refactor: refactor website ssl delete text

refactor: refactor user info (#14021 )
refactor: refactor website ssl keyType default value (#14023 )
2026-10-10 16:00:31 +00:00 · 2026-10-10 17:55:58 +08:00 · 2026-10-10 17:50:05 +08:00 · 2026-10-10 17:49:14 +08:00 · 2026-10-10 17:48:57 +08:00 · 2026-10-10 11:13:17 +08:00
60 changed files with 1181 additions and 270 deletions
@@ -86,17 +86,23 @@ func (b *BaseApi) CheckHasCli(c *gin.Context) {

 // @Tags Database Redis
 // @Summary Install redis-cli
-// @Success 200
+// @Accept json
+// @Param request body dto.RedisCliInstall true "request"
+// @Success 200 {string} string
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /databases/redis/install/cli [post]
 func (b *BaseApi) InstallCli(c *gin.Context) {
-	if err := redisService.InstallCli(); err != nil {
+	var req dto.RedisCliInstall
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := redisService.InstallCli(req)
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-
-	helper.Success(c)
+	helper.SuccessWithData(c, data)
 }

 // @Tags Database Redis
@@ -22,6 +22,10 @@ type DBBaseInfo struct {
 	Port          int64  `json:"port"`
 }

+type RedisCliInstall struct {
+	TaskID string `json:"taskID" validate:"omitempty,uuid"`
+}
+
 // mysql
 type MysqlDBSearch struct {
 	PageInfo
@@ -50,13 +50,12 @@ type FirewallBackendOption struct {
 }

 type FirewallBackendFamilyStatus struct {
-	Partial       bool     `json:"partial"`
-	Available     bool     `json:"available"`
-	Initialized   bool     `json:"initialized"`
-	Bound         bool     `json:"bound"`
-	Reason        string   `json:"reason,omitempty"`
-	ForwardPolicy string   `json:"forwardPolicy,omitempty"`
-	RAInterfaces  []string `json:"raInterfaces,omitempty"`
+	Partial      bool     `json:"partial"`
+	Available    bool     `json:"available"`
+	Initialized  bool     `json:"initialized"`
+	Bound        bool     `json:"bound"`
+	Reason       string   `json:"reason,omitempty"`
+	RAInterfaces []string `json:"raInterfaces,omitempty"`
 }

 type FirewallBackendGroup struct {
@@ -2,6 +2,7 @@ package repo

 import (
 	"context"
+	"time"

 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
@@ -110,7 +111,9 @@ func (t TaskRepo) Update(ctx context.Context, task *model.Task) error {
 }

 func (t TaskRepo) UpdateRunningTaskToFailed() error {
-	return getTaskDb(t.WithByStatus(constant.StatusExecuting)).Model(&model.Task{}).Updates(map[string]interface{}{"status": constant.StatusFailed, "error_msg": "1Panel restart causes failure"}).Error
+	return getTaskDb(t.WithByStatus(constant.StatusExecuting)).Model(&model.Task{}).Updates(map[string]interface{}{
+		"status": constant.StatusFailed, "error_msg": constant.InterruptedMsg, "end_at": time.Now(),
+	}).Error
 }

 func (t TaskRepo) CountExecutingTask() (int64, error) {
@@ -550,6 +550,11 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript

 	installTask, err := task.NewTaskWithOps(appInstall.Name, task.TaskInstall, task.TaskScopeApp, req.TaskID, appInstall.ID)
 	if err != nil {
+		appInstall.Status = constant.StatusInstallErr
+		appInstall.Message = err.Error()
+		if saveErr := appInstallRepo.Save(context.Background(), appInstall); saveErr != nil {
+			err = fmt.Errorf("%w; save failed install status: %v", err, saveErr)
+		}
 		return
 	}

@@ -557,7 +562,7 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 		return
 	}

-	installApp := func(t *task.Task) error {
+	installApp := func(t *task.Task) (err error) {
 		if err = copyData(t, app, appDetail, appInstall, req); err != nil {
 			return err
 		}
@@ -339,6 +339,11 @@ func operateAppWithLifecycleScripts(install model.AppInstall, req request.AppIns

 	operationTask, err := task.NewTaskWithOps(install.Name, taskType, task.TaskScopeApp, req.TaskID, install.ID)
 	if err != nil {
+		install.Status = constant.StatusUpErr
+		install.Message = err.Error()
+		if saveErr := appInstallRepo.Save(context.Background(), &install); saveErr != nil {
+			return fmt.Errorf("%w; save failed operation status: %v", err, saveErr)
+		}
 		return err
 	}
 	operation := string(req.Operate)
@@ -567,11 +572,15 @@ func (a *AppInstallService) SyncAll(systemInit bool) error {
 		return err
 	}
 	for _, i := range allList {
-		if i.Status == constant.StatusInstalling || i.Status == constant.StatusUpgrading || i.Status == constant.StatusRebuilding || i.Status == constant.StatusUninstalling {
+		if appInstallOperationInterruptedOnRestart(i.Status) {
 			if systemInit {
-				i.Status = constant.StatusError
-				i.Message = "1Panel restart causes the task to terminate"
-				_ = appInstallRepo.Save(context.Background(), &i)
+				i.Status = appInstallOperationFailureStatus(i.Status)
+				i.Message = constant.InterruptedMsg
+				if err := appInstallRepo.Save(context.Background(), &i); err != nil {
+					return err
+				}
+			} else if err := syncAppInstallStatus(&i, false); err != nil {
+				global.LOG.Errorf("sync install app[%s] error,mgs: %s", i.Name, err.Error())
 			}
 			continue
 		}
@@ -931,10 +940,34 @@ func (a *AppInstallService) GetParams(id uint) (*response.AppConfig, error) {
 }

 func syncAppInstallStatus(appInstall *model.AppInstall, force bool) error {
+	operation := ""
+	switch appInstall.Status {
+	case constant.StatusInstalling:
+		operation = task.TaskInstall
+	case constant.StatusUpgrading:
+		operation = task.TaskUpgrade
+	case constant.StatusRebuilding:
+		operation = task.TaskBuild
+	case constant.StatusUninstalling:
+		operation = task.TaskUninstall
+	case constant.StatusStarting, constant.StatusWaiting:
+		operation = task.TaskUpdate
+	case constant.StatusRestarting:
+		operation = task.TaskRestart
+	}
+	if operation != "" {
+		if err := reconcileAppInstallTaskFailure(appInstall, operation, global.DB, global.TaskDB); err != nil {
+			return err
+		}
+	}
 	switch appInstall.Status {
 	case constant.StatusInstalling, constant.StatusRebuilding, constant.StatusUpgrading, constant.StatusUninstalling,
 		constant.StatusStarting, constant.StatusRestarting, constant.StatusWaiting:
 		return nil
+	case constant.StatusInstallErr, constant.StatusUpgradeErr, constant.StatusUpErr:
+		if !force {
+			return nil
+		}
 	}
 	cli, err := docker.NewClient()
 	if err != nil {
@@ -0,0 +1,76 @@
+package service
+
+import (
+	"errors"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"gorm.io/gorm"
+)
+
+func appInstallOperationFailureStatus(status string) string {
+	switch status {
+	case constant.StatusInstalling:
+		return constant.StatusInstallErr
+	case constant.StatusUpgrading:
+		return constant.StatusUpgradeErr
+	case constant.StatusUninstalling:
+		return constant.StatusError
+	default:
+		return constant.StatusUpErr
+	}
+}
+
+func appInstallOperationPending(status string) bool {
+	switch status {
+	case constant.StatusInstalling, constant.StatusRebuilding, constant.StatusUpgrading, constant.StatusUninstalling,
+		constant.StatusStarting, constant.StatusRestarting, constant.StatusWaiting:
+		return true
+	default:
+		return false
+	}
+}
+
+func appInstallOperationInterruptedOnRestart(status string) bool {
+	// ReStarting can also describe a container's Docker restart policy.
+	return appInstallOperationPending(status) && status != constant.StatusRestarting
+}
+
+func reconcileAppInstallTaskFailure(install *model.AppInstall, operation string, appDB, taskDB *gorm.DB) error {
+	if !appInstallOperationPending(install.Status) {
+		return nil
+	}
+	var operationTask model.Task
+	err := taskDB.Where("type = ? AND resource_id = ? AND operate = ?", "App", install.ID, operation).
+		Order("created_at DESC").First(&operationTask).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if operationTask.Status != constant.StatusFailed && operationTask.Status != constant.StatusCanceled {
+		return nil
+	}
+	// A previous operation must not turn a newly queued retry into a failure.
+	if operationTask.CreatedAt.Before(install.UpdatedAt) &&
+		(operationTask.EndAt.IsZero() || operationTask.EndAt.Before(install.UpdatedAt)) {
+		return nil
+	}
+	message := operationTask.ErrorMsg
+	if message == "" {
+		message = "the application operation task failed"
+	}
+	status := appInstallOperationFailureStatus(install.Status)
+	result := appDB.Model(&model.AppInstall{}).
+		Where("id = ? AND status = ? AND updated_at = ?", install.ID, install.Status, install.UpdatedAt).
+		Updates(map[string]interface{}{"status": status, "message": message})
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected > 0 {
+		install.Status = status
+		install.Message = message
+	}
+	return nil
+}
@@ -0,0 +1,147 @@
+package service
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/glebarez/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"gorm.io/gorm/logger"
+)
+
+func operationStatusTestDB(t *testing.T) (*gorm.DB, *gorm.DB, model.AppInstall) {
+	t.Helper()
+	open := func(name string, schema interface{}) *gorm.DB {
+		db, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), name)), &gorm.Config{
+			Logger: logger.Default.LogMode(logger.Silent),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := db.AutoMigrate(schema); err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() {
+			sqlDB, _ := db.DB()
+			if sqlDB != nil {
+				_ = sqlDB.Close()
+			}
+		})
+		return db
+	}
+	appDB := open("apps.db", &model.AppInstall{})
+	taskDB := open("tasks.db", &model.Task{})
+	install := model.AppInstall{
+		Name: "gb10-ds-vision", AppId: 1, AppDetailId: 1,
+		Version: "nvidia-gb10-dspark-0.1.1", ContainerName: "vllm-dspark-1", ServiceName: "vllm-dspark",
+		Status: constant.StatusStarting, Env: `{"MODEL_DIR":"/models/vision"}`,
+	}
+	if err := appDB.Omit(clause.Associations).Create(&install).Error; err != nil {
+		t.Fatal(err)
+	}
+	return appDB, taskDB, install
+}
+
+func TestAppInstallFailedTaskRecoversPendingState(t *testing.T) {
+	for _, state := range []string{constant.StatusStarting, constant.StatusWaiting, constant.StatusRestarting, constant.StatusInstalling} {
+		t.Run(state, func(t *testing.T) {
+			appDB, taskDB, install := operationStatusTestDB(t)
+			install.Status = state
+			if err := appDB.Omit(clause.Associations).Save(&install).Error; err != nil {
+				t.Fatal(err)
+			}
+			task := model.Task{ID: "failed", Type: "App", Operate: "TaskUpdate", ResourceID: install.ID,
+				Status: constant.StatusFailed, ErrorMsg: "model startup script failed", CreatedAt: install.UpdatedAt.Add(time.Second), EndAt: install.UpdatedAt.Add(2 * time.Second)}
+			if err := taskDB.Create(&task).Error; err != nil {
+				t.Fatal(err)
+			}
+			if err := reconcileAppInstallTaskFailure(&install, task.Operate, appDB, taskDB); err != nil {
+				t.Fatal(err)
+			}
+			want := constant.StatusUpErr
+			if state == constant.StatusInstalling {
+				want = constant.StatusInstallErr
+			}
+			var stored model.AppInstall
+			if err := appDB.First(&stored, install.ID).Error; err != nil {
+				t.Fatal(err)
+			}
+			if install.Status != want || stored.Status != want || stored.Message != task.ErrorMsg || stored.Env != install.Env {
+				t.Fatalf("recovered state = %s/%s, message %q, env %q", install.Status, stored.Status, stored.Message, stored.Env)
+			}
+		})
+	}
+}
+
+func TestAppInstallPendingStateKeepsActiveAndUnrelatedTasks(t *testing.T) {
+	for _, taskStatus := range []string{constant.StatusExecuting, constant.StatusSuccess, "missing", "previous-failure", "other-resource"} {
+		t.Run(taskStatus, func(t *testing.T) {
+			appDB, taskDB, install := operationStatusTestDB(t)
+			task := model.Task{ID: "task", Type: "App", Operate: "TaskUpdate", ResourceID: install.ID,
+				Status: taskStatus, CreatedAt: install.UpdatedAt.Add(time.Second), EndAt: install.UpdatedAt.Add(2 * time.Second)}
+			if taskStatus == "previous-failure" {
+				task.Status = constant.StatusFailed
+				task.CreatedAt = install.UpdatedAt.Add(-2 * time.Hour)
+				task.EndAt = install.UpdatedAt.Add(-time.Hour)
+			}
+			if taskStatus == "other-resource" {
+				task.Status = constant.StatusFailed
+				task.ResourceID++
+			}
+			if taskStatus != "missing" {
+				if err := taskDB.Create(&task).Error; err != nil {
+					t.Fatal(err)
+				}
+			}
+			if err := reconcileAppInstallTaskFailure(&install, task.Operate, appDB, taskDB); err != nil {
+				t.Fatal(err)
+			}
+			if install.Status != constant.StatusStarting {
+				t.Fatalf("unrelated or active task changed pending state to %s", install.Status)
+			}
+		})
+	}
+}
+
+func TestAppInstallRecoveryDoesNotOverwriteConcurrentRetry(t *testing.T) {
+	appDB, taskDB, install := operationStatusTestDB(t)
+	task := model.Task{ID: "failed", Type: "App", Operate: "TaskUpdate", ResourceID: install.ID,
+		Status: constant.StatusCanceled, ErrorMsg: "interrupted", CreatedAt: install.UpdatedAt.Add(time.Second), EndAt: install.UpdatedAt.Add(2 * time.Second)}
+	if err := taskDB.Create(&task).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := appDB.Callback().Update().Before("gorm:update").Register("new-operation", func(db *gorm.DB) {
+		if err := db.Exec("UPDATE app_installs SET updated_at = ?, message = ? WHERE id = ?", install.UpdatedAt.Add(time.Hour), "new attempt", install.ID).Error; err != nil {
+			t.Error(err)
+		}
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := reconcileAppInstallTaskFailure(&install, task.Operate, appDB, taskDB); err != nil {
+		t.Fatal(err)
+	}
+	var stored model.AppInstall
+	if err := appDB.First(&stored, install.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if stored.Status != constant.StatusStarting || stored.Message != "new attempt" {
+		t.Fatalf("recovery overwrote a newer operation: %s, %s", stored.Status, stored.Message)
+	}
+}
+
+func TestAppInstallRestartRecoveryCoversLifecycleStates(t *testing.T) {
+	for _, state := range []string{constant.StatusStarting, constant.StatusWaiting, constant.StatusInstalling} {
+		if !appInstallOperationInterruptedOnRestart(state) {
+			t.Errorf("restart recovery omitted %s", state)
+		}
+	}
+	for _, state := range []string{constant.StatusRunning, constant.StatusStopped, constant.StatusRestarting} {
+		if appInstallOperationInterruptedOnRestart(state) {
+			t.Errorf("restart recovery changes a Docker runtime state: %s", state)
+		}
+	}
+}
@@ -1406,9 +1406,8 @@ func handleErr(install model.AppInstall, err error, out string) error {
 }

 func doNotNeedSync(installed model.AppInstall) bool {
-	return installed.Status == constant.StatusInstalling || installed.Status == constant.StatusRebuilding || installed.Status == constant.StatusUpgrading ||
-		installed.Status == constant.StatusSyncing || installed.Status == constant.StatusUninstalling || installed.Status == constant.StatusInstallErr ||
-		installed.Status == constant.StatusStarting || installed.Status == constant.StatusRestarting || installed.Status == constant.StatusWaiting
+	return appInstallOperationPending(installed.Status) || installed.Status == constant.StatusSyncing ||
+		installed.Status == constant.StatusInstallErr || installed.Status == constant.StatusUpgradeErr || installed.Status == constant.StatusUpErr
 }

 func synAppInstall(containers map[string]container.Summary, appInstall *model.AppInstall, force bool) {
@@ -1502,6 +1501,11 @@ func handleInstalled(appInstallList []model.AppInstall, updated, sync, checkUpda
 	}

 	for _, installed := range appInstallList {
+		if sync && appInstallOperationPending(installed.Status) {
+			if err := syncAppInstallStatus(&installed, false); err != nil {
+				return nil, err
+			}
+		}
 		if updated && ignoreUpdate(installed) {
 			continue
 		}
@@ -383,11 +383,6 @@ func (u *ContainerService) Inspect(req dto.InspectReq) (string, error) {
 }

 func (u *ContainerService) Prune(req dto.ContainerPrune) error {
-	client, err := docker.NewDockerClient()
-	if err != nil {
-		return err
-	}
-	defer client.Close()
 	name := ""
 	switch req.PruneType {
 	case "container":
@@ -408,6 +403,14 @@ func (u *ContainerService) Prune(req dto.ContainerPrune) error {
 	}

 	taskItem.AddSubTask(i18n.GetMsgByKey("TaskClean"), func(t *task.Task) error {
+		if err := t.TaskCtx.Err(); err != nil {
+			return err
+		}
+		client, err := docker.NewDockerClient()
+		if err != nil {
+			return err
+		}
+		defer client.Close()
 		pruneFilters := filters.NewArgs()
 		if req.WithTagAll {
 			pruneFilters.Add("dangling", "false")
@@ -431,10 +434,7 @@ func (u *ContainerService) Prune(req dto.ContainerPrune) error {
 			}
 			SpaceReclaimed = int(rep.SpaceReclaimed)
 		case "network":
-			_, err := client.NetworksPrune(context.Background(), pruneFilters)
-			if err != nil {
-				return err
-			}
+			return cleanUnusedNetworks(t, client)
 		case "volume":
 			versions, err := client.ServerVersion(context.Background())
 			if err != nil {
@@ -2,16 +2,24 @@ package service

 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 	"strings"

 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/client"
+	"github.com/docker/docker/errdefs"
 )

