.Pages {
+					pageConfig, err := SharedHTTPPageDAO.ComposePageConfig(tx, page.Id, cacheMap)
+					if err != nil {
+						return nil, err
+					}
+					if pageConfig != nil && pageConfig.IsOn {
+						newPages = append(newPages, pageConfig)
+					}
+				}
+				httpPagesPolicy.Pages = newPages
+				if len(newPages) > 0 {
+					config.HTTPPagesPolicies[clusterId] = httpPagesPolicy
+				}
+			}
+		}
+
 		// 自动安装nftables
 		if clusterIndex == 0 {
 			config.AutoInstallNftables = nodeCluster.AutoInstallNftables
@@ -1394,7 +1451,7 @@ func (this *NodeDAO) CountAllEnabledNodesWithGrantId(tx *dbs.Tx, grantId int64)
 func (this *NodeDAO) FindAllEnabledNodesWithGrantId(tx *dbs.Tx, grantId int64) (result []*Node, err error) {
 	_, err = this.Query(tx).
 		State(NodeStateEnabled).
-		Where("id IN (SELECT nodeId FROM edgeNodeLogins WHERE type='ssh' AND JSON_CONTAINS(params, :grantParam))").
+		Where("id IN (SELECT nodeId FROM edgeNodeLogins WHERE type='ssh' AND JSON_CONTAINS(params, :grantParam) AND state=1)").
 		Param("grantParam", string(maps.Map{"grantId": grantId}.AsJSON())).
 		Where("clusterId IN (SELECT id FROM edgeNodeClusters WHERE state=1)").
 		Slice(&result).
@@ -1428,6 +1485,7 @@ func (this *NodeDAO) FindAllNotInstalledNodesWithClusterId(tx *dbs.Tx, clusterId
 func (this *NodeDAO) CountAllLowerVersionNodesWithClusterId(tx *dbs.Tx, clusterId int64, os string, arch string, version string) (int64, error) {
 	return this.Query(tx).
 		State(NodeStateEnabled).
+		Attr("isOn", true).
 		Attr("clusterId", clusterId).
 		Where("status IS NOT NULL").
 		Where("JSON_EXTRACT(status, '$.os')=:os").
@@ -1461,6 +1519,7 @@ func (this *NodeDAO) FindAllLowerVersionNodesWithClusterId(tx *dbs.Tx, clusterId
 func (this *NodeDAO) CountAllLowerVersionNodes(tx *dbs.Tx, version string) (int64, error) {
 	return this.Query(tx).
 		State(NodeStateEnabled).
+		Attr("isOn", true).
 		Where("clusterId IN (SELECT id FROM "+SharedNodeClusterDAO.Table+" WHERE state=1)").
 		Where("status IS NOT NULL").
 		Where("(JSON_EXTRACT(status, '$.buildVersionCode') IS NULL OR JSON_EXTRACT(status, '$.buildVersionCode')<:version)").
@@ -1550,7 +1609,7 @@ func (this *NodeDAO) FindAllEnabledNodesDNSWithClusterId(tx *dbs.Tx, clusterId i
 		Attr("isOn", true).
 		Attr("isUp", true).
 		Attr("isInstalled", isInstalled).
-		Result("id", "name", "dnsRoutes", "isOn").
+		Result("id", "name", "dnsRoutes", "isOn", "offlineDay", "actionStatus", "isBackupForCluster", "isBackupForGroup", "backupIPs", "clusterId", "groupId").
 		DescPk().
 		Slice(&result).
 		FindAll()
@@ -1575,7 +1634,7 @@ func (this *NodeDAO) FindEnabledNodeDNS(tx *dbs.Tx, nodeId int64) (*Node, error)
 	one, err := this.Query(tx).
 		State(NodeStateEnabled).
 		Pk(nodeId).
-		Result("id", "name", "dnsRoutes", "clusterId", "isOn").
+		Result("id", "name", "dnsRoutes", "clusterId", "isOn", "offlineDay", "isBackupForCluster", "isBackupForGroup", "actionStatus").
 		Find()
 	if one == nil {
 		return nil, err

internal/db/models/node_dao_ext.go

@@ -18,3 +18,8 @@ func (this *NodeDAO) loadServersFromCluster(tx *dbs.Tx, clusterId int64, serverI
 func (this *NodeDAO) composeExtConfig(tx *dbs.Tx, config *nodeconfigs.NodeConfig, clusterIds []int64, cacheMap *utils.CacheMap) error {
 	return nil
 }
+
+// CheckNodeIPAddresses 检查节点IP地址
+func (this *NodeDAO) CheckNodeIPAddresses(tx *dbs.Tx, node *Node) (shouldSkip bool, shouldOverwrite bool, ipAddressStrings []string, err error) {
+	return
+}

internal/db/models/node_ip_address_dao.go

@@ -307,7 +307,7 @@ func (this *NodeIPAddressDAO) FindFirstNodeAccessIPAddressId(tx *dbs.Tx, nodeId
 		FindInt64Col(0)
 }
 
-// FindNodeAccessAndUpIPAddresses 查找节点所有的可访问的IP地址
+// FindNodeAccessAndUpIPAddresses 查找节点所有的可访问且在线的IP地址
 func (this *NodeIPAddressDAO) FindNodeAccessAndUpIPAddresses(tx *dbs.Tx, nodeId int64, role nodeconfigs.NodeRole) (result []*NodeIPAddress, err error) {
 	if len(role) == 0 {
 		role = nodeconfigs.NodeRoleNode
@@ -326,6 +326,24 @@ func (this *NodeIPAddressDAO) FindNodeAccessAndUpIPAddresses(tx *dbs.Tx, nodeId
 	return
 }
 
+// FindNodeAccessIPAddresses 查找节点所有的可访问的IP地址，包括在线和离线
+func (this *NodeIPAddressDAO) FindNodeAccessIPAddresses(tx *dbs.Tx, nodeId int64, role nodeconfigs.NodeRole) (result []*NodeIPAddress, err error) {
+	if len(role) == 0 {
+		role = nodeconfigs.NodeRoleNode
+	}
+	_, err = this.Query(tx).
+		Attr("role", role).
+		Attr("nodeId", nodeId).
+		State(NodeIPAddressStateEnabled).
+		Attr("canAccess", true).
+		Attr("isOn", true).
+		Desc("order").
+		AscPk().
+		Slice(&result).
+		FindAll()
+	return
+}
+
 // CountAllEnabledIPAddresses 计算IP地址数量
 // TODO 目前支持边缘节点，将来支持NS节点
 func (this *NodeIPAddressDAO) CountAllEnabledIPAddresses(tx *dbs.Tx, role string, nodeClusterId int64, upState configutils.BoolState, keyword string) (int64, error) {

internal/db/models/node_model.go

@@ -43,6 +43,12 @@ type Node struct {
 	DnsResolver            dbs.JSON `field:"dnsResolver"`            // DNS解析器
 	EnableIPLists          bool     `field:"enableIPLists"`          // 启用IP名单
 	ApiNodeAddrs           dbs.JSON `field:"apiNodeAddrs"`           // API节点地址
+	OfflineDay             string   `field:"offlineDay"`             // 下线日期YYYYMMDD
+	OfflineIsNotified      bool     `field:"offlineIsNotified"`      // 下线是否已通知
+	IsBackupForCluster     bool     `field:"isBackupForCluster"`     // 是否为集群备用节点
+	IsBackupForGroup       bool     `field:"isBackupForGroup"`       // 是否为分组备用节点
+	BackupIPs              dbs.JSON `field:"backupIPs"`              // 备用IP
+	ActionStatus           dbs.JSON `field:"actionStatus"`           // 当前动作配置
 }
 
 type NodeOperator struct {
@@ -85,6 +91,12 @@ type NodeOperator struct {
 	DnsResolver            any // DNS解析器
 	EnableIPLists          any // 启用IP名单
 	ApiNodeAddrs           any // API节点地址
+	OfflineDay             any // 下线日期YYYYMMDD
+	OfflineIsNotified      any // 下线是否已通知
+	IsBackupForCluster     any // 是否为集群备用节点
+	IsBackupForGroup       any // 是否为分组备用节点
+	BackupIPs              any // 备用IP
+	ActionStatus           any // 当前动作配置
 }
 
 func NewNodeOperator() *NodeOperator {

internal/db/models/node_model_ext.go

@@ -7,6 +7,7 @@ import (
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/ddosconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/shared"
+	timeutil "github.com/iwind/TeaGo/utils/time"
 	"sort"
 	"time"
 )
@@ -16,7 +17,7 @@ func (this *Node) DecodeInstallStatus() (*NodeInstallStatus, error) {
 	if len(this.InstallStatus) == 0 {
 		return NewNodeInstallStatus(), nil
 	}
-	status := &NodeInstallStatus{}
+	var status = &NodeInstallStatus{}
 	err := json.Unmarshal(this.InstallStatus, status)
 	if err != nil {
 		return NewNodeInstallStatus(), err
@@ -37,7 +38,7 @@ func (this *Node) DecodeStatus() (*nodeconfigs.NodeStatus, error) {
 	if len(this.Status) == 0 {
 		return nil, nil
 	}
-	status := &nodeconfigs.NodeStatus{}
+	var status = &nodeconfigs.NodeStatus{}
 	err := json.Unmarshal(this.Status, status)
 	if err != nil {
 		return nil, err
@@ -47,7 +48,7 @@ func (this *Node) DecodeStatus() (*nodeconfigs.NodeStatus, error) {
 
 // DNSRouteCodes 所有的DNS线路
 func (this *Node) DNSRouteCodes() map[int64][]string {
-	routes := map[int64][]string{} // domainId => routes
+	var routes = map[int64][]string{} // domainId => routes
 	if len(this.DnsRoutes) == 0 {
 		return routes
 	}
@@ -61,7 +62,7 @@ func (this *Node) DNSRouteCodes() map[int64][]string {
 
 // DNSRouteCodesForDomainId DNS线路
 func (this *Node) DNSRouteCodesForDomainId(dnsDomainId int64) ([]string, error) {
-	routes := map[int64][]string{} // domainId => routes
+	var routes = map[int64][]string{} // domainId => routes
 	if len(this.DnsRoutes) == 0 {
 		return nil, nil
 	}
@@ -80,7 +81,7 @@ func (this *Node) DNSRouteCodesForDomainId(dnsDomainId int64) ([]string, error)
 
 // DecodeConnectedAPINodeIds 连接的API
 func (this *Node) DecodeConnectedAPINodeIds() ([]int64, error) {
-	apiNodeIds := []int64{}
+	var apiNodeIds = []int64{}
 	if IsNotNull(this.ConnectedAPINodes) {
 		err := json.Unmarshal(this.ConnectedAPINodes, &apiNodeIds)
 		if err != nil {
@@ -214,3 +215,8 @@ func (this *Node) DecodeAPINodeAddrs() []*serverconfigs.NetworkAddressConfig {
 	}
 	return result
 }
+
+// CheckIsOffline 检查是否已经离线
+func (this *Node) CheckIsOffline() bool {
+	return len(this.OfflineDay) > 0 && this.OfflineDay < timeutil.Format("Ymd")
+}

internal/db/models/node_model_ext_schdule.go

@@ -0,0 +1,9 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build !plus
+
+package models
+
+// HasScheduleSettings 检查是否设置了调度
+func (this *Node) HasScheduleSettings() bool {
+	return false
+}

internal/db/models/node_task_dao.go

@@ -25,6 +25,9 @@ const (
 	NodeTaskTypeNodeLevelChanged          NodeTaskType = "nodeLevelChanged"          // 节点级别变化
 	NodeTaskTypeUserServersStateChanged   NodeTaskType = "userServersStateChanged"   // 用户服务状态变化
 	NodeTaskTypeUAMPolicyChanged          NodeTaskType = "uamPolicyChanged"          // UAM策略变化
+	NodeTaskTypeHTTPPagesPolicyChanged    NodeTaskType = "httpPagesPolicyChanged"    // 自定义页面变化
+	NodeTaskTypeHTTPCCPolicyChanged       NodeTaskType = "httpCCPolicyChanged"       // CC策略变化
+	NodeTaskTypeHTTP3PolicyChanged        NodeTaskType = "http3PolicyChanged"        // HTTP3策略变化
 	NodeTaskTypeUpdatingServers           NodeTaskType = "updatingServers"           // 更新一组服务
 
 	// NS相关
@@ -297,8 +300,8 @@ func (this *NodeTaskDAO) FindAllDoingNodeTasksWithClusterId(tx *dbs.Tx, role str
 		Gt("nodeId", 0).
 		Where("(isDone=0 OR (isDone=1 AND isOk=0))").
 		Desc("isDone").
-		Asc().
 		Asc("nodeId").
+		AscPk().
 		Slice(&result).
 		FindAll()
 	return

internal/db/models/node_traffic_daily_stat_dao.go

@@ -1,4 +1,4 @@
-package stats
+package models
 
 import (
 	"github.com/TeaOSLab/EdgeAPI/internal/errors"
@@ -84,7 +84,9 @@ func (this *NodeTrafficDailyStatDAO) IncreaseDailyStat(tx *dbs.Tx, clusterId int
 	if err != nil {
 		return err
 	}
-	return nil
+
+	// 触发钩子
+	return this.increaseDailyStatHook(tx, role, nodeId)
 }
 
 // FindDailyStats 获取日期之间统计

internal/db/models/node_traffic_daily_stat_dao_ext.go

@@ -0,0 +1,14 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build !plus
+
+package models
+
+import (
+	"github.com/TeaOSLab/EdgeCommon/pkg/nodeconfigs"
+	"github.com/iwind/TeaGo/dbs"
+)
+
+// 增加日统计Hook
+func (this *NodeTrafficDailyStatDAO) increaseDailyStatHook(tx *dbs.Tx, role nodeconfigs.NodeRole, nodeId int64) error {
+	return nil
+}

internal/db/models/node_traffic_daily_stat_dao_test.go

@@ -1,4 +1,4 @@
-package stats
+package models
 
 import (
 	_ "github.com/go-sql-driver/mysql"

internal/db/models/node_traffic_daily_stat_model.go

@@ -1,4 +1,4 @@
-package stats
+package models
 
 // NodeTrafficDailyStat 总的流量统计（按天）
 type NodeTrafficDailyStat struct {

internal/db/models/node_traffic_daily_stat_model_ext.go

@@ -0,0 +1 @@
+package models

internal/db/models/node_value_dao.go

@@ -37,11 +37,15 @@ func init() {
 
 // CreateValue 创建值
 func (this *NodeValueDAO) CreateValue(tx *dbs.Tx, clusterId int64, role nodeconfigs.NodeRole, nodeId int64, item string, valueJSON []byte, createdAt int64) error {
+	if len(valueJSON) == 0 {
+		return errors.New("'valueJSON' should not be nil")
+	}
+
 	var day = timeutil.FormatTime("Ymd", createdAt)
 	var hour = timeutil.FormatTime("YmdH", createdAt)
 	var minute = timeutil.FormatTime("YmdHi", createdAt)
 
-	return this.Query(tx).
+	err := this.Query(tx).
 		InsertOrUpdateQuickly(maps.Map{
 			"clusterId": clusterId,
 			"role":      role,
@@ -55,6 +59,17 @@ func (this *NodeValueDAO) CreateValue(tx *dbs.Tx, clusterId int64, role nodeconf
 		}, maps.Map{
 			"value": valueJSON,
 		})
+	if err != nil {
+		return err
+	}
+
+	// 触发钩子
+	err = this.nodeValueHook(tx, role, nodeId, item, valueJSON)
+	if err != nil {
+		return err
+	}
+
+	return nil
 }
 
 // Clean 清除数据
@@ -324,7 +339,7 @@ func (this *NodeValueDAO) SumNodeClusterValues(tx *dbs.Tx, role string, clusterI
 
 // FindLatestNodeValue 获取最近一条数据
 func (this *NodeValueDAO) FindLatestNodeValue(tx *dbs.Tx, role string, nodeId int64, item string) (*NodeValue, error) {
-	fromMinute := timeutil.FormatTime("YmdHi", time.Now().Unix()-int64(60))
+	var fromMinute = timeutil.FormatTime("YmdHi", time.Now().Unix()-int64(60))
 
 	one, err := this.Query(tx).
 		Attr("role", role).

