优化细节

.gitignore

@@ -1,3 +1,5 @@
 *_plus.go
 *-plus.sh
+*_plus.html
+*_plus.js
 *@plus.js

build/build.sh

@@ -60,11 +60,13 @@ function build() {
 
 	# build
 	echo "building "${NAME}" ..."
-	env GOOS=$OS GOARCH=$GOARCH go build -tags $TAG -ldflags="-s -w" -o $DIST/bin/${NAME} $ROOT/../cmd/edge-admin/main.go
+	env GOOS=$OS GOARCH=$ARCH go build -tags $TAG -ldflags="-s -w" -o $DIST/bin/${NAME} $ROOT/../cmd/edge-admin/main.go
 
 	# delete hidden files
 	find $DIST -name ".DS_Store" -delete
 	find $DIST -name ".gitignore" -delete
+	find $DIST -name "*.less" -delete
+	find $DIST -name "*.css.map" -delete
 
 	# zip
 	echo "zip files ..."

go.mod

@@ -10,9 +10,11 @@ require (
 	github.com/go-sql-driver/mysql v1.5.0
 	github.com/go-yaml/yaml v2.1.0+incompatible
 	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/iwind/TeaGo v0.0.0-20210720011303-fc255c995afa
+	github.com/iwind/TeaGo v0.0.0-20211026123858-7de7a21cad24
 	github.com/iwind/gosock v0.0.0-20210722083328-12b2d66abec3
+	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/miekg/dns v1.1.35
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/tealeg/xlsx/v3 v3.2.3
 	github.com/xlzd/gotp v0.0.0-20181030022105-c8557ba2c119

go.sum

@@ -62,12 +62,16 @@ github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/iwind/TeaGo v0.0.0-20210628135026-38575a4ab060/go.mod h1:KU4mS7QNiZ7QWEuDBk1zw0/Q2LrAPZv3tycEFBsuUwc=
-github.com/iwind/TeaGo v0.0.0-20210720011303-fc255c995afa h1:woN88uEmRRUNFD7pRZEtX9heDcjFn0ClMxjF5ButKow=
-github.com/iwind/TeaGo v0.0.0-20210720011303-fc255c995afa/go.mod h1:KU4mS7QNiZ7QWEuDBk1zw0/Q2LrAPZv3tycEFBsuUwc=
+github.com/iwind/TeaGo v0.0.0-20210831140440-a2a442471b13 h1:HuEJ5xJfujW1Q6rNDhOu5LQXEBB2qLPah3jYslT8Gz4=
+github.com/iwind/TeaGo v0.0.0-20210831140440-a2a442471b13/go.mod h1:KU4mS7QNiZ7QWEuDBk1zw0/Q2LrAPZv3tycEFBsuUwc=
+github.com/iwind/TeaGo v0.0.0-20211026123858-7de7a21cad24 h1:1cGulkD2SNJJRok5OKwyhP/Ddm+PgSWKOupn0cR36/A=
+github.com/iwind/TeaGo v0.0.0-20211026123858-7de7a21cad24/go.mod h1:KU4mS7QNiZ7QWEuDBk1zw0/Q2LrAPZv3tycEFBsuUwc=
 github.com/iwind/gosock v0.0.0-20210722083328-12b2d66abec3 h1:aBSonas7vFcgTj9u96/bWGILGv1ZbUSTLiOzcI1ZT6c=
 github.com/iwind/gosock v0.0.0-20210722083328-12b2d66abec3/go.mod h1:H5Q7SXwbx3a97ecJkaS2sD77gspzE7HFUafBO0peEyA=
 github.com/json-iterator/go v1.1.10 h1:Kz6Cvnvv2wGdaG/V8yMvfkmNiXq9Ya2KUv4rouJJr68=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -77,8 +81,12 @@ github.com/miekg/dns v1.1.35 h1:oTfOaDH+mZkdcgdIjH6yBajRGtIwcwcaR+rt23ZSrJs=
 github.com/miekg/dns v1.1.35/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421 h1:ZqeYNhU3OHLH3mGKHDcjJRFFRrJa6eAM5H+CtDdOsPc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742 h1:Esafd1046DLDQ0W1YjYsBW+p8U2u7vzgW2SQVmlNazg=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=

internal/configloaders/admin_module.go

@@ -19,6 +19,7 @@ const (
 	AdminModuleCodeAdmin     AdminModuleCode = "admin"     // 系统用户
 	AdminModuleCodeUser      AdminModuleCode = "user"      // 平台用户
 	AdminModuleCodeFinance   AdminModuleCode = "finance"   // 财务
+	AdminModuleCodePlan      AdminModuleCode = "plan"      // 套餐
 	AdminModuleCodeLog       AdminModuleCode = "log"       // 日志
 	AdminModuleCodeSetting   AdminModuleCode = "setting"   // 设置
 	AdminModuleCodeCommon    AdminModuleCode = "common"    // 只要登录就可以访问的模块
@@ -182,7 +183,7 @@ func AllModuleMaps() []maps.Map {
 	}
 	if teaconst.IsPlus {
 		m = append(m, maps.Map{
-			"name": "自建DNS",
+			"name": "智能DNS",
 			"code": AdminModuleCodeNS,
 			"url":  "/ns",
 		})
@@ -203,6 +204,11 @@ func AllModuleMaps() []maps.Map {
 			"code": AdminModuleCodeFinance,
 			"url":  "/finance",
 		},
+		{
+			"name": "套餐管理",
+			"code": AdminModuleCodePlan,
+			"url":  "/plans",
+		},
 		{
 			"name": "日志审计",
 			"code": AdminModuleCodeLog,

internal/const/const.go

@@ -1,9 +1,9 @@
 package teaconst
 
 const (
-	Version = "0.3.1"
+	Version = "0.3.3"
 
-	APINodeVersion = "0.3.1"
+	APINodeVersion = "0.3.3"
 
 	ProductName   = "Edge Admin"
 	ProcessName   = "edge-admin"

internal/rpc/rpc_client.go

@@ -364,6 +364,14 @@ func (this *RPCClient) ACMETaskRPC() pb.ACMETaskServiceClient {
 	return pb.NewACMETaskServiceClient(this.pickConn())
 }
 
+func (this *RPCClient) ACMEProviderRPC() pb.ACMEProviderServiceClient {
+	return pb.NewACMEProviderServiceClient(this.pickConn())
+}
+
+func (this *RPCClient) ACMEProviderAccountRPC() pb.ACMEProviderAccountServiceClient {
+	return pb.NewACMEProviderAccountServiceClient(this.pickConn())
+}
+
 func (this *RPCClient) UserRPC() pb.UserServiceClient {
 	return pb.NewUserServiceClient(this.pickConn())
 }
@@ -456,6 +464,14 @@ func (this *RPCClient) ServerStatBoardChartRPC() pb.ServerStatBoardChartServiceC
 	return pb.NewServerStatBoardChartServiceClient(this.pickConn())
 }
 
+func (this *RPCClient) PlanRPC() pb.PlanServiceClient {
+	return pb.NewPlanServiceClient(this.pickConn())
+}
+
+func (this *RPCClient) UserPlanRPC() pb.UserPlanServiceClient {
+	return pb.NewUserPlanServiceClient(this.pickConn())
+}
+
 // Context 构造Admin上下文
 func (this *RPCClient) Context(adminId int64) context.Context {
 	ctx := context.Background()

internal/utils/lookup.go

@@ -1,6 +1,7 @@
 package utils
 
 import (
+	"github.com/TeaOSLab/EdgeCommon/pkg/configutils"
 	"github.com/miekg/dns"
 )
 
@@ -16,13 +17,19 @@ func LookupCNAME(host string) (string, error) {
 
 	m.SetQuestion(host+".", dns.TypeCNAME)
 	m.RecursionDesired = true
-	r, _, err := c.Exchange(m, config.Servers[0]+":"+config.Port)
-	if err != nil {
-		return "", err
-	}
-	if len(r.Answer) == 0 {
-		return "", nil
-	}
 
-	return r.Answer[0].(*dns.CNAME).Target, nil
+	var lastErr error
+	for _, serverAddr := range config.Servers {
+		r, _, err := c.Exchange(m, configutils.QuoteIP(serverAddr)+":"+config.Port)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		if len(r.Answer) == 0 {
+			continue
+		}
+
+		return r.Answer[0].(*dns.CNAME).Target, nil
+	}
+	return "", lastErr
 }

internal/web/actions/actionutils/parent_action.go

@@ -19,6 +19,8 @@ type ParentAction struct {
 	actions.ActionObject
 
 	rpcClient *rpc.RPCClient
+
+	ctx context.Context
 }
 
 // Parent 可以调用自身的一个简便方法
@@ -117,6 +119,10 @@ func (this *ParentAction) RPC() *rpc.RPCClient {
 
 // AdminContext 获取Context
 func (this *ParentAction) AdminContext() context.Context {
+	if this.ctx != nil {
+		return this.ctx
+	}
+
 	if this.rpcClient == nil {
 		rpcClient, err := rpc.SharedRPC()
 		if err != nil {
@@ -125,7 +131,8 @@ func (this *ParentAction) AdminContext() context.Context {
 		}
 		this.rpcClient = rpcClient
 	}
-	return this.rpcClient.Context(this.AdminId())
+	this.ctx = this.rpcClient.Context(this.AdminId())
+	return this.ctx
 }
 
 // ViewData 视图里可以使用的数据

internal/web/actions/default/clusters/cluster/init.go

@@ -19,6 +19,7 @@ func init() {
 		server.
 			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNode)).
 			Helper(clusters.NewClusterHelper()).
+			Data("teaMenu", "clusters").
 			Prefix("/clusters/cluster").
 			Get("", new(IndexAction)).
 			Get("/nodes", new(NodesAction)).

internal/web/actions/default/clusters/cluster/node/nodeutils/utils.go

@@ -4,6 +4,7 @@ package nodeutils
 
 import (
 	"errors"
+	teaconst "github.com/TeaOSLab/EdgeAdmin/internal/const"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/iwind/TeaGo/maps"
@@ -49,7 +50,7 @@ func InitNodeInfo(parentAction *actionutils.ParentAction, nodeId int64) (*pb.Nod
 	var query = "clusterId=" + types.String(clusterId) + "&nodeId=" + types.String(nodeId)
 	var menuItem = parentAction.Data.GetString("secondMenuItem")
 
-	parentAction.Data["leftMenuItems"] = []maps.Map{
+	var menuItems = []maps.Map{
 		{
 			"name":     "基础设置",
 			"url":      prefix + "/update?" + query,
@@ -65,11 +66,17 @@ func InitNodeInfo(parentAction *actionutils.ParentAction, nodeId int64) (*pb.Nod
 			"url":      prefix + "/settings/cache?" + query,
 			"isActive": menuItem == "cache",
 		},
-		{
-			"name":     "阈值设置",
-			"url":      prefix + "/settings/thresholds?" + query,
-			"isActive": menuItem == "threshold",
-		},
+	}
+	if teaconst.IsPlus {
+		menuItems = append(menuItems, []maps.Map{
+			{
+				"name":     "阈值设置",
+				"url":      prefix + "/settings/thresholds?" + query,
+				"isActive": menuItem == "threshold",
+			},
+		}...)
+	}
+	menuItems = append(menuItems, []maps.Map{
 		{
 			"name":     "SSH设置",
 			"url":      prefix + "/settings/ssh?" + query,
@@ -80,7 +87,8 @@ func InitNodeInfo(parentAction *actionutils.ParentAction, nodeId int64) (*pb.Nod
 			"url":      prefix + "/settings/system?" + query,
 			"isActive": menuItem == "system",
 		},
-	}
+	}...)
+	parentAction.Data["leftMenuItems"] = menuItems
 
 	return nodeResp.Node, nil
 }

internal/web/actions/default/clusters/cluster/settings/index.go

@@ -4,6 +4,7 @@ import (
 	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/clusters/grants/grantutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/nodeconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/iwind/TeaGo/actions"
 	"github.com/iwind/TeaGo/maps"
@@ -21,6 +22,7 @@ func (this *IndexAction) Init() {
 func (this *IndexAction) RunGet(params struct {
 	ClusterId int64
 }) {
+	// 基本信息
 	clusterResp, err := this.RPC().NodeClusterRPC().FindEnabledNodeCluster(this.AdminContext(), &pb.FindEnabledNodeClusterRequest{NodeClusterId: params.ClusterId})
 	if err != nil {
 		this.ErrorPage(err)
@@ -53,10 +55,20 @@ func (this *IndexAction) RunGet(params struct {
 	}
 	this.Data["grant"] = grantMap
 
+	// 时区
+	this.Data["timeZoneGroups"] = nodeconfigs.FindAllTimeZoneGroups()
+	this.Data["timeZoneLocations"] = nodeconfigs.FindAllTimeZoneLocations()
+
+	if len(cluster.TimeZone) == 0 {
+		cluster.TimeZone = nodeconfigs.DefaultTimeZoneLocation
+	}
+	this.Data["timeZoneLocation"] = nodeconfigs.FindTimeZoneLocation(cluster.TimeZone)
+
 	this.Data["cluster"] = maps.Map{
 		"id":         cluster.Id,
 		"name":       cluster.Name,
 		"installDir": cluster.InstallDir,
+		"timeZone":   cluster.TimeZone,
 	}
 
 	this.Show()
@@ -68,6 +80,7 @@ func (this *IndexAction) RunPost(params struct {
 	Name       string
 	GrantId    int64
 	InstallDir string
+	TimeZone   string
 
 	Must *actions.Must
 }) {
@@ -83,6 +96,7 @@ func (this *IndexAction) RunPost(params struct {
 		Name:          params.Name,
 		NodeGrantId:   params.GrantId,
 		InstallDir:    params.InstallDir,
+		TimeZone:      params.TimeZone,
 	})
 	if err != nil {
 		this.ErrorPage(err)

internal/web/actions/default/clusters/clusterutils/clusters_helper.go

@@ -12,7 +12,8 @@ func NewClustersHelper() *ClustersHelper {
 	return &ClustersHelper{}
 }
 
-func (this *ClustersHelper) BeforeAction(action *actions.ActionObject) {
+func (this *ClustersHelper) BeforeAction(actionPtr actions.ActionWrapper) {
+	var action = actionPtr.Object()
 	if action.Request.Method != http.MethodGet {
 		return
 	}

internal/web/actions/default/clusters/grants/init.go

@@ -12,6 +12,7 @@ func init() {
 		server.
 			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNode)).
 			Helper(clusterutils.NewClustersHelper()).
+			Data("teaMenu", "clusters").
 			Data("teaSubMenu", "grant").
 			Prefix("/clusters/grants").
 

internal/web/actions/default/clusters/index.go

@@ -121,6 +121,10 @@ func (this *IndexAction) RunGet(params struct {
 				this.ErrorPage(err)
 			}
 
+			if cluster.TimeZone == nodeconfigs.DefaultTimeZoneLocation {
+				cluster.TimeZone = ""
+			}
+
 			clusterMaps = append(clusterMaps, maps.Map{
 				"id":                cluster.Id,
 				"name":              cluster.Name,
@@ -132,6 +136,7 @@ func (this *IndexAction) RunGet(params struct {
 				"dnsName":           cluster.DnsName,
 				"dnsDomainName":     dnsDomainName,
 				"countServers":      countServersResp.Count,
+				"timeZone":          cluster.TimeZone,
 			})
 		}
 	}

internal/web/actions/default/clusters/init.go

@@ -12,6 +12,7 @@ func init() {
 		server.
 			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNode)).
 			Helper(clusterutils.NewClustersHelper()).
+			Data("teaMenu", "clusters").
 			Prefix("/clusters").
 			Get("", new(IndexAction)).
 			GetPost("/create", new(CreateAction)).

internal/web/actions/default/clusters/logs/index.go

@@ -2,6 +2,7 @@ package logs
 
 import (
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/nodeconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/iwind/TeaGo/maps"
 	timeutil "github.com/iwind/TeaGo/utils/time"
@@ -12,6 +13,11 @@ type IndexAction struct {
 }
 
 func (this *IndexAction) Init() {
+	if this.ParamString("type") == "unread" {
+		this.FirstMenu("unread")
+	} else {
+		this.FirstMenu("index")
+	}
 }
 
 func (this *IndexAction) RunGet(params struct {
@@ -19,19 +25,34 @@ func (this *IndexAction) RunGet(params struct {
 	DayTo   string
 	Keyword string
 	Level   string
+	Type    string
 }) {
 	this.Data["dayFrom"] = params.DayFrom
 	this.Data["dayTo"] = params.DayTo
 	this.Data["keyword"] = params.Keyword
 	this.Data["level"] = params.Level
+	this.Data["type"] = params.Type
 