+var networkCleanupSlot = make(chan struct{}, 1)
+
 func (u *ContainerService) PageNetwork(req dto.SearchWithPage) (int64, interface{}, error) {
 	client, err := docker.NewDockerClient()
 	if err != nil {
@@ -172,3 +180,114 @@ func (u *ContainerService) CreateNetwork(req dto.NetworkCreate) error {
 	}
 	return nil
 }
+
+func cleanUnusedNetworks(t *task.Task, cli *client.Client) error {
+	ctx := t.TaskCtx
+	select {
+	case networkCleanupSlot <- struct{}{}:
+		defer func() { <-networkCleanupSlot }()
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	networks, err := cli.NetworkList(ctx, network.ListOptions{})
+	if err != nil {
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		return err
+	}
+	deleted, skipped, failed := 0, 0, 0
+	defer func() {
+		t.Log(i18n.GetMsgWithMap("NetworkCleanupSummary", map[string]interface{}{
+			"deleted": deleted, "skipped": skipped, "failed": failed,
+		}))
+	}()
+	var used map[string]bool
+	sort.Slice(networks, func(i, j int) bool { return networks[i].Name < networks[j].Name })
+	for _, n := range networks {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		switch n.Name {
+		case "none", "host", "bridge", "1panel-network":
+			skipped++
+			continue
+		}
+		if n.Scope != "local" || n.Ingress || n.ConfigOnly {
+			skipped++
+			continue
+		}
+		values := map[string]interface{}{"name": n.Name, "id": n.ID}
+		if used == nil {
+			containers, err := cli.ContainerList(ctx, container.ListOptions{All: true})
+			if err != nil {
+				if ctx.Err() != nil {
+					return ctx.Err()
+				}
+				return err
+			}
+			used = make(map[string]bool)
+			for _, c := range containers {
+				if c.NetworkSettings == nil {
+					continue
+				}
+				for name, endpoint := range c.NetworkSettings.Networks {
+					used[name] = true
+					if endpoint != nil {
+						used[endpoint.NetworkID] = true
+					}
+				}
+			}
+		}
+		if used[n.Name] || used[n.ID] {
+			skipped++
+			t.Log(i18n.GetMsgWithMap("NetworkCleanupConnected", values))
+			continue
+		}
+		inspected, err := cli.NetworkInspect(ctx, n.ID, network.InspectOptions{})
+		if err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			if errdefs.IsNotFound(err) {
+				skipped++
+			} else {
+				failed++
+				t.Logf("Failed to inspect network [%s] (%s): %v", n.Name, n.ID, err)
+			}
+			continue
+		}
+		if len(inspected.Containers) > 0 {
+			skipped++
+			t.Log(i18n.GetMsgWithMap("NetworkCleanupConnected", values))
+			continue
+		}
+		if err := cli.NetworkRemove(ctx, n.ID); err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			switch {
+			case errdefs.IsNotFound(err):
+				skipped++
+			case errdefs.IsConflict(err):
+				skipped++
+				t.Log(i18n.GetMsgWithMap("NetworkCleanupConnected", values))
+			default:
+				failed++
+				t.Logf("Failed to remove network [%s] (%s): %v", n.Name, n.ID, err)
+			}
+			continue
+		}
+		deleted++
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if failed > 0 {
+		return errors.New(i18n.GetMsgByKey("NetworkCleanupPartialFailure"))
+	}
+	return nil
+}
@@ -8,6 +8,12 @@ import (
 	"os"
 	"os/exec"
 	"strings"
+	"sync"
+
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/google/uuid"
+	"gorm.io/gorm"

 	"github.com/1Panel-dev/1Panel/agent/app/repo"
 	"github.com/1Panel-dev/1Panel/agent/global"
@@ -17,12 +23,15 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/compose"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
 	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
-	"github.com/docker/docker/api/types/container"
+	dockerclient "github.com/docker/docker/client"
 	_ "github.com/go-sql-driver/mysql"
 )

 type RedisService struct{}

+// The CLI container is shared by all remote Redis databases on this node.
+var redisCliInstallMutex sync.Mutex
+
 type IRedisService interface {
 	UpdateConf(req dto.RedisConfUpdate) error
 	UpdatePersistenceConf(req dto.RedisConfPersistenceUpdate) error
@@ -33,7 +42,7 @@ type IRedisService interface {
 	LoadPersistenceConf(req dto.LoadRedisStatus) (*dto.RedisPersistence, error)

 	CheckHasCli() bool
-	InstallCli() error
+	InstallCli(req dto.RedisCliInstall) (string, error)
 }

 func NewIRedisService() IRedisService {
@@ -61,30 +70,65 @@ func (u *RedisService) UpdateConf(req dto.RedisConfUpdate) error {
 }

 func (u *RedisService) CheckHasCli() bool {
-	client, err := docker.NewDockerClient()
-	if err != nil {
-		return false
-	}
-	defer client.Close()
-	containerLists, err := client.ContainerList(context.Background(), container.ListOptions{})
-	if err != nil {
-		return false
-	}
-	for _, item := range containerLists {
-		if strings.ReplaceAll(item.Names[0], "/", "") == "1Panel-redis-cli-tools" {
-			return true
-		}
-	}
-	return false
+	installed, _ := u.checkCliInstalled()
+	return installed
 }

-func (u *RedisService) InstallCli() error {
+func (u *RedisService) checkCliInstalled() (bool, error) {
+	client, err := docker.NewDockerClient()
+	if err != nil {
+		return false, err
+	}
+	defer client.Close()
+	info, err := client.ContainerInspect(context.Background(), "1Panel-redis-cli-tools")
+	if dockerclient.IsErrNotFound(err) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	return info.ContainerJSONBase != nil && info.State != nil && info.State.Running, nil
+}
+
+func (u *RedisService) InstallCli(req dto.RedisCliInstall) (string, error) {
+	if !redisCliInstallMutex.TryLock() {
+		return "", buserr.New("TaskIsExecuting")
+	}
+	defer redisCliInstallMutex.Unlock()
 	item := dto.ContainerOperate{
+		TaskID:   req.TaskID,
 		Name:     "1Panel-redis-cli-tools",
 		Image:    "redis:7.4.4",
 		Networks: []dto.ContainerNetwork{{Network: "1panel-network"}},
 	}
-	return NewIContainerService().ContainerCreate(item, false)
+	running, err := taskRepo.GetFirst(
+		repo.WithByName(task.GetTaskName(item.Name, task.TaskCreate, task.TaskScopeContainer)),
+		repo.WithByType(task.TaskScopeContainer),
+		taskRepo.WithByStatus(constant.StatusExecuting),
+	)
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return "", err
+	}
+	if running.ID != "" {
+		return running.ID, nil
+	}
+	installed, err := u.checkCliInstalled()
+	if err != nil || installed {
+		return "", err
+	}
+	if item.TaskID == "" {
+		item.TaskID = uuid.NewString()
+	}
+	if _, err := taskRepo.GetFirst(taskRepo.WithByID(item.TaskID)); !errors.Is(err, gorm.ErrRecordNotFound) {
+		if err != nil {
+			return "", err
+		}
+		return "", buserr.New("TaskIsExecuting")
+	}
+	if err := NewIContainerService().ContainerCreate(item, true); err != nil {
+		return "", err
+	}
+	return item.TaskID, nil
 }

 func (u *RedisService) ChangePassword(req dto.ChangeRedisPass) error {
@@ -108,9 +108,7 @@ func (s *FirewallService) LoadBaseInfo(chainGroup string) (dto.FirewallSubsystem
 			status.Reason = constant.FirewallBackendNotInstalled
 			return status, nil
 		}
-		status.IsExist = true
-		status.Message = err.Error()
-		return status, nil
+		return status, err
 	}
 	status.IsExist = true
 	runtimeStatus, err := lifecycle.LoadStatus(client)
@@ -1185,15 +1185,17 @@ func loadForwardingFirewallOverview(manager forwarding.Adapter, families []strin
 	}
 	ipv6, ipv6Err := loadForwardingFamilyInfo(manager, constant.FirewallFamilyIPv6)
 	if ipv6.Available {
-		interfaces, err := forwarding.IPv6RAInterfaces(os.ReadFile)
+		interfaces, err := forwarding.IPv6RAInterfaces(os.ReadFile, forwarding.LoadDockerIPv4BridgePorts)
 		var pathError *os.PathError
 		switch {
 		case errors.As(err, &pathError) && errors.Is(err, os.ErrNotExist) && pathError.Path == "/proc/net/if_inet6":
 			ipv6.Available, ipv6.Initialized, ipv6.Bound = false, false, false
 		case err != nil:
+			global.LOG.Warnf("IPv6 forwarding RA check failed: %v", err)
 			ipv6.Reason = "ipv6_ra_check_failed"
 			ipv6.Bound = false
 		case len(interfaces) > 0:
+			global.LOG.Warnf("IPv6 forwarding RA risk: interfaces %s may depend on RA/SLAAC with accept_ra=1", strings.Join(interfaces, ", "))
 			ipv6.Reason, ipv6.RAInterfaces = "ipv6_ra_required", interfaces
 			ipv6.Bound = false
 		case !ipv6.Bound:
@@ -9,13 +9,10 @@ import (
 	"strconv"
 	"strings"
 	"sync"
-	"time"

 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/task"
 	"github.com/1Panel-dev/1Panel/agent/constant"
-	"github.com/1Panel-dev/1Panel/agent/global"
-	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
 	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
 	"github.com/1Panel-dev/1Panel/agent/utils/firewall/forwarding"
@@ -82,23 +79,6 @@ func (s *ForwardingService) LoadBaseInfo(ctx context.Context) (dto.FirewallSubsy
 	baseInfo.PingStatus = firewall.LoadPingStatus()
 	baseInfo.IsInit, baseInfo.IsBind = status.IsInit, status.IsBind
 	baseInfo.IPv4, baseInfo.IPv6 = status.IPv4, status.IPv6
-	for _, family := range []struct {
-		command string
-		status  *dto.FirewallBackendFamilyStatus
-	}{
-		{"iptables", &baseInfo.IPv4},
-		{"ip6tables", &baseInfo.IPv6},
-	} {
-		if family.command == "ip6tables" && !baseInfo.IPv6Enabled {
-			continue
-		}
-		policy, err := loadForwardPolicy(ctx, family.command)
-		if err != nil {
-			global.LOG.Warnf("inspect %s FORWARD policy: %v", family.command, err)
-			continue
-		}
-		family.status.ForwardPolicy = policy
-	}
 	return baseInfo, nil
 }

@@ -308,26 +288,3 @@ func (s *ForwardingService) Restore(ctx context.Context) error {
 func NewIForwardingService() IForwardingService {
 	return newForwardingService()
 }
-
-func loadForwardPolicy(ctx context.Context, command string) (string, error) {
-	if !cmd.Which(command) {
-		command += "-nft"
-		if !cmd.Which(command) {
-			return "", nil
-		}
-	}
-	output, err := cmd.NewCommandMgr(cmd.WithContext(ctx), cmd.WithTimeout(5*time.Second)).RunWithOptionalSudoAndStdout(command, "-t", "filter", "-w", "2", "-S", "FORWARD")
-	if err != nil {
-		return "", err
-	}
-	for _, line := range strings.Split(output, "\n") {
-		fields := strings.Fields(line)
-		if len(fields) == 3 && fields[0] == "-P" && fields[1] == "FORWARD" {
-			if fields[2] != "ACCEPT" && fields[2] != "DROP" {
-				return "", fmt.Errorf("unexpected FORWARD policy: %s", fields[2])
-			}
-			return fields[2], nil
-		}
-	}
-	return "", errors.New("FORWARD default policy was not found")
-}
@@ -57,7 +57,10 @@ func (u *TaskLogService) ReadByLine(req request.TaskLogReadReq) (*response.FileL
 	if req.TaskID != "" {
 		opts = append(opts, taskRepo.WithByID(req.TaskID))
 	} else {
-		opts = append(opts, repo.WithOrderRuleBy("created_at", "desc"), repo.WithByType(req.TaskType), taskRepo.WithOperate(req.TaskOperate), taskRepo.WithResourceID(req.ResourceID))
+		opts = append(opts, repo.WithOrderRuleBy("created_at", "desc"), repo.WithByType(req.TaskType), taskRepo.WithResourceID(req.ResourceID))
+		if req.TaskOperate != "" {
+			opts = append(opts, taskRepo.WithOperate(req.TaskOperate))
+		}
 	}
 	taskModel, err := taskRepo.GetFirst(opts...)
 	if err != nil {
@@ -258,7 +258,15 @@ func (s *SubTask) Execute() error {
 		case <-ctx.Done():
 			s.RootTask.Log(i18n.GetWithName("TaskTimeout", subTaskName))
 			err = errors.New("timeout!")
+			if s.RootTask.Task.Type == TaskScopeVm {
+				<-done
+			}
 		case err = <-done:
+			if s.RootTask.Task.Type == TaskScopeVm && ctx.Err() != nil {
+				s.RootTask.Log(i18n.GetWithName("TaskTimeout", subTaskName))
+				err = errors.New("timeout!")
+				break
+			}
 			if err != nil {
 				s.RootTask.Log(i18n.GetWithNameAndErr("SubTaskFailed", subTaskName, err))
 				if err.Error() == i18n.GetMsgByKey("ErrShutDown") {
@@ -300,6 +300,9 @@ BuildCache: 'Build Cache'
 Volume: 'Volume'
 Network: "Network"
 PruneStart: 'Cleaning in progress'
+NetworkCleanupConnected: "Skipped network [{{ .name }}] ({{ .id }}): containers connected or network in use; not deleted"
+NetworkCleanupSummary: "Network cleanup finished: deleted {{ .deleted }}, skipped {{ .skipped }}, failed {{ .failed }}"
+NetworkCleanupPartialFailure: "Some networks could not be cleaned; see the task log"
 ContainerBackupPrepare: 'Prepare container backup workspace'
 ContainerBackupStop: 'Stop container before backup'
 ContainerBackupInspect: 'Backup container inspect and network'
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 forwarding is disabled. Set net.ipv4.ip_f
 ErrFirewallRuleSavedApplyFailed: "The new rule configuration was saved, but applying it to the firewall failed. Retry by synchronizing: {{ .detail }}"
 ErrFirewallRuleConflict: "A UFW rule with the same match conditions and a different action already exists. Edit the existing rule instead."
 ErrForwardInterfaceNotFound: "Network interface {{ .name }} specified by the forwarding rule does not exist. Check the interface name and retry."
+ErrIPv6RARisk: "IPv6 forwarding is blocked to prevent possible network loss. See the documentation and system logs for details."
+ErrIPv6RACheckFailed: "IPv6 forwarding is blocked because the network configuration could not be checked. See the system logs for details."

 ErrSSHPublicKey: "Enter a valid SSH public key"
 ErrSSHPrivateKey: "Invalid SSH private key or incorrect passphrase; encrypted keys require the original passphrase"
@@ -300,6 +300,9 @@ BuildCache: 'Caché de compilación'
 Volume: 'Volumen de almacenamiento'
 Network: 'Red'
 PruneStart: 'Limpiando en progreso espere...'
+NetworkCleanupConnected: "Se omitió la red [{{ .name }}] ({{ .id }}): hay contenedores conectados o la red está en uso; no se eliminó"
+NetworkCleanupSummary: "Limpieza de redes finalizada: eliminadas {{ .deleted }}, omitidas {{ .skipped }}, fallidas {{ .failed }}"
+NetworkCleanupPartialFailure: "No se pudieron limpiar algunas redes; consulte el registro de la tarea"
 ContainerBackupPrepare: 'Preparar espacio de respaldo del contenedor'
 ContainerBackupStop: 'Detener contenedor antes del respaldo'
 ContainerBackupInspect: 'Respaldar inspect y red del contenedor'
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "El reenvío IPv4 está desactivado. Configure
 ErrFirewallRuleSavedApplyFailed: "Se guardó la configuración de la nueva regla, pero no se pudo aplicar al cortafuegos. Vuelva a intentarlo mediante la sincronización: {{ .detail }}"
 ErrFirewallRuleConflict: "Ya existe una regla UFW con las mismas condiciones y una acción diferente. Edite la regla existente."
 ErrForwardInterfaceNotFound: "La interfaz de red {{ .name }} indicada en la regla de reenvío no existe. Compruebe el nombre e inténtelo de nuevo."
+ErrIPv6RARisk: "El reenvío IPv6 está bloqueado para evitar una posible pérdida de conectividad. Consulte la documentación y los registros del sistema."
+ErrIPv6RACheckFailed: "El reenvío IPv6 está bloqueado porque no se pudo comprobar la configuración de red. Consulte los registros del sistema."

 ErrSSHPublicKey: "Introduce una clave pública SSH válida"
 ErrSSHPrivateKey: "Clave privada SSH no válida o contraseña incorrecta; las claves cifradas requieren la contraseña original"
@@ -300,6 +300,9 @@ BuildCache: 'کش ساخت'
 Volume: 'حجم'
 Network: "شبکه"
 PruneStart: 'پاک‌سازی در حال انجام است'
+NetworkCleanupConnected: "از شبکه [{{ .name }}] ({{ .id }}) صرف‌نظر شد: کانتینر متصل دارد یا در حال استفاده است؛ حذف نشد"
+NetworkCleanupSummary: "پاک‌سازی شبکه‌ها پایان یافت: حذف‌شده {{ .deleted }}، ردشده {{ .skipped }}، ناموفق {{ .failed }}"
+NetworkCleanupPartialFailure: "پاک‌سازی برخی شبکه‌ها ناموفق بود؛ گزارش وظیفه را بررسی کنید"
 ContainerBackupPrepare: 'آماده‌سازی فضای کاری پشتیبان کانتینر'
 ContainerBackupStop: 'توقف کانتینر قبل از پشتیبان‌گیری'
 ContainerBackupInspect: 'بررسی و شبکه کانتینر پشتیبان'
@@ -719,6 +722,8 @@ ErrDockerIPv4ForwardingDisabled: "ارسال IPv4 غیرفعال است. پیش
 ErrFirewallRuleSavedApplyFailed: "پیکربندی قانون جدید ذخیره شد، اما اعمال آن در دیوار آتش ناموفق بود. با همگام‌سازی دوباره تلاش کنید: {{ .detail }}"
 ErrFirewallRuleConflict: "یک قانون UFW با شرایط تطبیق یکسان و عملکرد متفاوت از قبل وجود دارد. قانون موجود را ویرایش کنید."
 ErrForwardInterfaceNotFound: "رابط شبکه {{ .name }} مشخص‌شده در قانون انتقال وجود ندارد. نام رابط را بررسی کرده و دوباره تلاش کنید."
+ErrIPv6RARisk: "فعال‌سازی هدایت IPv6 به دلیل خطر قطع شبکه مسدود شد. مستندات و گزارش‌های سیستم را بررسی کنید."
+ErrIPv6RACheckFailed: "فعال‌سازی هدایت IPv6 به دلیل عدم امکان بررسی پیکربندی شبکه مسدود شد. جزئیات در گزارش‌های سیستم موجود است."