internal/db/models/node_value_dao_ext.go

@@ -0,0 +1,14 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build !plus
+
+package models
+
+import (
+	"github.com/TeaOSLab/EdgeCommon/pkg/nodeconfigs"
+	"github.com/iwind/TeaGo/dbs"
+)
+
+// 节点值变更Hook
+func (this *NodeValueDAO) nodeValueHook(tx *dbs.Tx, role nodeconfigs.NodeRole, nodeId int64, item nodeconfigs.NodeValueItem, valueJSON []byte) error {
+	return nil
+}

internal/db/models/ns_cluster_model.go

@@ -15,6 +15,7 @@ type NSCluster struct {
 	Tcp             dbs.JSON `field:"tcp"`             // TCP设置
 	Tls             dbs.JSON `field:"tls"`             // TLS设置
 	Udp             dbs.JSON `field:"udp"`             // UDP设置
+	Doh             dbs.JSON `field:"doh"`             // DoH设置
 	DdosProtection  dbs.JSON `field:"ddosProtection"`  // DDoS防护设置
 	Hosts           dbs.JSON `field:"hosts"`           // DNS主机地址
 	Soa             dbs.JSON `field:"soa"`             // SOA配置
@@ -39,6 +40,7 @@ type NSClusterOperator struct {
 	Tcp             any // TCP设置
 	Tls             any // TLS设置
 	Udp             any // UDP设置
+	Doh             any // DoH设置
 	DdosProtection  any // DDoS防护设置
 	Hosts           any // DNS主机地址
 	Soa             any // SOA配置

internal/db/models/ns_node_dao.go

@@ -93,6 +93,7 @@ func (this *NSNodeDAO) CountAllLowerVersionNodesWithClusterId(tx *dbs.Tx, cluste
 	return this.Query(tx).
 		State(NSNodeStateEnabled).
 		Attr("clusterId", clusterId).
+		Attr("isOn", true).
 		Where("status IS NOT NULL").
 		Where("JSON_EXTRACT(status, '$.os')=:os").
 		Where("JSON_EXTRACT(status, '$.arch')=:arch").
@@ -161,6 +162,7 @@ func (this *NSNodeDAO) UpdateNodeStatus(tx *dbs.Tx, nodeId int64, nodeStatus *no
 func (this *NSNodeDAO) CountAllLowerVersionNodes(tx *dbs.Tx, version string) (int64, error) {
 	return this.Query(tx).
 		State(NSNodeStateEnabled).
+		Attr("isOn", true).
 		Where("clusterId IN (SELECT id FROM "+SharedNSClusterDAO.Table+" WHERE state=1)").
 		Where("status IS NOT NULL").
 		Where("(JSON_EXTRACT(status, '$.buildVersionCode') IS NULL OR JSON_EXTRACT(status, '$.buildVersionCode')<:version)").

internal/db/models/origin_dao.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"github.com/TeaOSLab/EdgeAPI/internal/utils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/ossconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/shared"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/sslconfigs"
 	_ "github.com/go-sql-driver/mysql"
@@ -91,7 +92,8 @@ func (this *OriginDAO) CreateOrigin(tx *dbs.Tx,
 	adminId int64,
 	userId int64,
 	name string,
-	addrJSON string,
+	addrJSON []byte,
+	ossConfig *ossconfigs.OSSConfig,
 	description string,
 	weight int32, isOn bool,
 	connTimeout *shared.TimeDuration,
@@ -141,7 +143,18 @@ func (this *OriginDAO) CreateOrigin(tx *dbs.Tx,
 		op.MaxIdleConns = 0
 	}
 
-	op.Addr = addrJSON
+	if len(addrJSON) > 0 {
+		op.Addr = addrJSON
+	}
+
+	if ossConfig != nil {
+		ossConfigJSON, err := json.Marshal(ossConfig)
+		if err != nil {
+			return 0, err
+		}
+		op.Oss = ossConfigJSON
+	}
+
 	op.Description = description
 	if weight < 0 {
 		weight = 0
@@ -182,7 +195,8 @@ func (this *OriginDAO) CreateOrigin(tx *dbs.Tx,
 func (this *OriginDAO) UpdateOrigin(tx *dbs.Tx,
 	originId int64,
 	name string,
-	addrJSON string,
+	addrJSON []byte,
+	ossConfig *ossconfigs.OSSConfig,
 	description string,
 	weight int32,
 	isOn bool,
@@ -201,7 +215,17 @@ func (this *OriginDAO) UpdateOrigin(tx *dbs.Tx,
 	var op = NewOriginOperator()
 	op.Id = originId
 	op.Name = name
+
 	op.Addr = addrJSON
+
+	if ossConfig != nil {
+		ossConfigJSON, err := json.Marshal(ossConfig)
+		if err != nil {
+			return err
+		}
+		op.Oss = ossConfigJSON
+	}
+
 	op.Description = description
 	if weight < 0 {
 		weight = 0
@@ -369,6 +393,7 @@ func (this *OriginDAO) ComposeOriginConfig(tx *dbs.Tx, originId int64, dataMap *
 		FollowPort:   origin.FollowPort,
 	}
 
+	// addr
 	if IsNotNull(origin.Addr) {
 		var addr = &serverconfigs.NetworkAddressConfig{}
 		err = json.Unmarshal(origin.Addr, addr)
@@ -378,6 +403,16 @@ func (this *OriginDAO) ComposeOriginConfig(tx *dbs.Tx, originId int64, dataMap *
 		config.Addr = addr
 	}
 
+	// oss
+	if IsNotNull(origin.Oss) {
+		var ossConfig = ossconfigs.NewOSSConfig()
+		err = json.Unmarshal(origin.Oss, ossConfig)
+		if err != nil {
+			return nil, err
+		}
+		config.OSS = ossConfig
+	}
+
 	if IsNotNull(origin.ConnTimeout) {
 		var connTimeout = &shared.TimeDuration{}
 		err = json.Unmarshal(origin.ConnTimeout, &connTimeout)

internal/db/models/origin_model.go

@@ -11,6 +11,7 @@ type Origin struct {
 	Name               string   `field:"name"`               // 名称
 	Version            uint32   `field:"version"`            // 版本
 	Addr               dbs.JSON `field:"addr"`               // 地址
+	Oss                dbs.JSON `field:"oss"`                // OSS配置
 	Description        string   `field:"description"`        // 描述
 	Code               string   `field:"code"`               // 代号
 	Weight             uint32   `field:"weight"`             // 权重
@@ -34,33 +35,34 @@ type Origin struct {
 }
 
 type OriginOperator struct {
-	Id                 interface{} // ID
-	AdminId            interface{} // 管理员ID
-	UserId             interface{} // 用户ID
-	IsOn               interface{} // 是否启用
-	Name               interface{} // 名称
-	Version            interface{} // 版本
-	Addr               interface{} // 地址
-	Description        interface{} // 描述
-	Code               interface{} // 代号
-	Weight             interface{} // 权重
-	ConnTimeout        interface{} // 连接超时
-	ReadTimeout        interface{} // 读超时
-	IdleTimeout        interface{} // 空闲连接超时
-	MaxFails           interface{} // 最多失败次数
-	MaxConns           interface{} // 最大并发连接数
-	MaxIdleConns       interface{} // 最多空闲连接数
-	HttpRequestURI     interface{} // 转发后的请求URI
-	HttpRequestHeader  interface{} // 请求Header配置
-	HttpResponseHeader interface{} // 响应Header配置
-	Host               interface{} // 自定义主机名
-	HealthCheck        interface{} // 健康检查设置
-	Cert               interface{} // 证书设置
-	Ftp                interface{} // FTP相关设置
-	CreatedAt          interface{} // 创建时间
-	Domains            interface{} // 所属域名
-	FollowPort         interface{} // 端口跟随
-	State              interface{} // 状态
+	Id                 any // ID
+	AdminId            any // 管理员ID
+	UserId             any // 用户ID
+	IsOn               any // 是否启用
+	Name               any // 名称
+	Version            any // 版本
+	Addr               any // 地址
+	Oss                any // OSS配置
+	Description        any // 描述
+	Code               any // 代号
+	Weight             any // 权重
+	ConnTimeout        any // 连接超时
+	ReadTimeout        any // 读超时
+	IdleTimeout        any // 空闲连接超时
+	MaxFails           any // 最多失败次数
+	MaxConns           any // 最大并发连接数
+	MaxIdleConns       any // 最多空闲连接数
+	HttpRequestURI     any // 转发后的请求URI
+	HttpRequestHeader  any // 请求Header配置
+	HttpResponseHeader any // 响应Header配置
+	Host               any // 自定义主机名
+	HealthCheck        any // 健康检查设置
+	Cert               any // 证书设置
+	Ftp                any // FTP相关设置
+	CreatedAt          any // 创建时间
+	Domains            any // 所属域名
+	FollowPort         any // 端口跟随
+	State              any // 状态
 }
 
 func NewOriginOperator() *OriginOperator {

internal/db/models/regions/region_province_dao.go

@@ -122,7 +122,7 @@ func (this *RegionProvinceDAO) FindAllEnabledProvincesWithCountryId(tx *dbs.Tx,
 	_, err = this.Query(tx).
 		State(RegionProvinceStateEnabled).
 		Attr("countryId", countryId).
-		Asc().
+		AscPk().
 		Slice(&result).
 		FindAll()
 	return
@@ -132,7 +132,7 @@ func (this *RegionProvinceDAO) FindAllEnabledProvincesWithCountryId(tx *dbs.Tx,
 func (this *RegionProvinceDAO) FindAllEnabledProvinces(tx *dbs.Tx) (result []*RegionProvince, err error) {
 	_, err = this.Query(tx).
 		State(RegionProvinceStateEnabled).
-		Asc().
+		AscPk().
 		Slice(&result).
 		FindAll()
 	return

internal/db/models/server_dao.go

@@ -354,6 +354,9 @@ func (this *ServerDAO) UpdateServerBasic(tx *dbs.Tx, serverId int64, name string
 
 // UpdateServerGroupIds 修改服务所在分组
 func (this *ServerDAO) UpdateServerGroupIds(tx *dbs.Tx, serverId int64, groupIds []int64) error {
+	if serverId <= 0 {
+		return errors.New("serverId should not be smaller than 0")
+	}
 	if groupIds == nil {
 		groupIds = []int64{}
 	}
@@ -390,6 +393,10 @@ func (this *ServerDAO) UpdateUserServerBasic(tx *dbs.Tx, serverId int64, name st
 
 // UpdateServerIsOn 修复服务是否启用
 func (this *ServerDAO) UpdateServerIsOn(tx *dbs.Tx, serverId int64, isOn bool) error {
+	if serverId <= 0 {
+		return errors.New("serverId should not be smaller than 0")
+	}
+
 	_, err := this.Query(tx).
 		Pk(serverId).
 		Set("isOn", isOn).
@@ -1594,12 +1601,16 @@ func (this *ServerDAO) FindAllEnabledServersWithDomain(tx *dbs.Tx, domain string
 }
 
 // FindEnabledServerWithDomain 根据域名查找服务集群ID
-func (this *ServerDAO) FindEnabledServerWithDomain(tx *dbs.Tx, domain string) (server *Server, err error) {
+func (this *ServerDAO) FindEnabledServerWithDomain(tx *dbs.Tx, userId int64, domain string) (server *Server, err error) {
 	if len(domain) == 0 {
 		return
 	}
 
-	one, err := this.Query(tx).
+	var query = this.Query(tx)
+	if userId > 0 {
+		query.Attr("userId", userId)
+	}
+	one, err := query.
 		State(ServerStateEnabled).
 		Where("JSON_CONTAINS(plainServerNames, :domain)").
 		Param("domain", strconv.Quote(domain)).
@@ -1618,7 +1629,11 @@ func (this *ServerDAO) FindEnabledServerWithDomain(tx *dbs.Tx, domain string) (s
 	var dotIndex = strings.Index(domain, ".")
 	if dotIndex > 0 {
 		var wildcardDomain = "*." + domain[dotIndex+1:]
-		one, err = this.Query(tx).
+		var wildcardQuery = this.Query(tx)
+		if userId > 0 {
+			wildcardQuery.Attr("userId", userId)
+		}
+		one, err = wildcardQuery.
 			State(ServerStateEnabled).
 			Where("JSON_CONTAINS(plainServerNames, :domain)").
 			Param("domain", strconv.Quote(wildcardDomain)).
@@ -2145,6 +2160,10 @@ func (this *ServerDAO) FindFirstHTTPOrHTTPSPortWithClusterId(tx *dbs.Tx, cluster
 
 // NotifyServerPortsUpdate 通知服务端口变化
 func (this *ServerDAO) NotifyServerPortsUpdate(tx *dbs.Tx, serverId int64) error {
+	if serverId <= 0 {
+		return nil
+	}
+
 	one, err := this.Query(tx).
 		Pk(serverId).
 		Result("tcp", "tls", "udp", "http", "https").
@@ -2472,6 +2491,10 @@ func (this *ServerDAO) UpdateServerTrafficLimitStatus(tx *dbs.Tx, trafficLimitCo
 
 // IncreaseServerTotalTraffic 增加服务的总流量
 func (this *ServerDAO) IncreaseServerTotalTraffic(tx *dbs.Tx, serverId int64, bytes int64) error {
+	if serverId <= 0 {
+		return errors.New("serverId should not be smaller than 0")
+	}
+
 	var gb = float64(bytes) / (1 << 30)
 	var day = timeutil.Format("Ymd")
 	var month = timeutil.Format("Ym")
@@ -2531,6 +2554,10 @@ func (this *ServerDAO) UpdateServersClusterIdWithPlanId(tx *dbs.Tx, planId int64
 
 // UpdateServerUserPlanId 设置服务所属套餐
 func (this *ServerDAO) UpdateServerUserPlanId(tx *dbs.Tx, serverId int64, userPlanId int64) error {
+	if serverId <= 0 {
+		return errors.New("serverId should not be smaller than 0")
+	}
+
 	oldClusterId, err := this.Query(tx).
 		Pk(serverId).
 		Result("clusterId").
@@ -2638,6 +2665,10 @@ func (this *ServerDAO) UpdateServerUserPlanId(tx *dbs.Tx, serverId int64, userPl
 
 // FindServerLastUserPlanIdAndUserId 查找最后使用的套餐
 func (this *ServerDAO) FindServerLastUserPlanIdAndUserId(tx *dbs.Tx, serverId int64) (userPlanId int64, userId int64, err error) {
+	if serverId <= 0 {
+		return 0, 0, errors.New("serverId should not be smaller than 0")
+	}
+
 	one, err := this.Query(tx).
 		Pk(serverId).
 		Result("lastUserPlanId", "userId").
@@ -2651,6 +2682,10 @@ func (this *ServerDAO) FindServerLastUserPlanIdAndUserId(tx *dbs.Tx, serverId in
 
 // UpdateServerUAM 开启UAM
 func (this *ServerDAO) UpdateServerUAM(tx *dbs.Tx, serverId int64, uamConfig *serverconfigs.UAMConfig) error {
+	if serverId <= 0 {
+		return errors.New("serverId should not be smaller than 0")
+	}
+
 	if uamConfig == nil {
 		return nil
 	}
@@ -2824,6 +2859,10 @@ func (this *ServerDAO) FindEnabledServersWithIds(tx *dbs.Tx, serverIds []int64)
 
 // NotifyUpdate 同步服务所在的集群
 func (this *ServerDAO) NotifyUpdate(tx *dbs.Tx, serverId int64) error {
+	if serverId <= 0 {
+		return nil
+	}
+
 	// 创建任务
 	clusterId, err := this.FindServerClusterId(tx, serverId)
 	if err != nil {
@@ -2837,6 +2876,9 @@ func (this *ServerDAO) NotifyUpdate(tx *dbs.Tx, serverId int64) error {
 
 // NotifyClusterUpdate 同步指定的集群
 func (this *ServerDAO) NotifyClusterUpdate(tx *dbs.Tx, clusterId, serverId int64) error {
+	if serverId <= 0 {
+		return nil
+	}
 	if clusterId <= 0 {
 		return nil
 	}
@@ -2845,6 +2887,10 @@ func (this *ServerDAO) NotifyClusterUpdate(tx *dbs.Tx, clusterId, serverId int64
 
