feat(redis): enable remote terminal through tracked background tasks (#14012)

* feat(redis): enable remote terminal through tracked background tasks

* feat(redis): enable remote terminal through tracked background tasks

* refactor(redis): remove redundant CLI status tracking

* refactor(redis): retain existing task execution flow

---------

Co-authored-by: ssongliu <sloooop1x@gmail.com>

README.md

@@ -1,9 +1,6 @@
 <p align="center"><a href="https://1panel.pro"><img src="https://resource.1panel.pro/img/1panel-logo.png" alt="1Panel" width="300" /></a></p>
-
-<h3 align="center">The open-source VPS control panel with native AI agent support</h3>
-
 <p align="center">
-  Trusted by <strong>2,000,000+</strong> self-hosters worldwide
+  Loved by a global community of <strong>2.5M+</strong> self-hosters.
 </p>
 
 <p align="center">
@@ -12,7 +9,6 @@
 
 <p align="center">
   <a href="https://www.gnu.org/licenses/gpl-3.0.html"><img src="https://shields.io/github/license/1Panel-dev/1Panel?color=%231890FF" alt="License: GPL v3"></a>
-  <a href="https://app.codacy.com/gh/1Panel-dev/1Panel"><img src="https://app.codacy.com/project/badge/Grade/da67574fd82b473992781d1386b937ef" alt="Codacy"></a>
   <a href="https://discord.gg/bUpUqWqdRr"><img src="https://img.shields.io/discord/1318846410149335080?logo=discord&labelColor=%20%235462eb&logoColor=%20%23f5f5f5&color=%20%235462eb" alt="Discord"></a>
   <a href="https://github.com/1Panel-dev/1Panel/releases"><img src="https://img.shields.io/github/v/release/1Panel-dev/1Panel" alt="GitHub release"></a>
   <a href="https://github.com/1Panel-dev/1Panel"><img src="https://img.shields.io/github/stars/1Panel-dev/1Panel?color=%231890FF&style=flat-square" alt="Stars"></a>
@@ -41,34 +37,28 @@
 
 ## What is 1Panel?
 
-1Panel is a modern, open-source VPS control panel — and the only one with **native AI agent support**. Run Ollama models, deploy OpenClaw agents, and manage your entire server stack from one clean web interface. No CLI memorization required.
-
-👉 Watch the [2-minute introduction](https://www.youtube.com/watch?v=Jl_wqp-XA08)
+1Panel is a modern, open-source Linux server management panel and a lightweight AI management platform. Through an intuitive web interface, it provides users with comprehensive, one-stop server management capabilities:
+- **AI Management**: Offers a unified management platform from bare metal to agents (Metal-to-Agent). It integrates an AI gateway, and Skills Hub, while supporting centralized management of agents and models.
+- **Efficient Visual Operations**: Easily manage Linux servers through a web-based GUI, streamlining tasks such as host monitoring, file management, database management, and container management.
+- **Rapid Website Deployment**: Deeply integrates with popular website builders like WordPress and Halo. It enables one-click domain binding and SSL certificate configuration, significantly lowering the barrier to website creation.
+- **Curated App Store**: Features a built-in store of high-quality open-source applications, providing one-click installation and upgrade services to effortlessly extend server capabilities.
+- **Enterprise-Grade Security**: Deploys applications based on container technology to effectively minimize vulnerability exposure. It also provides security features such as WAF and log auditing to ensure comprehensive server protection.
+- **One-Click Data Backup**: Supports one-click backup and restoration, and integrates with various cloud storage solutions to ensure data security and prevent loss.
 
 ## Why 1Panel?
 
 | | 1Panel | cPanel / Plesk | aaPanel | Webmin |
 |--|--------|----------------|---------|--------|
 | Free & open source | ✅ | ❌ | Partial | ✅ |
-| Native AI agent runtime | ✅ | ❌ | ❌ | ❌ |
+| AI management | ✅ | ❌ | ❌ | ❌ |
 | One-click app marketplace | ✅ 165+ apps | ❌ | ✅ | ❌ |
 | Modern UI (post-2020) | ✅ | ❌ | Partial | ❌ |
 | Docker / container management | ✅ | ❌ | ❌ | ❌ |
 | Active development | ✅ | ✅ | ✅ | Slow |
 
-## Key Features
-
-- **AI Agent Runtime**: Deploy Ollama LLMs, spin up OpenClaw personal agents, and monitor GPU utilization — all from the dashboard. No separate AI stack to manage.
-- **One-Click Website Deployment**: Launch production-ready websites with automatic domain binding, SSL provisioning, and Nginx config — zero manual setup.
-- **App Marketplace**: 165+ trusted open-source apps (Nextcloud, Bitwarden, Umami, NocoBase, and more) installed and updated with a single click.
-- **Docker & Container Management**: Create, start, stop, and inspect containers, images, networks, and volumes through a visual UI — no CLI juggling.
-- **Security Out of the Box**: Firewall rules, fail2ban, container isolation, WAF, and audit logs — configured and running from day one.
-- **Backup & Restore**: Schedule automated backups to AWS S3, Cloudflare R2, or local storage. Restore any snapshot in one click.
-
 ## Quick Start
 