 ErrSSHPublicKey: "یک کلید عمومی SSH معتبر وارد کنید"
 ErrSSHPrivateKey: "کلید خصوصی SSH نامعتبر یا عبارت عبور نادرست است؛ کلیدهای رمزگذاری‌شده به عبارت عبور اصلی نیاز دارند"
@@ -300,6 +300,9 @@ BuildCache: 'ビルドキャッシュ'
 Volume: 'ストレージボリューム'
 Network: 'ネットワーク'
 PruneStart: 'クリーンアップ中、しばらくお待ちください...'
+NetworkCleanupConnected: "ネットワーク [{{ .name }}] ({{ .id }}) をスキップしました：コンテナが接続されているか使用中のため、削除しませんでした"
+NetworkCleanupSummary: "ネットワークのクリーンアップが完了しました：削除 {{ .deleted }} 件、スキップ {{ .skipped }} 件、失敗 {{ .failed }} 件"
+NetworkCleanupPartialFailure: "一部のネットワークをクリーンアップできませんでした。タスクログを確認してください"
 ContainerBackupPrepare: 'コンテナバックアップ作業領域を準備'
 ContainerBackupStop: 'バックアップ前にコンテナを停止'
 ContainerBackupInspect: 'コンテナ inspect とネットワーク情報をバックアップ'
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 転送が無効です。Docker のファ
 ErrFirewallRuleSavedApplyFailed: "新しいルール設定は保存されましたが、ファイアウォールへの適用に失敗しました。同期で再試行してください：{{ .detail }}"
 ErrFirewallRuleConflict: "UFW に同じ一致条件でアクションが異なるルールが既に存在します。既存のルールを編集してください。"
 ErrForwardInterfaceNotFound: "転送ルールで指定されたネットワークインターフェース {{ .name }} は存在しません。名前を確認して再試行してください。"
+ErrIPv6RARisk: "ネットワーク切断のおそれがあるため、IPv6 転送の有効化をブロックしました。ドキュメントとシステムログをご確認ください。"
+ErrIPv6RACheckFailed: "ネットワーク設定を確認できないため、IPv6 転送の有効化をブロックしました。詳細はシステムログをご確認ください。"

 ErrSSHPublicKey: "有効な SSH 公開鍵を入力してください"
 ErrSSHPrivateKey: "SSH 秘密鍵の形式が無効か、パスフレーズが間違っています。暗号化された鍵には元のパスフレーズが必要です"
@@ -300,6 +300,9 @@ BuildCache: '빌드 캐시'
 Volume: '스토리지 볼륨'
 Network: '네트워크'
 PruneStart: '정리 중입니다. 잠시만 기다려주세요...'
+NetworkCleanupConnected: "네트워크 [{{ .name }}] ({{ .id }}) 건너뜀: 연결된 컨테이너가 있거나 사용 중이므로 삭제하지 않음"
+NetworkCleanupSummary: "네트워크 정리 완료: 삭제 {{ .deleted }}개, 건너뜀 {{ .skipped }}개, 실패 {{ .failed }}개"
+NetworkCleanupPartialFailure: "일부 네트워크를 정리하지 못했습니다. 작업 로그를 확인하세요"
 ContainerBackupPrepare: '컨테이너 백업 작업 공간 준비'
 ContainerBackupStop: '백업 전에 컨테이너 중지'
 ContainerBackupInspect: '컨테이너 inspect 및 네트워크 정보 백업'
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 전달이 비활성화되어 있습니다
 ErrFirewallRuleSavedApplyFailed: "새 규칙 설정이 저장되었지만 방화벽에 적용하지 못했습니다. 동기화하여 다시 시도하세요: {{ .detail }}"
 ErrFirewallRuleConflict: "UFW에 일치 조건이 같지만 동작이 다른 규칙이 이미 있습니다. 기존 규칙을 편집하세요."
 ErrForwardInterfaceNotFound: "전달 규칙에 지정된 네트워크 인터페이스 {{ .name }}이 존재하지 않습니다. 이름을 확인한 후 다시 시도하세요."
+ErrIPv6RARisk: "네트워크 연결이 끊길 위험이 있어 IPv6 전달 활성화를 차단했습니다. 문서와 시스템 로그를 확인하세요."
+ErrIPv6RACheckFailed: "네트워크 구성을 확인할 수 없어 IPv6 전달 활성화를 차단했습니다. 자세한 내용은 시스템 로그를 확인하세요."

 ErrSSHPublicKey: "유효한 SSH 공개 키를 입력하세요"
 ErrSSHPrivateKey: "SSH 개인 키 형식이 잘못되었거나 암호가 틀립니다. 암호화된 키에는 원래 암호가 필요합니다"
@@ -290,6 +290,9 @@ BuildCache: 'ແຄດການສ້າງ'
 Volume: 'ວໍລຸມ (Volume)'
 Network: "ເຄືອຂ່າຍ"
 PruneStart: 'ກຳລັງດຳເນີນການທຳຄວາມສະອາດ'
+NetworkCleanupConnected: "ຂ້າມເຄືອຂ່າຍ [{{ .name }}] ({{ .id }}): ມີຄອນເທນເນີເຊື່ອມຕໍ່ຢູ່ ຫຼື ເຄືອຂ່າຍກຳລັງຖືກໃຊ້ງານ; ບໍ່ໄດ້ລຶບ"
+NetworkCleanupSummary: "ການລ້າງເຄືອຂ່າຍສຳເລັດ: ລຶບແລ້ວ {{ .deleted }}, ຂ້າມ {{ .skipped }}, ລົ້ມເຫຼວ {{ .failed }}"
+NetworkCleanupPartialFailure: "ບໍ່ສາມາດລ້າງບາງເຄືອຂ່າຍໄດ້; ກະລຸນາເບິ່ງບັນທຶກວຽກ"
 ContainerBackupPrepare: 'ກຽມພື້ນທີ່ເຮັດວຽກສຳລັບສຳຮອງຂໍ້ມູນຄອນເທນເນີ'
 ContainerBackupStop: 'ຢຸດຄອນເທນເນີກ່ອນການສຳຮອງຂໍ້ມູນ'
 ContainerBackupInspect: 'ກວດສອບຄອນເທນເນີ ແລະ ເຄືອຂ່າຍສຳລັບການສຳຮອງຂໍ້ມູນ'
@@ -709,6 +712,8 @@ ErrDockerIPv4ForwardingDisabled: "ການສົ່ງຕໍ່ IPv4 ຖືກ
 ErrFirewallRuleSavedApplyFailed: "ບັນທຶກການຕັ້ງຄ່າກົດໃໝ່ແລ້ວ ແຕ່ນຳໃຊ້ກັບໄຟວໍບໍ່ສຳເລັດ. ລອງອີກຄັ້ງດ້ວຍການຊິງຂໍ້ມູນ: {{ .detail }}"
 ErrFirewallRuleConflict: "ມີກົດ UFW ທີ່ມີເງື່ອນໄຂກົງກັນແຕ່ການດຳເນີນການຕ່າງກັນແລ້ວ. ກະລຸນາແກ້ໄຂກົດທີ່ມີຢູ່."
 ErrForwardInterfaceNotFound: "ບໍ່ພົບອິນເຕີເຟດເຄືອຂ່າຍ {{ .name }} ທີ່ລະບຸໃນກົດສົ່ງຕໍ່. ກະລຸນາກວດສອບຊື່ ແລ້ວລອງໃໝ່."
+ErrIPv6RARisk: "ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກເພື່ອປ້ອງກັນຄວາມສ່ຽງທີ່ເຄືອຂ່າຍຈະຂາດການເຊື່ອມຕໍ່. ເບິ່ງເອກະສານ ແລະ ບັນທຶກລະບົບ."
+ErrIPv6RACheckFailed: "ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກເນື່ອງຈາກບໍ່ສາມາດກວດສອບການຕັ້ງຄ່າເຄືອຂ່າຍໄດ້. ເບິ່ງລາຍລະອຽດໃນບັນທຶກລະບົບ."

 ErrSSHPublicKey: "ກະລຸນາປ້ອນຄີສາທາລະນະ SSH ທີ່ຖືກຕ້ອງ"
 ErrSSHPrivateKey: "ຄີສ່ວນຕົວ SSH ບໍ່ຖືກຕ້ອງ ຫຼື ລະຫັດຜ່ານຜິດ; ຄີທີ່ເຂົ້າລະຫັດຕ້ອງໃຊ້ລະຫັດຜ່ານເດີມ"
@@ -300,6 +300,9 @@ BuildCache: 'Cache binaan'
 Volume: 'Jilid storan'
 Network: 'Rangkaian'
 PruneStart: 'Pembersihan sedang dijalankan, sila tunggu...'
+NetworkCleanupConnected: "Rangkaian [{{ .name }}] ({{ .id }}) dilangkau: terdapat kontena yang disambungkan atau rangkaian sedang digunakan; tidak dipadamkan"
+NetworkCleanupSummary: "Pembersihan rangkaian selesai: dipadamkan {{ .deleted }}, dilangkau {{ .skipped }}, gagal {{ .failed }}"
+NetworkCleanupPartialFailure: "Sesetengah rangkaian tidak dapat dibersihkan; semak log tugas"
 ContainerBackupPrepare: 'Sediakan ruang kerja sandaran kontena'
 ContainerBackupStop: 'Hentikan kontena sebelum sandaran'
 ContainerBackupInspect: 'Sandarkan inspect dan rangkaian kontena'
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "Pemajuan IPv4 dilumpuhkan. Tetapkan net.ipv4.i
 ErrFirewallRuleSavedApplyFailed: "Konfigurasi peraturan baharu telah disimpan, tetapi gagal digunakan pada tembok api. Cuba lagi melalui penyegerakan: {{ .detail }}"
 ErrFirewallRuleConflict: "Peraturan UFW dengan syarat padanan yang sama tetapi tindakan berbeza sudah wujud. Sila edit peraturan sedia ada."
 ErrForwardInterfaceNotFound: "Antara muka rangkaian {{ .name }} yang dinyatakan dalam peraturan pemajuan tidak wujud. Semak namanya dan cuba lagi."
+ErrIPv6RARisk: "Pemajuan IPv6 disekat bagi mengelakkan risiko kehilangan sambungan rangkaian. Rujuk dokumentasi dan log sistem."
+ErrIPv6RACheckFailed: "Pemajuan IPv6 disekat kerana konfigurasi rangkaian tidak dapat diperiksa. Lihat log sistem untuk butiran."

 ErrSSHPublicKey: "Masukkan kunci awam SSH yang sah"
 ErrSSHPrivateKey: "Kunci peribadi SSH tidak sah atau frasa laluan salah; kunci yang disulitkan memerlukan frasa laluan asal"
@@ -300,6 +300,9 @@ BuildCache: 'Cache de construção'
 Volume: 'Volume de armazenamento'
 Network: 'Rede'
 PruneStart: 'Limpando em andamento aguarde...'
+NetworkCleanupConnected: "Rede [{{ .name }}] ({{ .id }}) ignorada: há contêineres conectados ou a rede está em uso; não foi excluída"
+NetworkCleanupSummary: "Limpeza de redes concluída: excluídas {{ .deleted }}, ignoradas {{ .skipped }}, falhas {{ .failed }}"
+NetworkCleanupPartialFailure: "Não foi possível limpar algumas redes; consulte o log da tarefa"
 ContainerBackupPrepare: 'Preparar área de backup do contêiner'
 ContainerBackupStop: 'Parar contêiner antes do backup'
 ContainerBackupInspect: 'Fazer backup do inspect e rede do contêiner'
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "O encaminhamento IPv4 está desativado. Defina
 ErrFirewallRuleSavedApplyFailed: "A configuração da nova regra foi salva, mas não pôde ser aplicada ao firewall. Tente novamente por meio da sincronização: {{ .detail }}"
 ErrFirewallRuleConflict: "Já existe uma regra UFW com as mesmas condições e uma ação diferente. Edite a regra existente."
 ErrForwardInterfaceNotFound: "A interface de rede {{ .name }} especificada na regra de encaminhamento não existe. Verifique o nome e tente novamente."
+ErrIPv6RARisk: "O encaminhamento IPv6 foi bloqueado para evitar uma possível perda de conexão. Consulte a documentação e os logs do sistema."
+ErrIPv6RACheckFailed: "O encaminhamento IPv6 foi bloqueado porque não foi possível verificar a configuração de rede. Consulte os logs do sistema."

 ErrSSHPublicKey: "Informe uma chave pública SSH válida"
 ErrSSHPrivateKey: "Chave privada SSH inválida ou senha incorreta; chaves criptografadas exigem a senha original"
@@ -300,6 +300,9 @@ BuildCache: 'Кэш сборки'
 Volume: 'Том хранилища'
 Network: 'Сеть'
 PruneStart: 'Очистка выполняется, пожалуйста, подождите...'
+NetworkCleanupConnected: "Сеть [{{ .name }}] ({{ .id }}) пропущена: подключены контейнеры или сеть используется; не удалена"
+NetworkCleanupSummary: "Очистка сетей завершена: удалено {{ .deleted }}, пропущено {{ .skipped }}, ошибок {{ .failed }}"
+NetworkCleanupPartialFailure: "Не удалось очистить некоторые сети; проверьте журнал задачи"
 ContainerBackupPrepare: 'Подготовить рабочую область резервной копии контейнера'
 ContainerBackupStop: 'Остановить контейнер перед резервным копированием'
 ContainerBackupInspect: 'Сделать резервную копию inspect и сети контейнера'
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "Пересылка IPv4 отключена. П
 ErrFirewallRuleSavedApplyFailed: "Настройки нового правила сохранены, но применить их к межсетевому экрану не удалось. Повторите попытку с помощью синхронизации: {{ .detail }}"
 ErrFirewallRuleConflict: "В UFW уже есть правило с такими же условиями и другим действием. Отредактируйте существующее правило."
 ErrForwardInterfaceNotFound: "Сетевой интерфейс {{ .name }}, указанный в правиле перенаправления, не существует. Проверьте имя и повторите попытку."
+ErrIPv6RARisk: "Включение переадресации IPv6 заблокировано из-за риска потери связи. См. документацию и системные журналы."
+ErrIPv6RACheckFailed: "Включение переадресации IPv6 заблокировано: не удалось проверить настройки сети. Подробности в системных журналах."

 ErrSSHPublicKey: "Введите действительный открытый ключ SSH"
 ErrSSHPrivateKey: "Недопустимый закрытый ключ SSH или неверная парольная фраза; для зашифрованных ключей требуется исходная парольная фраза"
@@ -300,6 +300,9 @@ BuildCache: 'Derleme önbelleği'
 Volume: 'Depolama hacmi'
 Network: 'Ağ'
 PruneStart: 'Temizlik devam ediyor, lütfen bekleyin...'
+NetworkCleanupConnected: "Ağ [{{ .name }}] ({{ .id }}) atlandı: bağlı konteynerler var veya ağ kullanımda; silinmedi"
+NetworkCleanupSummary: "Ağ temizliği tamamlandı: silinen {{ .deleted }}, atlanan {{ .skipped }}, başarısız {{ .failed }}"
+NetworkCleanupPartialFailure: "Bazı ağlar temizlenemedi; görev günlüğünü kontrol edin"
 ContainerBackupPrepare: 'Konteyner yedekleme çalışma alanını hazırla'
 ContainerBackupStop: 'Yedeklemeden önce konteyneri durdur'
 ContainerBackupInspect: 'Konteyner inspect ve ağ bilgisini yedekle'
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 yönlendirmesi devre dışı. Docker güv
 ErrFirewallRuleSavedApplyFailed: "Yeni kural yapılandırması kaydedildi, ancak güvenlik duvarına uygulanamadı. Eşitleme yaparak yeniden deneyin: {{ .detail }}"
 ErrFirewallRuleConflict: "UFW içinde aynı eşleşme koşullarına sahip, farklı bir eylem uygulayan bir kural zaten var. Mevcut kuralı düzenleyin."
 ErrForwardInterfaceNotFound: "Yönlendirme kuralında belirtilen {{ .name }} ağ arayüzü mevcut değil. Arayüz adını kontrol edip yeniden deneyin."
+ErrIPv6RARisk: "Ağ bağlantısının kesilme riski nedeniyle IPv6 yönlendirmesi engellendi. Belgeleri ve sistem günlüklerini inceleyin."
+ErrIPv6RACheckFailed: "Ağ yapılandırması denetlenemediği için IPv6 yönlendirmesi engellendi. Ayrıntılar için sistem günlüklerini inceleyin."