+	// 未读数量
+	countUnreadResp, err := this.RPC().NodeLogRPC().CountNodeLogs(this.AdminContext(), &pb.CountNodeLogsRequest{
+		Role:     nodeconfigs.NodeRoleNode,
+		IsUnread: true,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Data["countUnreadLogs"] = countUnreadResp.Count
+
+	// 日志数量
 	countResp, err := this.RPC().NodeLogRPC().CountNodeLogs(this.AdminContext(), &pb.CountNodeLogsRequest{
-		NodeId:  0,
-		Role:    "node",
-		DayFrom: params.DayFrom,
-		DayTo:   params.DayTo,
-		Keyword: params.Keyword,
-		Level:   params.Level,
+		NodeId:   0,
+		Role:     nodeconfigs.NodeRoleNode,
+		DayFrom:  params.DayFrom,
+		DayTo:    params.DayTo,
+		Keyword:  params.Keyword,
+		Level:    params.Level,
+		IsUnread: params.Type == "unread",
 	})
 	if err != nil {
 		this.ErrorPage(err)
@@ -42,14 +63,15 @@ func (this *IndexAction) RunGet(params struct {
 	this.Data["page"] = page.AsHTML()
 
 	logsResp, err := this.RPC().NodeLogRPC().ListNodeLogs(this.AdminContext(), &pb.ListNodeLogsRequest{
-		NodeId:  0,
-		Role:    "node",
-		DayFrom: params.DayFrom,
-		DayTo:   params.DayTo,
-		Keyword: params.Keyword,
-		Level:   params.Level,
-		Offset:  page.Offset,
-		Size:    page.Size,
+		NodeId:   0,
+		Role:     nodeconfigs.NodeRoleNode,
+		DayFrom:  params.DayFrom,
+		DayTo:    params.DayTo,
+		Keyword:  params.Keyword,
+		Level:    params.Level,
+		IsUnread: params.Type == "unread",
+		Offset:   page.Offset,
+		Size:     page.Size,
 	})
 	if err != nil {
 		this.ErrorPage(err)
@@ -69,12 +91,14 @@ func (this *IndexAction) RunGet(params struct {
 		}
 
 		logs = append(logs, maps.Map{
+			"id":          log.Id,
 			"tag":         log.Tag,
 			"description": log.Description,
 			"createdTime": timeutil.FormatTime("Y-m-d H:i:s", log.CreatedAt),
 			"level":       log.Level,
 			"isToday":     timeutil.FormatTime("Y-m-d", log.CreatedAt) == timeutil.Format("Y-m-d"),
 			"count":       log.Count,
+			"isRead":      log.IsRead,
 			"node": maps.Map{
 				"id": node.Id,
 				"cluster": maps.Map{

internal/web/actions/default/clusters/logs/init.go

@@ -14,6 +14,7 @@ func init() {
 			Data("teaSubMenu", "log").
 			Prefix("/clusters/logs").
 			Get("", new(IndexAction)).
+			Post("/readLogs", new(ReadLogsAction)).
 			EndAll()
 	})
 }

internal/web/actions/default/clusters/logs/readLogs.go

@@ -0,0 +1,26 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package logs
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+)
+
+type ReadLogsAction struct {
+	actionutils.ParentAction
+}
+
+func (this *ReadLogsAction) RunPost(params struct {
+	LogIds []int64
+}) {
+	_, err := this.RPC().NodeLogRPC().UpdateNodeLogsRead(this.AdminContext(), &pb.UpdateNodeLogsReadRequest{
+		NodeLogIds: params.LogIds,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/clusters/selectPopup.go

@@ -21,6 +21,7 @@ func (this *SelectPopupAction) Init() {
 func (this *SelectPopupAction) RunGet(params struct {
 	SelectedClusterIds string
 	Keyword            string
+	PageSize           int64
 }) {
 	this.Data["keyword"] = params.Keyword
 
@@ -36,6 +37,9 @@ func (this *SelectPopupAction) RunGet(params struct {
 	var count = countResp.Count
 	var page = this.NewPage(count)
 	page.Size = 6
+	if params.PageSize > 0 {
+		page.Size = params.PageSize
+	}
 	this.Data["page"] = page.AsHTML()
 
 	clustersResp, err := this.RPC().NodeClusterRPC().ListEnabledNodeClusters(this.AdminContext(), &pb.ListEnabledNodeClustersRequest{

internal/web/actions/default/dashboard/index.go

@@ -55,13 +55,16 @@ func (this *IndexAction) RunPost(params struct{}) {
 	this.Data["dashboard"] = maps.Map{
 		"defaultClusterId": resp.DefaultNodeClusterId,
 
-		"countServers":      resp.CountServers,
-		"countNodeClusters": resp.CountNodeClusters,
-		"countNodes":        resp.CountNodes,
-		"countUsers":        resp.CountUsers,
-		"countAPINodes":     resp.CountAPINodes,
-		"countDBNodes":      resp.CountDBNodes,
-		"countUserNodes":    resp.CountUserNodes,
+		"countServers":          resp.CountServers,
+		"countNodeClusters":     resp.CountNodeClusters,
+		"countNodes":            resp.CountNodes,
+		"countOfflineNodes":     resp.CountOfflineNodes,
+		"countUsers":            resp.CountUsers,
+		"countAPINodes":         resp.CountAPINodes,
+		"countOfflineAPINodes":  resp.CountOfflineAPINodes,
+		"countDBNodes":          resp.CountDBNodes,
+		"countUserNodes":        resp.CountUserNodes,
+		"countOfflineUserNodes": resp.CountOfflineUserNodes,
 
 		"canGoServers":  configloaders.AllowModule(this.AdminId(), configloaders.AdminModuleCodeServer),
 		"canGoNodes":    configloaders.AllowModule(this.AdminId(), configloaders.AdminModuleCodeNode),

internal/web/actions/default/dns/domains/domainutils/utils.go

@@ -77,7 +77,7 @@ func ValidateRecordName(name string) bool {
 			strings.HasSuffix(piece, "-") ||
 			strings.Contains(piece, "--") ||
 			len(piece) > 63 ||
-			!regexp.MustCompile(`^[a-z0-9-]+$`).MatchString(piece) {
+			!regexp.MustCompile(`^[_a-z0-9-]+$`).MatchString(piece) {
 			return false
 		}
 	}

internal/web/actions/default/finance/bills/generate.go

@@ -1,38 +0,0 @@
-package bills
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
-	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
-	"github.com/iwind/TeaGo/actions"
-	timeutil "github.com/iwind/TeaGo/utils/time"
-	"time"
-)
-
-type GenerateAction struct {
-	actionutils.ParentAction
-}
-
-func (this *GenerateAction) Init() {
-	this.Nav("", "", "generate")
-}
-
-func (this *GenerateAction) RunGet(params struct{}) {
-	this.Data["month"] = timeutil.Format("Ym", time.Now().AddDate(0, -1, 0))
-
-	this.Show()
-}
-
-func (this *GenerateAction) RunPost(params struct {
-	Month string
-
-	Must *actions.Must
-}) {
-	defer this.CreateLogInfo("手动生成上个月（" + params.Month + "）账单")
-
-	_, err := this.RPC().UserBillRPC().GenerateAllUserBills(this.AdminContext(), &pb.GenerateAllUserBillsRequest{Month: params.Month})
-	if err != nil {
-		this.ErrorPage(err)
-		return
-	}
-	this.Success()
-}

internal/web/actions/default/finance/bills/index.go

@@ -1,65 +0,0 @@
-package bills
-
-import (
-	"fmt"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
-	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
-	"github.com/iwind/TeaGo/maps"
-)
-
-type IndexAction struct {
-	actionutils.ParentAction
-}
-
-func (this *IndexAction) Init() {
-	this.Nav("", "", "index")
-}
-
-func (this *IndexAction) RunGet(params struct {
-	PaidFlag int32 `default:"-1"`
-	UserId   int64
-	Month    string
-}) {
-	countResp, err := this.RPC().UserBillRPC().CountAllUserBills(this.AdminContext(), &pb.CountAllUserBillsRequest{})
-	if err != nil {
-		this.ErrorPage(err)
-		return
-	}
-
-	page := this.NewPage(countResp.Count)
-	this.Data["page"] = page.AsHTML()
-
-	billsResp, err := this.RPC().UserBillRPC().ListUserBills(this.AdminContext(), &pb.ListUserBillsRequest{
-		PaidFlag: params.PaidFlag,
-		UserId:   params.UserId,
-		Month:    params.Month,
-		Offset:   page.Offset,
-		Size:     page.Size,
-	})
-	if err != nil {
-		this.ErrorPage(err)
-		return
-	}
-	billMaps := []maps.Map{}
-	for _, bill := range billsResp.UserBills {
-		var userMap maps.Map = nil
-		if bill.User != nil {
-			userMap = maps.Map{
-				"id":       bill.User.Id,
-				"fullname": bill.User.Fullname,
-			}
-		}
-		billMaps = append(billMaps, maps.Map{
-			"id":          bill.Id,
-			"isPaid":      bill.IsPaid,
-			"month":       bill.Month,
-			"amount":      fmt.Sprintf("%.2f", bill.Amount),
-			"typeName":    bill.TypeName,
-			"user":        userMap,
-			"description": bill.Description,
-		})
-	}
-	this.Data["bills"] = billMaps
-
-	this.Show()
-}

internal/web/actions/default/finance/bills/init.go

@@ -1,22 +0,0 @@
-package bills
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeFinance)).
-			Data("teaMenu", "finance").
-
-			// 财务管理
-			Prefix("/finance/bills").
-			Get("", new(IndexAction)).
-			GetPost("/generate", new(GenerateAction)).
-
-			EndAll()
-	})
-}

internal/web/actions/default/finance/index.go

@@ -1,16 +0,0 @@
-package finance
-
-import "github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
-
-type IndexAction struct {
-	actionutils.ParentAction
-}
-
-func (this *IndexAction) Init() {
-	this.Nav("", "", "")
-}
-
-func (this *IndexAction) RunGet(params struct{}) {
-	// TODO 暂时先跳转到账单页，将来做成Dashboard
-	this.RedirectURL("/finance/bills")
-}

internal/web/actions/default/ns/clusters/cluster/init.go

@@ -1,38 +0,0 @@
-package cluster
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/ns/clusters/cluster/node"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/ns/clusters/clusterutils"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Helper(new(clusterutils.ClusterHelper)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "cluster").
-			Prefix("/ns/clusters/cluster").
-			Get("", new(IndexAction)).
-			GetPost("/delete", new(DeleteAction)).
-			GetPost("/createNode", new(CreateNodeAction)).
-			Post("/deleteNode", new(DeleteNodeAction)).
-			Get("/upgradeRemote", new(UpgradeRemoteAction)).
-			GetPost("/updateNodeSSH", new(UpdateNodeSSHAction)).
-
-			// 节点相关
-			Prefix("/ns/clusters/cluster/node").
-			Get("", new(node.IndexAction)).
-			Get("/logs", new(node.LogsAction)).
-			GetPost("/update", new(node.UpdateAction)).
-			GetPost("/install", new(node.InstallAction)).
-			Post("/status", new(node.StatusAction)).
-			Post("/updateInstallStatus", new(node.UpdateInstallStatusAction)).
-			Post("/start", new(node.StartAction)).
-			Post("/stop", new(node.StopAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/ns/clusters/cluster/settings/accessLog/init.go

@@ -1,21 +0,0 @@
-package accessLog
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/ns/clusters/clusterutils"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Helper(new(clusterutils.ClusterHelper)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "cluster").
-			Prefix("/ns/clusters/cluster/settings/accessLog").
-			GetPost("", new(IndexAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/ns/clusters/cluster/settings/init.go

@@ -1,21 +0,0 @@
-package cluster
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/ns/clusters/clusterutils"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Helper(new(clusterutils.ClusterHelper)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "cluster").
-			Prefix("/ns/clusters/cluster/settings").
-			GetPost("", new(IndexAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/ns/clusters/cluster/settings/recursion/init.go

@@ -1,21 +0,0 @@
-package recursion
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/ns/clusters/clusterutils"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Helper(new(clusterutils.ClusterHelper)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "cluster").
-			Prefix("/ns/clusters/cluster/settings/recursion").
-			GetPost("", new(IndexAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/ns/clusters/init.go

@@ -1,21 +0,0 @@
-package clusters
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "cluster").
-			Prefix("/ns/clusters").
-			Get("", new(IndexAction)).
-			GetPost("/create", new(CreateAction)).
-			Post("/options", new(OptionsAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/ns/clusters/logs/init.go

@@ -1,19 +0,0 @@
-package logs
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "log").
-			Prefix("/ns/clusters/logs").
-			Get("", new(IndexAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/ns/routes/init.go

@@ -1,25 +0,0 @@
-package clusters
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "route").
-			Prefix("/ns/routes").
-			Get("", new(IndexAction)).
-			Get("/route", new(RouteAction)).
-			GetPost("/createPopup", new(CreatePopupAction)).
-			GetPost("/updatePopup", new(UpdatePopupAction)).
-			Post("/delete", new(DeleteAction)).
-			Post("/sort", new(SortAction)).
-			Post("/options", new(OptionsAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/ns/settings/accesslogs/init.go

@@ -1,23 +0,0 @@
-// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
-
-package accesslogs
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/ns/settings/settingutils"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Helper(new(settingutils.Helper)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "setting").
-			Prefix("/ns/settings/accesslogs").
-			GetPost("", new(IndexAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/ns/users/init.go

@@ -1,19 +0,0 @@
-package users
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "domain").
-			Prefix("/ns/users").
-			Post("/options", new(OptionsAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/servers/accesslogs/init.go

@@ -1,26 +0,0 @@
-// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
-
-package ipbox
-
-import (
-	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
-	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
-	"github.com/iwind/TeaGo"
-)
-
-func init() {
-	TeaGo.BeforeStart(func(server *TeaGo.Server) {
-		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
-			Prefix("/servers/accesslogs").
-			Data("teaMenu", "servers").
-			Data("teaSubMenu", "accesslog").
-			Get("", new(IndexAction)).
-			GetPost("/createPopup", new(CreatePopupAction)).
-			Get("/policy", new(PolicyAction)).
-			GetPost("/test", new(TestAction)).
-			GetPost("/update", new(UpdateAction)).
-			Post("/delete", new(DeleteAction)).
-			EndAll()
-	})
-}

internal/web/actions/default/servers/addPortPopup.go

@@ -5,6 +5,7 @@ import (
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
 	"github.com/iwind/TeaGo/actions"
 	"github.com/iwind/TeaGo/maps"
+	"github.com/iwind/TeaGo/types"
 	"regexp"
 	"strings"
 )
@@ -18,9 +19,10 @@ func (this *AddPortPopupAction) Init() {
 }
 
 func (this *AddPortPopupAction) RunGet(params struct {
-	ServerType string
-	Protocol   string
-	From       string
+	ServerType   string
+	Protocol     string
+	From         string
+	SupportRange bool
 }) {
 	this.Data["from"] = params.From
 
@@ -36,10 +38,14 @@ func (this *AddPortPopupAction) RunGet(params struct {
 	}
 	this.Data["protocols"] = protocols
 
+	this.Data["supportRange"] = params.SupportRange
+
 	this.Show()
 }
 
 func (this *AddPortPopupAction) RunPost(params struct {
+	SupportRange bool
+
 	Protocol string
 	Address  string
 
@@ -50,26 +56,69 @@ func (this *AddPortPopupAction) RunPost(params struct {
 		"protocol":  params.Protocol,
 		"host":      "",
 		"portRange": "",
+		"minPort":   0,
+		"maxPort":   0,
 	}
 
-	// TODO 判断端口不能小于1
-	// TODO 判断端口号不能大于65535
-
-	digitRegexp := regexp.MustCompile(`^\d+$`)
-	if digitRegexp.MatchString(params.Address) {
-		addr["portRange"] = params.Address
-	} else if strings.Contains(params.Address, ":") {
+	var portRegexp = regexp.MustCompile(`^\d+$`)
+	if portRegexp.MatchString(params.Address) { // 单个端口
+		addr["portRange"] = this.checkPort(params.Address)
+	} else if params.SupportRange && regexp.MustCompile(`^\d+\s*-\s*\d+$`).MatchString(params.Address) { // Port1-Port2
+		addr["portRange"], addr["minPort"], addr["maxPort"] = this.checkPortRange(params.Address)
+	} else if strings.Contains(params.Address, ":") { // IP:Port
 		index := strings.LastIndex(params.Address, ":")
 		addr["host"] = strings.TrimSpace(params.Address[:index])
 		port := strings.TrimSpace(params.Address[index+1:])
-		if !digitRegexp.MatchString(port) {
-			this.Fail("端口只能是一个数字")
+		if portRegexp.MatchString(port) {
+			addr["portRange"] = this.checkPort(port)
+		} else if params.SupportRange && regexp.MustCompile(`^\d+\s*-\s*\d+$`).MatchString(port) { // Port1-Port2
+			addr["portRange"], addr["minPort"], addr["maxPort"] = this.checkPortRange(port)
+		} else {
+			this.FailField("address", "请输入正确的端口或者网络地址")
 		}
-		addr["portRange"] = port
 	} else {
-		this.Fail("请输入正确的端口或者网络地址")
+		this.FailField("address", "请输入正确的端口或者网络地址")
 	}
 
 	this.Data["address"] = addr
 	this.Success()
 }
+
+func (this *AddPortPopupAction) checkPort(port string) (portRange string) {
+	var intPort = types.Int(port)
+	if intPort < 1 {
+		this.FailField("address", "端口号不能小于1")
+	}
+	if intPort > 65535 {
+		this.FailField("address", "端口号不能大于65535")
+	}
+	return port
+}
+
+func (this *AddPortPopupAction) checkPortRange(port string) (portRange string, minPort int, maxPort int) {
+	var pieces = strings.Split(port, "-")
+	var piece1 = strings.TrimSpace(pieces[0])
+	var piece2 = strings.TrimSpace(pieces[1])
+	var port1 = types.Int(piece1)
+	var port2 = types.Int(piece2)
+
+	if port1 < 1 {
+		this.FailField("address", "端口号不能小于1")
+	}
+	if port1 > 65535 {
+		this.FailField("address", "端口号不能大于65535")
+	}
+
+	if port2 < 1 {
+		this.FailField("address", "端口号不能小于1")
+	}
+	if port2 > 65535 {
+		this.FailField("address", "端口号不能大于65535")
+	}
+
+	if port1 > port2 {
+		port1, port2 = port2, port1
+	}
+
+	return types.String(port1) + "-" + types.String(port2), port1, port2
+}

internal/web/actions/default/servers/certs/acme/accounts/createPopup.go

@@ -0,0 +1,100 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package accounts
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+	"github.com/iwind/TeaGo/maps"
+)
+
+type CreatePopupAction struct {
+	actionutils.ParentAction
+}
+
+func (this *CreatePopupAction) Init() {
+	this.Nav("", "", "")
+}
+
+func (this *CreatePopupAction) RunGet(params struct {
+	ProviderCode string
+}) {
+	this.Data["providerCode"] = params.ProviderCode
+
+	// 服务商列表
+	providersResp, err := this.RPC().ACMEProviderRPC().FindAllACMEProviders(this.AdminContext(), &pb.FindAllACMEProvidersRequest{})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	var providerMaps = []maps.Map{}
+	for _, provider := range providersResp.AcmeProviders {
+		providerMaps = append(providerMaps, maps.Map{
+			"name":           provider.Name,
+			"code":           provider.Code,
+			"description":    provider.Description,
+			"requireEAB":     provider.RequireEAB,
+			"eabDescription": provider.EabDescription,
+		})
+	}
+
+	this.Data["providers"] = providerMaps
+
+	this.Show()
+}
+
+func (this *CreatePopupAction) RunPost(params struct {
+	Name         string
+	ProviderCode string
+	EabKid       string
+	EabKey       string
+
+	Must *actions.Must
+	CSRF *actionutils.CSRF
+}) {
+	var accountId int64
+	defer func() {
+		this.CreateLogInfo("创建ACME服务商账号 %d", accountId)
+	}()
+
+	params.Must.
+		Field("name", params.Name).
+		Require("请输入账号名称").
+		Field("providerCode", params.ProviderCode).
+		Require("请选择服务商")
+
+	providerResp, err := this.RPC().ACMEProviderRPC().FindACMEProviderWithCode(this.AdminContext(), &pb.FindACMEProviderWithCodeRequest{AcmeProviderCode: params.ProviderCode})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	var provider = providerResp.AcmeProvider
+	if provider == nil {
+		this.Fail("请选择服务商")
+	}
+
+	if provider.RequireEAB {
+		params.Must.
+			Field("eabKid", params.EabKid).
+			Require("请输入EAB Kid").
+			Field("eabKey", params.EabKey).
+			Require("请输入EAB HMAC Key")
+	}
+
+	createResp, err := this.RPC().ACMEProviderAccountRPC().CreateACMEProviderAccount(this.AdminContext(), &pb.CreateACMEProviderAccountRequest{
+		Name:         params.Name,
+		ProviderCode: params.ProviderCode,
+		EabKid:       params.EabKid,
+		EabKey:       params.EabKey,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	accountId = createResp.AcmeProviderAccountId
+
+	this.Success()
+}

internal/web/actions/default/servers/certs/acme/accounts/delete.go

@@ -0,0 +1,26 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package accounts
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+)
+
+type DeleteAction struct {
+	actionutils.ParentAction
+}
+
+func (this *DeleteAction) RunPost(params struct {
+	AccountId int64
+}) {
+	defer this.CreateLogInfo("删除ACME服务商账号 %d", params.AccountId)
+
+	_, err := this.RPC().ACMEProviderAccountRPC().DeleteACMEProviderAccount(this.AdminContext(), &pb.DeleteACMEProviderAccountRequest{AcmeProviderAccountId: params.AccountId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/certs/acme/accounts/index.go