-> **Requirements:** Linux VPS (Debian / Ubuntu / CentOS / Rocky), 1 GB RAM, internet access.  
-> Takes ~60 seconds.
+Prepare your Linux server and run the following script:
 
 ```bash
 bash -c "$(curl -sSL https://resource.1panel.pro/v2/quick_start.sh)"
@@ -83,24 +73,20 @@ Run `1pctl user-info` via SSH if you need to retrieve your access credentials.
 
 ## Pro Edition
 
-1Panel OSS is free forever. Pro adds features built for teams and production workloads:
+1Panel OSS is free forever. 1Panel Pro and Ent adds features built for teams and production workloads:
 
-| Feature | OSS | Pro |
-|---------|:---:|:---:|
-| One-click app installs | ✅ | ✅ |
-| AI agents (OpenClaw) | 1 agent | Unlimited |
-| WAF & advanced security | Basic | ✅ |
-| Website tamper protection | ❌ | ✅ |
-| Website uptime monitoring | ❌ | ✅ |
-| Multi-node management | ❌ | ✅ |
-| Custom logo & theme | ❌ | ✅ |
-| Priority support | ❌ | ✅ |
-
-**From $80/year.** [Compare plans & start 30-day free trial →](https://1panel.pro/pricing)
-
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=1Panel-dev/1Panel&type=Date)](https://star-history.com/#1Panel-dev/1Panel&Date)
+| Feature | OSS | Pro | Ent |
+|---------|:---:|:---:|:---:|
+| One-click app installs | ✅ | ✅ | ✅ |
+| AI agents (OpenClaw) | 5 agent | Unlimited | ✅ |
+| WAF & advanced security | Basic | ✅ | ✅ |
+| Website tamper protection | ❌ | ✅ | ✅ |
+| Website uptime monitoring | ❌ | ✅ | ✅ |
+| Multi-node management | ❌ | ✅ | ✅ |
+| Custom logo & theme | ❌ | ✅ | ✅ |
+| KVM Web UI | ❌ | ❌ | ✅ |
+| AI Gateway | ❌ | ❌ | ✅ |
+| Priority support | ❌ | ❌ | ✅ |
 
 ## Community & Support
 

agent/app/api/v2/alert.go

@@ -2,11 +2,14 @@ package v2
 
 import (
 	"errors"
+	"net/http"
 	"net/url"
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/gin-gonic/gin"
 )
 
@@ -294,6 +297,34 @@ func (b *BaseApi) UpdateAlertConfig(c *gin.Context) {
 		return
 	}
 	if err := alertService.UpdateAlertConfig(req, loadAuditUser(c)); err != nil {
+		switch {
+		case errors.Is(err, repo.ErrAlertConfigRevisionConflict):
+			helper.ErrorWithBusinessCode(c, http.StatusConflict, "ALERT_CONFIG_REVISION_CONFLICT", "ErrInvalidParams", err)
+		case errors.Is(err, repo.ErrAlertConfigRevisionRequired):
+			helper.ErrorWithBusinessCode(c, http.StatusConflict, "ALERT_CONFIG_REVISION_REQUIRED", "ErrInvalidParams", err)
+		default:
+			helper.InternalServer(c, err)
+		}
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Alert
+// @Summary Update alert config status
+// @Accept json
+// @Param request body dto.AlertConfigStatusUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /alert/config/status [post]
+// @x-panel-log {"bodyKeys":["id","status"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新告警配置状态 [id][status]","formatEN":"update alert config status [id][status]"}
+func (b *BaseApi) UpdateAlertConfigStatus(c *gin.Context) {
+	var req dto.AlertConfigStatusUpdate
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := alertService.UpdateAlertConfigStatus(req, loadAuditUser(c)); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -346,6 +377,15 @@ func (b *BaseApi) TestAlertConfig(c *gin.Context) {
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
+	if req.Type == constant.Custom {
+		result, err := alertService.TestCustomAlertConfig(req)
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+		helper.SuccessWithData(c, result)
+		return
+	}
 	flag, err := alertService.TestAlertConfig(req)
 	if err != nil {
 		helper.InternalServer(c, err)

agent/app/api/v2/container.go

@@ -439,7 +439,7 @@ func (b *BaseApi) ContainerItemStats(c *gin.Context) {
 		return
 	}
 
-	data, err := containerService.ContainerItemStats(req)
+	data, err := containerService.ContainerItemStats(c.Request.Context(), req)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return

agent/app/api/v2/database_redis.go

@@ -86,17 +86,23 @@ func (b *BaseApi) CheckHasCli(c *gin.Context) {
 
 // @Tags Database Redis
 // @Summary Install redis-cli
-// @Success 200
+// @Accept json
+// @Param request body dto.RedisCliInstall true "request"
+// @Success 200 {string} string
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /databases/redis/install/cli [post]
 func (b *BaseApi) InstallCli(c *gin.Context) {
-	if err := redisService.InstallCli(); err != nil {
+	var req dto.RedisCliInstall
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := redisService.InstallCli(req)
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-
-	helper.Success(c)
+	helper.SuccessWithData(c, data)
 }
 
 // @Tags Database Redis

agent/app/api/v2/entry.go

@@ -42,8 +42,9 @@ var (
 	fileShareService          = service.NewIFileShareService()
 	sshService                = service.NewISSHService()
 	firewallService           = service.NewIFirewallService()
+	firewallSettingService    = service.NewIFirewallSettingService()
 	forwardingService         = service.NewIForwardingService()
-	iptablesService           = service.NewIIptablesService()
+	dockerPortGuardService    = service.NewIDockerPortGuardService()
 	monitorService            = service.NewIMonitorService()
 	systemService             = service.NewISystemService()
 	runtimeDiagnosticsService = service.NewIRuntimeDiagnosticsService()

agent/app/api/v2/file.go

@@ -35,6 +35,81 @@ var cancelledChunkUploads = struct {
 	ids map[string]struct{}
 }{ids: make(map[string]struct{})}
 
+type chunkUploadLock struct {
+	mutex sync.Mutex
+	refs  int
+}
+
+var chunkUploadLocks = struct {
+	sync.Mutex
+	items map[string]*chunkUploadLock
+}{items: make(map[string]*chunkUploadLock)}
+
+type completedChunkUpload struct {
+	dstDir   string
+	filename string
+	fileSize int64
+}
+
+var completedChunkUploads = struct {
+	sync.RWMutex
+	items map[string]completedChunkUpload
+}{items: make(map[string]completedChunkUpload)}
+
+var activeChunkUploadTTL = 24 * time.Hour
+
+var (
+	errChunkUploadCancelled = errors.New("upload cancelled")
+	errInvalidChunkUpload   = errors.New("invalid chunk upload")
+)
+
+type activeChunkUpload struct {
+	upload    completedChunkUpload
+	expiresAt time.Time
+	timer     *time.Timer
+}
+
+var activeChunkUploads = struct {
+	sync.RWMutex
+	items map[string]activeChunkUpload
+}{items: make(map[string]activeChunkUpload)}
+
+type resumableUploadChunk struct {
+	UploadID   string
+	Filename   string
+	DstDir     string
+	ChunkIndex int
+	ChunkCount int
+	Offset     int64
+	FileSize   int64
+	Overwrite  bool
+}
+
+func invalidChunkUploadError(message string) error {
+	return fmt.Errorf("%w: %s", errInvalidChunkUpload, message)
+}
+
+func isRetryableChunkUploadError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, errChunkUploadCancelled) ||
+		errors.Is(err, errInvalidChunkUpload) ||
+		errors.Is(err, os.ErrExist) ||
+		errors.Is(err, os.ErrPermission) ||
+		errors.Is(err, os.ErrInvalid) ||
+		errors.Is(err, syscall.ENOSPC) ||
+		errors.Is(err, syscall.EDQUOT) ||
+		errors.Is(err, syscall.EROFS) ||
+		errors.Is(err, syscall.EFBIG) ||
+		errors.Is(err, syscall.ENAMETOOLONG) ||
+		errors.Is(err, syscall.ENOTDIR) ||
+		errors.Is(err, syscall.EISDIR) {
+		return false
+	}
+	return true
+}
+
 // @Tags File
 // @Summary List files
 // @Accept json
@@ -474,11 +549,7 @@ func (b *BaseApi) UploadFiles(c *gin.Context) {
 			continue
 		}
 		dstInfo, statErr := os.Stat(dstFilename)
-		if overwrite {
-			_ = os.Remove(dstFilename)
-		}
-
-		err = os.Rename(tmpFilename, dstFilename)
+		err = finalizeUploadedFile(tmpFilename, dstFilename, overwrite)
 		if err != nil {
 			_ = os.Remove(tmpFilename)
 			e := fmt.Errorf("upload [%s] file failed, err: %v", file.Filename, err)
@@ -613,10 +684,35 @@ func (b *BaseApi) StopWget(c *gin.Context) {
 		return
 	}
 
-	files.CancelDownload(req.Key)
+	if err := files.CancelDownload(req.Key); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
 	helper.Success(c)
 }
 
+// @Tags File
+// @Summary Remove finished download progress records without deleting files
+// @Accept json
+// @Param request body request.FileProcessRemoveReq true "request"
+// @Success 200 {object} response.FileProcessKeys
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/wget/process/remove [post]
+// @x-panel-log {"bodyKeys":["keys"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"移除已结束下载记录 [keys]","formatEN":"Remove finished download records [keys]"}
+func (b *BaseApi) RemoveWgetRecords(c *gin.Context) {
+	var req request.FileProcessRemoveReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	keys, err := files.RemoveDownloadRecords(req.Keys)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.SuccessWithData(c, response.FileProcessKeys{Keys: keys})
+}
+
 // @Tags File
 // @Summary Move file
 // @Accept json
@@ -638,6 +734,26 @@ func (b *BaseApi) MoveFile(c *gin.Context) {
 	helper.Success(c)
 }
 
+// @Tags File
+// @Summary Stop file move task
+// @Accept json
+// @Param request body request.FileMoveStopReq true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /files/move/stop [post]
+func (b *BaseApi) StopMoveFile(c *gin.Context) {
+	var req request.FileMoveStopReq
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := fileService.StopMvFile(req.TaskID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags File
 // @Summary Download file
 // @Accept json
@@ -792,6 +908,289 @@ func (b *BaseApi) DepthDirSize(c *gin.Context) {
 	helper.SuccessWithData(c, res)
 }
 
+func lockChunkUpload(uploadID string) func() {
+	chunkUploadLocks.Lock()
+	lock, ok := chunkUploadLocks.items[uploadID]
+	if !ok {
+		lock = &chunkUploadLock{}
+		chunkUploadLocks.items[uploadID] = lock
+	}
+	lock.refs++
+	chunkUploadLocks.Unlock()
+
+	lock.mutex.Lock()
+	return func() {
+		lock.mutex.Unlock()
+		chunkUploadLocks.Lock()
+		lock.refs--
+		if lock.refs == 0 {
+			delete(chunkUploadLocks.items, uploadID)
+		}
+		chunkUploadLocks.Unlock()
+	}
+}
+
+func resumableUploadPartPath(dstDir, uploadID string) string {
+	return filepath.Join(dstDir, fmt.Sprintf(".1panel-upload-%s.part", uploadID))
+}
+
+func finalizeUploadedFile(tmpFile, dstFile string, overwrite bool) error {
+	if overwrite {
+		return os.Rename(tmpFile, dstFile)
+	}
+	if err := os.Link(tmpFile, dstFile); err != nil {
+		return err
+	}
+	if err := os.Remove(tmpFile); err != nil {
+		if rollbackErr := os.Remove(dstFile); rollbackErr != nil {
+			return fmt.Errorf("remove upload temporary file failed: %v, rollback destination failed: %w", err, rollbackErr)
+		}
+		return err
+	}
+	return nil
+}
+
+func registerActiveChunkUpload(uploadID string, upload completedChunkUpload) error {
+	activeChunkUploads.Lock()
+	defer activeChunkUploads.Unlock()
+	if active, ok := activeChunkUploads.items[uploadID]; ok {
+		if active.upload != upload {
+			return invalidChunkUploadError("upload ID is already used by another file")
+		}
+		active.timer.Stop()
+	}
+	expiresAt := time.Now().Add(activeChunkUploadTTL)
+	timer := time.AfterFunc(activeChunkUploadTTL, func() {
+		expireActiveChunkUpload(uploadID, expiresAt)
+	})
+	activeChunkUploads.items[uploadID] = activeChunkUpload{
+		upload:    upload,
+		expiresAt: expiresAt,
+		timer:     timer,
+	}
+	return nil
+}
+
+func loadActiveChunkUpload(uploadID string) (completedChunkUpload, bool) {
+	activeChunkUploads.RLock()
+	active, ok := activeChunkUploads.items[uploadID]
+	activeChunkUploads.RUnlock()
+	return active.upload, ok
+}
+
+func deleteActiveChunkUpload(uploadID string) {
+	activeChunkUploads.Lock()
+	if active, ok := activeChunkUploads.items[uploadID]; ok {
+		active.timer.Stop()
+	}
+	delete(activeChunkUploads.items, uploadID)
+	activeChunkUploads.Unlock()
+}
+
+func discardActiveChunkUpload(uploadID, partFile string) error {
+	deleteActiveChunkUpload(uploadID)
+	if err := os.Remove(partFile); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove upload temporary file failed: %w", err)
+	}
+	return nil
+}
+
+func finalizeActiveChunkUpload(uploadID, partFile, dstFile string, overwrite bool) error {
+	if err := finalizeUploadedFile(partFile, dstFile, overwrite); err != nil {
+		if removeErr := discardActiveChunkUpload(uploadID, partFile); removeErr != nil {
+			return errors.Join(err, removeErr)
+		}
+		return err
+	}
+	return nil
+}
+
+func expireActiveChunkUpload(uploadID string, expiresAt time.Time) {
+	unlock := lockChunkUpload(uploadID)
+	defer unlock()
+	activeChunkUploads.Lock()
+	active, ok := activeChunkUploads.items[uploadID]
+	if !ok || !active.expiresAt.Equal(expiresAt) {
+		activeChunkUploads.Unlock()
+		return
+	}
+	delete(activeChunkUploads.items, uploadID)
+	activeChunkUploads.Unlock()
+	partFile := resumableUploadPartPath(active.upload.dstDir, uploadID)
+	if err := os.Remove(partFile); err != nil && !os.IsNotExist(err) {
+		global.LOG.Warnf("remove inactive upload part [%s] failed: %v", partFile, err)
+	}
+}
+
+func removeActiveResumableUploadPart(uploadID string) error {
+	unlock := lockChunkUpload(uploadID)
+	defer unlock()
+	upload, ok := loadActiveChunkUpload(uploadID)
+	if !ok {
+		return nil
+	}
+	err := os.Remove(resumableUploadPartPath(upload.dstDir, uploadID))
+	if err == nil || os.IsNotExist(err) {
+		deleteActiveChunkUpload(uploadID)
+		return nil
+	}
+	return err
+}
+
+func loadCompletedChunkUpload(uploadID string) (completedChunkUpload, bool) {
+	completedChunkUploads.RLock()
+	completed, ok := completedChunkUploads.items[uploadID]
+	completedChunkUploads.RUnlock()
+	return completed, ok
+}
+
+func markChunkUploadCompleted(uploadID string, completed completedChunkUpload) {
+	completedChunkUploads.Lock()
+	completedChunkUploads.items[uploadID] = completed
+	completedChunkUploads.Unlock()
+	time.AfterFunc(10*time.Minute, func() {
+		completedChunkUploads.Lock()
+		delete(completedChunkUploads.items, uploadID)
+		completedChunkUploads.Unlock()
+	})
+}
+
+func writeResumableUploadChunk(chunk resumableUploadChunk, chunkData []byte) error {
+	unlock := lockChunkUpload(chunk.UploadID)
+	defer unlock()
+	if chunkUploadCancelled(chunk.UploadID) {
+		return errChunkUploadCancelled
+	}
+	if chunk.UploadID == "" || filepath.Base(chunk.UploadID) != chunk.UploadID || strings.ContainsAny(chunk.UploadID, `/\`) {
+		return invalidChunkUploadError("invalid upload ID")
+	}
+	if chunk.Filename == "" || filepath.Base(chunk.Filename) != chunk.Filename || strings.ContainsAny(chunk.Filename, `/\`) {
+		return invalidChunkUploadError("invalid filename")
+	}
+	if strings.TrimSpace(chunk.DstDir) == "" {
+		return invalidChunkUploadError("upload destination is required")
+	}
+	dstDir := filepath.Clean(strings.TrimSpace(chunk.DstDir))
+
+	if chunk.ChunkCount <= 0 || chunk.ChunkIndex < 0 || chunk.ChunkIndex >= chunk.ChunkCount {
+		return invalidChunkUploadError("invalid chunk index")
+	}
+	if chunk.FileSize <= 0 || chunk.Offset < 0 || chunk.Offset > chunk.FileSize {
+		return invalidChunkUploadError("invalid upload offset")
+	}
+	chunkEnd := chunk.Offset + int64(len(chunkData))
+	if chunkEnd > chunk.FileSize {
+		return invalidChunkUploadError("chunk exceeds file size")
+	}
+	if chunk.ChunkIndex+1 == chunk.ChunkCount {
+		if chunkEnd != chunk.FileSize {
+			return invalidChunkUploadError("final chunk does not match file size")
+		}
+	} else if chunkEnd >= chunk.FileSize {
+		return invalidChunkUploadError("non-final chunk reaches file size")
+	}
+	if completed, ok := loadCompletedChunkUpload(chunk.UploadID); ok {
+		if completed.dstDir == dstDir && completed.filename == chunk.Filename && completed.fileSize == chunk.FileSize {
+			return nil
+		}
+		return invalidChunkUploadError("upload ID has already completed another file")
+	}
+	upload := completedChunkUpload{dstDir: dstDir, filename: chunk.Filename, fileSize: chunk.FileSize}
+	if err := registerActiveChunkUpload(chunk.UploadID, upload); err != nil {
+		return err
+	}
+
+	mode, err := files.GetParentMode(dstDir)
+	if err != nil {
+		return err
+	}
+	if err = os.MkdirAll(dstDir, mode); err != nil {
+		return err
+	}
+	dstDirInfo, err := os.Stat(dstDir)
+	if err != nil {
+		return err
+	}
+	if !dstDirInfo.IsDir() {
+		return invalidChunkUploadError(fmt.Sprintf("upload destination [%s] is not a directory", dstDir))
+	}
+
+	dstFile := filepath.Join(dstDir, chunk.Filename)
+	partFile := resumableUploadPartPath(dstDir, chunk.UploadID)
+	if dstFile == partFile {
+		return invalidChunkUploadError("filename conflicts with upload temporary file")
+	}
+	fileMode := dstDirInfo.Mode().Perm()
+	ownerInfo := dstDirInfo
+	if dstInfo, statErr := os.Stat(dstFile); statErr == nil {
+		if !chunk.Overwrite {
+			if err := discardActiveChunkUpload(chunk.UploadID, partFile); err != nil {
+				return errors.Join(os.ErrExist, err)
+			}
+			return os.ErrExist
+		}
+		fileMode = dstInfo.Mode().Perm()
+		ownerInfo = dstInfo
+	} else if !os.IsNotExist(statErr) {
+		return statErr
+	}
+
+	part, err := os.OpenFile(partFile, os.O_CREATE|os.O_RDWR, fileMode)
+	if err != nil {
+		return err
+	}
+	partClosed := false
+	defer func() {
+		if !partClosed {
+			_ = part.Close()
+		}
+	}()
+	if stat, statErr := part.Stat(); statErr != nil {
+		return statErr
+	} else if chunk.Offset > stat.Size() {
+		return invalidChunkUploadError(fmt.Sprintf("unexpected upload offset %d, current size is %d", chunk.Offset, stat.Size()))
+	} else if chunk.Offset < stat.Size() && chunkEnd > stat.Size() {
+		if err = part.Truncate(chunk.Offset); err != nil {
+			return err
+		}
+	}
+	if _, err = part.WriteAt(chunkData, chunk.Offset); err != nil {
+		return err
+	}
+
+	if chunk.ChunkIndex+1 != chunk.ChunkCount {
+		return nil
+	}
+	partInfo, err := part.Stat()
+	if err != nil {
+		return err
+	}
+	if partInfo.Size() != chunk.FileSize {
+		return invalidChunkUploadError(fmt.Sprintf("uploaded file size mismatch: expected %d, got %d", chunk.FileSize, partInfo.Size()))
+	}
+	if err = part.Close(); err != nil {
+		return err
+	}
+	partClosed = true
+	if err = os.Chmod(partFile, fileMode); err != nil {
+		return err
+	}
+	if stat, ok := ownerInfo.Sys().(*syscall.Stat_t); ok {
+		if err = os.Chown(partFile, int(stat.Uid), int(stat.Gid)); err != nil {
+			return err
+		}
+	}
+	if chunkUploadCancelled(chunk.UploadID) {
+		return errChunkUploadCancelled
+	}
+	if err = finalizeActiveChunkUpload(chunk.UploadID, partFile, dstFile, chunk.Overwrite); err != nil {
+		return err
+	}
+	markChunkUploadCompleted(chunk.UploadID, upload)
+	deleteActiveChunkUpload(chunk.UploadID)
+	return nil
+}
+
 func mergeChunks(fileName string, fileDir string, dstDir string, chunkCount int, overwrite bool) error {
 	defer func() {
 		_ = os.RemoveAll(fileDir)
@@ -871,6 +1270,10 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 		helper.BadRequest(c, err)
 		return
 	}
+	if chunkCount <= 0 || chunkIndex < 0 || chunkIndex >= chunkCount {
+		helper.BadRequest(c, errors.New("invalid chunk index"))
+		return
+	}
 	fileOp := files.NewFileOp()
 	tmpDir := path.Join(global.Dir.TmpDir, "upload")
 	if !fileOp.Stat(tmpDir) {
@@ -885,20 +1288,25 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 		return
 	}
 	uploadID := strings.TrimSpace(c.PostForm("uploadID"))
+	resumable := c.PostForm("fileSize") != "" || c.PostForm("offset") != ""
 	cancellable := uploadID != ""
 	if cancellable && (filepath.Base(uploadID) != uploadID || strings.ContainsAny(uploadID, `/\\`)) {
 		helper.BadRequest(c, errors.New("invalid upload ID"))
 		return
 	}
+	if resumable && !cancellable {
+		helper.BadRequest(c, errors.New("upload ID is required"))
+		return
+	}
 	if !cancellable {
 		uploadID = filename
 	}
 	fileDir := filepath.Join(tmpDir, uploadID)
 	if cancellable && chunkUploadCancelled(uploadID) {
-		helper.BadRequest(c, errors.New("upload cancelled"))
+		helper.BadRequest(c, errChunkUploadCancelled)
 		return
 	}
-	if chunkIndex == 0 {
+	if !resumable && chunkIndex == 0 {
 		if fileOp.Stat(fileDir) {
 			_ = fileOp.DeleteDir(fileDir)
 		}
@@ -907,32 +1315,67 @@ func (b *BaseApi) UploadChunkFiles(c *gin.Context) {
 	filePath := filepath.Join(fileDir, filename)
 
 	defer func() {
-		if err != nil {
+		if !resumable && err != nil {
 			_ = os.RemoveAll(fileDir)
 		}
 	}()
-	var (
-		emptyFile *os.File
-		chunkData []byte
-	)
-
-	emptyFile, err = os.Create(filePath)
-	if err != nil {
-		helper.BadRequest(c, err)
-		return
-	}
-	defer emptyFile.Close()
-
-	chunkData, err = io.ReadAll(uploadFile)
+	chunkData, err := io.ReadAll(uploadFile)
 	if err != nil {
 		helper.InternalServer(c, buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err))
 		return
 	}
 	if cancellable && chunkUploadCancelled(uploadID) {
-		err = errors.New("upload cancelled")
+		err = errChunkUploadCancelled
 		helper.BadRequest(c, err)
 		return
 	}
+	if resumable {
+		offset, parseErr := strconv.ParseInt(c.PostForm("offset"), 10, 64)
+		if parseErr != nil {
+			helper.BadRequest(c, parseErr)
+			return
+		}
+		fileSize, parseErr := strconv.ParseInt(c.PostForm("fileSize"), 10, 64)
+		if parseErr != nil {
+			helper.BadRequest(c, parseErr)
+			return
+		}
+		overwrite := true
+		if ow := c.PostForm("overwrite"); ow != "" {
+			overwrite, _ = strconv.ParseBool(ow)
+		}
+		err = writeResumableUploadChunk(resumableUploadChunk{
+			UploadID:   uploadID,
+			Filename:   filename,
+			DstDir:     c.PostForm("path"),
+			ChunkIndex: chunkIndex,
+			ChunkCount: chunkCount,
+			Offset:     offset,
+			FileSize:   fileSize,
+			Overwrite:  overwrite,
+		}, chunkData)
+		if err != nil {
+			uploadErr := buserr.WithMap("ErrFileUpload", map[string]interface{}{"name": filename, "detail": err.Error()}, err)
+			helper.ErrorWithDetailAndData(c, http.StatusInternalServerError, "ErrInternalServer", uploadErr, gin.H{
+				"retryable": isRetryableChunkUploadError(err),
+			})
+			return
+		}
+		if chunkIndex+1 == chunkCount {
+			cancelledChunkUploads.Lock()
+			delete(cancelledChunkUploads.ids, uploadID)
+			cancelledChunkUploads.Unlock()
+		}
+		helper.SuccessWithData(c, true)
+		return
+	}
+
+	emptyFile, err := os.Create(filePath)
+	if err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	defer emptyFile.Close()
 
 	chunkPath := filepath.Join(fileDir, fmt.Sprintf("%s.%d", filename, chunkIndex))
 	err = os.WriteFile(chunkPath, chunkData, constant.DirPerm)
@@ -985,6 +1428,10 @@ func (b *BaseApi) StopChunkUpload(c *gin.Context) {
 		helper.InternalServer(c, err)
 		return
 	}
+	if err := removeActiveResumableUploadPart(uploadID); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
 	helper.Success(c)
 }
 

agent/app/api/v2/firewall.go

@@ -1,34 +1,53 @@
 package v2
 
 import (
+	"errors"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"net/http"
+
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
 	"github.com/gin-gonic/gin"
 )
 
+func (b *BaseApi) UpdatePanelFirewallPort(c *gin.Context) {
+	if !global.IsMaster {
+		c.AbortWithStatus(http.StatusForbidden)
+		return
+	}
+	var request struct {
+		OldPort uint `json:"oldPort" validate:"required,min=1,max=65535"`
+		NewPort uint `json:"newPort" validate:"required,min=1,max=65535"`
+	}
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallService.UpdatePanelPort(c.Request.Context(), request.OldPort, request.NewPort); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags Firewall
 // @Summary Load firewall base info
 // @Accept json
 // @Param request body dto.OperationWithName true "request"
-// @Success 200 {object} dto.FirewallBaseInfo
+// @Success 200 {object} dto.FirewallSubsystemStatus
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/firewall/base [post]
 func (b *BaseApi) LoadFirewallBaseInfo(c *gin.Context) {
-	var req dto.OperationWithName
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+	var request dto.OperationWithName
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
 
-	var (
-		data dto.FirewallBaseInfo
-		err  error
-	)
-	if req.Name == "forward" {
-		data, err = forwardingService.LoadBaseInfo()
-	} else {
-		data, err = firewallService.LoadBaseInfo(req.Name)
-	}
+	data, err := firewallService.LoadBaseInfo(request.Name)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
@@ -37,331 +56,625 @@ func (b *BaseApi) LoadFirewallBaseInfo(c *gin.Context) {
 	helper.SuccessWithData(c, data)
 }
 
-// @Tags Firewall
-// @Summary Page firewall rules
-// @Accept json
-// @Param request body dto.RuleSearch true "request"
-// @Success 200 {object} dto.PageResult
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/search [post]
-func (b *BaseApi) SearchFirewallRule(c *gin.Context) {
-	var req dto.RuleSearch
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	var (
-		total int64
-		list  interface{}
-		err   error
-	)
-	if req.Type == "forward" {
-		total, list, err = forwardingService.SearchWithPage(dto.ForwardRuleSearch{
-			PageInfo: req.PageInfo,
-			Info:     req.Info,
-			Status:   req.Status,
-			Strategy: req.Strategy,
-		})
-	} else {
-		total, list, err = firewallService.SearchWithPage(req)
-	}
-	if err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-
-	helper.SuccessWithData(c, dto.PageResult{
-		Items: list,
-		Total: total,
-	})
-}
-
 // @Tags Firewall
 // @Summary Operate firewall
 // @Accept json
-// @Param request body dto.FirewallOperation true "request"
-// @Success 200
+// @Param request body dto.FirewallLifecycleOperation true "request"
+// @Success 200 {object} dto.FirewallLifecycleOperationResponse
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/firewall/operate [post]
 // @x-panel-log {"bodyKeys":["operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] 防火墙","formatEN":"[operation] firewall"}
 func (b *BaseApi) OperateFirewall(c *gin.Context) {
-	var req dto.FirewallOperation
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+	var request dto.FirewallLifecycleOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
 
-	if err := firewallService.OperateFirewall(req); err != nil {
+	result, err := firewallService.QueueFirewallOperation(request)
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
 
-	helper.Success(c)
+	helper.SuccessWithData(c, result)
 }
 
 // @Tags Firewall
-// @Summary Create group
+// @Summary Load forwarding base info
 // @Accept json
-// @Param request body dto.PortRuleOperate true "request"
-// @Success 200
+// @Success 200 {object} dto.FirewallSubsystemStatus
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/port [post]
-// @x-panel-log {"bodyKeys":["port","strategy"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"添加端口规则 [strategy] [port]","formatEN":"create port rules [strategy][port]"}
-func (b *BaseApi) OperatePortRule(c *gin.Context) {
-	var req dto.PortRuleOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.OperatePortRule(req, true); err != nil {
+// @Router /hosts/firewall/forward/base [post]
+func (b *BaseApi) LoadForwardingBaseInfo(c *gin.Context) {
+	data, err := forwardingService.LoadBaseInfo(c.Request.Context())
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-	helper.Success(c)
-}
-
-// OperateForwardRule
-// @Tags Firewall
-// @Summary Operate forward rule
-// @Accept json
-// @Param request body dto.ForwardRuleOperate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/forward [post]
-// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新端口转发规则","formatEN":"update port forward rules"}
-func (b *BaseApi) OperateForwardRule(c *gin.Context) {
-	var req dto.ForwardRuleOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := forwardingService.Operate(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
+	helper.SuccessWithData(c, data)
 }
 
 // @Tags Firewall
-// @Summary Operate Ip rule
+// @Summary Page forwarding rules
 // @Accept json
-// @Param request body dto.AddrRuleOperate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/ip [post]
-// @x-panel-log {"bodyKeys":["strategy","address"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"添加 ip 规则 [strategy] [address]","formatEN":"create address rules [strategy][address]"}
-func (b *BaseApi) OperateIPRule(c *gin.Context) {
-	var req dto.AddrRuleOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.OperateAddressRule(req, true); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary Batch operate rule
-// @Accept json
-// @Param request body dto.BatchRuleOperate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/batch [post]
-func (b *BaseApi) BatchOperateRule(c *gin.Context) {
-	var req dto.BatchRuleOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.BatchOperateRule(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary Update rule description
-// @Accept json
-// @Param request body dto.UpdateFirewallDescription true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/update/description [post]
-func (b *BaseApi) UpdateFirewallDescription(c *gin.Context) {
-	var req dto.UpdateFirewallDescription
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.UpdateDescription(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary Update port rule
-// @Accept json
-// @Param request body dto.PortRuleUpdate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/update/port [post]
-func (b *BaseApi) UpdatePortRule(c *gin.Context) {
-	var req dto.PortRuleUpdate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.UpdatePortRule(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary Update Ip rule
-// @Accept json
-// @Param request body dto.AddrRuleUpdate true "request"
-// @Success 200
-// @Security ApiKeyAuth
-// @Security Timestamp
-// @Router /hosts/firewall/update/addr [post]
-func (b *BaseApi) UpdateAddrRule(c *gin.Context) {
-	var req dto.AddrRuleUpdate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
-		return
-	}
-
-	if err := firewallService.UpdateAddrRule(req); err != nil {
-		helper.InternalServer(c, err)
-		return
-	}
-	helper.Success(c)
-}
-
-// @Tags Firewall
-// @Summary search iptables filter rules
-// @Accept json
-// @Param request body dto.SearchPageWithType true "request"
+// @Param request body dto.ForwardRuleSearch true "request"
 // @Success 200 {object} dto.PageResult
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/filter/rule/search [post]
-func (b *BaseApi) SearchFilterRules(c *gin.Context) {
-	var req dto.SearchPageWithType
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+// @Router /hosts/firewall/forward/search [post]
+func (b *BaseApi) SearchForwardingRules(c *gin.Context) {
+	var request dto.ForwardRuleSearch
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
-
-	total, list, err := iptablesService.Search(req)
+	total, items, err := forwardingService.SearchRules(c.Request.Context(), request)
 	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
 
-	helper.SuccessWithData(c, dto.PageResult{
-		Items: list,
-		Total: total,
-	})
+	helper.SuccessWithData(c, dto.PageResult{Items: items, Total: total})
 }
 
 // @Tags Firewall
-// @Summary Operate iptables filter rule
+// @Summary Operate forwarding rules
 // @Accept json
-// @Param request body dto.IptablesRuleOp true "request"
-// @Success 200
+// @Param request body dto.ForwardRuleOperate true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/filter/rule/operate [post]
-// @x-panel-log {"bodyKeys":["operation","chain"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] filter规则到 [chain]","formatEN":"[operation] filter rule to [chain]"}
-func (b *BaseApi) OperateFilterRule(c *gin.Context) {
-	var req dto.IptablesRuleOp
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+// @Router /hosts/firewall/forward/operate [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新端口转发规则","formatEN":"update port forward rules"}
+func (b *BaseApi) OperateForwardingRules(c *gin.Context) {
+	var request dto.ForwardRuleOperate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
-	if err := iptablesService.OperateRule(req, true); err != nil {
+
+	result, err := forwardingService.OperateRules(request)
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-
-	helper.Success(c)
+	helper.SuccessWithData(c, result)
 }
 
 // @Tags Firewall
-// @Summary Batch operate iptables filter rules
+// @Summary Enable forwarding
 // @Accept json
-// @Param request body dto.IptablesBatchOperate true "request"
-// @Success 200
+// @Param request body dto.FirewallInitializationTask true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/filter/rule/batch [post]
-func (b *BaseApi) BatchOperateFilterRule(c *gin.Context) {
-	var req dto.IptablesBatchOperate
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+// @Router /hosts/firewall/forward/enable [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"初始化并启用端口转发","formatEN":"initialize and enable port forwarding"}
+func (b *BaseApi) EnableForwarding(c *gin.Context) {
+	var request dto.FirewallInitializationTask
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
-
-	if err := iptablesService.BatchOperate(req); err != nil {
+	result, err := forwardingService.QueueInitialization(request)
+	if err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
-
-	helper.Success(c)
+	helper.SuccessWithData(c, result)
 }
 
 // @Tags Firewall
-// @Summary Apply/Unload/Init iptables filter
+// @Summary Apply/Unload/Init firewall filter chain
 // @Accept json
-// @Param request body dto.IptablesOp true "request"
-// @Success 200
+// @Param request body dto.FilterChainOperation true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/firewall/filter/operate [post]
-// @x-panel-log {"bodyKeys":["operate"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operate] iptables filter 防火墙","formatEN":"[operate] iptables filter firewall"}
+// @x-panel-log {"bodyKeys":["operate"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operate] 防火墙过滤链","formatEN":"[operate] firewall filter chain"}
 func (b *BaseApi) OperateFilterChain(c *gin.Context) {
-	var req dto.IptablesOp
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+	var request dto.FilterChainOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
-	var err error
-	if req.Operate == "init-forward" {
-		err = forwardingService.Enable()
-	} else {
-		err = iptablesService.Operate(req)
+	if request.Operate == "init-base" {
+		result, err := firewallService.QueueFilterChainInitialization(request)
+		if err != nil {
+			helper.InternalServer(c, err)
+			return
+		}
+		helper.SuccessWithData(c, result)
+		return
 	}
-	if err != nil {
+	if err := firewallService.OperateFilterChain(request); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
+	helper.SuccessWithData(c, dto.FilterChainOperationResponse{})
+}
 
+// @Tags Firewall
+// @Summary List unified firewall v2 rules
+// @Accept json
+// @Param request body dto.FirewallRuleInventory true "request"
+// @Success 200 {object} dto.FirewallRuleInventoryResponse
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/search [post]
+func (b *BaseApi) SearchFirewallRules(c *gin.Context) {
+	var request dto.FirewallRuleInventory
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	inventory, err := firewallService.Inventory(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, inventory)
+}
+
+// @Tags Firewall
+// @Summary Reset firewall rules
+// @Accept json
+// @Param request body dto.FirewallRuleReset true "request"
+// @Success 200 {object} dto.FirewallRuleResetResponse
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/reset [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"重置防火墙规则","formatEN":"reset firewall rules"}
+func (b *BaseApi) ResetFirewallRules(c *gin.Context) {
+	var request dto.FirewallRuleReset
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallService.Reset(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Load one provider-native firewall object definition
+// @Accept json
+// @Param request body dto.FirewallNativeDetail true "request"
+// @Success 200 {string} string
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/native/detail [post]
+func (b *BaseApi) LoadFirewallNativeDetail(c *gin.Context) {
+	var request dto.FirewallNativeDetail
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	info, err := firewallService.LoadFirewallNativeDetail(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, info)
+}
+
+// @Tags Firewall
+// @Summary Queue firewall rule creation
+// @Description Creation and import return a taskID immediately; validation and execution results are written to the task log.
+// @Accept json
+// @Param request body dto.FirewallRuleCreate true "request"
+// @Success 200 {object} dto.FirewallRuleCreateResponse
+// @Failure 400 {object} dto.Response
+// @Failure 409 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"添加防火墙规则","formatEN":"create firewall rules"}
+func (b *BaseApi) CreateFirewallRules(c *gin.Context) {
+	var request dto.FirewallRuleCreate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallService.Create(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Queue firewall rule deletion
+// @Description Deletes non-whitelist rules by scope and instance key. Returns a taskID immediately; results are written to the task log.
+// @Accept json
+// @Param request body dto.FirewallRuleDelete true "request"
+// @Success 200 {object} dto.FirewallRuleDeleteResponse
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/delete [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除防火墙规则","formatEN":"delete firewall rules"}
+func (b *BaseApi) DeleteFirewallRules(c *gin.Context) {
+	var request dto.FirewallRuleDelete
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallService.Delete(c.Request.Context(), request)
+	if err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Update a firewall rule
+// @Accept json
+// @Param request body dto.FirewallRuleUpdate true "request"
+// @Success 200
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/update [post]
+// @x-panel-log {"bodyKeys":["instanceKey"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"更新防火墙规则 [instanceKey]","formatEN":"update firewall rule [instanceKey]"}
+func (b *BaseApi) UpdateFirewallRule(c *gin.Context) {
+	var request dto.FirewallRuleUpdate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallService.Update(c.Request.Context(), request); err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
 	helper.Success(c)
 }
 
 // @Tags Firewall
-// @Summary load chain status with name
+// @Summary Reorder a firewall rule
 // @Accept json
-// @Param request body dto.OperationWithName true "request"
+// @Param request body dto.FirewallRuleReorder true "request"
+// @Success 200
+// @Failure 400 {object} dto.Response
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/reorder [post]
+// @x-panel-log {"bodyKeys":["instanceKey"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"调整防火墙规则顺序 [instanceKey]","formatEN":"reorder firewall rule [instanceKey]"}
+func (b *BaseApi) ReorderFirewallRule(c *gin.Context) {
+	var request dto.FirewallRuleReorder
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallService.Reorder(c.Request.Context(), request); err != nil {
+		handleFirewallRuleError(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+func handleFirewallRuleError(c *gin.Context, err error) {
+	var businessErr buserr.BusinessError
+	isBusinessError := errors.As(err, &businessErr)
+	switch {
+	case errors.Is(err, filter.ErrProtectedRule):
+		helper.ErrorWithBusinessCode(c, http.StatusBadRequest, "FW_LOCKOUT_RISK", "ErrInvalidParams", err)
+	case errors.Is(err, filter.ErrRuleStale):
+		helper.ErrorWithBusinessCode(c, http.StatusConflict, "FW_RULE_STALE", "ErrInvalidParams", err)
+	case errors.Is(err, filter.ErrUnsupportedScope), errors.Is(err, filter.ErrInvalidScope),
+		errors.Is(err, filter.ErrProviderUnavailable), errors.Is(err, filter.ErrAdapterUnavailable):
+		helper.ErrorWithBusinessCode(c, http.StatusBadRequest, "FW_SCOPE_UNSUPPORTED", "ErrInvalidParams", err)
+	case errors.Is(err, filter.ErrInvalidRule), errors.Is(err, filter.ErrRuleOperation):
+		helper.ErrorWithBusinessCode(c, http.StatusBadRequest, "FW_RULE_UNSUPPORTED", "ErrInvalidParams", err)
+	case isBusinessError && businessErr.Msg == "ErrRecordExist":
+		c.JSON(http.StatusOK, dto.Response{Code: http.StatusConflict, ErrorCode: "FW_RULE_DUPLICATE", Message: err.Error()})
+		c.Abort()
+	case isBusinessError && businessErr.Msg == "ErrFirewallRuleConflict":
+		c.JSON(http.StatusOK, dto.Response{Code: http.StatusConflict, ErrorCode: "FW_RULE_CONFLICT", Message: err.Error()})
+		c.Abort()
+	case isBusinessError && businessErr.Msg == "ErrInvalidParams":
+		c.JSON(http.StatusOK, dto.Response{Code: http.StatusBadRequest, ErrorCode: "FW_RULE_UNSUPPORTED", Message: err.Error()})
+		c.Abort()
+	default:
+		helper.ErrorWithBusinessCode(c, http.StatusInternalServerError, "FW_APPLY_FAILED", "ErrInternalServer", err)
+	}
+}
+
+// @Tags Firewall
+// @Summary Load firewall settings
+// @Success 200 {object} dto.FirewallSettings
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings [get]
+func (b *BaseApi) LoadFirewallSettings(c *gin.Context) {
+	data, err := firewallSettingService.Load(c.Request.Context())
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Firewall
+// @Summary Create firewall port whitelist rules
+// @Description Saves whitelist configuration and applies missing allowances; existing rules are not removed.
+// @Accept json
+// @Param request body dto.FirewallPortWhitelistCreate true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
-// @Router /hosts/firewall/filter/chain/status [post]
-func (b *BaseApi) LoadChainStatus(c *gin.Context) {
-	var req dto.OperationWithName
-	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+// @Router /hosts/firewall/settings/whitelist [post]
+// @x-panel-log {"bodyKeys":["rule"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"创建防火墙端口白名单","formatEN":"create firewall port whitelist"}
+func (b *BaseApi) CreateFirewallPortWhitelist(c *gin.Context) {
+	var request dto.FirewallPortWhitelistCreate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
 		return
 	}
+	if err := firewallSettingService.CreatePortWhitelist(c.Request.Context(), request); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
 
-	helper.SuccessWithData(c, iptablesService.LoadChainStatus(req))
+// @Tags Firewall
+// @Summary Update firewall port whitelist rules
+// @Description Saves whitelist configuration and applies missing allowances; existing rules are not removed.
+// @Accept json
+// @Param request body dto.FirewallPortWhitelistUpdate true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings/whitelist/update [post]
+// @x-panel-log {"bodyKeys":["oldRule","rule"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"编辑防火墙端口白名单","formatEN":"update firewall port whitelist"}
+func (b *BaseApi) UpdateFirewallPortWhitelist(c *gin.Context) {
+	var request dto.FirewallPortWhitelistUpdate
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallSettingService.UpdatePortWhitelist(c.Request.Context(), request); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Firewall
+// @Summary Delete firewall port whitelist rules
+// @Description Removes whitelist configuration; existing firewall rules are not removed.
+// @Accept json
+// @Param request body dto.FirewallPortWhitelistDelete true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings/whitelist/delete [post]
+// @x-panel-log {"bodyKeys":["rules"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除防火墙端口白名单","formatEN":"delete firewall port whitelist"}
+func (b *BaseApi) DeleteFirewallPortWhitelist(c *gin.Context) {
+	var request dto.FirewallPortWhitelistDelete
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallSettingService.DeletePortWhitelist(c.Request.Context(), request); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Firewall
+// @Summary Operate firewall backend
+// @Accept json
+// @Param request body dto.FirewallBackendOperation true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings/operate [post]
+// @x-panel-log {"bodyKeys":["subsystem","backend","operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"防火墙子系统 [subsystem] 后端 [operation] [backend]","formatEN":"[operation] firewall [subsystem] backend [backend]"}
+func (b *BaseApi) OperateFirewallBackend(c *gin.Context) {
+	var request dto.FirewallBackendOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if err := firewallSettingService.Operate(c.Request.Context(), request); err != nil {
+		var businessErr buserr.BusinessError
+		if errors.As(err, &businessErr) && businessErr.Msg == "ErrFirewallBackendCleanupRequired" {
+			c.JSON(http.StatusOK, dto.Response{Code: http.StatusConflict, ErrorCode: "FW_BACKEND_CLEANUP_REQUIRED", Message: err.Error()})
+			c.Abort()
+			return
+		}
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Firewall
+// @Summary List Docker port guard status and policies
+// @Success 200 {object} dto.DockerPortGuardList
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/ports [get]
+func (b *BaseApi) ListDockerPortGuard(c *gin.Context) {
+	data, err := dockerPortGuardService.LoadOverview(c.Request.Context())
+	if err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Firewall
+// @Summary List Docker published ports
+// @Success 200 {array} dto.DockerPortGuardContainer
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/endpoints [get]
+func (b *BaseApi) ListDockerPublishedPorts(c *gin.Context) {
+	data, err := dockerPortGuardService.LoadPublishedPorts(c.Request.Context())
+	if err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+// @Tags Firewall
+// @Summary Operate Docker port guard
+// @Accept json
+// @Param request body dto.DockerPortGuardOperation true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/operate [post]
+// @x-panel-log {"bodyKeys":["operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] Docker 端口防护","formatEN":"[operation] Docker port guard"}
+func (b *BaseApi) OperateDockerPortGuard(c *gin.Context) {
+	var request dto.DockerPortGuardOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	if request.Operation == "initialize" {
+		result, err := dockerPortGuardService.QueueInitialization(request)
+		if err != nil {
+			handleDockerPortGuardError(c, err)
+			return
+		}
+		helper.SuccessWithData(c, result)
+		return
+	}
+	if err := dockerPortGuardService.Operate(c.Request.Context(), request); err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
+// @Tags Firewall