 // NotifyDNSUpdate 通知当前集群DNS更新
 func (this *ServerDAO) NotifyDNSUpdate(tx *dbs.Tx, serverId int64) error {
+	if serverId <= 0 {
+		return nil
+	}
+
 	clusterId, err := this.Query(tx).
 		Pk(serverId).
 		Result("clusterId").
@@ -2870,6 +2916,10 @@ func (this *ServerDAO) NotifyDNSUpdate(tx *dbs.Tx, serverId int64) error {
 
 // NotifyClusterDNSUpdate 通知某个集群中的DNS更新
 func (this *ServerDAO) NotifyClusterDNSUpdate(tx *dbs.Tx, clusterId int64, serverId int64) error {
+	if serverId <= 0 {
+		return nil
+	}
+
 	dnsInfo, err := SharedNodeClusterDAO.FindClusterDNSInfo(tx, clusterId, nil)
 	if err != nil {
 		return err
@@ -2885,6 +2935,10 @@ func (this *ServerDAO) NotifyClusterDNSUpdate(tx *dbs.Tx, clusterId int64, serve
 
 // NotifyDisable 通知禁用
 func (this *ServerDAO) NotifyDisable(tx *dbs.Tx, serverId int64) error {
+	if serverId <= 0 {
+		return nil
+	}
+
 	// 禁用缓存策略相关的内容
 	policyIds, err := SharedHTTPFirewallPolicyDAO.FindFirewallPolicyIdsWithServerId(tx, serverId)
 	if err != nil {

internal/db/models/server_dao_test.go

@@ -229,7 +229,7 @@ func TestServerDAO_FindEnabledServerWithDomain(t *testing.T) {
 
 	for _, domain := range []string{"a", "a.com", "teaos.cn", "www.teaos.cn", "cdn.teaos.cn", "google.com"} {
 		var before = time.Now()
-		server, err := dao.FindEnabledServerWithDomain(tx, domain)
+		server, err := dao.FindEnabledServerWithDomain(tx, 0, domain)
 		var costMs = time.Since(before).Seconds() * 1000
 		if err != nil {
 			t.Fatal(err)

internal/db/models/ssl_policy_dao.go

@@ -100,7 +100,8 @@ func (this *SSLPolicyDAO) ComposePolicyConfig(tx *dbs.Tx, policyId int64, ignore
 	config.Id = int64(policy.Id)
 	config.IsOn = policy.IsOn
 	config.ClientAuthType = int(policy.ClientAuthType)
-	config.HTTP2Enabled = policy.Http2Enabled == 1
+	config.HTTP2Enabled = policy.Http2Enabled
+	config.HTTP3Enabled = policy.Http3Enabled
 	config.MinVersion = policy.MinVersion
 
 	// certs
@@ -200,7 +201,7 @@ func (this *SSLPolicyDAO) FindAllEnabledPolicyIdsWithCertId(tx *dbs.Tx, certId i
 }
 
 // CreatePolicy 创建Policy
-func (this *SSLPolicyDAO) CreatePolicy(tx *dbs.Tx, adminId int64, userId int64, http2Enabled bool, minVersion string, certsJSON []byte, hstsJSON []byte, ocspIsOn bool, clientAuthType int32, clientCACertsJSON []byte, cipherSuitesIsOn bool, cipherSuites []string) (int64, error) {
+func (this *SSLPolicyDAO) CreatePolicy(tx *dbs.Tx, adminId int64, userId int64, http2Enabled bool, http3Enabled bool, minVersion string, certsJSON []byte, hstsJSON []byte, ocspIsOn bool, clientAuthType int32, clientCACertsJSON []byte, cipherSuitesIsOn bool, cipherSuites []string) (int64, error) {
 	var op = NewSSLPolicyOperator()
 	op.State = SSLPolicyStateEnabled
 	op.IsOn = true
@@ -208,6 +209,7 @@ func (this *SSLPolicyDAO) CreatePolicy(tx *dbs.Tx, adminId int64, userId int64,
 	op.UserId = userId
 
 	op.Http2Enabled = http2Enabled
+	op.Http3Enabled = http3Enabled
 	op.MinVersion = minVersion
 
 	if len(certsJSON) > 0 {
@@ -240,7 +242,7 @@ func (this *SSLPolicyDAO) CreatePolicy(tx *dbs.Tx, adminId int64, userId int64,
 }
 
 // UpdatePolicy 修改Policy
-func (this *SSLPolicyDAO) UpdatePolicy(tx *dbs.Tx, policyId int64, http2Enabled bool, minVersion string, certsJSON []byte, hstsJSON []byte, ocspIsOn bool, clientAuthType int32, clientCACertsJSON []byte, cipherSuitesIsOn bool, cipherSuites []string) error {
+func (this *SSLPolicyDAO) UpdatePolicy(tx *dbs.Tx, policyId int64, http2Enabled bool, http3Enabled bool, minVersion string, certsJSON []byte, hstsJSON []byte, ocspIsOn bool, clientAuthType int32, clientCACertsJSON []byte, cipherSuitesIsOn bool, cipherSuites []string) error {
 	if policyId <= 0 {
 		return errors.New("invalid policyId")
 	}
@@ -248,6 +250,7 @@ func (this *SSLPolicyDAO) UpdatePolicy(tx *dbs.Tx, policyId int64, http2Enabled
 	var op = NewSSLPolicyOperator()
 	op.Id = policyId
 	op.Http2Enabled = http2Enabled
+	op.Http3Enabled = http3Enabled
 	op.MinVersion = minVersion
 
 	if len(certsJSON) > 0 {

internal/db/models/ssl_policy_model.go

@@ -7,7 +7,7 @@ type SSLPolicy struct {
 	Id               uint32   `field:"id"`               // ID
 	AdminId          uint32   `field:"adminId"`          // 管理员ID
 	UserId           uint32   `field:"userId"`           // 用户ID
-	IsOn             bool    `field:"isOn"`             // 是否启用
+	IsOn             bool     `field:"isOn"`             // 是否启用
 	Certs            dbs.JSON `field:"certs"`            // 证书列表
 	ClientCACerts    dbs.JSON `field:"clientCACerts"`    // 客户端证书
 	ClientAuthType   uint32   `field:"clientAuthType"`   // 客户端认证类型
@@ -15,28 +15,30 @@ type SSLPolicy struct {
 	CipherSuitesIsOn uint8    `field:"cipherSuitesIsOn"` // 是否自定义加密算法套件
 	CipherSuites     dbs.JSON `field:"cipherSuites"`     // 加密算法套件
 	Hsts             dbs.JSON `field:"hsts"`             // HSTS设置
-	Http2Enabled     uint8    `field:"http2Enabled"`     // 是否启用HTTP/2
+	Http2Enabled     bool     `field:"http2Enabled"`     // 是否启用HTTP/2
+	Http3Enabled     bool     `field:"http3Enabled"`     // 是否启用HTTP/3
 	OcspIsOn         uint8    `field:"ocspIsOn"`         // 是否启用OCSP
 	State            uint8    `field:"state"`            // 状态
 	CreatedAt        uint64   `field:"createdAt"`        // 创建时间
 }
 
 type SSLPolicyOperator struct {
-	Id               interface{} // ID
-	AdminId          interface{} // 管理员ID
-	UserId           interface{} // 用户ID
-	IsOn             interface{} // 是否启用
-	Certs            interface{} // 证书列表
-	ClientCACerts    interface{} // 客户端证书
-	ClientAuthType   interface{} // 客户端认证类型
-	MinVersion       interface{} // 支持的SSL最小版本
-	CipherSuitesIsOn interface{} // 是否自定义加密算法套件
-	CipherSuites     interface{} // 加密算法套件
-	Hsts             interface{} // HSTS设置
-	Http2Enabled     interface{} // 是否启用HTTP/2
-	OcspIsOn         interface{} // 是否启用OCSP
-	State            interface{} // 状态
-	CreatedAt        interface{} // 创建时间
+	Id               any // ID
+	AdminId          any // 管理员ID
+	UserId           any // 用户ID
+	IsOn             any // 是否启用
+	Certs            any // 证书列表
+	ClientCACerts    any // 客户端证书
+	ClientAuthType   any // 客户端认证类型
+	MinVersion       any // 支持的SSL最小版本
+	CipherSuitesIsOn any // 是否自定义加密算法套件
+	CipherSuites     any // 加密算法套件
+	Hsts             any // HSTS设置
+	Http2Enabled     any // 是否启用HTTP/2
+	Http3Enabled     any // 是否启用HTTP/3
+	OcspIsOn         any // 是否启用OCSP
+	State            any // 状态
+	CreatedAt        any // 创建时间
 }
 
 func NewSSLPolicyOperator() *SSLPolicyOperator {

internal/db/models/stats/node_traffic_daily_stat_model_ext.go

@@ -1 +0,0 @@
-package stats

internal/db/models/sys_event_dao.go

@@ -51,7 +51,7 @@ func (this *SysEventDAO) CreateEvent(tx *dbs.Tx, event EventInterface) error {
 // 查找事件
 func (this *SysEventDAO) FindEvents(tx *dbs.Tx, size int64) (result []*SysEvent, err error) {
 	_, err = this.Query(tx).
-		Asc().
+		AscPk().
 		Limit(size).
 		Slice(&result).
 		FindAll()

internal/db/models/updating_server_list_dao.go

@@ -82,7 +82,7 @@ func (this *UpdatingServerListDAO) FindLists(tx *dbs.Tx, clusterIds []int64, las
 	_, err = this.Query(tx).
 		Attr("clusterId", clusterIds). // 即使clusterIds数量是变化的，这里也不需要使用Reuse(false)，因为clusterIds通常数量有限
 		Gt("id", lastId).
-		Asc(). // 非常重要
+		AscPk(). // 非常重要
 		Slice(&result).
 		FindAll()
 	return

internal/db/models/user_node_dao.go

@@ -280,6 +280,7 @@ func (this *UserNodeDAO) UpdateNodeStatus(tx *dbs.Tx, nodeId int64, nodeStatus *
 func (this *UserNodeDAO) CountAllLowerVersionNodes(tx *dbs.Tx, version string) (int64, error) {
 	return this.Query(tx).
 		State(UserNodeStateEnabled).
+		Attr("isOn", true).
 		Where("status IS NOT NULL").
 		Where("(JSON_EXTRACT(status, '$.buildVersionCode') IS NULL OR JSON_EXTRACT(status, '$.buildVersionCode')<:version)").
 		Param("version", utils.VersionToLong(version)).

internal/dnsclients/types_ext.go

@@ -1,10 +1,11 @@
 // Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
 //go:build !plus
-// +build !plus
 
 package dnsclients
 
-import "github.com/iwind/TeaGo/maps"
+import (
+	"github.com/iwind/TeaGo/maps"
+)
 
 // FindProvider 查找服务商实例
 func FindProvider(providerType ProviderType, providerId int64) ProviderInterface {

internal/nodes/api_node.go

@@ -28,6 +28,7 @@ import (
 	"github.com/iwind/gosock/pkg/gosock"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/status"
 	"gopkg.in/yaml.v3"
 	"log"
 	"net"
@@ -309,7 +310,7 @@ func (this *APINode) checkDB() error {
 		// 决定是否尝试启动本地的MySQL
 		if strings.Contains(err.Error(), "connection refused") {
 			config, _ := db.Config()
-			if config != nil && (strings.Contains(config.Dsn, "tcp(127.0.0.1:") || strings.Contains(config.Dsn, "tcp(localhost:)")) && os.Getgid() == 0 /** ROOT 用户 **/ {
+			if config != nil && (strings.Contains(config.Dsn, "tcp(127.0.0.1:") || strings.Contains(config.Dsn, "tcp(localhost:")) && os.Getgid() == 0 /** ROOT 用户 **/ {
 				var mysqldSafeFile = "/usr/local/mysql/bin/mysqld_safe"
 				_, err = os.Stat(mysqldSafeFile)
 				if err == nil {
@@ -832,7 +833,12 @@ func (this *APINode) unaryInterceptor(ctx context.Context, req any, info *grpc.U
 	}
 	result, err := handler(ctx, req)
 	if err != nil {
-		err = errors.New("'" + info.FullMethod + "()' says: " + err.Error())
+		statusErr, ok := status.FromError(err)
+		if ok {
+			err = status.Error(statusErr.Code(), "'" + info.FullMethod + "()' says: " + err.Error())
+		} else {
+			err = errors.New("'" + info.FullMethod + "()' says: " + err.Error())
+		}
 	}
 	return result, err
 }

internal/rpc/services/service_acme_task.go

@@ -420,6 +420,12 @@ func (this *ACMETaskService) FindEnabledACMETask(ctx context.Context, req *pb.Fi
 		}
 	}
 
+	// 证书
+	var pbCert *pb.SSLCert
+	if task.CertId > 0 {
+		pbCert = &pb.SSLCert{Id: int64(task.CertId)}
+	}
+
 	return &pb.FindEnabledACMETaskResponse{AcmeTask: &pb.ACMETask{
 		Id:          int64(task.Id),
 		IsOn:        task.IsOn,
@@ -431,5 +437,6 @@ func (this *ACMETaskService) FindEnabledACMETask(ctx context.Context, req *pb.Fi
 		AcmeUser:    pbACMEUser,
 		AuthType:    task.AuthType,
 		AuthURL:     task.AuthURL,
+		SslCert:     pbCert,
 	}}, nil
 }

internal/rpc/services/service_admin.go

@@ -369,7 +369,11 @@ func (this *AdminService) CountAllEnabledAdmins(ctx context.Context, req *pb.Cou
 		return nil, err
 	}
 
-	count, err := models.SharedAdminDAO.CountAllEnabledAdmins(tx, req.Keyword, isSuperAdmin && req.HasWeakPassword)
+	if !isSuperAdmin && req.HasWeakPassword {
+		return this.SuccessCount(0)
+	}
+
+	count, err := models.SharedAdminDAO.CountAllEnabledAdmins(tx, req.Keyword, req.HasWeakPassword)
 	if err != nil {
 		return nil, err
 	}
@@ -393,7 +397,11 @@ func (this *AdminService) ListEnabledAdmins(ctx context.Context, req *pb.ListEna
 		return nil, err
 	}
 
-	admins, err := models.SharedAdminDAO.ListEnabledAdmins(tx, req.Keyword, isSuperAdmin && req.HasWeakPassword, req.Offset, req.Size)
+	if !isSuperAdmin && req.HasWeakPassword {
+		return &pb.ListEnabledAdminsResponse{Admins: nil}, nil
+	}
+
+	admins, err := models.SharedAdminDAO.ListEnabledAdmins(tx, req.Keyword, req.HasWeakPassword, req.Offset, req.Size)
 	if err != nil {
 		return nil, err
 	}

internal/rpc/services/service_base.go

@@ -16,7 +16,9 @@ import (
 	"github.com/iwind/TeaGo/dbs"
 	"github.com/iwind/TeaGo/lists"
 	"github.com/iwind/TeaGo/maps"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
 )
 
 type BaseService struct {
@@ -229,7 +231,7 @@ func (this *BaseService) PermissionError() error {
 }
 
 func (this *BaseService) NotImplementedYet() error {
-	return errors.New("not implemented yet")
+	return status.Error(codes.Unimplemented, "not implemented yet")
 }
 