@@ -0,0 +1,61 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package accounts
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/maps"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "", "account")
+}
+
+func (this *IndexAction) RunGet(params struct{}) {
+	countResp, err := this.RPC().ACMEProviderAccountRPC().CountAllEnabledACMEProviderAccounts(this.AdminContext(), &pb.CountAllEnabledACMEProviderAccountsRequest{})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	var count = countResp.Count
+	var page = this.NewPage(count)
+	this.Data["page"] = page.AsHTML()
+
+	accountsResp, err := this.RPC().ACMEProviderAccountRPC().ListEnabledACMEProviderAccounts(this.AdminContext(), &pb.ListEnabledACMEProviderAccountsRequest{
+		Offset: page.Offset,
+		Size:   page.Size,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	var accountMaps = []maps.Map{}
+	for _, account := range accountsResp.AcmeProviderAccounts {
+		var providerMap maps.Map
+		if account.AcmeProvider != nil {
+			providerMap = maps.Map{
+				"name":       account.AcmeProvider.Name,
+				"code":       account.AcmeProvider.Code,
+				"requireEAB": account.AcmeProvider.RequireEAB,
+			}
+		}
+
+		accountMaps = append(accountMaps, maps.Map{
+			"id":       account.Id,
+			"isOn":     account.IsOn,
+			"name":     account.Name,
+			"eabKid":   account.EabKid,
+			"eabKey":   account.EabKey,
+			"provider": providerMap,
+		})
+	}
+	this.Data["accounts"] = accountMaps
+
+	this.Show()
+}

internal/web/actions/default/servers/certs/acme/accounts/updatePopup.go

@@ -0,0 +1,108 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package accounts
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+	"github.com/iwind/TeaGo/maps"
+)
+
+type UpdatePopupAction struct {
+	actionutils.ParentAction
+}
+
+func (this *UpdatePopupAction) Init() {
+	this.Nav("", "", "")
+}
+
+func (this *UpdatePopupAction) RunGet(params struct {
+	AccountId int64
+}) {
+	// 账号信息
+	accountResp, err := this.RPC().ACMEProviderAccountRPC().FindEnabledACMEProviderAccount(this.AdminContext(), &pb.FindEnabledACMEProviderAccountRequest{AcmeProviderAccountId: params.AccountId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	var account = accountResp.AcmeProviderAccount
+	if account == nil {
+		this.NotFound("ACMEProviderAccount", params.AccountId)
+		return
+	}
+
+	var providerMap maps.Map
+	if account.AcmeProvider != nil {
+		providerMap = maps.Map{
+			"name":           account.AcmeProvider.Name,
+			"code":           account.AcmeProvider.Code,
+			"description":    account.AcmeProvider.Description,
+			"eabDescription": account.AcmeProvider.EabDescription,
+			"requireEAB":     account.AcmeProvider.RequireEAB,
+		}
+	}
+
+	this.Data["account"] = maps.Map{
+		"id":           account.Id,
+		"name":         account.Name,
+		"isOn":         account.IsOn,
+		"providerCode": account.ProviderCode,
+		"eabKid":       account.EabKid,
+		"eabKey":       account.EabKey,
+		"provider":     providerMap,
+	}
+
+	this.Show()
+}
+
+func (this *UpdatePopupAction) RunPost(params struct {
+	AccountId    int64
+	Name         string
+	ProviderCode string
+	EabKid       string
+	EabKey       string
+
+	Must *actions.Must
+	CSRF *actionutils.CSRF
+}) {
+	defer this.CreateLogInfo("修改ACME服务商账号 %d", params.AccountId)
+
+	params.Must.
+		Field("name", params.Name).
+		Require("请输入账号名称").
+		Field("providerCode", params.ProviderCode).
+		Require("请选择服务商")
+
+	providerResp, err := this.RPC().ACMEProviderRPC().FindACMEProviderWithCode(this.AdminContext(), &pb.FindACMEProviderWithCodeRequest{AcmeProviderCode: params.ProviderCode})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	var provider = providerResp.AcmeProvider
+	if provider == nil {
+		this.Fail("请选择服务商")
+	}
+
+	if provider.RequireEAB {
+		params.Must.
+			Field("eabKid", params.EabKid).
+			Require("请输入EAB Kid").
+			Field("eabKey", params.EabKey).
+			Require("请输入EAB HMAC Key")
+	}
+
+	_, err = this.RPC().ACMEProviderAccountRPC().UpdateACMEProviderAccount(this.AdminContext(), &pb.UpdateACMEProviderAccountRequest{
+		AcmeProviderAccountId: params.AccountId,
+		Name:                  params.Name,
+		EabKid:                params.EabKid,
+		EabKey:                params.EabKey,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/certs/acme/create.go

@@ -35,15 +35,31 @@ func (this *CreateAction) RunGet(params struct{}) {
 		}
 
 		userMaps = append(userMaps, maps.Map{
-			"id":          user.Id,
-			"description": description,
-			"email":       user.Email,
+			"id":           user.Id,
+			"description":  description,
+			"email":        user.Email,
+			"providerCode": user.AcmeProviderCode,
 		})
 	}
 	this.Data["users"] = userMaps
 
+	// 证书服务商
+	providersResp, err := this.RPC().ACMEProviderRPC().FindAllACMEProviders(this.AdminContext(), &pb.FindAllACMEProvidersRequest{})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	var providerMaps = []maps.Map{}
+	for _, provider := range providersResp.AcmeProviders {
+		providerMaps = append(providerMaps, maps.Map{
+			"name": provider.Name,
+			"code": provider.Code,
+		})
+	}
+	this.Data["providers"] = providerMaps
+
 	// 域名解析服务商
-	providersResp, err := this.RPC().DNSProviderRPC().FindAllEnabledDNSProviders(this.AdminContext(), &pb.FindAllEnabledDNSProvidersRequest{
+	dnsProvidersResp, err := this.RPC().DNSProviderRPC().FindAllEnabledDNSProviders(this.AdminContext(), &pb.FindAllEnabledDNSProvidersRequest{
 		AdminId: this.AdminId(),
 		UserId:  0,
 	})
@@ -51,15 +67,15 @@ func (this *CreateAction) RunGet(params struct{}) {
 		this.ErrorPage(err)
 		return
 	}
-	providerMaps := []maps.Map{}
-	for _, provider := range providersResp.DnsProviders {
-		providerMaps = append(providerMaps, maps.Map{
+	dnsProviderMaps := []maps.Map{}
+	for _, provider := range dnsProvidersResp.DnsProviders {
+		dnsProviderMaps = append(dnsProviderMaps, maps.Map{
 			"id":       provider.Id,
 			"name":     provider.Name,
 			"typeName": provider.TypeName,
 		})
 	}
-	this.Data["providers"] = providerMaps
+	this.Data["dnsProviders"] = dnsProviderMaps
 
 	this.Show()
 }

internal/web/actions/default/servers/certs/acme/index.go

@@ -136,6 +136,26 @@ func (this *IndexAction) RunGet(params struct {
 		if task.AcmeUser == nil {
 			continue
 		}
+
+		// 服务商
+		var providerMap maps.Map
+		if task.AcmeUser.AcmeProvider != nil {
+			providerMap = maps.Map{
+				"name": task.AcmeUser.AcmeProvider.Name,
+				"code": task.AcmeUser.AcmeProvider.Code,
+			}
+		}
+
+		// 账号
+		var accountMap maps.Map
+		if task.AcmeUser.AcmeProviderAccount != nil {
+			accountMap = maps.Map{
+				"id":   task.AcmeUser.AcmeProviderAccount.Id,
+				"name": task.AcmeUser.AcmeProviderAccount.Name,
+			}
+		}
+
+		// DNS服务商
 		dnsProviderMap := maps.Map{}
 		if task.AuthType == "dns" && task.DnsProvider != nil {
 			dnsProviderMap = maps.Map{
@@ -170,8 +190,10 @@ func (this *IndexAction) RunGet(params struct {
 			"id":       task.Id,
 			"authType": task.AuthType,
 			"acmeUser": maps.Map{
-				"id":    task.AcmeUser.Id,
-				"email": task.AcmeUser.Email,
+				"id":       task.AcmeUser.Id,
+				"email":    task.AcmeUser.Email,
+				"provider": providerMap,
+				"account":  accountMap,
 			},
 			"dnsProvider": dnsProviderMap,
 			"dnsDomain":   task.DnsDomain,

internal/web/actions/default/servers/certs/acme/users/accountsWithCode.go

@@ -0,0 +1,33 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package users
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/maps"
+)
+
+type AccountsWithCodeAction struct {
+	actionutils.ParentAction
+}
+
+func (this *AccountsWithCodeAction) RunPost(params struct {
+	Code string
+}) {
+	accountsResp, err := this.RPC().ACMEProviderAccountRPC().FindAllACMEProviderAccountsWithProviderCode(this.AdminContext(), &pb.FindAllACMEProviderAccountsWithProviderCodeRequest{AcmeProviderCode: params.Code})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	var accountMaps = []maps.Map{}
+	for _, account := range accountsResp.AcmeProviderAccounts {
+		accountMaps = append(accountMaps, maps.Map{
+			"id":   account.Id,
+			"name": account.Name,
+		})
+	}
+	this.Data["accounts"] = accountMaps
+
+	this.Success()
+}

internal/web/actions/default/servers/certs/acme/users/createPopup.go

@@ -16,12 +16,30 @@ func (this *CreatePopupAction) Init() {
 }
 
 func (this *CreatePopupAction) RunGet(params struct{}) {
+	// 服务商
+	providersResp, err := this.RPC().ACMEProviderRPC().FindAllACMEProviders(this.AdminContext(), &pb.FindAllACMEProvidersRequest{})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	var providerMaps = []maps.Map{}
+	for _, provider := range providersResp.AcmeProviders {
+		providerMaps = append(providerMaps, maps.Map{
+			"code":       provider.Code,
+			"name":       provider.Name,
+			"requireEAB": provider.RequireEAB,
+		})
+	}
+	this.Data["providers"] = providerMaps
+
 	this.Show()
 }
 
 func (this *CreatePopupAction) RunPost(params struct {
-	Email       string
-	Description string
+	Email        string
+	ProviderCode string
+	AccountId    int64
+	Description  string
 
 	Must *actions.Must
 	CSRF *actionutils.CSRF
@@ -29,11 +47,44 @@ func (this *CreatePopupAction) RunPost(params struct {
 	params.Must.
 		Field("email", params.Email).
 		Require("请输入邮箱").
-		Email("请输入正确的邮箱格式")
+		Email("请输入正确的邮箱格式").
+		Field("providerCode", params.ProviderCode).
+		Require("请选择所属服务商")
+
+	providerResp, err := this.RPC().ACMEProviderRPC().FindACMEProviderWithCode(this.AdminContext(), &pb.FindACMEProviderWithCodeRequest{
+		AcmeProviderCode: params.ProviderCode,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if providerResp.AcmeProvider == nil {
+		this.Fail("找不到要选择的证书")
+	}
+	if providerResp.AcmeProvider.RequireEAB {
+		if params.AccountId <= 0 {
+			this.Fail("此服务商要求必须选择或创建服务商账号")
+		}
+
+		// 同一个账号只能有一个用户
+		countResp, err := this.RPC().ACMEUserRPC().
+			CountACMEUsers(this.AdminContext(), &pb.CountAcmeUsersRequest{
+				AcmeProviderAccountId: params.AccountId,
+			})
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+		if countResp.Count > 0 {
+			this.Fail("此服务商账号已被别的用户使用，请换成别的账号")
+		}
+	}
 
 	createResp, err := this.RPC().ACMEUserRPC().CreateACMEUser(this.AdminContext(), &pb.CreateACMEUserRequest{
-		Email:       params.Email,
-		Description: params.Description,
+		Email:                 params.Email,
+		Description:           params.Description,
+		AcmeProviderCode:      params.ProviderCode,
+		AcmeProviderAccountId: params.AccountId,
 	})
 	if err != nil {
 		this.ErrorPage(err)
@@ -42,9 +93,10 @@ func (this *CreatePopupAction) RunPost(params struct {
 
 	// 返回数据
 	this.Data["acmeUser"] = maps.Map{
-		"id":          createResp.AcmeUserId,
-		"description": params.Description,
-		"email":       params.Email,
+		"id":           createResp.AcmeUserId,
+		"description":  params.Description,
+		"email":        params.Email,
+		"providerCode": params.ProviderCode,
 	}
 
 	// 日志

internal/web/actions/default/servers/certs/acme/users/index.go

@@ -40,11 +40,31 @@ func (this *IndexAction) RunGet(params struct{}) {
 	}
 	userMaps := []maps.Map{}
 	for _, user := range usersResp.AcmeUsers {
+		// 服务商
+		var providerMap maps.Map
+		if user.AcmeProvider != nil {
+			providerMap = maps.Map{
+				"name": user.AcmeProvider.Name,
+				"code": user.AcmeProvider.Code,
+			}
+		}
+
+		// 账号
+		var accountMap maps.Map
+		if user.AcmeProviderAccount != nil {
+			accountMap = maps.Map{
+				"id":   user.AcmeProviderAccount.Id,
+				"name": user.AcmeProviderAccount.Name,
+			}
+		}
+
 		userMaps = append(userMaps, maps.Map{
 			"id":          user.Id,
 			"email":       user.Email,
 			"description": user.Description,
 			"createdTime": timeutil.FormatTime("Y-m-d H:i:s", user.CreatedAt),
+			"provider":    providerMap,
+			"account":     accountMap,
 		})
 	}
 	this.Data["users"] = userMaps

internal/web/actions/default/servers/certs/acme/users/updatePopup.go

@@ -29,10 +29,30 @@ func (this *UpdatePopupAction) RunGet(params struct {
 		return
 	}
 
+	// 服务商
+	var providerMap maps.Map
+	if user.AcmeProvider != nil {
+		providerMap = maps.Map{
+			"name": user.AcmeProvider.Name,
+			"code": user.AcmeProvider.Code,
+		}
+	}
+
+	// 账号
+	var accountMap maps.Map
+	if user.AcmeProviderAccount != nil {
+		accountMap = maps.Map{
+			"id":   user.AcmeProviderAccount.Id,
+			"name": user.AcmeProviderAccount.Name,
+		}
+	}
+
 	this.Data["user"] = maps.Map{
 		"id":          user.Id,
 		"email":       user.Email,
 		"description": user.Description,
+		"provider":    providerMap,
+		"account":     accountMap,
 	}
 
 	this.Show()

internal/web/actions/default/servers/certs/init.go

@@ -3,6 +3,7 @@ package certs
 import (
 	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/certs/acme"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/certs/acme/accounts"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/certs/acme/users"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
 	"github.com/iwind/TeaGo"
@@ -13,9 +14,7 @@ func init() {
 		server.
 			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
 			Helper(NewHelper()).
-
 			Data("teaSubMenu", "cert").
-
 			Prefix("/servers/certs").
 			Data("leftMenuItem", "cert").
 			Get("", new(IndexAction)).
@@ -31,7 +30,7 @@ func init() {
 			Get("/selectPopup", new(SelectPopupAction)).
 			Get("/datajs", new(DatajsAction)).
 
-			// ACME
+			// ACME任务
 			Prefix("/servers/certs/acme").
 			Data("leftMenuItem", "acme").
 			Get("", new(acme.IndexAction)).
@@ -40,13 +39,23 @@ func init() {
 			GetPost("/updateTaskPopup", new(acme.UpdateTaskPopupAction)).
 			Post("/deleteTask", new(acme.DeleteTaskAction)).
 