 ErrSSHPublicKey: "Geçerli bir SSH açık anahtarı girin"
 ErrSSHPrivateKey: "SSH özel anahtarı geçersiz veya parola yanlış; şifreli anahtarlar mevcut parolayı gerektirir"
@@ -300,6 +300,9 @@ BuildCache: '構建快取'
 Volume: '磁碟區'
 Network: '網路'
 PruneStart: '清理中，請稍候...'
+NetworkCleanupConnected: "跳過網路 [{{ .name }}] ({{ .id }})：仍有容器連接或正在使用，未刪除"
+NetworkCleanupSummary: "網路清理完成：已刪除 {{ .deleted }}，已跳過 {{ .skipped }}，失敗 {{ .failed }}"
+NetworkCleanupPartialFailure: "部分網路清理失敗，請查看任務日誌"
 ContainerBackupPrepare: '準備容器備份工作目錄'
 ContainerBackupStop: '備份前停止容器'
 ContainerBackupInspect: '備份容器 Inspect 與網路資訊'
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 轉送尚未啟用，請先設定 net.ipv
 ErrFirewallRuleSavedApplyFailed: "新規則設定已儲存，但套用至防火牆失敗。可透過同步重試：{{ .detail }}"
 ErrFirewallRuleConflict: "UFW 中已存在比對條件相同但動作不同的規則，請編輯既有規則。"
 ErrForwardInterfaceNotFound: "轉發規則指定的網卡 {{ .name }} 不存在，請檢查網卡名稱後重試。"
+ErrIPv6RARisk: "IPv6 轉送可能導致網路中斷，已阻止啟用。請參閱文件，詳情見系統日誌。"
+ErrIPv6RACheckFailed: "無法檢查 IPv6 網路設定，已阻止啟用轉送。詳情見系統日誌。"

 ErrSSHPublicKey: "請輸入有效的 SSH 公鑰"
 ErrSSHPrivateKey: "SSH 私鑰格式無效或密碼錯誤；加密私鑰需要填寫原密碼"
@@ -300,6 +300,9 @@ BuildCache: "构建缓存"
 Volume: "存储卷"
 Network: "网络"
 PruneStart: "清理中，请稍候..."
+NetworkCleanupConnected: "跳过网络 [{{ .name }}] ({{ .id }})：仍有容器连接或正在使用，未删除"
+NetworkCleanupSummary: "网络清理完成：已删除 {{ .deleted }}，已跳过 {{ .skipped }}，失败 {{ .failed }}"
+NetworkCleanupPartialFailure: "部分网络清理失败，请查看任务日志"
 ContainerBackupPrepare: "准备容器备份工作目录"
 ContainerBackupStop: "备份前停止容器"
 ContainerBackupInspect: "备份容器 Inspect 与网络信息"
@@ -718,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 转发未开启，请先设置 net.ipv4.i
 ErrFirewallRuleSavedApplyFailed: "新规则配置已保存，但应用到防火墙失败。可通过同步重试：{{ .detail }}"
 ErrFirewallRuleConflict: "UFW 中已存在匹配条件相同但动作不同的规则，请编辑已有规则。"
 ErrForwardInterfaceNotFound: "转发规则指定的网卡 {{ .name }} 不存在，请检查网卡名称后重试。"
+ErrIPv6RARisk: "IPv6 转发存在断网风险，已阻止启用。请参阅文档，详情见系统日志。"
+ErrIPv6RACheckFailed: "无法检查 IPv6 网络配置，已阻止启用转发。详情见系统日志。"

 ErrSSHPublicKey: "请输入有效的 SSH 公钥"
 ErrSSHPrivateKey: "SSH 私钥格式无效或密码错误；加密私钥需要填写原密码"
@@ -251,6 +251,10 @@ func (c *CommandHelper) buildPipeCommands(ctx context.Context, commands []PipeCo
 		cmdItem.SysProcAttr = &syscall.SysProcAttr{
 			Setpgid: true,
 		}
+		cmdItem.Cancel = func() error {
+			_ = syscall.Kill(-cmdItem.Process.Pid, syscall.SIGKILL)
+			return cmdItem.Process.Kill()
+		}
 		cmds = append(cmds, cmdItem)
 	}
 	return cmds
@@ -335,6 +339,12 @@ func (c *CommandHelper) run(name string, arg ...string) (string, error) {
 	cmd.SysProcAttr = &syscall.SysProcAttr{
 		Setpgid: true,
 	}
+	if newContext != nil {
+		cmd.Cancel = func() error {
+			_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+			return cmd.Process.Kill()
+		}
+	}

 	customWriter := &CustomWriter{taskItem: c.taskItem}
 	var stdout, stderr bytes.Buffer
@@ -398,6 +408,9 @@ func (c *CommandHelper) run(name string, arg ...string) (string, error) {
 	}()
 	select {
 	case err := <-done:
+		if newContext != nil && newContext.Err() != nil {
+			return "", c.pipeResultErr(newContext, err)
+		}
 		if err != nil {
 			return handleErr(&stdout, &stderr, c.IgnoreExist1, err)
 		}
@@ -1,6 +1,8 @@
 package forwarding

 import (
+	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -8,19 +10,27 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"time"

+	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/docker/docker/api/types/network"
 )

 func ensureFamilyForwardingSysctls(system forwardingSystem, family string) error {
 	withIPv6 := family == FamilyIPv6
 	if withIPv6 {
-		interfaces, err := IPv6RAInterfaces(system.ReadFile)
+		interfaces, err := IPv6RAInterfaces(system.ReadFile, LoadDockerIPv4BridgePorts)
 		if err != nil {
-			return fmt.Errorf("check IPv6 Router Advertisement: %w", err)
+			global.LOG.Warnf("IPv6 forwarding blocked: failed to check Router Advertisement: %v", err)
+			return buserr.New("ErrIPv6RACheckFailed")
 		}
 		if len(interfaces) > 0 {
-			return fmt.Errorf("IPv6 forwarding blocked: interfaces %s may depend on RA/SLAAC with accept_ra=1; persist accept_ra=2 on interfaces that require RA before retrying", strings.Join(interfaces, ", "))
+			global.LOG.Warnf("IPv6 forwarding blocked: interfaces %s may depend on RA/SLAAC with accept_ra=1; review the network configuration and persist accept_ra=2 on interfaces that require RA before retrying", strings.Join(interfaces, ", "))
+			return buserr.New("ErrIPv6RARisk")
 		}
 	}
 	paths := []string{"/proc/sys/net/ipv4/ip_forward"}
@@ -43,7 +53,7 @@ func ensureFamilyForwardingSysctls(system forwardingSystem, family string) error
 	return nil
 }

-func IPv6RAInterfaces(readFile func(string) ([]byte, error)) ([]string, error) {
+func IPv6RAInterfaces(readFile func(string) ([]byte, error), loadDockerPorts func() (map[string]bool, error)) ([]string, error) {
 	addresses, err := readFile("/proc/net/if_inet6")
 	if err != nil {
 		return nil, err
@@ -67,21 +77,16 @@ func IPv6RAInterfaces(readFile func(string) ([]byte, error)) ([]string, error) {
 		if err != nil {
 			return nil, err
 		}
-		if _, exists := globalAddresses[name]; !exists {
-			globalAddresses[name] = false
-		}
-		if fields[3] == "00" {
-			globalAddresses[name] = true
-			if flags&permanentAddress == 0 {
-				raInterfaces[name] = true
-			}
+		globalAddresses[name] = globalAddresses[name] || fields[3] == "00"
+		if fields[3] == "00" && flags&permanentAddress == 0 {
+			raInterfaces[name] = true
 		}
 	}
 	routes, err := readFile("/proc/net/ipv6_route")
 	if err != nil {
 		return nil, err
 	}
-	const raRouteFlags = 0x00010000 | 0x00800000
+	const raRouteFlags = 0x00010000 | 0x00080000 | 0x00800000
 	for _, line := range strings.Split(string(routes), "\n") {
 		fields := strings.Fields(line)
 		if len(fields) == 0 {
@@ -98,12 +103,15 @@ func IPv6RAInterfaces(readFile func(string) ([]byte, error)) ([]string, error) {
 			raInterfaces[fields[9]] = true
 		}
 	}
+	uncertainInterfaces := make(map[string]bool)
 	for name, hasGlobalAddress := range globalAddresses {
-		if !hasGlobalAddress {
+		if !hasGlobalAddress && !raInterfaces[name] {
 			raInterfaces[name] = true
+			uncertainInterfaces[name] = true
 		}
 	}
 	var interfaces []string
+	checkDockerPorts := false
 	for name := range raInterfaces {
 		if name == "lo" {
 			continue
@@ -118,15 +126,104 @@ func IPv6RAInterfaces(readFile func(string) ([]byte, error)) ([]string, error) {
 		switch strings.TrimSpace(string(value)) {
 		case "1":
 			interfaces = append(interfaces, name)
+			checkDockerPorts = checkDockerPorts || uncertainInterfaces[name]
 		case "0", "2":
 		default:
 			return nil, fmt.Errorf("invalid accept_ra value for %s", name)
 		}
 	}
+	if checkDockerPorts {
+		ports, err := loadDockerPorts()
+		if err != nil {
+			global.LOG.Warnf("IPv6 forwarding RA check: cannot exclude Docker bridge ports: %v", err)
+		} else {
+			kept := interfaces[:0]
+			for _, name := range interfaces {
+				if !uncertainInterfaces[name] || !ports[name] {
+					kept = append(kept, name)
+				}
+			}
+			interfaces = kept
+		}
+	}
 	sort.Strings(interfaces)
 	return interfaces, nil
 }

+func LoadDockerIPv4BridgePorts() (map[string]bool, error) {
+	cli, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer cli.Close()
+	if !strings.HasPrefix(cli.DaemonHost(), "unix://") {
+		return nil, errors.New("cannot verify local bridge ports using a remote Docker daemon")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	info, err := cli.Info(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for _, option := range info.SecurityOptions {
+		if option == "name=rootless" {
+			return nil, errors.New("cannot verify host bridge ports using a rootless Docker daemon")
+		}
+	}
+	networks, err := cli.NetworkList(ctx, network.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+	output, err := cmd.NewCommandMgr(cmd.WithContext(ctx), cmd.WithTimeout(5*time.Second)).RunWithOptionalSudoAndStdout("ip", "-details", "-json", "link", "show")
+	if err != nil {
+		return nil, err
+	}
+	return dockerIPv4BridgePorts(networks, output)
+}
+
+func dockerIPv4BridgePorts(networks []network.Summary, linkJSON string) (map[string]bool, error) {
+	bridges := make(map[string]bool)
+	for _, item := range networks {
+		if item.Driver != "bridge" || item.EnableIPv6 || item.ConfigOnly {
+			continue
+		}
+		name := item.Options["com.docker.network.bridge.name"]
+		if name == "" {
+			if item.Options["com.docker.network.bridge.default_bridge"] == "true" {
+				name = "docker0"
+			} else if len(item.ID) >= 12 {
+				name = "br-" + item.ID[:12]
+			}
+		}
+		if name != "" {
+			bridges[name] = true
+		}
+	}
+	var links []struct {
+		Name     string `json:"ifname"`
+		Master   string `json:"master"`
+		LinkInfo struct {
+			Kind string `json:"info_kind"`
+		} `json:"linkinfo"`
+	}
+	if err := json.Unmarshal([]byte(linkJSON), &links); err != nil {
+		return nil, err
+	}
+	confirmedBridges := make(map[string]bool)
+	for _, link := range links {
+		if link.LinkInfo.Kind == "bridge" && bridges[link.Name] {
+			confirmedBridges[link.Name] = true
+		}
+	}
+	ports := make(map[string]bool)
+	for _, link := range links {
+		if link.LinkInfo.Kind == "veth" && confirmedBridges[link.Master] {
+			ports[link.Name] = true
+		}
+	}
+	return ports, nil
+}
+
 func enableFamilyForwardingSysctls(content, family string) string {
 	lines := strings.Split(strings.TrimRight(content, "\n"), "\n")
 	wanted := map[string]string{"net.ipv4.ip_forward": "net.ipv4.ip_forward = 1"}
@@ -15092,9 +15092,26 @@ const docTemplate = `{
 		},
 		"/databases/redis/install/cli": {
 			"post": {
+				"consumes": [
+					"application/json"
+				],
+				"parameters": [
+					{
+						"description": "request",
+						"in": "body",
+						"name": "request",
+						"required": true,
+						"schema": {
+							"$ref": "#/definitions/dto.RedisCliInstall"
+						}
+					}
+				],
 				"responses": {
 					"200": {
-						"description": "OK"
+						"description": "OK",
+						"schema": {
+							"type": "string"
+						}
 					}
 				},
 				"security": [
@@ -36372,9 +36389,6 @@ const docTemplate = `{
 				"bound": {
 					"type": "boolean"
 				},
-				"forwardPolicy": {
-					"type": "string"
-				},
 				"initialized": {
 					"type": "boolean"
 				},
@@ -40152,6 +40166,14 @@ const docTemplate = `{
 			],
 			"type": "object"
 		},
+		"dto.RedisCliInstall": {
+			"type": "object",
+			"properties": {
+				"taskID": {
+					"type": "string"
+				}
+			}
+		},
 		"dto.RedisConf": {
 			"properties": {
 				"containerName": {
@@ -15088,9 +15088,26 @@
 		},
 		"/databases/redis/install/cli": {
 			"post": {
+				"consumes": [
+					"application/json"
+				],
+				"parameters": [
+					{
+						"description": "request",
+						"in": "body",
+						"name": "request",
+						"required": true,
+						"schema": {
+							"$ref": "#/definitions/dto.RedisCliInstall"
+						}
+					}
+				],
 				"responses": {
 					"200": {
-						"description": "OK"
+						"description": "OK",
+						"schema": {
+							"type": "string"
+						}
 					}
 				},
 				"security": [
@@ -36368,9 +36385,6 @@
 				"bound": {
 					"type": "boolean"
 				},
-				"forwardPolicy": {
-					"type": "string"
-				},
 				"initialized": {
 					"type": "boolean"
 				},
@@ -40148,6 +40162,14 @@
 			],
 			"type": "object"
 		},
+		"dto.RedisCliInstall": {
+			"type": "object",
+			"properties": {
+				"taskID": {
+					"type": "string"
+				}
+			}
+		},
 		"dto.RedisConf": {
 			"properties": {
 				"containerName": {
@@ -230,6 +230,10 @@ func (c *CommandHelper) buildPipeCommands(ctx context.Context, commands []PipeCo
 		cmdItem.SysProcAttr = &syscall.SysProcAttr{
 			Setpgid: true,
 		}
+		cmdItem.Cancel = func() error {
+			_ = syscall.Kill(-cmdItem.Process.Pid, syscall.SIGKILL)
+			return cmdItem.Process.Kill()
+		}
 		cmds = append(cmds, cmdItem)
 	}
 	return cmds
@@ -305,6 +309,12 @@ func (c *CommandHelper) run(name string, arg ...string) (string, error) {
 	cmd.SysProcAttr = &syscall.SysProcAttr{
 		Setpgid: true,
 	}
+	if newContext != nil {
+		cmd.Cancel = func() error {
+			_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+			return cmd.Process.Kill()
+		}
+	}

 	customWriter := &CustomWriter{taskItem: c.taskItem}
 	var stdout, stderr bytes.Buffer
@@ -357,11 +367,12 @@ func (c *CommandHelper) run(name string, arg ...string) (string, error) {
 	}()
 	select {
 	case err := <-done:
-		if c.preserveErrorCause && newContext != nil && newContext.Err() != nil {
-			if cmd.Process != nil && cmd.Process.Pid > 0 {
-				_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		if newContext != nil && newContext.Err() != nil {
+			resultErr := c.pipeResultErr(newContext, err)
+			if c.preserveErrorCause {
+				resultErr = &commandError{message: resultErr.Error(), cause: newContext.Err()}
 			}
-			return "", newContext.Err()
+			return "", resultErr
 		}
 		if err != nil {
 			out, resultErr := handleErr(&stdout, &stderr, c.IgnoreExist1, err)
@@ -23,7 +23,6 @@ export namespace Firewall {
        initialized: boolean;
        bound: boolean;
        reason?: string;
-        forwardPolicy?: 'ACCEPT' | 'DROP';
        raInterfaces?: string[];
    }
    export interface BackendGroup {
@@ -311,6 +311,7 @@ export namespace Website {
        email: string;
        url: string;
        type: string;
+        keyType: string;
        useProxy: boolean;
    }