+// @Summary Delete Docker port guard policies
+// @Accept json
+// @Param request body dto.DockerPortGuardPolicyBatchDelete true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/policies/delete/batch [post]
+// @x-panel-log {"bodyKeys":["uuids"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"删除 Docker 端口防护策略 [uuids]","formatEN":"delete Docker port guard policies [uuids]"}
+func (b *BaseApi) DeleteDockerPortGuardPolicies(c *gin.Context) {
+	var request dto.DockerPortGuardPolicyBatchDelete
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := dockerPortGuardService.DeletePolicies(request)
+	if err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Batch upsert Docker port guard policies
+// @Accept json
+// @Param request body dto.DockerPortGuardPolicyBatch true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/docker/policies/batch [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"批量更新 Docker 端口防护策略","formatEN":"batch update Docker port guard policies"}
+func (b *BaseApi) UpsertDockerPortGuardPolicies(c *gin.Context) {
+	var request dto.DockerPortGuardPolicyBatch
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := dockerPortGuardService.UpsertPolicies(request)
+	if err != nil {
+		handleDockerPortGuardError(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+func handleDockerPortGuardError(c *gin.Context, err error) {
+	var businessErr buserr.BusinessError
+	if errors.As(err, &businessErr) {
+		code, errorCode := http.StatusInternalServerError, ""
+		switch businessErr.Msg {
+		case "ErrDockerIptablesChainUnavailable":
+			code, errorCode = http.StatusServiceUnavailable, "FW_DOCKER_IPTABLES_CHAIN_UNAVAILABLE"
+		case "ErrDockerNftablesChainUnavailable":
+			code, errorCode = http.StatusServiceUnavailable, "FW_DOCKER_NFTABLES_CHAIN_UNAVAILABLE"
+		case "ErrInvalidParams":
+			code, errorCode = http.StatusBadRequest, "FW_DOCKER_GUARD_INVALID"
+		case "ErrDockerFailed":
+			code, errorCode = http.StatusServiceUnavailable, "FW_DOCKER_UNAVAILABLE"
+		}
+		if errorCode != "" {
+			c.JSON(http.StatusOK, dto.Response{Code: code, ErrorCode: errorCode, Message: err.Error()})
+			c.Abort()
+			return
+		}
+	}
+	if errors.Is(err, docker.ErrUnavailable) {
+		helper.ErrorWithBusinessCode(c, http.StatusServiceUnavailable, "FW_DOCKER_UNAVAILABLE", "ErrDockerFailed", err)
+		return
+	}
+	helper.ErrorWithBusinessCode(c, http.StatusInternalServerError, "FW_DOCKER_GUARD_FAILED", "ErrInternalServer", err)
+}
+
+// @Tags Firewall
+// @Summary List firewall rule backups
+// @Param subsystem query string false "Firewall subsystem" Enums(system,forwarding,docker) default(system)
+// @Success 200 {object} dto.FirewallRuleBackups
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/rules/backups [get]
+func (b *BaseApi) ListFirewallRuleBackups(c *gin.Context) {
+	result, err := firewallService.ListRuleBackups(c.Request.Context(), c.DefaultQuery("subsystem", "system"))
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Initialize, repair or bind one firewall address family
+// @Accept json
+// @Param request body dto.FirewallFamilyOperation true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/family/operate [post]
+// @x-panel-log {"bodyKeys":["subsystem","family","operation"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"[operation] [subsystem] [family] 防火墙链","formatEN":"[operation] [subsystem] [family] firewall chains"}
+func (b *BaseApi) OperateFirewallFamily(c *gin.Context) {
+	var request dto.FirewallFamilyOperation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallSettingService.OperateFamily(request)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
+}
+
+// @Tags Firewall
+// @Summary Update firewall IPv6 support
+// @Accept json
+// @Param request body dto.FirewallIPv6Operation true "request"
+// @Success 200 {object} dto.FilterChainOperationResponse
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/firewall/settings/ipv6 [post]
+// @x-panel-log {"bodyKeys":["status"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"设置防火墙 IPv6 支持为 [status]","formatEN":"Set firewall IPv6 support to [status]"}
+func (b *BaseApi) OperateFirewallIPv6(c *gin.Context) {
+	var request dto.FirewallIPv6Operation
+	if err := helper.CheckBindAndValidate(&request, c); err != nil {
+		return
+	}
+	result, err := firewallSettingService.OperateIPv6(request)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, result)
 }

agent/app/api/v2/gpu.go

@@ -3,9 +3,8 @@ package v2
 import (
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu/common"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/xpu"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/accelerator"
 	"github.com/gin-gonic/gin"
 )
 
@@ -17,27 +16,20 @@ import (
 // @Security Timestamp
 // @Router /ai/gpu/load [get]
 func (b *BaseApi) LoadGpuInfo(c *gin.Context) {
-	ok, client := gpu.New()
+	ok, client := accelerator.New()
 	if ok {
-		info, err := client.LoadGpuInfo()
+		snapshot, err := client.Collect(c.Request.Context())
 		if err != nil {
 			helper.BadRequest(c, err)
 			return
 		}
-		helper.SuccessWithData(c, info)
-		return
-	}
-	xpuOK, xpuClient := xpu.New()
-	if xpuOK {
-		info, err := xpuClient.LoadGpuInfo()
-		if err != nil {
-			helper.BadRequest(c, err)
-			return
+		if warning := snapshot.Warning(); warning != nil {
+			global.LOG.Warnf("load realtime accelerator data partially failed, err: %v", warning)
 		}
-		helper.SuccessWithData(c, info)
+		helper.SuccessWithData(c, &snapshot.Info)
 		return
 	}
-	helper.SuccessWithData(c, &common.GpuInfo{})
+	helper.SuccessWithData(c, &accelerator.Info{})
 }
 
 // @Tags AI

agent/app/api/v2/helper/helper.go

@@ -30,6 +30,26 @@ func ErrorWithDetail(ctx *gin.Context, code int, msgKey string, err error) {
 	ctx.Abort()
 }
 
+func ErrorWithBusinessCode(ctx *gin.Context, code int, businessCode, msgKey string, err error) {
+	res := dto.Response{
+		Code:      code,
+		ErrorCode: businessCode,
+		Message:   i18n.GetMsgWithDetail(msgKey, err.Error()),
+	}
+	ctx.JSON(http.StatusOK, res)
+	ctx.Abort()
+}
+
+func ErrorWithDetailAndData(ctx *gin.Context, code int, msgKey string, err error, data interface{}) {
+	res := dto.Response{
+		Code: code,
+		Data: data,
+	}
+	res.Message = i18n.GetMsgWithDetail(msgKey, err.Error())
+	ctx.JSON(http.StatusOK, res)
+	ctx.Abort()
+}
+
 func InternalServer(ctx *gin.Context, err error) {
 	ErrorWithDetail(ctx, http.StatusInternalServerError, "ErrInternalServer", err)
 }

agent/app/api/v2/monitor.go

@@ -1,13 +1,9 @@
 package v2
 
 import (
-	"sort"
-
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/gin-gonic/gin"
-	"github.com/shirou/gopsutil/v4/disk"
-	"github.com/shirou/gopsutil/v4/net"
 )
 
 // @Tags Monitor
@@ -32,14 +28,19 @@ func (b *BaseApi) LoadMonitor(c *gin.Context) {
 }
 
 // @Tags Monitor
-// @Summary Clean monitor data
+// @Summary Clean host or GPU monitor data
+// @Param request body dto.MonitorClean true "request"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/monitor/clean [post]
-// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"清空监控数据","formatEN":"clean monitor datas"}
+// @x-panel-log {"bodyKeys":["type"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"清空 [type] 监控数据","formatEN":"clean [type] monitoring data"}
 func (b *BaseApi) CleanMonitor(c *gin.Context) {
-	if err := monitorService.CleanData(); err != nil {
+	var req dto.MonitorClean
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := monitorService.CleanData(req.Type); err != nil {
 		helper.InternalServer(c, err)
 		return
 	}
@@ -91,14 +92,7 @@ func (b *BaseApi) UpdateMonitorSetting(c *gin.Context) {
 // @Security Timestamp
 // @Router /hosts/monitor/netoptions [get]
 func (b *BaseApi) GetNetworkOptions(c *gin.Context) {
-	netStat, _ := net.IOCounters(true)
-	var options []string
-	options = append(options, "all")
-	for _, net := range netStat {
-		options = append(options, net.Name)
-	}
-	sort.Strings(options)
-	helper.SuccessWithData(c, options)
+	helper.SuccessWithData(c, monitorService.LoadNetworkOptions())
 }
 
 // @Tags Monitor
@@ -108,12 +102,5 @@ func (b *BaseApi) GetNetworkOptions(c *gin.Context) {
 // @Security Timestamp
 // @Router /hosts/monitor/iooptions [get]
 func (b *BaseApi) GetIOOptions(c *gin.Context) {
-	diskStat, _ := disk.IOCounters()
-	var options []string
-	options = append(options, "all")
-	for _, net := range diskStat {
-		options = append(options, net.Name)
-	}
-	sort.Strings(options)
-	helper.SuccessWithData(c, options)
+	helper.SuccessWithData(c, monitorService.LoadIOOptions())
 }

agent/app/api/v2/monitor_vllm.go

@@ -0,0 +1,45 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/gin-gonic/gin"
+)
+
+func (b *BaseApi) LoadVLLMMonitor(c *gin.Context) {
+	var req dto.MonitorVLLMSearch
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := monitorService.LoadVLLMMonitorData(req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+func (b *BaseApi) LoadVLLMCurrent(c *gin.Context) {
+	var req dto.MonitorVLLMCurrent
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	data, err := monitorService.LoadVLLMCurrent(c.Request.Context(), req)
+	if err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.SuccessWithData(c, data)
+}
+
+func (b *BaseApi) CleanVLLMMonitor(c *gin.Context) {
+	var req dto.MonitorVLLMClean
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := monitorService.CleanVLLMMonitor(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/api/v2/runtime.go

@@ -169,7 +169,7 @@ func (b *BaseApi) GetNodePackageRunScript(c *gin.Context) {
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /runtimes/operate [post]
-// @x-panel-log {"bodyKeys":["id"],"paramKeys":[],"BeforeFunctions":[],"formatZH":"操作运行环境 [id]","formatEN":"Operate runtime [id]"}
+// @x-panel-log {"bodyKeys":["ID"],"paramKeys":[],"BeforeFunctions":[{"input_column":"id","input_value":"ID","isList":false,"db":"runtimes","output_column":"name","output_value":"name"}],"formatZH":"操作运行环境 [name]","formatEN":"Operate runtime [name]"}
 func (b *BaseApi) OperateRuntime(c *gin.Context) {
 	var req request.RuntimeOperate
 	if err := helper.CheckBindAndValidate(&req, c); err != nil {

agent/app/api/v2/ssh.go

@@ -83,6 +83,7 @@ func (b *BaseApi) CreateRootCert(c *gin.Context) {
 	}
 	if err := loadCertAfterDecrypt(&req); err != nil {
 		helper.BadRequest(c, err)
+		return
 	}
 	if err := sshService.CreateRootCert(req); err != nil {
 		helper.InternalServer(c, err)
@@ -107,6 +108,7 @@ func (b *BaseApi) EditRootCert(c *gin.Context) {
 	}
 	if err := loadCertAfterDecrypt(&req); err != nil {
 		helper.BadRequest(c, err)
+		return
 	}
 	if err := sshService.EditRootCert(req); err != nil {
 		helper.InternalServer(c, err)

agent/app/api/v2/terminal.go

@@ -1,11 +1,14 @@
 package v2
 
 import (
+	"crypto/sha256"
 	"encoding/base64"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"net/http"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
@@ -19,29 +22,35 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/gorilla/websocket"
 	"github.com/pkg/errors"
+	gossh "golang.org/x/crypto/ssh"
 )
 
 // @Tags Terminal
 // @Summary Ws local terminal
 // @Param command query string false "command"
+// @Param session query string false "session id to reattach"
+// @Param terminalPersistent query boolean false "allow recovery after an unexpected disconnect"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/terminal/local [get]
 func (b *BaseApi) WsLocalTerminal(c *gin.Context) {
-	b.runSSHSession(c, loadLocalConn, c.DefaultQuery("command", ""))
+	b.runSSHSession(c, "local", loadLocalConn, c.DefaultQuery("command", ""))
 }
 
 // @Tags Terminal
 // @Summary Ws host SSH
 // @Param id query integer false "id"
 // @Param command query string false "command"
+// @Param session query string false "session id to reattach"
+// @Param title query string false "session title shown in the session list"
+// @Param terminalPersistent query boolean false "allow recovery after an unexpected disconnect"
 // @Success 200
 // @Security ApiKeyAuth
 // @Security Timestamp
 // @Router /hosts/terminal/ssh [get]
 func (b *BaseApi) WsHostSSH(c *gin.Context) {
-	b.runSSHSession(c, func() (*ssh.SSHClient, error) {
+	b.runSSHSession(c, "ssh", func() (*ssh.SSHClient, error) {
 		hostID, _ := strconv.Atoi(c.DefaultQuery("id", "0"))
 		if hostID <= 0 {
 			return nil, errors.New("missing host id")
@@ -65,26 +74,33 @@ func (b *BaseApi) WsContainerTerminal(c *gin.Context) {
 		return
 	}
 	defer wsConn.Close()
-
-	slave, err := loadContainerTerminalCommand(c)
-	if wshandleError(wsConn, err) {
-		return
-	}
-	defer slave.Close()
-
-	tty, err := terminal.NewLocalWsSession(cols, rows, wsConn, slave, false)
-	if wshandleError(wsConn, err) {
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		_ = wshandleError(wsConn, errors.New("missing terminal identity"))
 		return
 	}
 
-	quitChan := make(chan bool, 3)
-	tty.Start(quitChan)
-	go slave.Wait(quitChan)
+	opts := terminal.SessionOptions{
+		Identity: identity,
+		Kind:     "container",
+		Target:   containerTerminalTarget(c),
+		Cols:     cols,
+		Rows:     rows,
+	}
+	if err := terminal.ServeCommand(wsConn, strings.TrimSpace(c.Query("session")), opts, func() (*terminal.LocalCommand, error) {
+		return loadContainerTerminalCommand(c)
+	}); err != nil {
+		_ = wshandleError(wsConn, err)
+	}
+}
 
-	<-quitChan
-
-	global.LOG.Info("websocket finished")
-	closeTerminalConn(wsConn)
+func containerTerminalTarget(c *gin.Context) string {
+	query := c.Request.URL.Query()
+	for _, key := range []string{"cols", "rows", "session", "terminalRevalidate"} {
+		query.Del(key)
+	}
+	sum := sha256.Sum256([]byte(query.Encode()))
+	return hex.EncodeToString(sum[:])
 }
 
 func prepareTerminalSession(c *gin.Context) (*websocket.Conn, int, int, bool) {
@@ -115,32 +131,138 @@ func prepareTerminalSession(c *gin.Context) (*websocket.Conn, int, int, bool) {
 	return wsConn, cols, rows, true
 }
 
-func (b *BaseApi) runSSHSession(c *gin.Context, connect func() (*ssh.SSHClient, error), command string) {
+func (b *BaseApi) runSSHSession(c *gin.Context, kind string, connect func() (*ssh.SSHClient, error), command string) {
 	wsConn, cols, rows, ok := prepareTerminalSession(c)
 	if !ok {
 		return
 	}
 	defer wsConn.Close()
-
-	client, clientErr := connect()
-	if wshandleError(wsConn, errors.WithMessage(clientErr, "failed to set up the connection. Please check the host information")) {
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		_ = wshandleError(wsConn, errors.New("missing terminal identity"))
 		return
 	}
-	defer client.Close()
 
-	sws, err := terminal.NewLogicSshWsSession(cols, rows, client.Client, wsConn, command)
-	if wshandleError(wsConn, err) {
+	hostID := 0
+	if kind == "ssh" {
+		hostID, _ = strconv.Atoi(c.DefaultQuery("id", "0"))
+	}
+	opts := terminal.SessionOptions{
+		Identity:   identity,
+		Kind:       kind,
+		Title:      sanitizeTerminalTitle(c.Query("title")),
+		Persistent: c.Query("terminalPersistent") == "true",
+		HostID:     uint(max(hostID, 0)),
+		Cols:       cols,
+		Rows:       rows,
+		InitCmd:    command,
+	}
+	err := terminal.Serve(wsConn, strings.TrimSpace(c.Query("session")), opts, func() (*gossh.Client, error) {
+		client, err := connect()
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed to set up the connection. Please check the host information")
+		}
+		return client.Client, nil
+	})
+	if err != nil {
+		_ = wshandleError(wsConn, err)
+	}
+}
+
+// @Tags Terminal
+// @Summary List the caller's live terminal sessions
+// @Success 200 {array} terminal.Info
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/terminal/sessions/search [post]
+func (b *BaseApi) SearchTerminalSessions(c *gin.Context) {
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		helper.BadRequest(c, errors.New("missing terminal identity"))
 		return
 	}
-	defer sws.Close()
+	helper.SuccessWithData(c, terminal.List(identity))
+}
 
-	quitChan := make(chan bool, 3)
-	sws.Start(quitChan)
-	go sws.Wait(quitChan)
+// @Tags Terminal
+// @Summary Close a terminal session
+// @Accept json
+// @Param request body dto.TerminalSessionClose true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/terminal/sessions/close [post]
+func (b *BaseApi) CloseTerminalSession(c *gin.Context) {
+	var req dto.TerminalSessionClose
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		helper.BadRequest(c, errors.New("missing terminal identity"))
+		return
+	}
+	if err := terminal.CloseSession(req.ID, identity); err != nil {
+		helper.BadRequest(c, err)
+		return
+	}
+	helper.Success(c)
+}
 
-	<-quitChan
+// @Tags Terminal
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/terminal/sessions/closeAll [post]
+func (b *BaseApi) CloseAllTerminalSessions(c *gin.Context) {
+	identity, ok := loadTerminalIdentity(c)
+	if !ok {
+		helper.BadRequest(c, errors.New("missing terminal identity"))
+		return
+	}
+	terminal.Revoke("auth_session", identity.UserID, identity.AuthSessionID)
+	helper.Success(c)
+}
 
-	closeTerminalConn(wsConn)
+func (b *BaseApi) RevokeTerminalSessions(c *gin.Context) {
+	var req dto.TerminalSessionRevoke
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if (req.Scope == "auth_session" && (req.UserID == "" || req.AuthSessionID == "")) ||
+		(req.Scope == "user" && req.UserID == "") {
+		helper.BadRequest(c, errors.New("missing terminal revocation identity"))
+		return
+	}
+	terminal.Revoke(req.Scope, req.UserID, req.AuthSessionID)
+	helper.Success(c)
+}
+
+func loadTerminalIdentity(c *gin.Context) (terminal.Identity, bool) {
+	identity := terminal.Identity{
+		UserID:        strings.TrimSpace(c.GetHeader(terminal.HeaderUserID)),
+		AuthSessionID: strings.TrimSpace(c.GetHeader(terminal.HeaderAuthSessionID)),
+	}
+	if value := c.GetHeader(terminal.HeaderAuthLeaseUntil); value != "" {
+		millis, err := strconv.ParseInt(value, 10, 64)
+		if err != nil || millis <= 0 {
+			return terminal.Identity{}, false
+		}
+		identity.AuthLeaseUntil = time.UnixMilli(millis)
+		if maximum := time.Now().Add(90 * time.Second); identity.AuthLeaseUntil.After(maximum) {
+			identity.AuthLeaseUntil = maximum
+		}
+	}
+	return identity, identity.Valid()
+}
+
+// sanitizeTerminalTitle keeps the title a short single line.
+func sanitizeTerminalTitle(title string) string {
+	title = strings.Join(strings.Fields(title), " ")
+	if r := []rune(title); len(r) > 64 {
+		title = string(r[:64])
+	}
+	return title
 }
 
 func closeTerminalConn(wsConn *websocket.Conn) {

agent/app/api/v2/terminal_capabilities.go

@@ -0,0 +1,10 @@
+package v2
+
+import (
+	"github.com/1Panel-dev/1Panel/agent/app/api/v2/helper"
+	"github.com/gin-gonic/gin"
+)
+
+func (b *BaseApi) TerminalCapabilities(c *gin.Context) {
+	helper.SuccessWithData(c, gin.H{"apiKeyLeaseVersion": 1})
+}

agent/app/dto/agents.go

@@ -162,16 +162,25 @@ type AgentWebsiteBindReq struct {
 }
 
 type AgentModelConfigUpdateReq struct {
-	AgentID   uint     `json:"agentId" validate:"required"`
-	AccountID uint     `json:"accountId" validate:"required"`
-	Model     string   `json:"model" validate:"required"`
-	Fallbacks []string `json:"fallbacks"`
+	AgentID   uint                 `json:"agentId" validate:"required"`
+	AccountID uint                 `json:"accountId" validate:"required"`
+	Model     string               `json:"model" validate:"required"`
+	Fallbacks []string             `json:"fallbacks"`
+	Metadata  []AgentModelMetadata `json:"metadata" validate:"dive"`
 }
 
 type AgentModelConfig struct {
-	AccountID uint     `json:"accountId"`
-	Model     string   `json:"model"`
-	Fallbacks []string `json:"fallbacks"`
+	AccountID uint                 `json:"accountId"`
+	Model     string               `json:"model"`
+	Fallbacks []string             `json:"fallbacks"`
+	Metadata  []AgentModelMetadata `json:"metadata"`
+}
+
+type AgentModelMetadata struct {
+	Model         string `json:"model" validate:"required"`
+	InputMode     string `json:"inputMode" validate:"required,oneof=auto text image"`
+	ContextWindow int    `json:"contextWindow" validate:"min=0"`
+	MaxTokens     int    `json:"maxTokens" validate:"min=0"`
 }
 
 type AgentHermesChatSessionItem struct {

agent/app/dto/alert.go

@@ -21,6 +21,7 @@ type AlertBase struct {
 }
 
 type PushAlert struct {
+	Result    string `json:"result,omitempty"`
 	TaskName  string `json:"taskName"`
 	AlertType string `json:"alertType"`
 	EntryID   uint   `json:"entryID"`
@@ -53,6 +54,7 @@ type AlertDTO struct {
 	Method         string    `json:"method"`
 	Title          string    `json:"title"`
 	Project        string    `json:"project"`
+	TaskName       string    `json:"taskName,omitempty"`
 	Status         string    `json:"status"`
 	SendCount      uint      `json:"sendCount"`
 	AdvancedParams string    `json:"advancedParams"`
@@ -151,16 +153,25 @@ type AlertLog struct {
 }
 
 type AlertDetail struct {
-	LicenseId   string  `json:"licenseId"`
-	Type        string  `json:"type"`
-	SubType     string  `json:"subType"`
-	Title       string  `json:"title"`
-	Method      string  `json:"method"`
-	LicenseCode string  `json:"licenseCode"`
-	DeviceId    string  `json:"deviceId"`
-	Project     string  `json:"project"`
-	Params      []Param `json:"params"`
-	Phone       string  `json:"phone"`
+	LicenseId   string             `json:"licenseId"`
+	Type        string             `json:"type"`
+	SubType     string             `json:"subType"`
+	Title       string             `json:"title"`
+	Method      string             `json:"method"`
+	LicenseCode string             `json:"licenseCode"`
+	DeviceId    string             `json:"deviceId"`
+	Project     string             `json:"project"`
+	Params      []Param            `json:"params"`
+	Phone       string             `json:"phone"`
+	Task        *AlertTaskMetadata `json:"task,omitempty"`
+}
+
+type AlertTaskMetadata struct {
+	AlertID   uint   `json:"alertId"`
+	Type      string `json:"type"`
+	Quota     string `json:"quota"`
+	QuotaType string `json:"quotaType"`
+	Method    string `json:"method"`
 }
 
 type AlertRule struct {
@@ -295,15 +306,19 @@ type OfflineQueryRequest struct {
 }
 
 type AlertConfigUpdate struct {
-	ID          uint   `json:"id"`
-	Type        string `json:"type"`
-	Title       string `json:"title"`
-	Status      string `json:"status"`
-	Config      string `json:"config"`
-	DisplayName string `json:"displayName"`
+	ID          uint       `json:"id"`
+	Type        string     `json:"type"`
+	Title       string     `json:"title"`
+	Status      string     `json:"status"`
+	Config      string     `json:"config"`
+	DisplayName string     `json:"displayName"`
+	Revision    *time.Time `json:"revision"`
 }
 
 type AlertConfigTest struct {
+	ID          uint   `json:"id"`
+	Type        string `json:"type"`
+	Config      string `json:"config"`
 	Host        string `json:"host"`
 	Port        int    `json:"port"`
 	Sender      string `json:"sender"`

agent/app/dto/alert_webhook.go

@@ -0,0 +1,80 @@
+package dto
+
+const AlertCustomWebhookSchemaVersion = 1
+
+type AlertConfigStatusUpdate struct {
+	ID     uint   `json:"id" validate:"required"`
+	Status string `json:"status" validate:"required,oneof=Enable Disable"`
+}
+
+type AlertCustomWebhookSecretMutation struct {
+	Action string `json:"action,omitempty"`
+	Value  string `json:"value,omitempty"`
+}
+
+type AlertCustomWebhookURL struct {
+	AlertCustomWebhookSecretMutation
+	Configured bool   `json:"configured"`
+	Masked     string `json:"masked,omitempty"`
+}
+
+type AlertCustomWebhookBody struct {
+	Type     string                        `json:"type"`
+	Template string                        `json:"template,omitempty"`
+	Fields   []AlertCustomWebhookFormField `json:"fields,omitempty"`
+}
+
+type AlertCustomWebhookFormField struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}
+
+type AlertCustomWebhookHeader struct {
+	UID        string `json:"uid"`
+	Key        string `json:"key"`
+	Secret     bool   `json:"secret"`
+	Action     string `json:"action,omitempty"`
+	Value      string `json:"value,omitempty"`
+	Configured bool   `json:"configured,omitempty"`
+	Masked     string `json:"masked,omitempty"`
+}
+
+type AlertCustomWebhookConfig struct {
+	SchemaVersion int                        `json:"schemaVersion"`
+	State         string                     `json:"state,omitempty"`
+	DisplayName   string                     `json:"displayName"`
+	Preset        string                     `json:"preset"`
+	Method        string                     `json:"method"`
+	URL           AlertCustomWebhookURL      `json:"url"`
+	Body          AlertCustomWebhookBody     `json:"body"`
+	Headers       []AlertCustomWebhookHeader `json:"headers"`
+}
+
+type AlertCustomWebhookSecretConfig struct {
+	SchemaVersion int               `json:"schemaVersion"`
+	URL           string            `json:"url"`
+	Headers       map[string]string `json:"headers,omitempty"`
+}
+
+type AlertCustomWebhookResolvedConfig struct {
+	SchemaVersion int
+	DisplayName   string
+	Preset        string
+	Method        string
+	URL           string
+	Body          AlertCustomWebhookBody
+	Headers       []AlertCustomWebhookResolvedHeader
+}
+
+type AlertCustomWebhookResolvedHeader struct {
+	Key   string
+	Value string
+}
+
+type AlertConfigTestResult struct {
+	Success    bool   `json:"success"`
+	StatusCode int    `json:"statusCode,omitempty"`
+	Duration   int64  `json:"duration,omitempty"` // milliseconds
+	Message    string `json:"message,omitempty"`
+	Response   string `json:"response,omitempty"`
+}

agent/app/dto/common_res.go

@@ -6,9 +6,10 @@ type PageResult struct {
 }
 
 type Response struct {
-	Code    int         `json:"code"`
-	Message string      `json:"message"`
-	Data    interface{} `json:"data"`
+	Code      int         `json:"code"`
+	ErrorCode string      `json:"errorCode,omitempty"`
+	Message   string      `json:"message"`
+	Data      interface{} `json:"data"`
 }
 
 type Options struct {

agent/app/dto/cronjob.go

@@ -51,9 +51,10 @@ type CronjobOperate struct {
 	Secret            string `json:"secret"`
 	Args              string `json:"args"`
 
-	AlertCount  uint   `json:"alertCount"`
-	AlertTitle  string `json:"alertTitle"`
-	AlertMethod string `json:"alertMethod"`
+	AlertCount       uint   `json:"alertCount"`
+	AlertTitle       string `json:"alertTitle"`
+	AlertMethod      string `json:"alertMethod"`
+	AlertTriggerMode string `json:"alertTriggerMode" validate:"omitempty,oneof=failed success both"`
 
 	CleanLogConfig
 }
@@ -126,7 +127,8 @@ type CronjobInfo struct {
 	Secret           string `json:"secret"`
 	Args             string `json:"args"`
 
-	AlertCount uint `json:"alertCount"`
+	AlertCount       uint   `json:"alertCount"`
+	AlertTriggerMode string `json:"alertTriggerMode"`
 }
 
 type CronjobImport struct {
@@ -169,9 +171,10 @@ type CronjobTrans struct {
 	SourceAccounts  []string `json:"sourceAccounts"`
 	DownloadAccount string   `json:"downloadAccount"`
 
-	AlertCount  uint   `json:"alertCount"`
-	AlertTitle  string `json:"alertTitle"`
-	AlertMethod string `json:"alertMethod"`
+	AlertCount       uint   `json:"alertCount"`
+	AlertTitle       string `json:"alertTitle"`
+	AlertMethod      string `json:"alertMethod"`
+	AlertTriggerMode string `json:"alertTriggerMode" validate:"omitempty,oneof=failed success both"`
 }
 type TransHelper struct {
 	Name       string `json:"name"`

agent/app/dto/dashboard.go

@@ -121,6 +121,7 @@ type DashboardCurrent struct {
 	NetBytesRecv uint64 `json:"netBytesRecv"`
 
 	GPUData []GPUInfo `json:"gpuData"`
+	NPUData []NPUInfo `json:"npuData"`
 	XPUData []XPUInfo `json:"xpuData"`
 
 	TopCPUItems []Process `json:"topCPUItems"`
@@ -156,8 +157,12 @@ type DiskInfo struct {
 }
 
 type GPUInfo struct {
+	Type             string `json:"type"`
 	Index            uint   `json:"index"`
+	NPUIndex         uint   `json:"npuIndex"`
+	ChipIndex        uint   `json:"chipIndex"`
 	ProductName      string `json:"productName"`
+	BusID            string `json:"busID"`
 	GPUUtil          string `json:"gpuUtil"`
 	Temperature      string `json:"temperature"`
 	PerformanceState string `json:"performanceState"`
@@ -170,6 +175,27 @@ type GPUInfo struct {
 	FanSpeed         string `json:"fanSpeed"`
 }
 
+type NPUInfo struct {
+	Type           string `json:"type"`
+	Index          uint   `json:"index"`
+	NPUIndex       uint   `json:"npuIndex"`
+	ChipIndex      uint   `json:"chipIndex"`
+	ProductName    string `json:"productName"`
+	BusID          string `json:"busID"`
+	Health         string `json:"health"`
+	Temperature    string `json:"temperature"`
+	PowerDraw      string `json:"powerDraw"`
+	AICore         string `json:"aiCore"`
+	MemUsed        string `json:"memUsed"`
+	MemTotal       string `json:"memTotal"`
+	MemoryUsed     string `json:"memoryUsed"`
+	MemoryTotal    string `json:"memoryTotal"`
+	HBMUsed        string `json:"hbmUsed"`
+	HBMTotal       string `json:"hbmTotal"`
+	HugepagesUsed  string `json:"hugepagesUsed"`
+	HugepagesTotal string `json:"hugepagesTotal"`
+}
+
 type AppLauncher struct {
 	Key         string `json:"key"`
 	Type        string `json:"type"`
@@ -202,11 +228,13 @@ type LauncherOption struct {
 }
 
 type XPUInfo struct {
-	DeviceID    int    `json:"deviceID"`
-	DeviceName  string `json:"deviceName"`
-	Memory      string `json:"memory"`
-	Temperature string `json:"temperature"`
-	MemoryUsed  string `json:"memoryUsed"`
-	Power       string `json:"power"`
-	MemoryUtil  string `json:"memoryUtil"`
+	DeviceID      int    `json:"deviceID"`
+	DeviceName    string `json:"deviceName"`
+	PciBdfAddress string `json:"pciBdfAddress"`
+	Memory        string `json:"memory"`
+	Temperature   string `json:"temperature"`
+	GPUUtil       string `json:"gpuUtil"`
+	MemoryUsed    string `json:"memoryUsed"`
+	Power         string `json:"power"`
+	MemoryUtil    string `json:"memoryUtil"`
 }

agent/app/dto/database.go

@@ -22,6 +22,10 @@ type DBBaseInfo struct {
 	Port          int64  `json:"port"`
 }
 
+type RedisCliInstall struct {
+	TaskID string `json:"taskID" validate:"omitempty,uuid"`
+}
+
 // mysql
 type MysqlDBSearch struct {
 	PageInfo

agent/app/dto/firewall.go

@@ -1,100 +1,353 @@
 package dto
 
-type FirewallBaseInfo struct {
-	Name       string `json:"name"`
-	IsExist    bool   `json:"isExist"`
-	IsActive   bool   `json:"isActive"`
-	IsInit     bool   `json:"isInit"`
-	IsBind     bool   `json:"isBind"`
-	Version    string `json:"version"`
-	PingStatus string `json:"pingStatus"`
+import (
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
+	dockerfirewall "github.com/1Panel-dev/1Panel/agent/utils/firewall/docker_guard"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/forwarding"
+)
+
+type FirewallSubsystemStatus struct {
+	IPv6Enabled     bool                        `json:"ipv6Enabled"`
+	Name            string                      `json:"name"`
+	Backend         string                      `json:"backend"`
+	ConflictBackend string                      `json:"conflictBackend,omitempty"`
+	IsExist         bool                        `json:"isExist"`
+	IsActive        bool                        `json:"isActive"`
+	IsInit          bool                        `json:"isInit"`
+	IsBind          bool                        `json:"isBind"`
+	Version         string                      `json:"version"`
+	PingStatus      string                      `json:"pingStatus"`
+	Message         string                      `json:"message,omitempty"`
+	Reason          string                      `json:"reason,omitempty"`
+	LifecycleTaskID string                      `json:"lifecycleTaskID,omitempty"`
+	IPv4            FirewallBackendFamilyStatus `json:"ipv4"`
+	IPv6            FirewallBackendFamilyStatus `json:"ipv6"`
 }
 
-type RuleSearch struct {
-	PageInfo
-	Info     string `json:"info"`
-	Status   string `json:"status"`
-	Strategy string `json:"strategy"`
-	Type     string `json:"type" validate:"required"`
-}
-
-type FirewallOperation struct {
+type FirewallLifecycleOperation struct {
 	Operation         string `json:"operation" validate:"required,oneof=start stop restart disableBanPing enableBanPing"`
 	WithDockerRestart bool   `json:"withDockerRestart"`
 }
 
-type PortRuleOperate struct {
-	ID        uint   `json:"id"`
-	Operation string `json:"operation" validate:"required,oneof=add remove"`
-	Chain     string `json:"chain"`
-	Address   string `json:"address"`
-	Port      string `json:"port" validate:"required"`
-	Protocol  string `json:"protocol" validate:"required,oneof=tcp udp tcp/udp"`
-	Strategy  string `json:"strategy" validate:"required,oneof=accept drop"`
-
-	Description string `json:"description"`
+type FirewallLifecycleOperationResponse struct {
+	TaskID string `json:"taskID,omitempty"`
+	Queued bool   `json:"queued"`
 }
 
-type UpdateFirewallDescription struct {
-	Type     string `json:"type"`
-	Chain    string `json:"chain"`
-	SrcIP    string `json:"srcIP"`
-	DstIP    string `json:"dstIP"`
-	SrcPort  string `json:"srcPort"`
-	DstPort  string `json:"dstPort"`
-	Protocol string `json:"protocol"`
-	Strategy string `json:"strategy" validate:"required,oneof=accept drop"`
-
-	Description string `json:"description"`
+type FirewallBackendOption struct {
+	Name           string                      `json:"name"`
+	Installed      bool                        `json:"installed"`
+	Active         bool                        `json:"active"`
+	Initialized    bool                        `json:"initialized"`
+	Bound          bool                        `json:"bound"`
+	Supported      bool                        `json:"supported"`
+	SupportReason  string                      `json:"supportReason,omitempty"`
+	Implementation string                      `json:"implementation,omitempty"`
+	Message        string                      `json:"message,omitempty"`
+	IPv4           FirewallBackendFamilyStatus `json:"ipv4"`
+	IPv6           FirewallBackendFamilyStatus `json:"ipv6"`
 }
 
-type AddrRuleOperate struct {
-	ID        uint   `json:"id"`
-	Operation string `json:"operation" validate:"required,oneof=add remove"`
-	Address   string `json:"address"  validate:"required"`
-	Strategy  string `json:"strategy" validate:"required,oneof=accept drop"`
-
-	Description string `json:"description"`
+type FirewallBackendFamilyStatus struct {
+	Partial      bool     `json:"partial"`
+	Available    bool     `json:"available"`
+	Initialized  bool     `json:"initialized"`
+	Bound        bool     `json:"bound"`
+	Reason       string   `json:"reason,omitempty"`
+	RAInterfaces []string `json:"raInterfaces,omitempty"`
 }
 
-type PortRuleUpdate struct {
-	OldRule PortRuleOperate `json:"oldRule"`
-	NewRule PortRuleOperate `json:"newRule"`
+type FirewallBackendGroup struct {
+	Selected string                  `json:"selected"`
+	Current  string                  `json:"current,omitempty"`
+	Options  []FirewallBackendOption `json:"options"`
 }
 
-type AddrRuleUpdate struct {
-	OldRule AddrRuleOperate `json:"oldRule"`
-	NewRule AddrRuleOperate `json:"newRule"`
+type FirewallSettings struct {
+	IPv6Enabled   bool                   `json:"ipv6Enabled"`
+	System        FirewallBackendGroup   `json:"system"`
+	Forwarding    FirewallBackendGroup   `json:"forwarding"`
+	Docker        FirewallBackendGroup   `json:"docker"`
+	PingStatus    string                 `json:"pingStatus"`
+	PortWhitelist []filter.PortWhitelist `json:"portWhiteList"`
+	PanelPort     string                 `json:"panelPort"`
+	SSHPort       string                 `json:"sshPort"`
 }
 
-type BatchRuleOperate struct {
-	Type  string            `json:"type" validate:"required"`
-	Rules []PortRuleOperate `json:"rules"`
+type FirewallPortWhitelistCreate struct {
+	Rule filter.PortWhitelist `json:"rule" validate:"required"`
 }
 
-type IptablesOp struct {
-	Name    string `json:"name" validate:"required,oneof=1PANEL_INPUT 1PANEL_OUTPUT 1PANEL_BASIC 1PANEL_FORWARD"`
-	Operate string `json:"operate" validate:"required,oneof=init-base init-forward init-advance bind-base unbind-base bind unbind"`
+type FirewallPortWhitelistUpdate struct {
+	OldRule filter.PortWhitelist `json:"oldRule" validate:"required"`
+	Rule    filter.PortWhitelist `json:"rule" validate:"required"`
 }
 
-type IptablesRuleOp struct {
-	Operation   string `json:"operation" validate:"required,oneof=add remove"`
-	ID          uint   `json:"id"`
-	Chain       string `json:"chain" validate:"required,oneof=1PANEL_BASIC 1PANEL_BASIC_BEFORE 1PANEL_INPUT 1PANEL_OUTPUT"`
-	Protocol    string `json:"protocol"`
-	SrcIP       string `json:"srcIP"`
-	SrcPort     uint   `json:"srcPort"`
-	DstIP       string `json:"dstIP"`
-	DstPort     uint   `json:"dstPort"`
-	Strategy    string `json:"strategy" validate:"required,oneof=accept drop reject"`
-	Description string `json:"description"`
+type FirewallPortWhitelistDelete struct {
+	Rule *filter.PortWhitelist `json:"rule" validate:"required"`
 }
 
-type IptablesBatchOperate struct {
-	Rules []IptablesRuleOp `json:"rules"`
+type FirewallBackendOperation struct {
+	Subsystem string `json:"subsystem" validate:"required,oneof=system forwarding docker"`
+	Backend   string `json:"backend" validate:"required,oneof=firewalld ufw iptables nftables"`
+	Operation string `json:"operation" validate:"required,oneof=select initialize cleanup"`
 }
 
-type IptablesChainStatus struct {
-	IsBind          bool   `json:"isBind"`
-	DefaultStrategy string `json:"defaultStrategy"`
+type FirewallIPv6Operation struct {
+	Status string `json:"status" validate:"required,oneof=Enable Disable"`
+}
+
+type FirewallFamilyOperation struct {
+	Subsystem string `json:"subsystem" validate:"required,oneof=system forwarding docker"`
+	Backend   string `json:"backend" validate:"required,oneof=iptables nftables"`
+	Family    string `json:"family" validate:"required,oneof=ipv4 ipv6"`
+	Operation string `json:"operation" validate:"required,oneof=initialize repair bind"`
+}
+
+type FilterChainOperation struct {
+	Name    string `json:"name" validate:"required,eq=1PANEL_BASIC"`
+	Operate string `json:"operate" validate:"required,oneof=init-base bind-base unbind-base"`
+	TaskID  string `json:"taskID,omitempty" validate:"omitempty,max=64"`
+}
+
+type FilterChainOperationResponse struct {
+	TaskID string `json:"taskID"`
+	Queued bool   `json:"queued"`
+}
+
+type FirewallInitializationTask struct {
+	BackupFile string `json:"backupFile,omitempty" validate:"omitempty,max=255"`
+	TaskID     string `json:"taskID,omitempty" validate:"omitempty,max=64"`
+}
+
+type FirewallSystemPort = firewall.SystemPort
+
+type FirewallRuleInventoryResponse struct {
+	IPv4Range filter.PositionRange   `json:"ipv4Range"`
+	IPv6Range filter.PositionRange   `json:"ipv6Range"`
+	Total     int64                  `json:"total"`
+	AllTotal  int64                  `json:"allTotal"`
+	Items     []filter.InventoryItem `json:"items"`
+	Notices   []filter.ScopeNotice   `json:"notices,omitempty"`
+}
+
+type FirewallRuleBackup struct {
+	Name       string          `json:"name"`
+	Provider   filter.Provider `json:"provider"`
+	RuleCount  int             `json:"ruleCount"`
+	ModifiedAt int64           `json:"modifiedAt"`
+}
+
+type FirewallRuleBackups struct {
+	Directory string               `json:"directory"`
+	Files     []FirewallRuleBackup `json:"files"`
+}
+
+type FirewallRuleResetResponse struct {
+	BackupPath string `json:"backupPath"`
+	Removed    int    `json:"removed"`
+	Disabled   bool   `json:"disabled"`
+}
+
+type FirewallRuleReset struct {
+	Subsystem         string          `json:"subsystem,omitempty" validate:"omitempty,oneof=system forwarding docker"`
+	Backup            *bool           `json:"backup,omitempty" default:"true"`
+	Provider          filter.Provider `json:"provider,omitempty" validate:"omitempty,oneof=firewalld ufw iptables nftables"`
+	WithDockerRestart bool            `json:"withDockerRestart"`
+}
+
+type FirewallRuleInventory struct {
+	PageInfo
+	Scope         filter.Scope    `json:"scope,omitempty"`
+	Scopes        []filter.Scope  `json:"scopes,omitempty" validate:"max=16"`
+	All           bool            `json:"all,omitempty"`
+	Info          string          `json:"info"`
+	Families      []filter.Family `json:"families,omitempty" validate:"omitempty,dive,oneof=ipv4 ipv6"`
+	Actions       []string        `json:"actions,omitempty" validate:"omitempty,dive,oneof=accept deny"`
+	ExcludeChains []string        `json:"excludeChains,omitempty" validate:"omitempty,dive,oneof=1PANEL_BASIC_BEFORE 1PANEL_BASIC 1PANEL_BASIC_AFTER"`
+}
+
+type FirewallNativeDetail struct {
+	Provider   filter.Provider   `json:"provider" validate:"required,oneof=firewalld ufw"`
+	NativeKind filter.NativeKind `json:"nativeKind" validate:"required,oneof=zone_service ufw_application"`
+	Name       string            `json:"name" validate:"required"`
+	Permanent  bool              `json:"permanent"`
+}
+
+type DockerPortGuardBase struct {
+	IPv6Enabled bool                        `json:"ipv6Enabled"`
+	Name        string                      `json:"name"`
+	Version     string                      `json:"version"`
+	IsExist     bool                        `json:"isExist"`
+	Initialized bool                        `json:"initialized"`
+	Bound       bool                        `json:"bound"`
+	IPv4        DockerPortGuardFamilyStatus `json:"ipv4"`
+	IPv6        DockerPortGuardFamilyStatus `json:"ipv6"`
+	Backend     string                      `json:"backend"`
+	Message     string                      `json:"message,omitempty"`
+}
+
+type DockerPortGuardFamilyStatus struct {
+	Partial     bool   `json:"partial"`
+	State       string `json:"state"`
+	Reason      string `json:"reason,omitempty"`
+	Initialized bool   `json:"initialized"`
+	Bound       bool   `json:"bound"`
+	Effective   bool   `json:"effective"`
+}
+
+type DockerPortGuardEndpoint struct {
+	Family           string   `json:"family"`
+	HostIP           string   `json:"hostIP"`
+	HostPort         uint16   `json:"hostPort"`
+	Protocol         string   `json:"protocol"`
+	ContainerID      string   `json:"containerID"`
+	ContainerName    string   `json:"containerName"`
+	ContainerState   string   `json:"containerState,omitempty"`
+	ContainerPort    uint16   `json:"containerPort"`
+	Compose          string   `json:"compose,omitempty"`
+	Application      string   `json:"application,omitempty"`
+	PolicyUUID       string   `json:"policyUUID,omitempty"`
+	Mode             string   `json:"mode,omitempty"`
+	Sources          []string `json:"sources"`
+	Effective        bool     `json:"effective"`
+	TrafficPath      string   `json:"trafficPath"`
+	ManagementTarget string   `json:"managementTarget"`
+	ManagementReason string   `json:"managementReason,omitempty"`
+}
+
+type DockerPortGuardPortGroup struct {
+	Key       string                    `json:"key"`
+	Label     string                    `json:"label"`
+	Endpoint  DockerPortGuardEndpoint   `json:"endpoint"`
+	Endpoints []DockerPortGuardEndpoint `json:"endpoints"`
+}
+
+type DockerPortGuardContainer struct {
+	Key         string                     `json:"key"`
+	Name        string                     `json:"name"`
+	Compose     string                     `json:"compose,omitempty"`
+	Application string                     `json:"application,omitempty"`
+	Endpoints   []DockerPortGuardEndpoint  `json:"endpoints"`
+	PortGroups  []DockerPortGuardPortGroup `json:"portGroups"`
+}
+
+type DockerPortGuardList struct {
+	Base           DockerPortGuardBase        `json:"base"`
+	Containers     []DockerPortGuardContainer `json:"containers"`
+	OrphanPolicies []DockerPortGuardEndpoint  `json:"orphanPolicies"`
+}
+
+type DockerPortGuardEndpointIdentity struct {
+	Family   string `json:"family" validate:"required,oneof=ipv4 ipv6"`
+	HostIP   string `json:"hostIP" validate:"required,max=45"`
+	HostPort uint16 `json:"hostPort" validate:"required,min=1"`
+	Protocol string `json:"protocol" validate:"required,oneof=tcp udp"`
+}
+
+type DockerPortGuardPolicyBatch struct {
+	Policies []DockerPortGuardPolicy `json:"policies" validate:"required,min=1,dive"`
+	Import   bool                    `json:"import"`
+}
+
+type DockerPortGuardPolicyBatchDelete struct {
+	UUIDs []string `json:"uuids" validate:"required,min=1,dive,required,max=64"`
+}
+
+type DockerPortGuardPolicy struct {
+	DockerPortGuardEndpointIdentity
+	Mode    string   `json:"mode" validate:"required,oneof=deny_sources allow_sources deny_all accept_sources accept_all"`
+	Sources []string `json:"sources" validate:"dive,required,max=64"`
+}
+
+type DockerPortGuardOperation struct {
+	BackupFile string `json:"backupFile,omitempty" validate:"omitempty,max=255"`
+	Operation  string `json:"operation" validate:"required,oneof=initialize bind unbind"`
+	TaskID     string `json:"taskID,omitempty" validate:"omitempty,max=64"`
+}
+
+type FirewallRuleCreateItem struct {
+	Raw         string              `json:"raw,omitempty"`
+	ParseStatus filter.ParseStatus  `json:"parseStatus,omitempty"`
+	Rule        filter.FirewallRule `json:"rule" validate:"required"`
+	SourceKind  string              `json:"sourceKind" validate:"omitempty,oneof=user imported"`
+}
+
+type FirewallRuleCreate struct {
+	BackupFile string                   `json:"backupFile,omitempty" validate:"omitempty,max=255"`
+	Initialize bool                     `json:"initialize"`
+	Items      []FirewallRuleCreateItem `json:"items" validate:"dive"`
+}
+
+type FirewallRuleCreateResponse struct {
+	TaskID    string                      `json:"taskID,omitempty"`
+	Queued    bool                        `json:"queued,omitempty"`
+	Succeeded int                         `json:"succeeded"`
+	Failed    int                         `json:"failed"`
+	Skipped   int                         `json:"skipped"`
+	Errors    []FirewallRuleCreateFailure `json:"errors,omitempty"`
+}
+
+type FirewallRuleCreateFailure struct {
+	Index  int                 `json:"index"`
+	Status string              `json:"status"`
+	Rule   filter.FirewallRule `json:"rule"`
+	Error  string              `json:"error,omitempty"`
+}
+
+type FirewallRuleDelete struct {
+	Targets []FirewallRuleDeleteItem `json:"targets" validate:"required,min=1,dive"`