+			// ACME用户
 			Prefix("/servers/certs/acme/users").
 			Get("", new(users.IndexAction)).
 			GetPost("/createPopup", new(users.CreatePopupAction)).
 			GetPost("/updatePopup", new(users.UpdatePopupAction)).
 			Post("/delete", new(users.DeleteAction)).
 			GetPost("/selectPopup", new(users.SelectPopupAction)).
+			Post("/accountsWithCode", new(users.AccountsWithCodeAction)).
 
+			// ACME账号
+			Prefix("/servers/certs/acme/accounts").
+			Get("", new(accounts.IndexAction)).
+			GetPost("/createPopup", new(accounts.CreatePopupAction)).
+			GetPost("/updatePopup", new(accounts.UpdatePopupAction)).
+			Post("/delete", new(accounts.DeleteAction)).
+
+			//
 			EndAll()
 	})
 }

internal/web/actions/default/servers/certs/updatePopup.go

@@ -7,6 +7,7 @@ import (
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/sslconfigs"
 	"github.com/iwind/TeaGo/actions"
+	timeutil "github.com/iwind/TeaGo/utils/time"
 )
 
 type UpdatePopupAction struct {
@@ -45,6 +46,8 @@ func (this *UpdatePopupAction) RunGet(params struct {
 func (this *UpdatePopupAction) RunPost(params struct {
 	CertId int64
 
+	TextMode bool
+
 	Name        string
 	IsCA        bool
 	Description string
@@ -53,6 +56,9 @@ func (this *UpdatePopupAction) RunPost(params struct {
 	CertFile *actions.File
 	KeyFile  *actions.File
 
+	CertText string
+	KeyText  string
+
 	Must *actions.Must
 }) {
 	// 创建日志
@@ -82,18 +88,31 @@ func (this *UpdatePopupAction) RunPost(params struct {
 		Field("name", params.Name).
 		Require("请输入证书说明")
 
-	if params.CertFile != nil {
-		certConfig.CertData, err = params.CertFile.Read()
-		if err != nil {
-			this.Fail("读取证书文件内容错误，请重新上传")
+	if params.TextMode {
+		if len(params.CertText) > 0 {
+			certConfig.CertData = []byte(params.CertText)
 		}
-	}
 
-	if !params.IsCA {
-		if params.KeyFile != nil {
-			certConfig.KeyData, err = params.KeyFile.Read()
+		if !params.IsCA {
+			if len(params.KeyText) > 0 {
+				certConfig.KeyData = []byte(params.KeyText)
+			}
+		}
+	} else {
+
+		if params.CertFile != nil {
+			certConfig.CertData, err = params.CertFile.Read()
 			if err != nil {
-				this.Fail("读取密钥文件内容错误，请重新上传")
+				this.FailField("certFile", "读取证书文件内容错误，请重新上传")
+			}
+		}
+
+		if !params.IsCA {
+			if params.KeyFile != nil {
+				certConfig.KeyData, err = params.KeyFile.Read()
+				if err != nil {
+					this.FailField("keyFile", "读取私钥文件内容错误，请重新上传")
+				}
 			}
 		}
 	}
@@ -109,6 +128,10 @@ func (this *UpdatePopupAction) RunPost(params struct {
 		}
 	}
 
+	if len(timeutil.Format("Y", certConfig.TimeEnd())) != 4 {
+		this.Fail("证书格式错误：无法读取到证书有效期")
+	}
+
 	// 保存
 	_, err = this.RPC().SSLCertRPC().UpdateSSLCert(this.AdminContext(), &pb.UpdateSSLCertRequest{
 		SslCertId:   params.CertId,

internal/web/actions/default/servers/certs/uploadPopup.go

@@ -7,6 +7,7 @@ import (
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/sslconfigs"
 	"github.com/iwind/TeaGo/actions"
+	timeutil "github.com/iwind/TeaGo/utils/time"
 )
 
 type UploadPopupAction struct {
@@ -22,6 +23,7 @@ func (this *UploadPopupAction) RunGet(params struct{}) {
 }
 
 func (this *UploadPopupAction) RunPost(params struct {
+	TextMode    bool
 	Name        string
 	IsCA        bool
 	Description string
@@ -30,6 +32,9 @@ func (this *UploadPopupAction) RunPost(params struct {
 	CertFile *actions.File
 	KeyFile  *actions.File
 
+	CertText string
+	KeyText  string
+
 	Must *actions.Must
 }) {
 	params.Must.
@@ -39,22 +44,37 @@ func (this *UploadPopupAction) RunPost(params struct {
 	certData := []byte{}
 	keyData := []byte{}
 
-	if params.CertFile == nil {
-		this.Fail("请选择要上传的证书文件")
-	}
-	var err error
-	certData, err = params.CertFile.Read()
-	if err != nil {
-		this.Fail("读取证书文件内容错误，请重新上传")
-	}
+	if params.TextMode {
+		if len(params.CertText) == 0 {
+			this.FailField("certText", "请输入证书内容")
+		}
 
-	if !params.IsCA {
-		if params.KeyFile == nil {
-			this.Fail("请选择要上传的私钥文件")
-		} else {
-			keyData, err = params.KeyFile.Read()
-			if err != nil {
-				this.Fail("读取密钥文件内容错误，请重新上传")
+		if !params.IsCA {
+			if len(params.KeyText) == 0 {
+				this.FailField("keyText", "请输入私钥内容")
+			}
+		}
+
+		certData = []byte(params.CertText)
+		keyData = []byte(params.KeyText)
+	} else {
+		if params.CertFile == nil {
+			this.FailField("certFile", "请选择要上传的证书文件")
+		}
+		var err error
+		certData, err = params.CertFile.Read()
+		if err != nil {
+			this.FailField("certFile", "读取证书文件内容错误，请重新上传")
+		}
+
+		if !params.IsCA {
+			if params.KeyFile == nil {
+				this.FailField("keyFile", "请选择要上传的私钥文件")
+			} else {
+				keyData, err = params.KeyFile.Read()
+				if err != nil {
+					this.FailField("keyFile", "读取密钥文件内容错误，请重新上传")
+				}
 			}
 		}
 	}
@@ -65,7 +85,7 @@ func (this *UploadPopupAction) RunPost(params struct {
 		CertData: certData,
 		KeyData:  keyData,
 	}
-	err = sslConfig.Init()
+	err := sslConfig.Init()
 	if err != nil {
 		if params.IsCA {
 			this.Fail("证书校验错误：" + err.Error())
@@ -73,6 +93,9 @@ func (this *UploadPopupAction) RunPost(params struct {
 			this.Fail("证书或密钥校验错误：" + err.Error())
 		}
 	}
+	if len(timeutil.Format("Y", sslConfig.TimeEnd())) != 4 {
+		this.Fail("证书格式错误：无法读取到证书有效期")
+	}
 
 	// 保存
 	createResp, err := this.RPC().SSLCertRPC().CreateSSLCert(this.AdminContext(), &pb.CreateSSLCertRequest{

internal/web/actions/default/servers/components/waf/group.go

@@ -73,6 +73,14 @@ func (this *GroupAction) RunGet(params struct {
 			"name": set.Name,
 			"rules": lists.Map(set.Rules, func(k int, v interface{}) interface{} {
 				rule := v.(*firewallconfigs.HTTPFirewallRule)
+
+				// 校验
+				var errString = ""
+				var err = rule.Init()
+				if err != nil {
+					errString = err.Error()
+				}
+
 				return maps.Map{
 					"param":             rule.Param,
 					"paramFilters":      rule.ParamFilters,
@@ -81,6 +89,7 @@ func (this *GroupAction) RunGet(params struct {
 					"isCaseInsensitive": rule.IsCaseInsensitive,
 					"isComposed":        firewallconfigs.CheckCheckpointIsComposed(rule.Prefix()),
 					"checkpointOptions": rule.CheckpointOptions,
+					"err":               errString,
 				}
 			}),
 			"isOn":      set.IsOn,

internal/web/actions/default/servers/components/waf/index.go

@@ -70,10 +70,17 @@ func (this *IndexAction) RunGet(params struct {
 		}
 		countClusters := countClustersResp.Count
 
+		// mode
+		if len(policy.Mode) == 0 {
+			policy.Mode = firewallconfigs.FirewallModeDefend
+		}
+
 		policyMaps = append(policyMaps, maps.Map{
 			"id":            policy.Id,
 			"isOn":          policy.IsOn,
 			"name":          policy.Name,
+			"mode":          policy.Mode,
+			"modeInfo":      firewallconfigs.FindFirewallMode(policy.Mode),
 			"countInbound":  countInbound,
 			"countOutbound": countOutbound,
 			"countClusters": countClusters,

internal/web/actions/default/servers/components/waf/init.go

@@ -19,6 +19,7 @@ func init() {
 			GetPost("/createPopup", new(CreatePopupAction)).
 			Post("/delete", new(DeleteAction)).
 			Get("/policy", new(PolicyAction)).
+			Post("/upgradeTemplate", new(UpgradeTemplateAction)).
 			Get("/groups", new(GroupsAction)).
 			Get("/group", new(GroupAction)).
 			Get("/log", new(LogAction)).

internal/web/actions/default/servers/components/waf/policy.go

@@ -4,6 +4,7 @@ import (
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
 	"github.com/iwind/TeaGo/maps"
 )
 
@@ -46,11 +47,44 @@ func (this *PolicyAction) RunGet(params struct {
 		}
 	}
 
+	// 检查是否有升级
+	var templatePolicy = firewallconfigs.HTTPFirewallTemplate()
+	var upgradeItems = []string{}
+	if templatePolicy.Inbound != nil {
+		for _, group := range templatePolicy.Inbound.Groups {
+			if len(group.Code) == 0 {
+				continue
+			}
+			var oldGroup = firewallPolicy.FindRuleGroupWithCode(group.Code)
+			if oldGroup == nil {
+				upgradeItems = append(upgradeItems, group.Name)
+				continue
+			}
+			for _, set := range group.Sets {
+				if len(set.Code) == 0 {
+					continue
+				}
+				var oldSet = oldGroup.FindRuleSetWithCode(set.Code)
+				if oldSet == nil {
+					upgradeItems = append(upgradeItems, group.Name+" -- "+set.Name)
+					continue
+				}
+			}
+		}
+	}
+	this.Data["upgradeItems"] = upgradeItems
+
+	// 模式
+	if len(firewallPolicy.Mode) == 0 {
+		firewallPolicy.Mode = firewallconfigs.FirewallModeDefend
+	}
 	this.Data["firewallPolicy"] = maps.Map{
 		"id":           firewallPolicy.Id,
 		"name":         firewallPolicy.Name,
 		"isOn":         firewallPolicy.IsOn,
 		"description":  firewallPolicy.Description,
+		"mode":         firewallPolicy.Mode,
+		"modeInfo":     firewallconfigs.FindFirewallMode(firewallPolicy.Mode),
 		"groups":       internalGroups,
 		"blockOptions": firewallPolicy.BlockOptions,
 	}

internal/web/actions/default/servers/components/waf/update.go

@@ -1,6 +1,7 @@
 package waf
 
 import (
+	"encoding/json"
 	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
@@ -37,14 +38,22 @@ func (this *UpdateAction) RunGet(params struct {
 			StatusCode: http.StatusForbidden,
 			Body:       "Blocked By WAF",
 			URL:        "",
+			Timeout:    60,
 		}
 	}
 
+	// mode
+	if len(firewallPolicy.Mode) == 0 {
+		firewallPolicy.Mode = firewallconfigs.FirewallModeDefend
+	}
+	this.Data["modes"] = firewallconfigs.FindAllFirewallModes()
+
 	this.Data["firewallPolicy"] = maps.Map{
 		"id":           firewallPolicy.Id,
 		"name":         firewallPolicy.Name,
 		"description":  firewallPolicy.Description,
 		"isOn":         firewallPolicy.IsOn,
+		"mode":         firewallPolicy.Mode,
 		"blockOptions": firewallPolicy.BlockOptions,
 	}
 
@@ -77,6 +86,7 @@ func (this *UpdateAction) RunPost(params struct {
 	BlockOptionsJSON []byte
 	Description      string
 	IsOn             bool
+	Mode             string
 
 	Must *actions.Must
 }) {
@@ -87,13 +97,21 @@ func (this *UpdateAction) RunPost(params struct {
 		Field("name", params.Name).
 		Require("请输入策略名称")
 
-	_, err := this.RPC().HTTPFirewallPolicyRPC().UpdateHTTPFirewallPolicy(this.AdminContext(), &pb.UpdateHTTPFirewallPolicyRequest{
+	// 校验JSON
+	var blockOptions = &firewallconfigs.HTTPFirewallBlockAction{}
+	err := json.Unmarshal(params.BlockOptionsJSON, blockOptions)
+	if err != nil {
+		this.Fail("拦截动作参数校验失败：" + err.Error())
+	}
+
+	_, err = this.RPC().HTTPFirewallPolicyRPC().UpdateHTTPFirewallPolicy(this.AdminContext(), &pb.UpdateHTTPFirewallPolicyRequest{
 		HttpFirewallPolicyId: params.FirewallPolicyId,
 		IsOn:                 params.IsOn,
 		Name:                 params.Name,
 		Description:          params.Description,
 		FirewallGroupCodes:   params.GroupCodes,
 		BlockOptionsJSON:     params.BlockOptionsJSON,
+		Mode:                 params.Mode,
 	})
 	if err != nil {
 		this.ErrorPage(err)

internal/web/actions/default/servers/components/waf/upgradeTemplate.go

@@ -0,0 +1,124 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package waf
+
+import (
+	"encoding/json"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
+)
+
+type UpgradeTemplateAction struct {
+	actionutils.ParentAction
+}
+
+func (this *UpgradeTemplateAction) RunPost(params struct {
+	PolicyId int64
+}) {
+	defer this.CreateLogInfo("升级WAF %d 内置规则", params.PolicyId)
+
+	policy, err := dao.SharedHTTPFirewallPolicyDAO.FindEnabledHTTPFirewallPolicyConfig(this.AdminContext(), params.PolicyId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if policy == nil {
+		this.NotFound("firewallPolicy", params.PolicyId)
+		return
+	}
+
+	// 检查是否有升级
+	var templatePolicy = firewallconfigs.HTTPFirewallTemplate()
+	if templatePolicy.Inbound != nil {
+		for _, group := range templatePolicy.Inbound.Groups {
+			if len(group.Code) == 0 {
+				continue
+			}
+			var oldGroup = policy.FindRuleGroupWithCode(group.Code)
+			if oldGroup == nil {
+				createGroupResp, err := this.RPC().HTTPFirewallRuleGroupRPC().CreateHTTPFirewallRuleGroup(this.AdminContext(), &pb.CreateHTTPFirewallRuleGroupRequest{
+					IsOn:        true,
+					Name:        group.Name,
+					Code:        group.Code,
+					Description: group.Description,
+				})
+				if err != nil {
+					this.ErrorPage(err)
+					return
+				}
+				var groupId = createGroupResp.FirewallRuleGroupId
+				policy.Inbound.GroupRefs = append(policy.Inbound.GroupRefs, &firewallconfigs.HTTPFirewallRuleGroupRef{
+					IsOn:    true,
+					GroupId: groupId,
+				})
+
+				for _, set := range group.Sets {
+					setJSON, err := json.Marshal(set)
+					if err != nil {
+						this.ErrorPage(err)
+						return
+					}
+					_, err = this.RPC().HTTPFirewallRuleGroupRPC().AddHTTPFirewallRuleGroupSet(this.AdminContext(), &pb.AddHTTPFirewallRuleGroupSetRequest{
+						FirewallRuleGroupId:       groupId,
+						FirewallRuleSetConfigJSON: setJSON,
+					})
+					if err != nil {
+						this.ErrorPage(err)
+						return
+					}
+				}
+
+				continue
+			}
+			for _, set := range group.Sets {
+				if len(set.Code) == 0 {
+					continue
+				}
+				var oldSet = oldGroup.FindRuleSetWithCode(set.Code)
+				if oldSet == nil {
+					setJSON, err := json.Marshal(set)
+					if err != nil {
+						this.ErrorPage(err)
+						return
+					}
+					_, err = this.RPC().HTTPFirewallRuleGroupRPC().AddHTTPFirewallRuleGroupSet(this.AdminContext(), &pb.AddHTTPFirewallRuleGroupSetRequest{
+						FirewallRuleGroupId:       oldGroup.Id,
+						FirewallRuleSetConfigJSON: setJSON,
+					})
+					if err != nil {
+						this.ErrorPage(err)
+						return
+					}
+					continue
+				}
+			}
+		}
+	}
+
+	// 保存inbound
+	inboundJSON, err := policy.InboundJSON()
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	outboundJSON, err := policy.OutboundJSON()
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	_, err = this.RPC().HTTPFirewallPolicyRPC().UpdateHTTPFirewallPolicyGroups(this.AdminContext(), &pb.UpdateHTTPFirewallPolicyGroupsRequest{
+		HttpFirewallPolicyId: params.PolicyId,
+		InboundJSON:          inboundJSON,
+		OutboundJSON:         outboundJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/create.go

@@ -8,6 +8,7 @@ import (
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/sslconfigs"
 	"github.com/iwind/TeaGo/actions"
 	"github.com/iwind/TeaGo/logs"
@@ -71,8 +72,11 @@ func (this *CreateAction) RunPost(params struct {
 	CertIdsJSON []byte
 	Origins     string
 
-	AccessLogIsOn bool
-	WebsocketIsOn bool
+	AccessLogIsOn  bool
+	WebsocketIsOn  bool
+	CacheIsOn      bool
+	WafIsOn        bool
+	RemoteAddrIsOn bool
 