@@ -193,8 +193,10 @@ export const redisPersistenceConf = (type: string, database: string) => {
 export const checkRedisCli = () => {
    return http.get<boolean>(`/databases/redis/check`);
 };
-export const installRedisCli = () => {
-    return http.post(`/databases/redis/install/cli`, {}, TimeoutEnum.T_5M);
+export const installRedisCli = (taskID: string, node: string) => {
+    return http.post<string>(`/databases/redis/install/cli?operateNode=${encodeURIComponent(node)}`, {
+        taskID,
+    });
 };
 export const changeRedisPassword = (database: string, password: string) => {
    if (password) {
@@ -570,6 +570,8 @@ const message = {
        cancelKeepAlive: 'Stop keeping page session',
    },
    header: {
+        userCenter: 'User Center',
+        exitSystem: 'Log Out',
        logout: 'Logout',
    },
    database: {
@@ -1065,6 +1067,13 @@ const message = {
            whiteListHelper: 'Restrict access to only IPs in the whitelist',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI Gateway supports standalone deployment',
+            deploymentNoticeDescription:
+                'AI Gateway now supports standalone deployment. The built-in AI Gateway in 1Panel will no longer receive updates. We recommend installing the standalone version from the App Store. You can also continue using the current version.',
+            deploymentNoticeContinue: 'Understood, continue using',
+            deploymentNoticeAppStore: 'Go to App Store',
+            deploymentNoticeNoAppPermission:
+                'You do not have access to the App Store. Contact your administrator to install the standalone version.',
            title: 'AI Gateway',
            apiReference: 'API Reference',
            notInstalled: 'Not installed',
@@ -4166,6 +4175,9 @@ const message = {
            'Enabling this can avoid certificate leakage, setting a default website will invalidate this setting',
    },
    ssl: {
+        deleteConfirm:
+            'The following certificates will be deleted. ACME certificates will be automatically revoked. Continue?',
+        deleteAndRevoke: 'Delete and revoke',
        create: 'Request',
        provider: 'Type',
        manualCreate: 'Created manually',
@@ -4306,8 +4318,6 @@ const message = {
        dockerGuard: 'Container Port Guard',
        systemFirewall: 'Host firewall',
        systemFirewallHelper: 'Controls host port access and inbound firewall rules.',
-        forwardPolicyDropWarning:
-            'This server restricts network forwarding. Port forwarding rules may not take effect.',
        forwardingHelper: 'Manages port-forwarding rules.',
        dockerFirewallHelper: 'Selects how 1Panel manages container port protection.',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0, experimental',
@@ -4390,9 +4400,9 @@ const message = {
            'Host INPUT rules do not directly protect this Docker published port. Click to open Container Port Guard.',
        notInitialized: 'Not initialized',
        ipv6RARisk:
-            'IPv6 forwarding is blocked: interfaces {0} have accept_ra=1 and may rely on RA/SLAAC. Review the network configuration, persist accept_ra=2 on interfaces that need RA, then retry.',
+            'IPv6 forwarding is blocked to prevent possible network loss. See the documentation and system logs for details.',
        ipv6RACheckFailed:
-            'Cannot check IPv6 RA configuration. Enabling IPv6 forwarding is blocked. Check the system network configuration and retry.',
+            'IPv6 forwarding is blocked because the network configuration could not be checked. See the system logs for details.',
        ipv6ForwardingOnDemand:
            'IPv6 forwarding is not enabled. It will be checked and enabled when IPv6 rules are added or restored.',
        familyUnsupported: 'The system does not support {0}',
@@ -570,6 +570,8 @@ const message = {
        cancelKeepAlive: 'Dejar de mantener la sesión de la página',
    },
    header: {
+        userCenter: 'Centro de usuario',
+        exitSystem: 'Cerrar sesión',
        logout: 'Cerrar sesión',
    },
    database: {
@@ -1069,6 +1071,13 @@ const message = {
            whiteListHelper: 'Restringir el acceso solo a las IP incluidas en la lista blanca',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI Gateway admite la implementación independiente',
+            deploymentNoticeDescription:
+                'AI Gateway ahora admite la implementación independiente. AI Gateway integrado en 1Panel dejará de recibir actualizaciones. Recomendamos instalar la versión independiente desde la tienda de aplicaciones. También puede seguir usando la versión actual.',
+            deploymentNoticeContinue: 'Entendido, seguir usando',
+            deploymentNoticeAppStore: 'Ir a la tienda de aplicaciones',
+            deploymentNoticeNoAppPermission:
+                'No tiene acceso a la tienda de aplicaciones. Contacte con su administrador para instalar la versión independiente.',
            title: 'Gateway de IA',
            apiReference: 'Referencia de API',
            notInstalled: 'No instalado',
@@ -4216,6 +4225,9 @@ const message = {
            'Habilitar esto puede evitar la fuga de certificados, establecer un sitio web predeterminado invalidará esta configuración',
    },
    ssl: {
+        deleteConfirm:
+            'Se eliminarán los siguientes certificados. Los certificados ACME se revocarán automáticamente. ¿Desea continuar?',
+        deleteAndRevoke: 'Eliminar y revocar',
        create: 'Solicitar',
        provider: 'Tipo',
        manualCreate: 'Creado manualmente',
@@ -4357,8 +4369,6 @@ const message = {
        dockerGuard: 'Protección de puertos de contenedores',
        systemFirewall: 'Firewall del host',
        systemFirewallHelper: 'Controla el acceso a los puertos del host y las reglas de entrada.',
-        forwardPolicyDropWarning:
-            'Este servidor restringe el reenvío de red. Es posible que las reglas de reenvío de puertos no surtan efecto.',
        forwardingHelper: 'Gestiona las reglas de reenvío de puertos.',
        dockerFirewallHelper: 'Selecciona cómo gestiona 1Panel la protección de puertos de contenedores.',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0, experimental',
@@ -4443,9 +4453,9 @@ const message = {
            'Las reglas INPUT del host no protegen directamente este puerto publicado por Docker. Haz clic para abrir la protección de puertos de contenedores.',
        notInitialized: 'No inicializado',
        ipv6RARisk:
-            'El reenvío IPv6 está bloqueado: las interfaces {0} tienen accept_ra=1 y pueden depender de RA/SLAAC. Revise la configuración de red, configure accept_ra=2 de forma persistente en las interfaces que necesitan RA y vuelva a intentarlo.',
+            'El reenvío IPv6 está bloqueado para evitar una posible pérdida de conectividad. Consulte la documentación y los registros del sistema.',
        ipv6RACheckFailed:
-            'No se puede comprobar la configuración RA de IPv6. Se ha bloqueado la activación del reenvío IPv6. Revise la configuración de red y vuelva a intentarlo.',
+            'El reenvío IPv6 está bloqueado porque no se pudo comprobar la configuración de red. Consulte los registros del sistema.',
        ipv6ForwardingOnDemand:
            'El reenvío IPv6 no está habilitado. Se comprobará y habilitará al añadir o restaurar reglas IPv6.',
        familyUnsupported: 'El sistema no admite {0}',
@@ -565,6 +565,8 @@ const message = {
        cancelKeepAlive: 'لغو حفظ نشست صفحه',
    },
    header: {
+        userCenter: 'مرکز کاربری',
+        exitSystem: 'خروج از سیستم',
        logout: 'خروج',
    },
    database: {
@@ -1051,6 +1053,13 @@ const message = {
            whiteListHelper: 'دسترسی را فقط به IP‌های موجود در لیست سفید محدود کنید',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'درگاه هوش مصنوعی از استقرار مستقل پشتیبانی می‌کند',
+            deploymentNoticeDescription:
+                'درگاه هوش مصنوعی اکنون از استقرار مستقل پشتیبانی می‌کند. درگاه هوش مصنوعی داخلی 1Panel دیگر به‌روزرسانی دریافت نخواهد کرد. توصیه می‌کنیم نسخه مستقل را از فروشگاه برنامه نصب کنید. همچنین می‌توانید به استفاده از نسخه فعلی ادامه دهید.',
+            deploymentNoticeContinue: 'متوجه شدم، ادامه استفاده',
+            deploymentNoticeAppStore: 'رفتن به فروشگاه برنامه',
+            deploymentNoticeNoAppPermission:
+                'شما به فروشگاه برنامه دسترسی ندارید. برای نصب نسخه مستقل با مدیر تماس بگیرید.',
            title: 'دروازه AI',
            apiReference: 'راهنمای API',
            notInstalled: 'نصب نشده',
@@ -4132,6 +4141,8 @@ const message = {
            'فعال‌سازی این گزینه می‌تواند از نشت گواهی جلوگیری کند، تنظیم یک وب‌سایت پیش‌فرض این تنظیم را بی‌اثر می‌کند',
    },
    ssl: {
+        deleteConfirm: 'گواهی‌های زیر حذف خواهند شد. گواهی‌های ACME به‌طور خودکار باطل خواهند شد. آیا ادامه می‌دهید؟',
+        deleteAndRevoke: 'حذف و ابطال',
        create: 'درخواست',
        provider: 'نوع',
        manualCreate: 'ایجاد دستی',
@@ -4271,7 +4282,6 @@ const message = {
        dockerGuard: 'محافظت از پورت کانتینر',
        systemFirewall: 'فایروال میزبان',
        systemFirewallHelper: 'دسترسی پورت‌های میزبان و قوانین ورودی را کنترل می‌کند.',
-        forwardPolicyDropWarning: 'این سرور هدایت ترافیک شبکه را محدود کرده است. ممکن است قوانین هدایت پورت کار نکنند.',
        forwardingHelper: 'قوانین انتقال پورت را مدیریت می‌کند.',
        dockerFirewallHelper: 'روش مدیریت محافظت از پورت کانتینر در 1Panel را انتخاب می‌کند.',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0، آزمایشی',
@@ -4355,10 +4365,9 @@ const message = {
        dockerInputNotProtected:
            'قوانین INPUT میزبان مستقیماً از این پورت منتشرشده Docker محافظت نمی‌کنند. برای باز کردن محافظت از پورت کانتینر کلیک کنید.',
        notInitialized: 'راه‌اندازی نشده',
-        ipv6RARisk:
-            'هدایت IPv6 مسدود شد: رابط‌های {0} دارای accept_ra=1 هستند و ممکن است به RA/SLAAC وابسته باشند. تنظیمات شبکه را بررسی کنید، برای رابط‌های نیازمند RA مقدار accept_ra=2 را به‌صورت پایدار تنظیم کنید و دوباره تلاش کنید.',
+        ipv6RARisk: 'فعال‌سازی هدایت IPv6 به دلیل خطر قطع شبکه مسدود شد. مستندات و گزارش‌های سیستم را بررسی کنید.',
        ipv6RACheckFailed:
-            'بررسی تنظیمات RA در IPv6 ممکن نیست. فعال‌سازی هدایت IPv6 مسدود شده است. تنظیمات شبکه سیستم را بررسی کرده و دوباره تلاش کنید.',
+            'فعال‌سازی هدایت IPv6 به دلیل عدم امکان بررسی پیکربندی شبکه مسدود شد. جزئیات در گزارش‌های سیستم موجود است.',
        ipv6ForwardingOnDemand: 'هدایت IPv6 فعال نیست. هنگام افزودن یا بازیابی قوانین IPv6 بررسی و فعال خواهد شد.',
        familyUnsupported: 'سیستم از {0} پشتیبانی نمی‌کند',
        familyChainIssue: '{0} · زنجیره {1} · {2}',
@@ -568,6 +568,8 @@ const message = {
        cancelKeepAlive: 'ページセッションの保持を解除',
    },
    header: {
+        userCenter: 'ユーザーセンター',
+        exitSystem: 'ログアウト',
        logout: 'ログアウト',
    },
    database: {
@@ -1054,6 +1056,13 @@ const message = {
            whiteListHelper: 'ホワイトリスト内のIPのみアクセスを許可する',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI ゲートウェイの独立したデプロイに対応',
+            deploymentNoticeDescription:
+                'AI ゲートウェイは独立したデプロイに対応しました。1Panel 内蔵の AI ゲートウェイは今後更新されません。アプリストアから独立版をインストールすることをお勧めします。現在のバージョンを引き続き使用することもできます。',
+            deploymentNoticeContinue: '了解して使用を継続',
+            deploymentNoticeAppStore: 'アプリストアへ',
+            deploymentNoticeNoAppPermission:
+                'アプリストアへのアクセス権限がありません。管理者に独立版のインストールを依頼してください。',
            title: 'AI ゲートウェイ',
            apiReference: 'API リファレンス',
            notInstalled: '未インストール',
@@ -4154,6 +4163,8 @@ const message = {
            '有効にすると証明書の漏洩を防げますが、デフォルト Web サイトを設定するとこの設定は無効になります',
    },
    ssl: {
+        deleteConfirm: '以下の証明書を削除します。ACME 証明書は自動的に失効されます。続行しますか？',
+        deleteAndRevoke: '削除して失効',
        create: 'リクエスト',
        provider: 'タイプ',
        manualCreate: '手動で作成されます',
@@ -4294,8 +4305,6 @@ const message = {
        dockerGuard: 'コンテナポート保護',
        systemFirewall: 'ホストファイアウォール',
        systemFirewallHelper: 'ホストのポートアクセスと受信ルールを管理します。',
-        forwardPolicyDropWarning:
-            'このサーバーではネットワーク転送が制限されているため、ポート転送ルールが機能しない可能性があります。',
        forwardingHelper: 'ポート転送ルールを管理します。',
        dockerFirewallHelper: '1Panel のコンテナポート保護の管理方法を選択します。',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0、実験的',
@@ -4377,9 +4386,9 @@ const message = {
            'ホストの INPUT ルールでは、この Docker 公開ポートを直接保護できません。クリックしてコンテナポート保護を開きます。',
        notInitialized: '未初期化',
        ipv6RARisk:
-            'IPv6 転送がブロックされています。インターフェース {0} は accept_ra=1 で、RA/SLAAC に依存している可能性があります。ネットワーク設定を確認し、RA が必要なインターフェースで accept_ra=2 を永続的に設定してから再試行してください。',
+            'ネットワーク切断のおそれがあるため、IPv6 転送の有効化をブロックしました。ドキュメントとシステムログをご確認ください。',
        ipv6RACheckFailed:
-            'IPv6 RA 設定を確認できないため、IPv6 転送の有効化をブロックしました。システムのネットワーク設定を確認して再試行してください。',
+            'ネットワーク設定を確認できないため、IPv6 転送の有効化をブロックしました。詳細はシステムログをご確認ください。',
        ipv6ForwardingOnDemand: 'IPv6 転送は無効です。IPv6 ルールの追加または復元時に確認して有効化します。',
        familyUnsupported: 'システムは {0} をサポートしていません',
        familyChainIssue: '{0} · {1} チェーン · {2}',
@@ -562,6 +562,8 @@ const message = {
        cancelKeepAlive: '페이지 세션 유지 해제',
    },
    header: {
+        userCenter: '사용자 센터',
+        exitSystem: '로그아웃',
        logout: '로그아웃',
    },
    database: {
@@ -1043,6 +1045,12 @@ const message = {
            whiteListHelper: '화이트리스트에 있는 IP만 접근 허용',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI 게이트웨이 독립 배포 지원',
+            deploymentNoticeDescription:
+                'AI 게이트웨이가 독립 배포를 지원합니다. 1Panel 내장 AI 게이트웨이는 더 이상 업데이트되지 않습니다. 앱 스토어에서 독립 버전을 설치하는 것을 권장합니다. 현재 버전을 계속 사용할 수도 있습니다.',
+            deploymentNoticeContinue: '확인, 계속 사용',
+            deploymentNoticeAppStore: '앱 스토어로 이동',
+            deploymentNoticeNoAppPermission: '앱 스토어 접근 권한이 없습니다. 관리자에게 독립 버전 설치를 요청하세요.',
            title: 'AI 게이트웨이',
            apiReference: 'API 안내',
            notInstalled: '설치되지 않음',
@@ -4078,6 +4086,8 @@ const message = {
            '활성화하면 인증서 누출을 방지할 수 있지만, 기본 웹사이트를 설정하면 이 설정이 무효화됩니다',
    },
    ssl: {
+        deleteConfirm: '다음 인증서를 삭제합니다. ACME 인증서는 자동으로 폐기됩니다. 계속하시겠습니까?',
+        deleteAndRevoke: '삭제 및 폐기',
        create: '요청',
        provider: '유형',
        manualCreate: '수동 생성됨',
@@ -4215,7 +4225,6 @@ const message = {
        dockerGuard: '컨테이너 포트 보호',
        systemFirewall: '호스트 방화벽',
        systemFirewallHelper: '호스트 포트 접근과 인바운드 규칙을 관리합니다.',
-        forwardPolicyDropWarning: '현재 서버에서 네트워크 전달이 제한되어 포트 전달 규칙이 작동하지 않을 수 있습니다.',
        forwardingHelper: '포트 포워딩 규칙을 관리합니다.',
        dockerFirewallHelper: '1Panel 컨테이너 포트 보호 관리 방식을 선택합니다.',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0, 실험적',
@@ -4296,9 +4305,9 @@ const message = {
            '호스트 INPUT 규칙은 이 Docker 게시 포트를 직접 보호하지 않습니다. 클릭하여 컨테이너 포트 보호를 여세요.',
        notInitialized: '초기화되지 않음',
        ipv6RARisk:
-            'IPv6 전달이 차단되었습니다. 인터페이스 {0}의 accept_ra=1 설정으로 인해 RA/SLAAC에 의존할 수 있습니다. 네트워크 설정을 확인하고 RA가 필요한 인터페이스에 accept_ra=2를 영구 설정한 후 다시 시도하세요.',
+            '네트워크 연결이 끊길 위험이 있어 IPv6 전달 활성화를 차단했습니다. 문서와 시스템 로그를 확인하세요.',
        ipv6RACheckFailed:
-            'IPv6 RA 설정을 확인할 수 없어 IPv6 전달 활성화를 차단했습니다. 시스템 네트워크 설정을 확인한 후 다시 시도하세요.',
+            '네트워크 구성을 확인할 수 없어 IPv6 전달 활성화를 차단했습니다. 자세한 내용은 시스템 로그를 확인하세요.',
        ipv6ForwardingOnDemand:
            'IPv6 전달이 활성화되지 않았습니다. IPv6 규칙을 추가하거나 복원할 때 확인 후 활성화됩니다.',
        familyUnsupported: '시스템에서 {0}을 지원하지 않습니다',
@@ -563,6 +563,8 @@ const message = {
        cancelKeepAlive: 'ຍົກເລີກການຮັກສາເຊັດຊັນໜ້າ',
    },
    header: {
+        userCenter: 'ສູນຜູ້ໃຊ້',
+        exitSystem: 'ອອກຈາກລະບົບ',
        logout: 'ອອກຈາກລະບົບ',
    },
    database: {
@@ -1040,6 +1042,13 @@ const message = {
            whiteListHelper: 'ຈຳກັດການເຂົ້າເຖິງສະເພາະ IP ໃນລາຍຊື່ທີ່ອະນຸຍາດ',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI Gateway ຮອງຮັບການຕິດຕັ້ງແບບແຍກຕ່າງຫາກ',
+            deploymentNoticeDescription:
+                'AI Gateway ຮອງຮັບການຕິດຕັ້ງແບບແຍກຕ່າງຫາກແລ້ວ. AI Gateway ທີ່ມາພ້ອມກັບ 1Panel ຈະບໍ່ໄດ້ຮັບການອັບເດດອີກ. ແນະນຳໃຫ້ຕິດຕັ້ງລຸ້ນແຍກຕ່າງຫາກຈາກຮ້ານແອັບ. ທ່ານຍັງສາມາດໃຊ້ລຸ້ນປັດຈຸບັນຕໍ່ໄດ້.',
+            deploymentNoticeContinue: 'ຮັບຊາບ, ໃຊ້ຕໍ່',
+            deploymentNoticeAppStore: 'ໄປທີ່ຮ້ານແອັບ',
+            deploymentNoticeNoAppPermission:
+                'ທ່ານບໍ່ມີສິດເຂົ້າເຖິງຮ້ານແອັບ. ກະລຸນາຕິດຕໍ່ຜູ້ດູແລເພື່ອຕິດຕັ້ງລຸ້ນແຍກຕ່າງຫາກ.',
            title: 'AI Gateway',
            apiReference: 'ຄູ່ມື API',
            notInstalled: 'ຍັງບໍ່ໄດ້ຕິດຕັ້ງ',
@@ -4049,6 +4058,8 @@ const message = {
            'ການເປີດໃຊ້ສິ່ງນີ້ສາມາດຫຼີກລ່ຽງການຮົ່ວໄຫຼຂອງໃບຢັ້ງຢືນ, ແຕ່ການຕັ້ງເວັບໄຊເລີ່ມຕົ້ນຈະເຮັດໃຫ້ການຕັ້ງຄ່ານີ້ບໍ່ມີຜົນ',
    },
    ssl: {
+        deleteConfirm: 'ຈະລຶບໃບຢັ້ງຢືນຕໍ່ໄປນີ້. ໃບຢັ້ງຢືນ ACME ຈະຖືກຖອນໂດຍອັດຕະໂນມັດ. ຕ້ອງການສືບຕໍ່ບໍ?',
+        deleteAndRevoke: 'ລຶບ ແລະ ຖອນ',
        create: 'ຮ້ອງຂໍ',
        provider: 'ປະເພດ',
        manualCreate: 'ສ້າງດ້ວຍຕົນເອງ',
@@ -4182,7 +4193,6 @@ const message = {
        dockerGuard: 'ການປ້ອງກັນພອດຄອນເທນເນີ',
        systemFirewall: 'ໄຟວໍໂຮສ',
        systemFirewallHelper: 'ຄວບຄຸມການເຂົ້າເຖິງພອດໂຮສ ແລະ ກົດຂາເຂົ້າ.',
-        forwardPolicyDropWarning: 'ເຊີບເວີນີ້ຈຳກັດການສົ່ງຕໍ່ເຄືອຂ່າຍ. ກົດການສົ່ງຕໍ່ພອດອາດບໍ່ເຮັດວຽກ.',
        forwardingHelper: 'ຈັດການກົດການສົ່ງຕໍ່ພອດ.',
        dockerFirewallHelper: 'ເລືອກວິທີທີ່ 1Panel ຈັດການການປ້ອງກັນພອດຄອນເທນເນີ.',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0, ທົດລອງ',
@@ -4260,9 +4270,9 @@ const message = {
            'ກົດ INPUT ຂອງໂຮສບໍ່ໄດ້ປ້ອງກັນພອດ Docker ນີ້ໂດຍກົງ. ຄລິກເພື່ອເປີດການປ້ອງກັນພອດຄອນເທນເນີ.',
        notInitialized: 'ຍັງບໍ່ໄດ້ເລີ່ມຕົ້ນ',
        ipv6RARisk:
-            'ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກ: ອິນເຕີເຟດ {0} ມີ accept_ra=1 ແລະອາດອາໄສ RA/SLAAC. ກວດສອບການຕັ້ງຄ່າເຄືອຂ່າຍ, ຕັ້ງ accept_ra=2 ແບບຖາວອນໃຫ້ອິນເຕີເຟດທີ່ຕ້ອງການ RA ແລ້ວລອງໃໝ່.',
+            'ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກເພື່ອປ້ອງກັນຄວາມສ່ຽງທີ່ເຄືອຂ່າຍຈະຂາດການເຊື່ອມຕໍ່. ເບິ່ງເອກະສານ ແລະ ບັນທຶກລະບົບ.',
        ipv6RACheckFailed:
-            'ບໍ່ສາມາດກວດສອບການຕັ້ງຄ່າ IPv6 RA ໄດ້. ການເປີດໃຊ້ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກ. ກວດສອບການຕັ້ງຄ່າເຄືອຂ່າຍແລ້ວລອງໃໝ່.',
+            'ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກເນື່ອງຈາກບໍ່ສາມາດກວດສອບການຕັ້ງຄ່າເຄືອຂ່າຍໄດ້. ເບິ່ງລາຍລະອຽດໃນບັນທຶກລະບົບ.',
        ipv6ForwardingOnDemand: 'ຍັງບໍ່ໄດ້ເປີດໃຊ້ການສົ່ງຕໍ່ IPv6. ລະບົບຈະກວດສອບແລະເປີດໃຊ້ເມື່ອເພີ່ມຫຼືກູ້ຄືນກົດ IPv6.',
        familyUnsupported: 'ລະບົບບໍ່ຮອງຮັບ {0}',
        familyChainIssue: '{0} · chain {1} · {2}',
@@ -575,6 +575,8 @@ const message = {
        cancelKeepAlive: 'Hentikan pengekalan sesi halaman',
    },
    header: {
+        userCenter: 'Pusat Pengguna',
+        exitSystem: 'Log keluar',
        logout: 'Log keluar',
    },
    database: {
@@ -1077,6 +1079,13 @@ const message = {