+}
+
+type FirewallRuleDeleteItem struct {
+	FirewallRuleDeleteTarget
+	Observed filter.ObservedRule `json:"observed" validate:"required"`
+}
+
+type FirewallRuleDeleteTarget struct {
+	Scope       filter.Scope `json:"scope" validate:"required"`
+	InstanceKey string       `json:"instanceKey" validate:"required,max=128"`
+}
+
+type FirewallRuleDeleteResponse struct {
+	TaskID    string                      `json:"taskID,omitempty"`
+	Queued    bool                        `json:"queued,omitempty"`
+	Succeeded int                         `json:"succeeded"`
+	Failed    int                         `json:"failed"`
+	Errors    []FirewallRuleDeleteFailure `json:"errors,omitempty"`
+}
+
+type FirewallRuleDeleteFailure struct {
+	Index       int    `json:"index"`
+	InstanceKey string `json:"instanceKey"`
+	Error       string `json:"error"`
+}
+
+type FirewallRuleUpdate struct {
+	FirewallRuleDeleteTarget
+	Rule        *filter.FirewallRule `json:"rule,omitempty" validate:"required_without_all=Description OrderIndex Priority,excluded_with=Description OrderIndex Priority"`
+	Description *string              `json:"description,omitempty" validate:"excluded_with=Rule"`
+	OrderIndex  *int64               `json:"orderIndex,omitempty" validate:"excluded_with=Rule Priority"`
+	Priority    *int                 `json:"priority,omitempty" validate:"excluded_with=Rule OrderIndex"`
+}
+
+type FirewallRuleReorder struct {
+	FirewallRuleDeleteTarget
+	TargetPosition *int64 `json:"targetPosition"`
+	Priority       *int   `json:"priority"`
+}
+
+type FirewallRuleExportItem struct {
+	filter.FirewallRule
+	Raw         string             `json:"raw,omitempty"`
+	ParseStatus filter.ParseStatus `json:"parseStatus,omitempty"`
+}
+
+type FirewallSubsystemBackup struct {
+	Families   []string                        `json:"families,omitempty"`
+	Subsystem  string                          `json:"subsystem"`
+	Provider   filter.Provider                 `json:"provider"`
+	Forwarding []forwarding.Rule               `json:"forwarding"`
+	Docker     *dockerfirewall.PolicyInventory `json:"docker,omitempty"`
 }

agent/app/dto/forwarding.go

@@ -2,13 +2,12 @@ package dto
 
 type ForwardRuleSearch struct {
 	PageInfo
+	All      bool   `json:"all,omitempty"`
 	Info     string `json:"info"`
 	Status   string `json:"status"`
 	Strategy string `json:"strategy"`
 }
 
-// ForwardRule preserves the existing firewall search response shape while
-// keeping forwarding data separate from the filter client model.
 type ForwardRule struct {
 	ID       uint   `json:"id"`
 	Chain    string `json:"chain"`
@@ -28,13 +27,14 @@ type ForwardRule struct {
 }
 
 type ForwardRuleOperate struct {
-	ForceDelete bool                   `json:"forceDelete"`
-	Rules       []ForwardRuleOperation `json:"rules"`
+	Import bool                   `json:"import"`
+	Rules  []ForwardRuleOperation `json:"rules" validate:"required,min=1,dive"`
 }
 
 type ForwardRuleOperation struct {
 	Operation  string `json:"operation" validate:"required,oneof=add remove"`
 	Num        string `json:"num"`
+	Family     string `json:"family" validate:"omitempty,oneof=ipv4 ipv6"`
 	Protocol   string `json:"protocol" validate:"required,oneof=tcp udp tcp/udp"`
 	Interface  string `json:"interface"`
 	Port       string `json:"port" validate:"required"`

agent/app/dto/monitor.go

@@ -1,6 +1,10 @@
 package dto
 
-import "time"
+import (
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+)
 
 type MonitorSearch struct {
 	Param     string    `json:"param" validate:"required,oneof=all cpu memory load io network"`
@@ -26,50 +30,92 @@ type Process struct {
 }
 
 type MonitorSetting struct {
-	MonitorStatus    string `json:"monitorStatus"`
-	MonitorStoreDays string `json:"monitorStoreDays"`
-	MonitorInterval  string `json:"monitorInterval"`
-	DefaultNetwork   string `json:"defaultNetwork"`
-	DefaultIO        string `json:"defaultIO"`
+	GPUMonitorStatus     string `json:"gpuMonitorStatus"`
+	GPUMonitorStoreDays  string `json:"gpuMonitorStoreDays"`
+	GPUMonitorInterval   string `json:"gpuMonitorInterval"`
+	VLLMMonitorStatus    string `json:"vllmMonitorStatus"`
+	VLLMMonitorStoreDays string `json:"vllmMonitorStoreDays"`
+	VLLMMonitorInterval  string `json:"vllmMonitorInterval"`
+	MonitorStatus        string `json:"monitorStatus"`
+	MonitorStoreDays     string `json:"monitorStoreDays"`
+	MonitorInterval      string `json:"monitorInterval"`
+	DefaultNetwork       string `json:"defaultNetwork"`
+	DefaultIO            string `json:"defaultIO"`
 }
 
 type MonitorSettingUpdate struct {
-	Key   string `json:"key" validate:"required,oneof=MonitorStatus MonitorStoreDays MonitorInterval DefaultNetwork DefaultIO"`
+	Key   string `json:"key" validate:"required,oneof=MonitorStatus MonitorStoreDays MonitorInterval GPUMonitorStatus GPUMonitorStoreDays GPUMonitorInterval VLLMMonitorStatus VLLMMonitorStoreDays VLLMMonitorInterval DefaultNetwork DefaultIO"`
 	Value string `json:"value"`
 }
 
 type MonitorGPUOptions struct {
+	Supported bool           `json:"supported"`
 	GPUType   string         `json:"gpuType"`
 	ChartHide []GPUChartHide `json:"chartHide"`
 	Options   []string       `json:"options"`
 }
 type GPUChartHide struct {
+	DeviceID    string `json:"deviceID"`
+	Legacy      bool   `json:"legacy"`
 	ProductName string `json:"productName"`
+	Type        string `json:"type"`
 	Process     bool   `json:"process"`
 	GPU         bool   `json:"gpu"`
 	Memory      bool   `json:"memory"`
 	Power       bool   `json:"power"`
+	PowerLimit  bool   `json:"powerLimit"`
 	Temperature bool   `json:"temperature"`
 	Speed       bool   `json:"speed"`
 }
 type MonitorGPUSearch struct {
+	Aggregation string    `json:"aggregation" validate:"omitempty,oneof=avg max"`
+	DeviceID    string    `json:"deviceID"`
+	Legacy      bool      `json:"legacy"`
 	ProductName string    `json:"productName"`
 	StartTime   time.Time `json:"startTime"`
 	EndTime     time.Time `json:"endTime"`
 }
 type MonitorGPUData struct {
-	Date             []time.Time `json:"date"`
-	GPUValue         []float64   `json:"gpuValue"`
-	TemperatureValue []float64   `json:"temperatureValue"`
-	PowerTotal       []float64   `json:"powerTotal"`
-	PowerUsed        []float64   `json:"powerUsed"`
-	PowerPercent     []float64   `json:"powerPercent"`
-	MemoryTotal      []float64   `json:"memoryTotal"`
-	MemoryUsed       []float64   `json:"memoryUsed"`
-	MemoryPercent    []float64   `json:"memoryPercent"`
-	SpeedValue       []int       `json:"speedValue"`
+	MemoryActivity     []*float64 `json:"memoryActivity"`
+	EncoderUtil        []*float64 `json:"encoderUtil"`
+	DecoderUtil        []*float64 `json:"decoderUtil"`
+	JPEGUtil           []*float64 `json:"jpegUtil"`
+	OFAUtil            []*float64 `json:"ofaUtil"`
+	MediaUtil          []*float64 `json:"mediaUtil"`
+	ComputeUtil        []*float64 `json:"computeUtil"`
+	CopyUtil           []*float64 `json:"copyUtil"`
+	HotspotTemperature []*float64 `json:"hotspotTemperature"`
+	FanRPM             []*float64 `json:"fanRPM"`
+	AICPUUtil          []*float64 `json:"aiCPUUtil"`
+	CtrlCPUUtil        []*float64 `json:"ctrlCPUUtil"`
+	DDRUsed            []*float64 `json:"ddrUsed"`
+	DDRTotal           []*float64 `json:"ddrTotal"`
+	HBMUsed            []*float64 `json:"hbmUsed"`
+	HBMTotal           []*float64 `json:"hbmTotal"`
+	DDRBandwidth       []*float64 `json:"ddrBandwidth"`
+	HBMBandwidth       []*float64 `json:"hbmBandwidth"`
+	MemoryBandwidth    []*float64 `json:"memoryBandwidth"`
+	MediaFrequency     []*float64 `json:"mediaFrequency"`
+	HugepagesUsed      []*float64 `json:"hugepagesUsed"`
+	HugepagesTotal     []*float64 `json:"hugepagesTotal"`
 
-	ProcessCount []int          `json:"processCount"`
+	BucketSeconds          int64       `json:"bucketSeconds"`
+	SampleCount            int64       `json:"sampleCount"`
+	MemoryTemperatureValue []*float64  `json:"memoryTemperatureValue"`
+	FrequencyValue         []*float64  `json:"frequencyValue"`
+	MemoryFrequencyValue   []*float64  `json:"memoryFrequencyValue"`
+	Date                   []time.Time `json:"date"`
+	GPUValue               []*float64  `json:"gpuValue"`
+	TemperatureValue       []*float64  `json:"temperatureValue"`
+	PowerTotal             []*float64  `json:"powerTotal"`
+	PowerUsed              []*float64  `json:"powerUsed"`
+	PowerPercent           []*float64  `json:"powerPercent"`
+	MemoryTotal            []*float64  `json:"memoryTotal"`
+	MemoryUsed             []*float64  `json:"memoryUsed"`
+	MemoryPercent          []*float64  `json:"memoryPercent"`
+	SpeedValue             []*float64  `json:"speedValue"`
+
+	ProcessCount []*float64     `json:"processCount"`
 	GPUProcesses [][]GPUProcess `json:"gpuProcesses"`
 }
 
@@ -79,3 +125,28 @@ type GPUProcess struct {
 	ProcessName string `json:"processName"`
 	UsedMemory  string `json:"usedMemory"`
 }
+
+type MonitorVLLMSearch struct {
+	AppInstallID uint      `json:"appInstallID" validate:"required"`
+	StartTime    time.Time `json:"startTime" validate:"required"`
+	EndTime      time.Time `json:"endTime" validate:"required"`
+	Aggregation  string    `json:"aggregation" validate:"omitempty,oneof=avg max"`
+}
+
+type MonitorVLLMData struct {
+	SampleCount   int64               `json:"sampleCount"`
+	BucketSeconds int64               `json:"bucketSeconds"`
+	Points        []model.MonitorVLLM `json:"points"`
+}
+
+type MonitorVLLMCurrent struct {
+	AppInstallID uint `json:"appInstallID" validate:"required"`
+}
+
+type MonitorVLLMClean struct {
+	AppInstallID uint `json:"appInstallID" validate:"required"`
+}
+
+type MonitorClean struct {
+	Type string `json:"type" validate:"required,oneof=host gpu"`
+}

agent/app/dto/nginx.go

@@ -51,13 +51,19 @@ const (
 	CACHE      NginxKey = "cache"
 	HttpPer    NginxKey = "http-per"
 	ProxyCache NginxKey = "proxy-cache"
+	Brotli     NginxKey = "brotli"
 )
 
+// BrotliKeys are served from the panel-managed http.d file rather than
+// nginx.conf, because the module is optional: its directives must disappear
+// together with the module, otherwise nginx refuses to start.
+var BrotliKeys = []string{"brotli", "brotli_comp_level", "brotli_min_length", "brotli_types"}
+
 var ScopeKeyMap = map[NginxKey][]string{
 	Index:     {"index"},
 	LimitConn: {"limit_conn", "limit_rate", "limit_conn_zone"},
 	SSL:       {"ssl_certificate", "ssl_certificate_key"},
-	HttpPer:   {"server_names_hash_bucket_size", "client_header_buffer_size", "client_max_body_size", "keepalive_timeout", "gzip", "gzip_min_length", "gzip_comp_level"},
+	HttpPer:   {"server_names_hash_bucket_size", "client_header_buffer_size", "client_max_body_size", "keepalive_timeout", "gzip", "gzip_min_length", "gzip_comp_level", "gzip_types", "gzip_vary", "gzip_proxied"},
 }
 
 var StaticFileKeyMap = map[NginxKey]struct {

agent/app/dto/request/app.go

@@ -50,6 +50,10 @@ type AppContainerConfig struct {
 	Type          string  `json:"type"`
 	SpecifyIP     string  `json:"specifyIP"`
 	RestartPolicy string  `json:"restartPolicy" validate:"omitempty,oneof=always unless-stopped no on-failure"`
+
+	KeepServiceName         bool `json:"-"`
+	SkipComposeCommonConfig bool `json:"-"`
+	UseLifecycleScripts     bool `json:"-"`
 }
 
 type AppInstalledSearch struct {
@@ -92,6 +96,8 @@ type AppInstalledOperate struct {
 	TaskID        string              `json:"taskID"`
 	DeleteImage   bool                `json:"deleteImage"`
 	Favorite      bool                `json:"favorite"`
+
+	UseLifecycleScripts bool `json:"-"`
 }
 
 type AppInstallUpgrade struct {
@@ -111,11 +117,14 @@ type AppInstallDelete struct {
 	DeleteDB     bool   `json:"deleteDB"`
 	DeleteImage  bool   `json:"deleteImage"`
 	TaskID       string `json:"taskID"`
+
+	UseLifecycleScripts bool `json:"-"`
 }
 
 type AppInstalledUpdate struct {
 	InstallId uint                   `json:"installId" validate:"required"`
 	Params    map[string]interface{} `json:"params" validate:"required"`
+	TaskID    string                 `json:"-"`
 	AppContainerConfig
 }
 

agent/app/dto/request/file.go

@@ -122,6 +122,7 @@ type FileWget struct {
 	Name              string `json:"name" validate:"required"`
 	IgnoreCertificate bool   `json:"ignoreCertificate"`
 	UseProxy          bool   `json:"useProxy"`
+	UseServerFilename bool   `json:"useServerFilename"`
 }
 
 type FileMove struct {
@@ -131,6 +132,11 @@ type FileMove struct {
 	Name       string   `json:"name"`
 	Cover      bool     `json:"cover"`
 	CoverPaths []string `json:"coverPaths"`
+	TaskID     string   `json:"taskID"`
+}
+
+type FileMoveStopReq struct {
+	TaskID string `json:"taskID" validate:"required"`
 }
 
 type FileDownload struct {
@@ -153,6 +159,10 @@ type FileProcessReq struct {
 	Key string `json:"key"`
 }
 
+type FileProcessRemoveReq struct {
+	Keys []string `json:"keys" validate:"required,min=1,max=1000"`
+}
+
 type FileRoleUpdate struct {
 	Path  string `json:"path" validate:"required"`
 	User  string `json:"user" validate:"required"`

agent/app/dto/request/runtime.go

@@ -66,14 +66,15 @@ type RuntimeDelete struct {
 }
 
 type RuntimeUpdate struct {
-	Name    string `json:"name"`
-	ID      uint   `json:"id"`
-	Image   string `json:"image"`
-	Version string `json:"version"`
-	Rebuild bool   `json:"rebuild"`
-	Source  string `json:"source"`
-	CodeDir string `json:"codeDir"`
-	Remark  string `json:"remark"`
+	AppDetailID uint   `json:"appDetailId"`
+	Name        string `json:"name"`
+	ID          uint   `json:"id"`
+	Image       string `json:"image"`
+	Version     string `json:"version"`
+	Rebuild     bool   `json:"rebuild"`
+	Source      string `json:"source"`
+	CodeDir     string `json:"codeDir"`
+	Remark      string `json:"remark"`
 
 	Params map[string]interface{} `json:"params"`
 	NodeConfig

agent/app/dto/response/nginx.go

@@ -17,6 +17,17 @@ type NginxParam struct {
 	Params []string `json:"params"`
 }
 
+// NginxBrotliRes carries the brotli settings together with where they live.
+// ManagedExternally is true when the user defined brotli by hand, in which
+// case the panel only reports the values and must not write its own copy.
+// ManagedUnavailable is true when the panel could not wire the managed
+// configuration into nginx.conf at all, so the reported values are inert.
+type NginxBrotliRes struct {
+	Params             []NginxParam `json:"params"`
+	ManagedExternally  bool         `json:"managedExternally"`
+	ManagedUnavailable bool         `json:"managedUnavailable"`
+}
+
 type NginxAuthRes struct {
 	Enable bool            `json:"enable"`
 	Items  []dto.NginxAuth `json:"items"`

agent/app/dto/setting.go

@@ -35,7 +35,7 @@ type SettingUpdate struct {
 }
 
 type AgentSettingUpdate struct {
-	Key   string `json:"key" validate:"required,oneof=SystemIP DockerSockPath FileRecycleBin FirewallPortWhiteList"`
+	Key   string `json:"key" validate:"required,oneof=SystemIP DockerSockPath FileRecycleBin"`
 	Value string `json:"value"`
 }
 

agent/app/dto/ssh.go

@@ -25,7 +25,7 @@ type RootCertOperate struct {
 	ID             uint   `json:"id"`
 	Name           string `json:"name"`
 	Mode           string `json:"mode"`
-	EncryptionMode string `json:"encryptionMode" validate:"required,oneof=rsa ed25519 ecdsa dsa"`
+	EncryptionMode string `json:"encryptionMode"`
 	PassPhrase     string `json:"passPhrase"`
 	PublicKey      string `json:"publicKey"`
 	PrivateKey     string `json:"privateKey"`

agent/app/dto/terminal.go

@@ -0,0 +1,11 @@
+package dto
+
+type TerminalSessionClose struct {
+	ID string `json:"id" validate:"required"`
+}
+
+type TerminalSessionRevoke struct {
+	Scope         string `json:"scope" validate:"required,oneof=auth_session user all"`
+	UserID        string `json:"userId"`
+	AuthSessionID string `json:"authSessionId"`
+}

agent/app/model/alert.go

@@ -1,5 +1,12 @@
 package model
 
+import (
+	"strings"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
 type Alert struct {
 	BaseModel
 
@@ -18,10 +25,11 @@ type Alert struct {
 
 type AlertTask struct {
 	BaseModel
-	Type      string `gorm:"type:varchar(64);not null" json:"type"`
-	Quota     string `gorm:"type:varchar(64)" json:"quota"`
-	QuotaType string `gorm:"type:varchar(64)" json:"quotaType"`
-	Method    string `gorm:"type:varchar(128);not null;default:'sms'" json:"method"`
+	Type          string `gorm:"type:varchar(64);not null" json:"type"`
+	Quota         string `gorm:"type:varchar(64)" json:"quota"`
+	QuotaType     string `gorm:"type:varchar(64)" json:"quotaType"`
+	Method        string `gorm:"type:varchar(128);not null;default:'sms'" json:"method"`
+	DeliveryLogID *uint  `gorm:"uniqueIndex" json:"-"`
 }
 
 type AlertLog struct {
@@ -41,12 +49,21 @@ type AlertLog struct {
 
 type AlertConfig struct {
 	BaseModel
-	Type       string `gorm:"type:varchar(64);not null" json:"type"`
-	Title      string `gorm:"type:varchar(64);not null" json:"title"`
-	Status     string `gorm:"type:varchar(64);not null" json:"status"`
-	Config     string `gorm:"type:varchar(256);not null" json:"config"`
-	CreateUser string `gorm:"type:varchar(256)" json:"createUser"`
-	UpdateUser string `gorm:"type:varchar(256)" json:"updateUser"`
+	UID          string `gorm:"type:varchar(64);not null;uniqueIndex" json:"uid"`
+	Type         string `gorm:"type:varchar(64);not null" json:"type"`
+	Title        string `gorm:"type:varchar(64);not null" json:"title"`
+	Status       string `gorm:"type:varchar(64);not null" json:"status"`
+	Config       string `gorm:"type:text;not null" json:"config"`
+	SecretConfig string `gorm:"type:text;not null;default:''" json:"-"`
+	CreateUser   string `gorm:"type:varchar(256)" json:"createUser"`
+	UpdateUser   string `gorm:"type:varchar(256)" json:"updateUser"`
+}
+
+func (a *AlertConfig) BeforeCreate(_ *gorm.DB) error {
+	if strings.TrimSpace(a.UID) == "" {
+		a.UID = uuid.NewString()
+	}
+	return nil
 }
 
 type LoginLog struct {

agent/app/model/firewall.go

@@ -1,18 +0,0 @@
-package model
-
-type Firewall struct {
-	BaseModel
-
-	Type    string `json:"type"`
-	Port    string `json:"port"`    // Deprecated
-	Address string `json:"address"` // Deprecated
-
-	Chain       string `json:"chain"`
-	Protocol    string `json:"protocol"`
-	SrcIP       string `json:"srcIP"`
-	SrcPort     string `json:"srcPort"`
-	DstIP       string `json:"dstIP"`
-	DstPort     string `json:"dstPort"`
-	Strategy    string `gorm:"not null" json:"strategy"`
-	Description string `json:"description"`
-}

agent/app/model/monitor.go

@@ -1,5 +1,7 @@
 package model
 
+import "time"
+
 type MonitorBase struct {
 	BaseModel
 	Cpu         float64     `json:"cpu"`
@@ -33,14 +35,78 @@ type MonitorNetwork struct {
 }
 
 type MonitorGPU struct {
+	MemoryUtil         *float64 `json:"memoryUtil"`
+	MemoryActivity     *float64 `json:"memoryActivity"`
+	EncoderUtil        *float64 `json:"encoderUtil"`
+	DecoderUtil        *float64 `json:"decoderUtil"`
+	JPEGUtil           *float64 `json:"jpegUtil"`
+	OFAUtil            *float64 `json:"ofaUtil"`
+	MediaUtil          *float64 `json:"mediaUtil"`
+	ComputeUtil        *float64 `json:"computeUtil"`
+	CopyUtil           *float64 `json:"copyUtil"`
+	HotspotTemperature *float64 `json:"hotspotTemperature"`
+	FanRPM             *float64 `json:"fanRPM"`
+	AICPUUtil          *float64 `json:"aiCPUUtil"`
+	CtrlCPUUtil        *float64 `json:"ctrlCPUUtil"`
+	DDRUsed            *float64 `json:"ddrUsed"`
+	DDRTotal           *float64 `json:"ddrTotal"`
+	HBMUsed            *float64 `json:"hbmUsed"`
+	HBMTotal           *float64 `json:"hbmTotal"`
+	DDRBandwidth       *float64 `json:"ddrBandwidth"`
+	HBMBandwidth       *float64 `json:"hbmBandwidth"`
+	MemoryBandwidth    *float64 `json:"memoryBandwidth"`
+	MediaFrequency     *float64 `json:"mediaFrequency"`
+	HugepagesUsed      *float64 `json:"hugepagesUsed"`
+	HugepagesTotal     *float64 `json:"hugepagesTotal"`
+
+	MemoryTemperature *float64 `json:"memoryTemperature"`
+	DeviceID          string   `json:"deviceID"`
+	DeviceType        string   `json:"deviceType"`
+	ProcessStatus     string   `json:"processStatus"`
+	Frequency         *float64 `json:"frequency"`
+	MemoryFrequency   *float64 `json:"memoryFrequency"`
+	IntervalSeconds   int      `json:"intervalSeconds"`
 	BaseModel
-	ProductName   string  `json:"productName"`
-	GPUUtil       float64 `json:"gpuUtil"`
-	Temperature   float64 `json:"temperature"`
-	PowerDraw     float64 `json:"powerDraw"`
-	MaxPowerLimit float64 `json:"maxPowerLimit"`
-	MemUsed       float64 `json:"memUsed"`
-	MemTotal      float64 `json:"memTotal"`
-	FanSpeed      int     `json:"fanSpeed"`
-	Processes     string  `json:"processes"`
+	ProductName   string   `json:"productName"`
+	GPUUtil       *float64 `json:"gpuUtil"`
+	Temperature   *float64 `json:"temperature"`
+	PowerDraw     *float64 `json:"powerDraw"`
+	MaxPowerLimit *float64 `json:"maxPowerLimit"`
+	MemUsed       *float64 `json:"memUsed"`
+	MemTotal      *float64 `json:"memTotal"`
+	FanSpeed      *float64 `json:"fanSpeed"`
+	Processes     string   `json:"processes"`
+}
+
+type MonitorVLLM struct {
+	ID              uint      `json:"-" gorm:"primarykey;autoIncrement"`
+	CreatedAt       time.Time `json:"createdAt"`
+	AppInstallID    uint      `json:"appInstallID"`
+	Status          string    `json:"status"`
+	RawMetrics      string    `json:"-"`
+	HistogramDeltas string    `json:"-"`
+
+	Running               *float64 `json:"running"`
+	Waiting               *float64 `json:"waiting"`
+	CacheUsage            *float64 `json:"cacheUsage"`
+	PromptThroughput      *float64 `json:"promptThroughput"`
+	GenerationThroughput  *float64 `json:"generationThroughput"`
+	RequestThroughput     *float64 `json:"requestThroughput"`
+	TimeToFirstToken      *float64 `json:"timeToFirstToken"`
+	TimePerOutputToken    *float64 `json:"timePerOutputToken"`
+	RequestLatency        *float64 `json:"requestLatency"`
+	PrefillTime           *float64 `json:"prefillTime"`
+	DecodeTime            *float64 `json:"decodeTime"`
+	TimeToFirstTokenP50   *float64 `json:"timeToFirstTokenP50"`
+	TimeToFirstTokenP90   *float64 `json:"timeToFirstTokenP90"`
+	TimeToFirstTokenP95   *float64 `json:"timeToFirstTokenP95"`
+	TimeToFirstTokenP99   *float64 `json:"timeToFirstTokenP99"`
+	TimePerOutputTokenP50 *float64 `json:"timePerOutputTokenP50"`
+	TimePerOutputTokenP90 *float64 `json:"timePerOutputTokenP90"`
+	TimePerOutputTokenP95 *float64 `json:"timePerOutputTokenP95"`
+	TimePerOutputTokenP99 *float64 `json:"timePerOutputTokenP99"`
+	RequestLatencyP50     *float64 `json:"requestLatencyP50"`
+	RequestLatencyP90     *float64 `json:"requestLatencyP90"`
+	RequestLatencyP95     *float64 `json:"requestLatencyP95"`
+	RequestLatencyP99     *float64 `json:"requestLatencyP99"`
 }

agent/app/provider/catalog.go

@@ -40,20 +40,30 @@ type Meta struct {
 var catalog = map[string]Meta{
 	"custom": {
 		Key: "custom", DisplayName: "Custom", Sort: 10, DefaultAPIType: "openai-completions", EnvKey: "CUSTOM_API_KEY",
-		APIConfigs: editableAPIConfigs(true, "openai-completions", "openai-responses", "anthropic-messages", "openai-images"),
+		APIConfigs: editableAPIConfigs(true, "openai-completions", "openai-responses", "anthropic-messages", "openai-images", "dashscope-images", "openai-embeddings"),
 	},
 	"ollama": {
 		Key: "ollama", DisplayName: "Ollama", Sort: 15, DefaultAPIType: "openai-responses",
-		APIConfigs: editableAPIConfigs(false, "openai-responses", "openai-completions"),
+		APIConfigs: editableAPIConfigs(false, "openai-responses", "openai-completions", "openai-embeddings"),
+	},
+	// llmman (https://github.com/llmmanorg/llmman): local runner with Ollama/OpenAI-compatible routes on 127.0.0.1:17434.
+	"llmman": {
+		Key: "llmman", DisplayName: "llmman", Sort: 16, DefaultAPIType: "openai-responses",
+		APIConfigs: []APIConfig{
+			{APIType: "openai-responses", BaseURL: "http://127.0.0.1:17434/v1", EditableBaseURL: true},
+			{APIType: "openai-completions", BaseURL: "http://127.0.0.1:17434/v1", EditableBaseURL: true},
+			{APIType: "openai-embeddings", BaseURL: "http://127.0.0.1:17434/v1", EditableBaseURL: true},
+		},
 	},
 	"vllm": {
 		Key: "vllm", DisplayName: "vLLM", Sort: 20, DefaultAPIType: "openai-completions", EnvKey: "VLLM_API_KEY",
-		APIConfigs: editableAPIConfigs(false, "openai-completions", "openai-responses", "anthropic-messages", "openai-images"),
+		APIConfigs: editableAPIConfigs(false, "openai-completions", "openai-responses", "anthropic-messages", "openai-images", "openai-embeddings"),
 	},
 	"deepseek": {
 		Key: "deepseek", DisplayName: "DeepSeek", Sort: 25, DefaultAPIType: "openai-completions", EnvKey: "DEEPSEEK_API_KEY",
 		APIConfigs: []APIConfig{
 			{APIType: "openai-completions", BaseURL: "https://api.deepseek.com"},
+			{APIType: "openai-responses", BaseURL: "https://api.deepseek.com"},
 			anthropicAPIConfig("https://api.deepseek.com/anthropic", AuthModeXAPIKey),
 		},
 		Models: []Model{{ID: "deepseek-v4-flash", Name: "deepseek-v4-flash"}, {ID: "deepseek-v4-pro", Name: "deepseek-v4-pro"}},
@@ -131,6 +141,10 @@ var catalog = map[string]Meta{
 			{APIType: "openai-responses", BaseURL: "https://api.openai.com/v1"},
 			{APIType: "openai-completions", BaseURL: "https://api.openai.com/v1"},
 			{APIType: "openai-images", BaseURL: "https://api.openai.com/v1"},
+			{APIType: "openai-embeddings", BaseURL: "https://api.openai.com/v1", Models: []Model{
+				{ID: "text-embedding-3-small", Name: "text-embedding-3-small"},
+				{ID: "text-embedding-3-large", Name: "text-embedding-3-large"},
+			}},
 		},
 		Models: []Model{{ID: "gpt-5.4", Name: "gpt-5.4"}, {ID: "gpt-5.4-pro", Name: "gpt-5.4-pro"}, {ID: "gpt-5.4-mini", Name: "gpt-5.4-mini"}, {ID: "gpt-5.4-nano", Name: "gpt-5.4-nano"}},
 	},
@@ -296,7 +310,7 @@ func DefaultModels(key, apiType string) []Model {
 		if len(config.Models) > 0 {
 			return append([]Model(nil), config.Models...)
 		}
-		if IsImageAPIType(config.APIType) {
+		if IsImageAPIType(config.APIType) || IsEmbeddingAPIType(config.APIType) {
 			return nil
 		}
 		break
@@ -359,7 +373,7 @@ func ResolveBaseURL(key, apiType, requested string) (string, error) {
 	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
 		return "", fmt.Errorf("invalid base url")
 	}
-	if key == "custom" && IsImageAPIType(config.APIType) {
+	if key == "custom" && (IsImageAPIType(config.APIType) || IsEmbeddingAPIType(config.APIType)) {
 		return baseURL, nil
 	}
 	parsed.Path = normalizeEndpointPath(config.APIType, parsed.Path)
@@ -381,6 +395,8 @@ func normalizeEndpointPath(apiType, value string) string {
 		suffixes = []string{"/responses"}
 	case "anthropic-messages":
 		suffixes = []string{"/v1/messages", "/messages"}
+	case "openai-embeddings":
+		suffixes = []string{"/v1/embeddings", "/embeddings"}
 	}
 	for _, suffix := range suffixes {
 		if strings.HasSuffix(strings.ToLower(path), suffix) {
@@ -390,6 +406,10 @@ func normalizeEndpointPath(apiType, value string) string {
 	return path
 }
 
+func IsEmbeddingAPIType(apiType string) bool {
+	return apiType == "openai-embeddings"
+}
+
 func IsImageAPIType(apiType string) bool {
 	switch apiType {
 	case "openai-images", "dashscope-images", "minimax-images", "openrouter-images":
@@ -442,6 +462,7 @@ var legacyModelPrefixes = map[string][]string{
 	"custom":              {"custom"},
 	"vllm":                {"custom"},
 	"ollama":              {"ollama"},
+	"llmman":              {"llmman"},
 	"deepseek":            {"deepseek"},
 	"bailian-coding-plan": {"bailian-coding-plan"},
 	"ark-coding-plan":     {"ark-coding-plan"},

agent/app/provider/openclaw.go

@@ -23,7 +23,7 @@ func BuildOpenClawProviderPatch(provider, modelName, apiType, authMode, baseURL,
 	if _, ok := FindAPIConfig(provider, resolvedAPIType); !ok {
 		resolvedAPIType = DefaultAPIType(provider)
 	}
-	if IsImageAPIType(resolvedAPIType) {
+	if IsImageAPIType(resolvedAPIType) || IsEmbeddingAPIType(resolvedAPIType) {
 		return nil, fmt.Errorf("api type %s does not support text generation", resolvedAPIType)
 	}
 	resolvedAuthMode, err := ResolveAuthMode(provider, resolvedAPIType, authMode)
@@ -43,8 +43,8 @@ func BuildOpenClawProviderPatch(provider, modelName, apiType, authMode, baseURL,
 		providerKey = "moonshot"
 		resolvedAPIType = "openai-completions"
 		usesBearer = false
-	case "ollama":
-		apiKey = "ollama"
+	case "ollama", "llmman":
+		apiKey = provider
 		usesBearer = false
 	case "openai", "openrouter", "anthropic":
 		preserveQualifiedModel = strings.Contains(modelName, "/")

agent/app/provider/verify.go

@@ -27,11 +27,14 @@ type verifyErrorResponse struct {
 	Message string `json:"message"`
 }
 
-const defaultVerifyTimeout = 30 * time.Second
+const (
+	defaultVerifyTimeout   = 30 * time.Second
+	defaultVerifyMaxTokens = 16
+)
 
 func SkipVerification(provider string) bool {
 	switch provider {
-	case "vllm", "ollama", "kimi-coding":
+	case "vllm", "ollama", "llmman", "kimi-coding":
 		return true
 	default:
 		return false
@@ -81,6 +84,10 @@ func BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model stri
 	}
 
 	switch apiType {
+	case "openai-embeddings":
+		request.URL = embeddingVerifyURL(baseURL)
+		headers["Authorization"] = "Bearer " + apiKey
+		request.Body = mustJSON(map[string]interface{}{"model": model, "input": "ping"})
 	case "openai-images":
 		request.URL = imageVerifyURL(provider, baseURL, "/images/generations")
 		headers["Authorization"] = "Bearer " + apiKey
@@ -112,25 +119,36 @@ func BuildVerifyRequest(provider, apiType, authMode, baseURL, apiKey, model stri
 		}
 		headers["anthropic-version"] = "2023-06-01"
 		request.Body = mustJSON(map[string]interface{}{
-			"model": model, "max_tokens": 1, "stream": false,
+			"model": model, "max_tokens": defaultVerifyMaxTokens, "stream": false,
 			"messages": []map[string]interface{}{{"role": "user", "content": []map[string]string{{"type": "text", "text": "test"}}}},
 		})
 	case "openai-responses":
 		request.URL = baseURL + "/responses"
 		headers["Authorization"] = "Bearer " + apiKey
-		request.Body = mustJSON(map[string]interface{}{"model": model, "input": "test", "max_output_tokens": 1, "stream": false})
+		request.Body = mustJSON(map[string]interface{}{"model": model, "input": "test", "max_output_tokens": defaultVerifyMaxTokens, "stream": false})
 	default:
 		request.URL = baseURL + "/chat/completions"
-		if provider != "ollama" || strings.TrimSpace(apiKey) != "" {
+		if (provider != "ollama" && provider != "llmman") || strings.TrimSpace(apiKey) != "" {
 			headers["Authorization"] = "Bearer " + apiKey
 		}
 		request.Body = mustJSON(map[string]interface{}{
-			"model": model, "messages": []map[string]string{{"role": "user", "content": "test"}}, "max_tokens": 1, "stream": false,
+			"model": model, "messages": []map[string]string{{"role": "user", "content": "test"}}, "max_tokens": defaultVerifyMaxTokens, "stream": false,
 		})
 	}
 	return request
 }
 
+func embeddingVerifyURL(baseURL string) string {
+	lowerBaseURL := strings.ToLower(baseURL)
+	if strings.HasSuffix(lowerBaseURL, "/embeddings") {
+		return baseURL
+	}
+	if strings.HasSuffix(lowerBaseURL, "/v1") {
+		return baseURL + "/embeddings"
+	}
+	return baseURL + "/v1/embeddings"
+}
+
 func imageVerifyURL(provider, baseURL, endpoint string) string {
 	if provider == "custom" || strings.HasSuffix(strings.ToLower(baseURL), endpoint) {
 		return baseURL

agent/app/repo/agent_account.go

@@ -86,7 +86,7 @@ func (a AgentAccountRepo) CountTextByProviders(providers []string) (map[string]i
 		Model(&model.AgentAccount{}).
 		Select("provider, COUNT(*) as count").
 		Where("provider IN ?", normalizedProviders).
-		Where("api_type NOT LIKE ?", "%-images").
+		Scopes(WithTextAPIType()).
 		Group("provider").
 		Scan(&rows).Error; err != nil {
 		return nil, err

agent/app/repo/alert.go

@@ -1,20 +1,30 @@
 package repo
 
 import (
+	"encoding/base64"
 	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/google/uuid"
 	"google.golang.org/genproto/googleapis/type/date"
 	"gorm.io/gorm"
-	"strconv"
-	"time"
+	"gorm.io/gorm/clause"
 )
 
 type AlertRepo struct{}
 
+var (
+	ErrAlertConfigRevisionConflict = errors.New("alert config revision conflict")
+	ErrAlertConfigRevisionRequired = errors.New("alert config revision is required")
+)
+
 type IAlertRepo interface {
 	WithByType(alertType string) DBOption
 	WithByStatusIn(status []string) DBOption
@@ -24,6 +34,7 @@ type IAlertRepo interface {
 	WithByCreateAt(date *date.Date) DBOption
 	WithByLicenseId(licenseId string) DBOption
 	WithByRecordId(recordId uint) DBOption
+	WithByDeliveryLogID(logID uint) DBOption
 	WithByAlertMethodContainsConfigID(id uint) DBOption
 	WithByMethodConfigIDs(ids []uint) DBOption
 
@@ -45,6 +56,8 @@ type IAlertRepo interface {
 	CleanAlertLogs() error
 
 	CreateAlertTask(alertTaskBase *model.AlertTask) error
+	CreatePendingAlertTask(logID, alertID uint, alertTask *model.AlertTask) (bool, error)
+	FinalizePendingAlertTask(logID uint, succeeded bool, message string, fallback *model.AlertTask) (bool, error)
 	DeleteAlertTask(opts ...DBOption) error
 	GetAlertTask(opts ...DBOption) (model.AlertTask, error)
 	LoadTaskCount(alertType string, project string, method string) (uint, uint, error)
@@ -55,6 +68,7 @@ type IAlertRepo interface {
 	GetConfigById(id uint) (model.AlertConfig, error)
 	AlertConfigList(opts ...DBOption) ([]model.AlertConfig, error)
 	UpdateAlertConfig(maps map[string]interface{}, opts ...DBOption) error
+	UpdateAlertConfigWithRevision(maps map[string]interface{}, revision *time.Time, opts ...DBOption) error
 	CreateAlertConfig(config *model.AlertConfig) error
 	DeleteAlertConfig(opts ...DBOption) error
 
@@ -223,13 +237,78 @@ func (a *AlertRepo) DeleteLog(opts ...DBOption) error {
 }
 
 func (a *AlertRepo) CleanAlertLogs() error {
-	return global.AlertDB.Where("1 = 1").Delete(&model.AlertLog{}).Error
+	return global.AlertDB.Where("status <> ?", constant.AlertPushing).Delete(&model.AlertLog{}).Error
 }
 
 func (a *AlertRepo) CreateAlertTask(alertTaskBase *model.AlertTask) error {
 	return global.AlertDB.Model(&model.AlertTask{}).Create(&alertTaskBase).Error
 }
 
+func (a *AlertRepo) CreatePendingAlertTask(logID, alertID uint, alertTask *model.AlertTask) (bool, error) {
+	if alertTask == nil {
+		return false, fmt.Errorf("pending alert task is required")
+	}
+	created := false
+	err := global.AlertDB.Transaction(func(tx *gorm.DB) error {
+		var log model.AlertLog
+		if err := tx.Where("id = ? AND status = ?", logID, constant.AlertPushing).First(&log).Error; err != nil {
+			return err
+		}
+		if log.AlertId != alertID || log.Type != alertTask.Type || log.Method != alertTask.Method {
+			return fmt.Errorf("pending alert task does not match delivery log %d", logID)
+		}
+		alertTask.DeliveryLogID = &logID
+		result := tx.Clauses(clause.OnConflict{
+			Columns:   []clause.Column{{Name: "delivery_log_id"}},
+			DoNothing: true,
+		}).Create(alertTask)
+		if result.Error != nil {
+			return result.Error
+		}
+		created = result.RowsAffected > 0
+		return nil
+	})
+	return created, err
+}
+
+func (a *AlertRepo) FinalizePendingAlertTask(logID uint, succeeded bool, message string, fallback *model.AlertTask) (bool, error) {
+	finalized := false
+	err := global.AlertDB.Transaction(func(tx *gorm.DB) error {
+		status := constant.AlertError
+		if succeeded {
+			status = constant.AlertSuccess
+			message = ""
+		}
+		result := tx.Model(&model.AlertLog{}).
+			Where("id = ? AND status = ?", logID, constant.AlertPushing).
+			Updates(map[string]interface{}{"status": status, "message": message})
+		if result.Error != nil {
+			return result.Error
+		}
+		if result.RowsAffected == 0 {
+			return nil
+		}
+		finalized = true
+		if !succeeded {
+			return tx.Where("delivery_log_id = ?", logID).Delete(&model.AlertTask{}).Error
+		}
+
+		var count int64
+		if err := tx.Model(&model.AlertTask{}).Where("delivery_log_id = ?", logID).Count(&count).Error; err != nil {
+			return err
+		}
+		if count > 0 {
+			return nil
+		}
+		if fallback == nil {
+			return fmt.Errorf("pending alert task metadata is unavailable for delivery log %d", logID)
+		}
+		fallback.DeliveryLogID = &logID
+		return tx.Create(fallback).Error
+	})
+	return finalized, err
+}
+
 func (a *AlertRepo) DeleteAlertTask(opts ...DBOption) error {
 	db, _ := getAlertDB(opts...)
 	return db.Delete(&model.AlertTask{}).Error
@@ -310,7 +389,23 @@ func (a *AlertRepo) UpdateAlertConfig(maps map[string]interface{}, opts ...DBOpt
 	return db.Model(&model.AlertConfig{}).Updates(maps).Error
 }
 
+func (a *AlertRepo) UpdateAlertConfigWithRevision(maps map[string]interface{}, revision *time.Time, opts ...DBOption) error {
+	if revision == nil {
+		return a.UpdateAlertConfig(maps, opts...)
+	}
+	db, _ := getAlertDB(opts...)
+	result := db.Model(&model.AlertConfig{}).Where("updated_at = ?", *revision).Updates(maps)
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected == 0 {
+		return ErrAlertConfigRevisionConflict
+	}
+	return nil
+}
+
 func (a *AlertRepo) CreateAlertConfig(config *model.AlertConfig) error {
+	ensureAlertConfigUID(config)
 	return global.AlertDB.Model(&model.AlertConfig{}).Create(config).Error
 }
 
@@ -338,6 +433,12 @@ func (a *AlertRepo) WithByTypeNotIn(types []string) DBOption {
 	}
 }
 
+func (a *AlertRepo) WithByDeliveryLogID(logID uint) DBOption {
+	return func(g *gorm.DB) *gorm.DB {
+		return g.Where("delivery_log_id = ?", logID)
+	}
+}
+
 func (a *AlertRepo) PageAlertConfig(page, size int, opts ...DBOption) (int64, []model.AlertConfig, error) {
 	var configs []model.AlertConfig
 	db := global.AlertDB.Model(&model.AlertConfig{})
@@ -378,26 +479,44 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 		return err
 	}
 
-	oldConfigMap := make(map[string]uint)
+	oldConfigMap := make(map[string]model.AlertConfig)
+	oldConfigByUID := make(map[string]model.AlertConfig)
 	oldConfigByType := make(map[string][]model.AlertConfig)
 	oldConfigByKey := make(map[string][]model.AlertConfig)
 	consumedConfigIDs := make(map[uint]struct{})
 	for _, item := range oldConfigs {
+		if strings.TrimSpace(item.UID) != "" {
+			oldConfigByUID[item.UID] = item
+		}
 		if singletonTypes[item.Type] {
-			oldConfigMap[item.Type] = item.ID
+			oldConfigMap[item.Type] = item
 			continue
 		}
 		oldConfigByType[item.Type] = append(oldConfigByType[item.Type], item)
 		oldConfigByKey[alertConfigSyncKey(item)] = append(oldConfigByKey[alertConfigSyncKey(item)], item)
 	}
 	for _, item := range data {
+		if uid := strings.TrimSpace(item.UID); uid != "" {
+			if matched, ok := oldConfigByUID[uid]; ok && matched.Type != item.Type {
+				tx.Rollback()
+				return fmt.Errorf("alert config UID %q belongs to type %q, not %q", uid, matched.Type, item.Type)
+			}
+		}
 		if singletonTypes[item.Type] {
-			if val, ok := oldConfigMap[item.Type]; ok {
-				item.ID = val
+			if matched, ok := oldConfigMap[item.Type]; ok {
+				if err := inheritAlertConfigSyncState(&item, matched); err != nil {
+					tx.Rollback()
+					return err
+				}
 				delete(oldConfigMap, item.Type)
 				consumedConfigIDs[item.ID] = struct{}{}
 			} else {
 				item.ID = 0
+				ensureAlertConfigUID(&item)
+				if err := validateAlertConfigSyncSecret(&item); err != nil {
+					tx.Rollback()
+					return err
+				}
 			}
 			if item.ID == 0 {
 				if err := tx.Create(&item).Error; err != nil {
@@ -411,9 +530,31 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 			continue
 		}
 
+		if strings.TrimSpace(item.UID) != "" {
+			if matched, ok := oldConfigByUID[item.UID]; ok {
+				delete(oldConfigByUID, item.UID)
+				if err := inheritAlertConfigSyncState(&item, matched); err != nil {
+					tx.Rollback()
+					return err
+				}
+				consumedConfigIDs[item.ID] = struct{}{}
+				if err := tx.Save(&item).Error; err != nil {
+					tx.Rollback()
+					return err
+				}
+				deleteAlertConfigByID(oldConfigByType, matched.ID)
+				deleteAlertConfigByID(oldConfigByKey, matched.ID)
+				continue
+			}
+		}
+
 		key := alertConfigSyncKey(item)
 		if matched, ok := popAlertConfigByKey(oldConfigByKey, key); ok {
-			item.ID = matched.ID
+			delete(oldConfigByUID, matched.UID)
+			if err := inheritAlertConfigSyncState(&item, matched); err != nil {
+				tx.Rollback()
+				return err
+			}
 			consumedConfigIDs[item.ID] = struct{}{}
 			if err := tx.Save(&item).Error; err != nil {
 				tx.Rollback()
@@ -424,7 +565,12 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 		}
 
 		if matched, ok := popUnusedAlertConfigByType(oldConfigByType, usedConfigIDs, item.Type); ok {
-			item.ID = matched.ID
+			delete(oldConfigByUID, matched.UID)
+			deleteAlertConfigByID(oldConfigByKey, matched.ID)
+			if err := inheritAlertConfigSyncState(&item, matched); err != nil {
+				tx.Rollback()
+				return err
+			}
 			consumedConfigIDs[item.ID] = struct{}{}
 			if err := tx.Save(&item).Error; err != nil {
 				tx.Rollback()
@@ -434,6 +580,11 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 		}
 
 		item.ID = 0
+		ensureAlertConfigUID(&item)
+		if err := validateAlertConfigSyncSecret(&item); err != nil {
+			tx.Rollback()
+			return err
+		}
 		if err := tx.Create(&item).Error; err != nil {
 			tx.Rollback()
 			return err
@@ -458,6 +609,63 @@ func (a *AlertRepo) SyncAll(data []model.AlertConfig) error {
 	return nil
 }
 
+func ensureAlertConfigUID(config *model.AlertConfig) {
+	if config != nil && strings.TrimSpace(config.UID) == "" {
+		config.UID = uuid.NewString()
+	}
+}
+
+func inheritAlertConfigSyncState(incoming *model.AlertConfig, existing model.AlertConfig) error {
+	if incoming.Type != existing.Type {
+		return fmt.Errorf("alert config UID %q belongs to type %q, not %q", incoming.UID, existing.Type, incoming.Type)
+	}
+	preserveExistingCustom := incoming.Type == constant.Custom &&
+		existing.Status == constant.AlertDisable &&
+		incoming.Title == existing.Title &&
+		incoming.Status == existing.Status &&
+		incoming.Config == existing.Config &&
+		(incoming.SecretConfig == "" || incoming.SecretConfig == existing.SecretConfig)
+	incoming.ID = existing.ID
+	if strings.TrimSpace(incoming.UID) == "" {
+		incoming.UID = existing.UID
+	}
+	if incoming.Type == constant.Custom && incoming.SecretConfig == "" {
+		incoming.SecretConfig = existing.SecretConfig
+	}
+	if preserveExistingCustom {
+		return nil
+	}
+	return validateAlertConfigSyncSecret(incoming)
+}
+
+func validateAlertConfigSyncSecret(incoming *model.AlertConfig) error {
+	if incoming.Type != constant.Custom {
+		incoming.SecretConfig = ""
+		return nil
+	}
+	if strings.TrimSpace(incoming.SecretConfig) == "" {
+		return fmt.Errorf("custom webhook sync secret is missing")
+	}
+	var version struct {
+		SchemaVersion int `json:"schemaVersion"`
+	}
+	if err := json.Unmarshal([]byte(incoming.Config), &version); err != nil || version.SchemaVersion != 1 {
+		return fmt.Errorf("custom webhook sync config must use schemaVersion 1")
+	}
+	secret := incoming.SecretConfig
+	for _, prefix := range []string{"core:v1:", "agent:v1:"} {
+		if !strings.HasPrefix(secret, prefix) {
+			continue
+		}
+		ciphertext, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(secret, prefix))
+		if err != nil || len(ciphertext) < 32 || len(ciphertext)%16 != 0 {
+			return fmt.Errorf("custom webhook sync secret envelope is invalid")
+		}
+		return nil
+	}
+	return fmt.Errorf("custom webhook sync secret must use a versioned envelope")
+}
+
 func loadUsedAlertConfigIDs(tx *gorm.DB) (map[uint]struct{}, error) {
 	var alerts []model.Alert
 	if err := tx.Select("method").Find(&alerts).Error; err != nil {

agent/app/repo/common.go

@@ -108,7 +108,7 @@ func WithByAPIType(apiType string) DBOption {
 
 func WithTextAPIType() DBOption {
 	return func(g *gorm.DB) *gorm.DB {
-		return g.Where("api_type NOT LIKE ?", "%-images")
+		return g.Where("api_type NOT LIKE ? AND api_type <> ?", "%-images", "openai-embeddings")
 	}
 }
 

agent/app/repo/host.go

@@ -22,11 +22,6 @@ type IHostRepo interface {
 	WithByPort(port uint) DBOption
 	WithByUser(user string) DBOption
 
-	GetFirewallRecord(opts ...DBOption) (model.Firewall, error)
-	ListFirewallRecord(opts ...DBOption) ([]model.Firewall, error)
-	SaveFirewallRecord(firewall *model.Firewall) error
-	DeleteFirewallRecordByID(id uint) error
-
 	SyncCert(data []model.RootCert) error
 	GetCert(opts ...DBOption) (model.RootCert, error)
 	PageCert(limit, offset int, opts ...DBOption) (int64, []model.RootCert, error)
@@ -34,8 +29,6 @@ type IHostRepo interface {
 	SaveCert(cert *model.RootCert) error
 	UpdateCert(id uint, vars map[string]interface{}) error
 	DeleteCert(opts ...DBOption) error
-
-	WithByChain(chain string) DBOption
 }
 
 func NewIHostRepo() IHostRepo {
@@ -116,65 +109,6 @@ func (h *HostRepo) Delete(opts ...DBOption) error {
 	return db.Delete(&model.Host{}).Error
 }
 
-func (h *HostRepo) GetFirewallRecord(opts ...DBOption) (model.Firewall, error) {
-	var firewall model.Firewall
-	db := global.DB
-	for _, opt := range opts {
-		db = opt(db)
-	}
-	err := db.First(&firewall).Error
-	return firewall, err
-}
-
-func (h *HostRepo) ListFirewallRecord(opts ...DBOption) ([]model.Firewall, error) {
-	var firewalls []model.Firewall
-	db := global.DB
-	for _, opt := range opts {
-		db = opt(db)
-	}
-	if err := global.DB.Find(&firewalls).Error; err != nil {
-		return firewalls, nil
-	}
-	return firewalls, nil
-}
-
-func (h *HostRepo) SaveFirewallRecord(firewall *model.Firewall) error {
-	if firewall.ID != 0 {
-		return global.DB.Save(firewall).Error
-	}
-	var data model.Firewall
-	switch firewall.Type {
-	case "port":
-		_ = global.DB.Where("type = ? AND dst_port = ? AND protocol = ? AND src_ip = ? AND strategy = ?", "port",
-			firewall.DstPort,
-			firewall.Protocol,
-			firewall.SrcIP,
-			firewall.Strategy,
-		).First(&data).Error
-	case "ip":
-		_ = global.DB.Where("type = ? AND src_ip = ? AND strategy = ?", "address", firewall.SrcIP, firewall.Strategy).First(&data)
-	default:
-		_ = global.DB.Where("type = ? AND chain = ? AND src_port = ? AND dst_port = ? AND protocol = ? AND src_ip = ? AND dst_ip = ? AND strategy = ?",
-			firewall.Type,
-			firewall.Chain,
-			firewall.SrcPort,
-			firewall.DstPort,