 	WebRoot string
 
@@ -483,6 +487,75 @@ func (this *CreateAction) RunPost(params struct {
 					}
 				}
 			}
+
+			// cache
+			if params.CacheIsOn {
+				var cacheConfig = &serverconfigs.HTTPCacheConfig{
+					IsPrior:         false,
+					IsOn:            true,
+					AddStatusHeader: true,
+					PurgeIsOn:       false,
+					PurgeKey:        "",
+					CacheRefs:       nil,
+				}
+				cacheConfigJSON, err := json.Marshal(cacheConfig)
+				if err != nil {
+					this.ErrorPage(err)
+					return
+				}
+				_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebCache(this.AdminContext(), &pb.UpdateHTTPWebCacheRequest{
+					WebId:     webConfig.Id,
+					CacheJSON: cacheConfigJSON,
+				})
+				if err != nil {
+					this.ErrorPage(err)
+					return
+				}
+			}
+
+			// waf
+			if params.WafIsOn {
+				var firewallRef = &firewallconfigs.HTTPFirewallRef{
+					IsPrior:          false,
+					IsOn:             true,
+					FirewallPolicyId: 0,
+				}
+				firewallRefJSON, err := json.Marshal(firewallRef)
+				if err != nil {
+					this.ErrorPage(err)
+					return
+				}
+				_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebFirewall(this.AdminContext(), &pb.UpdateHTTPWebFirewallRequest{
+					WebId:        webConfig.Id,
+					FirewallJSON: firewallRefJSON,
+				})
+				if err != nil {
+					this.ErrorPage(err)
+					return
+				}
+			}
+
+			// remoteAddr
+			var remoteAddrConfig = &serverconfigs.HTTPRemoteAddrConfig{
+				IsOn:  true,
+				Value: "${rawRemoteAddr}",
+			}
+			if params.RemoteAddrIsOn {
+				remoteAddrConfig.Value = "${remoteAddr}"
+			}
+			remoteAddrConfigJSON, err := json.Marshal(remoteAddrConfig)
+			if err != nil {
+				this.ErrorPage(err)
+				return
+			}
+			_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebRemoteAddr(this.AdminContext(), &pb.UpdateHTTPWebRemoteAddrRequest{
+				WebId:          webConfig.Id,
+				RemoteAddrJSON: remoteAddrConfigJSON,
+			})
+			if err != nil {
+				this.ErrorPage(err)
+				return
+			}
 		}
 	}
 

internal/web/actions/default/servers/groups/group/servergrouputils/utils.go

@@ -4,6 +4,7 @@ package servergrouputils
 
 import (
 	"errors"
+	teaconst "github.com/TeaOSLab/EdgeAdmin/internal/const"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/iwind/TeaGo/maps"
@@ -35,75 +36,115 @@ func InitGroup(parent *actionutils.ParentAction, groupId int64, menuItem string)
 		}
 
 		var urlPrefix = "/servers/groups/group/settings"
-		parent.Data["leftMenuItems"] = []maps.Map{
-			/**{
-				"name":     "Web设置",
-				"url":      urlPrefix + "/web?groupId=" + types.String(groupId),
-				"isActive": menuItem == "web",
-			},**/
+		var leftMenuItems = []maps.Map{
 			{
-				"name":     "HTTP反向代理",
+				"name":     "HTTP代理",
 				"url":      urlPrefix + "/httpReverseProxy?groupId=" + types.String(groupId),
 				"isActive": menuItem == "httpReverseProxy",
 				"isOn":     configInfoResp.HasHTTPReverseProxy,
 			},
 			{
-				"name":     "TCP反向代理",
+				"name":     "TCP代理",
 				"url":      urlPrefix + "/tcpReverseProxy?groupId=" + types.String(groupId),
 				"isActive": menuItem == "tcpReverseProxy",
 				"isOn":     configInfoResp.HasTCPReverseProxy,
 			},
 			{
-				"name":     "UDP反向代理",
+				"name":     "UDP代理",
 				"url":      urlPrefix + "/udpReverseProxy?groupId=" + types.String(groupId),
 				"isActive": menuItem == "udpReverseProxy",
 				"isOn":     configInfoResp.HasUDPReverseProxy,
 			},
-			/**{
-				"name": "-",
-				"url":  "",
-			},
-			{
-				"name":     "WAF",
-				"url":      urlPrefix + "/waf?groupId=" + types.String(groupId),
-				"isActive": menuItem == "waf",
-			},
-			{
-				"name":     "缓存",
-				"url":      urlPrefix + "/cache?groupId=" + types.String(groupId),
-				"isActive": menuItem == "cache",
-			},
-			{
-				"name":     "访问日志",
-				"url":      urlPrefix + "/accessLog?groupId=" + types.String(groupId),
-				"isActive": menuItem == "accessLog",
-			},
-			{
-				"name":     "统计",
-				"url":      urlPrefix + "/stat?groupId=" + types.String(groupId),
-				"isActive": menuItem == "stat",
-			},
-			{
-				"name":     "Gzip压缩",
-				"url":      urlPrefix + "/gzip?groupId=" + types.String(groupId),
-				"isActive": menuItem == "gzip",
-			},
-			{
-				"name":     "特殊页面",
-				"url":      urlPrefix + "/pages?groupId=" + types.String(groupId),
-				"isActive": menuItem == "page",
-			},
-			{
-				"name":     "HTTP Header",
-				"url":      urlPrefix + "/headers?groupId=" + types.String(groupId),
-				"isActive": menuItem == "header",
-			},
-			{
-				"name":     "Websocket",
-				"url":      urlPrefix + "/websocket?groupId=" + types.String(groupId),
-				"isActive": menuItem == "websocket",
-			},**/
 		}
+
+		if teaconst.IsPlus {
+			leftMenuItems = append([]maps.Map{
+				{
+					"name":     "Web设置",
+					"url":      urlPrefix + "/web?groupId=" + types.String(groupId),
+					"isActive": menuItem == "web",
+					"isOn":     configInfoResp.HasRootConfig,
+				},
+			}, leftMenuItems...)
+			leftMenuItems = append(leftMenuItems, []maps.Map{
+				{
+					"name": "-",
+					"url":  "",
+				},
+				{
+					"name":     "WAF",
+					"url":      urlPrefix + "/waf?groupId=" + types.String(groupId),
+					"isActive": menuItem == "waf",
+					"isOn":     configInfoResp.HasWAFConfig,
+				},
+				{
+					"name":     "缓存",
+					"url":      urlPrefix + "//cache?groupId=" + types.String(groupId),
+					"isActive": menuItem == "cache",
+					"isOn":     configInfoResp.HasCacheConfig,
+				},
+				{
+					"name":     "字符编码",
+					"url":      urlPrefix + "/charset?groupId=" + types.String(groupId),
+					"isActive": menuItem == "charset",
+					"isOn":     configInfoResp.HasCharsetConfig,
+				},
+				{
+					"name":     "访问日志",
+					"url":      urlPrefix + "/accessLog?groupId=" + types.String(groupId),
+					"isActive": menuItem == "accessLog",
+					"isOn":     configInfoResp.HasAccessLogConfig,
+				},
+				{
+					"name":     "统计",
+					"url":      urlPrefix + "/stat?groupId=" + types.String(groupId),
+					"isActive": menuItem == "stat",
+					"isOn":     configInfoResp.HasStatConfig,
+				},
+				{
+					"name":     "内容压缩",
+					"url":      urlPrefix + "/compression?groupId=" + types.String(groupId),
+					"isActive": menuItem == "compression",
+					"isOn":     configInfoResp.HasCompressionConfig,
+				},
+				{
+					"name":     "特殊页面",
+					"url":      urlPrefix + "/pages?groupId=" + types.String(groupId),
+					"isActive": menuItem == "pages",
+					"isOn":     configInfoResp.HasPagesConfig,
+				},
+				{
+					"name":     "HTTP Header",
+					"url":      urlPrefix + "/headers?groupId=" + types.String(groupId),
+					"isActive": menuItem == "headers",
+					"isOn":     configInfoResp.HasRequestHeadersConfig || configInfoResp.HasResponseHeadersConfig,
+				},
+				{
+					"name":     "Websocket",
+					"url":      urlPrefix + "/websocket?groupId=" + types.String(groupId),
+					"isActive": menuItem == "websocket",
+					"isOn":     configInfoResp.HasWebsocketConfig,
+				},
+				{
+					"name":     "WebP",
+					"url":      urlPrefix + "/webp?groupId=" + types.String(groupId),
+					"isActive": menuItem == "webp",
+					"isOn":     configInfoResp.HasWebPConfig,
+				},
+			}...)
+		}
+
+		leftMenuItems = append(leftMenuItems, maps.Map{
+			"name": "-",
+			"url":  "",
+		})
+		leftMenuItems = append(leftMenuItems, maps.Map{
+			"name":     "访客IP地址",
+			"url":      urlPrefix + "/remoteAddr?groupId=" + types.String(groupId),
+			"isActive": menuItem == "remoteAddr",
+			"isOn":     configInfoResp.HasRemoteAddrConfig,
+		})
+		parent.Data["leftMenuItems"] = leftMenuItems
 	}
 
 	return group, nil

internal/web/actions/default/servers/groups/group/settings/accessLog/index.go

@@ -0,0 +1,68 @@
+package accessLog
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("accessLog")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "accessLog")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	// 获取配置
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Data["webId"] = webConfig.Id
+	this.Data["accessLogConfig"] = webConfig.AccessLogRef
+
+	// 通用变量
+	this.Data["fields"] = serverconfigs.HTTPAccessLogFields
+	this.Data["defaultFieldCodes"] = serverconfigs.HTTPAccessLogDefaultFieldsCodes
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId         int64
+	AccessLogJSON []byte
+
+	Must *actions.Must
+}) {
+	// 日志
+	defer this.CreateLog(oplogs.LevelInfo, "修改Web %d 的访问日志设置", params.WebId)
+
+	// TODO 检查参数
+
+	_, err := this.RPC().HTTPWebRPC().UpdateHTTPWebAccessLog(this.AdminContext(), &pb.UpdateHTTPWebAccessLogRequest{
+		WebId:         params.WebId,
+		AccessLogJSON: params.AccessLogJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/accessLog/init.go

@@ -1,4 +1,4 @@
-package test
+package accessLog
 
 import (
 	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
@@ -9,12 +9,11 @@ import (
 func init() {
 	TeaGo.BeforeStart(func(server *TeaGo.Server) {
 		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "test").
-			Prefix("/ns/test").
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/accessLog").
 			GetPost("", new(IndexAction)).
-			Post("/nodeOptions", new(NodeOptionsAction)).
 			EndAll()
 	})
 }

internal/web/actions/default/servers/groups/group/settings/cache/index.go

@@ -0,0 +1,88 @@
+package cache
+
+import (
+	"encoding/json"
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("cache")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "cache")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["cacheConfig"] = webConfig.Cache
+
+	this.Data["cachePolicy"] = nil
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId     int64
+	CacheJSON []byte
+
+	Must *actions.Must
+}) {
+	// 日志
+	defer this.CreateLog(oplogs.LevelInfo, "修改Web %d 的缓存设置", params.WebId)
+
+	// 校验配置
+	cacheConfig := &serverconfigs.HTTPCacheConfig{}
+	err := json.Unmarshal(params.CacheJSON, cacheConfig)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	err = cacheConfig.Init()
+	if err != nil {
+		this.Fail("检查配置失败：" + err.Error())
+	}
+
+	// 去除不必要的部分
+	for _, cacheRef := range cacheConfig.CacheRefs {
+		cacheRef.CachePolicy = nil
+	}
+
+	cacheJSON, err := json.Marshal(cacheConfig)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebCache(this.AdminContext(), &pb.UpdateHTTPWebCacheRequest{
+		WebId:     params.WebId,
+		CacheJSON: cacheJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/cache/init.go

@@ -0,0 +1,21 @@
+package cache
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
+	"github.com/iwind/TeaGo"
+)
+
+func init() {
+	TeaGo.BeforeStart(func(server *TeaGo.Server) {
+		server.
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/cache").
+			GetPost("", new(IndexAction)).
+			GetPost("/purge", new(PurgeAction)).
+			GetPost("/preheat", new(PreheatAction)).
+			EndAll()
+	})
+}

internal/web/actions/default/servers/groups/group/settings/cache/preheat.go

@@ -0,0 +1,143 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package cache
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/nodes/nodeutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/messageconfigs"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+	"github.com/iwind/TeaGo/lists"
+	"strings"
+)
+
+type PreheatAction struct {
+	actionutils.ParentAction
+}
+
+func (this *PreheatAction) Init() {
+	this.Nav("", "setting", "preheat")
+	this.SecondMenu("cache")
+}
+
+func (this *PreheatAction) RunGet(params struct {
+	ServerId int64
+}) {
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["webConfig"] = webConfig
+
+	this.Show()
+}
+
+func (this *PreheatAction) RunPost(params struct {
+	ServerId int64
+	WebId    int64
+	Keys     string
+
+	Must *actions.Must
+}) {
+
+	// 创建日志
+	defer this.CreateLog(oplogs.LevelInfo, "预热服务 %d 缓存", params.ServerId)
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithId(this.AdminContext(), params.WebId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if webConfig == nil {
+		this.NotFound("httpWeb", params.WebId)
+		return
+	}
+	var cache = webConfig.Cache
+	if cache == nil || !cache.IsOn {
+		this.Fail("当前没有开启缓存")
+	}
+
+	serverResp, err := this.RPC().ServerRPC().FindEnabledUserServerBasic(this.AdminContext(), &pb.FindEnabledUserServerBasicRequest{ServerId: params.ServerId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	var server = serverResp.Server
+	if server == nil || server.NodeCluster == nil {
+		this.NotFound("server", params.ServerId)
+		return
+	}
+
+	var clusterId = server.NodeCluster.Id
+
+	clusterResp, err := this.RPC().NodeClusterRPC().FindEnabledNodeCluster(this.AdminContext(), &pb.FindEnabledNodeClusterRequest{NodeClusterId: clusterId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	var cluster = clusterResp.NodeCluster
+	if cluster == nil {
+		this.NotFound("nodeCluster", clusterId)
+		return
+	}
+	var cachePolicyId = cluster.HttpCachePolicyId
+	if cachePolicyId == 0 {
+		this.Fail("当前集群没有设置缓存策略")
+	}
+
+	cachePolicyResp, err := this.RPC().HTTPCachePolicyRPC().FindEnabledHTTPCachePolicyConfig(this.AdminContext(), &pb.FindEnabledHTTPCachePolicyConfigRequest{HttpCachePolicyId: cachePolicyId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	cachePolicyJSON := cachePolicyResp.HttpCachePolicyJSON
+	if len(cachePolicyJSON) == 0 {
+		this.Fail("找不到要操作的缓存策略")
+	}
+
+	if len(params.Keys) == 0 {
+		this.Fail("请输入要预热的Key列表")
+	}
+
+	realKeys := []string{}
+	for _, key := range strings.Split(params.Keys, "\n") {
+		key = strings.TrimSpace(key)
+		if len(key) == 0 {
+			continue
+		}
+		if lists.ContainsString(realKeys, key) {
+			continue
+		}
+		realKeys = append(realKeys, key)
+	}
+
+	// 发送命令
+	msg := &messageconfigs.PreheatCacheMessage{
+		CachePolicyJSON: cachePolicyJSON,
+		Keys:            realKeys,
+	}
+	results, err := nodeutils.SendMessageToCluster(this.AdminContext(), clusterId, messageconfigs.MessageCodePreheatCache, msg, 300)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	isAllOk := true
+	for _, result := range results {
+		if !result.IsOK {
+			isAllOk = false
+			break
+		}
+	}
+
+	this.Data["isAllOk"] = isAllOk
+	this.Data["results"] = results
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/cache/purge.go

@@ -0,0 +1,149 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package cache
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/nodes/nodeutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/messageconfigs"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+	"github.com/iwind/TeaGo/lists"
+	"strings"
+)
+
+type PurgeAction struct {
+	actionutils.ParentAction
+}
+
+func (this *PurgeAction) Init() {
+	this.Nav("", "setting", "purge")
+	this.SecondMenu("cache")
+}
+
+func (this *PurgeAction) RunGet(params struct {
+	ServerId int64
+}) {
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["webConfig"] = webConfig
+
+	this.Show()
+}
+
+func (this *PurgeAction) RunPost(params struct {
+	ServerId int64
+	WebId    int64
+	Type     string
+	Keys     string
+
+	Must *actions.Must
+}) {
+
+	// 创建日志
+	defer this.CreateLog(oplogs.LevelInfo, "删除服务 %d 缓存", params.ServerId)
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithId(this.AdminContext(), params.WebId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if webConfig == nil {
+		this.NotFound("httpWeb", params.WebId)
+		return
+	}
+	var cache = webConfig.Cache
+	if cache == nil || !cache.IsOn {
+		this.Fail("当前没有开启缓存")
+	}
+
+	serverResp, err := this.RPC().ServerRPC().FindEnabledUserServerBasic(this.AdminContext(), &pb.FindEnabledUserServerBasicRequest{ServerId: params.ServerId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	var server = serverResp.Server
+	if server == nil || server.NodeCluster == nil {
+		this.NotFound("server", params.ServerId)
+		return
+	}
+
+	var clusterId = server.NodeCluster.Id
+
+	clusterResp, err := this.RPC().NodeClusterRPC().FindEnabledNodeCluster(this.AdminContext(), &pb.FindEnabledNodeClusterRequest{NodeClusterId: clusterId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	var cluster = clusterResp.NodeCluster
+	if cluster == nil {
+		this.NotFound("nodeCluster", clusterId)
+		return
+	}
+	var cachePolicyId = cluster.HttpCachePolicyId
+	if cachePolicyId == 0 {
+		this.Fail("当前集群没有设置缓存策略")
+	}
+
+	cachePolicyResp, err := this.RPC().HTTPCachePolicyRPC().FindEnabledHTTPCachePolicyConfig(this.AdminContext(), &pb.FindEnabledHTTPCachePolicyConfigRequest{HttpCachePolicyId: cachePolicyId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	cachePolicyJSON := cachePolicyResp.HttpCachePolicyJSON
+	if len(cachePolicyJSON) == 0 {
+		this.Fail("找不到要操作的缓存策略")
+	}
+
+	if len(params.Keys) == 0 {
+		this.Fail("请输入要删除的Key列表")
+	}
+
+	realKeys := []string{}
+	for _, key := range strings.Split(params.Keys, "\n") {
+		key = strings.TrimSpace(key)
+		if len(key) == 0 {
+			continue
+		}
+		if lists.ContainsString(realKeys, key) {
+			continue
+		}
+		realKeys = append(realKeys, key)
+	}
+
+	// 发送命令
+	msg := &messageconfigs.PurgeCacheMessage{
+		CachePolicyJSON: cachePolicyJSON,
+		Keys:            realKeys,
+	}
+	if params.Type == "prefix" {
+		msg.Type = messageconfigs.PurgeCacheMessageTypeDir
+	} else {
+		msg.Type = messageconfigs.PurgeCacheMessageTypeFile
+	}
+	results, err := nodeutils.SendMessageToCluster(this.AdminContext(), clusterId, messageconfigs.MessageCodePurgeCache, msg, 10)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	isAllOk := true
+	for _, result := range results {
+		if !result.IsOK {
+			isAllOk = false
+			break
+		}
+	}
+
+	this.Data["isAllOk"] = isAllOk
+	this.Data["results"] = results
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/charset/index.go