 // NullTx 空的数据库事务

internal/rpc/services/service_dns_domain.go

@@ -472,13 +472,14 @@ func (this *DNSDomainService) findClusterDNSChanges(cluster *models.NodeCluster,
 	var nodeKeys = []string{}
 	var addingNodeRecordKeysMap = map[string]bool{} // clusterDnsName_type_ip_route
 	for _, node := range nodes {
-		ipAddresses, err := models.SharedNodeIPAddressDAO.FindNodeAccessAndUpIPAddresses(tx, int64(node.Id), nodeconfigs.NodeRoleNode)
+		shouldSkip, shouldOverwrite, ipAddressesStrings, err := models.SharedNodeDAO.CheckNodeIPAddresses(tx, node)
 		if err != nil {
 			return nil, nil, nil, 0, 0, false, false, err
 		}
-		if len(ipAddresses) == 0 {
+		if shouldSkip {
 			continue
 		}
+
 		routeCodes, err := node.DNSRouteCodesForDomainId(int64(cluster.DnsDomainId))
 		if err != nil {
 			return nil, nil, nil, 0, 0, false, false, err
@@ -491,7 +492,16 @@ func (this *DNSDomainService) findClusterDNSChanges(cluster *models.NodeCluster,
 				continue
 			}
 		}
-		for _, route := range routeCodes {
+
+		if !shouldOverwrite {
+			ipAddresses, err := models.SharedNodeIPAddressDAO.FindNodeAccessAndUpIPAddresses(tx, int64(node.Id), nodeconfigs.NodeRoleNode)
+			if err != nil {
+				return nil, nil, nil, 0, 0, false, false, err
+			}
+			if len(ipAddresses) == 0 {
+				continue
+			}
+
 			for _, ipAddress := range ipAddresses {
 				// 检查专属节点
 				if !ipAddress.IsValidInCluster(clusterId) {
@@ -505,6 +515,16 @@ func (this *DNSDomainService) findClusterDNSChanges(cluster *models.NodeCluster,
 				if net.ParseIP(ip) == nil {
 					continue
 				}
+
+				ipAddressesStrings = append(ipAddressesStrings, ip)
+			}
+		}
+		if len(ipAddressesStrings) == 0 {
+			continue
+		}
+
+		for _, route := range routeCodes {
+			for _, ip := range ipAddressesStrings {
 				var key = ip + "_" + route
 				nodeKeys = append(nodeKeys, key)
 				record, ok := nodeRecordMapping[key]

internal/rpc/services/service_dns_task.go

@@ -62,7 +62,7 @@ func (this *DNSTaskService) FindAllDoingDNSTasks(ctx context.Context, req *pb.Fi
 		}
 
 		switch task.Type {
-		case dns.DNSTaskTypeClusterChange, dns.DNSTaskTypeClusterRemoveDomain:
+		case dns.DNSTaskTypeClusterChange, dns.DNSTaskTypeClusterNodesChange, dns.DNSTaskTypeClusterRemoveDomain:
 			clusterName, err := models.SharedNodeClusterDAO.FindNodeClusterName(tx, int64(task.ClusterId))
 			if err != nil {
 				return nil, err

internal/rpc/services/service_http_cache_task.go

@@ -131,7 +131,7 @@ func (this *HTTPCacheTaskService) CreateHTTPCacheTask(ctx context.Context, req *
 		// 查询所在集群
 		server, ok := domainMap[domain]
 		if !ok {
-			server, err = models.SharedServerDAO.FindEnabledServerWithDomain(tx, domain)
+			server, err = models.SharedServerDAO.FindEnabledServerWithDomain(tx, userId, domain)
 			if err != nil {
 				return nil, err
 			}

internal/rpc/services/service_http_cache_task_key.go

@@ -5,8 +5,10 @@ package services
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"github.com/TeaOSLab/EdgeAPI/internal/db/models"
 	"github.com/TeaOSLab/EdgeAPI/internal/utils"
+	"github.com/TeaOSLab/EdgeAPI/internal/utils/regexputils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/iwind/TeaGo/dbs"
 )
@@ -35,7 +37,8 @@ func (this *HTTPCacheTaskKeyService) ValidateHTTPCacheTaskKeys(ctx context.Conte
 	}
 
 	var pbFailResults = []*pb.ValidateHTTPCacheTaskKeysResponse_FailKey{}
-	var domainMap = map[string]*models.Server{} // domain name => *Server
+	var foundDomainMap = map[string]*models.Server{} // domain name => *Server
+	var missingDomainMap = map[string]bool{}         // domain name => true
 	for _, key := range req.Keys {
 		if len(key) == 0 {
 			pbFailResults = append(pbFailResults, &pb.ValidateHTTPCacheTaskKeysResponse_FailKey{
@@ -55,21 +58,31 @@ func (this *HTTPCacheTaskKeyService) ValidateHTTPCacheTaskKeys(ctx context.Conte
 			continue
 		}
 
+		// 是否不存在
+		if missingDomainMap[domain] {
+			pbFailResults = append(pbFailResults, &pb.ValidateHTTPCacheTaskKeysResponse_FailKey{
+				Key:        key,
+				ReasonCode: "requireServer",
+			})
+			continue
+		}
+
 		// 查询所在集群
-		server, ok := domainMap[domain]
+		server, ok := foundDomainMap[domain]
 		if !ok {
-			server, err = models.SharedServerDAO.FindEnabledServerWithDomain(tx, domain)
+			server, err = models.SharedServerDAO.FindEnabledServerWithDomain(tx, userId, domain)
 			if err != nil {
 				return nil, err
 			}
 			if server == nil {
+				missingDomainMap[domain] = true
 				pbFailResults = append(pbFailResults, &pb.ValidateHTTPCacheTaskKeysResponse_FailKey{
 					Key:        key,
 					ReasonCode: "requireServer",
 				})
 				continue
 			}
-			domainMap[domain] = server
+			foundDomainMap[domain] = server
 		}
 
 		// 检查用户
@@ -171,3 +184,22 @@ func (this *HTTPCacheTaskKeyService) UpdateHTTPCacheTaskKeysStatus(ctx context.C
 
 	return this.Success()
 }
+
+// CountHTTPCacheTaskKeysWithDay 计算当天已经清理的Key数量
+func (this *HTTPCacheTaskKeyService) CountHTTPCacheTaskKeysWithDay(ctx context.Context, req *pb.CountHTTPCacheTaskKeysWithDayRequest) (*pb.RPCCountResponse, error) {
+	userId, err := this.ValidateUserNode(ctx, true)
+	if err != nil {
+		return nil, err
+	}
+
+	if !regexputils.YYYYMMDD.MatchString(req.Day) {
+		return nil, errors.New("invalid format 'day'")
+	}
+
+	var tx = this.NullTx()
+	countKeys, err := models.SharedHTTPCacheTaskKeyDAO.CountUserTasksInDay(tx, userId, req.Day, req.KeyType)
+	if err != nil {
+		return nil, err
+	}
+	return this.SuccessCount(countKeys)
+}

internal/rpc/services/service_http_header_policy.go

@@ -202,7 +202,7 @@ func (this *HTTPHeaderPolicyService) UpdateHTTPHeaderPolicyCORS(ctx context.Cont
 		}
 	}
 
-	var corsConfig = &shared.HTTPCORSHeaderConfig{}
+	var corsConfig = shared.NewHTTPCORSHeaderConfig()
 	err = json.Unmarshal(req.CorsJSON, corsConfig)
 	if err != nil {
 		return nil, err
@@ -219,3 +219,28 @@ func (this *HTTPHeaderPolicyService) UpdateHTTPHeaderPolicyCORS(ctx context.Cont
 
 	return this.Success()
 }
+
+// UpdateHTTPHeaderPolicyNonStandardHeaders 修改非标的Headers
+func (this *HTTPHeaderPolicyService) UpdateHTTPHeaderPolicyNonStandardHeaders(ctx context.Context, req *pb.UpdateHTTPHeaderPolicyNonStandardHeadersRequest) (*pb.RPCSuccess, error) {
+	_, userId, err := this.ValidateAdminAndUser(ctx, true)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+
+	// 检查权限
+	if userId > 0 {
+		err = models.SharedHTTPHeaderPolicyDAO.CheckUserHeaderPolicy(tx, userId, req.HttpHeaderPolicyId)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	err = models.SharedHTTPHeaderPolicyDAO.UpdateNonStandardHeaders(tx, req.HttpHeaderPolicyId, req.HeaderNames)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.Success()
+}

internal/rpc/services/service_http_web.go

@@ -318,7 +318,22 @@ func (this *HTTPWebService) UpdateHTTPWebPages(ctx context.Context, req *pb.Upda
 
 	var tx = this.NullTx()
 
-	err = models.SharedHTTPWebDAO.UpdateWebPages(tx, req.HttpWebId, req.PagesJSON)
+	// 检查配置
+	var pages = []*serverconfigs.HTTPPageConfig{}
+	err = json.Unmarshal(req.PagesJSON, &pages)
+	if err != nil {
+		return nil, errors.New("decode 'pages' failed: " + err.Error())
+	}
+	var newPages = []*serverconfigs.HTTPPageConfig{}
+	for _, page := range pages {
+		newPages = append(newPages, &serverconfigs.HTTPPageConfig{Id: page.Id})
+	}
+	newPagesJSON, err := json.Marshal(newPages)
+	if err != nil {
+		return nil, err
+	}
+
+	err = models.SharedHTTPWebDAO.UpdateWebPages(tx, req.HttpWebId, newPagesJSON)
 	if err != nil {
 		return nil, err
 	}

internal/rpc/services/service_node.go

@@ -384,6 +384,9 @@ func (this *NodeService) ListEnabledNodesMatch(ctx context.Context, req *pb.List
 			NodeRegion:            pbRegion,
 			DnsRoutes:             pbRoutes,
 			Level:                 int32(node.Level),
+			OfflineDay:            node.OfflineDay,
+			IsBackupForCluster:    node.IsBackupForCluster,
+			IsBackupForGroup:      node.IsBackupForGroup,
 		})
 	}
 
@@ -683,6 +686,9 @@ func (this *NodeService) FindEnabledNode(ctx context.Context, req *pb.FindEnable
 		DnsRoutes:              pbRoutes,
 		EnableIPLists:          node.EnableIPLists,
 		ApiNodeAddrsJSON:       node.ApiNodeAddrs,
+		OfflineDay:             node.OfflineDay,
+		IsBackupForCluster:     node.IsBackupForCluster,
+		IsBackupForGroup:       node.IsBackupForGroup,
 	}}, nil
 }
 
@@ -1397,12 +1403,15 @@ func (this *NodeService) FindAllEnabledNodesDNSWithNodeClusterId(ctx context.Con
 				continue
 			}
 			result = append(result, &pb.NodeDNSInfo{
-				Id:              int64(node.Id),
-				Name:            node.Name,
-				IpAddr:          ip,
-				NodeIPAddressId: int64(ipAddress.Id),
-				Routes:          pbRoutes,
-				NodeClusterId:   req.NodeClusterId,
+				Id:                 int64(node.Id),
+				Name:               node.Name,
+				IpAddr:             ip,
+				NodeIPAddressId:    int64(ipAddress.Id),
+				Routes:             pbRoutes,
+				NodeClusterId:      req.NodeClusterId,
+				IsBackupForCluster: node.IsBackupForCluster,
+				IsBackupForGroup:   node.IsBackupForGroup,
+				IsOffline:          node.CheckIsOffline(),
 			})
 		}
 	}
@@ -1497,6 +1506,9 @@ func (this *NodeService) FindEnabledNodeDNS(ctx context.Context, req *pb.FindEna
 			NodeClusterDNSName: clusterDNS.DnsName,
 			DnsDomainId:        dnsDomainId,
 			DnsDomainName:      dnsDomainName,
+			IsBackupForCluster: node.IsBackupForCluster,
+			IsBackupForGroup:   node.IsBackupForGroup,
+			IsOffline:          node.CheckIsOffline(),
 		},
 	}, nil
 }
@@ -2097,6 +2109,11 @@ func (this *NodeService) FindEnabledNodeConfigInfo(ctx context.Context, req *pb.
 	// ddos protection
 	result.HasDDoSProtection = node.HasDDoSProtection()
 
+	// schedule
+	result.HasScheduleSettings = node.HasScheduleSettings()
+
+	// pages
+
 	return result, nil
 }
 
@@ -2240,39 +2257,3 @@ func (this *NodeService) UpdateNodeAPIConfig(ctx context.Context, req *pb.Update
 
 	return this.Success()
 }
-
-// FindNodeUAMPolicies 查找节点的UAM策略
-func (this *NodeService) FindNodeUAMPolicies(ctx context.Context, req *pb.FindNodeUAMPoliciesRequest) (*pb.FindNodeUAMPoliciesResponse, error) {
-	nodeId, err := this.ValidateNode(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	var tx = this.NullTx()
-	clusterIds, err := models.SharedNodeDAO.FindEnabledAndOnNodeClusterIds(tx, nodeId)
-	if err != nil {
-		return nil, err
-	}
-
-	var pbPolicies = []*pb.FindNodeUAMPoliciesResponse_UAMPolicy{}
-	for _, clusterId := range clusterIds {
-		policy, err := models.SharedNodeClusterDAO.FindClusterUAMPolicy(tx, clusterId, nil)
-		if err != nil {
-			return nil, err
-		}
-		if policy == nil {
-			continue
-		}
-		policyJSON, err := json.Marshal(policy)
-		if err != nil {
-			return nil, err
-		}
-		pbPolicies = append(pbPolicies, &pb.FindNodeUAMPoliciesResponse_UAMPolicy{
-			NodeClusterId: clusterId,
-			UamPolicyJSON: policyJSON,
-		})
-	}
-	return &pb.FindNodeUAMPoliciesResponse{
-		UamPolicies: pbPolicies,
-	}, nil
-}

internal/rpc/services/service_node_cluster.go

@@ -3,6 +3,7 @@ package services
 import (
 	"context"
 	"encoding/json"
+	teaconst "github.com/TeaOSLab/EdgeAPI/internal/const"
 	"github.com/TeaOSLab/EdgeAPI/internal/db/models"
 	"github.com/TeaOSLab/EdgeAPI/internal/db/models/dns"
 	"github.com/TeaOSLab/EdgeAPI/internal/db/models/dns/dnsutils"
@@ -1140,6 +1141,18 @@ func (this *NodeClusterService) FindEnabledNodeClusterConfigInfo(ctx context.Con
 		result.UamIsOn = nodeconfigs.DefaultUAMPolicy.IsOn
 	}
 
+	// HTTP CC
+	if models.IsNotNull(cluster.Cc) {
+		var httpCCPolicy = nodeconfigs.NewHTTPCCPolicy()
+		err = json.Unmarshal(cluster.Cc, httpCCPolicy)
+		if err != nil {
+			return nil, err
+		}
+		result.HttpCCIsOn = httpCCPolicy.IsOn
+	} else {
+		result.HttpCCIsOn = nodeconfigs.NewHTTPCCPolicy().IsOn
+	}
+
 	// system service
 	if models.IsNotNull(cluster.SystemServices) {
 		var servicesMap = map[string]maps.Map{}
@@ -1157,6 +1170,26 @@ func (this *NodeClusterService) FindEnabledNodeClusterConfigInfo(ctx context.Con
 	// ddos
 	result.HasDDoSProtection = cluster.HasDDoSProtection()
 
+	// HTTP Pages
+	if models.IsNotNull(cluster.HttpPages) {
+		var pagesPolicy = nodeconfigs.NewHTTPPagesPolicy()
+		err = json.Unmarshal(cluster.HttpPages, pagesPolicy)
+		if err != nil {
+			return nil, err
+		}
+		result.HasHTTPPagesPolicy = pagesPolicy.IsOn && len(pagesPolicy.Pages) > 0
+	}
+
+	// HTTP/3
+	if models.IsNotNull(cluster.Http3) {
+		var http3Policy = nodeconfigs.NewHTTP3Policy()
+		err = json.Unmarshal(cluster.Http3, http3Policy)
+		if err != nil {
+			return nil, err
+		}
+		result.Http3IsOn = http3Policy.IsOn
+	}
+
 	return result, nil
 }
 
@@ -1225,6 +1258,10 @@ func (this *NodeClusterService) UpdateNodeClusterWebPPolicy(ctx context.Context,
 
 // FindEnabledNodeClusterUAMPolicy 读取集群UAM策略
 func (this *NodeClusterService) FindEnabledNodeClusterUAMPolicy(ctx context.Context, req *pb.FindEnabledNodeClusterUAMPolicyRequest) (*pb.FindEnabledNodeClusterUAMPolicyResponse, error) {
+	if !teaconst.IsPlus {
+		return nil, this.NotImplementedYet()
+	}
+
 	_, _, err := this.ValidateAdminAndUser(ctx, false)
 	if err != nil {
 		return nil, err
@@ -1246,6 +1283,10 @@ func (this *NodeClusterService) FindEnabledNodeClusterUAMPolicy(ctx context.Cont
 
 // UpdateNodeClusterUAMPolicy 设置集群的UAM策略
 func (this *NodeClusterService) UpdateNodeClusterUAMPolicy(ctx context.Context, req *pb.UpdateNodeClusterUAMPolicyRequest) (*pb.RPCSuccess, error) {
+	if !teaconst.IsPlus {
+		return nil, this.NotImplementedYet()
+	}
+
 	_, err := this.ValidateAdmin(ctx)
 	if err != nil {
 		return nil, err
@@ -1270,6 +1311,61 @@ func (this *NodeClusterService) UpdateNodeClusterUAMPolicy(ctx context.Context,
 	return this.Success()
 }
 