-			firewall.Protocol,
-			firewall.SrcIP,
-			firewall.DstIP,
-			firewall.Strategy,
-		).First(&data).Error
-	}
-	if data.ID != 0 {
-		firewall.ID = data.ID
-	}
-	return global.DB.Save(firewall).Error
-}
-
-func (h *HostRepo) DeleteFirewallRecordByID(id uint) error {
-	return global.DB.Where("id = ?", id).Delete(&model.Firewall{}).Error
-}
-
 func (u *HostRepo) GetCert(opts ...DBOption) (model.RootCert, error) {
 	var cert model.RootCert
 	db := global.DB
@@ -253,9 +187,3 @@ func (u *HostRepo) SyncCert(data []model.RootCert) error {
 	tx.Commit()
 	return nil
 }
-
-func (u *HostRepo) WithByChain(chain string) DBOption {
-	return func(g *gorm.DB) *gorm.DB {
-		return g.Where("chain = ?", chain)
-	}
-}

agent/app/repo/monitor.go

@@ -1,6 +1,8 @@
 package repo
 
 import (
+	"fmt"
+	"strings"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
@@ -10,11 +12,25 @@ import (
 
 type MonitorRepo struct{}
 
+type GPUHistoryPoint struct {
+	model.MonitorGPU
+	Bucket        int64
+	PowerPercent  *float64
+	MemoryPercent *float64
+	ProcessCount  *float64
+}
+
 type IMonitorRepo interface {
+	CleanHost() error
+	CleanGPU() error
 	GetBase(opts ...DBOption) ([]model.MonitorBase, error)
-	GetGPU(opts ...DBOption) ([]model.MonitorGPU, error)
+	CountGPU(opts ...DBOption) (int64, error)
+	GetGPUHistory(start time.Time, bucketSeconds int64, aggregation string, opts ...DBOption) ([]GPUHistoryPoint, error)
+	GetGPUDevices() ([]model.MonitorGPU, error)
 	GetIO(opts ...DBOption) ([]model.MonitorIO, error)
 	GetNetwork(opts ...DBOption) ([]model.MonitorNetwork, error)
+	GetIONames() ([]string, error)
+	GetNetworkNames() ([]string, error)
 
 	CreateMonitorBase(model model.MonitorBase) error
 	BatchCreateMonitorGPU(list []model.MonitorGPU) error
@@ -25,13 +41,26 @@ type IMonitorRepo interface {
 	DelMonitorIO(timeForDelete time.Time) error
 	DelMonitorNet(timeForDelete time.Time) error
 
-	WithByProductName(name string) DBOption
+	WithByGPUDevice(deviceID, name string, legacy bool) DBOption
 }
 
 func NewIMonitorRepo() IMonitorRepo {
 	return &MonitorRepo{}
 }
 
+func (s *MonitorRepo) CleanHost() error {
+	for _, item := range []interface{}{&model.MonitorBase{}, &model.MonitorIO{}, &model.MonitorNetwork{}} {
+		if err := global.MonitorDB.Where("1 = 1").Delete(item).Error; err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (s *MonitorRepo) CleanGPU() error {
+	return global.GPUMonitorDB.Where("1 = 1").Delete(&model.MonitorGPU{}).Error
+}
+
 func (u *MonitorRepo) GetBase(opts ...DBOption) ([]model.MonitorBase, error) {
 	var data []model.MonitorBase
 	db := global.MonitorDB
@@ -59,20 +88,25 @@ func (u *MonitorRepo) GetNetwork(opts ...DBOption) ([]model.MonitorNetwork, erro
 	err := db.Find(&data).Error
 	return data, err
 }
-func (u *MonitorRepo) GetGPU(opts ...DBOption) ([]model.MonitorGPU, error) {
-	var data []model.MonitorGPU
-	db := global.GPUMonitorDB
-	for _, opt := range opts {
-		db = opt(db)
-	}
-	err := db.Find(&data).Error
-	return data, err
+func (u *MonitorRepo) GetIONames() ([]string, error) {
+	var names []string
+	err := global.MonitorDB.Model(&model.MonitorIO{}).Distinct().Pluck("name", &names).Error
+	return names, err
+}
+
+func (u *MonitorRepo) GetNetworkNames() ([]string, error) {
+	var names []string
+	err := global.MonitorDB.Model(&model.MonitorNetwork{}).Distinct().Pluck("name", &names).Error
+	return names, err
 }
 
 func (u *MonitorRepo) CreateMonitorBase(model model.MonitorBase) error {
 	return global.MonitorDB.Create(&model).Error
 }
 func (s *MonitorRepo) BatchCreateMonitorGPU(list []model.MonitorGPU) error {
+	if len(list) == 0 {
+		return nil
+	}
 	return global.GPUMonitorDB.CreateInBatches(&list, len(list)).Error
 }
 func (u *MonitorRepo) BatchCreateMonitorIO(ioList []model.MonitorIO) error {
@@ -94,8 +128,67 @@ func (s *MonitorRepo) DelMonitorGPU(timeForDelete time.Time) error {
 	return global.GPUMonitorDB.Where("created_at < ?", timeForDelete).Delete(&model.MonitorGPU{}).Error
 }
 
-func (s *MonitorRepo) WithByProductName(name string) DBOption {
-	return func(g *gorm.DB) *gorm.DB {
-		return g.Where("product_name = ?", name)
+func (u *MonitorRepo) GetGPUDevices() ([]model.MonitorGPU, error) {
+	var data []model.MonitorGPU
+	err := global.GPUMonitorDB.Model(&model.MonitorGPU{}).Select("device_id, product_name, device_type").Group("device_id, product_name, device_type").Order("product_name, device_id").Find(&data).Error
+	return data, err
+}
+
+func (u *MonitorRepo) WithByGPUDevice(deviceID, name string, legacy bool) DBOption {
+	return func(db *gorm.DB) *gorm.DB {
+		if deviceID != "" {
+			return db.Where("device_id = ?", deviceID)
+		}
+		db = db.Where("product_name = ?", name)
+		if legacy {
+			db = db.Where("device_id IS NULL OR device_id = ''")
+		}
+		return db
 	}
 }
+
+func (u *MonitorRepo) CountGPU(opts ...DBOption) (int64, error) {
+	db := global.GPUMonitorDB.Model(&model.MonitorGPU{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	var count int64
+	err := db.Count(&count).Error
+	return count, err
+}
+
+func (u *MonitorRepo) GetGPUHistory(start time.Time, bucketSeconds int64, aggregation string, opts ...DBOption) ([]GPUHistoryPoint, error) {
+	db := global.GPUMonitorDB.Model(&model.MonitorGPU{})
+	for _, opt := range opts {
+		db = opt(db)
+	}
+	expressions := []string{
+		"CASE WHEN max_power_limit > 0 THEN 100.0 * power_draw / max_power_limit END",
+		"CASE WHEN mem_total > 0 AND mem_used IS NOT NULL THEN 100.0 * mem_used / mem_total ELSE memory_util END",
+		"CASE WHEN (process_status = 'ok' OR process_status IS NULL OR process_status = '') AND json_valid(processes) THEN CASE WHEN json_type(processes) = 'array' THEN json_array_length(processes) END END",
+	}
+	aliases := []string{"power_percent", "memory_percent", "process_count"}
+	columns := []string{"*"}
+	if bucketSeconds > 0 {
+		operation := "AVG"
+		if aggregation == "max" {
+			operation = "MAX"
+		}
+		columns = []string{fmt.Sprintf("(CAST(strftime('%%s', created_at) AS INTEGER) - %d) / %d AS bucket", start.Unix(), bucketSeconds)}
+		for _, column := range []string{"memory_activity", "encoder_util", "decoder_util", "jpeg_util", "ofa_util", "media_util", "compute_util", "copy_util", "hotspot_temperature", "fan_rpm", "ai_cpu_util", "ctrl_cpu_util", "ddr_used", "ddr_total", "hbm_used", "hbm_total", "ddr_bandwidth", "hbm_bandwidth", "memory_bandwidth", "media_frequency", "hugepages_used", "hugepages_total", "gpu_util", "temperature", "memory_temperature", "power_draw", "max_power_limit", "mem_used", "mem_total", "frequency", "memory_frequency", "fan_speed"} {
+			columns = append(columns, operation+"("+column+") AS "+column)
+		}
+		for i := range expressions {
+			expressions[i] = operation + "(" + expressions[i] + ")"
+		}
+		db = db.Group("bucket").Order("bucket ASC")
+	} else {
+		db = db.Order("created_at ASC, id ASC")
+	}
+	for i, expression := range expressions {
+		columns = append(columns, expression+" AS "+aliases[i])
+	}
+	var data []GPUHistoryPoint
+	err := db.Select(strings.Join(columns, ", ")).Scan(&data).Error
+	return data, err
+}

agent/app/repo/monitor_vllm.go

@@ -0,0 +1,78 @@
+package repo
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"gorm.io/gorm"
+)
+
+type VLLMMonitorRepo struct{}
+
+type VLLMHistoryPoint struct {
+	model.MonitorVLLM
+	Bucket           int64
+	HistogramSamples string
+}
+
+func (r *VLLMMonitorRepo) Create(point *model.MonitorVLLM) error {
+	return global.VLLMMonitorDB.Create(point).Error
+}
+
+func (r *VLLMMonitorRepo) Latest(id uint) (model.MonitorVLLM, error) {
+	var point model.MonitorVLLM
+	db := global.VLLMMonitorDB.Where("app_install_id = ?", id)
+	err := db.Order("created_at DESC, id DESC").First(&point).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return point, nil
+	}
+	return point, err
+}
+
+func (r *VLLMMonitorRepo) CleanTarget(id uint) error {
+	return global.VLLMMonitorDB.Where("app_install_id = ?", id).Delete(&model.MonitorVLLM{}).Error
+}
+
+func (r *VLLMMonitorRepo) DeleteBefore(before time.Time) error {
+	return global.VLLMMonitorDB.Where("created_at < ?", before).Delete(&model.MonitorVLLM{}).Error
+}
+
+func (r *VLLMMonitorRepo) Count(id uint, start, end time.Time) (int64, error) {
+	var count int64
+	db := global.VLLMMonitorDB.Model(&model.MonitorVLLM{}).Where("app_install_id = ? AND created_at >= ? AND created_at <= ?", id, start, end)
+	err := db.Count(&count).Error
+	return count, err
+}
+
+func (r *VLLMMonitorRepo) History(id uint, start, end time.Time, seconds int64, aggregation string) ([]VLLMHistoryPoint, error) {
+	db := global.VLLMMonitorDB.Model(&model.MonitorVLLM{}).Where("app_install_id = ? AND created_at >= ? AND created_at <= ?", id, start, end)
+	metrics := []string{"running", "waiting", "cache_usage", "prompt_throughput", "generation_throughput", "request_throughput", "time_to_first_token", "time_per_output_token", "request_latency", "prefill_time", "decode_time", "time_to_first_token_p50", "time_to_first_token_p90", "time_to_first_token_p95", "time_to_first_token_p99", "time_per_output_token_p50", "time_per_output_token_p90", "time_per_output_token_p95", "time_per_output_token_p99", "request_latency_p50", "request_latency_p90", "request_latency_p95", "request_latency_p99"}
+	var columns []string
+	if seconds > 0 {
+		operation := "AVG"
+		if aggregation == "max" {
+			operation = "MAX"
+		}
+		columns = []string{fmt.Sprintf("(CAST(strftime('%%s', created_at) AS INTEGER) - %d) / %d AS bucket", start.Unix(), seconds)}
+		for _, column := range metrics {
+			if aggregation != "max" && (strings.HasPrefix(column, "time_to_first_token_p") || strings.HasPrefix(column, "time_per_output_token_p") || strings.HasPrefix(column, "request_latency_p")) {
+				continue
+			}
+			columns = append(columns, operation+"("+column+") AS "+column)
+		}
+		if aggregation != "max" {
+			columns = append(columns, "json_group_array(json(NULLIF(histogram_deltas, ''))) AS histogram_samples")
+		}
+		db = db.Group("bucket").Order("bucket ASC")
+	} else {
+		columns = append([]string{"id", "created_at", "app_install_id", "status"}, metrics...)
+		db = db.Order("created_at ASC, id ASC")
+	}
+	var points []VLLMHistoryPoint
+	err := db.Select(strings.Join(columns, ", ")).Scan(&points).Error
+	return points, err
+}

agent/app/repo/setting.go

@@ -1,11 +1,13 @@
 package repo
 
 import (
+	"context"
 	"errors"
 
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 type SettingRepo struct{}
@@ -19,12 +21,16 @@ type ISettingRepo interface {
 	WithByKey(key string) DBOption
 
 	UpdateOrCreate(key, value string) error
+	UpdateValues(map[string]string) error
 
 	GetDescription(opts ...DBOption) (model.CommonDescription, error)
 	GetDescriptionList(opts ...DBOption) ([]model.CommonDescription, error)
 	CreateDescription(data *model.CommonDescription) error
+	SaveDescriptions(context.Context, []model.CommonDescription) error
 	UpdateDescription(id string, val map[string]interface{}) error
 	DelDescription(id string) error
+	DeleteDescriptions(context.Context, string, []string, bool) (int64, error)
+	WithDescriptionIDs(ids []string) DBOption
 	WithByDescriptionID(id string) DBOption
 }
 
@@ -90,6 +96,25 @@ func (s *SettingRepo) UpdateOrCreate(key, value string) error {
 	return global.DB.Model(&setting).UpdateColumn("value", value).Error
 }
 
+func (s *SettingRepo) UpdateValues(values map[string]string) error {
+	return global.DB.Transaction(func(tx *gorm.DB) error {
+		for key, value := range values {
+			var setting model.Setting
+			err := tx.Where("key = ?", key).First(&setting).Error
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				if err := tx.Create(&model.Setting{Key: key, Value: value}).Error; err != nil {
+					return err
+				}
+			} else if err != nil {
+				return err
+			} else if err := tx.Model(&setting).UpdateColumn("value", value).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
 func (s *SettingRepo) GetDescriptionList(opts ...DBOption) ([]model.CommonDescription, error) {
 	var lists []model.CommonDescription
 	db := global.DB.Model(&model.CommonDescription{})
@@ -111,14 +136,42 @@ func (s *SettingRepo) GetDescription(opts ...DBOption) (model.CommonDescription,
 func (s *SettingRepo) CreateDescription(data *model.CommonDescription) error {
 	return global.DB.Create(data).Error
 }
+
+func (s *SettingRepo) SaveDescriptions(ctx context.Context, descriptions []model.CommonDescription) error {
+	return global.DB.WithContext(ctx).Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "id"}},
+		DoUpdates: clause.AssignmentColumns([]string{"description"}),
+	}).CreateInBatches(&descriptions, 100).Error
+}
+
 func (s *SettingRepo) UpdateDescription(id string, val map[string]interface{}) error {
 	return global.DB.Model(&model.CommonDescription{}).Where("id = ?", id).Updates(val).Error
 }
 func (s *SettingRepo) DelDescription(id string) error {
 	return global.DB.Where("id = ?", id).Delete(&model.CommonDescription{}).Error
 }
+
+func (s *SettingRepo) DeleteDescriptions(ctx context.Context, kind string, ids []string, emptyOnly bool) (int64, error) {
+	var deleted int64
+	for start := 0; start < len(ids); start += 500 {
+		query := global.DB.WithContext(ctx).Where("type = ? AND id IN ?", kind, ids[start:min(start+500, len(ids))])
+		if emptyOnly {
+			query = query.Where("description = ? AND is_pinned = ?", "", false)
+		}
+		result := query.Delete(&model.CommonDescription{})
+		deleted += result.RowsAffected
+		if result.Error != nil {
+			return deleted, result.Error
+		}
+	}
+	return deleted, nil
+}
 func (s *SettingRepo) WithByDescriptionID(id string) DBOption {
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Where("id = ?", id)
 	}
 }
+
+func (s *SettingRepo) WithDescriptionIDs(ids []string) DBOption {
+	return func(db *gorm.DB) *gorm.DB { return db.Where("id IN ?", ids) }
+}

agent/app/service/agents.go

@@ -936,6 +936,7 @@ func (a AgentService) GetModelConfig(req dto.AgentIDReq) (*dto.AgentModelConfig,
 		AccountID: agent.AccountID,
 		Model:     model,
 		Fallbacks: extractOpenclawFallbackModelIDs(conf, account, models, model),
+		Metadata:  extractOpenclawModelMetadata(conf, account, models),
 	}, nil
 }
 
@@ -967,7 +968,7 @@ func (a AgentService) UpdateModelConfig(req dto.AgentModelConfigUpdateReq) error
 		if agent.AgentType != constant.AppOpenclaw {
 			return fmt.Errorf("%s does not support", agent.AgentType)
 		}
-		if err := writeOpenclawConfig(confDir, account, modelName, agent.Token, nil, req.Fallbacks); err != nil {
+		if err := writeOpenclawConfig(confDir, account, modelName, agent.Token, nil, req.Fallbacks, req.Metadata); err != nil {
 			return err
 		}
 	}
@@ -1684,7 +1685,7 @@ func (a AgentService) syncAgentsByAccount(account *model.AgentAccount) error {
 				return err
 			}
 			fallbacks := extractOpenclawFallbackModelIDs(conf, account, accountModels, selectedAccountModel.ID)
-			if err := writeOpenclawConfig(confDir, account, modelName, agent.Token, nil, fallbacks); err != nil {
+			if err := writeOpenclawConfig(confDir, account, modelName, agent.Token, nil, fallbacks, nil); err != nil {
 				return err
 			}
 		case constant.AppHermesAgent:

agent/app/service/agents_channels.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -1320,6 +1321,10 @@ func appendPluginAllow(conf map[string]interface{}, pluginID string) {
 }
 
 func installOpenclawPlugin(mgr *cmd.CommandHelper, containerName, spec, pluginID string) error {
+	help, err := cmd.RunDockerExecWithStdout(time.Minute, containerName, "openclaw", "plugins", "install", "--help")
+	if err != nil {
+		return err
+	}
 	workdir := path.Join(openclawPluginPackageTmpDir, pluginID)
 	defer func() {
 		_ = mgr.Run("docker", "exec", containerName, "rm", "-rf", workdir)
@@ -1341,7 +1346,19 @@ func installOpenclawPlugin(mgr *cmd.CommandHelper, containerName, spec, pluginID
 	if pkgPath == "" {
 		return fmt.Errorf("openclaw plugin package not found")
 	}
-	return mgr.Run("docker", "exec", containerName, "openclaw", "plugins", "install", pkgPath, "--dangerously-force-unsafe-install")
+	args := []string{"exec", containerName, "openclaw", "plugins", "install", pkgPath}
+	// Newer CLIs require source confirmation; older releases do not support --force.
+	options := strings.Fields(help)
+	if slices.Contains(options, "--force") {
+		args = append(args, "--force")
+	} else if slices.Contains(options, "--dangerously-force-unsafe-install") {
+		args = append(args, "--dangerously-force-unsafe-install")
+	}
+	// Source confirmation does not grant the selected channel plugin's capabilities.
+	if slices.Contains(options, "--accept-capabilities") {
+		args = append(args, "--accept-capabilities")
+	}
+	return mgr.Run("docker", args...)
 }
 
 func uninstallOpenclawPlugin(mgr *cmd.CommandHelper, containerName, pluginID string) error {

agent/app/service/agents_utils.go

@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"path"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -116,7 +117,7 @@ func resolveAgentAccountInput(provider, apiType, authMode, apiKey, baseURL, mode
 		return resolvedAgentAccountInput{}, buserr.New("ErrAgentAccountModelsRequired")
 	}
 	imageAPI := providercatalog.IsImageAPIType(resolvedAPIType)
-	if validateAvailability && (imageAPI || !providercatalog.SkipVerification(provider)) {
+	if validateAvailability && (imageAPI || providercatalog.IsEmbeddingAPIType(resolvedAPIType) || !providercatalog.SkipVerification(provider)) {
 		if err := providercatalog.VerifyAccount(provider, resolvedAPIType, resolvedAuthMode, resolvedBaseURL, resolvedAPIKey, modelID); err != nil {
 			return resolvedAgentAccountInput{}, err
 		}
@@ -737,9 +738,11 @@ type modelProvider struct {
 }
 
 type modelEntry struct {
-	ID    string   `json:"id"`
-	Name  string   `json:"name"`
-	Input []string `json:"input,omitempty"`
+	ID            string   `json:"id"`
+	Name          string   `json:"name"`
+	Input         []string `json:"input,omitempty"`
+	ContextWindow int      `json:"contextWindow,omitempty"`
+	MaxTokens     int      `json:"maxTokens,omitempty"`
 }
 
 func requiresOpenclawProviderModels(provider string) bool {
@@ -767,7 +770,7 @@ type browserConfig struct {
 	DefaultProfile string `json:"defaultProfile"`
 }
 
-func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName, token string, allowedOrigins []string, fallbacks []string) error {
+func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName, token string, allowedOrigins []string, fallbacks []string, metadata []dto.AgentModelMetadata) error {
 	if strings.TrimSpace(confDir) == "" {
 		return fmt.Errorf("config dir is required")
 	}
@@ -852,6 +855,7 @@ func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName,
 		}
 		conf = initial
 	} else {
+		preserveOpenclawModelMetadata(conf, cfg.Models)
 		if err := applyOpenclawModelsConfig(conf, cfg.Models); err != nil {
 			return err
 		}
@@ -906,6 +910,9 @@ func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName,
 	if allowedOrigins != nil {
 		setSecurityConfig(conf, dto.AgentSecurityConfig{AllowedOrigins: allowedOrigins})
 	}
+	if err := applyOpenclawModelMetadata(conf, account, metadata); err != nil {
+		return err
+	}
 	if err := writeOpenclawConfigRaw(configPath, conf); err != nil {
 		return err
 	}
@@ -920,6 +927,144 @@ func writeOpenclawConfig(confDir string, account *model.AgentAccount, modelName,
 	return writeAgentEnvMap(path.Join(confDir, ".env"), envMap, order)
 }
 
+func readOpenclawModelsConfig(conf map[string]interface{}) *modelsConfig {
+	raw, ok := conf["models"]
+	if !ok {
+		return nil
+	}
+	payload, err := json.Marshal(raw)
+	if err != nil {
+		return nil
+	}
+	var models modelsConfig
+	if err := json.Unmarshal(payload, &models); err != nil {
+		return nil
+	}
+	return &models
+}
+
+func preserveOpenclawModelMetadata(conf map[string]interface{}, next *modelsConfig) {
+	current := readOpenclawModelsConfig(conf)
+	if current == nil || next == nil {
+		return
+	}
+	for providerID, nextProvider := range next.Providers {
+		currentProvider, ok := current.Providers[providerID]
+		if !ok {
+			continue
+		}
+		byID := make(map[string]modelEntry, len(currentProvider.Models))
+		for _, entry := range currentProvider.Models {
+			byID[entry.ID] = entry
+		}
+		for index := range nextProvider.Models {
+			currentEntry, ok := byID[nextProvider.Models[index].ID]
+			if !ok {
+				continue
+			}
+			nextProvider.Models[index].Input = currentEntry.Input
+			nextProvider.Models[index].ContextWindow = currentEntry.ContextWindow
+			nextProvider.Models[index].MaxTokens = currentEntry.MaxTokens
+		}
+		next.Providers[providerID] = nextProvider
+	}
+}
+
+func extractOpenclawModelMetadata(conf map[string]interface{}, account *model.AgentAccount, accountModels []dto.AgentAccountModel) []dto.AgentModelMetadata {
+	result := make([]dto.AgentModelMetadata, 0, len(accountModels))
+	configured := readOpenclawModelsConfig(conf)
+	for _, item := range accountModels {
+		_, inferred, providerID, _, err := buildOpenclawAccountModelConfig(account, item)
+		if err != nil {
+			continue
+		}
+		metadata := dto.AgentModelMetadata{Model: item.ID, InputMode: "auto"}
+		if configured != nil {
+			for _, entry := range configured.Providers[providerID].Models {
+				if entry.ID != inferred.ID {
+					continue
+				}
+				metadata.ContextWindow = entry.ContextWindow
+				metadata.MaxTokens = entry.MaxTokens
+				if len(entry.Input) > 0 && !slices.Equal(entry.Input, inferred.Input) {
+					if slices.Contains(entry.Input, "image") {
+						metadata.InputMode = "image"
+					} else {
+						metadata.InputMode = "text"
+					}
+				}
+				break
+			}
+		}
+		result = append(result, metadata)
+	}
+	return result
+}
+
+func applyOpenclawModelMetadata(conf map[string]interface{}, account *model.AgentAccount, requested []dto.AgentModelMetadata) error {
+	if len(requested) == 0 {
+		return nil
+	}
+	configured := readOpenclawModelsConfig(conf)
+	if configured == nil {
+		return fmt.Errorf("model metadata is not supported for provider %s", account.Provider)
+	}
+	accountModels, err := loadAgentAccountModels(account)
+	if err != nil {
+		return err
+	}
+	available := make(map[string]dto.AgentAccountModel, len(accountModels))
+	for _, item := range accountModels {
+		available[item.ID] = item
+	}
+	seen := make(map[string]struct{}, len(requested))
+	for _, metadata := range requested {
+		item, ok := available[metadata.Model]
+		if !ok {
+			return buserr.New("ErrAgentModelNotInAccount")
+		}
+		if _, ok := seen[metadata.Model]; ok {
+			return fmt.Errorf("duplicate model metadata: %s", metadata.Model)
+		}
+		seen[metadata.Model] = struct{}{}
+		_, inferred, providerID, _, err := buildOpenclawAccountModelConfig(account, item)
+		if err != nil {
+			return err
+		}
+		provider := configured.Providers[providerID]
+		found := false
+		for index := range provider.Models {
+			if provider.Models[index].ID != inferred.ID {
+				continue
+			}
+			found = true
+			provider.Models[index].ContextWindow = metadata.ContextWindow
+			provider.Models[index].MaxTokens = metadata.MaxTokens
+			switch metadata.InputMode {
+			case "auto":
+				provider.Models[index].Input = inferred.Input
+			case "text":
+				provider.Models[index].Input = []string{"text"}
+			case "image":
+				provider.Models[index].Input = []string{"text", "image"}
+			default:
+				return fmt.Errorf("unsupported model input mode: %s", metadata.InputMode)
+			}
+			break
+		}
+		if !found {
+			return buserr.New("ErrAgentModelNotInAccount")
+		}
+		configured.Providers[providerID] = provider
+	}
+	modelsMap, err := structToMap(configured)
+	if err != nil {
+		return err
+	}
+	conf["models"] = modelsMap
+	return nil
+}
+
 func resolveOpenclawFallbackModels(account *model.AgentAccount, primaryModel string, fallbackIDs []string) ([]string, error) {
 	accountModels, err := loadAgentAccountModels(account)
 	if err != nil {
@@ -1041,7 +1186,7 @@ func prepareOpenclawInstallFiles(appInstall *model.AppInstall, account *model.Ag
 		return fmt.Errorf("app install is required")
 	}
 	confDir := path.Join(appInstall.GetPath(), "data", "conf")
-	if err := writeOpenclawConfig(confDir, account, modelName, token, allowedOrigins, nil); err != nil {
+	if err := writeOpenclawConfig(confDir, account, modelName, token, allowedOrigins, nil, nil); err != nil {
 		return err
 	}
 	dataDir := path.Join(appInstall.GetPath(), "data")
@@ -1338,7 +1483,7 @@ func normalizeAgentAccountModel(account *model.AgentAccount, model dto.AgentAcco
 
 func requiresInitialAgentAccountModels(provider string) bool {
 	switch provider {
-	case "custom", "vllm", "ollama":
+	case "custom", "vllm", "ollama", "llmman":
 		return true
 	default:
 		return false

agent/app/service/alert.go

@@ -4,11 +4,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"mime"
-	"sort"
 	"strconv"
 	"strings"
-	"sync"
-	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
@@ -17,11 +14,13 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
-	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	alertUtil "github.com/1Panel-dev/1Panel/agent/utils/alert"
+	alertconfig "github.com/1Panel-dev/1Panel/agent/utils/alert_config"
+	alertwebhook "github.com/1Panel-dev/1Panel/agent/utils/alert_webhook"
 	"github.com/1Panel-dev/1Panel/agent/utils/copier"
 	"github.com/1Panel-dev/1Panel/agent/utils/email"
 	"github.com/1Panel-dev/1Panel/agent/utils/xpack"
-	"github.com/shirou/gopsutil/v4/disk"
+	"github.com/1Panel-dev/1Panel/agent/utils/xpack/providers"
 )
 
 type AlertService struct{}
@@ -34,6 +33,28 @@ var communityAlertMethodTypeNames = map[string]string{
 	constant.SMS:      "SMS",
 }
 
+var legacyAlertMethodTypeMap = map[string]string{
+	"mail":            constant.Email,
+	constant.Email:    constant.Email,
+	constant.SMS:      constant.SMS,
+	constant.Bark:     constant.Bark,
+	constant.WeChat:   constant.WeCom,
+	constant.WeCom:    constant.WeCom,
+	constant.DingTalk: constant.DingTalk,
+	constant.FeiShu:   constant.FeiShu,
+	constant.Custom:   constant.Custom,
+}
+
+var supportedAlertMethodTypes = map[string]struct{}{
+	constant.Email:    {},
+	constant.SMS:      {},
+	constant.Bark:     {},
+	constant.WeCom:    {},
+	constant.DingTalk: {},
+	constant.FeiShu:   {},
+	constant.Custom:   {},
+}
+
 type IAlertService interface {
 	PageAlert(req dto.AlertSearch) (int64, []dto.AlertDTO, error)
 	GetAlerts() ([]dto.AlertDTO, error)
@@ -53,8 +74,10 @@ type IAlertService interface {
 	GetAlertConfig(req dto.AlertConfigQuery) ([]model.AlertConfig, error)
 	PageAlertConfig(req dto.AlertConfigPageReq) (int64, []model.AlertConfig, error)
 	UpdateAlertConfig(req dto.AlertConfigUpdate, operator string) error
+	UpdateAlertConfigStatus(req dto.AlertConfigStatusUpdate, operator string) error
 	DeleteAlertConfig(id uint) error
 	TestAlertConfig(req dto.AlertConfigTest) (bool, error)
+	TestCustomAlertConfig(req dto.AlertConfigTest) (dto.AlertConfigTestResult, error)
 }
 
 func NewIAlertService() IAlertService {
@@ -82,7 +105,38 @@ func (a AlertService) PageAlert(search dto.AlertSearch) (int64, []dto.AlertDTO,
 		return 0, nil, err
 	}
 
+	cronjobProjects := make(map[string]uint)
+	var cronjobIDs []uint
 	for _, item := range alerts {
+		if alertUtil.GetCronJobType(item.Type) != "cronJob" {
+			continue
+		}
+		if _, exists := cronjobProjects[item.Project]; exists {
+			continue
+		}
+		id, parseErr := strconv.ParseUint(item.Project, 10, strconv.IntSize)
+		if parseErr != nil || id == 0 {
+			continue
+		}
+		cronjobProjects[item.Project] = uint(id)
+		cronjobIDs = append(cronjobIDs, uint(id))
+	}
+	cronjobsByID := make(map[uint]model.Cronjob)
+	if len(cronjobIDs) > 0 {
+		cronjobs, err := cronjobRepo.List(repo.WithByIDs(cronjobIDs))
+		if err != nil {
+			return 0, nil, err
+		}
+		for _, cronjob := range cronjobs {
+			cronjobsByID[cronjob.ID] = cronjob
+		}
+	}
+
+	for _, item := range alerts {
+		var taskName string
+		if cronjob, exists := cronjobsByID[cronjobProjects[item.Project]]; exists && cronjob.Type == item.Type {
+			taskName = cronjob.Name
+		}
 
 		result = append(result, dto.AlertDTO{
 			ID:             item.ID,
@@ -92,6 +146,7 @@ func (a AlertService) PageAlert(search dto.AlertSearch) (int64, []dto.AlertDTO,
 			Method:         item.Method,
 			Title:          item.Title,
 			Project:        item.Project,
+			TaskName:       taskName,
 			Status:         item.Status,
 			SendCount:      item.SendCount,
 			AdvancedParams: item.AdvancedParams,
@@ -163,6 +218,16 @@ func (a AlertService) CreateAlert(create dto.AlertCreate, operator string) error
 			return err
 		}
 	} else {
+		advanced, err := prepareCronJobAlertParams(create.Type, "", create.AdvancedParams)
+		if err != nil {
+			return err
+		}
+		create.AdvancedParams = advanced
+		if create.Status != constant.AlertDisable {
+			if err := a.validateCronJobAlertChannels(create.Type, advanced, create.Method); err != nil {
+				return err
+			}
+		}
 		alertInfo.Status = constant.AlertEnable
 		if err := copier.Copy(&alertInfo, &create); err != nil {
 			return buserr.WithErr("ErrStructTransform", err)
@@ -180,9 +245,28 @@ func (a AlertService) CreateAlert(create dto.AlertCreate, operator string) error
 }
 
 func (a AlertService) UpdateAlert(req dto.AlertUpdate, operator string) error {
-	if err := a.validateCommunityAlertMethod(req.Method); err != nil {
+	if alertUtil.GetCronJobType(req.Type) == "cronJob" {
+		previous, err := alertRepo.Get(repo.WithByID(req.ID))
+		if err != nil {
+			return err
+		}
+		req.AdvancedParams, err = prepareCronJobAlertParams(req.Type, previous.AdvancedParams, req.AdvancedParams)
+		if err != nil {
+			return err
+		}
+	}
+	methodTypes, err := a.validateAlertMethodReferences(req.Method)
+	if err != nil {
 		return err
 	}
+	if req.Status != constant.AlertDisable {
+		if err := a.validateCronJobAlertChannels(req.Type, req.AdvancedParams, req.Method); err != nil {
+			return err
+		}
+		if err := a.validateAlertMethodEntitlement(methodTypes); err != nil {
+			return err
+		}
+	}
 
 	upMap := make(map[string]interface{})
 	upMap["id"] = req.ID
@@ -240,7 +324,19 @@ func (a AlertService) UpdateStatus(id uint, status string) error {
 	if alertInfo.ID == 0 {
 		return buserr.New("ErrRecordNotFound")
 	}
-	err := alertRepo.Update(map[string]interface{}{"status": status}, repo.WithByID(alertInfo.ID))
+	methodTypes, err := a.validateAlertMethodReferences(alertInfo.Method)
+	if err != nil {
+		return err
+	}
+	if status == constant.AlertEnable {
+		if err := a.validateCronJobAlertChannels(alertInfo.Type, alertInfo.AdvancedParams, alertInfo.Method); err != nil {
+			return err
+		}
+		if err := a.validateAlertMethodEntitlement(methodTypes); err != nil {
+			return err
+		}
+	}
+	err = alertRepo.Update(map[string]interface{}{"status": status}, repo.WithByID(alertInfo.ID))
 	if err != nil {
 		return err
 	}
@@ -257,122 +353,14 @@ func (a AlertService) UpdateStatus(id uint, status string) error {
 }
 
 func (a AlertService) GetDisks() ([]dto.DiskDTO, error) {
-	var disks []dto.DiskDTO
-	excludes := map[string]struct{}{
-		"/mnt/cdrom": {}, "/boot": {}, "/boot/efi": {}, "/dev": {}, "/dev/shm": {},
-		"/run/lock": {}, "/run": {}, "/run/shm": {}, "/run/user": {},
+	infos := loadDiskInfo(true)
+	disks := make([]dto.DiskDTO, 0, len(infos))
+	for _, item := range infos {
+		disks = append(disks, dto.DiskDTO(item))
 	}
-	stdout, err := executeDiskCommand()
-	if err != nil {
-		return disks, nil
-	}
-
-	lines := strings.Split(stdout, "\n")
-	var mounts []dto.AlertDiskInfo
-
-	for _, line := range lines {
-		fields := strings.Fields(line)
-		if len(fields) < 7 {
-			continue
-		}
-		mountPoint := strings.Join(fields[6:], " ")
-		if shouldExclude(fields, mountPoint, excludes) {
-			continue
-		}
-		mounts = append(mounts, dto.AlertDiskInfo{Type: fields[1], Device: fields[0], Mount: mountPoint})
-
-	}
-
-	var (
-		wg sync.WaitGroup
-		mu sync.Mutex
-	)
-	wg.Add(len(mounts))
-	for i := 0; i < len(mounts); i++ {
-		go func(timeoutCh <-chan time.Time, mount dto.AlertDiskInfo) {
-			defer wg.Done()
-
-			var itemData dto.DiskDTO
-			itemData.Path = mount.Mount
-			itemData.Type = mount.Type
-			itemData.Device = mount.Device
-			select {
-			case <-timeoutCh:
-				mu.Lock()
-				disks = append(disks, itemData)
-				mu.Unlock()
-				global.LOG.Errorf("load disk info from %s failed, err: timeout", mount.Mount)
-			default:
-				state, err := disk.Usage(mount.Mount)
-				if err != nil {
-					mu.Lock()
-					disks = append(disks, itemData)
-					mu.Unlock()
-					global.LOG.Errorf("load disk info from %s failed, err: %v", mount.Mount, err)
-					return
-				}
-				itemData.Total = state.Total
-				itemData.Free = state.Free
-				itemData.Used = state.Used
-				itemData.UsedPercent = state.UsedPercent
-				itemData.InodesTotal = state.InodesTotal
-				itemData.InodesUsed = state.InodesUsed
-				itemData.InodesFree = state.InodesFree
-				itemData.InodesUsedPercent = state.InodesUsedPercent
-				mu.Lock()
-				disks = append(disks, itemData)
-				mu.Unlock()
-			}
-		}(time.After(5*time.Second), mounts[i])
-	}
-	wg.Wait()
-
-	sort.Slice(disks, func(i, j int) bool {
-		return disks[i].Path < disks[j].Path
-	})
 	return disks, nil
 }
 
-func executeDiskCommand() (string, error) {
-	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(2 * time.Second))
-	stdout, err := cmdMgr.RunWithStdout("df", "-hT", "-P")
-	if err != nil {
-		cmdMgr2 := cmd.NewCommandMgr(cmd.WithTimeout(1 * time.Second))
-		stdout, err = cmdMgr2.RunWithStdout("df", "-lhT", "-P")
-	}
-	if err != nil {
-		return stdout, err
-	}
-	var lines []string
-	for _, line := range strings.Split(stdout, "\n") {
-		if !strings.Contains(line, "/") || strings.Contains(line, "tmpfs") || strings.Contains(line, "snap/core") || strings.Contains(line, "udev") {
-			continue
-		}
-		lines = append(lines, line)
-	}
-	if len(lines) == 0 {
-		return "", nil
-	}
-	return strings.Join(lines, "\n"), nil
-}
-
-func shouldExclude(fields []string, mountPoint string, excludes map[string]struct{}) bool {
-	if strings.HasPrefix(mountPoint, "/snap") || len(strings.Split(mountPoint, "/")) > 10 {
-		return true
-	}
-	if strings.TrimSpace(fields[1]) == "tmpfs" {
-		return true
-	}
-	if strings.Contains(fields[2], "K") {
-		return true
-	}
-	if strings.Contains(mountPoint, "docker") {
-		return true
-	}
-	_, excluded := excludes[mountPoint]
-	return excluded
-}
-
 func (a AlertService) PageAlertLogs(search dto.AlertLogSearch) (int64, []dto.AlertLogDTO, error) {
 	var (
 		opts   []repo.DBOption
@@ -412,6 +400,7 @@ func (a AlertService) parseAlertLog(item model.AlertLog) (dto.AlertLogDTO, error
 	if err := unmarshalAlertInfo(item.AlertDetail, &alertDetail); err != nil {
 		return dto.AlertLogDTO{}, err
 	}
+	alertDetail.Task = nil
 	if err := unmarshalAlertInfo(item.AlertRule, &alertRule); err != nil {
 		return dto.AlertLogDTO{}, err
 	}
@@ -494,7 +483,13 @@ func (a AlertService) GetAlertConfig(req dto.AlertConfigQuery) ([]model.AlertCon
 	}
 	opts = append(opts, repo.WithByStatus(constant.AlertEnable))
 	configs, err := alertRepo.AlertConfigList(opts...)
-	return configs, err
+	if err != nil {
+		return nil, err
+	}
+	if err := exposeCustomAlertConfigSecrets(configs); err != nil {
+		return nil, err
+	}
+	return configs, nil
 }
 
 func (a AlertService) PageAlertConfig(req dto.AlertConfigPageReq) (int64, []model.AlertConfig, error) {
@@ -505,13 +500,49 @@ func (a AlertService) PageAlertConfig(req dto.AlertConfigPageReq) (int64, []mode
 	if len(req.ExcludeTypes) > 0 {
 		opts = append(opts, alertRepo.WithByTypeNotIn(req.ExcludeTypes))
 	}
-	return alertRepo.PageAlertConfig(req.Page, req.PageSize, opts...)
+	total, configs, err := alertRepo.PageAlertConfig(req.Page, req.PageSize, opts...)
+	if err != nil {
+		return 0, nil, err
+	}
+	if err := exposeCustomAlertConfigSecrets(configs); err != nil {
+		return 0, nil, err
+	}
+	return total, configs, nil
 }
 
 func (a AlertService) UpdateAlertConfig(req dto.AlertConfigUpdate, operator string) error {
+	if req.Type == constant.Custom {
+		if req.ID != 0 && req.Revision == nil {
+			return repo.ErrAlertConfigRevisionRequired
+		}
+		return a.updateCustomAlertConfig(req, operator)
+	}
+	usesMutation, err := alertconfig.UsesMutation(req.Type, req.Config)
+	if err != nil {
+		return err
+	}
+	if req.ID != 0 && usesMutation && req.Revision == nil {
+		return repo.ErrAlertConfigRevisionRequired
+	}
+	var existing *model.AlertConfig
+	if req.ID != 0 {
+		stored, err := alertRepo.GetConfigById(req.ID)
+		if err != nil {
+			return err
+		}
+		if stored.Type != req.Type {
+			return fmt.Errorf("alert config %d has type %s, not %s", req.ID, stored.Type, req.Type)
+		}
+		existing = &stored
+	}
 	if err := a.validateCommunityAlertConfigType(req.Type); err != nil {
 		return err
 	}
+	prepared, err := alertconfig.Prepare(req.Type, req.Config, req.Status, existing)
+	if err != nil {
+		return err
+	}
+	req.Config = prepared
 	if err := a.checkAlertConfigDisplayNameUnique(req); err != nil {
 		return err
 	}
@@ -526,7 +557,7 @@ func (a AlertService) UpdateAlertConfig(req dto.AlertConfigUpdate, operator stri
 		upMap["status"] = req.Status
 		upMap["config"] = req.Config
 		upMap["update_user"] = operator
-		if err := alertRepo.UpdateAlertConfig(upMap, repo.WithByID(req.ID)); err != nil {
+		if err := alertRepo.UpdateAlertConfigWithRevision(upMap, req.Revision, repo.WithByID(req.ID)); err != nil {
 			return err
 		}
 	} else {
@@ -544,6 +575,99 @@ func (a AlertService) UpdateAlertConfig(req dto.AlertConfigUpdate, operator stri
 	return nil
 }
 
+func (a AlertService) updateCustomAlertConfig(req dto.AlertConfigUpdate, operator string) error {
+	if err := validateAlertConfigStatus(req.Status); err != nil {
+		return err
+	}
+
+	var existing *model.AlertConfig
+	if req.ID != 0 {
+		config, err := alertRepo.GetConfigById(req.ID)
+		if err != nil {
+			return err
+		}
+		if config.Type != constant.Custom {
+			return fmt.Errorf("alert config %d is not a custom webhook", req.ID)
+		}
+		existing = &config
+	}
+	prepared, err := alertwebhook.Prepare(req.Config, req.Status, existing)
+	if err != nil {
+		return err
+	}
+	validatedReq := req
+	validatedReq.Config = prepared.Config
+	if err := a.checkAlertConfigDisplayNameUnique(validatedReq); err != nil {
+		return err
+	}
+
+	if existing != nil {
+		return alertRepo.UpdateAlertConfigWithRevision(map[string]interface{}{
+			"type":          constant.Custom,
+			"title":         req.Title,
+			"status":        req.Status,
+			"config":        prepared.Config,
+			"secret_config": prepared.SecretConfig,
+			"update_user":   operator,
+		}, req.Revision, repo.WithByID(req.ID))
+	}
+
+	return alertRepo.CreateAlertConfig(&model.AlertConfig{
+		Type:         constant.Custom,
+		Title:        req.Title,
+		Status:       req.Status,
+		Config:       prepared.Config,
+		SecretConfig: prepared.SecretConfig,
+		CreateUser:   operator,
+		UpdateUser:   operator,
+	})
+}
+
+func (a AlertService) UpdateAlertConfigStatus(req dto.AlertConfigStatusUpdate, operator string) error {
+	if err := validateAlertConfigStatus(req.Status); err != nil {
+		return err
+	}
+	config, err := alertRepo.GetConfigById(req.ID)
+	if err != nil {
+		return err
+	}
+	if req.Status == constant.AlertEnable {
+		if err := a.validateCommunityAlertConfigType(config.Type); err != nil {
+			return err
+		}
+		if config.Type == constant.Custom {
+			if _, err := alertwebhook.Resolve(config); err != nil {
+				return err
+			}
+		}
+	}
+	return alertRepo.UpdateAlertConfig(map[string]interface{}{
+		"status":      req.Status,
+		"update_user": operator,
+	}, repo.WithByID(req.ID))
+}
+
+func validateAlertConfigStatus(status string) error {
+	if status != constant.AlertEnable && status != constant.AlertDisable {
+		return fmt.Errorf("alert config status must be Enable or Disable")
+	}
+	return nil
+}
+
+func exposeCustomAlertConfigSecrets(configs []model.AlertConfig) error {
+	for index := range configs {
+		if configs[index].Type != constant.Custom {
+			continue
+		}
+		view, err := alertwebhook.PlainView(configs[index])
+		if err != nil {
+			return fmt.Errorf("build editable custom alert config %d: %w", configs[index].ID, err)
+		}
+		configs[index].Config = view
+	}
+	return nil
+}
+
 func (a AlertService) checkAlertConfigSMSPhoneUnique(req dto.AlertConfigUpdate) error {
 	if req.Type != constant.SMSConfig {
 		return nil
@@ -568,6 +692,9 @@ func (a AlertService) checkAlertConfigSMSPhoneUnique(req dto.AlertConfigUpdate)
 }
 
 func (a AlertService) checkAlertConfigDisplayNameUnique(req dto.AlertConfigUpdate) error {
+	if req.Type != constant.Custom && (global.CONF.Base.IsEnterprise || global.CONF.Base.Edition == "cn") {
+		return nil
+	}
 	displayName := alertConfigDisplayName(req.Type, req.Config)
 	if displayName == "" {
 		return nil
@@ -591,37 +718,67 @@ func (a AlertService) checkAlertConfigDisplayNameUnique(req dto.AlertConfigUpdat
 }
 
 func (a AlertService) validateCommunityAlertMethod(method string) error {
-	if global.CONF.Base.IsEnterprise || global.CONF.Base.Edition == "cn" {
-		return nil
-	}
-	if strings.TrimSpace(method) == "" {
-		return nil
+	methodTypes, err := a.validateAlertMethodReferences(method)
+	if err != nil {
+		return err
 	}
+	return a.validateAlertMethodEntitlement(methodTypes)
+}
 
+func (a AlertService) validateAlertMethodReferences(method string) ([]string, error) {
+	if strings.TrimSpace(method) == "" {
+		return nil, buserr.WithErr("ErrAlertMethodNotSupported", nil)
+	}
+	methodTypes := make([]string, 0)
 	for _, item := range strings.Split(method, ",") {
 		item = strings.TrimSpace(item)
 		if item == "" {
 			continue
 		}
+		configType := ""
 		if configID, err := strconv.ParseUint(item, 10, 64); err == nil {
 			config, err := alertRepo.GetConfigById(uint(configID))
 			if err != nil {
-				return err
+				return nil, err
 			}
-			if _, ok := communityAlertMethodTypeNames[config.Type]; ok {
-				return buserr.WithErr("ErrAlertMethodNotSupported", nil)
+			configType = config.Type
+		} else {
+			var ok bool
+			configType, ok = legacyAlertMethodTypeMap[item]
+			if !ok {
+				return nil, buserr.WithErr("ErrAlertMethodNotSupported", nil)
 			}
+		}
+		if _, ok := supportedAlertMethodTypes[configType]; !ok {
+			return nil, buserr.WithErr("ErrAlertMethodNotSupported", nil)
+		}
+		methodTypes = append(methodTypes, configType)
+	}
+	if len(methodTypes) == 0 {
+		return nil, buserr.WithErr("ErrAlertMethodNotSupported", nil)
+	}
+	return methodTypes, nil
+}
+
+func (a AlertService) validateAlertMethodEntitlement(methodTypes []string) error {
+	for _, configType := range methodTypes {
+		if configType == constant.Custom {
 			continue
 		}
-		if _, ok := communityAlertMethodTypeNames[item]; ok {
+		if global.CONF.Base.IsEnterprise || global.CONF.Base.Edition == "cn" {
+			continue
+		}
+		if _, ok := communityAlertMethodTypeNames[configType]; ok {
 			return buserr.WithErr("ErrAlertMethodNotSupported", nil)
 		}
 	}
-
 	return nil
 }
 
 func (a AlertService) validateCommunityAlertConfigType(configType string) error {
+	if configType == constant.Custom {
+		return nil
+	}
 	if global.CONF.Base.IsEnterprise || global.CONF.Base.Edition == "cn" {
 		return nil
 	}
@@ -633,7 +790,7 @@ func (a AlertService) validateCommunityAlertConfigType(configType string) error
 
 func alertConfigDisplayName(configType, configData string) string {
 	switch configType {
-	case constant.Email, constant.WeCom, constant.DingTalk, constant.FeiShu, constant.Bark, constant.SMS:
+	case constant.Email, constant.WeCom, constant.DingTalk, constant.FeiShu, constant.Bark, constant.SMS, constant.Custom:
 		var cfg struct {
 			DisplayName string `json:"displayName"`
 		}
@@ -672,20 +829,24 @@ func (a AlertService) DeleteAlertConfig(id uint) error {
 }
 
 func (a AlertService) TestAlertConfig(req dto.AlertConfigTest) (bool, error) {
-	username := req.UserName
-	if username == "" {
-		username = req.Sender
+	emailConfig, err := resolveEmailTestConfig(req)
+	if err != nil {
+		return false, err
 	}
-	encodedDisplayName := mime.BEncoding.Encode("UTF-8", req.DisplayName)
+	username := emailConfig.UserName
+	if username == "" {
+		username = emailConfig.Sender
+	}
+	encodedDisplayName := mime.BEncoding.Encode("UTF-8", emailConfig.DisplayName)
 	cfg := email.SMTPConfig{
-		Host:       req.Host,
-		Port:       req.Port,
-		Sender:     req.Sender,
+		Host:       emailConfig.Host,
+		Port:       emailConfig.Port,
+		Sender:     emailConfig.Sender,
 		Username:   username,
-		Password:   req.Password,
-		From:       fmt.Sprintf(`"%s" <%s>`, encodedDisplayName, req.Sender),
-		Encryption: req.Encryption,
-		Recipient:  req.Recipient,
+		Password:   emailConfig.Password,
+		From:       fmt.Sprintf(`"%s" <%s>`, encodedDisplayName, emailConfig.Sender),
+		Encryption: emailConfig.Encryption,
+		Recipient:  emailConfig.Recipient,
 	}
 
 	msg := email.EmailMessage{
@@ -700,9 +861,94 @@ func (a AlertService) TestAlertConfig(req dto.AlertConfigTest) (bool, error) {
 	return true, nil
 }
 
+func resolveEmailTestConfig(req dto.AlertConfigTest) (dto.AlertEmailConfig, error) {
+	emailConfig := dto.AlertEmailConfig{
+		Host:        req.Host,
+		Port:        req.Port,
+		Sender:      req.Sender,
+		UserName:    req.UserName,
+		Password:    req.Password,
+		DisplayName: req.DisplayName,
+		Encryption:  req.Encryption,
+		Recipient:   req.Recipient,
+	}
+	if strings.TrimSpace(req.Config) != "" {
+		configType := req.Type
+		if configType == "" {
+			configType = constant.EmailConfig
+		}
+		if configType != constant.EmailConfig {
+			return dto.AlertEmailConfig{}, fmt.Errorf("alert config test type must be email")
+		}
+		var existing *model.AlertConfig
+		if req.ID != 0 {
+			stored, err := alertRepo.GetConfigById(req.ID)
+			if err != nil {
+				return dto.AlertEmailConfig{}, err
+			}
+			existing = &stored
+		}
+		prepared, err := alertconfig.Prepare(configType, req.Config, constant.AlertEnable, existing)
+		if err != nil {
+			return dto.AlertEmailConfig{}, err
+		}