@@ -0,0 +1,64 @@
+package charset
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/configutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("charset")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "charset")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["charsetConfig"] = webConfig.Charset
+
+	this.Data["usualCharsets"] = configutils.UsualCharsets
+	this.Data["allCharsets"] = configutils.AllCharsets
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId       int64
+	CharsetJSON []byte
+
+	Must *actions.Must
+}) {
+	defer this.CreateLog(oplogs.LevelInfo, "修改Web %d 的字符集设置", params.WebId)
+
+	_, err := this.RPC().HTTPWebRPC().UpdateHTTPWebCharset(this.AdminContext(), &pb.UpdateHTTPWebCharsetRequest{
+		WebId:       params.WebId,
+		CharsetJSON: params.CharsetJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/charset/init.go

@@ -0,0 +1,19 @@
+package charset
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
+	"github.com/iwind/TeaGo"
+)
+
+func init() {
+	TeaGo.BeforeStart(func(server *TeaGo.Server) {
+		server.
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/charset").
+			GetPost("", new(IndexAction)).
+			EndAll()
+	})
+}

internal/web/actions/default/servers/groups/group/settings/compression/index.go

@@ -0,0 +1,78 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package compression
+
+import (
+	"encoding/json"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("compression")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "compression")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	// WebId
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+
+	this.Data["compressionConfig"] = webConfig.Compression
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId           int64
+	CompressionJSON []byte
+
+	Must *actions.Must
+	CSRF *actionutils.CSRF
+}) {
+	defer this.CreateLogInfo("修改Web %d 的压缩设置", params.WebId)
+
+	// 校验配置
+	var compressionConfig = &serverconfigs.HTTPCompressionConfig{}
+	err := json.Unmarshal(params.CompressionJSON, compressionConfig)
+	if err != nil {
+		this.Fail("配置校验失败：" + err.Error())
+	}
+
+	err = compressionConfig.Init()
+	if err != nil {
+		this.Fail("配置校验失败：" + err.Error())
+	}
+
+	_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebCompression(this.AdminContext(), &pb.UpdateHTTPWebCompressionRequest{
+		WebId:           params.WebId,
+		CompressionJSON: params.CompressionJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/compression/init.go

@@ -0,0 +1,19 @@
+package compression
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
+	"github.com/iwind/TeaGo"
+)
+
+func init() {
+	TeaGo.BeforeStart(func(server *TeaGo.Server) {
+		server.
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/compression").
+			GetPost("", new(IndexAction)).
+			EndAll()
+	})
+}

internal/web/actions/default/servers/groups/group/settings/headers/index.go

@@ -0,0 +1,158 @@
+package headers
+
+import (
+	"encoding/json"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/shared"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("header")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "headers")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	webId := webConfig.Id
+	this.Data["webId"] = webId
+
+	isChanged := false
+	if webConfig.RequestHeaderPolicy == nil {
+		createHeaderPolicyResp, err := this.RPC().HTTPHeaderPolicyRPC().CreateHTTPHeaderPolicy(this.AdminContext(), &pb.CreateHTTPHeaderPolicyRequest{})
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+		headerPolicyId := createHeaderPolicyResp.HeaderPolicyId
+		ref := &shared.HTTPHeaderPolicyRef{
+			IsPrior:        false,
+			IsOn:           true,
+			HeaderPolicyId: headerPolicyId,
+		}
+		refJSON, err := json.Marshal(ref)
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+		_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebRequestHeader(this.AdminContext(), &pb.UpdateHTTPWebRequestHeaderRequest{
+			WebId:      webId,
+			HeaderJSON: refJSON,
+		})
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+		isChanged = true
+	}
+	if webConfig.ResponseHeaderPolicy == nil {
+		createHeaderPolicyResp, err := this.RPC().HTTPHeaderPolicyRPC().CreateHTTPHeaderPolicy(this.AdminContext(), &pb.CreateHTTPHeaderPolicyRequest{})
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+		headerPolicyId := createHeaderPolicyResp.HeaderPolicyId
+		ref := &shared.HTTPHeaderPolicyRef{
+			IsPrior:        false,
+			IsOn:           true,
+			HeaderPolicyId: headerPolicyId,
+		}
+		refJSON, err := json.Marshal(ref)
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+		_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebResponseHeader(this.AdminContext(), &pb.UpdateHTTPWebResponseHeaderRequest{
+			WebId:      webId,
+			HeaderJSON: refJSON,
+		})
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+		isChanged = true
+	}
+
+	// 重新获取配置
+	if isChanged {
+		webConfig, err = dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+	}
+
+	this.Data["requestHeaderRef"] = webConfig.RequestHeaderPolicyRef
+	this.Data["requestHeaderPolicy"] = webConfig.RequestHeaderPolicy
+	this.Data["responseHeaderRef"] = webConfig.ResponseHeaderPolicyRef
+	this.Data["responseHeaderPolicy"] = webConfig.ResponseHeaderPolicy
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId              int64
+	Type               string
+	RequestHeaderJSON  []byte
+	ResponseHeaderJSON []byte
+
+	Must *actions.Must
+}) {
+	defer this.CreateLogInfo("修改Web %d 的Header设置", params.WebId)
+
+	switch params.Type {
+	case "request":
+		// 检查配置
+		var requestHeaderRef = &shared.HTTPHeaderPolicyRef{}
+		err := json.Unmarshal(params.RequestHeaderJSON, requestHeaderRef)
+		if err != nil {
+			this.Fail("请求Header配置校验失败：" + err.Error() + ", JSON: " + string(params.RequestHeaderJSON))
+		}
+
+		_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebRequestHeader(this.AdminContext(), &pb.UpdateHTTPWebRequestHeaderRequest{
+			WebId:      params.WebId,
+			HeaderJSON: params.RequestHeaderJSON,
+		})
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+	case "response":
+		// 校验配置
+		var responseHeaderRef = &shared.HTTPHeaderPolicyRef{}
+		err := json.Unmarshal(params.ResponseHeaderJSON, responseHeaderRef)
+		if err != nil {
+			this.Fail("响应Header配置校验失败：" + err.Error() + ", JSON: " + string(params.ResponseHeaderJSON))
+		}
+
+		_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebResponseHeader(this.AdminContext(), &pb.UpdateHTTPWebResponseHeaderRequest{
+			WebId:      params.WebId,
+			HeaderJSON: params.ResponseHeaderJSON,
+		})
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/headers/init.go

@@ -0,0 +1,19 @@
+package headers
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
+	"github.com/iwind/TeaGo"
+)
+
+func init() {
+	TeaGo.BeforeStart(func(server *TeaGo.Server) {
+		server.
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/headers").
+			GetPost("", new(IndexAction)).
+			EndAll()
+	})
+}

internal/web/actions/default/servers/groups/group/settings/httpReverseProxy/setting.go

@@ -87,15 +87,26 @@ func (this *SettingAction) RunPost(params struct {
 		return
 	}
 
+	// PROXY Protocol
+	var proxyProtocolJSON = []byte{}
+	if reverseProxyConfig.ProxyProtocol != nil {
+		proxyProtocolJSON, err = json.Marshal(reverseProxyConfig.ProxyProtocol)
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+	}
+
 	// 设置反向代理相关信息
 	_, err = this.RPC().ReverseProxyRPC().UpdateReverseProxy(this.AdminContext(), &pb.UpdateReverseProxyRequest{
-		ReverseProxyId:  reverseProxyConfig.Id,
-		RequestHostType: types.Int32(reverseProxyConfig.RequestHostType),
-		RequestHost:     reverseProxyConfig.RequestHost,
-		RequestURI:      reverseProxyConfig.RequestURI,
-		StripPrefix:     reverseProxyConfig.StripPrefix,
-		AutoFlush:       reverseProxyConfig.AutoFlush,
-		AddHeaders:      reverseProxyConfig.AddHeaders,
+		ReverseProxyId:    reverseProxyConfig.Id,
+		RequestHostType:   types.Int32(reverseProxyConfig.RequestHostType),
+		RequestHost:       reverseProxyConfig.RequestHost,
+		RequestURI:        reverseProxyConfig.RequestURI,
+		StripPrefix:       reverseProxyConfig.StripPrefix,
+		AutoFlush:         reverseProxyConfig.AutoFlush,
+		AddHeaders:        reverseProxyConfig.AddHeaders,
+		ProxyProtocolJSON: proxyProtocolJSON,
 	})
 
 	this.Success()

internal/web/actions/default/servers/groups/group/settings/index/index.go

@@ -3,6 +3,7 @@
 package reverseProxy
 
 import (
+	teaconst "github.com/TeaOSLab/EdgeAdmin/internal/const"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
 	"github.com/iwind/TeaGo/types"
 )
@@ -18,6 +19,10 @@ func (this *IndexAction) Init() {
 func (this *IndexAction) RunGet(params struct {
 	GroupId int64
 }) {
-	this.RedirectURL("/servers/groups/group/settings/httpReverseProxy?groupId=" + types.String(params.GroupId))
+	if teaconst.IsPlus {
+		this.RedirectURL("/servers/groups/group/settings/web?groupId=" + types.String(params.GroupId))
+	} else {
+		this.RedirectURL("/servers/groups/group/settings/httpReverseProxy?groupId=" + types.String(params.GroupId))
+	}
 	return
 }

internal/web/actions/default/servers/groups/group/settings/pages/index.go

@@ -0,0 +1,73 @@
+package pages
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("pages")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "pages")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["pages"] = webConfig.Pages
+	this.Data["shutdownConfig"] = webConfig.Shutdown
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId        int64
+	PagesJSON    string
+	ShutdownJSON string
+	Must         *actions.Must
+}) {
+	// 日志
+	defer this.CreateLog(oplogs.LevelInfo, "修改Web %d 的设置", params.WebId)
+
+	// TODO 检查配置
+
+	_, err := this.RPC().HTTPWebRPC().UpdateHTTPWebPages(this.AdminContext(), &pb.UpdateHTTPWebPagesRequest{
+		WebId:     params.WebId,
+		PagesJSON: []byte(params.PagesJSON),
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebShutdown(this.AdminContext(), &pb.UpdateHTTPWebShutdownRequest{
+		WebId:        params.WebId,
+		ShutdownJSON: []byte(params.ShutdownJSON),
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/pages/init.go

@@ -0,0 +1,19 @@
+package pages
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
+	"github.com/iwind/TeaGo"
+)
+
+func init() {
+	TeaGo.BeforeStart(func(server *TeaGo.Server) {
+		server.
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/pages").
+			GetPost("", new(IndexAction)).
+			EndAll()
+	})
+}

internal/web/actions/default/servers/groups/group/settings/remoteAddr/index.go

@@ -0,0 +1,68 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package remoteAddr
+
+import (
+	"encoding/json"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("remoteAddr")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "remoteAddr")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["remoteAddrConfig"] = webConfig.RemoteAddr
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId          int64
+	RemoteAddrJSON []byte
+
+	Must *actions.Must
+	CSRF *actionutils.CSRF
+}) {
+	var remoteAddrConfig = &serverconfigs.HTTPRemoteAddrConfig{}
+	err := json.Unmarshal(params.RemoteAddrJSON, remoteAddrConfig)
+	if err != nil {
+		this.Fail("参数校验失败：" + err.Error())
+	}
+
+	_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebRemoteAddr(this.AdminContext(), &pb.UpdateHTTPWebRemoteAddrRequest{
+		WebId:          params.WebId,
+		RemoteAddrJSON: params.RemoteAddrJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/remoteAddr/init.go

@@ -0,0 +1,19 @@
+package remoteAddr
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
+	"github.com/iwind/TeaGo"
+)
+
+func init() {
+	TeaGo.BeforeStart(func(server *TeaGo.Server) {
+		server.
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/remoteAddr").
+			GetPost("", new(IndexAction)).
+			EndAll()
+	})
+}

internal/web/actions/default/servers/groups/group/settings/stat/index.go

@@ -0,0 +1,60 @@
+package stat
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("stat")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "stat")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["statConfig"] = webConfig.StatRef
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId    int64
+	StatJSON []byte
+
+	Must *actions.Must
+}) {
+	defer this.CreateLogInfo("修改Web %d 的统计设置", params.WebId)
+
+	// TODO 校验配置
+
+	_, err := this.RPC().HTTPWebRPC().UpdateHTTPWebStat(this.AdminContext(), &pb.UpdateHTTPWebStatRequest{
+		WebId:    params.WebId,
+		StatJSON: params.StatJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/stat/init.go

@@ -1,4 +1,4 @@
-package logs
+package stat
 
 import (
 	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
@@ -9,11 +9,11 @@ import (
 func init() {
 	TeaGo.BeforeStart(func(server *TeaGo.Server) {
 		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeNS)).
-			Data("teaMenu", "ns").
-			Data("teaSubMenu", "accessLog").
-			Prefix("/ns/clusters/accessLogs").
-			Get("", new(IndexAction)).
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/stat").
+			GetPost("", new(IndexAction)).
 			EndAll()
 	})
 }

internal/web/actions/default/servers/groups/group/settings/tcpReverseProxy/setting.go

@@ -87,15 +87,26 @@ func (this *SettingAction) RunPost(params struct {
 		return
 	}
 
+	// PROXY Protocol
+	var proxyProtocolJSON = []byte{}
+	if reverseProxyConfig.ProxyProtocol != nil {
+		proxyProtocolJSON, err = json.Marshal(reverseProxyConfig.ProxyProtocol)
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+	}
+
 	// 设置反向代理相关信息
 	_, err = this.RPC().ReverseProxyRPC().UpdateReverseProxy(this.AdminContext(), &pb.UpdateReverseProxyRequest{
-		ReverseProxyId:  reverseProxyConfig.Id,
-		RequestHostType: types.Int32(reverseProxyConfig.RequestHostType),
-		RequestHost:     reverseProxyConfig.RequestHost,
-		RequestURI:      reverseProxyConfig.RequestURI,
-		StripPrefix:     reverseProxyConfig.StripPrefix,
-		AutoFlush:       reverseProxyConfig.AutoFlush,
-		AddHeaders:      reverseProxyConfig.AddHeaders,
+		ReverseProxyId:    reverseProxyConfig.Id,
+		RequestHostType:   types.Int32(reverseProxyConfig.RequestHostType),
+		RequestHost:       reverseProxyConfig.RequestHost,
+		RequestURI:        reverseProxyConfig.RequestURI,
+		StripPrefix:       reverseProxyConfig.StripPrefix,
+		AutoFlush:         reverseProxyConfig.AutoFlush,
+		AddHeaders:        reverseProxyConfig.AddHeaders,
+		ProxyProtocolJSON: proxyProtocolJSON,
 	})
 
 	this.Success()

internal/web/actions/default/servers/groups/group/settings/waf/group.go

@@ -0,0 +1,100 @@
+package waf
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
+	"github.com/iwind/TeaGo/lists"
+	"github.com/iwind/TeaGo/maps"
+	"strings"
+)
+
+type GroupAction struct {
+	actionutils.ParentAction
+}
+
+func (this *GroupAction) Init() {
+	this.Nav("", "setting", this.ParamString("type"))
+	this.SecondMenu("waf")
+}
+
+func (this *GroupAction) RunGet(params struct {
+	FirewallPolicyId int64
+	GroupId          int64
+	Type             string
+}) {
+	this.Data["type"] = params.Type
+	this.Data["firewallPolicyId"] = params.FirewallPolicyId
+
+	// policy
+	firewallPolicy, err := dao.SharedHTTPFirewallPolicyDAO.FindEnabledHTTPFirewallPolicyConfig(this.AdminContext(), params.FirewallPolicyId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if firewallPolicy == nil {
+		this.NotFound("firewallPolicy", params.FirewallPolicyId)
+		return
+	}
+
+	// group config
+	groupConfig, err := dao.SharedHTTPFirewallRuleGroupDAO.FindRuleGroupConfig(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if groupConfig == nil {
+		this.NotFound("firewallRuleGroup", params.GroupId)
+		return
+	}
+
+	this.Data["group"] = groupConfig
+
+	// rule sets
+	this.Data["sets"] = lists.Map(groupConfig.Sets, func(k int, v interface{}) interface{} {
+		set := v.(*firewallconfigs.HTTPFirewallRuleSet)
+
+		var actionMaps = []maps.Map{}
+		for _, action := range set.Actions {
+			def := firewallconfigs.FindActionDefinition(action.Code)
+			if def == nil {
+				continue
+			}
+
+			actionMaps = append(actionMaps, maps.Map{
+				"code":     strings.ToUpper(action.Code),
+				"name":     def.Name,
+				"category": def.Category,
+				"options":  action.Options,
+			})
+		}
+
+		return maps.Map{
+			"id":   set.Id,
+			"name": set.Name,
+			"rules": lists.Map(set.Rules, func(k int, v interface{}) interface{} {
+				rule := v.(*firewallconfigs.HTTPFirewallRule)
+				var errString = ""
+				var err = rule.Init()
+				if err != nil {
+					errString = err.Error()
+				}
+				return maps.Map{
+					"param":             rule.Param,
+					"paramFilters":      rule.ParamFilters,
+					"operator":          rule.Operator,
+					"value":             rule.Value,
+					"isCaseInsensitive": rule.IsCaseInsensitive,
+					"isComposed":        firewallconfigs.CheckCheckpointIsComposed(rule.Prefix()),
+					"checkpointOptions": rule.CheckpointOptions,
+					"err":               errString,
+				}
+			}),
+			"isOn":      set.IsOn,
+			"actions":   actionMaps,
+			"connector": strings.ToUpper(set.Connector),
+		}
+	})
+
+	this.Show()
+}