+// FindEnabledNodeClusterHTTPCCPolicy 读取集群HTTP CC策略
+func (this *NodeClusterService) FindEnabledNodeClusterHTTPCCPolicy(ctx context.Context, req *pb.FindEnabledNodeClusterHTTPCCPolicyRequest) (*pb.FindEnabledNodeClusterHTTPCCPolicyResponse, error) {
+	if !teaconst.IsPlus {
+		return nil, this.NotImplementedYet()
+	}
+
+	_, _, err := this.ValidateAdminAndUser(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	httpCCPolicy, err := models.SharedNodeClusterDAO.FindClusterHTTPCCPolicy(tx, req.NodeClusterId, nil)
+	if err != nil {
+		return nil, err
+	}
+	httpCCPolicyJSON, err := json.Marshal(httpCCPolicy)
+	if err != nil {
+		return nil, err
+	}
+	return &pb.FindEnabledNodeClusterHTTPCCPolicyResponse{
+		HttpCCPolicyJSON: httpCCPolicyJSON,
+	}, nil
+}
+
+// UpdateNodeClusterHTTPCCPolicy 设置集群的HTTP CC策略
+func (this *NodeClusterService) UpdateNodeClusterHTTPCCPolicy(ctx context.Context, req *pb.UpdateNodeClusterHTTPCCPolicyRequest) (*pb.RPCSuccess, error) {
+	if !teaconst.IsPlus {
+		return nil, this.NotImplementedYet()
+	}
+
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var httpCCPolicy = nodeconfigs.NewHTTPCCPolicy()
+	err = json.Unmarshal(req.HttpCCPolicyJSON, httpCCPolicy)
+	if err != nil {
+		return nil, err
+	}
+
+	err = httpCCPolicy.Init()
+	if err != nil {
+		return nil, errors.New("validate http cc policy failed: " + err.Error())
+	}
+
+	var tx = this.NullTx()
+	err = models.SharedNodeClusterDAO.UpdateClusterHTTPCCPolicy(tx, req.NodeClusterId, httpCCPolicy)
+	if err != nil {
+		return nil, err
+	}
+	return this.Success()
+}
+
 // FindNodeClusterDDoSProtection 获取集群的DDoS设置
 func (this *NodeClusterService) FindNodeClusterDDoSProtection(ctx context.Context, req *pb.FindNodeClusterDDoSProtectionRequest) (*pb.FindNodeClusterDDoSProtectionResponse, error) {
 	_, err := this.ValidateAdmin(ctx)
@@ -1367,3 +1463,81 @@ func (this *NodeClusterService) UpdateNodeClusterGlobalServerConfig(ctx context.
 
 	return this.Success()
 }
+
+// FindNodeClusterHTTPPagesPolicy 获取集群的自定义页面设置
+func (this *NodeClusterService) FindNodeClusterHTTPPagesPolicy(ctx context.Context, req *pb.FindNodeClusterHTTPPagesPolicyRequest) (*pb.FindNodeClusterHTTPPagesPolicyResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	httpPagesPolicy, err := models.SharedNodeClusterDAO.FindClusterHTTPPagesPolicy(tx, req.NodeClusterId, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	httpPagesPolicyJSON, err := json.Marshal(httpPagesPolicy)
+	if err != nil {
+		return nil, err
+	}
+	return &pb.FindNodeClusterHTTPPagesPolicyResponse{
+		HttpPagesPolicyJSON: httpPagesPolicyJSON,
+	}, nil
+}
+
+// UpdateNodeClusterHTTPPagesPolicy 修改集群的自定义页面设置
+func (this *NodeClusterService) UpdateNodeClusterHTTPPagesPolicy(ctx context.Context, req *pb.UpdateNodeClusterHTTPPagesPolicyRequest) (*pb.RPCSuccess, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	var policy = nodeconfigs.NewHTTPPagesPolicy()
+	err = json.Unmarshal(req.HttpPagesPolicyJSON, policy)
+	if err != nil {
+		return nil, err
+	}
+	err = policy.Init()
+	if err != nil {
+		return nil, errors.New("validate policy failed: " + err.Error())
+	}
+
+	err = models.SharedNodeClusterDAO.UpdateClusterHTTPPagesPolicy(tx, req.NodeClusterId, policy)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.Success()
+}
+
+// UpdateNodeClusterHTTP3Policy 修改集群的HTTP3设置
+func (this *NodeClusterService) UpdateNodeClusterHTTP3Policy(ctx context.Context, req *pb.UpdateNodeClusterHTTP3PolicyRequest) (*pb.RPCSuccess, error) {
+	if !teaconst.IsPlus {
+		return nil, this.NotImplementedYet()
+	}
+
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var http3Policy = nodeconfigs.NewHTTP3Policy()
+	err = json.Unmarshal(req.Http3PolicyJSON, http3Policy)
+	if err != nil {
+		return nil, err
+	}
+
+	err = http3Policy.Init()
+	if err != nil {
+		return nil, errors.New("validate http3 policy failed: " + err.Error())
+	}
+
+	var tx = this.NullTx()
+	err = models.SharedNodeClusterDAO.UpdateClusterHTTP3Policy(tx, req.NodeClusterId, http3Policy)
+	if err != nil {
+		return nil, err
+	}
+	return this.Success()
+}

internal/rpc/services/service_node_cluster_ext.go

@@ -0,0 +1,13 @@
+// Copyright 2023 GoEdge CDN goedge.cdn@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build !plus
+
+package services
+
+import (
+	"context"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+)
+
+func (this *NodeClusterService) FindNodeClusterHTTP3Policy(ctx context.Context, req *pb.FindNodeClusterHTTP3PolicyRequest) (*pb.FindNodeClusterHTTP3PolicyResponse, error) {
+	return nil, this.NotImplementedYet()
+}

internal/rpc/services/service_node_ext.go

@@ -0,0 +1,49 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build !plus
+
+package services
+
+import (
+	"context"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+)
+
+func (this *NodeService) FindNodeUAMPolicies(ctx context.Context, req *pb.FindNodeUAMPoliciesRequest) (*pb.FindNodeUAMPoliciesResponse, error) {
+	return nil, this.NotImplementedYet()
+}
+
+func (this *NodeService) FindNodeHTTPCCPolicies(ctx context.Context, req *pb.FindNodeHTTPCCPoliciesRequest) (*pb.FindNodeHTTPCCPoliciesResponse, error) {
+	return nil, this.NotImplementedYet()
+}
+
+func (this *NodeService) FindNodeHTTP3Policies(ctx context.Context, req *pb.FindNodeHTTP3PoliciesRequest) (*pb.FindNodeHTTP3PoliciesResponse, error) {
+	return nil, this.NotImplementedYet()
+}
+
+func (this *NodeService) FindNodeHTTPPagesPolicies(ctx context.Context, req *pb.FindNodeHTTPPagesPoliciesRequest) (*pb.FindNodeHTTPPagesPoliciesResponse, error) {
+	return nil, this.NotImplementedYet()
+}
+
+func (this *NodeService) FindNodeScheduleInfo(ctx context.Context, req *pb.FindNodeScheduleInfoRequest) (*pb.FindNodeScheduleInfoResponse, error) {
+	return nil, this.NotImplementedYet()
+}
+
+func (this *NodeService) UpdateNodeScheduleInfo(ctx context.Context, req *pb.UpdateNodeScheduleInfoRequest) (*pb.RPCSuccess, error) {
+	return nil, this.NotImplementedYet()
+}
+
+func (this *NodeService) ResetNodeActionStatus(ctx context.Context, req *pb.ResetNodeActionStatusRequest) (*pb.RPCSuccess, error) {
+	return nil, this.NotImplementedYet()
+}
+
+func (this *NodeService) FindAllNodeScheduleInfoWithNodeClusterId(ctx context.Context, req *pb.FindAllNodeScheduleInfoWithNodeClusterIdRequest) (*pb.FindAllNodeScheduleInfoWithNodeClusterIdResponse, error) {
+	return nil, this.NotImplementedYet()
+}
+
+func (this *NodeService) CopyNodeActionsToNodeGroup(ctx context.Context, req *pb.CopyNodeActionsToNodeGroupRequest) (*pb.RPCSuccess, error) {
+	return nil, this.NotImplementedYet()
+}
+
+func (this *NodeService) CopyNodeActionsToNodeCluster(ctx context.Context, req *pb.CopyNodeActionsToNodeClusterRequest) (*pb.RPCSuccess, error) {
+	return nil, this.NotImplementedYet()
+}

internal/rpc/services/service_origin.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"github.com/TeaOSLab/EdgeAPI/internal/db/models"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/ossconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/shared"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/sslconfigs"
 	"github.com/iwind/TeaGo/maps"
@@ -23,15 +24,26 @@ func (this *OriginService) CreateOrigin(ctx context.Context, req *pb.CreateOrigi
 		return nil, err
 	}
 
+	// 源站地址设置
 	if req.Addr == nil {
 		return nil, errors.New("'addr' can not be nil")
 	}
-	addrMap := maps.Map{
+	var addrMap = maps.Map{
 		"protocol":  req.Addr.Protocol,
 		"portRange": req.Addr.PortRange,
 		"host":      req.Addr.Host,
 	}
 
+	// OSS设置
+	var ossConfig *ossconfigs.OSSConfig
+	if len(req.OssJSON) > 0 {
+		ossConfig = ossconfigs.NewOSSConfig()
+		err = json.Unmarshal(req.OssJSON, ossConfig)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	var tx = this.NullTx()
 
 	// 校验参数
@@ -72,7 +84,7 @@ func (this *OriginService) CreateOrigin(ctx context.Context, req *pb.CreateOrigi
 		}
 	}
 
-	originId, err := models.SharedOriginDAO.CreateOrigin(tx, adminId, userId, req.Name, string(addrMap.AsJSON()), req.Description, req.Weight, req.IsOn, connTimeout, readTimeout, idleTimeout, req.MaxConns, req.MaxIdleConns, certRef, req.Domains, req.Host, req.FollowPort)
+	originId, err := models.SharedOriginDAO.CreateOrigin(tx, adminId, userId, req.Name, addrMap.AsJSON(), ossConfig, req.Description, req.Weight, req.IsOn, connTimeout, readTimeout, idleTimeout, req.MaxConns, req.MaxIdleConns, certRef, req.Domains, req.Host, req.FollowPort)
 	if err != nil {
 		return nil, err
 	}
@@ -95,6 +107,8 @@ func (this *OriginService) UpdateOrigin(ctx context.Context, req *pb.UpdateOrigi
 			return nil, err
 		}
 	}
+
+	// 源站地址设置
 	if req.Addr == nil {
 		return nil, errors.New("'addr' can not be nil")
 	}
@@ -104,6 +118,16 @@ func (this *OriginService) UpdateOrigin(ctx context.Context, req *pb.UpdateOrigi
 		"host":      req.Addr.Host,
 	}
 
+	// OSS设置
+	var ossConfig *ossconfigs.OSSConfig
+	if len(req.OssJSON) > 0 {
+		ossConfig = ossconfigs.NewOSSConfig()
+		err = json.Unmarshal(req.OssJSON, ossConfig)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	// 校验参数
 	var connTimeout = &shared.TimeDuration{}
 	if len(req.ConnTimeoutJSON) > 0 {
@@ -142,7 +166,7 @@ func (this *OriginService) UpdateOrigin(ctx context.Context, req *pb.UpdateOrigi
 		}
 	}
 
-	err = models.SharedOriginDAO.UpdateOrigin(tx, req.OriginId, req.Name, string(addrMap.AsJSON()), req.Description, req.Weight, req.IsOn, connTimeout, readTimeout, idleTimeout, req.MaxConns, req.MaxIdleConns, certRef, req.Domains, req.Host, req.FollowPort)
+	err = models.SharedOriginDAO.UpdateOrigin(tx, req.OriginId, req.Name, addrMap.AsJSON(), ossConfig, req.Description, req.Weight, req.IsOn, connTimeout, readTimeout, idleTimeout, req.MaxConns, req.MaxIdleConns, certRef, req.Domains, req.Host, req.FollowPort)
 	if err != nil {
 		return nil, err
 	}

internal/rpc/services/service_server.go

@@ -9,13 +9,17 @@ import (
 	"github.com/TeaOSLab/EdgeAPI/internal/db/models/clients"
 	"github.com/TeaOSLab/EdgeAPI/internal/db/models/dns"
 	"github.com/TeaOSLab/EdgeAPI/internal/utils"
+	"github.com/TeaOSLab/EdgeAPI/internal/utils/domainutils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/sslconfigs"
 	"github.com/iwind/TeaGo/dbs"
 	"github.com/iwind/TeaGo/lists"
 	"github.com/iwind/TeaGo/maps"
 	"github.com/iwind/TeaGo/types"
 	timeutil "github.com/iwind/TeaGo/utils/time"
+	"net"
+	"net/url"
 	"regexp"
 	"strings"
 )
@@ -184,6 +188,505 @@ func (this *ServerService) CreateServer(ctx context.Context, req *pb.CreateServe
 	return &pb.CreateServerResponse{ServerId: serverId}, nil
 }
 