+		if err := json.Unmarshal([]byte(prepared), &emailConfig); err != nil {
+			return dto.AlertEmailConfig{}, fmt.Errorf("decode email alert config: %w", err)
+		}
+	}
+	return emailConfig, nil
+}
+
+func (a AlertService) TestCustomAlertConfig(req dto.AlertConfigTest) (dto.AlertConfigTestResult, error) {
+	if req.Type != constant.Custom {
+		return dto.AlertConfigTestResult{}, fmt.Errorf("alert config test type must be custom")
+	}
+	var existing *model.AlertConfig
+	if req.ID != 0 {
+		config, err := alertRepo.GetConfigById(req.ID)
+		if err != nil {
+			return dto.AlertConfigTestResult{}, err
+		}
+		if config.Type != constant.Custom {
+			return dto.AlertConfigTestResult{}, fmt.Errorf("alert config %d is not a custom webhook", req.ID)
+		}
+		existing = &config
+	}
+	prepared, err := alertwebhook.Prepare(req.Config, constant.AlertEnable, existing)
+	if err != nil {
+		return dto.AlertConfigTestResult{}, err
+	}
+	resolved, err := alertwebhook.Resolve(model.AlertConfig{
+		Type:         constant.Custom,
+		Config:       prepared.Config,
+		SecretConfig: prepared.SecretConfig,
+	})
+	if err != nil {
+		return dto.AlertConfigTestResult{}, err
+	}
+	tester, ok := xpack.AlertProvider.(providers.CustomWebhookTester)
+	if !ok {
+		return dto.AlertConfigTestResult{
+			Success: false,
+			Message: providers.ErrCustomWebhookUnsupported.Error(),
+		}, nil
+	}
+	return tester.TestCustomWebhook(resolved)
+}
+
 func (a AlertService) ExternalUpdateAlert(updateAlert dto.AlertCreate, operator string) error {
-	if err := a.validateCommunityAlertMethod(updateAlert.Method); err != nil {
-		return err
+	var methodTypes []string
+	if updateAlert.SendCount != 0 || strings.TrimSpace(updateAlert.Method) != "" {
+		var err error
+		methodTypes, err = a.validateAlertMethodReferences(updateAlert.Method)
+		if err != nil {
+			return err
+		}
+	}
+	if updateAlert.SendCount != 0 {
+		if err := a.validateAlertMethodEntitlement(methodTypes); err != nil {
+			return err
+		}
 	}
 	upMap := make(map[string]interface{})
 	var newStatus string
@@ -721,6 +967,23 @@ func (a AlertService) ExternalUpdateAlert(updateAlert dto.AlertCreate, operator
 		alertRepo.WithByType(updateAlert.Type),
 		alertRepo.WithByProject(updateAlert.Project),
 	)
+	advanced, err := prepareCronJobAlertParams(updateAlert.Type, alertInfo.AdvancedParams, updateAlert.AdvancedParams)
+	if err != nil {
+		return err
+	}
+	updateAlert.AdvancedParams = advanced
+	if alertUtil.GetCronJobType(updateAlert.Type) == "cronJob" {
+		upMap["advanced_params"] = advanced
+	}
+	if newStatus == constant.AlertEnable {
+		method := updateAlert.Method
+		if method == "" {
+			method = alertInfo.Method
+		}
+		if err := a.validateCronJobAlertChannels(updateAlert.Type, advanced, method); err != nil {
+			return err
+		}
+	}
 
 	if alertInfo.ID > 0 {
 		shouldUpdate := false
@@ -734,6 +997,9 @@ func (a AlertService) ExternalUpdateAlert(updateAlert dto.AlertCreate, operator
 		if val, ok := upMap["method"]; ok && val != "" && val != alertInfo.Method {
 			shouldUpdate = true
 		}
+		if val, ok := upMap["advanced_params"]; ok && val != alertInfo.AdvancedParams {
+			shouldUpdate = true
+		}
 
 		if shouldUpdate {
 			if err := alertRepo.Update(
@@ -755,3 +1021,22 @@ func (a AlertService) ExternalUpdateAlert(updateAlert dto.AlertCreate, operator
 
 	return nil
 }
+
+func prepareCronJobAlertParams(alertType, previous, incoming string) (string, error) {
+	if alertUtil.GetCronJobType(alertType) != "cronJob" {
+		return incoming, nil
+	}
+	return alertUtil.MergeCronJobAlertParams(previous, incoming)
+}
+
+func (a AlertService) validateCronJobAlertChannels(alertType, advanced, method string) error {
+	if alertUtil.GetCronJobType(alertType) != "cronJob" {
+		return nil
+	}
+	mode, err := alertUtil.CronJobAlertTriggerMode(advanced)
+	if err != nil || mode != alertUtil.CronJobAlertSuccess {
+		return err
+	}
+	_, err = a.validateAlertMethodReferences(method)
+	return err
+}

agent/app/service/alert_helper.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"math"
 	"net"
@@ -29,9 +30,11 @@ import (
 )
 
 const (
-	ResourceAlertInterval = 30
-	CheckIntervalSec      = 3
-	LoadCheckIntervalMin  = 5
+	ResourceAlertInterval     = 30
+	CheckIntervalSec          = 3
+	LoadCheckIntervalMin      = 5
+	sshIPLoginWindow          = 30 * time.Minute
+	sslAutoRenewAlertSkipDays = 31
 )
 
 type AlertTaskHelper struct {
@@ -512,10 +515,32 @@ func loadPanelLogin(alert dto.AlertDTO) {
 }
 
 func loadSSHLogin(alert dto.AlertDTO) {
-	count, isAlert, err := alertUtil.CountRecentFailedSSHLog(alert.Cycle, alert.Count)
-	if err != nil {
-		global.LOG.Errorf("Failed to count recent failed ssh login logs: %v", err)
+	now := time.Now()
+	failedWindow := time.Duration(alert.Cycle) * time.Minute
+	loadWindow := failedWindow
+	if loadWindow < sshIPLoginWindow {
+		loadWindow = sshIPLoginWindow
 	}
+	location, err := time.LoadLocation(common.LoadTimeZoneByCmd())
+	if err != nil {
+		global.LOG.Errorf("Failed to load timezone for ssh login logs: %v", err)
+		location = time.Local
+	}
+	histories, err := loadSSHAlertHistories(defaultSSHLogDir, now.Add(-loadWindow), now, location)
+	if err != nil {
+		global.LOG.Errorf("Failed to load ssh login logs: %v", err)
+	}
+	interfaceAddrs, err := net.InterfaceAddrs()
+	if err != nil {
+		global.LOG.Warnf("Failed to load local IP addresses for ssh login alert: %v", err)
+	}
+	count, records := summarizeSSHLoginHistories(
+		histories,
+		now,
+		failedWindow,
+		sshSuccessLoginWhitelist(alert.AdvancedParams, interfaceAddrs),
+	)
+	isAlert := count >= int(alert.Count)
 	if isAlert {
 		params := []dto.Param{
 			{
@@ -531,12 +556,6 @@ func loadSSHLogin(alert dto.AlertDTO) {
 		}
 		sendAlerts(alert, "sshLogin", strconv.Itoa(count), "sshLogin", params)
 	}
-	whitelist := strings.Split(strings.TrimSpace(alert.AdvancedParams), "\n")
-	records, err := alertUtil.FindRecentSuccessLoginNotInWhitelist(30, whitelist)
-	if err != nil {
-		global.LOG.Errorf("Failed to check recent failed ip ssh login logs: %v", err)
-	}
-	records = filterSSHLoginEntriesNotInWhitelist(records, whitelist)
 	if len(records) > 0 {
 		quota := strings.Join(records, "\n")
 		params := []dto.Param{
@@ -555,6 +574,19 @@ func loadSSHLogin(alert dto.AlertDTO) {
 	}
 }
 
+func sshSuccessLoginWhitelist(configured string, interfaceAddrs []net.Addr) []string {
+	whitelist := strings.Split(strings.TrimSpace(configured), "\n")
+	whitelist = append(whitelist, "127.0.0.0/8", "::1")
+	for _, addr := range interfaceAddrs {
+		ipNet, ok := addr.(*net.IPNet)
+		if !ok || ipNet.IP == nil || ipNet.IP.IsUnspecified() {
+			continue
+		}
+		whitelist = append(whitelist, ipNet.IP.String())
+	}
+	return whitelist
+}
+
 func filterLoginLogsNotInWhitelist(records []model.LoginLog, whitelist []string) []model.LoginLog {
 	filtered := make([]model.LoginLog, 0, len(records))
 	for _, record := range records {
@@ -565,20 +597,6 @@ func filterLoginLogsNotInWhitelist(records []model.LoginLog, whitelist []string)
 	return filtered
 }
 
-func filterSSHLoginEntriesNotInWhitelist(records []string, whitelist []string) []string {
-	filtered := make([]string, 0, len(records))
-	for _, record := range records {
-		ip := record
-		if idx := strings.Index(record, "-"); idx >= 0 {
-			ip = record[:idx]
-		}
-		if !isIPInWhitelist(ip, whitelist) {
-			filtered = append(filtered, record)
-		}
-	}
-	return filtered
-}
-
 func isIPInWhitelist(ip string, whitelist []string) bool {
 	targetIP := net.ParseIP(strings.TrimSpace(ip))
 	if targetIP == nil {
@@ -695,9 +713,10 @@ func sendAlertsByConfigId(alert dto.AlertDTO, alertType, quota, quotaType string
 
 func sendAlertsByLegacyMethod(alert dto.AlertDTO, alertType, quota, quotaType string, params []dto.Param, method string) {
 	typeMap := map[string]string{
-		"mail":        constant.Email,
-		constant.Bark: constant.Bark,
-		constant.SMS:  constant.SMS,
+		"mail":          constant.Email,
+		constant.Bark:   constant.Bark,
+		constant.SMS:    constant.SMS,
+		constant.Custom: constant.Custom,
 	}
 	configType, ok := typeMap[method]
 	if !ok {
@@ -785,7 +804,7 @@ func doSendAlert(alert dto.AlertDTO, alertType, quota, quotaType string, params
 		}
 		alertUtil.CreateNewAlertTask(quota, alertType, quotaType, methodStr)
 
-	case constant.WeCom, constant.DingTalk, constant.FeiShu:
+	case constant.WeCom, constant.DingTalk, constant.FeiShu, constant.Custom:
 		todayCount, isValid := canSendAlertToday(alertType, quotaType, alert.SendCount, methodStr)
 		if !isValid {
 			return
@@ -798,12 +817,31 @@ func doSendAlert(alert dto.AlertDTO, alertType, quota, quotaType string, params
 		}
 		transport := xpack.MultiNodeProvider.LoadRequestTransport()
 		agentInfo, _ := xpack.MultiNodeProvider.GetAgentInfo()
-		alertErr := xpack.AlertProvider.CreateWebhookAlertLog(alertType, alert, create, quotaType, params, config, transport, agentInfo)
+		queued := false
+		var alertErr error
+		if config.Type == constant.Custom {
+			task := dto.AlertTaskMetadata{
+				AlertID:   alert.ID,
+				Type:      alertType,
+				Quota:     quota,
+				QuotaType: quotaType,
+				Method:    methodStr,
+			}
+			result, deliveryErr := xpack.DeliverCustomWebhookAlertLog(alertType, alert, create, quotaType, params, config, transport, agentInfo, task)
+			queued, alertErr = result.Queued, deliveryErr
+			if alertErr == nil && result.Queued {
+				_, alertErr = alertUtil.RecordQueuedAlertTask(result.LogID, task)
+			}
+		} else {
+			alertErr = xpack.AlertProvider.CreateWebhookAlertLog(alertType, alert, create, quotaType, params, config, transport, agentInfo)
+		}
 		if alertErr != nil {
 			global.LOG.Infof("%s alert webhook %s push faild, err: %v", alertType, methodStr, alertErr)
 			return
 		}
-		alertUtil.CreateNewAlertTask(quota, alertType, quotaType, methodStr)
+		if !queued {
+			alertUtil.CreateNewAlertTask(quota, alertType, quotaType, methodStr)
+		}
 	}
 }
 
@@ -844,7 +882,7 @@ func calculateSSLExpiryDays(sslList []model.WebsiteSSL, cycle uint) (map[int][]s
 		daysDiff := int(math.Ceil(
 			ssl.ExpireDate.Sub(currentDate).Hours() / 24,
 		))
-		if daysDiff > 0 && int(cycle) >= daysDiff {
+		if daysDiff > 0 && int(cycle) >= daysDiff && !shouldSuppressSSLExpiryAlert(ssl, daysDiff) {
 			daysDiffMap[daysDiff] = append(daysDiffMap[daysDiff], ssl.PrimaryDomain)
 			projectMap[ssl.ID] = append(projectMap[ssl.ID], ssl.ExpireDate)
 		}
@@ -852,6 +890,10 @@ func calculateSSLExpiryDays(sslList []model.WebsiteSSL, cycle uint) (map[int][]s
 	return daysDiffMap, projectMap
 }
 
+func shouldSuppressSSLExpiryAlert(ssl model.WebsiteSSL, remainingDays int) bool {
+	return ssl.AutoRenew && remainingDays < sslAutoRenewAlertSkipDays
+}
+
 func calculateWebsiteExpiryDays(websites []model.Website, cycle uint) (map[int][]string, map[uint][]time.Time) {
 	currentDate := time.Now()
 	daysDiffMap := make(map[int][]string)
@@ -1024,50 +1066,37 @@ func processAllDisks(alert dto.AlertDTO) error {
 		global.LOG.Errorf("error getting disk list, err: %v", err)
 		return err
 	}
-	var errMsgs []string
 	for _, item := range diskList {
-		err := checkAndCreateDiskAlert(alert, item.Path)
-		if err != nil {
-			errMsg := fmt.Sprintf("disk path %s process failed: %v", item.Path, err)
-			errMsgs = append(errMsgs, errMsg)
-			global.LOG.Errorf("%s", errMsg)
+		if item.Total == 0 {
 			continue
 		}
-	}
-	if len(errMsgs) > 0 {
-		return fmt.Errorf("batch process disks failed, error count: %d, details: %s", len(errMsgs), strings.Join(errMsgs, "; "))
+		checkAndCreateDiskAlert(alert, item.Path, &disk.UsageStat{Used: item.Used, UsedPercent: item.UsedPercent})
 	}
 	return nil
 }
 
 func processSingleDisk(alert dto.AlertDTO) error {
-	err := checkAndCreateDiskAlert(alert, alert.Project)
+	usageStat, err := loadDiskUsageWithTimeout(alert.Project, true)
 	if err != nil {
-		global.LOG.Errorf("%s", err.Error())
+		global.LOG.Errorf("error getting disk usage for %s, err: %v", alert.Project, err)
 		return err
 	}
+	checkAndCreateDiskAlert(alert, alert.Project, usageStat)
 	return nil
 }
 
-func checkAndCreateDiskAlert(alert dto.AlertDTO, path string) error {
-	usageStat, err := psutil.DISK.GetUsage(path, false)
-	if err != nil {
-		global.LOG.Errorf("error getting disk usage for %s, err: %v", path, err)
-		return err
-	}
-
+func checkAndCreateDiskAlert(alert dto.AlertDTO, path string, usageStat *disk.UsageStat) {
 	usedTotal, usedStr := calculateUsedTotal(alert.Cycle, usageStat)
 	commonTotal := float64(alert.Count)
 	if alert.Cycle == 1 {
 		commonTotal *= 1024 * 1024 * 1024
 	}
 	if usedTotal < commonTotal {
-		return nil
+		return
 	}
 	params := createAlertDiskParams(path, usedStr)
 	sender := NewAlertSender(alert, alert.Project)
 	sender.ResourceSend(path, params)
-	return nil
 }
 
 func calculateUsedTotal(cycle uint, usageStat *disk.UsageStat) (float64, string) {
@@ -1097,3 +1126,55 @@ func calculateMinutesDifference(newDate time.Time) int {
 	minutesDifference := int(now.Sub(newDate).Minutes())
 	return minutesDifference
 }
+
+func loadSSHAlertHistories(
+	baseDir string,
+	startTime, endTime time.Time,
+	location *time.Location,
+) ([]dto.SSHHistory, error) {
+	fileList, err := listSSHLogFiles(baseDir)
+	if err != nil {
+		return nil, err
+	}
+
+	var (
+		histories []dto.SSHHistory
+		loadErr   error
+	)
+	for _, file := range fileList {
+		items, err := loadSSHHistoriesFromFile(file.Name, "", "", startTime, endTime, file.Year, location)
+		if err != nil {
+			loadErr = errors.Join(loadErr, fmt.Errorf("load SSH log file %s: %w", file.Name, err))
+			continue
+		}
+		histories = append(histories, items...)
+	}
+	return histories, loadErr
+}
+
+func summarizeSSHLoginHistories(
+	histories []dto.SSHHistory,
+	now time.Time,
+	failedWindow time.Duration,
+	whitelist []string,
+) (int, []string) {
+	failedStartTime := now.Add(-failedWindow)
+	successStartTime := now.Add(-sshIPLoginWindow)
+	failedCount := 0
+	var abnormalLogins []string
+
+	for _, item := range histories {
+		switch item.Status {
+		case constant.StatusFailed:
+			if isSSHLogWithinTimeRange(item.Date, failedStartTime, now) {
+				failedCount++
+			}
+		case constant.StatusSuccess:
+			if !isSSHLogWithinTimeRange(item.Date, successStartTime, now) || isIPInWhitelist(item.Address, whitelist) {
+				continue
+			}
+			abnormalLogins = append(abnormalLogins, fmt.Sprintf("%s-%s", item.Address, item.Date.Format(constant.DateTimeLayout)))
+		}
+	}
+	return failedCount, abnormalLogins
+}

agent/app/service/alert_sender.go

@@ -75,7 +75,7 @@ func (s *AlertSender) sendByConfig(config model.AlertConfig, quota string, param
 		} else {
 			s.sendBarkWithConfig(config, quota, params)
 		}
-	case constant.WeCom, constant.DingTalk, constant.FeiShu:
+	case constant.WeCom, constant.DingTalk, constant.FeiShu, constant.Custom:
 		if isResource {
 			s.sendResourceWebhookWithConfig(config, quota, params)
 		} else {
@@ -86,7 +86,7 @@ func (s *AlertSender) sendByConfig(config model.AlertConfig, quota string, param
 
 func (s *AlertSender) sendByLegacyMethod(method string, quota string, params []dto.Param, isResource bool) {
 	alertRepo := repo.NewIAlertRepo()
-	typeMap := map[string]string{"mail": constant.Email, constant.Bark: constant.Bark, constant.SMS: constant.SMS}
+	typeMap := map[string]string{"mail": constant.Email, constant.Bark: constant.Bark, constant.SMS: constant.SMS, constant.Custom: constant.Custom}
 	configType := method
 	if mapped, ok := typeMap[method]; ok {
 		configType = mapped
@@ -308,12 +308,31 @@ func (s *AlertSender) sendWebhookWithConfig(config model.AlertConfig, quota stri
 	}
 	transport := xpack.MultiNodeProvider.LoadRequestTransport()
 	agentInfo, _ := xpack.MultiNodeProvider.GetAgentInfo()
-	err := xpack.AlertProvider.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo)
+	queued := false
+	var err error
+	if config.Type == constant.Custom {
+		task := dto.AlertTaskMetadata{
+			AlertID:   s.alert.ID,
+			Type:      s.alert.Type,
+			Quota:     quota,
+			QuotaType: s.quotaType,
+			Method:    strconv.Itoa(int(config.ID)),
+		}
+		result, deliveryErr := xpack.DeliverCustomWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo, task)
+		queued, err = result.Queued, deliveryErr
+		if err == nil && result.Queued {
+			_, err = alertUtil.RecordQueuedAlertTask(result.LogID, task)
+		}
+	} else {
+		err = xpack.AlertProvider.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo)
+	}
 	if err != nil {
 		global.LOG.Errorf("%s alert %s webhook push failed: %v", s.alert.Type, config.Type, err)
 		return
 	}
-	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, strconv.Itoa(int(config.ID)))
+	if !queued {
+		alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, strconv.Itoa(int(config.ID)))
+	}
 }
 
 func (s *AlertSender) sendResourceWebhookWithConfig(config model.AlertConfig, quota string, params []dto.Param) {
@@ -334,11 +353,31 @@ func (s *AlertSender) sendResourceWebhookWithConfig(config model.AlertConfig, qu
 	}
 	transport := xpack.MultiNodeProvider.LoadRequestTransport()
 	agentInfo, _ := xpack.MultiNodeProvider.GetAgentInfo()
-	if err := xpack.AlertProvider.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo); err != nil {
+	queued := false
+	var err error
+	if config.Type == constant.Custom {
+		task := dto.AlertTaskMetadata{
+			AlertID:   s.alert.ID,
+			Type:      s.alert.Type,
+			Quota:     quota,
+			QuotaType: s.quotaType,
+			Method:    strconv.Itoa(int(config.ID)),
+		}
+		result, deliveryErr := xpack.DeliverCustomWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo, task)
+		queued, err = result.Queued, deliveryErr
+		if err == nil && result.Queued {
+			_, err = alertUtil.RecordQueuedAlertTask(result.LogID, task)
+		}
+	} else {
+		err = xpack.AlertProvider.CreateWebhookAlertLog(s.alert.Type, s.alert, create, quota, params, config, transport, agentInfo)
+	}
+	if err != nil {
 		global.LOG.Errorf("%s alert %s webhook push failed: %v", s.alert.Type, config.Type, err)
 		return
 	}
-	alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, strconv.Itoa(int(config.ID)))
+	if !queued {
+		alertUtil.CreateNewAlertTask(quota, s.alert.Type, s.quotaType, strconv.Itoa(int(config.ID)))
+	}
 }
 
 func (s *AlertSender) sendWebhook(quota string, params []dto.Param, method string) {

agent/app/service/app.go

@@ -223,6 +223,9 @@ func (a AppService) GetAppDetailByKey(appKey, version string) (response.AppDetai
 	if err != nil {
 		return appDetailDTO, err
 	}
+	if err = checkVllmVersionAccess(app.Key, version); err != nil {
+		return appDetailDTO, err
+	}
 	appDetail, err := appDetailRepo.GetFirst(appDetailRepo.WithAppId(app.ID), appDetailRepo.WithVersion(version))
 	if err != nil {
 		return appDetailDTO, err
@@ -241,14 +244,17 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 	if err != nil {
 		return appDetailDTO, err
 	}
+	app, err := appRepo.GetFirst(repo.WithByID(detail.AppId))
+	if err != nil {
+		return appDetailDTO, err
+	}
+	if err = checkVllmVersionAccess(app.Key, detail.Version); err != nil {
+		return appDetailDTO, err
+	}
 	appDetailDTO.AppDetail = detail
 	appDetailDTO.Enable = true
 
 	if appType == "runtime" {
-		app, err := appRepo.GetFirst(repo.WithByID(appID))
-		if err != nil {
-			return appDetailDTO, err
-		}
 		fileOp := files.NewFileOp()
 
 		versionPath := filepath.Join(app.GetAppResourcePath(), detail.Version)
@@ -319,10 +325,6 @@ func (a AppService) GetAppDetail(appID uint, version, appType string) (response.
 
 	appDetailDTO.HostMode = isHostModel(appDetailDTO.DockerCompose)
 
-	app, err := appRepo.GetFirst(repo.WithByID(detail.AppId))
-	if err != nil {
-		return appDetailDTO, err
-	}
 	if err := checkLimit(app); err != nil {
 		appDetailDTO.Enable = false
 	}
@@ -374,6 +376,9 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 	if err != nil {
 		return
 	}
+	if err = checkVllmVersionAccess(app.Key, appDetail.Version); err != nil {
+		return
+	}
 	if DatabaseKeys[app.Key] > 0 {
 		if existDatabases, _ := databaseRepo.GetList(repo.WithByName(req.Name)); len(existDatabases) > 0 {
 			err = buserr.New("ErrRemoteExist")
@@ -483,15 +488,17 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 		index++
 	}
 	newServiceName := strings.ToLower(appInstall.Name)
-	if app.Limit == 0 && newServiceName != serviceName && len(servicesMap) == 1 {
+	if app.Limit == 0 && newServiceName != serviceName && len(servicesMap) == 1 && !req.KeepServiceName {
 		servicesMap[newServiceName] = servicesMap[serviceName]
 		delete(servicesMap, serviceName)
 		serviceName = newServiceName
 	}
 	appInstall.ServiceName = serviceName
 
-	if err = addDockerComposeCommonParam(composeMap, appInstall.ServiceName, req.AppContainerConfig, req.Params); err != nil {
-		return
+	if !req.SkipComposeCommonConfig {
+		if err = addDockerComposeCommonParam(composeMap, appInstall.ServiceName, req.AppContainerConfig, req.Params); err != nil {
+			return
+		}
 	}
 	var (
 		composeByte []byte
@@ -559,7 +566,7 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 				return err
 			}
 		}
-		if executeScript {
+		if executeScript || req.UseLifecycleScripts {
 			if err = runScript(t, appInstall, "init"); err != nil {
 				return err
 			}
@@ -572,7 +579,7 @@ func (a AppService) installWithHooks(req request.AppInstallCreate, executeScript
 				return err
 			}
 		}
-		if err = upApp(t, appInstall, req.PullImage); err != nil {
+		if err = upApp(t, appInstall, req.PullImage, req.UseLifecycleScripts); err != nil {
 			return err
 		}
 		updateToolApp(appInstall)

agent/app/service/app_install.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"maps"
 	"math"
 	"net/http"
 	"os"
@@ -13,12 +14,14 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
 	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
@@ -252,6 +255,9 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 		return buserr.New("ErrInstallDirNotFound")
 	}
 	dockerComposePath := install.GetComposePath()
+	if req.UseLifecycleScripts && (req.Operate == constant.Start || req.Operate == constant.Stop || req.Operate == constant.Restart) {
+		return operateAppWithLifecycleScripts(install, req, nil)
+	}
 	switch req.Operate {
 	case constant.Rebuild:
 		return rebuildApp(install)
@@ -275,12 +281,13 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 		return syncAppInstallStatus(&install, false)
 	case constant.Delete:
 		deleteReq := request.AppInstallDelete{
-			Install:      install,
-			DeleteBackup: req.DeleteBackup,
-			ForceDelete:  req.ForceDelete,
-			DeleteDB:     req.DeleteDB,
-			DeleteImage:  req.DeleteImage,
-			TaskID:       req.TaskID,
+			Install:             install,
+			DeleteBackup:        req.DeleteBackup,
+			ForceDelete:         req.ForceDelete,
+			DeleteDB:            req.DeleteDB,
+			DeleteImage:         req.DeleteImage,
+			TaskID:              req.TaskID,
+			UseLifecycleScripts: req.UseLifecycleScripts,
 		}
 		if err = deleteAppInstall(deleteReq); err != nil && !req.ForceDelete {
 			return err
@@ -312,6 +319,70 @@ func (a *AppInstallService) Operate(req request.AppInstalledOperate) error {
 	}
 }
 
+func operateAppWithLifecycleScripts(install model.AppInstall, req request.AppInstalledOperate, onFailure func(error)) error {
+	taskType := task.TaskUpdate
+	switch req.Operate {
+	case constant.Start:
+		install.Status = constant.StatusStarting
+	case constant.Restart:
+		taskType = task.TaskRestart
+		install.Status = constant.StatusRestarting
+	case constant.Stop:
+		install.Status = constant.StatusWaiting
+	default:
+		return errors.New("lifecycle script operation not supported")
+	}
+	install.Message = ""
+	if err := appInstallRepo.Save(context.Background(), &install); err != nil {
+		return err
+	}
+
+	operationTask, err := task.NewTaskWithOps(install.Name, taskType, task.TaskScopeApp, req.TaskID, install.ID)
+	if err != nil {
+		return err
+	}
+	operation := string(req.Operate)
+	operationTask.AddSubTaskWithOps(
+		task.GetTaskName(install.Name, taskType, task.TaskScopeApp),
+		func(t *task.Task) error {
+			if err := runScript(t, &install, operation); err != nil {
+				return err
+			}
+			if req.Operate == constant.Stop {
+				install.Status = constant.StatusStopped
+				install.Message = ""
+				return appInstallRepo.Save(context.Background(), &install)
+			}
+			containerNames, err := getContainerNames(install)
+			if err != nil {
+				return err
+			}
+			if len(containerNames) == 0 {
+				return buserr.WithName("ErrContainerNotFound", install.Name)
+			}
+			install.ContainerName = strings.Join(containerNames, ",")
+			install.Status = constant.StatusRunning
+			install.Message = ""
+			return appInstallRepo.Save(context.Background(), &install)
+		},
+		nil,
+		0,
+		time.Hour,
+	)
+	go func() {
+		if taskErr := operationTask.Execute(); taskErr != nil {
+			if onFailure != nil {
+				onFailure(taskErr)
+				return
+			}
+			install.Status = constant.StatusUpErr
+			install.Message = taskErr.Error()
+			_ = appInstallRepo.Save(context.Background(), &install)
+		}
+	}()
+	return nil
+}
+
 func (a *AppInstallService) UpdateAppConfig(req request.AppConfigUpdate) error {
 	installed, err := appInstallRepo.GetFirst(repo.WithByID(req.InstallID))
 	if err != nil {
@@ -374,8 +445,10 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 				return err
 			}
 		}
-		if err = addDockerComposeCommonParam(composeMap, installed.ServiceName, req.AppContainerConfig, req.Params); err != nil {
-			return err
+		if !req.SkipComposeCommonConfig {
+			if err = addDockerComposeCommonParam(composeMap, installed.ServiceName, req.AppContainerConfig, req.Params); err != nil {
+				return err
+			}
 		}
 		composeByte, err := yaml.Marshal(composeMap)
 		if err != nil {
@@ -408,7 +481,7 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	if err != nil {
 		return err
 	}
-	backupEnvMaps := oldEnvMaps
+	backupEnvMaps := maps.Clone(oldEnvMaps)
 	handleMap(req.Params, oldEnvMaps)
 	paramByte, err := json.Marshal(oldEnvMaps)
 	if err != nil {
@@ -420,13 +493,32 @@ func (a *AppInstallService) Update(req request.AppInstalledUpdate) error {
 	}
 	fileOp := files.NewFileOp()
 	_ = fileOp.WriteFile(installed.GetComposePath(), strings.NewReader(installed.DockerCompose), constant.DirPerm)
-	if err := rebuildApp(installed); err != nil {
+	restoreConfig := func(operationErr error) {
 		_ = env.Write(backupEnvMaps, envPath)
 		_ = fileOp.WriteFile(installed.GetComposePath(), strings.NewReader(backupDockerCompose), constant.DirPerm)
+		failed := oldInstalled
+		failed.Status = constant.StatusUpErr
+		failed.Message = operationErr.Error()
+		_ = appInstallRepo.Save(context.Background(), &failed)
+	}
+	if req.UseLifecycleScripts {
+		err = operateAppWithLifecycleScripts(installed, request.AppInstalledOperate{
+			InstallId:           installed.ID,
+			Operate:             constant.Restart,
+			TaskID:              req.TaskID,
+			UseLifecycleScripts: true,
+		}, restoreConfig)
+	} else {
+		err = rebuildApp(installed)
+	}
+	if err != nil {
+		restoreConfig(err)
 		return err
 	}
-	installed.Status = constant.StatusRunning
-	_ = appInstallRepo.Save(context.Background(), &installed)
+	if !req.UseLifecycleScripts {
+		installed.Status = constant.StatusRunning
+		_ = appInstallRepo.Save(context.Background(), &installed)
+	}
 
 	proxyChanged := hasAppInstallProxyPassChanged(&oldInstalled, &installed)
 	currentProxy, currentProxyErr := getAppInstallProxyPass(&installed)
@@ -583,6 +675,9 @@ func (a *AppInstallService) GetUpdateVersions(req request.AppUpdateVersion) ([]d
 		return versions, err
 	}
 	for _, detail := range details {
+		if !canAccessVllmVersion(app.Key, detail.Version) {
+			continue
+		}
 		ignores, _ := appIgnoreUpgradeRepo.List(runtimeRepo.WithDetailId(detail.ID), appIgnoreUpgradeRepo.WithScope("version"))
 		if len(ignores) > 0 {
 			continue
@@ -836,7 +931,9 @@ func (a *AppInstallService) GetParams(id uint) (*response.AppConfig, error) {
 }
 
 func syncAppInstallStatus(appInstall *model.AppInstall, force bool) error {
-	if appInstall.Status == constant.StatusInstalling || appInstall.Status == constant.StatusRebuilding || appInstall.Status == constant.StatusUpgrading || appInstall.Status == constant.StatusUninstalling {
+	switch appInstall.Status {
+	case constant.StatusInstalling, constant.StatusRebuilding, constant.StatusUpgrading, constant.StatusUninstalling,
+		constant.StatusStarting, constant.StatusRestarting, constant.StatusWaiting:
 		return nil
 	}
 	cli, err := docker.NewClient()

agent/app/service/app_upgrade.go

@@ -40,14 +40,13 @@ const (
 	appUpgradeDown
 	appUpgradeMutated
 	appUpgradeStarted
-	appUpgradeReady
 	appUpgradeCommitted
 )
 
-const composeServiceLabel = "com.docker.compose.service"
-
 var appUpgradeLocks sync.Map
 
+const composeServiceLabel = "com.docker.compose.service"
+
 type appUpgradeSnapshot interface {
 	Restore() error
 	Cleanup()
@@ -107,6 +106,9 @@ func upgradeInstall(req request.AppInstallUpgrade) error {
 	if err != nil {
 		return err
 	}
+	if err = checkVllmVersionAccess(install.App.Key, detail.Version); err != nil {
+		return err
+	}
 	if install.App.Key == vllmAppKeyForUpgrade && !isVllmUpgradeVersionAllowed(install.Version, detail.Version, loadVllmImageFromEnv(install.Env)) {
 		return errors.New("vLLM can only upgrade within the same image type")
 	}
@@ -426,7 +428,7 @@ func (u *appUpgradeContext) cutover(t *task.Task) error {
 
 	logStr := fmt.Sprintf("%s %s", i18n.GetMsgByKey("Run"), i18n.GetMsgByKey("App"))
 	t.LogStart(logStr)
-	if out, upErr := compose.UpWithoutPull(u.original.GetComposePath()); upErr != nil {
+	if out, upErr := compose.UpWithoutBuild(u.original.GetComposePath()); upErr != nil {
 		if out != "" {
 			upErr = fmt.Errorf("%s: %w", out, upErr)
 		}
@@ -436,15 +438,14 @@ func (u *appUpgradeContext) cutover(t *task.Task) error {
 	t.LogSuccess(logStr)
 	u.phase = appUpgradeStarted
 
-	t.LogStart(i18n.GetMsgByKey("UpgradeWaitReady"))
-	containerNames, err := waitAppContainersReady(context.Background(), u.candidate)
-	if err != nil {
-		t.LogFailedWithErr(i18n.GetMsgByKey("UpgradeWaitReady"), err)
-		return err
+	containerNames, discoverErr := discoverUpgradeContainerNames(u.candidate, u.envContent)
+	if discoverErr != nil {
+		t.Logf("WARNING: discover upgraded application containers failed: %v", discoverErr)
+	} else if len(containerNames) > 0 {
+		u.candidate.ContainerName = strings.Join(containerNames, ",")
+	} else {
+		t.Log("WARNING: no containers found for the upgraded application")
 	}
-	t.LogSuccess(i18n.GetMsgByKey("UpgradeWaitReady"))
-	u.phase = appUpgradeReady
-	u.candidate.ContainerName = strings.Join(containerNames, ",")
 	u.candidate.Status = constant.StatusRunning
 	u.candidate.Message = ""
 
@@ -459,9 +460,21 @@ func (u *appUpgradeContext) cutover(t *task.Task) error {
 		}); err != nil {
 			return err
 		}
+		// Upgrades deliberately keep the user's nginx.conf, so corrected gzip
+		// defaults shipped with a new version would never reach existing
+		// installations. Rewrite only an untouched factory configuration, and
+		// never fail the upgrade over it.
+		if gzipErr := upgradeStockNginxGzipConfig(u.candidate); gzipErr != nil {
+			t.Logf("WARNING: update stock gzip configuration failed, keeping the current one: %v", gzipErr)
+		}
 	} else if err = appInstallRepo.Save(context.Background(), &u.candidate); err != nil {
 		return err
 	}
+	if discoverErr == nil && len(containerNames) > 0 {
+		if syncErr := syncAppInstallStatus(&u.candidate, true); syncErr != nil {
+			t.Logf("WARNING: sync upgraded application status failed: %v", syncErr)
+		}
+	}
 	u.phase = appUpgradeCommitted
 	u.deleteOldImages(t)
 	return nil
@@ -513,7 +526,6 @@ func (u *appUpgradeContext) applyStagedFiles() error {
 			nginxModuleBuildDir,
 			nginxModuleModulesDir,
 			path.Join(nginxModuleConfDir, nginxModuleEnabledConfDir),
-			path.Join(nginxModuleConfDir, "nginx.conf"),
 		} {
 			if err := replaceUpgradePath(u.stageDir, u.original.GetPath(), relativePath); err != nil {
 				return err
@@ -546,7 +558,7 @@ func (u *appUpgradeContext) rollback(t *task.Task) (rollbackErr error) {
 		return u.finishRollback()
 	}
 	if u.phase < appUpgradeMutated {
-		if out, err := compose.UpWithoutPull(u.original.GetComposePath()); err != nil {
+		if out, err := compose.UpWithoutBuild(u.original.GetComposePath()); err != nil {
 			if out != "" {
 				err = fmt.Errorf("%s: %w", out, err)
 			}
@@ -564,14 +576,14 @@ func (u *appUpgradeContext) rollback(t *task.Task) (rollbackErr error) {
 	if u.backupFile != "" {
 		_ = u.restoreManagedFiles()
 		if err := handleAppRecover(&u.original, t, u.backupFile, true, "", ""); err != nil {
-			_, _ = compose.UpWithoutPull(u.original.GetComposePath())
+			_, _ = compose.UpWithoutBuild(u.original.GetComposePath())
 			return errors.Join(rollbackErr, err)
 		}
 	} else {
 		if err := u.restoreManagedFiles(); err != nil {
 			return errors.Join(rollbackErr, err)
 		}
-		if out, err := compose.UpWithoutPull(u.original.GetComposePath()); err != nil {
+		if out, err := compose.UpWithoutBuild(u.original.GetComposePath()); err != nil {
 			if out != "" {
 				err = fmt.Errorf("%s: %w", out, err)
 			}
@@ -582,9 +594,6 @@ func (u *appUpgradeContext) rollback(t *task.Task) (rollbackErr error) {
 }
 
 func (u *appUpgradeContext) finishRollback() error {
-	if _, err := waitAppContainersReady(context.Background(), u.original); err != nil {
-		return err
-	}
 	restored := u.original
 	if err := appInstallRepo.Save(context.Background(), &restored); err != nil {
 		return err
@@ -716,6 +725,20 @@ func renderUpgradeEnv(install *model.AppInstall, original []byte) ([]byte, error
 		return nil, err
 	}
 	handleMap(envs, params)
+	if install.App.Key == "openlist" {
+		// The upgrade script updates this too late for the pre-pull phase.
+		image := "openlistteam/openlist:v" + strings.TrimPrefix(install.Version, "v")
+		if preInstalled := params["PRE_INSTALLED"]; preInstalled != "" {
+			image += "-" + preInstalled
+		}
+		params["OPENLIST_IMAGE"] = image
+		envs["OPENLIST_IMAGE"] = image
+		content, err := json.Marshal(envs)
+		if err != nil {
+			return nil, err
+		}
+		install.Env = string(content)
+	}
 	if install.App.Key == constant.AppOpenresty {
 		for _, key := range []string{"CONTAINER_PACKAGE_URL", "RESTY_ADD_PACKAGE_BUILDDEPS", "RESTY_CONFIG_OPTIONS_MORE"} {
 			if value, ok := originalEnv[key]; ok {
@@ -858,28 +881,7 @@ func (s *upgradeFileSnapshot) Cleanup() {
 	}
 }
 
-type appContainerReadinessClient interface {
-	ContainerList(context.Context, container.ListOptions) ([]container.Summary, error)
-	ContainerInspect(context.Context, string) (container.InspectResponse, error)
-}
-
-func waitAppContainersReady(ctx context.Context, install model.AppInstall) ([]string, error) {
-	client, err := docker.NewDockerClient()
-	if err != nil {
-		return nil, err
-	}
-	defer client.Close()
-	return waitAppContainersReadyWithClient(ctx, client, install)
-}
-
-func waitAppContainersReadyWithClient(ctx context.Context, client appContainerReadinessClient, install model.AppInstall) ([]string, error) {
-	envContent, err := os.ReadFile(install.GetEnvPath())
-	if err != nil {
-		envContent, err = renderUpgradeEnv(&install, nil)
-		if err != nil {
-			return nil, err
-		}
-	}
+func discoverUpgradeContainerNames(install model.AppInstall, envContent []byte) ([]string, error) {
 	project, err := docker.GetComposeProject(install.Name, install.GetPath(), []byte(install.DockerCompose), envContent, false)
 	if err != nil {
 		return nil, err
@@ -893,36 +895,24 @@ func waitAppContainersReadyWithClient(ctx context.Context, client appContainerRe
 	if len(expectedServices) == 0 {
 		return strings.Split(install.ContainerName, ","), nil
 	}
-	options := container.ListOptions{
-		All: true,
-		Filters: filters.NewArgs(
-			filters.Arg("label", composeWorkdirLabel+"="+install.GetPath()),
-		),
+	client, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
 	}
-	containers, err := client.ContainerList(ctx, options)
+	defer client.Close()
+	containers, err := client.ContainerList(context.Background(), container.ListOptions{
+		All:     true,
+		Filters: filters.NewArgs(filters.Arg("label", composeWorkdirLabel+"="+install.GetPath())),
+	})
 	if err != nil {
 		return nil, err
 	}
-	foundServices := make(map[string]bool, len(expectedServices))
 	containerNames := make([]string, 0, len(containers))
 	for _, item := range containers {
-		serviceName := item.Labels[composeServiceLabel]
-		if _, ok := expectedServices[serviceName]; !ok {
-			continue
-		}
-		if err = waitContainerReady(ctx, client, item.ID); err != nil {
-			return nil, fmt.Errorf("container %s is not ready: %w", serviceName, err)
-		}
-		foundServices[serviceName] = true
-		if len(item.Names) > 0 {
+		if _, ok := expectedServices[item.Labels[composeServiceLabel]]; ok && len(item.Names) > 0 {
 			containerNames = append(containerNames, strings.TrimPrefix(item.Names[0], "/"))
 		}
 	}
-	for serviceName := range expectedServices {
-		if !foundServices[serviceName] {
-			return nil, fmt.Errorf("container for service %s was not created", serviceName)
-		}
-	}
 	sort.Strings(containerNames)
 	return containerNames, nil
 }

agent/app/service/app_utils.go

@@ -352,15 +352,33 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 		if dir != nil {
 			logStr := i18n.GetMsgByKey("Stop") + i18n.GetMsgByKey("App")
 			t.Log(logStr)
+			cleanupFailed := false
 
-			out, err := compose.Down(install.GetComposePath())
-			if err != nil && !deleteReq.ForceDelete {
-				return handleErr(install, err, out)
+			if deleteReq.UseLifecycleScripts {
+				if scriptErr := runScript(t, &install, "uninstall"); scriptErr != nil {
+					cleanupFailed = true
+					if !deleteReq.ForceDelete {
+						return scriptErr
+					}
+				}
+			} else {
+				out, downErr := compose.Down(install.GetComposePath())
+				if downErr != nil {
+					cleanupFailed = true
+					if !deleteReq.ForceDelete {
+						return handleErr(install, downErr, out)
+					}
+				}
+				if scriptErr := runScript(t, &install, "uninstall"); scriptErr != nil {
+					cleanupFailed = true
+					if !deleteReq.ForceDelete {
+						_, _ = compose.Up(install.GetComposePath())
+						return scriptErr
+					}
+				}
 			}
-			t.LogSuccess(logStr)
-			if err = runScript(t, &install, "uninstall"); err != nil {
-				_, _ = compose.Up(install.GetComposePath())
-				return err
+			if !cleanupFailed {
+				t.LogSuccess(logStr)
 			}
 			if deleteReq.DeleteImage {
 				content, err := op.GetContent(install.GetEnvPath())
@@ -460,8 +478,9 @@ func deleteAppInstall(deleteReq request.AppInstallDelete) error {
 	}
 	uninstallTask.AddSubTask(task.GetTaskName(install.Name, task.TaskUninstall, task.TaskScopeApp), uninstall, nil)
 	go func() {
-		if err := uninstallTask.Execute(); err != nil && !deleteReq.ForceDelete {
+		if err := uninstallTask.Execute(); err != nil {
 			install.Status = constant.StatusError
+			install.Message = err.Error()
 			_ = appInstallRepo.Save(context.Background(), &install)
 		}
 	}()
@@ -999,6 +1018,12 @@ func runScript(task *task.Task, appInstall *model.AppInstall, operate string) er
 		scriptPath = path.Join(workDir, "scripts", "upgrade.sh")
 	case "uninstall":
 		scriptPath = path.Join(workDir, "scripts", "uninstall.sh")
+	case "start":
+		scriptPath = path.Join(workDir, "scripts", "start.sh")
+	case "stop":
+		scriptPath = path.Join(workDir, "scripts", "stop.sh")
+	case "restart":
+		scriptPath = path.Join(workDir, "scripts", "restart.sh")
 	}
 	fileOp := files.NewFileOp()
 	if !fileOp.Stat(scriptPath) {
@@ -1008,7 +1033,11 @@ func runScript(task *task.Task, appInstall *model.AppInstall, operate string) er
 	logStr := i18n.GetWithName("ExecShell", operate)
 	task.LogStart(logStr)
 
-	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(10*time.Minute), cmd.WithWorkDir(workDir))
+	timeout := 10 * time.Minute
+	if operate == "start" || operate == "restart" {
+		timeout = time.Hour
+	}
+	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(timeout), cmd.WithWorkDir(workDir), cmd.WithTask(*task))
 	if err := cmdMgr.Run("bash", scriptPath); err != nil {
 		task.LogFailedWithErr(logStr, err)
 		return err
@@ -1043,12 +1072,15 @@ func checkContainerNameIsExist(containerName, appDir string) (bool, error) {
 	return false, nil
 }
 
-func upApp(task *task.Task, appInstall *model.AppInstall, pullImages bool) error {
+func upApp(task *task.Task, appInstall *model.AppInstall, pullImages, useLifecycleScripts bool) error {
 	upProject := func(appInstall *model.AppInstall) (err error) {
 		var (
 			out    string
 			errMsg string
 		)
+		if useLifecycleScripts {
+			return runScript(task, appInstall, "start")
+		}
 		if pullImages && appInstall.App.Type != "php" {
 			envByte, err := files.NewFileOp().GetContent(appInstall.GetEnvPath())
 			if err != nil {
@@ -1375,7 +1407,8 @@ func handleErr(install model.AppInstall, err error, out string) error {
 
 func doNotNeedSync(installed model.AppInstall) bool {
 	return installed.Status == constant.StatusInstalling || installed.Status == constant.StatusRebuilding || installed.Status == constant.StatusUpgrading ||
-		installed.Status == constant.StatusSyncing || installed.Status == constant.StatusUninstalling || installed.Status == constant.StatusInstallErr
+		installed.Status == constant.StatusSyncing || installed.Status == constant.StatusUninstalling || installed.Status == constant.StatusInstallErr ||
+		installed.Status == constant.StatusStarting || installed.Status == constant.StatusRestarting || installed.Status == constant.StatusWaiting
 }
 
 func synAppInstall(containers map[string]container.Summary, appInstall *model.AppInstall, force bool) {
@@ -2229,6 +2262,9 @@ func getAppVersions(key string, details []model.AppDetail) []string {
 	hasLatest := false
 	latestVersion := ""
 	for _, detail := range details {
+		if !canAccessVllmVersion(key, detail.Version) {
+			continue
+		}
 		if key != "mssql" && strings.Contains(detail.Version, "latest") {
 			hasLatest = true
 			latestVersion = detail.Version

agent/app/service/backup_app.go

@@ -232,7 +232,7 @@ func handleAppRecover(install *model.AppInstall, parentTask *task.Task, recoverF
 		}
 		defer func() {
 			if isRollback {
-				_, _ = compose.UpWithoutPull(install.GetComposePath())
+				_, _ = compose.UpWithoutBuild(install.GetComposePath())
 			} else {
 				_, _ = compose.Up(install.GetComposePath())
 			}

agent/app/service/backup_container.go

@@ -582,6 +582,10 @@ func stepRecreateContainer(recoverCtx *containerRecoverContext, taskItem *task.T
 	if config.Image == "" {
 		return fmt.Errorf("container image not found in backup file")
 	}
+	networkConf, extraNetworks := buildContainerRecoverNetworkConfig(recoverCtx.inspectInfo.NetworkSettings, hostConfig)
+	if err := normalizeContainerEndpointSettings(ctx, recoverCtx.client, networkConf, extraNetworks); err != nil {
+		return err
+	}
 	if !checkImageExist(recoverCtx.client, config.Image) {
 		if err := pullImages(taskItem, recoverCtx.client, config.Image); err != nil {
 			return err
@@ -596,7 +600,7 @@ func stepRecreateContainer(recoverCtx *containerRecoverContext, taskItem *task.T
 		return err
 	}
 
-	createRes, err := createContainerWithOldNetworks(ctx, recoverCtx.client, config, hostConfig, recoverCtx.inspectInfo.NetworkSettings, recoverCtx.targetName)
+	createRes, err := createContainerWithNetworks(ctx, recoverCtx.client, config, hostConfig, networkConf, extraNetworks, recoverCtx.targetName)
 	if err != nil {
 		return err
 	}
@@ -604,7 +608,7 @@ func stepRecreateContainer(recoverCtx *containerRecoverContext, taskItem *task.T
 	return nil
 }
 
-func normalizeContainerEndpointSettings(ctx context.Context, cli *client.Client, primary *network.NetworkingConfig, extras map[string]*network.EndpointSettings) {
+func normalizeContainerEndpointSettings(ctx context.Context, cli *client.Client, primary *network.NetworkingConfig, extras map[string]*network.EndpointSettings) error {
 	if cli.NewVersionError(ctx, "1.44", "specify mac-address per network") != nil {
 		removeEndpointMacAddresses(primary, extras)
 	}
@@ -619,11 +623,14 @@ func normalizeContainerEndpointSettings(ctx context.Context, cli *client.Client,
 			}
 			info, err := cli.NetworkInspect(ctx, netName, network.InspectOptions{})
 			if err != nil {
-				continue
+				return fmt.Errorf("inspect network %s failed: %w", netName, err)
+			}
+			if err := validateContainerEndpointStaticIP(netName, info, endpoint); err != nil {
+				return err
 			}
-			removeUnsupportedEndpointStaticIP(netName, info, endpoint)
 		}
 	}
+	return nil
 }
 
 func removeEndpointMacAddresses(primary *network.NetworkingConfig, extras map[string]*network.EndpointSettings) {
@@ -641,24 +648,28 @@ func removeEndpointMacAddresses(primary *network.NetworkingConfig, extras map[st
 	}
 }
 
-func removeUnsupportedEndpointStaticIP(netName string, info network.Inspect, endpoint *network.EndpointSettings) {
+func validateContainerEndpointStaticIP(netName string, info network.Inspect, endpoint *network.EndpointSettings) error {
 	if endpoint == nil || endpoint.IPAMConfig == nil {
-		return
+		return nil
 	}
-	if isDefaultBridgeNetwork(netName, info) {
-		endpoint.IPAMConfig = nil
-		return
+	ipam := endpoint.IPAMConfig
+	if err := ipam.Validate(); err != nil {
+		return fmt.Errorf("invalid IP configuration for network %s: %w", netName, err)
+	}
+	if ipam.IPv4Address == "" && ipam.IPv6Address == "" {
+		return nil
+	}
+	if netName == "host" || netName == "none" || isDefaultBridgeNetwork(netName, info) {
+		return fmt.Errorf("network %s does not support static IP configuration", netName)
 	}
 
-	if endpoint.IPAMConfig.IPv4Address != "" && !networkSupportsStaticIP(info, endpoint.IPAMConfig.IPv4Address, false) {
-		endpoint.IPAMConfig.IPv4Address = ""
+	if ipam.IPv4Address != "" && !networkSupportsStaticIP(info, ipam.IPv4Address, false) {
+		return fmt.Errorf("static IPv4 address %s is not in a configured subnet of network %s", ipam.IPv4Address, netName)
 	}
-	if endpoint.IPAMConfig.IPv6Address != "" && !networkSupportsStaticIP(info, endpoint.IPAMConfig.IPv6Address, true) {