internal/web/actions/default/servers/groups/group/settings/waf/groups.go

@@ -0,0 +1,83 @@
+package waf
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/iwind/TeaGo/maps"
+)
+
+type GroupsAction struct {
+	actionutils.ParentAction
+}
+
+func (this *GroupsAction) Init() {
+	this.Nav("", "setting", this.ParamString("type"))
+	this.SecondMenu("waf")
+}
+
+func (this *GroupsAction) RunGet(params struct {
+	ServerId         int64
+	FirewallPolicyId int64
+	Type             string
+}) {
+	this.Data["firewallPolicyId"] = params.FirewallPolicyId
+	this.Data["type"] = params.Type
+
+	firewallPolicy, err := dao.SharedHTTPFirewallPolicyDAO.FindEnabledHTTPFirewallPolicyConfig(this.AdminContext(), params.FirewallPolicyId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if firewallPolicy == nil {
+		this.NotFound("firewallPolicy", params.FirewallPolicyId)
+		return
+	}
+
+	groupMaps := []maps.Map{}
+
+	// inbound
+	if params.Type == "inbound" {
+		if firewallPolicy.Inbound != nil {
+			for _, g := range firewallPolicy.Inbound.Groups {
+				groupMaps = append(groupMaps, maps.Map{
+					"id":          g.Id,
+					"name":        g.Name,
+					"code":        g.Code,
+					"isOn":        g.IsOn,
+					"description": g.Description,
+					"countSets":   len(g.Sets),
+					"canDelete":   len(g.Code) == 0,
+				})
+			}
+		}
+	}
+
+	// outbound
+	if params.Type == "outbound" {
+		if firewallPolicy.Outbound != nil {
+			for _, g := range firewallPolicy.Outbound.Groups {
+				groupMaps = append(groupMaps, maps.Map{
+					"id":          g.Id,
+					"name":        g.Name,
+					"code":        g.Code,
+					"isOn":        g.IsOn,
+					"description": g.Description,
+					"countSets":   len(g.Sets),
+					"canDelete":   len(g.Code) == 0,
+				})
+			}
+		}
+	}
+
+	this.Data["groups"] = groupMaps
+
+	// WAF是否启用
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Data["wafIsOn"] = webConfig.FirewallRef != nil && webConfig.FirewallRef.IsOn
+
+	this.Show()
+}

internal/web/actions/default/servers/groups/group/settings/waf/index.go

@@ -0,0 +1,76 @@
+package waf
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("waf")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "waf")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["firewallConfig"] = webConfig.FirewallRef
+
+	// 获取当前服务所在集群的WAF设置
+	this.Data["firewallPolicy"] = nil
+
+	// 当前的Server独立设置
+	if webConfig.FirewallRef == nil || webConfig.FirewallRef.FirewallPolicyId == 0 {
+		firewallPolicyId, err := dao.SharedHTTPWebDAO.InitEmptyHTTPFirewallPolicy(this.AdminContext(), params.GroupId, 0, webConfig.Id, webConfig.FirewallRef != nil && webConfig.FirewallRef.IsOn)
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+		this.Data["firewallPolicyId"] = firewallPolicyId
+	} else {
+		this.Data["firewallPolicyId"] = webConfig.FirewallRef.FirewallPolicyId
+	}
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId        int64
+	FirewallJSON []byte
+
+	Must *actions.Must
+}) {
+	defer this.CreateLogInfo("修改Web %d 的WAF设置", params.WebId)
+
+	// TODO 检查配置
+
+	_, err := this.RPC().HTTPWebRPC().UpdateHTTPWebFirewall(this.AdminContext(), &pb.UpdateHTTPWebFirewallRequest{
+		WebId:        params.WebId,
+		FirewallJSON: params.FirewallJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/waf/init.go

@@ -0,0 +1,33 @@
+package waf
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/server/settings/waf/ipadmin"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/serverutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
+	"github.com/iwind/TeaGo"
+)
+
+func init() {
+	TeaGo.BeforeStart(func(server *TeaGo.Server) {
+		server.
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Helper(serverutils.NewServerHelper()).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/waf").
+			GetPost("", new(IndexAction)).
+			Get("/ipadmin/allowList", new(ipadmin.AllowListAction)).
+			Get("/ipadmin/denyList", new(ipadmin.DenyListAction)).
+			GetPost("/ipadmin/countries", new(ipadmin.CountriesAction)).
+			GetPost("/ipadmin/provinces", new(ipadmin.ProvincesAction)).
+			GetPost("/ipadmin/updateIPPopup", new(ipadmin.UpdateIPPopupAction)).
+			Post("/ipadmin/deleteIP", new(ipadmin.DeleteIPAction)).
+			GetPost("/ipadmin/test", new(ipadmin.TestAction)).
+
+			// 规则相关
+			Get("/groups", new(GroupsAction)).
+			Get("/group", new(GroupAction)).
+			EndAll()
+	})
+}

internal/web/actions/default/servers/groups/group/settings/waf/ipadmin/allowList.go

@@ -0,0 +1,95 @@
+package ipadmin
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
+	"github.com/iwind/TeaGo/maps"
+	timeutil "github.com/iwind/TeaGo/utils/time"
+	"time"
+)
+
+type AllowListAction struct {
+	actionutils.ParentAction
+}
+
+func (this *AllowListAction) Init() {
+	this.Nav("", "setting", "allowList")
+	this.SecondMenu("waf")
+}
+
+func (this *AllowListAction) RunGet(params struct {
+	ServerId         int64
+	FirewallPolicyId int64
+}) {
+	this.Data["featureIsOn"] = true
+	this.Data["firewallPolicyId"] = params.FirewallPolicyId
+
+	listId, err := dao.SharedIPListDAO.FindAllowIPListIdWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	// 创建
+	if listId == 0 {
+		listId, err = dao.SharedIPListDAO.CreateIPListForServerId(this.AdminContext(), params.ServerId, "white")
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+	}
+
+	this.Data["listId"] = listId
+
+	// 数量
+	countResp, err := this.RPC().IPItemRPC().CountIPItemsWithListId(this.AdminContext(), &pb.CountIPItemsWithListIdRequest{IpListId: listId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	count := countResp.Count
+	page := this.NewPage(count)
+	this.Data["page"] = page.AsHTML()
+
+	// 列表
+	itemsResp, err := this.RPC().IPItemRPC().ListIPItemsWithListId(this.AdminContext(), &pb.ListIPItemsWithListIdRequest{
+		IpListId: listId,
+		Offset:   page.Offset,
+		Size:     page.Size,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	itemMaps := []maps.Map{}
+	for _, item := range itemsResp.IpItems {
+		expiredTime := ""
+		if item.ExpiredAt > 0 {
+			expiredTime = timeutil.FormatTime("Y-m-d H:i:s", item.ExpiredAt)
+		}
+
+		itemMaps = append(itemMaps, maps.Map{
+			"id":             item.Id,
+			"ipFrom":         item.IpFrom,
+			"ipTo":           item.IpTo,
+			"expiredTime":    expiredTime,
+			"reason":         item.Reason,
+			"type":           item.Type,
+			"isExpired":      item.ExpiredAt > 0 && item.ExpiredAt < time.Now().Unix(),
+			"eventLevelName": firewallconfigs.FindFirewallEventLevelName(item.EventLevel),
+		})
+	}
+	this.Data["items"] = itemMaps
+
+	// WAF是否启用
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Data["wafIsOn"] = webConfig.FirewallRef != nil && webConfig.FirewallRef.IsOn
+
+	this.Show()
+}

internal/web/actions/default/servers/groups/group/settings/waf/ipadmin/countries.go

@@ -0,0 +1,121 @@
+package ipadmin
+
+import (
+	"encoding/json"
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
+	"github.com/iwind/TeaGo/actions"
+	"github.com/iwind/TeaGo/lists"
+	"github.com/iwind/TeaGo/maps"
+	"strings"
+)
+
+type CountriesAction struct {
+	actionutils.ParentAction
+}
+
+func (this *CountriesAction) Init() {
+	this.Nav("", "setting", "country")
+	this.SecondMenu("waf")
+}
+
+func (this *CountriesAction) RunGet(params struct {
+	FirewallPolicyId int64
+	ServerId         int64
+}) {
+	this.Data["featureIsOn"] = true
+	this.Data["firewallPolicyId"] = params.FirewallPolicyId
+
+	this.Data["subMenuItem"] = "region"
+
+	// 当前选中的地区
+	policyConfig, err := dao.SharedHTTPFirewallPolicyDAO.FindEnabledHTTPFirewallPolicyConfig(this.AdminContext(), params.FirewallPolicyId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if policyConfig == nil {
+		this.NotFound("firewallPolicy", params.FirewallPolicyId)
+		return
+	}
+	selectedCountryIds := []int64{}
+	if policyConfig.Inbound != nil && policyConfig.Inbound.Region != nil {
+		selectedCountryIds = policyConfig.Inbound.Region.DenyCountryIds
+	}
+
+	countriesResp, err := this.RPC().RegionCountryRPC().FindAllEnabledRegionCountries(this.AdminContext(), &pb.FindAllEnabledRegionCountriesRequest{})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	countryMaps := []maps.Map{}
+	for _, country := range countriesResp.Countries {
+		countryMaps = append(countryMaps, maps.Map{
+			"id":        country.Id,
+			"name":      country.Name,
+			"letter":    strings.ToUpper(string(country.Pinyin[0][0])),
+			"isChecked": lists.ContainsInt64(selectedCountryIds, country.Id),
+		})
+	}
+	this.Data["countries"] = countryMaps
+
+	// WAF是否启用
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Data["wafIsOn"] = webConfig.FirewallRef != nil && webConfig.FirewallRef.IsOn
+
+	this.Show()
+}
+
+func (this *CountriesAction) RunPost(params struct {
+	FirewallPolicyId int64
+	CountryIds       []int64
+
+	Must *actions.Must
+}) {
+	// 日志
+	defer this.CreateLog(oplogs.LevelInfo, "WAF策略 %d 设置禁止访问的国家和地区", params.FirewallPolicyId)
+
+	policyConfig, err := dao.SharedHTTPFirewallPolicyDAO.FindEnabledHTTPFirewallPolicyConfig(this.AdminContext(), params.FirewallPolicyId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if policyConfig == nil {
+		this.NotFound("firewallPolicy", params.FirewallPolicyId)
+		return
+	}
+
+	if policyConfig.Inbound == nil {
+		policyConfig.Inbound = &firewallconfigs.HTTPFirewallInboundConfig{IsOn: true}
+	}
+	if policyConfig.Inbound.Region == nil {
+		policyConfig.Inbound.Region = &firewallconfigs.HTTPFirewallRegionConfig{
+			IsOn: true,
+		}
+	}
+	policyConfig.Inbound.Region.DenyCountryIds = params.CountryIds
+
+	inboundJSON, err := json.Marshal(policyConfig.Inbound)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	_, err = this.RPC().HTTPFirewallPolicyRPC().UpdateHTTPFirewallInboundConfig(this.AdminContext(), &pb.UpdateHTTPFirewallInboundConfigRequest{
+		HttpFirewallPolicyId: params.FirewallPolicyId,
+		InboundJSON:          inboundJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/waf/ipadmin/deleteIP.go

@@ -0,0 +1,29 @@
+package ipadmin
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+)
+
+type DeleteIPAction struct {
+	actionutils.ParentAction
+}
+
+func (this *DeleteIPAction) RunPost(params struct {
+	FirewallPolicyId int64
+	ItemId           int64
+}) {
+	// 日志
+	defer this.CreateLog(oplogs.LevelInfo, "从WAF策略 %d 名单中删除IP %d", params.FirewallPolicyId, params.ItemId)
+
+	// TODO 判断权限
+
+	_, err := this.RPC().IPItemRPC().DeleteIPItem(this.AdminContext(), &pb.DeleteIPItemRequest{IpItemId: params.ItemId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/waf/ipadmin/denyList.go

@@ -0,0 +1,95 @@
+package ipadmin
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
+	"github.com/iwind/TeaGo/maps"
+	timeutil "github.com/iwind/TeaGo/utils/time"
+	"time"
+)
+
+type DenyListAction struct {
+	actionutils.ParentAction
+}
+
+func (this *DenyListAction) Init() {
+	this.Nav("", "setting", "denyList")
+	this.SecondMenu("waf")
+}
+
+func (this *DenyListAction) RunGet(params struct {
+	FirewallPolicyId int64
+	ServerId         int64
+}) {
+	this.Data["featureIsOn"] = true
+	this.Data["firewallPolicyId"] = params.FirewallPolicyId
+
+	listId, err := dao.SharedIPListDAO.FindDenyIPListIdWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	// 创建
+	if listId == 0 {
+		listId, err = dao.SharedIPListDAO.CreateIPListForServerId(this.AdminContext(), params.ServerId, "black")
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+	}
+
+	this.Data["listId"] = listId
+
+	// 数量
+	countResp, err := this.RPC().IPItemRPC().CountIPItemsWithListId(this.AdminContext(), &pb.CountIPItemsWithListIdRequest{IpListId: listId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	count := countResp.Count
+	page := this.NewPage(count)
+	this.Data["page"] = page.AsHTML()
+
+	// 列表
+	itemsResp, err := this.RPC().IPItemRPC().ListIPItemsWithListId(this.AdminContext(), &pb.ListIPItemsWithListIdRequest{
+		IpListId: listId,
+		Offset:   page.Offset,
+		Size:     page.Size,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	itemMaps := []maps.Map{}
+	for _, item := range itemsResp.IpItems {
+		expiredTime := ""
+		if item.ExpiredAt > 0 {
+			expiredTime = timeutil.FormatTime("Y-m-d H:i:s", item.ExpiredAt)
+		}
+
+		itemMaps = append(itemMaps, maps.Map{
+			"id":             item.Id,
+			"ipFrom":         item.IpFrom,
+			"ipTo":           item.IpTo,
+			"expiredTime":    expiredTime,
+			"reason":         item.Reason,
+			"type":           item.Type,
+			"isExpired":      item.ExpiredAt > 0 && item.ExpiredAt < time.Now().Unix(),
+			"eventLevelName": firewallconfigs.FindFirewallEventLevelName(item.EventLevel),
+		})
+	}
+	this.Data["items"] = itemMaps
+
+	// WAF是否启用
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Data["wafIsOn"] = webConfig.FirewallRef != nil && webConfig.FirewallRef.IsOn
+
+	this.Show()
+}

internal/web/actions/default/servers/groups/group/settings/waf/ipadmin/provinces.go

@@ -0,0 +1,122 @@
+package ipadmin
+
+import (
+	"encoding/json"
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
+	"github.com/iwind/TeaGo/actions"
+	"github.com/iwind/TeaGo/lists"
+	"github.com/iwind/TeaGo/maps"
+)
+
+const ChinaCountryId = 1
+
+type ProvincesAction struct {
+	actionutils.ParentAction
+}
+
+func (this *ProvincesAction) Init() {
+	this.Nav("", "setting", "province")
+	this.SecondMenu("waf")
+}
+
+func (this *ProvincesAction) RunGet(params struct {
+	FirewallPolicyId int64
+	ServerId         int64
+}) {
+	this.Data["featureIsOn"] = true
+	this.Data["firewallPolicyId"] = params.FirewallPolicyId
+	this.Data["subMenuItem"] = "province"
+
+	// 当前选中的省份
+	policyConfig, err := dao.SharedHTTPFirewallPolicyDAO.FindEnabledHTTPFirewallPolicyConfig(this.AdminContext(), params.FirewallPolicyId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if policyConfig == nil {
+		this.NotFound("firewallPolicy", params.FirewallPolicyId)
+		return
+	}
+	selectedProvinceIds := []int64{}
+	if policyConfig.Inbound != nil && policyConfig.Inbound.Region != nil {
+		selectedProvinceIds = policyConfig.Inbound.Region.DenyProvinceIds
+	}
+
+	provincesResp, err := this.RPC().RegionProvinceRPC().FindAllEnabledRegionProvincesWithCountryId(this.AdminContext(), &pb.FindAllEnabledRegionProvincesWithCountryIdRequest{
+		CountryId: int64(ChinaCountryId),
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	provinceMaps := []maps.Map{}
+	for _, province := range provincesResp.Provinces {
+		provinceMaps = append(provinceMaps, maps.Map{
+			"id":        province.Id,
+			"name":      province.Name,
+			"isChecked": lists.ContainsInt64(selectedProvinceIds, province.Id),
+		})
+	}
+	this.Data["provinces"] = provinceMaps
+
+	// WAF是否启用
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Data["wafIsOn"] = webConfig.FirewallRef != nil && webConfig.FirewallRef.IsOn
+
+	this.Show()
+}
+
+func (this *ProvincesAction) RunPost(params struct {
+	FirewallPolicyId int64
+	ProvinceIds      []int64
+
+	Must *actions.Must
+}) {
+	// 日志
+	defer this.CreateLog(oplogs.LevelInfo, "WAF策略 %d 设置禁止访问的省份", params.FirewallPolicyId)
+
+	policyConfig, err := dao.SharedHTTPFirewallPolicyDAO.FindEnabledHTTPFirewallPolicyConfig(this.AdminContext(), params.FirewallPolicyId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	if policyConfig == nil {
+		this.NotFound("firewallPolicy", params.FirewallPolicyId)
+		return
+	}
+
+	if policyConfig.Inbound == nil {
+		policyConfig.Inbound = &firewallconfigs.HTTPFirewallInboundConfig{IsOn: true}
+	}
+	if policyConfig.Inbound.Region == nil {
+		policyConfig.Inbound.Region = &firewallconfigs.HTTPFirewallRegionConfig{
+			IsOn: true,
+		}
+	}
+	policyConfig.Inbound.Region.DenyProvinceIds = params.ProvinceIds
+
+	inboundJSON, err := json.Marshal(policyConfig.Inbound)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	_, err = this.RPC().HTTPFirewallPolicyRPC().UpdateHTTPFirewallInboundConfig(this.AdminContext(), &pb.UpdateHTTPFirewallInboundConfigRequest{
+		HttpFirewallPolicyId: params.FirewallPolicyId,
+		InboundJSON:          inboundJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/waf/ipadmin/test.go