            whiteListHelper: 'Hadkan akses kepada hanya IP dalam senarai putih',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI Gateway menyokong penggunaan kendiri',
+            deploymentNoticeDescription:
+                'AI Gateway kini menyokong penggunaan kendiri. AI Gateway terbina dalam 1Panel tidak lagi akan menerima kemas kini. Kami mengesyorkan pemasangan versi kendiri daripada gedung aplikasi. Anda juga boleh terus menggunakan versi semasa.',
+            deploymentNoticeContinue: 'Faham, terus gunakan',
+            deploymentNoticeAppStore: 'Pergi ke gedung aplikasi',
+            deploymentNoticeNoAppPermission:
+                'Anda tidak mempunyai akses ke gedung aplikasi. Hubungi pentadbir untuk memasang versi kendiri.',
            title: 'Gateway AI',
            apiReference: 'Rujukan API',
            notInstalled: 'Belum dipasang',
@@ -4231,6 +4240,8 @@ const message = {
            'Mengaktifkan ini boleh mengelakkan kebocoran sijil, menetapkan laman web lalai akan membatalkan tetapan ini',
    },
    ssl: {
+        deleteConfirm: 'Sijil berikut akan dipadamkan. Sijil ACME akan dibatalkan secara automatik. Teruskan?',
+        deleteAndRevoke: 'Padam dan batalkan',
        create: 'Permintaan',
        provider: 'Jenis',
        manualCreate: 'Dicipta secara manual',
@@ -4374,8 +4385,6 @@ const message = {
        dockerGuard: 'Perlindungan port bekas',
        systemFirewall: 'Tembok api hos',
        systemFirewallHelper: 'Mengawal akses port hos dan peraturan masuk.',
-        forwardPolicyDropWarning:
-            'Pelayan ini mengehadkan pemajuan rangkaian. Peraturan pemajuan port mungkin tidak berfungsi.',
        forwardingHelper: 'Mengurus peraturan pemajuan port.',
        dockerFirewallHelper: 'Memilih cara 1Panel mengurus perlindungan port bekas.',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0, percubaan',
@@ -4459,9 +4468,9 @@ const message = {
            'Peraturan INPUT hos tidak melindungi port terbitan Docker ini secara langsung. Klik untuk membuka perlindungan port bekas.',
        notInitialized: 'Belum dimulakan',
        ipv6RARisk:
-            'Pemajuan IPv6 disekat: antara muka {0} mempunyai accept_ra=1 dan mungkin bergantung pada RA/SLAAC. Semak konfigurasi rangkaian, tetapkan accept_ra=2 secara kekal pada antara muka yang memerlukan RA, kemudian cuba lagi.',
+            'Pemajuan IPv6 disekat bagi mengelakkan risiko kehilangan sambungan rangkaian. Rujuk dokumentasi dan log sistem.',
        ipv6RACheckFailed:
-            'Konfigurasi RA IPv6 tidak dapat diperiksa. Pengaktifan pemajuan IPv6 disekat. Semak konfigurasi rangkaian sistem dan cuba lagi.',
+            'Pemajuan IPv6 disekat kerana konfigurasi rangkaian tidak dapat diperiksa. Lihat log sistem untuk butiran.',
        ipv6ForwardingOnDemand:
            'Pemajuan IPv6 belum diaktifkan. Ia akan diperiksa dan diaktifkan apabila peraturan IPv6 ditambah atau dipulihkan.',
        familyUnsupported: 'Sistem tidak menyokong {0}',
@@ -568,6 +568,8 @@ const message = {
        cancelKeepAlive: 'Parar de manter a sessão da página',
    },
    header: {
+        userCenter: 'Central do usuário',
+        exitSystem: 'Sair',
        logout: 'Logout',
    },
    database: {
@@ -1072,6 +1074,13 @@ const message = {
                'Após ativar, você pode desativar o acesso externo à porta em Loja de Apps - Instalado - Ollama - Parâmetros para melhorar a segurança.',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI Gateway permite implantação independente',
+            deploymentNoticeDescription:
+                'O AI Gateway agora permite implantação independente. O AI Gateway integrado ao 1Panel não receberá mais atualizações. Recomendamos instalar a versão independente pela loja de aplicativos. Você também pode continuar usando a versão atual.',
+            deploymentNoticeContinue: 'Entendido, continuar usando',
+            deploymentNoticeAppStore: 'Ir à loja de aplicativos',
+            deploymentNoticeNoAppPermission:
+                'Você não tem acesso à loja de aplicativos. Contate o administrador para instalar a versão independente.',
            title: 'Gateway de IA',
            apiReference: 'Referência da API',
            notInstalled: 'Não instalado',
@@ -4250,6 +4259,9 @@ const message = {
            'Ativar isso pode evitar vazamento de certificados, definir um site padrão invalidará esta configuração',
    },
    ssl: {
+        deleteConfirm:
+            'Os certificados a seguir serão excluídos. Os certificados ACME serão revogados automaticamente. Continuar?',
+        deleteAndRevoke: 'Excluir e revogar',
        create: 'Solicitar',
        provider: 'Tipo',
        manualCreate: 'Criado manualmente',
@@ -4395,8 +4407,6 @@ const message = {
        dockerGuard: 'Proteção de portas de contêineres',
        systemFirewall: 'Firewall do host',
        systemFirewallHelper: 'Controla o acesso às portas do host e as regras de entrada.',
-        forwardPolicyDropWarning:
-            'Este servidor restringe o encaminhamento de rede. As regras de encaminhamento de portas podem não funcionar.',
        forwardingHelper: 'Gerencia regras de encaminhamento de portas.',
        dockerFirewallHelper: 'Seleciona como o 1Panel gerencia a proteção de portas de contêineres.',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0, experimental',
@@ -4482,9 +4492,9 @@ const message = {
            'As regras INPUT do host não protegem diretamente esta porta publicada pelo Docker. Clique para abrir a proteção de portas de contêineres.',
        notInitialized: 'Não inicializado',
        ipv6RARisk:
-            'O encaminhamento IPv6 foi bloqueado: as interfaces {0} têm accept_ra=1 e podem depender de RA/SLAAC. Verifique a configuração de rede, configure accept_ra=2 de forma persistente nas interfaces que precisam de RA e tente novamente.',
+            'O encaminhamento IPv6 foi bloqueado para evitar uma possível perda de conexão. Consulte a documentação e os logs do sistema.',
        ipv6RACheckFailed:
-            'Não foi possível verificar a configuração RA do IPv6. A ativação do encaminhamento IPv6 foi bloqueada. Verifique a configuração de rede e tente novamente.',
+            'O encaminhamento IPv6 foi bloqueado porque não foi possível verificar a configuração de rede. Consulte os logs do sistema.',
        ipv6ForwardingOnDemand:
            'O encaminhamento IPv6 não está ativado. Ele será verificado e ativado ao adicionar ou restaurar regras IPv6.',
        familyUnsupported: 'O sistema não oferece suporte a {0}',
@@ -566,6 +566,8 @@ const message = {
        cancelKeepAlive: 'Не сохранять сеанс страницы',
    },
    header: {
+        userCenter: 'Центр пользователя',
+        exitSystem: 'Выйти из системы',
        logout: 'Выход',
    },
    database: {
@@ -1065,6 +1067,13 @@ const message = {
            whiteListHelper: 'Ограничить доступ только для IP-адресов из белого списка',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI Gateway поддерживает отдельное развёртывание',
+            deploymentNoticeDescription:
+                'AI Gateway теперь поддерживает отдельное развёртывание. Встроенный AI Gateway в 1Panel больше не будет получать обновления. Рекомендуем установить отдельную версию из магазина приложений. Вы также можете продолжить использовать текущую версию.',
+            deploymentNoticeContinue: 'Понятно, продолжить использование',
+            deploymentNoticeAppStore: 'Перейти в магазин приложений',
+            deploymentNoticeNoAppPermission:
+                'У вас нет доступа к магазину приложений. Обратитесь к администратору для установки отдельной версии.',
            title: 'AI-шлюз',
            apiReference: 'Справочник API',
            notInstalled: 'Не установлен',
@@ -4217,6 +4226,9 @@ const message = {
            'Включение этого может предотвратить утечку сертификатов, установка веб-сайта по умолчанию сделает эту настройку недействительной',
    },
    ssl: {
+        deleteConfirm:
+            'Следующие сертификаты будут удалены. Сертификаты ACME будут автоматически отозваны. Продолжить?',
+        deleteAndRevoke: 'Удалить и отозвать',
        create: 'Запросить',
        provider: 'Тип',
        manualCreate: 'Создан вручную',
@@ -4361,8 +4373,6 @@ const message = {
        dockerGuard: 'Защита портов контейнеров',
        systemFirewall: 'Брандмауэр хоста',
        systemFirewallHelper: 'Управляет доступом к портам хоста и входящими правилами.',
-        forwardPolicyDropWarning:
-            'На этом сервере ограничена пересылка сетевого трафика. Правила перенаправления портов могут не работать.',
        forwardingHelper: 'Управляет правилами перенаправления портов.',
        dockerFirewallHelper: 'Выбирает способ управления защитой портов контейнеров в 1Panel.',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0, экспериментально',
@@ -4447,9 +4457,9 @@ const message = {
            'Правила INPUT хоста не защищают этот опубликованный Docker-порт напрямую. Нажмите, чтобы открыть защиту портов контейнеров.',
        notInitialized: 'Не инициализировано',
        ipv6RARisk:
-            'Пересылка IPv6 заблокирована: интерфейсы {0} имеют accept_ra=1 и могут зависеть от RA/SLAAC. Проверьте настройки сети, сохраните accept_ra=2 для интерфейсов, которым нужен RA, и повторите попытку.',
+            'Включение переадресации IPv6 заблокировано из-за риска потери связи. См. документацию и системные журналы.',
        ipv6RACheckFailed:
-            'Не удалось проверить настройки RA для IPv6. Включение пересылки IPv6 заблокировано. Проверьте настройки сети и повторите попытку.',
+            'Включение переадресации IPv6 заблокировано: не удалось проверить настройки сети. Подробности в системных журналах.',
        ipv6ForwardingOnDemand:
            'Пересылка IPv6 не включена. Проверка и включение выполняются при добавлении или восстановлении правил IPv6.',
        familyUnsupported: 'Система не поддерживает {0}',
@@ -570,6 +570,8 @@ const message = {
        cancelKeepAlive: 'Sayfa oturumunu korumayı bırak',
    },
    header: {
+        userCenter: 'Kullanıcı Merkezi',
+        exitSystem: 'Çıkış yap',
        logout: 'Çıkış',
    },
    database: {
@@ -1076,6 +1078,13 @@ const message = {
            whiteListHelper: 'Erişimi yalnızca beyaz listedeki IPlerle sınırlayın',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI Gateway bağımsız dağıtımı destekliyor',
+            deploymentNoticeDescription:
+                'AI Gateway artık bağımsız dağıtımı destekliyor. 1Panel içindeki AI Gateway artık güncelleme almayacak. Uygulama mağazasından bağımsız sürümü yüklemenizi öneririz. Mevcut sürümü kullanmaya da devam edebilirsiniz.',
+            deploymentNoticeContinue: 'Anladım, kullanmaya devam et',
+            deploymentNoticeAppStore: 'Uygulama mağazasına git',
+            deploymentNoticeNoAppPermission:
+                'Uygulama mağazasına erişim izniniz yok. Bağımsız sürümü yüklemek için yöneticinizle iletişime geçin.',
            title: 'AI Ağ Geçidi',
            apiReference: 'API Referansı',
            notInstalled: 'Kurulu değil',
@@ -4235,6 +4244,9 @@ const message = {
            'Etkinleştirilmesi sertifika sızıntısını önleyebilir, varsayılan bir web sitesi ayarlamak bu ayarı geçersiz kılar',
    },
    ssl: {
+        deleteConfirm:
+            'Aşağıdaki sertifikalar silinecek. ACME sertifikaları otomatik olarak iptal edilecek. Devam edilsin mi?',
+        deleteAndRevoke: 'Sil ve iptal et',
        create: 'İstek',
        provider: 'Tür',
        manualCreate: 'Manuel olarak oluşturuldu',
@@ -4379,7 +4391,6 @@ const message = {
        dockerGuard: 'Konteyner portu koruması',
        systemFirewall: 'Ana makine güvenlik duvarı',
        systemFirewallHelper: 'Ana makine port erişimini ve gelen kuralları yönetir.',
-        forwardPolicyDropWarning: 'Bu sunucu ağ yönlendirmesini kısıtlıyor. Port yönlendirme kuralları çalışmayabilir.',
        forwardingHelper: 'Port yönlendirme kurallarını yönetir.',
        dockerFirewallHelper: '1Panel konteyner portu korumasının nasıl yönetileceğini seçer.',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0, deneysel',
@@ -4466,9 +4477,9 @@ const message = {
            'Ana makine INPUT kuralları bu Docker yayımlanmış portunu doğrudan korumaz. Konteyner portu korumasını açmak için tıklayın.',
        notInitialized: 'Başlatılmadı',
        ipv6RARisk:
-            'IPv6 yönlendirme engellendi: {0} arayüzlerinde accept_ra=1 ayarlı ve bu arayüzler RA/SLAAC kullanıyor olabilir. Ağ yapılandırmasını kontrol edin, RA gereken arayüzlerde accept_ra=2 ayarını kalıcı olarak uygulayın ve yeniden deneyin.',
+            'Ağ bağlantısının kesilme riski nedeniyle IPv6 yönlendirmesi engellendi. Belgeleri ve sistem günlüklerini inceleyin.',
        ipv6RACheckFailed:
-            'IPv6 RA yapılandırması kontrol edilemedi. IPv6 yönlendirmeyi etkinleştirme engellendi. Sistem ağ yapılandırmasını kontrol edip yeniden deneyin.',
+            'Ağ yapılandırması denetlenemediği için IPv6 yönlendirmesi engellendi. Ayrıntılar için sistem günlüklerini inceleyin.',
        ipv6ForwardingOnDemand:
            'IPv6 yönlendirme etkin değil. IPv6 kuralları eklenirken veya geri yüklenirken kontrol edilip etkinleştirilecektir.',
        familyUnsupported: 'Sistem {0} desteğini sunmuyor',
@@ -548,6 +548,8 @@ const message = {
        cancelKeepAlive: '取消保持頁面工作階段',
    },
    header: {
+        userCenter: '使用者中心',
+        exitSystem: '登出系統',
        logout: '登出',
    },
    database: {
@@ -1006,6 +1008,12 @@ const message = {
            whiteListHelper: '限制僅白名單中的 IP 可瀏覽',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI 網關已支援獨立部署',
+            deploymentNoticeDescription:
+                'AI 網關現已支援獨立部署，1Panel 內建 AI 網關後續將不再更新。建議前往應用程式商店安裝獨立版本，您也可以繼續使用目前版本。',
+            deploymentNoticeContinue: '已知悉，繼續使用',
+            deploymentNoticeAppStore: '前往應用程式商店',
+            deploymentNoticeNoAppPermission: '您沒有應用程式商店存取權限，請聯絡管理員安裝獨立版本。',
            title: 'AI 閘道',
            apiReference: '介面說明',
            notInstalled: '未安裝',
@@ -3890,6 +3898,8 @@ const message = {
        sslRejectHandshakeHelper: '開啟之後可以避免憑證洩露，設置預設網站會讓此設置失效',
    },
    ssl: {
+        deleteConfirm: '將對以下憑證進行 刪除 操作，ACME 類型憑證會被自動撤銷，是否繼續？',
+        deleteAndRevoke: '刪除並撤銷',
        create: '申請憑證',
        provider: '類型',
        manualCreate: '手動建立',
@@ -4020,7 +4030,6 @@ const message = {
        dockerGuard: '容器連接埠防護',
        systemFirewall: '主機防火牆',
        systemFirewallHelper: '用於管理主機連接埠存取和入站規則。',
-        forwardPolicyDropWarning: '目前伺服器限制了網路轉送，轉送規則可能無法生效。',
        forwardingHelper: '用於管理連接埠轉發規則。',
        dockerFirewallHelper: '用於選擇 1Panel 容器連接埠防護的管理方式。',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0，實驗性',
@@ -4092,9 +4101,8 @@ const message = {
        dockerInputUseHostFirewall: '此連接埠需要透過主機防火牆設定存取規則，請前往主機防火牆進行設定。',
        dockerInputNotProtected: '主機 INPUT 規則無法直接保護此 Docker 發佈連接埠，點擊前往容器連接埠防護。',
        notInitialized: '未初始化',
-        ipv6RARisk:
-            'IPv6 轉送已阻止：網路介面 {0} 的 accept_ra=1，可能依賴 RA/SLAAC。請確認網路設定，為需要接收 RA 的介面持久化設定 accept_ra=2 後重試。',
-        ipv6RACheckFailed: '無法檢查 IPv6 RA 設定，已阻止啟用 IPv6 轉送。請檢查系統網路設定後重試。',
+        ipv6RARisk: 'IPv6 轉送可能導致網路中斷，已阻止啟用。請參閱文件，詳情見系統日誌。',
+        ipv6RACheckFailed: '無法檢查 IPv6 網路設定，已阻止啟用轉送。詳情見系統日誌。',
        ipv6ForwardingOnDemand: 'IPv6 轉送尚未啟用，將在新增或還原 IPv6 規則時檢查並啟用。',
        familyUnsupported: '系統不支援 {0}',
        familyChainIssue: '{0} · {1} 鏈 · {2}',
@@ -552,6 +552,8 @@ const message = {
        cancelKeepAlive: '取消保持页面会话',
    },
    header: {
+        userCenter: '用户中心',
+        exitSystem: '退出系统',
        logout: '退出登录',
    },
    database: {
@@ -1019,6 +1021,12 @@ const message = {
            whiteListHelper: '限制仅白名单中的 IP 可访问',
        },
        aiProxy: {
+            deploymentNoticeTitle: 'AI 网关已支持独立部署',
+            deploymentNoticeDescription:
+                'AI 网关现已支持独立部署，1Panel 内置 AI 网关后续将不再更新。建议前往应用商店安装独立版本，您也可以继续使用当前版本。',
+            deploymentNoticeContinue: '已知晓，继续使用',
+            deploymentNoticeAppStore: '前往应用商店',
+            deploymentNoticeNoAppPermission: '您没有应用商店访问权限，请联系管理员安装独立版本。',
            title: 'AI 网关',
            apiReference: '接口说明',
            notInstalled: '未安装',
@@ -3935,6 +3943,8 @@ const message = {
        sslRejectHandshakeHelper: '开启之后可以避免证书泄露，设置默认网站会让此设置失效',
    },
    ssl: {
+        deleteConfirm: '将对以下证书进行 删除 操作，ACME类型证书会被自动吊销，是否继续？',
+        deleteAndRevoke: '删除并吊销',
        create: '申请证书',
        provider: '类型',
        manualCreate: '手动创建',
@@ -4066,7 +4076,6 @@ const message = {
        dockerGuard: '容器端口防护',
        systemFirewall: '主机防火墙',
        systemFirewallHelper: '用于管理主机端口访问和入站规则。',
-        forwardPolicyDropWarning: '当前服务器限制了网络转发，转发规则可能无法生效。',
        forwardingHelper: '用于管理端口转发规则。',
        dockerFirewallHelper: '用于选择 1Panel 容器端口防护的管理方式。',
        dockerNftablesRequirement: 'Docker ≥ 29.0.0，实验性',
@@ -4138,9 +4147,8 @@ const message = {
        dockerInputUseHostFirewall: '该端口需要通过主机防火墙设置访问规则，请前往主机防火墙进行配置。',
        dockerInputNotProtected: '宿主机 INPUT 规则不能直接保护此 Docker 发布端口，点击前往容器端口防护。',
        notInitialized: '未初始化',
-        ipv6RARisk:
-            'IPv6 转发已阻止：网卡 {0} 的 accept_ra=1，可能依赖 RA/SLAAC。请确认网络配置，为需要接收 RA 的网卡持久化设置 accept_ra=2 后重试。',
-        ipv6RACheckFailed: '无法检查 IPv6 RA 配置，已阻止启用 IPv6 转发。请检查系统网络配置后重试。',
+        ipv6RARisk: 'IPv6 转发存在断网风险，已阻止启用。请参阅文档，详情见系统日志。',
+        ipv6RACheckFailed: '无法检查 IPv6 网络配置，已阻止启用转发。详情见系统日志。',
        ipv6ForwardingOnDemand: 'IPv6 转发尚未启用，将在添加或恢复 IPv6 规则时检查并启用。',
        familyUnsupported: '系统不支持 {0}',
        familyChainIssue: '{0} · {1} 链 · {2}',
@@ -2,7 +2,7 @@
    <div>
        <el-popover
            v-model:visible="popoverVisible"
-            placement="right-end"
+            placement="right-start"
            :show-arrow="false"
            :offset="0"
            :width="200"
@@ -26,12 +26,6 @@
                </div>
            </template>
            <div class="dropdown-menu" v-loading="loading || switchingNode">
-                <div class="dropdown-item" v-if="currentUser" @click="changeUserInfo">
-                    <SvgIcon class="icon" iconName="p-gerenzhongxin1" />
-                    {{ currentUser.name }}
-                </div>
-                <el-divider class="divider" />
-
                <div class="dropdown-item" @click="openTask">
                    <SvgIcon class="icon" iconName="p-renwuzhongxin1" />
                    {{ $t('menu.msgCenter') }}
@@ -74,11 +68,6 @@
                        </el-icon>
                    </div>
                </div>
-                <el-divider class="divider" />
-                <div class="dropdown-item" @click="logout">
-                    <SvgIcon class="icon" iconName="p-tuichudenglu3" />
-                    {{ $t('commons.login.logout') }}
-                </div>
            </div>
        </el-popover>
        <NodeDrawer
@@ -129,7 +118,7 @@ const props = defineProps({