-		endpoint.IPAMConfig.IPv6Address = ""
-	}
-	if endpoint.IPAMConfig.IPv4Address == "" && endpoint.IPAMConfig.IPv6Address == "" && len(endpoint.IPAMConfig.LinkLocalIPs) == 0 {
-		endpoint.IPAMConfig = nil
+	if ipam.IPv6Address != "" && !networkSupportsStaticIP(info, ipam.IPv6Address, true) {
+		return fmt.Errorf("static IPv6 address %s is not in a configured subnet of network %s", ipam.IPv6Address, netName)
 	}
+	return nil
 }
 
 func isDefaultBridgeNetwork(netName string, info network.Inspect) bool {
@@ -673,6 +684,7 @@ func networkSupportsStaticIP(info network.Inspect, ip string, isIPv6 bool) bool
 	if err != nil {
 		return false
 	}
+	addr = addr.Unmap()
 	if addr.Is6() != isIPv6 {
 		return false
 	}
@@ -813,11 +825,6 @@ func buildContainerRecoverNetworkConfig(networkSettings *container.NetworkSettin
 				IPv6Address:  endpoint.IPAMConfig.IPv6Address,
 				LinkLocalIPs: append([]string(nil), endpoint.IPAMConfig.LinkLocalIPs...),
 			}
-		} else if name != "bridge" && (endpoint.IPAddress != "" || endpoint.GlobalIPv6Address != "") {
-			endpointSetting.IPAMConfig = &network.EndpointIPAMConfig{
-				IPv4Address: endpoint.IPAddress,
-				IPv6Address: endpoint.GlobalIPv6Address,
-			}
 		}
 		if name == primaryName {
 			config.EndpointsConfig[name] = endpointSetting
@@ -831,39 +838,6 @@ func buildContainerRecoverNetworkConfig(networkSettings *container.NetworkSettin
 	return config, extraNetworks
 }
 
-const unsupportedUserSpecifiedIPAddress = "user specified IP address is supported only when connecting to networks with user configured subnets"
-
-func clearUnsupportedDynamicEndpointIPAM(err error, endpoints map[string]*network.EndpointSettings, networkSettings *container.NetworkSettings) bool {
-	if err == nil || !strings.Contains(err.Error(), unsupportedUserSpecifiedIPAddress) {
-		return false
-	}
-	for name, endpoint := range endpoints {
-		if !isDynamicContainerNetwork(networkSettings, name) || endpoint == nil || endpoint.IPAMConfig == nil {
-			continue
-		}
-		if strings.Contains(err.Error(), "network "+name+":") {
-			endpoint.IPAMConfig = nil
-			return true
-		}
-	}
-	cleared := false
-	for name, endpoint := range endpoints {
-		if isDynamicContainerNetwork(networkSettings, name) && endpoint != nil && endpoint.IPAMConfig != nil {
-			endpoint.IPAMConfig = nil
-			cleared = true
-		}
-	}
-	return cleared
-}
-
-func isDynamicContainerNetwork(networkSettings *container.NetworkSettings, name string) bool {
-	if networkSettings == nil || name == "bridge" {
-		return false
-	}
-	endpoint := networkSettings.Networks[name]
-	return endpoint != nil && endpoint.IPAMConfig == nil && (endpoint.IPAddress != "" || endpoint.GlobalIPv6Address != "")
-}
-
 func cloneContainerConfig(config *container.Config) *container.Config {
 	if config == nil {
 		return &container.Config{}

agent/app/service/container.go

@@ -16,6 +16,7 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -24,6 +25,7 @@ import (
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
 	"github.com/1Panel-dev/1Panel/agent/app/task"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
@@ -79,7 +81,7 @@ type IContainerService interface {
 	ContainerUpgrade(req dto.ContainerUpgrade) error
 	ContainerInfo(req dto.OperationWithName) (*dto.ContainerOperate, error)
 	ContainerListStats() ([]dto.ContainerListStats, error)
-	ContainerItemStats(req dto.OperationWithName) (dto.ContainerItemStats, error)
+	ContainerItemStats(ctx context.Context, req dto.OperationWithName) (dto.ContainerItemStats, error)
 	LoadResourceLimit() (*dto.ResourceLimit, error)
 	ContainerRename(req dto.ContainerRename) error
 	ContainerCommit(req dto.ContainerCommit) error
@@ -246,15 +248,15 @@ func (u *ContainerService) LoadStatus() (dto.ContainerStatus, error) {
 	}
 	return data, nil
 }
-func (u *ContainerService) ContainerItemStats(req dto.OperationWithName) (dto.ContainerItemStats, error) {
+func (u *ContainerService) ContainerItemStats(ctx context.Context, req dto.OperationWithName) (dto.ContainerItemStats, error) {
 	var data dto.ContainerItemStats
 	client, err := docker.NewDockerClient()
 	if err != nil {
 		return data, err
 	}
+	defer client.Close()
 	if req.Name != "system" {
-		defer client.Close()
-		containerInfo, _, err := client.ContainerInspectWithRaw(context.Background(), req.Name, true)
+		containerInfo, _, err := client.ContainerInspectWithRaw(ctx, req.Name, true)
 		if err != nil {
 			return data, err
 		}
@@ -263,7 +265,7 @@ func (u *ContainerService) ContainerItemStats(req dto.OperationWithName) (dto.Co
 		return data, nil
 	}
 
-	usage, err := client.DiskUsage(context.Background(), types.DiskUsageOptions{})
+	usage, err := client.DiskUsage(ctx, types.DiskUsageOptions{})
 	if err != nil {
 		return data, err
 	}
@@ -381,11 +383,6 @@ func (u *ContainerService) Inspect(req dto.InspectReq) (string, error) {
 }
 
 func (u *ContainerService) Prune(req dto.ContainerPrune) error {
-	client, err := docker.NewDockerClient()
-	if err != nil {
-		return err
-	}
-	defer client.Close()
 	name := ""
 	switch req.PruneType {
 	case "container":
@@ -406,6 +403,14 @@ func (u *ContainerService) Prune(req dto.ContainerPrune) error {
 	}
 
 	taskItem.AddSubTask(i18n.GetMsgByKey("TaskClean"), func(t *task.Task) error {
+		if err := t.TaskCtx.Err(); err != nil {
+			return err
+		}
+		client, err := docker.NewDockerClient()
+		if err != nil {
+			return err
+		}
+		defer client.Close()
 		pruneFilters := filters.NewArgs()
 		if req.WithTagAll {
 			pruneFilters.Add("dangling", "false")
@@ -429,10 +434,7 @@ func (u *ContainerService) Prune(req dto.ContainerPrune) error {
 			}
 			SpaceReclaimed = int(rep.SpaceReclaimed)
 		case "network":
-			_, err := client.NetworksPrune(context.Background(), pruneFilters)
-			if err != nil {
-				return err
-			}
+			return cleanUnusedNetworks(t, client)
 		case "volume":
 			versions, err := client.ServerVersion(context.Background())
 			if err != nil {
@@ -534,7 +536,9 @@ func (u *ContainerService) ContainerCreate(req dto.ContainerOperate, inThread bo
 		if err != nil {
 			return err
 		}
-		normalizeContainerEndpointSettings(ctx, client, networkConf, nil)
+		if err := normalizeContainerEndpointSettings(ctx, client, networkConf, nil); err != nil {
+			return err
+		}
 		con, err := client.ContainerCreate(ctx, config, hostConf, networkConf, &v1.Platform{}, req.Name)
 		if err != nil {
 			taskItem.Log(i18n.GetMsgByKey("ContainerCreateFailed"))
@@ -644,14 +648,9 @@ func loadContainerNetworkInfo(name string, endpoint *network.EndpointSettings) d
 	if endpoint.IPAMConfig != nil {
 		item.LinkLocalIPs = append([]string(nil), endpoint.IPAMConfig.LinkLocalIPs...)
 	}
-	if name != "bridge" {
-		if endpoint.IPAMConfig != nil {
-			item.Ipv4 = endpoint.IPAMConfig.IPv4Address
-			item.Ipv6 = endpoint.IPAMConfig.IPv6Address
-		} else {
-			item.Ipv4 = endpoint.IPAddress
-			item.Ipv6 = endpoint.GlobalIPv6Address
-		}
+	if name != "bridge" && endpoint.IPAMConfig != nil {
+		item.Ipv4 = endpoint.IPAMConfig.IPv4Address
+		item.Ipv6 = endpoint.IPAMConfig.IPv6Address
 	}
 	return item
 }
@@ -1678,30 +1677,42 @@ func checkImageLike(client *client.Client, imageName string) bool {
 
 func pullImages(task *task.Task, client *client.Client, imageName string) error {
 	dockerCli := docker.NewClientWithExist(client)
+	repos, err := imageRepoRepo.List()
+	if err != nil {
+		return err
+	}
+	imageRepo := selectImageRepo(imageName, repos)
+	if imageRepo == nil || !imageRepo.Auth {
+		return dockerCli.PullImageWithProcess(task, imageName)
+	}
+
 	options := image.PullOptions{}
-	repos, _ := imageRepoRepo.List()
-	if len(repos) != 0 {
-		for _, repo := range repos {
-			if strings.HasPrefix(imageName, repo.DownloadUrl) && repo.Auth {
-				authConfig := registry.AuthConfig{
-					Username: repo.Username,
-					Password: repo.Password,
-				}
-				encodedJSON, err := json.Marshal(authConfig)
-				if err != nil {
-					return err
-				}
-				authStr := base64.URLEncoding.EncodeToString(encodedJSON)
-				options.RegistryAuth = authStr
-			}
+	authConfig := registry.AuthConfig{
+		Username: imageRepo.Username,
+		Password: imageRepo.Password,
+	}
+	encodedJSON, err := json.Marshal(authConfig)
+	if err != nil {
+		return err
+	}
+	options.RegistryAuth = base64.URLEncoding.EncodeToString(encodedJSON)
+	return dockerCli.PullImageWithProcessAndOptions(task, imageName, options)
+}
+
+func selectImageRepo(imageName string, repos []model.ImageRepo) *model.ImageRepo {
+	var selected *model.ImageRepo
+	selectedURLLength := 0
+	for i := range repos {
+		downloadURL := strings.TrimRight(strings.TrimSpace(repos[i].DownloadUrl), "/")
+		if downloadURL == "" || !strings.HasPrefix(imageName, downloadURL+"/") {
+			continue
 		}
-	} else {
-		hasAuth, authStr := loadAuthInfo(imageName)
-		if hasAuth {
-			options.RegistryAuth = authStr
+		if len(downloadURL) > selectedURLLength {
+			selected = &repos[i]
+			selectedURLLength = len(downloadURL)
 		}
 	}
-	return dockerCli.PullImageWithProcessAndOptions(task, imageName, options)
+	return selected
 }
 
 func loadCpuAndMem(client *client.Client, containerItem string) dto.ContainerListStats {
@@ -1758,7 +1769,10 @@ func checkPortStats(ports []dto.PortHelper, checkInUse bool) (nat.PortMap, error
 			}
 			for i := 0; i <= hostEnd-hostStart; i++ {
 				bindItem := nat.PortBinding{HostPort: strconv.Itoa(hostStart + i), HostIP: port.HostIP}
-				portMap[nat.Port(fmt.Sprintf("%d/%s", containerStart+i, port.Protocol))] = []nat.PortBinding{bindItem}
+				portKey := nat.Port(fmt.Sprintf("%d/%s", containerStart+i, port.Protocol))
+				if !slices.Contains(portMap[portKey], bindItem) {
+					portMap[portKey] = append(portMap[portKey], bindItem)
+				}
 			}
 			for i := hostStart; i <= hostEnd; i++ {
 				if checkInUse && common.ScanPortWithIP(port.HostIP, i) {
@@ -1776,7 +1790,10 @@ func checkPortStats(ports []dto.PortHelper, checkInUse bool) (nat.PortMap, error
 				return portMap, buserr.WithDetail("ErrPortInUsed", portItem, nil)
 			}
 			bindItem := nat.PortBinding{HostPort: strconv.Itoa(portItem), HostIP: port.HostIP}
-			portMap[nat.Port(fmt.Sprintf("%s/%s", port.ContainerPort, port.Protocol))] = []nat.PortBinding{bindItem}
+			portKey := nat.Port(fmt.Sprintf("%s/%s", port.ContainerPort, port.Protocol))
+			if !slices.Contains(portMap[portKey], bindItem) {
+				portMap[portKey] = append(portMap[portKey], bindItem)
+			}
 		}
 	}
 	return portMap, nil
@@ -1922,90 +1939,7 @@ func loadPortByInspect(id string, client *client.Client) ([]container.Port, erro
 	return itemPorts, nil
 }
 func transPortToStr(ports []container.Port) []string {
-	var (
-		ipv4Ports []container.Port
-		ipv6Ports []container.Port
-	)
-	for _, port := range ports {
-		if strings.Contains(port.IP, ":") {
-			ipv6Ports = append(ipv6Ports, port)
-		} else {
-			ipv4Ports = append(ipv4Ports, port)
-		}
-	}
-	list1 := simplifyPort(ipv4Ports)
-	list2 := simplifyPort(ipv6Ports)
-	return append(list1, list2...)
-}
-func simplifyPort(ports []container.Port) []string {
-	var datas []string
-	if len(ports) == 0 {
-		return datas
-	}
-	if len(ports) == 1 {
-		ip := ""
-		if len(ports[0].IP) != 0 {
-			ip = ports[0].IP + ":"
-		}
-		itemPortStr := fmt.Sprintf("%s%v/%s", ip, ports[0].PrivatePort, ports[0].Type)
-		if ports[0].PublicPort != 0 {
-			itemPortStr = fmt.Sprintf("%s%v->%v/%s", ip, ports[0].PublicPort, ports[0].PrivatePort, ports[0].Type)
-		}
-		datas = append(datas, itemPortStr)
-		return datas
-	}
-
-	sort.Slice(ports, func(i, j int) bool {
-		return ports[i].PrivatePort < ports[j].PrivatePort
-	})
-	start := ports[0]
-
-	for i := 1; i < len(ports); i++ {
-		if ports[i].PrivatePort != ports[i-1].PrivatePort+1 || ports[i].IP != ports[i-1].IP || ports[i].PublicPort != ports[i-1].PublicPort+1 || ports[i].Type != ports[i-1].Type {
-			if ports[i-1].PrivatePort == start.PrivatePort {
-				itemPortStr := fmt.Sprintf("%s:%v/%s", start.IP, start.PrivatePort, start.Type)
-				if start.PublicPort != 0 {
-					itemPortStr = fmt.Sprintf("%s:%v->%v/%s", start.IP, start.PublicPort, start.PrivatePort, start.Type)
-				}
-				if len(start.IP) == 0 {
-					itemPortStr = strings.TrimPrefix(itemPortStr, ":")
-				}
-				datas = append(datas, itemPortStr)
-			} else {
-				itemPortStr := fmt.Sprintf("%s:%v-%v/%s", start.IP, start.PrivatePort, ports[i-1].PrivatePort, start.Type)
-				if start.PublicPort != 0 {
-					itemPortStr = fmt.Sprintf("%s:%v-%v->%v-%v/%s", start.IP, start.PublicPort, ports[i-1].PublicPort, start.PrivatePort, ports[i-1].PrivatePort, start.Type)
-				}
-				if len(start.IP) == 0 {
-					itemPortStr = strings.TrimPrefix(itemPortStr, ":")
-				}
-				datas = append(datas, itemPortStr)
-			}
-			start = ports[i]
-		}
-		if i == len(ports)-1 {
-			if ports[i].PrivatePort == start.PrivatePort {
-				itemPortStr := fmt.Sprintf("%s:%v/%s", start.IP, start.PrivatePort, start.Type)
-				if start.PublicPort != 0 {
-					itemPortStr = fmt.Sprintf("%s:%v->%v/%s", start.IP, start.PublicPort, start.PrivatePort, start.Type)
-				}
-				if len(start.IP) == 0 {
-					itemPortStr = strings.TrimPrefix(itemPortStr, ":")
-				}
-				datas = append(datas, itemPortStr)
-			} else {
-				itemPortStr := fmt.Sprintf("%s:%v-%v/%s", start.IP, start.PrivatePort, ports[i].PrivatePort, start.Type)
-				if start.PublicPort != 0 {
-					itemPortStr = fmt.Sprintf("%s:%v-%v->%v-%v/%s", start.IP, start.PublicPort, ports[i].PublicPort, start.PrivatePort, ports[i].PrivatePort, start.Type)
-				}
-				if len(start.IP) == 0 {
-					itemPortStr = strings.TrimPrefix(itemPortStr, ":")
-				}
-				datas = append(datas, itemPortStr)
-			}
-		}
-	}
-	return datas
+	return docker.SimplifyPorts(ports)
 }
 
 func loadComposeCount(client *client.Client) int {
@@ -2038,7 +1972,7 @@ func loadComposeCount(client *client.Client) int {
 }
 func loadContainerPortForInfo(itemPorts []container.Port) []dto.PortHelper {
 	var exposedPorts []dto.PortHelper
-	samePortMap := make(map[string]dto.PortHelper)
+	seenPorts := make(map[dto.PortHelper]struct{})
 	ports := transPortToStr(itemPorts)
 	for _, item := range ports {
 		itemStr := strings.Split(item, "->")
@@ -2059,16 +1993,11 @@ func loadContainerPortForInfo(itemPorts []container.Port) []dto.PortHelper {
 		}
 		itemPort.ContainerPort = itemContainer[0]
 		itemPort.Protocol = itemContainer[1]
-		keyItem := fmt.Sprintf("%s->%s/%s", itemPort.HostPort, itemPort.ContainerPort, itemPort.Protocol)
-		if val, ok := samePortMap[keyItem]; ok {
-			val.HostIP = ""
-			samePortMap[keyItem] = val
-		} else {
-			samePortMap[keyItem] = itemPort
+		if _, exists := seenPorts[itemPort]; exists {
+			continue
 		}
-	}
-	for _, val := range samePortMap {
-		exposedPorts = append(exposedPorts, val)
+		seenPorts[itemPort] = struct{}{}
+		exposedPorts = append(exposedPorts, itemPort)
 	}
 	return exposedPorts
 }

agent/app/service/container_compose.go

@@ -28,6 +28,7 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	"gopkg.in/yaml.v3"
+	"gorm.io/gorm"
 )
 
 const composeProjectLabel = "com.docker.compose.project"
@@ -252,6 +253,10 @@ func (u *ContainerService) CreateCompose(req dto.ComposeCreate) error {
 		return err
 	}
 	req.Name = projectName
+	recordName := strings.ToLower(req.Name)
+	if err := saveComposeRecord(recordName, req.Path); err != nil {
+		return fmt.Errorf("save compose record failed, err: %v", err)
+	}
 	taskItem, err := task.NewTaskWithOps(req.Name, task.TaskCreate, task.TaskScopeCompose, req.TaskID, 1)
 	if err != nil {
 		return fmt.Errorf("new task for image build failed, err: %v", err)
@@ -260,18 +265,7 @@ func (u *ContainerService) CreateCompose(req dto.ComposeCreate) error {
 		taskItem.AddSubTask(i18n.GetMsgByKey("ComposeCreate"), func(t *task.Task) error {
 			err := compose.UpWithTask(req.Path, t, req.ForcePull, req.Name)
 			t.LogWithStatus(i18n.GetMsgByKey("ComposeCreate"), err)
-			if err != nil {
-				_, _ = compose.Down(req.Path, req.Name)
-				return err
-			}
-			recordName := strings.ToLower(req.Name)
-			record, _ := composeRepo.GetRecord(repo.WithByName(recordName))
-			if record.ID == 0 {
-				_ = composeRepo.CreateRecord(&model.Compose{Name: recordName, Path: req.Path})
-			} else {
-				_ = composeRepo.UpdateRecord(recordName, map[string]interface{}{"path": req.Path})
-			}
-			return nil
+			return err
 		}, nil)
 		_ = taskItem.Execute()
 	}()
@@ -279,6 +273,17 @@ func (u *ContainerService) CreateCompose(req dto.ComposeCreate) error {
 	return nil
 }
 
+func saveComposeRecord(name, composePath string) error {
+	record, err := composeRepo.GetRecord(repo.WithByName(name))
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return err
+	}
+	if record.ID == 0 {
+		return composeRepo.CreateRecord(&model.Compose{Name: name, Path: composePath})
+	}
+	return composeRepo.UpdateRecord(name, map[string]interface{}{"path": composePath})
+}
+
 func checkComposeRecordName(name string) error {
 	composeItem, _ := composeRepo.GetRecord(repo.WithByName(name))
 	if composeItem.ID != 0 && len(composeItem.Path) != 0 {

agent/app/service/container_network.go

@@ -2,16 +2,24 @@ package service
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/client"
+	"github.com/docker/docker/errdefs"
 )
 
+var networkCleanupSlot = make(chan struct{}, 1)
+
 func (u *ContainerService) PageNetwork(req dto.SearchWithPage) (int64, interface{}, error) {
 	client, err := docker.NewDockerClient()
 	if err != nil {
@@ -172,3 +180,114 @@ func (u *ContainerService) CreateNetwork(req dto.NetworkCreate) error {
 	}
 	return nil
 }
+
+func cleanUnusedNetworks(t *task.Task, cli *client.Client) error {
+	ctx := t.TaskCtx
+	select {
+	case networkCleanupSlot <- struct{}{}:
+		defer func() { <-networkCleanupSlot }()
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	networks, err := cli.NetworkList(ctx, network.ListOptions{})
+	if err != nil {
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		return err
+	}
+	deleted, skipped, failed := 0, 0, 0
+	defer func() {
+		t.Log(i18n.GetMsgWithMap("NetworkCleanupSummary", map[string]interface{}{
+			"deleted": deleted, "skipped": skipped, "failed": failed,
+		}))
+	}()
+	var used map[string]bool
+	sort.Slice(networks, func(i, j int) bool { return networks[i].Name < networks[j].Name })
+	for _, n := range networks {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		switch n.Name {
+		case "none", "host", "bridge", "1panel-network":
+			skipped++
+			continue
+		}
+		if n.Scope != "local" || n.Ingress || n.ConfigOnly {
+			skipped++
+			continue
+		}
+		values := map[string]interface{}{"name": n.Name, "id": n.ID}
+		if used == nil {
+			containers, err := cli.ContainerList(ctx, container.ListOptions{All: true})
+			if err != nil {
+				if ctx.Err() != nil {
+					return ctx.Err()
+				}
+				return err
+			}
+			used = make(map[string]bool)
+			for _, c := range containers {
+				if c.NetworkSettings == nil {
+					continue
+				}
+				for name, endpoint := range c.NetworkSettings.Networks {
+					used[name] = true
+					if endpoint != nil {
+						used[endpoint.NetworkID] = true
+					}
+				}
+			}
+		}
+		if used[n.Name] || used[n.ID] {
+			skipped++
+			t.Log(i18n.GetMsgWithMap("NetworkCleanupConnected", values))
+			continue
+		}
+		inspected, err := cli.NetworkInspect(ctx, n.ID, network.InspectOptions{})
+		if err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			if errdefs.IsNotFound(err) {
+				skipped++
+			} else {
+				failed++
+				t.Logf("Failed to inspect network [%s] (%s): %v", n.Name, n.ID, err)
+			}
+			continue
+		}
+		if len(inspected.Containers) > 0 {
+			skipped++
+			t.Log(i18n.GetMsgWithMap("NetworkCleanupConnected", values))
+			continue
+		}
+		if err := cli.NetworkRemove(ctx, n.ID); err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			switch {
+			case errdefs.IsNotFound(err):
+				skipped++
+			case errdefs.IsConflict(err):
+				skipped++
+				t.Log(i18n.GetMsgWithMap("NetworkCleanupConnected", values))
+			default:
+				failed++
+				t.Logf("Failed to remove network [%s] (%s): %v", n.Name, n.ID, err)
+			}
+			continue
+		}
+		deleted++
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if failed > 0 {
+		return errors.New(i18n.GetMsgByKey("NetworkCleanupPartialFailure"))
+	}
+	return nil
+}

agent/app/service/container_update.go

@@ -1,9 +1,11 @@
 package service
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"sort"
 	"strings"
 	"sync"
@@ -18,6 +20,7 @@ import (
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/stdcopy"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
@@ -64,13 +67,13 @@ func (u *ContainerService) ContainerUpdate(req dto.ContainerOperate) error {
 			if err != nil {
 				return err
 			}
-			normalizeContainerEndpointSettings(ctx, client, networkConf, nil)
+			if err := normalizeContainerEndpointSettings(ctx, client, networkConf, nil); err != nil {
+				return err
+			}
 
 			cleanupErr, err := switchContainer(ctx, client, req.Name, oldContainer, func() (container.CreateResponse, error) {
-				return createContainerWithDynamicIPFallback(func() (container.CreateResponse, error) {
-					return client.ContainerCreate(ctx, config, hostConf, networkConf, &v1.Platform{}, req.Name)
-				}, networkConf.EndpointsConfig, oldContainer.NetworkSettings)
-			}, newContainerSwitchTaskLogger(t))
+				return client.ContainerCreate(ctx, config, hostConf, networkConf, &v1.Platform{}, req.Name)
+			}, config.Tty, t)
 			if err != nil {
 				return fmt.Errorf("update container failed, err: %v", err)
 			}
@@ -135,9 +138,15 @@ func (u *ContainerService) ContainerUpgrade(req dto.ContainerUpgrade) error {
 				config.Image = req.Image
 				hostConf := cloneContainerHostConfig(oldContainer.HostConfig)
 				preserveContainerVolumeMounts(hostConf, oldContainer.Mounts)
+				networkConf, extraNetworks := buildContainerRecoverNetworkConfig(oldContainer.NetworkSettings, hostConf)
+				if err := normalizeContainerEndpointSettings(ctx, client, networkConf, extraNetworks); err != nil {
+					upgradeErr := fmt.Errorf("prepare networks for container %s failed: %w", item, err)
+					upgradeErrors = append(upgradeErrors, upgradeErr)
+					return upgradeErr
+				}
 				cleanupErr, err := switchContainer(ctx, client, item, oldContainer, func() (container.CreateResponse, error) {
-					return createContainerWithOldNetworks(ctx, client, config, hostConf, oldContainer.NetworkSettings, item)
-				}, newContainerSwitchTaskLogger(t))
+					return createContainerWithNetworks(ctx, client, config, hostConf, networkConf, extraNetworks, item)
+				}, config.Tty, t)
 				if err != nil {
 					upgradeErr := fmt.Errorf("upgrade container %s failed: %w", item, err)
 					upgradeErrors = append(upgradeErrors, upgradeErr)
@@ -166,6 +175,7 @@ type containerSwitchClient interface {
 	ContainerStart(context.Context, string, container.StartOptions) error
 	ContainerRemove(context.Context, string, container.RemoveOptions) error
 	ContainerInspect(context.Context, string) (container.InspectResponse, error)
+	ContainerLogs(context.Context, string, container.LogsOptions) (io.ReadCloser, error)
 	NetworkConnect(context.Context, string, string, *network.EndpointSettings) error
 	NetworkDisconnect(context.Context, string, string, bool) error
 }
@@ -238,22 +248,18 @@ func (l *containerOperationMutex) lock(names ...string) func() {
 }
 
 type containerNetworkAttachment struct {
-	name      string
-	endpoint  *network.EndpointSettings
-	isDynamic bool
+	name     string
+	endpoint *network.EndpointSettings
 }
 
-type containerSwitchLogFunc func(messageKey, containerName string, err error)
-
-func newContainerSwitchTaskLogger(t *task.Task) containerSwitchLogFunc {
-	return func(messageKey, containerName string, err error) {
-		t.LogWithStatus(i18n.GetWithName(messageKey, containerName), err)
-	}
+type containerSwitchLogger interface {
+	LogWithStatus(string, error)
+	Log(string)
 }
 
-func logContainerSwitchStep(logger containerSwitchLogFunc, messageKey, containerName string, err error) {
+func logContainerSwitchStep(logger containerSwitchLogger, messageKey, containerName string, err error) {
 	if logger != nil {
-		logger(messageKey, containerName, err)
+		logger.LogWithStatus(i18n.GetWithName(messageKey, containerName), err)
 	}
 }
 
@@ -264,7 +270,8 @@ func switchContainer(
 	name string,
 	oldContainer container.InspectResponse,
 	createNew func() (container.CreateResponse, error),
-	logger containerSwitchLogFunc,
+	tty bool,
+	logger containerSwitchLogger,
 ) (cleanupErr error, err error) {
 	if oldContainer.ID == "" {
 		return nil, fmt.Errorf("original container ID is empty")
@@ -314,6 +321,7 @@ func switchContainer(
 	}
 	if err := cli.ContainerStart(ctx, created.ID, container.StartOptions{}); err != nil {
 		logContainerSwitchStep(logger, "ContainerStartReplacement", name, err)
+		logContainerStartupLogs(ctx, cli, created.ID, name, tty, logger)
 		rollbackErr := restoreOriginalContainer(ctx, cli, oldContainer.ID, name, wasRunning, created.ID, disconnectedNetworks, logger)
 		return nil, errors.Join(fmt.Errorf("start new container failed: %w", err), rollbackErr)
 	}
@@ -321,6 +329,7 @@ func switchContainer(
 	if wasRunning {
 		if err := waitContainerReady(ctx, cli, created.ID); err != nil {
 			logContainerSwitchStep(logger, "ContainerWaitReplacement", name, err)
+			logContainerStartupLogs(ctx, cli, created.ID, name, tty, logger)
 			rollbackErr := restoreOriginalContainer(ctx, cli, oldContainer.ID, name, wasRunning, created.ID, disconnectedNetworks, logger)
 			return nil, errors.Join(fmt.Errorf("new container readiness check failed: %w", err), rollbackErr)
 		}
@@ -337,8 +346,48 @@ const (
 	containerStartPollInterval  = time.Second
 	containerHealthCheckMinWait = 30 * time.Second
 	containerHealthCheckMaxWait = 10 * time.Minute
+	containerDiagnosticLogTail  = "200"
 )
 
+func logContainerStartupLogs(ctx context.Context, cli containerSwitchClient, containerID, name string, tty bool, logger containerSwitchLogger) {
+	if logger == nil {
+		return
+	}
+	logger.Log(fmt.Sprintf("========== %s ==========", i18n.GetWithName("ContainerStartupDiagnostic", name)))
+	diagnosticCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	reader, err := cli.ContainerLogs(diagnosticCtx, containerID, container.LogsOptions{
+		ShowStdout: true,
+		ShowStderr: true,
+		Timestamps: true,
+		Tail:       containerDiagnosticLogTail,
+	})
+	if err != nil {
+		logger.Log(i18n.GetWithNameAndErr("ContainerDiagnosticLogsFailed", name, err))
+		return
+	}
+	defer reader.Close()
+
+	var output bytes.Buffer
+	if tty {
+		_, err = io.Copy(&output, reader)
+	} else {
+		_, err = stdcopy.StdCopy(&output, &output, reader)
+	}
+	if err != nil {
+		logger.Log(i18n.GetWithNameAndErr("ContainerDiagnosticLogsFailed", name, err))
+		return
+	}
+	logs := strings.TrimSpace(output.String())
+	logger.Log(fmt.Sprintf("---------- %s ----------", i18n.GetMsgByKey("ContainerRecentLogs")))
+	if logs == "" {
+		logger.Log(i18n.GetMsgByKey("ContainerDiagnosticLogsEmpty"))
+		return
+	}
+	logger.Log(logs)
+}
+
 func waitContainerReady(ctx context.Context, cli containerInspectClient, containerID string) error {
 	info, err := cli.ContainerInspect(ctx, containerID)
 	if err != nil {
@@ -538,13 +587,13 @@ func disconnectOriginalContainerNetworks(ctx context.Context, cli containerSwitc
 	endpoints := make(map[string]*network.EndpointSettings, len(extras)+1)
 	if primary != nil {
 		for name, endpoint := range primary.EndpointsConfig {
-			if name != "bridge" && endpoint != nil && endpoint.IPAMConfig != nil {
+			if name != "bridge" && endpoint != nil {
 				endpoints[name] = endpoint
 			}
 		}
 	}
 	for name, endpoint := range extras {
-		if name != "bridge" && endpoint != nil && endpoint.IPAMConfig != nil {
+		if name != "bridge" && endpoint != nil {
 			endpoints[name] = endpoint
 		}
 	}
@@ -560,9 +609,8 @@ func disconnectOriginalContainerNetworks(ctx context.Context, cli containerSwitc
 			return disconnected, fmt.Errorf("disconnect original container from network %s failed: %w", name, err)
 		}
 		disconnected = append(disconnected, containerNetworkAttachment{
-			name:      name,
-			endpoint:  endpoints[name],
-			isDynamic: isDynamicContainerNetwork(oldContainer.NetworkSettings, name),
+			name:     name,
+			endpoint: endpoints[name],
 		})
 	}
 	return disconnected, nil
@@ -572,10 +620,6 @@ func reconnectOriginalContainerNetworks(ctx context.Context, cli containerSwitch
 	var reconnectErr error
 	for _, attachment := range attachments {
 		err := cli.NetworkConnect(ctx, attachment.name, containerID, attachment.endpoint)
-		if err != nil && attachment.isDynamic && strings.Contains(err.Error(), unsupportedUserSpecifiedIPAddress) {
-			attachment.endpoint.IPAMConfig = nil
-			err = cli.NetworkConnect(ctx, attachment.name, containerID, attachment.endpoint)
-		}
 		if err != nil {
 			reconnectErr = errors.Join(reconnectErr, fmt.Errorf("reconnect original container to network %s failed: %w", attachment.name, err))
 		}
@@ -583,7 +627,7 @@ func reconnectOriginalContainerNetworks(ctx context.Context, cli containerSwitch
 	return reconnectErr
 }
 
-func restoreOriginalContainer(ctx context.Context, cli containerSwitchClient, oldContainerID, originalName string, wasRunning bool, newContainer string, disconnectedNetworks []containerNetworkAttachment, logger containerSwitchLogFunc) error {
+func restoreOriginalContainer(ctx context.Context, cli containerSwitchClient, oldContainerID, originalName string, wasRunning bool, newContainer string, disconnectedNetworks []containerNetworkAttachment, logger containerSwitchLogger) error {
 	var rollbackErr error
 	backupName := containerSwitchBackupName(oldContainerID)
 	if newContainer != "" {
@@ -608,7 +652,7 @@ func restoreOriginalContainer(ctx context.Context, cli containerSwitchClient, ol
 	reconnectErr := reconnectOriginalContainerNetworks(ctx, cli, oldContainerID, disconnectedNetworks)
 	logContainerSwitchStep(logger, "ContainerRollbackReconnectOld", currentName, reconnectErr)
 	rollbackErr = errors.Join(rollbackErr, reconnectErr)
-	if wasRunning {
+	if wasRunning && reconnectErr == nil {
 		restartErr := restartOriginalContainer(ctx, cli, oldContainerID)
 		logContainerSwitchStep(logger, "ContainerRollbackRestartOld", currentName, restartErr)
 		rollbackErr = errors.Join(rollbackErr, restartErr)
@@ -616,17 +660,8 @@ func restoreOriginalContainer(ctx context.Context, cli containerSwitchClient, ol
 	return rollbackErr
 }
 
-func createContainerWithOldNetworks(ctx context.Context, client *client.Client, config *container.Config, hostConf *container.HostConfig, networkSettings *container.NetworkSettings, name string) (container.CreateResponse, error) {
-	networkConf, extraNetworks := buildContainerRecoverNetworkConfig(networkSettings, hostConf)
-	normalizeContainerEndpointSettings(ctx, client, networkConf, extraNetworks)
-	var primaryEndpoints map[string]*network.EndpointSettings
-	if networkConf != nil {
-		primaryEndpoints = networkConf.EndpointsConfig
-	}
-
-	created, err := createContainerWithDynamicIPFallback(func() (container.CreateResponse, error) {
-		return client.ContainerCreate(ctx, config, hostConf, networkConf, nil, name)
-	}, primaryEndpoints, networkSettings)
+func createContainerWithNetworks(ctx context.Context, client *client.Client, config *container.Config, hostConf *container.HostConfig, networkConf *network.NetworkingConfig, extraNetworks map[string]*network.EndpointSettings, name string) (container.CreateResponse, error) {
+	created, err := client.ContainerCreate(ctx, config, hostConf, networkConf, nil, name)
 	if err != nil {
 		return created, err
 	}
@@ -638,9 +673,6 @@ func createContainerWithOldNetworks(ctx context.Context, client *client.Client,
 	sort.Strings(extraNames)
 	for _, item := range extraNames {
 		err := client.NetworkConnect(ctx, item, created.ID, extraNetworks[item])
-		if clearUnsupportedDynamicEndpointIPAM(err, map[string]*network.EndpointSettings{item: extraNetworks[item]}, networkSettings) {
-			err = client.NetworkConnect(ctx, item, created.ID, extraNetworks[item])
-		}
 		if err != nil {
 			_ = client.ContainerRemove(ctx, created.ID, container.RemoveOptions{Force: true})
 			return created, err
@@ -648,16 +680,3 @@ func createContainerWithOldNetworks(ctx context.Context, client *client.Client,
 	}
 	return created, nil
 }
-
-func createContainerWithDynamicIPFallback(
-	create func() (container.CreateResponse, error),
-	endpoints map[string]*network.EndpointSettings,
-	networkSettings *container.NetworkSettings,
-) (container.CreateResponse, error) {
-	for {
-		created, err := create()
-		if err == nil || created.ID != "" || !clearUnsupportedDynamicEndpointIPAM(err, endpoints, networkSettings) {
-			return created, err
-		}
-	}
-}

agent/app/service/cronjob.go

@@ -16,6 +16,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
+	alertUtil "github.com/1Panel-dev/1Panel/agent/utils/alert"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
 	"github.com/jinzhu/copier"
 	"github.com/pkg/errors"
@@ -75,6 +76,7 @@ func (u *CronjobService) SearchWithPage(search dto.PageCronjob) (int64, interfac
 			EntryID:   cronjob.ID,
 		}
 		alertInfo, _ := alertRepo.Get(alertRepo.WithByType(alertBase.AlertType), alertRepo.WithByProject(strconv.Itoa(int(alertBase.EntryID))), repo.WithByStatus(constant.AlertEnable))
+		item.AlertTriggerMode, _ = alertUtil.CronJobAlertTriggerMode(alertInfo.AdvancedParams)
 		if alertInfo.SendCount != 0 {
 			item.AlertCount = alertInfo.SendCount
 		} else {
@@ -98,9 +100,11 @@ func (u *CronjobService) LoadInfo(req dto.OperateByID) (*dto.CronjobOperate, err
 		AlertType: cronjob.Type,
 		EntryID:   cronjob.ID,
 	}
-	alertInfo, _ := alertRepo.Get(alertRepo.WithByType(alertBase.AlertType), alertRepo.WithByProject(strconv.Itoa(int(alertBase.EntryID))), repo.WithByStatus(constant.AlertEnable))
+	alertInfo, _ := alertRepo.Get(alertRepo.WithByType(alertBase.AlertType), alertRepo.WithByProject(strconv.Itoa(int(alertBase.EntryID))))
 	item.AlertMethod = alertInfo.Method
-	if alertInfo.SendCount != 0 {
+	item.AlertTitle = alertInfo.Title
+	item.AlertTriggerMode, _ = alertUtil.CronJobAlertTriggerMode(alertInfo.AdvancedParams)
+	if alertInfo.Status == constant.AlertEnable {
 		item.AlertCount = alertInfo.SendCount
 	} else {
 		item.AlertCount = 0
@@ -195,11 +199,12 @@ func (u *CronjobService) Export(req dto.OperateByIDs) (string, error) {
 			}
 		}
 		item.SourceAccounts, item.DownloadAccount, _ = loadBackupNamesByID(cronjob.SourceAccountIDs, cronjob.DownloadAccountID)
-		alertInfo, _ := alertRepo.Get(alertRepo.WithByType(cronjob.Type), alertRepo.WithByProject(strconv.Itoa(int(cronjob.ID))), repo.WithByStatus(constant.AlertEnable))
-		if alertInfo.SendCount != 0 {
+		alertInfo, _ := alertRepo.Get(alertRepo.WithByType(cronjob.Type), alertRepo.WithByProject(strconv.Itoa(int(cronjob.ID))))
+		item.AlertTitle = alertInfo.Title
+		item.AlertMethod = alertInfo.Method
+		item.AlertTriggerMode, _ = alertUtil.CronJobAlertTriggerMode(alertInfo.AdvancedParams)
+		if alertInfo.Status == constant.AlertEnable {
 			item.AlertCount = alertInfo.SendCount
-			item.AlertTitle = alertInfo.Title
-			item.AlertMethod = alertInfo.Method
 		} else {
 			item.AlertCount = 0
 		}
@@ -213,6 +218,17 @@ func (u *CronjobService) Export(req dto.OperateByIDs) (string, error) {
 }
 
 func (u *CronjobService) Import(req []dto.CronjobTrans, operator string) error {
+	for _, item := range req {
+		advanced, err := cronJobAlertAdvancedParams(item.AlertTriggerMode)
+		if err != nil {
+			return err
+		}
+		if item.AlertCount != 0 {
+			if err := (AlertService{}).validateCronJobAlertChannels(item.Type, advanced, item.AlertMethod); err != nil {
+				return err
+			}
+		}
+	}
 	for _, item := range req {
 		cronjobItem, _ := cronjobRepo.Get(repo.WithByName(item.Name))
 		if cronjobItem.ID != 0 {
@@ -395,17 +411,27 @@ func (u *CronjobService) Import(req []dto.CronjobTrans, operator string) error {
 		} else {
 			cronjob.Status = constant.StatusDisable
 		}
-		_ = cronjobRepo.Create(&cronjob)
-		if item.AlertCount != 0 && item.AlertTitle != "" && item.AlertMethod != "" {
+		if err := cronjobRepo.Create(&cronjob); err != nil {
+			return err
+		}
+		if item.AlertTitle != "" && item.AlertMethod != "" {
+			advanced, _ := cronJobAlertAdvancedParams(item.AlertTriggerMode)
+			status := constant.AlertEnable
+			if item.AlertCount == 0 {
+				status = constant.AlertDisable
+			}
 			createAlert := dto.AlertCreate{
-				Title:     item.AlertTitle,
-				SendCount: item.AlertCount,
-				Method:    item.AlertMethod,
-				Type:      cronjob.Type,
-				Project:   strconv.Itoa(int(cronjob.ID)),
-				Status:    constant.AlertEnable,
+				Title:          item.AlertTitle,
+				SendCount:      item.AlertCount,
+				Method:         item.AlertMethod,
+				Type:           cronjob.Type,
+				Project:        strconv.Itoa(int(cronjob.ID)),
+				Status:         status,
+				AdvancedParams: advanced,
+			}
+			if err := NewIAlertService().CreateAlert(createAlert, operator); err != nil {
+				return err
 			}
-			_ = NewIAlertService().CreateAlert(createAlert, operator)
 		}
 	}
 	return nil
@@ -562,6 +588,15 @@ func (u *CronjobService) HandleOnce(id uint) error {
 }
 
 func (u *CronjobService) Create(req dto.CronjobOperate, operator string) error {
+	advanced, err := cronJobAlertAdvancedParams(req.AlertTriggerMode)
+	if err != nil {
+		return err
+	}
+	if req.AlertCount != 0 {
+		if err := (AlertService{}).validateCronJobAlertChannels(req.Type, advanced, req.AlertMethod); err != nil {
+			return err
+		}
+	}
 	cronjob, _ := cronjobRepo.Get(repo.WithByName(req.Name))
 	if cronjob.ID != 0 {
 		return buserr.New("ErrRecordExist")
@@ -603,12 +638,13 @@ func (u *CronjobService) Create(req dto.CronjobOperate, operator string) error {
 	}
 	if req.AlertCount != 0 && req.AlertTitle != "" && req.AlertMethod != "" {
 		createAlert := dto.AlertCreate{
-			Title:     req.AlertTitle,
-			SendCount: req.AlertCount,
-			Method:    req.AlertMethod,
-			Type:      cronjob.Type,
-			Project:   strconv.Itoa(int(cronjob.ID)),
-			Status:    constant.AlertEnable,
+			Title:          req.AlertTitle,
+			SendCount:      req.AlertCount,
+			Method:         req.AlertMethod,
+			Type:           cronjob.Type,
+			Project:        strconv.Itoa(int(cronjob.ID)),
+			Status:         constant.AlertEnable,
+			AdvancedParams: advanced,
 		}
 		err := NewIAlertService().CreateAlert(createAlert, operator)
 		if err != nil {
@@ -682,6 +718,10 @@ func (u *CronjobService) Delete(req dto.CronjobBatchDelete) error {
 }
 
 func (u *CronjobService) Update(id uint, req dto.CronjobOperate, operator string) error {
+	advanced, err := cronJobAlertAdvancedParams(req.AlertTriggerMode)
+	if err != nil {
+		return err
+	}
 	var cronjob model.Cronjob
 	if err := copier.Copy(&cronjob, &req); err != nil {
 		return buserr.WithDetail("ErrStructTransform", err.Error(), nil)
@@ -697,6 +737,20 @@ func (u *CronjobService) Update(id uint, req dto.CronjobOperate, operator string
 	if err != nil {
 		return buserr.New("ErrRecordNotFound")
 	}
+	if req.AlertCount != 0 {
+		previous, _ := alertRepo.Get(alertRepo.WithByType(cronModel.Type), alertRepo.WithByProject(strconv.Itoa(int(id))))
+		merged, err := prepareCronJobAlertParams(cronModel.Type, previous.AdvancedParams, advanced)
+		if err != nil {
+			return err
+		}
+		method := req.AlertMethod
+		if method == "" {
+			method = previous.Method
+		}
+		if err := (AlertService{}).validateCronJobAlertChannels(cronModel.Type, merged, method); err != nil {
+			return err
+		}
+	}
 	upMap := make(map[string]interface{})
 	cronjob.EntryIDs = cronModel.EntryIDs
 	cronjob.Type = cronModel.Type
@@ -753,11 +807,12 @@ func (u *CronjobService) Update(id uint, req dto.CronjobOperate, operator string
 		return err
 	}
 	updateAlert := dto.AlertCreate{
-		Title:     req.AlertTitle,
-		SendCount: req.AlertCount,
-		Method:    req.AlertMethod,
-		Type:      cronjob.Type,
-		Project:   strconv.Itoa(int(cronModel.ID)),
+		Title:          req.AlertTitle,
+		SendCount:      req.AlertCount,
+		Method:         req.AlertMethod,
+		Type:           cronjob.Type,
+		Project:        strconv.Itoa(int(cronModel.ID)),
+		AdvancedParams: advanced,
 	}
 	err = NewIAlertService().ExternalUpdateAlert(updateAlert, operator)
 	if err != nil {
@@ -766,6 +821,17 @@ func (u *CronjobService) Update(id uint, req dto.CronjobOperate, operator string
 	return nil
 }
 
+func cronJobAlertAdvancedParams(mode string) (string, error) {
+	if mode == "" {
+		return "", nil
+	}
+	data, err := json.Marshal(map[string]string{"alertTriggerMode": mode})
+	if err != nil {
+		return "", err
+	}
+	return alertUtil.MergeCronJobAlertParams("", string(data))
+}
+
 func (u *CronjobService) UpdateStatus(id uint, status string) error {
 	cronjob, _ := cronjobRepo.Get(repo.WithByID(id))
 	if cronjob.ID == 0 {

agent/app/service/cronjob_backup.go

@@ -412,6 +412,7 @@ func addSkipTask(source string, taskItem *task.Task) {
 		taskItem.Log(i18n.GetMsgByKey("NoSuchResource"))
 		return nil
 	}, nil)
+	taskItem.SubTasks[len(taskItem.SubTasks)-1].StepAlias = cronJobSkippedStep
 }
 
 func loadDbsForJob(cronjob model.Cronjob) []DatabaseHelper {

agent/app/service/cronjob_helper.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -23,6 +24,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/i18n"
+	alertUtil "github.com/1Panel-dev/1Panel/agent/utils/alert"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
 	"github.com/1Panel-dev/1Panel/agent/utils/ntp"
@@ -56,10 +58,11 @@ func (u *CronjobService) HandleJob(cronjob *model.Cronjob) {
 					_ = taskRepo.Save(context.Background(), taskItem.Task)
 				}
 				cronjobRepo.EndRecords(record, constant.StatusFailed, err.Error(), record.Records)
-				handleCronJobAlert(cronjob)
+				handleCronJobAlert(cronjob, cronJobAlertResult(taskItem, err))
 				return
 			}
 			cronjobRepo.EndRecords(record, constant.StatusSuccess, "", record.Records)
+			handleCronJobAlert(cronjob, cronJobAlertResult(taskItem, nil))
 		}()
 		return
 	}
@@ -70,19 +73,20 @@ func (u *CronjobService) HandleJob(cronjob *model.Cronjob) {
 			record.TaskID = ""
 		}
 		cronjobRepo.EndRecords(record, constant.StatusFailed, err.Error(), record.Records)
-		handleCronJobAlert(cronjob)
+		handleCronJobAlert(cronjob, cronJobAlertResult(taskItem, err))
 		return
 	}
 	go func() {
 		if err := taskItem.Execute(); err != nil {
-			taskItem, _ := taskRepo.GetFirst(taskRepo.WithByID(record.TaskID))
-			if len(taskItem.ID) == 0 {
+			storedTask, _ := taskRepo.GetFirst(taskRepo.WithByID(record.TaskID))
+			if len(storedTask.ID) == 0 {
 				record.TaskID = ""
 			}
 			cronjobRepo.EndRecords(record, constant.StatusFailed, err.Error(), record.Records)
-			handleCronJobAlert(cronjob)
+			handleCronJobAlert(cronjob, cronJobAlertResult(taskItem, err))
 		} else {
 			cronjobRepo.EndRecords(record, constant.StatusSuccess, "", record.Records)
+			handleCronJobAlert(cronjob, cronJobAlertResult(taskItem, nil))
 		}
 	}()
 }
@@ -482,8 +486,33 @@ func hasBackup(cronjobType string) bool {
 	return cronjobType == "app" || cronjobType == "database" || cronjobType == "website" || cronjobType == "directory" || cronjobType == "snapshot" || cronjobType == "log" || cronjobType == "cutWebsiteLog"
 }
 
-func handleCronJobAlert(cronjob *model.Cronjob) {
+const cronJobSkippedStep = "cronjob-skipped"
+
+func cronJobAlertResult(taskItem *task.Task, err error) string {
+	if errors.Is(err, context.Canceled) || taskItem.Task.Status == constant.StatusCanceled ||
+		(taskItem.TaskCtx != nil && taskItem.TaskCtx.Err() != nil) {
+		return ""
+	}
+	if err != nil {
+		return alertUtil.CronJobAlertFailed
+	}
+	if taskItem.Task.Status != constant.StatusSuccess {
+		return ""
+	}
+	for _, subTask := range taskItem.SubTasks {
+		if subTask.StepAlias != cronJobSkippedStep {
+			return alertUtil.CronJobAlertSuccess
+		}
+	}
+	return ""
+}
+
+func handleCronJobAlert(cronjob *model.Cronjob, result string) {
+	if result == "" {
+		return
+	}
 	pushAlert := dto.PushAlert{
+		Result:    result,
 		TaskName:  cronjob.Name,
 		AlertType: cronjob.Type,
 		EntryID:   cronjob.ID,

agent/app/service/dashboard.go

@@ -18,8 +18,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/xpu"
+	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/accelerator"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/controller"
@@ -243,9 +242,8 @@ func (u *DashboardService) LoadCurrentInfo(ioOption string, netOption string) *d
 	currentInfo.SwapMemoryUsed = swapInfo.Used
 	currentInfo.SwapMemoryUsedPercent = swapInfo.UsedPercent
 
-	currentInfo.DiskData = loadDiskInfo()
-	currentInfo.GPUData = loadGPUInfo()
-	currentInfo.XPUData = loadXpuInfo()
+	currentInfo.DiskData = loadDiskInfo(false)
+	currentInfo.GPUData, currentInfo.NPUData, currentInfo.XPUData = loadAcceleratorInfo()
 
 	if ioOption == "all" {
 		diskInfo, _ := disk.IOCounters()
@@ -457,24 +455,9 @@ type diskInfo struct {
 	Device string
 }
 
-func loadDiskInfo() []dto.DiskInfo {
+func loadDiskInfo(forceRefresh bool) []dto.DiskInfo {
 	var datas []dto.DiskInfo
-	cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(2 * time.Second))
-	format := `NR>1 && !/tmpfs|snap\/core|udev/ {printf "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", $1, $2, $3, $4, $5, $6, $7}`
-	stdout, err := cmdMgr.RunPipe(
-		cmd.PipeCommand{Name: "df", Args: []string{"-hT", "-P"}},
-		cmd.PipeCommand{Name: "awk", Args: []string{format}},
-	)
-	if err != nil {
-		cmdMgr2 := cmd.NewCommandMgr(cmd.WithTimeout(1 * time.Second))
-		stdout, err = cmdMgr2.RunPipe(
-			cmd.PipeCommand{Name: "df", Args: []string{"-lhT", "-P"}},
-			cmd.PipeCommand{Name: "awk", Args: []string{format}},
-		)
-		if err != nil {
-			return datas
-		}
-	}
+	stdout := loadDiskMounts()
 	lines := strings.Split(stdout, "\n")
 
 	var mounts []diskInfo
@@ -522,43 +505,22 @@ func loadDiskInfo() []dto.DiskInfo {
 			itemData.Type = mount.Type
 			itemData.Device = mount.Device
 
-			type diskResult struct {
-				state *disk.UsageStat