@@ -0,0 +1,100 @@
+package ipadmin
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
+	"github.com/iwind/TeaGo/actions"
+	"github.com/iwind/TeaGo/maps"
+	timeutil "github.com/iwind/TeaGo/utils/time"
+)
+
+type TestAction struct {
+	actionutils.ParentAction
+}
+
+func (this *TestAction) Init() {
+	this.Nav("", "setting", "test")
+	this.SecondMenu("waf")
+}
+
+func (this *TestAction) RunGet(params struct {
+	ServerId         int64
+	FirewallPolicyId int64
+}) {
+	this.Data["featureIsOn"] = true
+	this.Data["firewallPolicyId"] = params.FirewallPolicyId
+	this.Data["subMenuItem"] = "province"
+
+	// WAF是否启用
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerId(this.AdminContext(), params.ServerId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Data["wafIsOn"] = webConfig.FirewallRef != nil && webConfig.FirewallRef.IsOn
+
+	this.Show()
+}
+
+func (this *TestAction) RunPost(params struct {
+	FirewallPolicyId int64
+	Ip               string
+
+	Must *actions.Must
+}) {
+	resp, err := this.RPC().HTTPFirewallPolicyRPC().CheckHTTPFirewallPolicyIPStatus(this.AdminContext(), &pb.CheckHTTPFirewallPolicyIPStatusRequest{
+		HttpFirewallPolicyId: params.FirewallPolicyId,
+		Ip:                   params.Ip,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	resultMap := maps.Map{
+		"isDone":    true,
+		"isFound":   resp.IsFound,
+		"isOk":      resp.IsOk,
+		"error":     resp.Error,
+		"isAllowed": resp.IsAllowed,
+	}
+
+	if resp.IpList != nil {
+		resultMap["list"] = maps.Map{
+			"id":   resp.IpList.Id,
+			"name": resp.IpList.Name,
+		}
+	}
+	if resp.IpItem != nil {
+		resultMap["item"] = maps.Map{
+			"id":             resp.IpItem.Id,
+			"ipFrom":         resp.IpItem.IpFrom,
+			"ipTo":           resp.IpItem.IpTo,
+			"reason":         resp.IpItem.Reason,
+			"expiredAt":      resp.IpItem.ExpiredAt,
+			"expiredTime":    timeutil.FormatTime("Y-m-d H:i:s", resp.IpItem.ExpiredAt),
+			"type":           resp.IpItem.Type,
+			"eventLevelName": firewallconfigs.FindFirewallEventLevelName(resp.IpItem.EventLevel),
+		}
+	}
+
+	if resp.RegionCountry != nil {
+		resultMap["country"] = maps.Map{
+			"id":   resp.RegionCountry.Id,
+			"name": resp.RegionCountry.Name,
+		}
+	}
+
+	if resp.RegionProvince != nil {
+		resultMap["province"] = maps.Map{
+			"id":   resp.RegionProvince.Id,
+			"name": resp.RegionProvince.Name,
+		}
+	}
+
+	this.Data["result"] = resultMap
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/waf/ipadmin/updateIPPopup.go

@@ -0,0 +1,117 @@
+package ipadmin
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/oplogs"
+	"github.com/TeaOSLab/EdgeAdmin/internal/utils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+	"github.com/iwind/TeaGo/maps"
+)
+
+type UpdateIPPopupAction struct {
+	actionutils.ParentAction
+}
+
+func (this *UpdateIPPopupAction) Init() {
+	this.Nav("", "", "")
+}
+
+func (this *UpdateIPPopupAction) RunGet(params struct {
+	ItemId int64
+}) {
+	itemResp, err := this.RPC().IPItemRPC().FindEnabledIPItem(this.AdminContext(), &pb.FindEnabledIPItemRequest{IpItemId: params.ItemId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	item := itemResp.IpItem
+	if item == nil {
+		this.NotFound("ipItem", params.ItemId)
+		return
+	}
+
+	this.Data["item"] = maps.Map{
+		"id":         item.Id,
+		"ipFrom":     item.IpFrom,
+		"ipTo":       item.IpTo,
+		"expiredAt":  item.ExpiredAt,
+		"reason":     item.Reason,
+		"type":       item.Type,
+		"eventLevel": item.EventLevel,
+	}
+
+	this.Data["type"] = item.Type
+
+	this.Show()
+}
+
+func (this *UpdateIPPopupAction) RunPost(params struct {
+	ItemId int64
+
+	IpFrom     string
+	IpTo       string
+	ExpiredAt  int64
+	Reason     string
+	Type       string
+	EventLevel string
+
+	Must *actions.Must
+	CSRF *actionutils.CSRF
+}) {
+	// 日志
+	defer this.CreateLog(oplogs.LevelInfo, "修改WAF策略名单中的IP %d", params.ItemId)
+
+	// TODO 校验ItemId所属用户
+
+	switch params.Type {
+	case "ipv4":
+		params.Must.
+			Field("ipFrom", params.IpFrom).
+			Require("请输入开始IP")
+
+		// 校验IP格式（ipFrom/ipTo）
+		var ipFromLong uint64
+		if !utils.IsIPv4(params.IpFrom) {
+			this.Fail("请输入正确的开始IP")
+		}
+		ipFromLong = utils.IP2Long(params.IpFrom)
+
+		var ipToLong uint64
+		if len(params.IpTo) > 0 && !utils.IsIPv4(params.IpTo) {
+			ipToLong = utils.IP2Long(params.IpTo)
+			this.Fail("请输入正确的结束IP")
+		}
+
+		if ipFromLong > 0 && ipToLong > 0 && ipFromLong > ipToLong {
+			params.IpTo, params.IpFrom = params.IpFrom, params.IpTo
+		}
+	case "ipv6":
+		params.Must.
+			Field("ipFrom", params.IpFrom).
+			Require("请输入IP")
+
+		// 校验IP格式（ipFrom）
+		if !utils.IsIPv6(params.IpFrom) {
+			this.Fail("请输入正确的IPv6地址")
+		}
+	case "all":
+		params.IpFrom = "0.0.0.0"
+	}
+
+	_, err := this.RPC().IPItemRPC().UpdateIPItem(this.AdminContext(), &pb.UpdateIPItemRequest{
+		IpItemId:   params.ItemId,
+		IpFrom:     params.IpFrom,
+		IpTo:       params.IpTo,
+		ExpiredAt:  params.ExpiredAt,
+		Reason:     params.Reason,
+		Type:       params.Type,
+		EventLevel: params.EventLevel,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/web/index.go

@@ -0,0 +1,59 @@
+package web
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("web")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "web")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["rootConfig"] = webConfig.Root
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId    int64
+	RootJSON []byte
+
+	Must *actions.Must
+}) {
+	defer this.CreateLogInfo("修改Web %d 的首页文件名", params.WebId)
+
+	_, err := this.RPC().HTTPWebRPC().UpdateHTTPWeb(this.AdminContext(), &pb.UpdateHTTPWebRequest{
+		WebId:    params.WebId,
+		RootJSON: params.RootJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/web/init.go

@@ -1,4 +1,4 @@
-package finance
+package web
 
 import (
 	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
@@ -9,12 +9,11 @@ import (
 func init() {
 	TeaGo.BeforeStart(func(server *TeaGo.Server) {
 		server.
-			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeFinance)).
-
-			// 财务管理
-			Prefix("/finance").
-			Get("", new(IndexAction)).
-
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/web").
+			GetPost("", new(IndexAction)).
 			EndAll()
 	})
 }

internal/web/actions/default/servers/groups/group/settings/webp/index.go

@@ -0,0 +1,68 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package webp
+
+import (
+	"encoding/json"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("webp")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "webp")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["webpConfig"] = webConfig.WebP
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId    int64
+	WebpJSON []byte
+
+	Must *actions.Must
+	CSRF *actionutils.CSRF
+}) {
+	var webpConfig = &serverconfigs.WebPImageConfig{}
+	err := json.Unmarshal(params.WebpJSON, webpConfig)
+	if err != nil {
+		this.Fail("参数校验失败：" + err.Error())
+	}
+
+	_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebWebP(this.AdminContext(), &pb.UpdateHTTPWebWebPRequest{
+		WebId:    params.WebId,
+		WebpJSON: params.WebpJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/webp/init.go

@@ -0,0 +1,19 @@
+package webp
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
+	"github.com/iwind/TeaGo"
+)
+
+func init() {
+	TeaGo.BeforeStart(func(server *TeaGo.Server) {
+		server.
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/webp").
+			GetPost("", new(IndexAction)).
+			EndAll()
+	})
+}

internal/web/actions/default/servers/groups/group/settings/websocket/index.go

@@ -0,0 +1,122 @@
+package websocket
+
+import (
+	"encoding/json"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/servers/groups/group/servergrouputils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+	"github.com/iwind/TeaGo/actions"
+)
+
+type IndexAction struct {
+	actionutils.ParentAction
+}
+
+func (this *IndexAction) Init() {
+	this.Nav("", "setting", "index")
+	this.SecondMenu("websocket")
+}
+
+func (this *IndexAction) RunGet(params struct {
+	GroupId int64
+}) {
+	_, err := servergrouputils.InitGroup(this.Parent(), params.GroupId, "websocket")
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerGroupId(this.AdminContext(), params.GroupId)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Data["webId"] = webConfig.Id
+	this.Data["websocketRef"] = webConfig.WebsocketRef
+	this.Data["websocketConfig"] = webConfig.Websocket
+
+	this.Show()
+}
+
+func (this *IndexAction) RunPost(params struct {
+	WebId            int64
+	WebsocketRefJSON []byte
+	WebsocketJSON    []byte
+
+	Must *actions.Must
+}) {
+	defer this.CreateLogInfo("修改Web %d 的Websocket设置", params.WebId)
+
+	// TODO 检查配置
+
+	websocketRef := &serverconfigs.HTTPWebsocketRef{}
+	err := json.Unmarshal(params.WebsocketRefJSON, websocketRef)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	websocketConfig := &serverconfigs.HTTPWebsocketConfig{}
+	err = json.Unmarshal(params.WebsocketJSON, websocketConfig)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	err = websocketConfig.Init()
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	// 创建
+	handshakeTimeoutJSON, err := json.Marshal(websocketConfig.HandshakeTimeout)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	// 创建或修改
+	if websocketConfig.Id <= 0 {
+		createResp, err := this.RPC().HTTPWebsocketRPC().CreateHTTPWebsocket(this.AdminContext(), &pb.CreateHTTPWebsocketRequest{
+			HandshakeTimeoutJSON: handshakeTimeoutJSON,
+			AllowAllOrigins:      websocketConfig.AllowAllOrigins,
+			AllowedOrigins:       websocketConfig.AllowedOrigins,
+			RequestSameOrigin:    websocketConfig.RequestSameOrigin,
+			RequestOrigin:        websocketConfig.RequestOrigin,
+		})
+		if err != nil {
+			this.ErrorPage(err)
+			return
+		}
+		websocketConfig.Id = createResp.WebsocketId
+	} else {
+		_, err = this.RPC().HTTPWebsocketRPC().UpdateHTTPWebsocket(this.AdminContext(), &pb.UpdateHTTPWebsocketRequest{
+			WebsocketId:          websocketConfig.Id,
+			HandshakeTimeoutJSON: handshakeTimeoutJSON,
+			AllowAllOrigins:      websocketConfig.AllowAllOrigins,
+			AllowedOrigins:       websocketConfig.AllowedOrigins,
+			RequestSameOrigin:    websocketConfig.RequestSameOrigin,
+			RequestOrigin:        websocketConfig.RequestOrigin,
+		})
+	}
+
+	websocketRef.WebsocketId = websocketConfig.Id
+	websocketRefJSON, err := json.Marshal(websocketRef)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	_, err = this.RPC().HTTPWebRPC().UpdateHTTPWebWebsocket(this.AdminContext(), &pb.UpdateHTTPWebWebsocketRequest{
+		WebId:         params.WebId,
+		WebsocketJSON: websocketRefJSON,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	this.Success()
+}

internal/web/actions/default/servers/groups/group/settings/websocket/init.go

@@ -0,0 +1,19 @@
+package websocket
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/configloaders"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
+	"github.com/iwind/TeaGo"
+)
+
+func init() {
+	TeaGo.BeforeStart(func(server *TeaGo.Server) {
+		server.
+			Helper(helpers.NewUserMustAuth(configloaders.AdminModuleCodeServer)).
+			Data("teaMenu", "servers").
+			Data("teaSubMenu", "group").
+			Prefix("/servers/groups/group/settings/websocket").
+			GetPost("", new(IndexAction)).
+			EndAll()
+	})
+}

internal/web/actions/default/servers/init.go

@@ -16,7 +16,9 @@ func init() {
 			GetPost("/create", new(CreateAction)).
 			GetPost("/update", new(UpdateAction)).
 			Post("/fixLog", new(FixLogAction)).
+			Post("/nearby", new(NearbyAction)).
 
+			//
 			GetPost("/addPortPopup", new(AddPortPopupAction)).
 			GetPost("/addServerNamePopup", new(AddServerNamePopupAction)).
 			GetPost("/addOriginPopup", new(AddOriginPopupAction)).

internal/web/actions/default/servers/iplists/items.go

@@ -19,8 +19,11 @@ func (this *ItemsAction) Init() {
 }
 
 func (this *ItemsAction) RunGet(params struct {
-	ListId int64
+	ListId  int64
+	Keyword string
 }) {
+	this.Data["keyword"] = params.Keyword
+
 	err := InitIPList(this.Parent(), params.ListId)
 	if err != nil {
 		this.ErrorPage(err)
@@ -29,7 +32,10 @@ func (this *ItemsAction) RunGet(params struct {
 
 	// 数量
 	var listId = params.ListId
-	countResp, err := this.RPC().IPItemRPC().CountIPItemsWithListId(this.AdminContext(), &pb.CountIPItemsWithListIdRequest{IpListId: listId})
+	countResp, err := this.RPC().IPItemRPC().CountIPItemsWithListId(this.AdminContext(), &pb.CountIPItemsWithListIdRequest{
+		IpListId: listId,
+		Keyword:  params.Keyword,
+	})
 	if err != nil {
 		this.ErrorPage(err)
 		return
@@ -41,6 +47,7 @@ func (this *ItemsAction) RunGet(params struct {
 	// 列表
 	itemsResp, err := this.RPC().IPItemRPC().ListIPItemsWithListId(this.AdminContext(), &pb.ListIPItemsWithListIdRequest{
 		IpListId: listId,
+		Keyword:  params.Keyword,
 		Offset:   page.Offset,
 		Size:     page.Size,
 	})

internal/web/actions/default/servers/nearby.go

@@ -0,0 +1,56 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package servers
+
+import (
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/iwind/TeaGo/maps"
+	"github.com/iwind/TeaGo/types"
+	"strings"
+)
+
+// NearbyAction 查找附近的Server
+type NearbyAction struct {
+	actionutils.ParentAction
+}
+
+func (this *NearbyAction) RunPost(params struct {
+	ServerId int64
+	Url      string
+}) {
+	var groupMaps = []maps.Map{}
+
+	resp, err := this.RPC().ServerRPC().FindNearbyServers(this.AdminContext(), &pb.FindNearbyServersRequest{ServerId: params.ServerId})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	for _, group := range resp.Groups {
+		switch resp.Scope {
+		case "cluster":
+			group.Name = "[集群]" + group.Name
+		case "group":
+			group.Name = "[分组]" + group.Name
+		}
+
+		var itemMaps = []maps.Map{}
+		for _, server := range group.Servers {
+			itemMaps = append(itemMaps, maps.Map{
+				"name":     server.Name,
+				"url":      strings.ReplaceAll(params.Url, "${serverId}", types.String(server.Id)),
+				"isActive": params.ServerId == server.Id,
+			})
+		}
+
+		groupMaps = append(groupMaps, maps.Map{
+			"name":  group.Name,
+			"items": itemMaps,
+		})
+	}
+
+	this.Data["scope"] = resp.Scope
+	this.Data["groups"] = groupMaps
+
+	this.Success()
+}

internal/web/actions/default/servers/server/settings/accessLog/index.go

@@ -7,6 +7,7 @@ import (
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
 	"github.com/iwind/TeaGo/actions"
+	"github.com/iwind/TeaGo/types"
 )
 
 type IndexAction struct {
@@ -21,6 +22,17 @@ func (this *IndexAction) Init() {
 func (this *IndexAction) RunGet(params struct {
 	ServerId int64
 }) {
+	// 服务分组设置
+	groupResp, err := this.RPC().ServerGroupRPC().FindEnabledServerGroupConfigInfo(this.AdminContext(), &pb.FindEnabledServerGroupConfigInfoRequest{
+		ServerId: params.ServerId,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	this.Data["hasGroupConfig"] = groupResp.HasAccessLogConfig
+	this.Data["groupSettingURL"] = "/servers/groups/group/settings/accessLog?groupId=" + types.String(groupResp.ServerGroupId)
+
 	// 获取配置
 	webConfig, err := dao.SharedHTTPWebDAO.FindWebConfigWithServerId(this.AdminContext(), params.ServerId)
 	if err != nil {