 const defaultNodeLimit = 8;

-const emit = defineEmits(['openTask', 'refresh']);
+const emit = defineEmits(['openTask', 'refresh', 'userChange']);
 bus.on('refreshTask', () => {
    checkTask();
 });
@@ -272,6 +261,7 @@ const openNodeDashboard = () => {
 };

 const logout = () => {
+    popoverVisible.value = false;
    ElMessageBox.confirm(i18n.global.t('commons.msg.sureLogOut'), i18n.global.t('commons.msg.infoTitle'), {
        confirmButtonText: i18n.global.t('commons.button.confirm'),
        cancelButtonText: i18n.global.t('commons.button.cancel'),
@@ -297,13 +287,17 @@ const loadCurrentUser = async (currentNode?: string) => {
    const authInfo = await syncAuthInfo(currentNode);
    if (authInfo) {
        currentUser.value = authInfo;
+        emit('userChange', authInfo);
    }
 };
 const changeUserInfo = () => {
+    popoverVisible.value = false;
    loadCurrentUser();
    userInfoRef.value?.openDrawer();
 };

+defineExpose({ openUserInfo: changeUserInfo, logout });
+
 onMounted(() => {
    loadNodes();
    checkTask();
@@ -318,7 +312,7 @@ onMounted(() => {
    display: flex;
    align-items: center;
    box-sizing: border-box;
-    border-top: 1px solid var(--panel-footer-border);
+    border-bottom: 1px solid var(--panel-footer-border);
    height: 48px;
    .icon {
        margin-left: 25px;
@@ -10,6 +10,14 @@
            <PrimaryMenu />
        </div>
        <Logo :isCollapse="isCollapse" />
+        <Collapse
+            ref="nodeSelectorRef"
+            class="node-selector"
+            :version="version"
+            @open-task="openTask"
+            @refresh="search"
+            @user-change="currentUser = $event"
+        />
        <el-scrollbar>
            <el-menu
                :default-active="activeMenu"
@@ -23,7 +31,40 @@
                <SubItem :menuList="routerMenus" :level="0" />
            </el-menu>
        </el-scrollbar>
-        <Collapse :version="version" @open-task="openTask" @refresh="search" />
+        <el-dropdown
+            v-if="currentUser"
+            class="user-dropdown"
+            trigger="click"
+            placement="right-end"
+            :popper-options="{ modifiers: [{ name: 'flip', enabled: false }] }"
+            :show-arrow="false"
+            :hide-on-click="true"
+            @visible-change="userMenuVisible = $event"
+            @command="handleUserCommand"
+        >
+            <button
+                type="button"
+                class="user-entry"
+                :class="{ 'is-active': userMenuVisible }"
+                :aria-label="currentUser.name"
+                :title="currentUser.name"
+            >
+                <SvgIcon class="icon" iconName="p-gerenzhongxin1" />
+                <span v-if="!isCollapse" class="user-name">{{ currentUser.name }}</span>
+            </button>
+            <template #dropdown>
+                <el-dropdown-menu class="user-menu">
+                    <el-dropdown-item command="userCenter">
+                        <SvgIcon class="user-menu-icon" iconName="p-gerenzhongxin1" />
+                        <span>{{ $t('header.userCenter') }}</span>
+                    </el-dropdown-item>
+                    <el-dropdown-item command="logout">
+                        <SvgIcon class="user-menu-icon" iconName="p-tuichudenglu3" />
+                        <span>{{ $t('header.exitSystem') }}</span>
+                    </el-dropdown-item>
+                </el-dropdown-menu>
+            </template>
+        </el-dropdown>
    </div>
 </template>

@@ -40,12 +81,24 @@ import { getSettingBaseInfo } from '@/api/modules/setting';
 import PrimaryMenu from '@/assets/images/menu-bg.svg?component';
 import { hasPermissionMetaAccess, hasRouteRoleAccess } from '@/utils/rbac';
 import { useGlobalStore } from '@/composables/useGlobalStore';
+import type { Login } from '@/api/interface/auth';

 const route = useRoute();
 const router = useRouter();
 const menuStore = MenuStore();
 const { currentNode, isAdmin, menuAccordion, permissions } = useGlobalStore();
 const version = ref();
+const nodeSelectorRef = ref<InstanceType<typeof Collapse>>();
+const currentUser = ref<Login.AuthInfo>();
+const userMenuVisible = ref(false);
+
+const handleUserCommand = (command: string) => {
+    if (command === 'userCenter') {
+        nodeSelectorRef.value?.openUserInfo();
+    } else if (command === 'logout') {
+        nodeSelectorRef.value?.logout();
+    }
+};

 const activeMenu = computed(() => {
    const { meta, path } = route;
@@ -324,8 +377,14 @@ watch(
    height: 100%;
    background: var(--panel-menu-bg-color) no-repeat top;

+    .logo,
+    .node-selector {
+        flex-shrink: 0;
+    }
+
    .el-scrollbar {
        flex: 1;
+        min-height: 0;
        .el-menu {
            overflow: auto;
            overflow-x: hidden;
@@ -337,4 +396,62 @@ watch(
 .ico {
    height: 20px !important;
 }
+
+.user-dropdown {
+    flex-shrink: 0;
+    width: 100%;
+}
+
+.user-menu {
+    min-width: 160px;
+
+    :deep(.el-dropdown-menu__item) {
+        gap: 8px;
+        padding: 10px 16px;
+    }
+
+    .user-menu-icon {
+        flex-shrink: 0;
+        font-size: 8px;
+    }
+}
+
+.user-entry {
+    display: flex;
+    align-items: center;
+    gap: 7px;
+    flex-shrink: 0;
+    position: relative;
+    width: 100%;
+    height: 48px;
+    padding: 0 25px;
+    border: 0;
+    border-top: 1px solid var(--panel-footer-border);
+    background: transparent;
+    color: var(--panel-main-bg-color-1);
+    font-family: inherit;
+    font-size: var(--el-font-size-base);
+    line-height: 1.5;
+    text-align: left;
+    cursor: pointer;
+
+    .icon {
+        flex-shrink: 0;
+        font-size: 8px;
+    }
+
+    .user-name {
+        min-width: 0;
+        overflow: hidden;
+        text-overflow: ellipsis;
+        white-space: nowrap;
+    }
+
+    &:hover,
+    &:focus-visible,
+    &.is-active {
+        color: var(--el-color-primary);
+        background: var(--el-menu-item-bg-color);
+    }
+}
 </style>
@@ -81,7 +81,13 @@
                        :style="{ height: `calc(100vh - ${loadHeight()})`, 'background-color': '#000' }"
                        :description="loadErrMsg()"
                    >
-                        <el-button v-if="currentDB.from === 'remote'" v-permission type="primary" @click="installCli">
+                        <el-button
+                            v-if="currentDB.from === 'remote'"
+                            v-permission
+                            type="primary"
+                            :loading="cliSubmitting"
+                            @click="installCli"
+                        >
                            {{ $t('commons.button.enable') }}
                        </el-button>
                    </el-empty>
@@ -134,6 +140,7 @@
        </DialogPro>

        <QuickCmd ref="dialogQuickCmdRef" @reload="loadQuickCmd" />
+        <TaskLog ref="cliTaskLogRef" @close="checkCliValid" />
    </div>
 </template>

@@ -148,12 +155,14 @@ import { checkAppInstalled } from '@/api/modules/app';
 import { useGlobalStore } from '@/composables/useGlobalStore';
 import { listDatabases, checkRedisCli, installRedisCli } from '@/api/modules/database';
 import { Database } from '@/api/interface/database';
-import { MsgSuccess } from '@/utils/message';
 import i18n from '@/lang';
 import { getCommandList } from '@/api/modules/command';
 import { routerToName, routerToNameWithQuery } from '@/utils/router';
 import { useOperateNodeContext } from '@/composables/useOperateNodeContext';

+import TaskLog from '@/components/log/task/index.vue';
+import { newUUID } from '@/utils/id';
+
 const { currentNode, currentRedisDB, openMenuTabs } = useGlobalStore();
 useOperateNodeContext(currentNode);

@@ -170,7 +179,11 @@ const appStatusRef = ref();

 const open = ref(false);

-const redisCliExist = ref();
+const redisCliExist = ref(false);
+const cliSubmitting = ref(false);
+const cliTaskLogRef = ref<InstanceType<typeof TaskLog>>();
+const operateNode = currentNode.value;
+let disposed = false;

 const appKey = ref('redis');
 const appName = ref();
@@ -250,6 +263,7 @@ const changeDatabase = async () => {
 const loadDBOptions = async () => {
    try {
        const res = await listDatabases('redis,redis-cluster');
+        if (disposed || operateNode !== currentNode.value) return;
        let datas = res.data || [];
        dbOptionsLocal.value = [];
        dbOptionsRemote.value = [];
@@ -286,7 +300,7 @@ const loadDBOptions = async () => {
            reOpenTerminal();
        }
    } finally {
-        isLoaded.value = true;
+        if (!disposed && operateNode === currentNode.value) isLoaded.value = true;
    }
 };