+// CreateBasicHTTPServer 快速创建基本的HTTP网站
+func (this *ServerService) CreateBasicHTTPServer(ctx context.Context, req *pb.CreateBasicHTTPServerRequest) (*pb.CreateBasicHTTPServerResponse, error) {
+	adminId, userId, err := this.ValidateAdminAndUser(ctx, true)
+	if err != nil {
+		return nil, err
+	}
+
+	// 集群
+	var tx = this.NullTx()
+	if userId > 0 {
+		req.UserId = userId
+
+		nodeClusterId, err := models.SharedUserDAO.FindUserClusterId(tx, userId)
+		if err != nil {
+			return nil, err
+		}
+		req.NodeClusterId = nodeClusterId
+	} else if adminId > 0 && req.UserId > 0 && req.NodeClusterId <= 0 {
+		// check user
+		existUser, err := models.SharedUserDAO.Exist(tx, req.UserId)
+		if err != nil {
+			return nil, err
+		}
+		if !existUser {
+			return nil, errors.New("user id '" + types.String(req.UserId) + "' not found")
+		}
+
+		nodeClusterId, err := models.SharedUserDAO.FindUserClusterId(tx, userId)
+		if err != nil {
+			return nil, err
+		}
+		req.NodeClusterId = nodeClusterId
+	}
+
+	if req.NodeClusterId <= 0 {
+		return nil, errors.New("invalid 'nodeClusterId'")
+	}
+
+	if len(req.Domains) == 0 {
+		return nil, errors.New("'domains' should not be empty")
+	}
+	var serverNames = []*serverconfigs.ServerNameConfig{}
+	for _, domain := range req.Domains {
+		domain = strings.ToLower(domain)
+		if !domainutils.ValidateDomainFormat(domain) {
+			return nil, errors.New("invalid domain format '" + domain + "'")
+		}
+
+		// 检查域名是否已存在
+		existServerName, err := models.SharedServerDAO.ExistServerNameInCluster(tx, req.NodeClusterId, domain, 0, true)
+		if err != nil {
+			return nil, err
+		}
+		if existServerName {
+			return nil, errors.New("domain '" + domain + "' already created by other server")
+		}
+
+		serverNames = append(serverNames, &serverconfigs.ServerNameConfig{Name: domain})
+	}
+	serverNamesJSON, err := json.Marshal(serverNames)
+	if err != nil {
+		return nil, errors.New("encode 'serverNames' failed: " + err.Error())
+	}
+
+	// 是否需要审核
+	var isAuditing = false
+	var auditingServerNamesJSON = []byte("[]")
+	if userId > 0 {
+		// 如果域名不为空的时候需要审核
+		if len(serverNamesJSON) > 0 && string(serverNamesJSON) != "[]" {
+			globalConfig, err := models.SharedSysSettingDAO.ReadGlobalConfig(tx)
+			if err != nil {
+				return nil, err
+			}
+			if globalConfig != nil && globalConfig.HTTPAll.DomainAuditingIsOn {
+				isAuditing = true
+				serverNamesJSON = []byte("[]")
+				auditingServerNamesJSON = serverNamesJSON
+			}
+		}
+	}
+
+	// HTTP
+	var httpConfig = &serverconfigs.HTTPProtocolConfig{
+		BaseProtocol: serverconfigs.BaseProtocol{
+			IsOn: true,
+			Listen: []*serverconfigs.NetworkAddressConfig{
+				{
+					Protocol:  "http",
+					PortRange: "80",
+				},
+			},
+		},
+	}
+	httpJSON, err := json.Marshal(httpConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	// HTTPS
+	var certRefs = []*sslconfigs.SSLCertRef{}
+	for _, certId := range req.SslCertIds {
+		// 检查所有权
+		if userId > 0 {
+			err = models.SharedSSLCertDAO.CheckUserCert(tx, certId, userId)
+			if err != nil {
+				return nil, errors.New("check cert permission failed: " + err.Error())
+			}
+		} else {
+			existCert, err := models.SharedSSLCertDAO.Exist(tx, certId)
+			if err != nil {
+				return nil, err
+			}
+			if !existCert {
+				return nil, errors.New("cert '" + types.String(certId) + "' not found")
+			}
+		}
+
+		certRefs = append(certRefs, &sslconfigs.SSLCertRef{
+			IsOn:   true,
+			CertId: certId,
+		})
+	}
+	certRefsJSON, err := json.Marshal(certRefs)
+	if err != nil {
+		return nil, err
+	}
+	sslPolicyId, err := models.SharedSSLPolicyDAO.CreatePolicy(tx, adminId, req.UserId, false, false, "TLS 1.0", certRefsJSON, nil, false, 0, nil, false, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	var httpsConfig = &serverconfigs.HTTPSProtocolConfig{
+		BaseProtocol: serverconfigs.BaseProtocol{
+			IsOn: true,
+			Listen: []*serverconfigs.NetworkAddressConfig{
+				{
+					Protocol:  "https",
+					PortRange: "443",
+				},
+			},
+		},
+		SSLPolicyRef: &sslconfigs.SSLPolicyRef{
+			IsOn:        true,
+			SSLPolicyId: sslPolicyId,
+		},
+	}
+	httpsJSON, err := json.Marshal(httpsConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	// Reverse Proxy
+	var reverseProxyScheduleConfig = &serverconfigs.SchedulingConfig{
+		Code:    "random",
+		Options: nil,
+	}
+	reverseProxyScheduleJSON, err := json.Marshal(reverseProxyScheduleConfig)
+
+	var primaryOrigins = []*serverconfigs.OriginRef{}
+	for _, originAddr := range req.OriginAddrs {
+		u, err := url.Parse(originAddr)
+		if err != nil {
+			return nil, errors.New("parse origin address '" + originAddr + "' failed: " + err.Error())
+		}
+		if len(u.Scheme) == 0 || (u.Scheme != "http" && u.Scheme != "https" /** 特意不支持大写形式 **/) {
+			return nil, errors.New("invalid scheme in origin address '" + originAddr + "'")
+		}
+
+		if len(u.Host) == 0 {
+			return nil, errors.New("invalid host address '" + originAddr + "', contains no host")
+		}
+
+		host, port, err := net.SplitHostPort(u.Host)
+		if err != nil {
+			err = nil // ignore error
+
+			if domainutils.ValidateDomainFormat(u.Host) { // host with no port
+				host = u.Host
+				port = ""
+			} else {
+				return nil, errors.New("invalid host address '" + originAddr + "', invalid host format")
+			}
+		}
+
+		if len(port) == 0 {
+			switch u.Scheme {
+			case "http":
+				port = "80"
+			case "https":
+				port = "443"
+			}
+		}
+
+		var addr = &serverconfigs.NetworkAddressConfig{
+			Protocol:  serverconfigs.Protocol(u.Scheme),
+			Host:      host,
+			PortRange: port,
+		}
+		addrJSON, err := json.Marshal(addr)
+		if err != nil {
+			return nil, err
+		}
+
+		originId, err := models.SharedOriginDAO.CreateOrigin(tx, adminId, req.UserId, "", addrJSON, nil, "", 10, true, nil, nil, nil, 0, 0, nil, nil, u.Host, false)
+		if err != nil {
+			return nil, err
+		}
+		primaryOrigins = append(primaryOrigins, &serverconfigs.OriginRef{
+			IsOn:     true,
+			OriginId: originId,
+		})
+	}
+	primaryOriginsJSON, err := json.Marshal(primaryOrigins)
+	if err != nil {
+		return nil, err
+	}
+
+	reverseProxyId, err := models.SharedReverseProxyDAO.CreateReverseProxy(tx, adminId, req.UserId, reverseProxyScheduleJSON, primaryOriginsJSON, nil)
+	if err != nil {
+		return nil, err
+	}
+	reverseProxyJSON, err := json.Marshal(&serverconfigs.ReverseProxyRef{
+		IsPrior:        false,
+		IsOn:           true,
+		ReverseProxyId: reverseProxyId,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Web
+	webId, err := models.SharedHTTPWebDAO.CreateWeb(tx, adminId, req.UserId, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// Enable websocket
+	if req.EnableWebsocket {
+		websocketId, err := models.SharedHTTPWebsocketDAO.CreateWebsocket(tx, nil, true, nil, true, "")
+		if err != nil {
+			return nil, err
+		}
+		websocketRef, err := json.Marshal(&serverconfigs.HTTPWebsocketRef{
+			IsPrior:     false,
+			IsOn:        true,
+			WebsocketId: websocketId,
+		})
+		if err != nil {
+			return nil, err
+		}
+		err = models.SharedHTTPWebDAO.UpdateWebsocket(tx, webId, websocketRef)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// finally, we create ...
+	serverId, err := models.SharedServerDAO.CreateServer(tx, adminId, req.UserId, serverconfigs.ServerTypeHTTPProxy, req.Domains[0], "", serverNamesJSON, isAuditing, auditingServerNamesJSON, httpJSON, httpsJSON, nil, nil, nil, nil, webId, reverseProxyJSON, req.NodeClusterId, nil, nil, nil, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	return &pb.CreateBasicHTTPServerResponse{ServerId: serverId}, nil
+}
+
+// CreateBasicTCPServer 快速创建基本的TCP网站
+func (this *ServerService) CreateBasicTCPServer(ctx context.Context, req *pb.CreateBasicTCPServerRequest) (*pb.CreateBasicTCPServerResponse, error) {
+	adminId, userId, err := this.ValidateAdminAndUser(ctx, true)
+	if err != nil {
+		return nil, err
+	}
+
+	// 集群
+	var tx = this.NullTx()
+	if userId > 0 {
+		req.UserId = userId
+
+		nodeClusterId, err := models.SharedUserDAO.FindUserClusterId(tx, userId)
+		if err != nil {
+			return nil, err
+		}
+		req.NodeClusterId = nodeClusterId
+	} else if adminId > 0 && req.UserId > 0 && req.NodeClusterId <= 0 {
+		// check user
+		existUser, err := models.SharedUserDAO.Exist(tx, req.UserId)
+		if err != nil {
+			return nil, err
+		}
+		if !existUser {
+			return nil, errors.New("user id '" + types.String(req.UserId) + "' not found")
+		}
+
+		nodeClusterId, err := models.SharedUserDAO.FindUserClusterId(tx, userId)
+		if err != nil {
+			return nil, err
+		}
+		req.NodeClusterId = nodeClusterId
+	}
+
+	if req.NodeClusterId <= 0 {
+		return nil, errors.New("invalid 'nodeClusterId'")
+	}
+
+	// 检查用户权限
+	if userId > 0 {
+		features, err := models.SharedUserDAO.FindUserFeatures(tx, userId)
+		if err != nil {
+			return nil, err
+		}
+		var canSpecifyTCPPort = false
+		for _, feature := range features {
+			if feature.Code == "server.tcp.port" {
+				canSpecifyTCPPort = true
+				break
+			}
+		}
+		if !canSpecifyTCPPort {
+			if len(req.TcpPorts) > 0 || len(req.TlsPorts) > 0 {
+				return nil, errors.New("no permission to specify tcp/tls ports")
+			}
+		}
+	}
+
+	if len(req.TcpPorts) == 0 || len(req.TlsPorts) == 0 {
+		// TODO 未来支持自动创建端口
+		return nil, errors.New("no ports valid")
+	}
+
+	// TCP
+	var tcpConfig = &serverconfigs.HTTPProtocolConfig{
+		BaseProtocol: serverconfigs.BaseProtocol{
+			IsOn:   true,
+			Listen: []*serverconfigs.NetworkAddressConfig{},
+		},
+	}
+
+	for _, port := range req.TcpPorts {
+		existPort, err := models.SharedServerDAO.CheckPortIsUsing(tx, req.NodeClusterId, "tcp", int(port), 0, "")
+		if err != nil {
+			return nil, err
+		}
+		if existPort {
+			return nil, errors.New("port '" + types.String(port) + "' already used by other server")
+		}
+
+		tcpConfig.BaseProtocol.Listen = append(tcpConfig.BaseProtocol.Listen, &serverconfigs.NetworkAddressConfig{
+			Protocol:  "tcp",
+			PortRange: types.String(port),
+		})
+	}
+
+	tcpJSON, err := json.Marshal(tcpConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	// TLS
+	var tlsConfig = &serverconfigs.HTTPSProtocolConfig{
+		BaseProtocol: serverconfigs.BaseProtocol{
+			IsOn:   true,
+			Listen: []*serverconfigs.NetworkAddressConfig{},
+		},
+	}
+
+	for _, port := range req.TlsPorts {
+		existPort, err := models.SharedServerDAO.CheckPortIsUsing(tx, req.NodeClusterId, "tcp", int(port), 0, "")
+		if err != nil {
+			return nil, err
+		}
+		if existPort {
+			return nil, errors.New("port '" + types.String(port) + "' already used by other server")
+		}
+
+		tlsConfig.BaseProtocol.Listen = append(tlsConfig.BaseProtocol.Listen, &serverconfigs.NetworkAddressConfig{
+			Protocol:  "tls",
+			PortRange: types.String(port),
+		})
+	}
+
+	var certRefs = []*sslconfigs.SSLCertRef{}
+	for _, certId := range req.SslCertIds {
+		// 检查所有权
+		if userId > 0 {
+			err = models.SharedSSLCertDAO.CheckUserCert(tx, certId, userId)
+			if err != nil {
+				return nil, errors.New("check cert permission failed: " + err.Error())
+			}
+		} else {
+			existCert, err := models.SharedSSLCertDAO.Exist(tx, certId)
+			if err != nil {
+				return nil, err
+			}
+			if !existCert {
+				return nil, errors.New("cert '" + types.String(certId) + "' not found")
+			}
+		}
+
+		certRefs = append(certRefs, &sslconfigs.SSLCertRef{
+			IsOn:   true,
+			CertId: certId,
+		})
+	}
+	certRefsJSON, err := json.Marshal(certRefs)
+	if err != nil {
+		return nil, err
+	}
+	sslPolicyId, err := models.SharedSSLPolicyDAO.CreatePolicy(tx, adminId, req.UserId, false, false, "TLS 1.0", certRefsJSON, nil, false, 0, nil, false, nil)
+	if err != nil {
+		return nil, err
+	}
+	tlsConfig.SSLPolicyRef = &sslconfigs.SSLPolicyRef{
+		IsOn:        true,
+		SSLPolicyId: sslPolicyId,
+	}
+
+	tlsJSON, err := json.Marshal(tlsConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	// Reverse Proxy
+	var reverseProxyScheduleConfig = &serverconfigs.SchedulingConfig{
+		Code:    "random",
+		Options: nil,
+	}
+	reverseProxyScheduleJSON, err := json.Marshal(reverseProxyScheduleConfig)
+
+	var primaryOrigins = []*serverconfigs.OriginRef{}
+	for _, originAddr := range req.OriginAddrs {
+		u, err := url.Parse(originAddr)
+		if err != nil {
+			return nil, errors.New("parse origin address '" + originAddr + "' failed: " + err.Error())
+		}
+		if len(u.Scheme) == 0 || (u.Scheme != "tcp" && u.Scheme != "tls" && u.Scheme != "ssl" /** 特意不支持大写形式 **/) {
+			return nil, errors.New("invalid scheme in origin address '" + originAddr + "'")
+		}
+
+		if len(u.Host) == 0 {
+			return nil, errors.New("invalid host address '" + originAddr + "', contains no host")
+		}
+
+		host, port, err := net.SplitHostPort(u.Host)
+		if err != nil || len(host) == 0 || len(port) == 0 {
+			err = nil // ignore error
+
+			return nil, errors.New("invalid host address '" + originAddr + "', invalid host format")
+		}
+
+		if u.Scheme == "ssl" {
+			u.Scheme = "tls"
+		}
+
+		var addr = &serverconfigs.NetworkAddressConfig{
+			Protocol:  serverconfigs.Protocol(u.Scheme),
+			Host:      host,
+			PortRange: port,
+		}
+		addrJSON, err := json.Marshal(addr)
+		if err != nil {
+			return nil, err
+		}
+
+		originId, err := models.SharedOriginDAO.CreateOrigin(tx, adminId, req.UserId, "", addrJSON, nil, "", 10, true, nil, nil, nil, 0, 0, nil, nil, "", false)
+		if err != nil {
+			return nil, err
+		}
+		primaryOrigins = append(primaryOrigins, &serverconfigs.OriginRef{
+			IsOn:     true,
+			OriginId: originId,
+		})
+	}
+	primaryOriginsJSON, err := json.Marshal(primaryOrigins)
+	if err != nil {
+		return nil, err
+	}
+
+	reverseProxyId, err := models.SharedReverseProxyDAO.CreateReverseProxy(tx, adminId, req.UserId, reverseProxyScheduleJSON, primaryOriginsJSON, nil)
+	if err != nil {
+		return nil, err
+	}
+	reverseProxyJSON, err := json.Marshal(&serverconfigs.ReverseProxyRef{
+		IsPrior:        false,
+		IsOn:           true,
+		ReverseProxyId: reverseProxyId,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// finally, we create ...
+	serverId, err := models.SharedServerDAO.CreateServer(tx, adminId, req.UserId, serverconfigs.ServerTypeTCPProxy, "TCP Service", "", nil, false, nil, nil, nil, tcpJSON, tlsJSON, nil, nil, 0, reverseProxyJSON, req.NodeClusterId, nil, nil, nil, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	return &pb.CreateBasicTCPServerResponse{ServerId: serverId}, nil
+}
+
 // UpdateServerBasic 修改服务基本信息
 func (this *ServerService) UpdateServerBasic(ctx context.Context, req *pb.UpdateServerBasicRequest) (*pb.RPCSuccess, error) {
 	// 校验请求
@@ -2010,7 +2513,7 @@ func (this *ServerService) PurgeServerCache(ctx context.Context, req *pb.PurgeSe
 			// 查询所在集群
 			server, ok := domainMap[domain]
 			if !ok {
-				server, err = models.SharedServerDAO.FindEnabledServerWithDomain(tx, domain)
+				server, err = models.SharedServerDAO.FindEnabledServerWithDomain(tx, 0, domain)
 				if err != nil {
 					return nil, err
 				}

internal/rpc/services/service_server_daily_stat.go

@@ -68,7 +68,7 @@ func (this *ServerDailyStatService) UploadServerDailyStats(ctx context.Context,
 
 		// 节点流量
 		if nodeId > 0 {
-			err = stats.SharedNodeTrafficDailyStatDAO.IncreaseDailyStat(tx, clusterId, role, nodeId, timeutil.FormatTime("Ymd", stat.CreatedAt), stat.Bytes, stat.CachedBytes, stat.CountRequests, stat.CountCachedRequests, stat.CountAttackRequests, stat.AttackBytes)
+			err = models.SharedNodeTrafficDailyStatDAO.IncreaseDailyStat(tx, clusterId, role, nodeId, timeutil.FormatTime("Ymd", stat.CreatedAt), stat.Bytes, stat.CachedBytes, stat.CountRequests, stat.CountCachedRequests, stat.CountAttackRequests, stat.AttackBytes)
 			if err != nil {
 				return nil, err
 			}

internal/rpc/services/service_server_stat_board.go

@@ -325,7 +325,7 @@ func (this *ServerStatBoardService) ComposeServerStatNodeBoard(ctx context.Conte
 	}
 