@@ -301,6 +315,9 @@ const reOpenTerminal = async () => {
 };

 const initTerminal = async () => {
+    if (disposed || !currentDB.value) return;
+    const database = currentDBName.value;
+    const isCurrent = () => !disposed && operateNode === currentNode.value && database === currentDBName.value;
    loading.value = true;
    if (currentDB.value.from === 'remote') {
        if (!redisCliExist.value) {
@@ -311,9 +328,10 @@ const initTerminal = async () => {
        loading.value = false;
        redisIsExist.value = true;
        nextTick(() => {
+            if (!isCurrent()) return;
            terminalShow.value = true;
            redisStatus.value = 'Running';
-            terminalRef.value.acceptParams({
+            terminalRef.value?.acceptParams({
                endpoint: '/api/v2/hosts/terminal/container',
                args: `source=redis&name=${currentDBName.value}&from=${currentDB.value.from}`,
                error: '',
@@ -325,13 +343,15 @@ const initTerminal = async () => {
    }
    await checkAppInstalled(currentDB.value.type, currentDBName.value)
        .then((res) => {
+            if (!isCurrent()) return;
            redisIsExist.value = res.data.isExist;
            redisStatus.value = res.data.status;
            loading.value = false;
            nextTick(() => {
+                if (!isCurrent()) return;
                if (res.data.status === 'Running') {
                    terminalShow.value = true;
-                    terminalRef.value.acceptParams({
+                    terminalRef.value?.acceptParams({
                        endpoint: '/api/v2/hosts/terminal/container',
                        args: `source=${currentDB.value.type}&name=${currentDBName.value}&from=${currentDB.value.from}`,
                        error: '',
@@ -342,6 +362,7 @@ const initTerminal = async () => {
            isRefresh.value = !isRefresh.value;
        })
        .catch(() => {
+            if (!isCurrent()) return;
            closeTerminal(false);
            loading.value = false;
        });
@@ -353,27 +374,30 @@ const closeTerminal = async (isKeepShow: boolean) => {
 };

 const checkCliValid = async () => {
-    await checkRedisCli()
-        .then((res) => {
-            redisCliExist.value = res.data;
-            loadDBOptions();
-        })
-        .catch(() => {
-            loadDBOptions();
-        });
+    if (disposed || operateNode !== currentNode.value) return;
+    try {
+        const res = await checkRedisCli();
+        if (disposed || operateNode !== currentNode.value) return;
+        redisCliExist.value = res.data;
+    } finally {
+        if (!disposed && operateNode === currentNode.value) await loadDBOptions();
+    }
 };
+
 const installCli = async () => {
-    loading.value = true;
-    await installRedisCli()
-        .then(() => {
-            loading.value = false;
-            redisCliExist.value = true;
-            MsgSuccess(i18n.global.t('commons.msg.operationSuccess'));
-            reOpenTerminal();
-        })
-        .catch(() => {
-            loading.value = false;
-        });
+    if (cliSubmitting.value) return;
+    cliSubmitting.value = true;
+    try {
+        const res = await installRedisCli(newUUID(), operateNode);
+        if (disposed || operateNode !== currentNode.value) return;
+        if (res.data) {
+            cliTaskLogRef.value?.openWithTaskID(res.data, true, operateNode);
+        } else {
+            await checkCliValid();
+        }
+    } finally {
+        cliSubmitting.value = false;
+    }
 };

 const loadQuickCmd = async () => {
@@ -403,6 +427,7 @@ const onAfter = () => {
    initTerminal();
 };
 onBeforeUnmount(() => {
+    disposed = true;
    closeTerminal(false);
 });
 </script>
@@ -2851,6 +2851,36 @@ onBeforeUnmount(() => {
    border-bottom: 1px solid var(--el-border-color-light) !important;
 }

+/* Keep the closable tab width stable so switching tabs does not reflow the tab bar */
+:deep(.file-tabs .el-tabs__header .el-tabs__item.is-closable) {
+    padding: 0 20px;
+
+    .is-icon-close {
+        width: 14px;
+        margin-left: 5px;
+        right: 0;
+        opacity: 0;
+        pointer-events: none;
+        transition: opacity var(--el-transition-duration);
+    }
+
+    &.is-active,
+    &:hover,
+    &:focus-within {
+        .is-icon-close {
+            opacity: 1;
+            pointer-events: auto;
+        }
+    }
+
+    @media (hover: none), (pointer: coarse) {
+        .is-icon-close {
+            opacity: 1;
+            pointer-events: auto;
+        }
+    }
+}
+
 :deep(.file-tabs .el-tabs--card > .el-tabs__header .el-tabs__item.is-active) {
    border-bottom-width: 1px !important;
 }
@@ -6,7 +6,6 @@
            :closable="false"
            :title="$t('firewall.importLimit', [FIREWALL_BATCH_LIMIT, FIREWALL_IMPORT_MAX_SIZE / 1024])"
        />
-        <el-alert v-if="submitError" class="mb-3" type="error" :closable="false" :title="submitError" />
        <div class="import-file-bar mt-3">
            <el-upload
                ref="uploadRef"
@@ -100,7 +99,6 @@ const policies = ref<Firewall.DockerGuardPolicy[]>([]);
 const selects = ref(new Set<Firewall.DockerGuardPolicy>());
 const uploadRef = ref();
 const uploaderFiles = ref<UploadFile[]>([]);
-const submitError = ref('');
 const displaySources = (policy: Firewall.DockerGuardPolicy) => formatHostAddressList(policy.sources, policy.family);

 const fileOnChange = (uploadFile: UploadFile, uploadFiles: UploadFiles) => {
@@ -109,7 +107,6 @@ const fileOnChange = (uploadFile: UploadFile, uploadFiles: UploadFiles) => {

    policies.value = [];
    selects.value = new Set();
-    submitError.value = '';
    uploaderFiles.value = uploadFiles;
    if (uploadFile.raw.size > FIREWALL_IMPORT_MAX_SIZE) {
        uploadRef.value?.clearFiles();
@@ -162,7 +159,6 @@ const onImport = async () => {
        return;
    }
    loading.value = true;
-    submitError.value = '';
    try {
        const result = (
            await upsertDockerPortGuardPolicies({
@@ -171,16 +167,17 @@ const onImport = async () => {
            })
        ).data;
        if (!result.taskID || !result.queued) {
-            submitError.value = i18n.global.t('commons.msg.operationFailed');
+            MsgError(i18n.global.t('commons.msg.operationFailed'));
            return;
        }
        visible.value = false;
        emit('created', result.taskID);
    } catch (error) {
-        submitError.value =
+        MsgError(
            (isAxiosError(error) && error.response?.data?.message) ||
-            (error && getErrorMessage(error)) ||
-            i18n.global.t('commons.res.commonError');
+                (error && getErrorMessage(error)) ||
+                i18n.global.t('commons.res.commonError'),
+        );
    } finally {
        loading.value = false;
    }
@@ -200,7 +197,6 @@ const acceptParams = () => {
    policies.value = [];
    selects.value = new Set();
    uploaderFiles.value = [];
-    submitError.value = '';
    uploadRef.value?.clearFiles();
    visible.value = true;
 };
@@ -12,8 +12,7 @@
            v-loading="loading"
        >
            <template #prompt>
-                <el-alert v-if="data.base.message" type="warning" :closable="false" :title="data.base.message" />
-                <el-alert v-else type="info" :closable="false" :title="$t('firewall.dockerGuardHelper')" />
+                <el-alert type="info" :closable="false" :title="$t('firewall.dockerGuardHelper')" />
            </template>
            <template #leftToolBar>
                <el-button plain @click="orphanDrawerVisible = true">
@@ -455,6 +454,7 @@ const search = async () => {
    loading.value = true;
    try {
        Object.assign(data, (await loadDockerPortGuard()).data);
+        if (data.base.message) MsgError(data.base.message);
        selects.value = [];
        orphanSelects.value = [];
    } finally {
@@ -25,9 +25,6 @@
                    <span v-else>{{ $t('firewall.basicStatus') }}</span>
                </el-card>
                <LayoutContent :title="$t('firewall.forwardRule', 2)" :class="{ mask: !isInit || !isBind }">
-                    <template v-if="fireStatusRef?.forwardDropFamilies" #prompt>
-                        <el-alert type="warning" :closable="false" :title="$t('firewall.forwardPolicyDropWarning')" />
-                    </template>
                    <template #leftToolBar>
                        <el-button v-permission v-node-admin type="primary" @click="onOpenDialog('create')">
                            {{ $t('commons.button.create') }}
@@ -15,7 +15,7 @@
                </template>
            </i18n-t>
        </NoSuchService>
-        <div class="app-status card-interval" v-else-if="baseInfo.isExist && !baseInfo.message">
+        <div class="app-status card-interval" v-else-if="baseInfo.isExist">
            <el-card>
                <div class="flex w-full flex-col gap-4 md:flex-row">
                    <div class="flex flex-wrap gap-4 ml-3">
@@ -145,16 +145,6 @@
                :title="$t('firewall.directBackendConflictWarning', [backendName, baseInfo.conflictBackend])"
            />
        </div>
-        <el-alert v-else-if="baseInfo.isExist" class="card-interval" type="error" show-icon :closable="false">
-            <template #title>
-                <div class="flex items-center gap-2">
-                    <span>{{ baseInfo.message }}</span>
-                    <el-button v-permission v-node-admin type="primary" link @click="goToFirewallSetting">
-                        {{ $t('commons.button.set') }}
-                    </el-button>
-                </div>
-            </template>
-        </el-alert>
        <DockerRestart
            ref="dockerRef"
            v-model:withDockerRestart="withDockerRestart"
@@ -210,7 +200,6 @@ const baseInfo = ref<Firewall.FirewallBase>({
    conflictBackend: '',
    version: '',
    pingStatus: '',
-    message: '',
    reason: '',
    ipv4: { available: false, initialized: false, bound: false },
    ipv6: { available: false, initialized: false, bound: false },
@@ -243,13 +232,6 @@ const familyStatuses = computed(() =>
    ).filter((item) => item.family === 'IPv4' || baseInfo.value.ipv6Enabled !== false),
 );
 const availableFamilies = computed(() => familyStatuses.value.filter((item) => item.status.available));
-const forwardDropFamilies = computed(() => {
-    if (backendUnavailable.value || !baseInfo.value.isExist || baseInfo.value.message) return '';
-    return familyStatuses.value
-        .filter((item) => item.status.forwardPolicy === 'DROP')
-        .map((item) => item.family)
-        .join(', ');
-});
 const anyFamilyInitialized = computed(() => availableFamilies.value.some((item) => item.status.initialized));
 const allAvailableFamiliesInitialized = computed(
    () => availableFamilies.value.length > 0 && availableFamilies.value.every((item) => item.status.initialized),
@@ -297,7 +279,7 @@ const familyActions = computed(() =>
 const familyIssueText = (issue: FamilyIssue) => {
    if (!issue.available) return i18n.global.t('firewall.familyUnsupported', [issue.family]);
    if (issue.reason === 'ipv6_ra_required') {
-        return i18n.global.t('firewall.ipv6RARisk', [issue.raInterfaces?.join(', ') || '-']);
+        return i18n.global.t('firewall.ipv6RARisk');
    }
    if (issue.reason === 'ipv6_ra_check_failed') return i18n.global.t('firewall.ipv6RACheckFailed');
    if (issue.partial) return i18n.global.t('firewall.familyIncomplete', [issue.family]);
@@ -481,7 +463,6 @@ onBeforeUnmount(() => {
 });

 defineExpose({
-    forwardDropFamilies,
    acceptParams,
    openInitialization: onInit,
 });
@@ -179,7 +179,7 @@ import { Rules, checkMaxLength } from '@/global/form-rules';
 import FileList from '@/components/file-list/index.vue';
 import i18n from '@/lang';
 import { FormInstance } from 'element-plus';
-import { computed, reactive, ref } from 'vue';
+import { computed, reactive, ref, watch } from 'vue';
 import { MsgSuccess } from '@/utils/message';
 import { KeyTypes } from '@/global/mimetype';
 import { getDNSName, getAccountName } from '@/utils/ssl';
@@ -265,6 +265,15 @@ const initData = () => ({

 const ssl = ref(initData());
 const operate = ref('create');
+watch([() => ssl.value.acmeAccountId, acmeAccounts], () => {
+    if (operate.value !== 'create' || ssl.value.provider === 'selfSigned') {
+        return;
+    }
+    const account = acmeAccounts.value?.find((item) => item.id === ssl.value.acmeAccountId);
+    if (account?.keyType) {
+        ssl.value.keyType = account.keyType;
+    }
+});
 const dnsResolve = ref<Website.DNSResolve[]>([]);
 const em = defineEmits(['close', 'submit']);

@@ -304,6 +304,8 @@ const routerButton = [
    },
 ];

+const shouldRevokeSSL = (row: Website.SSLDTO) => ['dnsAccount', 'dnsManual', 'http'].includes(row.provider);
+
 const buttons = [
    {
        label: i18n.global.t('ssl.detail'),
@@ -379,6 +381,15 @@ const buttons = [
        click: function (row: Website.SSLDTO) {
            deletessl(row);
        },
+        show: (row: Website.SSLDTO) => !shouldRevokeSSL(row),
+    },
+    {
+        label: i18n.global.t('ssl.deleteAndRevoke'),
+        permission: true,
+        click: function (row: Website.SSLDTO) {
+            deletessl(row);
+        },
+        show: shouldRevokeSSL,
    },
 ];

@@ -532,9 +543,13 @@ const applySSL = (row: Website.SSLDTO) => {
 };

 const deletessl = async (row: any) => {
+    const isBatch = row == null;
+    const deleteLabel = i18n.global.t(
+        !isBatch && shouldRevokeSSL(row) ? 'ssl.deleteAndRevoke' : 'commons.button.delete',
+    );
    let names = [];
    let params = {};
-    if (row == null) {
+    if (isBatch) {
        names = selects.value.map((item: Website.SSLDTO) => item.primaryDomain);
        params = { ids: selects.value.map((item: Website.SSLDTO) => item.id) };
    } else {
@@ -543,12 +558,11 @@ const deletessl = async (row: any) => {
    }

    opRef.value.acceptParams({
-        title: i18n.global.t('commons.button.delete'),
+        title: deleteLabel,
        names: names,
-        msg: i18n.global.t('commons.msg.operatorHelper', [
-            i18n.global.t('website.ssl'),
-            i18n.global.t('commons.button.delete'),
-        ]),
+        msg: isBatch
+            ? i18n.global.t('ssl.deleteConfirm')
+            : i18n.global.t('commons.msg.operatorHelper', [i18n.global.t('website.ssl'), deleteLabel]),
        api: deleteSSL,
        params: params,
    });
@@ -9,21 +9,14 @@
                </el-select>
            </el-form-item>
            <div v-if="ssl.type === 'paste'">
-                <el-form-item :label="$t('website.privateKey')" prop="privateKey">
-                    <el-input v-model="ssl.privateKey" :rows="6" type="textarea" />
-                </el-form-item>
                <el-form-item :label="$t('website.certificate')" prop="certificate">
                    <el-input v-model="ssl.certificate" :rows="6" type="textarea" />
                </el-form-item>
+                <el-form-item :label="$t('website.privateKey')" prop="privateKey">
+                    <el-input v-model="ssl.privateKey" :rows="6" type="textarea" />
+                </el-form-item>
            </div>
            <div v-if="ssl.type === 'local'">
-                <el-form-item :label="$t('website.privateKeyPath')" prop="privateKeyPath">
-                    <el-input v-model="ssl.privateKeyPath">
-                        <template #prepend>
-                            <el-button icon="Folder" @click="keyFileRef.acceptParams({ dir: false })" />
-                        </template>
-                    </el-input>
-                </el-form-item>
                <el-form-item :label="$t('website.certificatePath')" prop="certificatePath">
                    <el-input v-model="ssl.certificatePath">
                        <template #prepend>
@@ -31,15 +24,22 @@
                        </template>
                    </el-input>
                </el-form-item>
+                <el-form-item :label="$t('website.privateKeyPath')" prop="privateKeyPath">
+                    <el-input v-model="ssl.privateKeyPath">
+                        <template #prepend>
+                            <el-button icon="Folder" @click="keyFileRef.acceptParams({ dir: false })" />
+                        </template>
+                    </el-input>
+                </el-form-item>
            </div>
            <div v-if="ssl.type === 'upload'">
-                <el-form-item :label="$t('website.privateKey')" prop="privateKeyFile">
+                <el-form-item :label="$t('website.certificate')" prop="certificateFile">
                    <el-upload
-                        ref="privateKeyUpload"
+                        ref="certificateUpload"
                        :auto-upload="false"
                        :limit="1"
-                        :on-change="handlePrivateKeyChange"
-                        :file-list="privateKeyFileList"
+                        :on-change="handleCertificateChange"
+                        :file-list="certificateFileList"
                        class="p-w-200"
                    >
                        <template #trigger>
@@ -49,13 +49,13 @@
                        </template>
                    </el-upload>
                </el-form-item>
-                <el-form-item :label="$t('website.certificate')" prop="certificateFile">
+                <el-form-item :label="$t('website.privateKey')" prop="privateKeyFile">
                    <el-upload
-                        ref="certificateUpload"
+                        ref="privateKeyUpload"
                        :auto-upload="false"
                        :limit="1"
-                        :on-change="handleCertificateChange"
-                        :file-list="certificateFileList"
+                        :on-change="handlePrivateKeyChange"
+                        :file-list="privateKeyFileList"
                        class="p-w-200"
                    >
                        <template #trigger>
Author	SHA1	Message	Date
guoyuqi	1fe78e4fe6	refactor: refactor website ssl delete text	2026-10-10 17:55:58 +08:00
Yuki Guo	8415a1ce28	refactor: refactor user info (#14021 )	2026-10-10 17:50:05 +08:00
Yuki Guo	faf4933a02	refactor: refactor website ssl keyType default value (#14023 )	2026-10-10 17:49:14 +08:00
Yuki Guo	c692a9f5e3	refactor: refactor website upload css (#14022 ) * refactor: refactor website upload css * refactor: refactor website upload css	2026-10-10 17:48:57 +08:00
CityFun	e7f0c21715	fix(vllm): resolve stuck startup state blocking operations (#14017 )	2026-10-10 11:13:17 +08:00
ssongliu	da7e8f1dbf	fix: Remove duplicate TaskScopeVm (#14020 )	2026-10-10 10:59:22 +08:00
Yuki Guoandssongliu	486cd5d0ad	feat(redis): enable remote terminal through tracked background tasks (#14012 ) * feat(redis): enable remote terminal through tracked background tasks * feat(redis): enable remote terminal through tracked background tasks * refactor(redis): remove redundant CLI status tracking * refactor(redis): retain existing task execution flow --------- Co-authored-by: ssongliu <sloooop1x@gmail.com>	2026-10-09 18:20:51 +08:00
ssongliu	00ce5a7b36	fix(firewall): preserve IPv6 RA protection and simplify error messages (#14015 )	2026-10-09 17:45:57 +08:00
ssongliu	c17f055e06	fix: preserve VM task timeout cleanup and terminate command groups (#14008 )	2026-10-09 17:45:41 +08:00
王贺	f22df4b29c	fix(file): stabilize closable tab width to avoid layout jitter (#14013 ) The closable card tabs animated the close icon width between active and inactive tabs, so each tab switch reflowed the tab bar and caused the page to jitter. Reserve the close icon slot and toggle it with opacity instead, matching the terminal tab implementation.	2026-10-09 17:16:10 +08:00
Yuki Guoandssongliu	b9bab90a14	fix: fix clean network (#14009 ) * fix: fix clean network * refactor(container): simplify network cleanup --------- Co-authored-by: ssongliu <sloooop1x@gmail.com>	2026-10-09 17:14:50 +08:00