 	// 当月总流量
-	monthlyTrafficStat, err := stats.SharedNodeTrafficDailyStatDAO.SumDailyStat(tx, nodeconfigs.NodeRoleNode, req.NodeId, timeutil.Format("Ym01"), timeutil.Format("Ym31"))
+	monthlyTrafficStat, err := models.SharedNodeTrafficDailyStatDAO.SumDailyStat(tx, nodeconfigs.NodeRoleNode, req.NodeId, timeutil.Format("Ym01"), timeutil.Format("Ym31"))
 	if err != nil {
 		return nil, err
 	}
@@ -335,7 +335,7 @@ func (this *ServerStatBoardService) ComposeServerStatNodeBoard(ctx context.Conte
 
 	// 按日流量统计
 	var dayFrom = timeutil.Format("Ymd", time.Now().AddDate(0, 0, -14))
-	dailyTrafficStats, err := stats.SharedNodeTrafficDailyStatDAO.FindDailyStats(tx, "node", req.NodeId, dayFrom, timeutil.Format("Ymd"))
+	dailyTrafficStats, err := models.SharedNodeTrafficDailyStatDAO.FindDailyStats(tx, "node", req.NodeId, dayFrom, timeutil.Format("Ymd"))
 	if err != nil {
 		return nil, err
 	}

internal/rpc/services/service_ssl_policy.go

@@ -44,7 +44,7 @@ func (this *SSLPolicyService) CreateSSLPolicy(ctx context.Context, req *pb.Creat
 		// TODO
 	}
 
-	policyId, err := models.SharedSSLPolicyDAO.CreatePolicy(tx, adminId, userId, req.Http2Enabled, req.MinVersion, req.SslCertsJSON, req.HstsJSON, req.OcspIsOn, req.ClientAuthType, req.ClientCACertsJSON, req.CipherSuitesIsOn, req.CipherSuites)
+	policyId, err := models.SharedSSLPolicyDAO.CreatePolicy(tx, adminId, userId, req.Http2Enabled, req.Http3Enabled, req.MinVersion, req.SslCertsJSON, req.HstsJSON, req.OcspIsOn, req.ClientAuthType, req.ClientCACertsJSON, req.CipherSuitesIsOn, req.CipherSuites)
 	if err != nil {
 		return nil, err
 	}
@@ -63,13 +63,13 @@ func (this *SSLPolicyService) UpdateSSLPolicy(ctx context.Context, req *pb.Updat
 	var tx = this.NullTx()
 
 	if userId > 0 {
-		err := models.SharedSSLPolicyDAO.CheckUserPolicy(tx, userId, req.SslPolicyId)
+		err = models.SharedSSLPolicyDAO.CheckUserPolicy(tx, userId, req.SslPolicyId)
 		if err != nil {
 			return nil, errors.New("check ssl policy failed: " + err.Error())
 		}
 	}
 
-	err = models.SharedSSLPolicyDAO.UpdatePolicy(tx, req.SslPolicyId, req.Http2Enabled, req.MinVersion, req.SslCertsJSON, req.HstsJSON, req.OcspIsOn, req.ClientAuthType, req.ClientCACertsJSON, req.CipherSuitesIsOn, req.CipherSuites)
+	err = models.SharedSSLPolicyDAO.UpdatePolicy(tx, req.SslPolicyId, req.Http2Enabled, req.Http3Enabled, req.MinVersion, req.SslCertsJSON, req.HstsJSON, req.OcspIsOn, req.ClientAuthType, req.ClientCACertsJSON, req.CipherSuitesIsOn, req.CipherSuites)
 	if err != nil {
 		return nil, err
 	}

internal/tasks/dns_task_executor.go

@@ -87,8 +87,8 @@ func (this *DNSTaskExecutor) loop() error {
 					return err
 				}
 			}
-		case dnsmodels.DNSTaskTypeClusterChange:
-			err = this.doCluster(taskId, taskVersion, int64(task.ClusterId))
+		case dnsmodels.DNSTaskTypeClusterChange, dnsmodels.DNSTaskTypeClusterNodesChange:
+			err = this.doCluster(taskId, taskVersion, int64(task.ClusterId), task.Type == dnsmodels.DNSTaskTypeClusterNodesChange)
 			if err != nil {
 				err = dnsmodels.SharedDNSTaskDAO.UpdateDNSTaskError(nil, taskId, err.Error())
 				if err != nil {
@@ -300,7 +300,7 @@ func (this *DNSTaskExecutor) doNode(taskId int64, taskVersion int64, nodeCluster
 
 	// 转交给cluster统一处理
 	if nodeClusterId > 0 {
-		err = dnsmodels.SharedDNSTaskDAO.CreateClusterTask(tx, nodeClusterId, dnsmodels.DNSTaskTypeClusterChange)
+		err = dnsmodels.SharedDNSTaskDAO.CreateClusterTask(tx, nodeClusterId, dnsmodels.DNSTaskTypeClusterNodesChange)
 		if err != nil {
 			return err
 		}
@@ -310,7 +310,7 @@ func (this *DNSTaskExecutor) doNode(taskId int64, taskVersion int64, nodeCluster
 			return err
 		}
 		for _, clusterId := range clusterIds {
-			err = dnsmodels.SharedDNSTaskDAO.CreateClusterTask(tx, clusterId, dnsmodels.DNSTaskTypeClusterChange)
+			err = dnsmodels.SharedDNSTaskDAO.CreateClusterTask(tx, clusterId, dnsmodels.DNSTaskTypeClusterNodesChange)
 			if err != nil {
 				return err
 			}
@@ -323,8 +323,8 @@ func (this *DNSTaskExecutor) doNode(taskId int64, taskVersion int64, nodeCluster
 }
 
 // 修改集群相关记录
-func (this *DNSTaskExecutor) doCluster(taskId int64, taskVersion int64, clusterId int64) error {
-	isOk := false
+func (this *DNSTaskExecutor) doCluster(taskId int64, taskVersion int64, clusterId int64, nodesOnly bool) error {
+	var isOk = false
 	defer func() {
 		if isOk {
 			err := dnsmodels.SharedDNSTaskDAO.UpdateDNSTaskDone(nil, taskId, taskVersion)
@@ -378,6 +378,14 @@ func (this *DNSTaskExecutor) doCluster(taskId int64, taskVersion int64, clusterI
 	var isChanged = false
 	var addingNodeRecordKeysMap = map[string]bool{} // clusterDnsName_type_ip_route
 	for _, node := range nodes {
+		shouldSkip, shouldOverwrite, ipAddressesStrings, err := models.SharedNodeDAO.CheckNodeIPAddresses(tx, node)
+		if err != nil {
+			return err
+		}
+		if shouldSkip {
+			continue
+		}
+
 		routes, err := node.DNSRouteCodesForDomainId(domainId)
 		if err != nil {
 			return err
@@ -387,26 +395,36 @@ func (this *DNSTaskExecutor) doCluster(taskId int64, taskVersion int64, clusterI
 		}
 
 		// 所有的IP记录
-		ipAddresses, err := models.SharedNodeIPAddressDAO.FindAllEnabledAddressesWithNode(tx, int64(node.Id), nodeconfigs.NodeRoleNode)
-		if err != nil {
-			return err
+		if !shouldOverwrite {
+			ipAddresses, err := models.SharedNodeIPAddressDAO.FindAllEnabledAddressesWithNode(tx, int64(node.Id), nodeconfigs.NodeRoleNode)
+			if err != nil {
+				return err
+			}
+			if len(ipAddresses) == 0 {
+				continue
+			}
+			for _, ipAddress := range ipAddresses {
+				// 检查专属节点
+				if !ipAddress.IsValidInCluster(clusterId) {
+					continue
+				}
+
+				var ip = ipAddress.DNSIP()
+				if len(ip) == 0 || !ipAddress.CanAccess || !ipAddress.IsUp || !ipAddress.IsOn {
+					continue
+				}
+				if net.ParseIP(ip) == nil {
+					continue
+				}
+				ipAddressesStrings = append(ipAddressesStrings, ip)
+			}
 		}
-		if len(ipAddresses) == 0 {
+
+		if len(ipAddressesStrings) == 0 {
 			continue
 		}
-		for _, ipAddress := range ipAddresses {
-			// 检查专属节点
-			if !ipAddress.IsValidInCluster(clusterId) {
-				continue
-			}
 
-			var ip = ipAddress.DNSIP()
-			if len(ip) == 0 || !ipAddress.CanAccess || !ipAddress.IsUp || !ipAddress.IsOn {
-				continue
-			}
-			if net.ParseIP(ip) == nil {
-				continue
-			}
+		for _, ip := range ipAddressesStrings {
 			for _, route := range routes {
 				var key = route + "@" + ip
 				_, ok := oldRecordsMap[key]
@@ -456,80 +474,82 @@ func (this *DNSTaskExecutor) doCluster(taskId int64, taskVersion int64, clusterI
 	}
 
 	// 服务域名
-	servers, err := models.SharedServerDAO.FindAllServersDNSWithClusterId(tx, clusterId)
-	if err != nil {
-		return err
-	}
-	serverRecords := []*dnstypes.Record{}             // 之所以用数组再存一遍，是因为dnsName可能会重复
-	serverRecordsMap := map[string]*dnstypes.Record{} // dnsName => *Record
-	for _, record := range records {
-		if record.Type == dnstypes.RecordTypeCNAME && record.Value == clusterDomain+"." {
-			serverRecords = append(serverRecords, record)
-			serverRecordsMap[record.Name] = record
+	if !nodesOnly {
+		servers, err := models.SharedServerDAO.FindAllServersDNSWithClusterId(tx, clusterId)
+		if err != nil {
+			return err
 		}
-	}
-
-	// 新增的域名
-	var serverDNSNames = []string{}
-	for _, server := range servers {
-		var dnsName = server.DnsName
-		if len(dnsName) == 0 {
-			continue
-		}
-		serverDNSNames = append(serverDNSNames, dnsName)
-		_, ok := serverRecordsMap[dnsName]
-		if !ok {
-			isChanged = true
-			err = manager.AddRecord(domain, &dnstypes.Record{
-				Id:    "",
-				Name:  dnsName,
-				Type:  dnstypes.RecordTypeCNAME,
-				Value: clusterDomain + ".",
-				Route: "", // 注意这里为空，需要在执行过程中获取默认值
-				TTL:   ttl,
-			})
-			if err != nil {
-				return err
+		serverRecords := []*dnstypes.Record{}             // 之所以用数组再存一遍，是因为dnsName可能会重复
+		serverRecordsMap := map[string]*dnstypes.Record{} // dnsName => *Record
+		for _, record := range records {
+			if record.Type == dnstypes.RecordTypeCNAME && record.Value == clusterDomain+"." {
+				serverRecords = append(serverRecords, record)
+				serverRecordsMap[record.Name] = record
 			}
 		}
-	}
 
-	// 自动设置的CNAME
-	var cnameRecords = []string{}
-	if dnsConfig != nil {
-		cnameRecords = dnsConfig.CNAMERecords
-	}
-	for _, cnameRecord := range cnameRecords {
-		// 如果记录已存在，则跳过
-		if lists.ContainsString(serverDNSNames, cnameRecord) {
-			continue
-		}
-
-		serverDNSNames = append(serverDNSNames, cnameRecord)
-		_, ok := serverRecordsMap[cnameRecord]
-		if !ok {
-			isChanged = true
-			err = manager.AddRecord(domain, &dnstypes.Record{
-				Id:    "",
-				Name:  cnameRecord,
-				Type:  dnstypes.RecordTypeCNAME,
-				Value: clusterDomain + ".",
-				Route: "", // 注意这里为空，需要在执行过程中获取默认值
-				TTL:   ttl,
-			})
-			if err != nil {
-				return err
+		// 新增的域名
+		var serverDNSNames = []string{}
+		for _, server := range servers {
+			var dnsName = server.DnsName
+			if len(dnsName) == 0 {
+				continue
+			}
+			serverDNSNames = append(serverDNSNames, dnsName)
+			_, ok := serverRecordsMap[dnsName]
+			if !ok {
+				isChanged = true
+				err = manager.AddRecord(domain, &dnstypes.Record{
+					Id:    "",
+					Name:  dnsName,
+					Type:  dnstypes.RecordTypeCNAME,
+					Value: clusterDomain + ".",
+					Route: "", // 注意这里为空，需要在执行过程中获取默认值
+					TTL:   ttl,
+				})
+				if err != nil {
+					return err
+				}
 			}
 		}
-	}
 
-	// 多余的域名
-	for _, record := range serverRecords {
-		if !lists.ContainsString(serverDNSNames, record.Name) {
-			isChanged = true
-			err = manager.DeleteRecord(domain, record)
-			if err != nil {
-				return err
+		// 自动设置的CNAME
+		var cnameRecords = []string{}
+		if dnsConfig != nil {
+			cnameRecords = dnsConfig.CNAMERecords
+		}
+		for _, cnameRecord := range cnameRecords {
+			// 如果记录已存在，则跳过
+			if lists.ContainsString(serverDNSNames, cnameRecord) {
+				continue
+			}
+
+			serverDNSNames = append(serverDNSNames, cnameRecord)
+			_, ok := serverRecordsMap[cnameRecord]
+			if !ok {
+				isChanged = true
+				err = manager.AddRecord(domain, &dnstypes.Record{
+					Id:    "",
+					Name:  cnameRecord,
+					Type:  dnstypes.RecordTypeCNAME,
+					Value: clusterDomain + ".",
+					Route: "", // 注意这里为空，需要在执行过程中获取默认值
+					TTL:   ttl,
+				})
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		// 多余的域名
+		for _, record := range serverRecords {
+			if !lists.ContainsString(serverDNSNames, record.Name) {
+				isChanged = true
+				err = manager.DeleteRecord(domain, record)
+				if err != nil {
+					return err
+				}
 			}
 		}
 	}

internal/tasks/dns_task_executor_test.go

@@ -1,3 +1,5 @@
+//go:build !plus
+
 package tasks_test
 
 import (

internal/tasks/health_check_cluster_task.go

@@ -127,7 +127,7 @@ func (this *HealthCheckClusterTask) Loop() error {
 			if err != nil {
 				return err
 			}
-			var message = "有" + numberutils.FormatInt(len(failedResults)) + "个节点在健康检查中出现问题"
+			var message = "有" + numberutils.FormatInt(len(failedResults)) + "个节点IP在健康检查中出现问题"
 			err = models.NewMessageDAO().CreateClusterMessage(nil, nodeconfigs.NodeRoleNode, this.clusterId, models.MessageTypeHealthCheckFailed, models.MessageLevelError, message, message, failedResultsJSON)
 			if err != nil {
 				return err

internal/tasks/health_check_executor.go

@@ -12,9 +12,11 @@ import (
 	"github.com/TeaOSLab/EdgeCommon/pkg/nodeconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/nodeutils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/iwind/TeaGo/dbs"
 	"github.com/iwind/TeaGo/lists"
 	"github.com/iwind/TeaGo/maps"
 	"github.com/iwind/TeaGo/types"
+	timeutil "github.com/iwind/TeaGo/utils/time"
 	"net"
 	"net/http"
 	"strconv"
@@ -63,26 +65,31 @@ func (this *HealthCheckExecutor) Run() ([]*HealthCheckResult, error) {
 		return results, nil
 	}
 
+	var tx *dbs.Tx
 	for _, node := range nodes {
-		if !node.IsOn {
+		if !node.IsOn || node.IsBackupForCluster || node.IsBackupForGroup || (len(node.OfflineDay) > 0 && node.OfflineDay < timeutil.Format("Ymd")) {
 			continue
 		}
-		result := &HealthCheckResult{
-			Node: node,
-		}
 
-		ipAddr, ipAddrId, err := models.NewNodeIPAddressDAO().FindFirstNodeAccessIPAddress(nil, int64(node.Id), false, nodeconfigs.NodeRoleNode)
+		ipAddrs, err := models.SharedNodeIPAddressDAO.FindNodeAccessIPAddresses(tx, int64(node.Id), nodeconfigs.NodeRoleNode)
 		if err != nil {
 			return nil, err
 		}
-		if len(ipAddr) == 0 {
-			result.Error = "no ip address can be used"
-		} else {
-			result.NodeAddr = ipAddr
-			result.NodeAddrId = ipAddrId
-		}
+		for _, ipAddr := range ipAddrs {
+			var ipClusterIds = ipAddr.DecodeClusterIds()
+			if len(ipClusterIds) > 0 && !lists.ContainsInt64(ipClusterIds, this.clusterId) {
+				continue
+			}
 
-		results = append(results, result)
+			// TODO 支持备用IP
+			var result = &HealthCheckResult{
+				Node:       node,
+				NodeAddrId: int64(ipAddr.Id),
+				NodeAddr:   ipAddr.Ip,
+			}
+
+			results = append(results, result)
+		}
 	}
 
 	// 并行检查
@@ -188,6 +195,15 @@ func (this *HealthCheckExecutor) runNode(healthCheckConfig *serverconfigs.Health
 					this.logErr("HealthCheckExecutor", err.Error())
 					return
 				}
+
+				// 触发节点动作
+				if !result.IsOk {
+					err := this.fireNodeActions(int64(result.Node.Id))
+					if err != nil {
+						this.logErr("HealthCheckExecutor", err.Error())
+					}
+					return
+				}
 			}
 
 			// 触发阈值
@@ -244,7 +260,7 @@ func (this *HealthCheckExecutor) runNode(healthCheckConfig *serverconfigs.Health
 func (this *HealthCheckExecutor) runNodeOnce(healthCheckConfig *serverconfigs.HealthCheckConfig, result *HealthCheckResult) error {
 	// 支持IPv6
 	if utils.IsIPv6(result.NodeAddr) {
-		result.NodeAddr = "[" + result.NodeAddr + "]"
+		result.NodeAddr = configutils.QuoteIP(result.NodeAddr)
 	}
 
 	if len(healthCheckConfig.URL) == 0 {

internal/tasks/health_check_executor_ext.go

@@ -0,0 +1,9 @@
+// Copyright 2023 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+//go:build !plus
+
+package tasks
+
+// 触发节点动作
+func (this *HealthCheckExecutor) fireNodeActions(nodeId int64) error {
+	return nil
+}

internal/tasks/health_check_executor_test.go

@@ -14,7 +14,7 @@ func TestHealthCheckExecutor_Run(t *testing.T) {
 	teaconst.IsPlus = true
 	dbs.NotifyReady()
 
-	executor := tasks.NewHealthCheckExecutor(35)
+	var executor = tasks.NewHealthCheckExecutor(42)
 	results, err := executor.Run()
 	if err != nil {
 		t.Fatal(err)

internal/tasks/health_check_result.go

@@ -2,10 +2,11 @@ package tasks
 
 import "github.com/TeaOSLab/EdgeAPI/internal/db/models"
 
+// HealthCheckResult 健康检查结果
 type HealthCheckResult struct {
 	Node       *models.Node
-	NodeAddr   string
-	NodeAddrId int64
+	NodeAddr   string // 节点IP地址
+	NodeAddrId int64  // 节点IP地址ID
 	IsOk       bool
 	Error      string
 	CostMs     float64

internal/tasks/health_check_task.go

@@ -72,12 +72,18 @@ func (this *HealthCheckTask) Loop() error {
 	for _, cluster := range clusters {
 		var clusterId = int64(cluster.Id)
 
+		if !cluster.IsOn {
+			this.stopClusterTask(clusterId)
+			continue
+		}
+
 		// 检查当前集群上是否有服务，如果尚没有部署服务，则直接跳过
 		countServers, err := models.SharedServerDAO.CountAllEnabledServersWithNodeClusterId(nil, clusterId)
 		if err != nil {
 			return err
 		}
 		if countServers == 0 {
+			this.stopClusterTask(clusterId)
 			continue
 		}
 
@@ -86,8 +92,16 @@ func (this *HealthCheckTask) Loop() error {
 			err = json.Unmarshal(cluster.HealthCheck, config)
 			if err != nil {
 				this.logErr("HealthCheckTask", err.Error())
+				this.stopClusterTask(clusterId)
 				continue
 			}
+			if !config.IsOn {
+				this.stopClusterTask(clusterId)
+				continue
+			}
+		} else {
+			this.stopClusterTask(clusterId)
+			continue
 		}
 
 		task, ok := this.tasksMap[clusterId]
@@ -112,3 +126,11 @@ func (this *HealthCheckTask) Loop() error {
 
 	return nil
 }
+
+func (this *HealthCheckTask) stopClusterTask(clusterId int64) {
+	var task = this.tasksMap[clusterId]
+	if task != nil {
+		task.Stop()
+		delete(this.tasksMap, clusterId)
+	}
+}

internal/tasks/health_check_task_test.go

@@ -0,0 +1,17 @@
+// Copyright 2023 GoEdge CDN goedge.cdn@gmail.com. All rights reserved. Official site: https://goedge.cn .
+
+package tasks_test
+
+import (
+	"github.com/TeaOSLab/EdgeAPI/internal/tasks"
+	"testing"
+	"time"
+)
+
+func TestNewHealthCheckTask(t *testing.T) {
+	var task = tasks.NewHealthCheckTask(1 * time.Minute)
+	err := task.Loop()
+	if err != nil {
+		t.Fatal(err)
+	}
+}

internal/utils/domainutils/utils.go

@@ -0,0 +1,31 @@
+// Copyright 2023 GoEdge CDN goedge.cdn@gmail.com. All rights reserved. Official site: https://goedge.cn .
+
+package domainutils
+
+import (
+	"regexp"
+	"strings"
+)
+
+// ValidateDomainFormat 校验域名格式
+func ValidateDomainFormat(domain string) bool {
+	pieces := strings.Split(domain, ".")
+	for _, piece := range pieces {
+		if piece == "-" ||
+			strings.HasPrefix(piece, "-") ||
+			strings.HasSuffix(piece, "-") ||
+			//strings.Contains(piece, "--") ||
+			len(piece) > 63 ||
+			// 支持中文、大写字母、下划线
+			!regexp.MustCompile(`^[\p{Han}_a-zA-Z0-9-]+$`).MatchString(piece) {
+			return false
+		}
+	}
+
+	// 最后一段不能是全数字
+	if regexp.MustCompile(`^(\d+)$`).MatchString(pieces[len(pieces)-1]) {
+		return false
+	}
+
+	return true
+}

internal/utils/lookup.go

@@ -3,20 +3,27 @@ package utils
 import (
 	"errors"
 	teaconst "github.com/TeaOSLab/EdgeAPI/internal/const"
+	"github.com/TeaOSLab/EdgeAPI/internal/utils/taskutils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/configutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/dnsconfigs"
+	"github.com/fsnotify/fsnotify"
+	"github.com/iwind/TeaGo/lists"
 	"github.com/iwind/TeaGo/logs"
 	"github.com/miekg/dns"
+	"sync"
 )
 
 var sharedDNSClient *dns.Client
 var sharedDNSConfig *dns.ClientConfig
+var sharedDNSLocker = &sync.RWMutex{}
 
 func init() {
 	if !teaconst.IsMain {
 		return
 	}
 
-	config, err := dns.ClientConfigFromFile("/etc/resolv.conf")
+	var resolvConfFile = "/etc/resolv.conf"
+	config, err := dns.ClientConfigFromFile(resolvConfFile)
 	if err != nil {
 		logs.Println("ERROR: configure dns client failed: " + err.Error())
 		return
@@ -25,6 +32,21 @@ func init() {
 	sharedDNSConfig = config
 	sharedDNSClient = &dns.Client{}
 
+	// 监视文件变化，以便及时更新配置
+	go func() {
+		watcher, watcherErr := fsnotify.NewWatcher()
+		if watcherErr == nil {
+			err = watcher.Add(resolvConfFile)
+			for range watcher.Events {
+				newConfig, err := dns.ClientConfigFromFile(resolvConfFile)
+				if err == nil && newConfig != nil {
+					sharedDNSLocker.Lock()
+					sharedDNSConfig = newConfig
+					sharedDNSLocker.Unlock()
+				}
+			}
+		}
+	}()
 }
 
 // LookupCNAME 查询CNAME记录
@@ -40,8 +62,10 @@ func LookupCNAME(host string) (string, error) {
 	m.RecursionDesired = true
 
 	var lastErr error
-	for _, serverAddr := range sharedDNSConfig.Servers {
-		r, _, err := sharedDNSClient.Exchange(m, configutils.QuoteIP(serverAddr)+":"+sharedDNSConfig.Port)
+	var serverAddrs = composeDNSResolverAddrs(nil)
+
+	for _, serverAddr := range serverAddrs {
+		r, _, err := sharedDNSClient.Exchange(m, serverAddr)
 		if err != nil {
 			lastErr = err
 			continue
@@ -56,8 +80,7 @@ func LookupCNAME(host string) (string, error) {
 }
 
 // LookupNS 查询NS记录
-// TODO 可以设置使用的DNS主机地址
-func LookupNS(host string) ([]string, error) {
+func LookupNS(host string, extraResolvers []*dnsconfigs.DNSResolver) ([]string, error) {
 	var m = new(dns.Msg)
 
 	m.SetQuestion(host+".", dns.TypeNS)
@@ -67,23 +90,36 @@ func LookupNS(host string) ([]string, error) {
 
 	var lastErr error
 	var hasValidServer = false
-	for _, serverAddr := range sharedDNSConfig.Servers {
-		r, _, err := sharedDNSClient.Exchange(m, configutils.QuoteIP(serverAddr)+":"+sharedDNSConfig.Port)
+	var serverAddrs = composeDNSResolverAddrs(extraResolvers)
+	if len(serverAddrs) == 0 {
+		return nil, nil
+	}
+
+	taskErr := taskutils.RunConcurrent(serverAddrs, taskutils.DefaultConcurrent, func(task any, locker *sync.RWMutex) {
+		var serverAddr = task.(string)
+		r, _, err := sharedDNSClient.Exchange(m, serverAddr)
 		if err != nil {
 			lastErr = err
-			continue
+			return
 		}
 
 		hasValidServer = true
 
 		if len(r.Answer) == 0 {
-			continue
+			return
 		}
 
 		for _, answer := range r.Answer {
-			result = append(result, answer.(*dns.NS).Ns)
+			var value = answer.(*dns.NS).Ns
+			locker.Lock()
+			if len(value) > 0 && !lists.ContainsString(result, value) {
+				result = append(result, value)
+			}
+			locker.Unlock()
 		}
-		break
+	})
+	if taskErr != nil {
+		return result, taskErr
 	}
 
 	if hasValidServer {
@@ -94,8 +130,7 @@ func LookupNS(host string) ([]string, error) {
 }
 
 // LookupTXT 获取CNAME
-// TODO 可以设置使用的DNS主机地址
-func LookupTXT(host string) ([]string, error) {
+func LookupTXT(host string, extraResolvers []*dnsconfigs.DNSResolver) ([]string, error) {
 	var m = new(dns.Msg)
 
 	m.SetQuestion(host+".", dns.TypeTXT)
@@ -104,23 +139,36 @@ func LookupTXT(host string) ([]string, error) {
 	var lastErr error
 	var result = []string{}
 	var hasValidServer = false
-	for _, serverAddr := range sharedDNSConfig.Servers {
-		r, _, err := sharedDNSClient.Exchange(m, configutils.QuoteIP(serverAddr)+":"+sharedDNSConfig.Port)
+	var serverAddrs = composeDNSResolverAddrs(extraResolvers)
+	if len(serverAddrs) == 0 {
+		return nil, nil
+	}
+
+	taskErr := taskutils.RunConcurrent(serverAddrs, taskutils.DefaultConcurrent, func(task any, locker *sync.RWMutex) {
+		var serverAddr = task.(string)
+		r, _, err := sharedDNSClient.Exchange(m, serverAddr)
 		if err != nil {
 			lastErr = err
-			continue
+			return
 		}
 		hasValidServer = true
 
 		if len(r.Answer) == 0 {
-			continue
+			return
 		}
 
 		for _, answer := range r.Answer {
-			result = append(result, answer.(*dns.TXT).Txt...)
+			for _, txt := range answer.(*dns.TXT).Txt {
+				locker.Lock()
+				if len(txt) > 0 && !lists.ContainsString(result, txt) {
+					result = append(result, txt)
+				}
+				locker.Unlock()
+			}
 		}
-
-		break
+	})
+	if taskErr != nil {
+		return result, taskErr
 	}
 
 	if hasValidServer {
@@ -129,3 +177,22 @@ func LookupTXT(host string) ([]string, error) {
 
 	return nil, lastErr
 }
+
+// 组合DNS解析服务器地址
+func composeDNSResolverAddrs(extraResolvers []*dnsconfigs.DNSResolver) []string {
+	sharedDNSLocker.RLock()
+	defer sharedDNSLocker.RUnlock()
+
+	// 这里不处理重复，方便我们可以多次重试
+	var servers = sharedDNSConfig.Servers
+	var port = sharedDNSConfig.Port
+
+	var serverAddrs = []string{}
+	for _, serverAddr := range servers {
+		serverAddrs = append(serverAddrs, configutils.QuoteIP(serverAddr)+":"+port)
+	}
+	for _, resolver := range extraResolvers {
+		serverAddrs = append(serverAddrs, resolver.Addr())
+	}
+	return serverAddrs
+}

internal/utils/lookup_test.go

@@ -4,6 +4,7 @@ package utils_test
 
 import (
 	"github.com/TeaOSLab/EdgeAPI/internal/utils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/dnsconfigs"
 	"testing"
 )
 
@@ -12,9 +13,25 @@ func TestLookupCNAME(t *testing.T) {
 }
 
 func TestLookupNS(t *testing.T) {
-	t.Log(utils.LookupNS("goedge.cn"))
+	t.Log(utils.LookupNS("goedge.cn", nil))
+}
+
+func TestLookupNSExtra(t *testing.T) {
+	t.Log(utils.LookupNS("goedge.cn", []*dnsconfigs.DNSResolver{
+		{
+			Host: "192.168.2.2",
+		},
+		{
+			Host: "192.168.2.2",
+			Port: 58,
+		},
+		{
+			Host: "8.8.8.8",
+			Port: 53,
+		},
+	}))
 }
 
 func TestLookupTXT(t *testing.T) {
-	t.Log(utils.LookupTXT("yanzheng.goedge.cn"))
+	t.Log(utils.LookupTXT("yanzheng.goedge.cn", nil))
 }

internal/utils/regexputils/expr.go

@@ -9,3 +9,7 @@ var (
 	YYYYMMDD   = regexp.MustCompile(`^\d{8}$`)
 	YYYYMM     = regexp.MustCompile(`^\d{6}$`)
 )
+
+var (
+	HTTPProtocol = regexp.MustCompile("^(?i)(http|https)://")
+)

internal/utils/taskutils/concurrent.go

@@ -0,0 +1,61 @@
+// Copyright 2023 GoEdge CDN goedge.cdn@gmail.com. All rights reserved. Official site: https://goedge.cn .
+
+package taskutils
+
+import (
+	"errors"
+	"reflect"
+	"sync"
+)
+
+const DefaultConcurrent = 16
+
+func RunConcurrent(tasks any, concurrent int, f func(task any, locker *sync.RWMutex)) error {
+	if tasks == nil {
+		return nil
+	}
+	var tasksValue = reflect.ValueOf(tasks)
+	if tasksValue.Type().Kind() != reflect.Slice {
+		return errors.New("ony works for slice")
+	}
+
+	var countTasks = tasksValue.Len()
+	if countTasks == 0 {
+		return nil
+	}
+
+	if concurrent <= 0 {
+		concurrent = 8
+	}
+	if concurrent > countTasks {
+		concurrent = countTasks
+	}
+
+	var taskChan = make(chan any, countTasks)
+	for i := 0; i < countTasks; i++ {
+		taskChan <- tasksValue.Index(i).Interface()
+	}
+
+	var wg = &sync.WaitGroup{}
+	wg.Add(concurrent)
+
+	var locker = &sync.RWMutex{}
+
+	for i := 0; i < concurrent; i++ {
+		go func() {
+			defer wg.Done()
+
+			for {
+				select {
+				case task := <-taskChan:
+					f(task, locker)
+				default:
+					return
+				}
+			}
+		}()
+	}
+	wg.Wait()
+
+	return nil
+}

internal/utils/taskutils/concurrent_test.go

@@ -0,0 +1,18 @@
+// Copyright 2023 GoEdge CDN goedge.cdn@gmail.com. All rights reserved. Official site: https://goedge.cn .
+
+package taskutils_test
+
+import (
+	"github.com/TeaOSLab/EdgeAPI/internal/utils/taskutils"
+	"sync"
+	"testing"
+)
+
+func TestRunConcurrent(t *testing.T) {
+	err := taskutils.RunConcurrent([]string{"a", "b", "c", "d", "e"}, 3, func(task any, locker *sync.RWMutex) {
+		t.Log("run", task)
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+}