-				err   error
-			}
-			resultCh := make(chan diskResult, 1)
-
-			go func() {
-				state, err := psutil.DISK.GetUsage(mount.Mount, false)
-				resultCh <- diskResult{state: state, err: err}
-			}()
-
-			select {
-			case <-time.After(5 * time.Second):
-				mu.Lock()
-				datas = append(datas, itemData)
-				mu.Unlock()
-				global.LOG.Errorf("load disk info from %s failed, err: timeout", mount.Mount)
-			case result := <-resultCh:
-				if result.err != nil {
-					mu.Lock()
-					datas = append(datas, itemData)
-					mu.Unlock()
-					global.LOG.Errorf("load disk info from %s failed, err: %v", mount.Mount, result.err)
-					return
-				}
-				itemData.Total = result.state.Total
-				itemData.Free = result.state.Free
-				itemData.Used = result.state.Used
-				itemData.UsedPercent = result.state.UsedPercent
-				itemData.InodesTotal = result.state.InodesTotal
-				itemData.InodesUsed = result.state.InodesUsed
-				itemData.InodesFree = result.state.InodesFree
-				itemData.InodesUsedPercent = result.state.InodesUsedPercent
-				mu.Lock()
-				datas = append(datas, itemData)
-				mu.Unlock()
+			state, err := loadDiskUsageWithTimeout(mount.Mount, forceRefresh)
+			if err != nil {
+				global.LOG.Errorf("load disk info from %s failed, err: %v", mount.Mount, err)
+			} else {
+				itemData.Total = state.Total
+				itemData.Free = state.Free
+				itemData.Used = state.Used
+				itemData.UsedPercent = state.UsedPercent
+				itemData.InodesTotal = state.InodesTotal
+				itemData.InodesUsed = state.InodesUsed
+				itemData.InodesFree = state.InodesFree
+				itemData.InodesUsedPercent = state.InodesUsedPercent
 			}
+			mu.Lock()
+			datas = append(datas, itemData)
+			mu.Unlock()
 		}(mounts[i])
 	}
 	wg.Wait()
@@ -569,32 +531,134 @@ func loadDiskInfo() []dto.DiskInfo {
 	return datas
 }
 
-func loadGPUInfo() []dto.GPUInfo {
-	ok, client := gpu.New()
-	var list []interface{}
-	if ok {
-		info, err := client.LoadGpuInfo()
-		if err != nil || len(info.GPUs) == 0 {
-			return nil
-		}
-		for _, item := range info.GPUs {
-			list = append(list, item)
-		}
+var diskMountsMu sync.Mutex
+
+func loadDiskMounts() string {
+	if !diskMountsMu.TryLock() {
+		return ""
 	}
-	if len(list) == 0 {
-		return nil
+	resultCh := make(chan string, 1)
+	go func() {
+		var stdout string
+		defer func() {
+			diskMountsMu.Unlock()
+			resultCh <- stdout
+		}()
+		cmdMgr := cmd.NewCommandMgr(cmd.WithTimeout(2 * time.Second))
+		format := `NR>1 && !/tmpfs|snap\/core|udev/ {printf "%s\t%s\t%s\t%s\t%s\t%s\t%s\n", $1, $2, $3, $4, $5, $6, $7}`
+		output, err := cmdMgr.RunPipe(
+			cmd.PipeCommand{Name: "df", Args: []string{"-hT", "-P"}},
+			cmd.PipeCommand{Name: "awk", Args: []string{format}},
+		)
+		if err != nil {
+			global.LOG.Errorf("load disk info with df -hT -P failed, err: %v", err)
+			cmdMgr2 := cmd.NewCommandMgr(cmd.WithTimeout(1 * time.Second))
+			output, err = cmdMgr2.RunPipe(
+				cmd.PipeCommand{Name: "df", Args: []string{"-lhT", "-P"}},
+				cmd.PipeCommand{Name: "awk", Args: []string{format}},
+			)
+			if err != nil {
+				global.LOG.Errorf("load disk info with df -lhT -P failed, err: %v", err)
+				return
+			}
+		}
+
+		stdout = output
+	}()
+	timer := time.NewTimer(3 * time.Second)
+	defer timer.Stop()
+	select {
+	case stdout := <-resultCh:
+		return stdout
+	case <-timer.C:
+		global.LOG.Error("load disk mounts timed out; df collection is still running")
+		return ""
 	}
-	var data []dto.GPUInfo
-	for _, gpu := range list {
-		var dataItem dto.GPUInfo
-		if err := copier.Copy(&dataItem, &gpu); err != nil {
+}
+
+func loadDiskUsageWithTimeout(path string, forceRefresh bool) (*disk.UsageStat, error) {
+	type diskResult struct {
+		state *disk.UsageStat
+		err   error
+	}
+	resultCh := make(chan diskResult, 1)
+	go func() {
+		state, err := psutil.DISK.GetUsage(path, forceRefresh)
+		resultCh <- diskResult{state: state, err: err}
+	}()
+	select {
+	case <-time.After(5 * time.Second):
+		return nil, fmt.Errorf("load disk usage from %s: timeout", path)
+	case result := <-resultCh:
+		return result.state, result.err
+	}
+}
+
+func loadAcceleratorInfo() ([]dto.GPUInfo, []dto.NPUInfo, []dto.XPUInfo) {
+	ok, client := accelerator.New()
+	if !ok {
+		return nil, nil, nil
+	}
+	snapshot, err := client.Collect(context.Background())
+	if err != nil || len(snapshot.Devices) == 0 {
+		return nil, nil, nil
+	}
+	if warning := snapshot.Warning(); warning != nil {
+		global.LOG.Warnf("load accelerator dashboard data partially failed, err: %v", warning)
+	}
+
+	var (
+		gpuData []dto.GPUInfo
+		npuData []dto.NPUInfo
+		xpuData []dto.XPUInfo
+	)
+	for _, device := range snapshot.Devices {
+		if device.ParentID != "" {
 			continue
 		}
-		dataItem.PowerUsage = dataItem.PowerDraw + " / " + dataItem.MaxPowerLimit
-		dataItem.MemoryUsage = dataItem.MemUsed + " / " + dataItem.MemTotal
-		data = append(data, dataItem)
+		switch device.Kind {
+		case accelerator.KindGPU:
+			if device.GPU == nil {
+				continue
+			}
+			var dataItem dto.GPUInfo
+			if err := copier.Copy(&dataItem, device.GPU); err != nil {
+				continue
+			}
+			dataItem.MaxPowerLimit = device.GPU.PowerLimit
+			dataItem.PowerUsage = dataItem.PowerDraw
+			if dataItem.MaxPowerLimit != "" {
+				dataItem.PowerUsage += " / " + dataItem.MaxPowerLimit
+			}
+			dataItem.MemoryUsage = dataItem.MemUsed + " / " + dataItem.MemTotal
+			gpuData = append(gpuData, dataItem)
+		case accelerator.KindNPU:
+			if device.NPU == nil {
+				continue
+			}
+			var dataItem dto.NPUInfo
+			if err := copier.Copy(&dataItem, device.NPU); err != nil {
+				continue
+			}
+			npuData = append(npuData, dataItem)
+		case accelerator.KindXPU:
+			if device.XPU == nil {
+				continue
+			}
+			xpuData = append(xpuData, dto.XPUInfo{
+				DeviceID:      device.Index,
+				DeviceName:    device.Name,
+				PciBdfAddress: device.BusID,
+				Memory:        device.XPU.Basic.Memory,
+				Temperature:   device.Metrics.Temperature.Display,
+				GPUUtil:       device.Metrics.Utilization.Display,
+				MemoryUsed:    device.Metrics.MemoryUsed.Display,
+				Power:         device.Metrics.Power.Display,
+				MemoryUtil:    device.Metrics.MemoryUtil.Display,
+			})
+		}
 	}
-	return data
+	return gpuData, npuData, xpuData
 }
 
 type AppLauncher struct {
@@ -610,32 +674,6 @@ func ArryContains(arr []string, element string) bool {
 	return false
 }
 
-func loadXpuInfo() []dto.XPUInfo {
-	var list []interface{}
-	ok, xpuClient := xpu.New()
-	if ok {
-		xpus, err := xpuClient.LoadDashData()
-		if err != nil || len(xpus) == 0 {
-			return nil
-		}
-		for _, item := range xpus {
-			list = append(list, item)
-		}
-	}
-	if len(list) == 0 {
-		return nil
-	}
-	var data []dto.XPUInfo
-	for _, gpu := range list {
-		var dataItem dto.XPUInfo
-		if err := copier.Copy(&dataItem, &gpu); err != nil {
-			continue
-		}
-		data = append(data, dataItem)
-	}
-	return data
-}
-
 func loadOutboundIP() string {
 	conn, err := network.Dial("udp", "8.8.8.8:80")
 

agent/app/service/database_redis.go

@@ -8,6 +8,12 @@ import (
 	"os"
 	"os/exec"
 	"strings"
+	"sync"
+
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
 
 	"github.com/1Panel-dev/1Panel/agent/app/repo"
 	"github.com/1Panel-dev/1Panel/agent/global"
@@ -17,12 +23,15 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/compose"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
 	"github.com/1Panel-dev/1Panel/agent/utils/encrypt"
-	"github.com/docker/docker/api/types/container"
+	dockerclient "github.com/docker/docker/client"
 	_ "github.com/go-sql-driver/mysql"
 )
 
 type RedisService struct{}
 
+// The CLI container is shared by all remote Redis databases on this node.
+var redisCliInstallMutex sync.Mutex
+
 type IRedisService interface {
 	UpdateConf(req dto.RedisConfUpdate) error
 	UpdatePersistenceConf(req dto.RedisConfPersistenceUpdate) error
@@ -33,7 +42,7 @@ type IRedisService interface {
 	LoadPersistenceConf(req dto.LoadRedisStatus) (*dto.RedisPersistence, error)
 
 	CheckHasCli() bool
-	InstallCli() error
+	InstallCli(req dto.RedisCliInstall) (string, error)
 }
 
 func NewIRedisService() IRedisService {
@@ -61,30 +70,65 @@ func (u *RedisService) UpdateConf(req dto.RedisConfUpdate) error {
 }
 
 func (u *RedisService) CheckHasCli() bool {
-	client, err := docker.NewDockerClient()
-	if err != nil {
-		return false
-	}
-	defer client.Close()
-	containerLists, err := client.ContainerList(context.Background(), container.ListOptions{})
-	if err != nil {
-		return false
-	}
-	for _, item := range containerLists {
-		if strings.ReplaceAll(item.Names[0], "/", "") == "1Panel-redis-cli-tools" {
-			return true
-		}
-	}
-	return false
+	installed, _ := u.checkCliInstalled()
+	return installed
 }
 
-func (u *RedisService) InstallCli() error {
+func (u *RedisService) checkCliInstalled() (bool, error) {
+	client, err := docker.NewDockerClient()
+	if err != nil {
+		return false, err
+	}
+	defer client.Close()
+	info, err := client.ContainerInspect(context.Background(), "1Panel-redis-cli-tools")
+	if dockerclient.IsErrNotFound(err) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	return info.ContainerJSONBase != nil && info.State != nil && info.State.Running, nil
+}
+
+func (u *RedisService) InstallCli(req dto.RedisCliInstall) (string, error) {
+	if !redisCliInstallMutex.TryLock() {
+		return "", buserr.New("TaskIsExecuting")
+	}
+	defer redisCliInstallMutex.Unlock()
 	item := dto.ContainerOperate{
+		TaskID:   req.TaskID,
 		Name:     "1Panel-redis-cli-tools",
 		Image:    "redis:7.4.4",
 		Networks: []dto.ContainerNetwork{{Network: "1panel-network"}},
 	}
-	return NewIContainerService().ContainerCreate(item, false)
+	running, err := taskRepo.GetFirst(
+		repo.WithByName(task.GetTaskName(item.Name, task.TaskCreate, task.TaskScopeContainer)),
+		repo.WithByType(task.TaskScopeContainer),
+		taskRepo.WithByStatus(constant.StatusExecuting),
+	)
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return "", err
+	}
+	if running.ID != "" {
+		return running.ID, nil
+	}
+	installed, err := u.checkCliInstalled()
+	if err != nil || installed {
+		return "", err
+	}
+	if item.TaskID == "" {
+		item.TaskID = uuid.NewString()
+	}
+	if _, err := taskRepo.GetFirst(taskRepo.WithByID(item.TaskID)); !errors.Is(err, gorm.ErrRecordNotFound) {
+		if err != nil {
+			return "", err
+		}
+		return "", buserr.New("TaskIsExecuting")
+	}
+	if err := NewIContainerService().ContainerCreate(item, true); err != nil {
+		return "", err
+	}
+	return item.TaskID, nil
 }
 
 func (u *RedisService) ChangePassword(req dto.ChangeRedisPass) error {

agent/app/service/device.go

@@ -73,7 +73,7 @@ func (u *DeviceService) LoadBaseInfo() (dto.DeviceBaseInfo, error) {
 	if baseInfo.SwapMemoryTotal != 0 {
 		baseInfo.SwapDetails = loadSwap()
 	}
-	disks := loadDiskInfo()
+	disks := loadDiskInfo(false)
 	for _, item := range disks {
 		baseInfo.MaxSize += item.Free
 	}

agent/app/service/disk_utils.go

@@ -61,18 +61,21 @@ func parseDevice(dev LsblkDevice) []response.DiskBasicInfo {
 
 	var used, avail, totalSize string
 	var usePercent int
-	isMounted := mountPoint != ""
+	isMounted := mountPoint != "" && mountPoint != "-"
 	isSystem := false
 
 	if dev.Fstype == "LVM2_member" && len(dev.Children) > 0 {
 		for _, child := range dev.Children {
-			if child.Type == "lvm" && child.Mountpoint != "" {
-				devicePath := "/dev/mapper/" + child.Name
-				totalSize, used, avail, usePercent, _ := getDiskUsageInfo(devicePath)
+			if child.Type == "lvm" && child.Mountpoint != "" && child.Mountpoint != "-" {
+				totalSize, used, avail, usePercent, _ := getDiskUsageInfo(child.Mountpoint)
+				childSize := child.Size
+				if totalSize != "" {
+					childSize = totalSize
+				}
 
 				childInfo := response.DiskBasicInfo{
 					Device:      dev.Name,
-					Size:        totalSize,
+					Size:        childSize,
 					Model:       dev.Model,
 					DiskType:    diskType,
 					Filesystem:  child.Fstype,
@@ -91,8 +94,7 @@ func parseDevice(dev LsblkDevice) []response.DiskBasicInfo {
 		return list
 	} else if isMounted {
 		isSystem = isSystemDisk(mountPoint)
-		devicePath := "/dev/" + dev.Name
-		totalSize, used, avail, usePercent, _ = getDiskUsageInfo(devicePath)
+		totalSize, used, avail, usePercent, _ = getDiskUsageInfo(mountPoint)
 		if totalSize != "" {
 			size = totalSize
 		}
@@ -229,9 +231,14 @@ func parseLsblkOutput(output string) ([]response.DiskBasicInfo, error) {
 		size := fields["SIZE"]
 
 		if diskType == "lvm" {
-			total, used, avail, usePercent, _ := getDiskUsageInfo("/dev/mapper/" + name)
-			if total != "" && fsType != "" {
-				size = total
+			var total, used, avail string
+			var usePercent int
+			isMounted := mountPoint != "" && mountPoint != "-"
+			if isMounted {
+				total, used, avail, usePercent, _ = getDiskUsageInfo(mountPoint)
+				if total != "" && fsType != "" {
+					size = total
+				}
 			}
 
 			lvmInfo := response.DiskBasicInfo{
@@ -246,7 +253,7 @@ func parseLsblkOutput(output string) ([]response.DiskBasicInfo, error) {
 				Avail:       avail,
 				UsePercent:  usePercent,
 				MountPoint:  mountPoint,
-				IsMounted:   mountPoint != "" && mountPoint != "-",
+				IsMounted:   isMounted,
 				Serial:      fields["SERIAL"],
 			}
 			lvmMap[name] = lvmInfo
@@ -269,8 +276,8 @@ func parseLsblkOutput(output string) ([]response.DiskBasicInfo, error) {
 			used, avail, totalSize string
 			usePercent             int
 		)
-		if mountPoint != "" {
-			totalSize, used, avail, usePercent, _ = getDiskUsageInfo("/dev/" + name)
+		if mountPoint != "" && mountPoint != "-" {
+			totalSize, used, avail, usePercent, _ = getDiskUsageInfo(mountPoint)
 			if totalSize != "" {
 				size = totalSize
 			}
@@ -387,26 +394,39 @@ func getParentDevice(device string) string {
 	return device
 }
 
-func getDiskUsageInfo(device string) (size, used, avail string, usePercent int, err error) {
-	output, err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).RunWithStdout("df", "-h", device)
+func getDiskUsageInfo(mountPoint string) (size, used, avail string, usePercent int, err error) {
+	// Query by mount point instead of a reconstructed device path. The mount table may record
+	// a different device alias such as /dev/root.
+	output, err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).RunWithStdout("df", "-h", "-P", mountPoint)
 	if err != nil {
 		return "", "", "", 0, nil
 	}
+	return parseDiskUsageOutput(output)
+}
+
+func parseDiskUsageOutput(output string) (size, used, avail string, usePercent int, err error) {
 	lines := strings.Split(strings.TrimSpace(output), "\n")
-	if len(lines) > 1 {
-		output = lines[len(lines)-1]
+	for i := len(lines) - 1; i >= 0; i-- {
+		fields := strings.Fields(lines[i])
+		for index, field := range fields {
+			if index < 3 || !strings.HasSuffix(field, "%") {
+				continue
+			}
+			percent, parseErr := strconv.Atoi(strings.TrimSuffix(field, "%"))
+			if parseErr != nil {
+				continue
+			}
+			return fields[index-3], fields[index-2], fields[index-1], percent, nil
+		}
+		for index, field := range fields {
+			if index < 3 || index+1 >= len(fields) || field != "-" || !strings.HasPrefix(fields[index+1], "/") {
+				continue
+			}
+			return fields[index-3], fields[index-2], fields[index-1], 0, nil
+		}
 	}
 
-	fields := strings.Fields(output)
-	if len(fields) >= 5 {
-		size = fields[1]
-		used = fields[2]
-		avail = fields[3]
-		usePercentStr := strings.TrimSuffix(fields[4], "%")
-		usePercent, _ = strconv.Atoi(usePercentStr)
-	}
-
-	return size, used, avail, usePercent, nil
+	return "", "", "", 0, nil
 }
 
 func formatDisk(req dto.DiskFormatRequest) error {

agent/app/service/docker.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"bufio"
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -14,14 +15,20 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/controller"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+
+	dockerfirewall "github.com/1Panel-dev/1Panel/agent/utils/firewall/docker_guard"
 )
 
+const dockerNftablesMinVersion = "29.0.0"
+
 type DockerService struct{}
 
 type IDockerService interface {
 	UpdateConf(req dto.SettingUpdate, withRestart bool) error
+	UpdateFirewallBackend(backend string) error
 	UpdateLogOption(req dto.LogOption) error
 	UpdateIpv6Option(req dto.Ipv6Option) error
 	UpdateConfByFile(info dto.DaemonJsonUpdateByFile) error
@@ -30,6 +37,115 @@ type IDockerService interface {
 	OperateDocker(req dto.DockerOperation) error
 }
 
+func loadDockerEngineVersion(ctx context.Context) string {
+	client, err := docker.NewDockerClient()
+	if err == nil {
+		defer client.Close()
+		if version, versionErr := client.ServerVersion(ctx); versionErr == nil && version.Version != "" {
+			return version.Version
+		}
+	}
+	if !cmd.Which("dockerd") {
+		return ""
+	}
+	stdout, err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).RunWithStdout("dockerd", "--version")
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(stdout)
+}
+
+func dockerNftablesSupported(version string) bool {
+	return version != "" && common.CompareAppVersion(version, dockerNftablesMinVersion)
+}
+
+func applyDockerFirewallBackendConfig(daemonMap map[string]interface{}, backend, version string) error {
+	switch backend {
+	case constant.FirewallProviderNftables:
+		if !dockerNftablesSupported(version) {
+			return fmt.Errorf("Docker Engine %s or later is required for the nftables firewall backend", dockerNftablesMinVersion)
+		}
+		daemonMap["experimental"] = true
+		daemonMap["firewall-backend"] = constant.FirewallProviderNftables
+	case constant.FirewallProviderIptables:
+		if dockerNftablesSupported(version) {
+			daemonMap["firewall-backend"] = constant.FirewallProviderIptables
+		} else {
+			delete(daemonMap, "firewall-backend")
+		}
+	default:
+		return fmt.Errorf("unsupported Docker firewall backend %q", backend)
+	}
+	return nil
+}
+
+func (u *DockerService) UpdateFirewallBackend(backend string) error {
+	version := loadDockerEngineVersion(context.Background())
+	if backend == constant.FirewallProviderNftables && !dockerNftablesSupported(version) {
+		return fmt.Errorf("Docker Engine %s or later is required for the nftables firewall backend", dockerNftablesMinVersion)
+	}
+	if backend == constant.FirewallProviderNftables {
+		if err := dockerfirewall.CheckIPv4Forwarding(); err != nil {
+			return err
+		}
+	}
+
+	original, readErr := os.ReadFile(constant.DaemonJsonPath)
+	existed := readErr == nil
+	if readErr != nil && !os.IsNotExist(readErr) {
+		return readErr
+	}
+	daemonMap := make(map[string]interface{})
+	if len(bytes.TrimSpace(original)) > 0 {
+		if err := json.Unmarshal(original, &daemonMap); err != nil {
+			return fmt.Errorf("failed to parse Docker configuration: %w", err)
+		}
+	}
+	if err := applyDockerFirewallBackendConfig(daemonMap, backend, version); err != nil {
+		return err
+	}
+	updated, err := json.MarshalIndent(daemonMap, "", "\t")
+	if err != nil {
+		return err
+	}
+	if existed && bytes.Equal(bytes.TrimSpace(original), bytes.TrimSpace(updated)) {
+		return nil
+	}
+	if err := os.MkdirAll(path.Dir(constant.DaemonJsonPath), 0755); err != nil {
+		return err
+	}
+	if err := os.WriteFile(constant.DaemonJsonPath, updated, 0640); err != nil {
+		return err
+	}
+	restore := func() error {
+		if existed {
+			return os.WriteFile(constant.DaemonJsonPath, original, 0640)
+		}
+		err := os.Remove(constant.DaemonJsonPath)
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	if err := validateDockerConfig(); err != nil {
+		if restoreErr := restore(); restoreErr != nil {
+			return fmt.Errorf("%v; failed to restore Docker configuration: %w", err, restoreErr)
+		}
+		return err
+	}
+	if err := controller.HandleRestart("docker"); err != nil {
+		cause := fmt.Errorf("failed to restart Docker: %w", err)
+		if restoreErr := restore(); restoreErr != nil {
+			return fmt.Errorf("%v; failed to restore Docker configuration: %w", cause, restoreErr)
+		}
+		if restoreRestartErr := controller.HandleRestart("docker"); restoreRestartErr != nil {
+			return fmt.Errorf("%v; the previous configuration was restored but Docker could not be restarted: %w", cause, restoreRestartErr)
+		}
+		return cause
+	}
+	return nil
+}
+
 func NewIDockerService() IDockerService {
 	return &DockerService{}
 }
@@ -167,7 +283,10 @@ func (u *DockerService) UpdateConf(req dto.SettingUpdate, withRestart bool) erro
 			delete(daemonMap, "ipv6")
 			delete(daemonMap, "fixed-cidr-v6")
 			delete(daemonMap, "ip6tables")
-			delete(daemonMap, "experimental")
+			backend, _ := settingRepo.GetValueByKey(constant.FirewallDockerBackendKey)
+			if !strings.EqualFold(strings.TrimSpace(backend), constant.FirewallProviderNftables) {
+				delete(daemonMap, "experimental")
+			}
 		}
 	case "LogOption":
 		if req.Value == "disable" {
@@ -368,6 +487,9 @@ func (u *DockerService) OperateDocker(req dto.DockerOperation) error {
 	if err := controller.Handle(req.Operation, service); err != nil {
 		return err
 	}
+	if req.Operation == "start" || req.Operation == "restart" {
+		return RestoreDockerPortGuard(context.Background())
+	}
 	return nil
 }
 

agent/app/service/entry.go

@@ -32,10 +32,11 @@ var (
 	scriptRepo  = repo.NewIScriptRepo()
 	cronjobRepo = repo.NewICronjobRepo()
 
-	hostRepo    = repo.NewIHostRepo()
-	ftpRepo     = repo.NewIFtpRepo()
-	clamRepo    = repo.NewIClamRepo()
-	monitorRepo = repo.NewIMonitorRepo()
+	hostRepo        = repo.NewIHostRepo()
+	ftpRepo         = repo.NewIFtpRepo()
+	clamRepo        = repo.NewIClamRepo()
+	monitorRepo     = repo.NewIMonitorRepo()
+	vllmMonitorRepo = &repo.VLLMMonitorRepo{}
 
 	settingRepo = repo.NewISettingRepo()
 	backupRepo  = repo.NewIBackupRepo()

agent/app/service/fail2ban.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/buserr"
-	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
 	"github.com/1Panel-dev/1Panel/agent/utils/toolbox"
 )
 
@@ -109,7 +108,7 @@ func (u *Fail2BanService) UpdateConf(req dto.Fail2BanUpdate) error {
 			if req.Value == "firewallcmd-ipset" {
 				itemName = "firewalld"
 			}
-			client, err := firewall.NewFirewallClient()
+			client, err := NewSelectedSystemFirewallClient()
 			if err != nil {
 				return err
 			}

agent/app/service/file.go

@@ -52,6 +52,8 @@ type FileService struct {
 
 const fileHistorySnapshotMaxSize = 10 * 1024 * 1024
 
+var fileTransferLocks = newFileTransferLocks()
+
 type IFileService interface {
 	GetFileList(op request.FileOption) (response.FileInfo, error)
 	SearchUploadWithPage(req request.SearchUploadWithPage) (int64, interface{}, error)
@@ -72,6 +74,7 @@ type IFileService interface {
 	ChangeName(req request.FileRename) error
 	Wget(w request.FileWget) (string, error)
 	MvFile(m request.FileMove) error
+	StopMvFile(taskID string) error
 	ChangeOwner(req request.FileRoleUpdate) error
 	ChangeMode(op request.FileCreate) error
 	BatchChangeModeAndOwner(op request.FileRoleReq) error
@@ -156,6 +159,10 @@ func (f *FileService) SearchUploadWithPage(req request.SearchUploadWithPage) (in
 		})
 	}
 
+	sort.SliceStable(files, func(i, j int) bool {
+		return files[i].CreatedAt > files[j].CreatedAt
+	})
+
 	total, start, end := len(files), (req.Page-1)*req.PageSize, req.Page*req.PageSize
 	if start > total {
 		backData = make([]response.UploadInfo, 0)
@@ -432,13 +439,15 @@ func (f *FileService) Compress(c request.FileCompress) error {
 	if err := preflightCompressTool(files.CompressType(c.Type)); err != nil {
 		return err
 	}
-	taskItem, err := task.NewTask(c.Name, task.TaskExec, task.TaskScopeTask, c.TaskID, 1)
+	taskName := i18n.GetMsgWithMap("FileTaskCompress", map[string]interface{}{"dst": strconv.Quote(filepath.Join(c.Dst, c.Name))})
+	taskItem, err := task.NewTask(taskName, task.TaskExec, task.TaskScopeTask, c.TaskID, 1)
 	if err != nil {
 		return err
 	}
 	go func() {
-		taskItem.AddSubTask(c.Name, func(t *task.Task) error {
-			t.LogStart(c.Name)
+		taskItem.AddSubTask(taskName, func(t *task.Task) error {
+			logFileTaskSources(t, c.Files)
+			t.Log(i18n.GetMsgWithMap("FileTaskFormat", map[string]interface{}{"format": strconv.Quote(c.Type)}))
 			compressType := files.CompressType(c.Type)
 			dstFile := filepath.Join(c.Dst, c.Name)
 			success := false
@@ -509,13 +518,15 @@ func (f *FileService) DeCompress(c request.FileDeCompress) error {
 	if err := preflightDecompressTool(files.CompressType(c.Type)); err != nil {
 		return err
 	}
-	taskItem, err := task.NewTask(c.Path, task.TaskExec, task.TaskScopeTask, c.TaskID, 1)
+	taskName := i18n.GetMsgWithMap("FileTaskDecompress", map[string]interface{}{"dst": strconv.Quote(c.Dst)})
+	taskItem, err := task.NewTask(taskName, task.TaskExec, task.TaskScopeTask, c.TaskID, 1)
 	if err != nil {
 		return err
 	}
 	go func() {
-		taskItem.AddSubTask(c.Path, func(t *task.Task) error {
-			t.LogStart(c.Path)
+		taskItem.AddSubTask(taskName, func(t *task.Task) error {
+			logFileTaskSources(t, []string{c.Path})
+			t.Log(i18n.GetMsgWithMap("FileTaskFormat", map[string]interface{}{"format": strconv.Quote(c.Type)}))
 			dstExisted := fo.Stat(c.Dst)
 			parentDir := filepath.Dir(c.Dst)
 			if !fo.Stat(parentDir) {
@@ -889,6 +900,7 @@ func (f *FileService) Wget(w request.FileWget) (string, error) {
 	key := "file-wget-" + common.GetUuid()
 	options := files.DownloadOptions{
 		IgnoreCertificate: w.IgnoreCertificate,
+		UseServerFilename: w.UseServerFilename,
 	}
 	if w.UseProxy {
 		systemProxy, err := NewISettingService().GetSystemProxy()
@@ -906,19 +918,79 @@ func (f *FileService) Wget(w request.FileWget) (string, error) {
 	return key, fo.DownloadFileWithProcess(w.Url, filepath.Join(w.Path, w.Name), key, options)
 }
 
+func logFileTaskSources(t *task.Task, sources []string) {
+	for _, source := range sources {
+		t.Log(i18n.GetMsgWithMap("FileTaskSource", map[string]interface{}{"path": strconv.Quote(source)}))
+	}
+}
+
 func (f *FileService) MvFile(m request.FileMove) error {
 	fo := files.NewFileOp()
+	if err := validateFileMove(fo, m); err != nil {
+		return err
+	}
+	if m.TaskID == "" {
+		m.TaskID = common.GetUuid()
+	}
+	if !fileTransferLocks.Acquire(m.TaskID, getFileTransferPaths(m)) {
+		return buserr.New("TaskIsExecuting")
+	}
+	nameKey := "FileTaskCopy"
+	if m.Type == "cut" {
+		nameKey = "FileTaskMove"
+	}
+	taskName := i18n.GetMsgWithMap(nameKey, map[string]interface{}{"dst": strconv.Quote(m.NewPath)})
+	taskItem, err := task.NewTask(taskName, task.TaskExec, task.TaskScopeTask, m.TaskID, 1)
+	if err != nil {
+		fileTransferLocks.Release(m.TaskID)
+		return err
+	}
+	go func() {
+		defer fileTransferLocks.Release(m.TaskID)
+		taskItem.AddSubTaskWithOps(taskName, func(t *task.Task) error {
+			logFileTaskSources(t, m.OldPaths)
+			logFileTaskSources(t, m.CoverPaths)
+			if m.Name != "" {
+				t.Log(i18n.GetMsgWithMap("FileTaskRename", map[string]interface{}{"name": strconv.Quote(m.Name)}))
+			}
+			err := f.moveFileWithContext(t.TaskCtx, m)
+			if err != nil && t.TaskCtx.Err() != nil {
+				return t.TaskCtx.Err()
+			}
+			return err
+		}, nil, 0, 0)
+		_ = taskItem.Execute()
+	}()
+	return nil
+}
+
+func (f *FileService) StopMvFile(taskID string) error {
+	if cancel, ok := global.LoadTaskCancel(taskID); ok {
+		cancel()
+		return nil
+	}
+	return buserr.New("TaskNotFound")
+}
+
+func validateFileMove(fo files.FileOp, m request.FileMove) error {
 	if !fo.Stat(m.NewPath) {
 		return buserr.New("ErrPathNotFound")
 	}
-	for _, oldPath := range m.OldPaths {
+	for _, oldPath := range append(append([]string{}, m.OldPaths...), m.CoverPaths...) {
 		if !fo.Stat(oldPath) {
 			return buserr.WithName("ErrFileNotFound", oldPath)
 		}
-		if oldPath == m.NewPath || strings.Contains(m.NewPath, filepath.Clean(oldPath)+"/") {
+		oldPath = filepath.Clean(oldPath)
+		newPath := filepath.Clean(m.NewPath)
+		if oldPath == newPath || strings.HasPrefix(newPath, oldPath+string(filepath.Separator)) {
 			return buserr.New("ErrMovePathFailed")
 		}
 	}
+	return nil
+}
+
+func (f *FileService) moveFileWithContext(ctx context.Context, m request.FileMove) error {
+	fo := files.NewFileOp()
 	type moveSnapshot struct {
 		path    string
 		content []byte
@@ -934,13 +1006,25 @@ func (f *FileService) MvFile(m request.FileMove) error {
 		}
 		if len(m.CoverPaths) > 0 {
 			for _, src := range m.CoverPaths {
-				if err := fo.CopyAndReName(src, m.NewPath, "", true); err != nil {
+				if err := ctx.Err(); err != nil {
+					return err
+				}
+				if err := fo.CopyAndReNameWithContext(ctx, src, m.NewPath, "", true); err != nil {
 					errs = append(errs, err)
 					global.LOG.Errorf("cut copy file [%s] to [%s] failed, err: %s", src, m.NewPath, err.Error())
+					continue
+				}
+				if err := ctx.Err(); err != nil {
+					return err
+				}
+				if err := fo.DeleteDir(src); err != nil {
+					removeErr := fmt.Errorf("remove merged source [%s] failed: %w", src, err)
+					errs = append(errs, removeErr)
+					global.LOG.Errorf("%s", removeErr.Error())
 				}
 			}
 		}
-		if err := fo.Cut(m.OldPaths, m.NewPath, m.Name, m.Cover); err != nil {
+		if err := fo.CutWithContext(ctx, m.OldPaths, m.NewPath, m.Name, m.Cover); err != nil {
 			return err
 		}
 		for _, snapshot := range snapshots {
@@ -951,18 +1035,18 @@ func (f *FileService) MvFile(m request.FileMove) error {
 				}
 			}
 		}
-		return nil
+		return aggregateFileMoveErrors(errs)
 	}
 	if m.Type == "copy" {
 		for _, src := range m.OldPaths {
-			if err := fo.CopyAndReName(src, m.NewPath, m.Name, m.Cover); err != nil {
+			if err := fo.CopyAndReNameWithContext(ctx, src, m.NewPath, m.Name, m.Cover); err != nil {
 				errs = append(errs, err)
 				global.LOG.Errorf("copy file [%s] to [%s] failed, err: %s", src, m.NewPath, err.Error())
 			}
 		}
 		if len(m.CoverPaths) > 0 {
 			for _, src := range m.CoverPaths {
-				if err := fo.CopyAndReName(src, m.NewPath, "", true); err != nil {
+				if err := fo.CopyAndReNameWithContext(ctx, src, m.NewPath, "", true); err != nil {
 					errs = append(errs, err)
 					global.LOG.Errorf("copy file [%s] to [%s] failed, err: %s", src, m.NewPath, err.Error())
 				}
@@ -970,14 +1054,7 @@ func (f *FileService) MvFile(m request.FileMove) error {
 		}
 	}
 
-	var errString string
-	for _, err := range errs {
-		errString += err.Error() + "\n"
-	}
-	if errString != "" {
-		return errors.New(errString)
-	}
-	return nil
+	return aggregateFileMoveErrors(errs)
 }
 
 func readEditableFileHistoryContent(filePath string) ([]byte, os.FileMode, bool) {
@@ -1233,7 +1310,7 @@ func (f *FileService) BatchCheckFiles(req request.FilePathsCheck) []response.Exi
 }
 
 func (f *FileService) GetHostMount() []dto.DiskInfo {
-	return loadDiskInfo()
+	return loadDiskInfo(false)
 }
 
 func (f *FileService) GetUsersAndGroups() (*response.UserGroupResponse, error) {

agent/app/service/file_transfer.go

@@ -0,0 +1,77 @@
+package service
+
+import (
+	"errors"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+)
+
+type fileTransferLockSet struct {
+	mu    sync.Mutex
+	paths map[string][]string
+}
+
+func newFileTransferLocks() *fileTransferLockSet {
+	return &fileTransferLockSet{paths: make(map[string][]string)}
+}
+
+func (s *fileTransferLockSet) Acquire(taskID string, transferPaths []string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for _, activePaths := range s.paths {
+		for _, activePath := range activePaths {
+			for _, transferPath := range transferPaths {
+				if fileTransferPathsOverlap(activePath, transferPath) {
+					return false
+				}
+			}
+		}
+	}
+	s.paths[taskID] = transferPaths
+	return true
+}
+
+func (s *fileTransferLockSet) Release(taskID string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.paths, taskID)
+}
+
+func getFileTransferPaths(req request.FileMove) []string {
+	paths := make([]string, 0, 1+len(req.OldPaths)+len(req.CoverPaths))
+	paths = append(paths, req.NewPath)
+	paths = append(paths, req.OldPaths...)
+	paths = append(paths, req.CoverPaths...)
+
+	unique := make(map[string]struct{}, len(paths))
+	result := make([]string, 0, len(paths))
+	for _, item := range paths {
+		item = filepath.Clean(item)
+		if _, ok := unique[item]; ok {
+			continue
+		}
+		unique[item] = struct{}{}
+		result = append(result, item)
+	}
+	return result
+}
+
+func fileTransferPathsOverlap(first, second string) bool {
+	return first == second || strings.HasPrefix(first, second+string(filepath.Separator)) || strings.HasPrefix(second, first+string(filepath.Separator))
+}
+
+func aggregateFileMoveErrors(errs []error) error {
+	if len(errs) == 0 {
+		return nil
+	}
+	var errString strings.Builder
+	for _, err := range errs {
+		errString.WriteString(err.Error())
+		errString.WriteByte('\n')
+	}
+	return errors.New(errString.String())
+}

agent/app/service/firewall_docker.go

@@ -0,0 +1,490 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/i18n"
+	dockerfirewall "github.com/1Panel-dev/1Panel/agent/utils/firewall/docker_guard"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
+	"github.com/docker/docker/client"
+	"github.com/google/uuid"
+)
+
+const (
+	dockerGuardComposeProjectLabel  = "com.docker.compose.project"
+	dockerGuardComposeCreatedBy     = "createdBy"
+	dockerTrafficPathForward        = "forward"
+	dockerTrafficPathInput          = "input"
+	dockerTrafficPathUnknown        = "unknown"
+	dockerManagementContainerGuard  = "container_guard"
+	dockerManagementHostFirewall    = "host_firewall"
+	dockerManagementNeedsDiagnosis  = "needs_diagnosis"
+	dockerReasonNATInspectFailed    = "nat_inspect_failed"
+	dockerReasonNATChainUnreachable = "nat_chain_unreachable"
+	dockerReasonProxyInspectFailed  = "proxy_inspect_failed"
+	dockerReasonNoMatchingPath      = "no_matching_path"
+)
+
+type DockerPortGuardService struct {
+	runtime           dockerfirewall.Runtime
+	runtimeForBackend func(context.Context, string) dockerfirewall.Runtime
+	client            func() (*client.Client, error)
+	version           func(string) string
+}
+
+var dockerPortGuardServiceMu sync.Mutex
+
+type IDockerPortGuardService interface {
+	LoadOverview(context.Context) (dto.DockerPortGuardList, error)
+	ExportBackup(context.Context, filter.Provider) (dto.FirewallSubsystemBackup, error)
+	LoadPublishedPorts(context.Context) ([]dto.DockerPortGuardContainer, error)
+	Operate(context.Context, dto.DockerPortGuardOperation) error
+	QueueInitialization(dto.DockerPortGuardOperation) (dto.FilterChainOperationResponse, error)
+	DeletePolicies(dto.DockerPortGuardPolicyBatchDelete) (dto.FilterChainOperationResponse, error)
+	UpsertPolicies(dto.DockerPortGuardPolicyBatch) (dto.FilterChainOperationResponse, error)
+	Restore(context.Context) error
+}
+
+func NewIDockerPortGuardService() IDockerPortGuardService {
+	return newDockerPortGuardService()
+}
+
+func (s *DockerPortGuardService) LoadOverview(ctx context.Context) (dto.DockerPortGuardList, error) {
+	families, err := loadFirewallFamilies()
+	if err != nil {
+		return dto.DockerPortGuardList{}, err
+	}
+	backend := selectedDockerFirewallBackend("")
+	inventory, err := s.guardRuntime(ctx, backend).ListPolicies()
+	if err != nil {
+		return dto.DockerPortGuardList{}, err
+	}
+	policies := dockerGuardInventoryEndpoints(inventory)
+	unavailable := func() dto.DockerPortGuardList {
+		backend := selectedDockerFirewallBackend("")
+		base := s.runtimeStatus(s.guardRuntime(ctx, backend), backend, len(families) > 1)
+		base.Message = i18n.Get("ErrDockerFailed")
+		return dto.DockerPortGuardList{Base: base, Containers: []dto.DockerPortGuardContainer{}, OrphanPolicies: policies}
+	}
+	cli, err := s.client()
+	if err != nil {
+		return unavailable(), nil
+	}
+	defer cli.Close()
+	info, err := cli.Info(ctx)
+	if err != nil {
+		return unavailable(), nil
+	}
+	detectedBackend := dockerFirewallBackend(info)
+	backend = selectedDockerFirewallBackend(detectedBackend)
+	base := s.runtimeStatus(s.guardRuntime(ctx, backend), backend, len(families) > 1)
+	endpoints, err := discoverDockerEndpoints(ctx, cli, true)
+	if err != nil {
+		return dto.DockerPortGuardList{}, err
+	}
+	annotateDockerEndpointManagement(ctx, endpoints, detectedBackend)
+	endpoints, orphanPolicies := matchDockerGuardPolicies(base, policies, endpoints)
+	sort.Slice(endpoints, func(i, j int) bool {
+		return fmt.Sprintf("%s|%s|%d|%s", endpoints[i].Family, endpoints[i].HostIP, endpoints[i].HostPort, endpoints[i].Protocol) < fmt.Sprintf("%s|%s|%d|%s", endpoints[j].Family, endpoints[j].HostIP, endpoints[j].HostPort, endpoints[j].Protocol)
+	})
+	sort.Slice(orphanPolicies, func(i, j int) bool {
+		return fmt.Sprintf("%s|%s|%d|%s", orphanPolicies[i].Family, orphanPolicies[i].HostIP, orphanPolicies[i].HostPort, orphanPolicies[i].Protocol) < fmt.Sprintf("%s|%s|%d|%s", orphanPolicies[j].Family, orphanPolicies[j].HostIP, orphanPolicies[j].HostPort, orphanPolicies[j].Protocol)
+	})
+	return dto.DockerPortGuardList{Base: base, Containers: groupDockerGuardContainers(endpoints), OrphanPolicies: orphanPolicies}, nil
+}
+
+func (s *DockerPortGuardService) ExportBackup(ctx context.Context, provider filter.Provider) (dto.FirewallSubsystemBackup, error) {
+	backend := string(provider)
+	if backend == "" {
+		backend = selectedDockerFirewallBackend("")
+	}
+	if backend != constant.FirewallProviderIptables && backend != constant.FirewallProviderNftables {
+		return dto.FirewallSubsystemBackup{}, filter.ErrInvalidRule
+	}
+	inventory, err := s.guardRuntime(ctx, backend).ListPolicies()
+	if err != nil {
+		return dto.FirewallSubsystemBackup{}, err
+	}
+	if inventory.Policies == nil {
+		inventory.Policies = []dockerfirewall.Policy{}
+	}
+	return dto.FirewallSubsystemBackup{Subsystem: "docker", Provider: filter.Provider(backend), Docker: &inventory}, nil
+}
+
+func (s *DockerPortGuardService) LoadPublishedPorts(ctx context.Context) ([]dto.DockerPortGuardContainer, error) {
+	cli, err := s.client()
+	if err != nil {
+		return nil, buserr.WithDetail("ErrDockerFailed", err.Error(), err)
+	}
+	defer cli.Close()
+
+	if socketPath, local := strings.CutPrefix(cli.DaemonHost(), "unix://"); local {
+		if _, statErr := os.Stat(socketPath); errors.Is(statErr, os.ErrNotExist) {
+			return []dto.DockerPortGuardContainer{}, nil
+		}
+	}
+
+	endpoints, err := discoverDockerEndpoints(ctx, cli, false)
+	if err != nil {
+		return nil, err
+	}
+	backend := selectedDockerFirewallBackend("")
+	if info, infoErr := cli.Info(ctx); infoErr == nil {
+		backend = dockerFirewallBackend(info)
+	}
+	annotateDockerEndpointManagement(ctx, endpoints, backend)
+	return groupDockerGuardContainers(endpoints), nil
+}
+
+func (s *DockerPortGuardService) Operate(ctx context.Context, request dto.DockerPortGuardOperation) error {
+	dockerPortGuardServiceMu.Lock()
+	defer dockerPortGuardServiceMu.Unlock()
+	switch request.Operation {
+	case "initialize":
+		return s.initialize(ctx, request, nil)
+	case "bind":
+		runtime, _, err := s.runtimeForDocker(ctx)
+		if err != nil {
+			return err
+		}
+		families, err := loadFirewallFamilies()
+		if err != nil {
+			return err
+		}
+		if err := errors.Join(runtime.Bind(families...), ctx.Err()); err != nil {
+			return err
+		}
+		return settingRepo.UpdateOrCreate(constant.FirewallDockerPortGuardStatusKey, constant.StatusEnable)
+	case "unbind":
+		var err error
+		if s.runtime != nil {
+			err = s.runtime.Unbind()
+		} else {
+			err = errors.Join(dockerfirewall.NewIptables(ctx).Unbind(), dockerfirewall.NewNftables(ctx).Unbind())
+		}
+		if err = errors.Join(err, ctx.Err()); err != nil {
+			return err
+		}
+		return settingRepo.UpdateOrCreate(constant.FirewallDockerPortGuardStatusKey, constant.StatusDisable)
+	default:
+		return fmt.Errorf("unsupported Docker port guard operation: %s", request.Operation)
+	}
+}
+
+func (s *DockerPortGuardService) QueueInitialization(request dto.DockerPortGuardOperation) (dto.FilterChainOperationResponse, error) {
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeFirewall, 0); err != nil {
+		return dto.FilterChainOperationResponse{}, err
+	}
+	if request.Operation != "initialize" {
+		return dto.FilterChainOperationResponse{}, filter.ErrInvalidRule
+	}
+	if request.BackupFile != "" {
+		if _, err := readFirewallSubsystemBackup(request.BackupFile, "docker"); err != nil {
+			return dto.FilterChainOperationResponse{}, err
+		}
+	}
+	return queueFirewallRuleTask(firewallTaskDocker, task.TaskExec, request.TaskID, []string{firewallTaskDocker}, func(t *task.Task) error {
+		dockerPortGuardServiceMu.Lock()
+		defer dockerPortGuardServiceMu.Unlock()
+		return s.initialize(t.TaskCtx, request, t)
+	})
+}
+
+func (s *DockerPortGuardService) DeletePolicies(request dto.DockerPortGuardPolicyBatchDelete) (dto.FilterChainOperationResponse, error) {
+	uuids, err := normalizeDockerFirewallUUIDs(request.UUIDs)
+	if err != nil {
+		return dto.FilterChainOperationResponse{}, err
+	}
+	return queueFirewallRuleTask(firewallTaskDocker, task.TaskDelete, "", uuids, func(t *task.Task) error {
+		ctx := t.TaskCtx
+		dockerPortGuardServiceMu.Lock()
+		defer dockerPortGuardServiceMu.Unlock()
+		runtime, backend, err := s.runtimeForDocker(ctx)
+		if err != nil {
+			return err
+		}
+		inventory, err := runtime.ListPolicies()
+		if err != nil {
+			return err
+		}
+		wanted := make(map[string]bool, len(uuids))
+		for _, id := range uuids {
+			wanted[id] = true
+		}
+		remaining := make([]dockerfirewall.Policy, 0, len(inventory.Policies))
+		for _, policy := range inventory.Policies {
+			if wanted[policy.UUID] {
+				delete(wanted, policy.UUID)
+			} else {
+				remaining = append(remaining, policy)
+			}
+		}
+		if len(wanted) > 0 {
+			return filter.ErrRuleStale
+		}
+		return applyDockerPolicies(ctx, runtime, backend, inventory, remaining)
+	})
+}
+
+func (s *DockerPortGuardService) UpsertPolicies(request dto.DockerPortGuardPolicyBatch) (dto.FilterChainOperationResponse, error) {
+	if len(request.Policies) > filter.MaxAtomicExpansion {
+		return dto.FilterChainOperationResponse{}, fmt.Errorf("create or import at most %d rules per batch (after expansion)", filter.MaxAtomicExpansion)
+	}
+	labels := make([]string, len(request.Policies))
+	policies := make([]dockerfirewall.Policy, 0, len(request.Policies))
+	endpoints := make([]dto.DockerPortGuardEndpointIdentity, 0, len(request.Policies))
+	count := 0
+	for i, policy := range request.Policies {
+		labels[i] = fmt.Sprintf("[%d/%d] %s %s %s:%d %s", i+1, len(request.Policies), policy.Family, policy.Protocol, policy.HostIP, policy.HostPort, policy.Mode)
+		normalized, err := normalizeDockerFirewallPolicy(dockerfirewall.Policy{
+			Family: policy.Family, HostIP: policy.HostIP, HostPort: policy.HostPort,
+			Protocol: policy.Protocol, Mode: policy.Mode, Sources: policy.Sources,
+		})
+		if err != nil {
+			return dto.FilterChainOperationResponse{}, fmt.Errorf("%s: %w", labels[i], err)
+		}
+		if normalized.Mode == dockerfirewall.ModeAll || normalized.Mode == dockerfirewall.ModeAcceptAll {
+			count++
+		} else {
+			count += len(normalized.Sources)
+			if normalized.Mode == dockerfirewall.ModeAllow {
+				count++
+			}
+		}
+		if count > filter.MaxAtomicExpansion {
+			return dto.FilterChainOperationResponse{}, fmt.Errorf("create or import at most %d rules per batch (after expansion)", filter.MaxAtomicExpansion)
+		}
+		normalized.UUID = uuid.NewString()
+		policies = append(policies, normalized)
+	}
+	return queueFirewallRuleTask(firewallTaskDocker, task.TaskUpdate, "", labels, func(t *task.Task) error {
+		ctx := t.TaskCtx
+		dockerPortGuardServiceMu.Lock()
+		defer dockerPortGuardServiceMu.Unlock()
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		runtime, backend, err := s.runtimeForDocker(ctx)
+		if err != nil {
+			return err
+		}
+		inventory, err := runtime.ListPolicies()
+		if err != nil {
+			return err
+		}
+		current := append([]dockerfirewall.Policy(nil), inventory.Policies...)
+		if request.Import {
+			backup := dto.FirewallSubsystemBackup{Provider: filter.Provider(backend), Docker: &dockerfirewall.PolicyInventory{Policies: policies}}
+			merged, err := mergeDockerBackup(inventory, backup, backend, t)
+			if err != nil {
+				return err
+			}
+			current = merged.Policies
+		}
+		byEndpoint := make(map[string]int, len(current))
+		for i, policy := range current {
+			byEndpoint[dockerPolicyEndpointKey(policy)] = i
+		}
+		for i := range policies {
+			key := dockerPolicyEndpointKey(policies[i])
+			index, exists := byEndpoint[key]
+			if request.Import {
+				if !exists || current[index].UUID != policies[i].UUID {
+					labels[i] = ""
+					continue
+				}
+			} else if exists {
+				policies[i].UUID = current[index].UUID
+				current[index] = policies[i]
+			} else {
+				byEndpoint[key] = len(current)
+				current = append(current, policies[i])
+			}
+			endpoints = append(endpoints, dto.DockerPortGuardEndpointIdentity{
+				Family: policies[i].Family, HostIP: policies[i].HostIP, HostPort: policies[i].HostPort, Protocol: policies[i].Protocol,
+			})
+		}
+		if len(endpoints) == 0 {
+			return nil
+		}
+		if err := s.rejectHostInputDockerGuardEndpoints(ctx, endpoints); err != nil {
+			return err
+		}
+		if err := applyDockerPolicies(ctx, runtime, backend, inventory, current); err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+func (s *DockerPortGuardService) Restore(ctx context.Context) error {
+	dockerPortGuardServiceMu.Lock()
+	defer dockerPortGuardServiceMu.Unlock()
+	enabled, err := dockerPortGuardPersistedEnabled()
+	if err != nil || !enabled {
+		return err
+	}
+	runtime, backend, err := s.runtimeForDocker(ctx)
+	if err != nil {
+		return err
+	}
+	backup, err := readFirewallSubsystemBackup("docker-"+backend+".rules", "docker")
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	families, err := loadFirewallFamilies()
+	if err != nil {
+		return err
+	}
+	if !slices.Contains(families, constant.FirewallFamilyIPv6) {
+		before := len(backup.Docker.Policies)
+		backup.Docker.Policies = slices.DeleteFunc(backup.Docker.Policies, func(policy dockerfirewall.Policy) bool { return policy.Family == constant.FirewallFamilyIPv6 })
+		logFirewallIPv6Skipped(nil, "Docker startup", before-len(backup.Docker.Policies))
+	}
+	missing := make(map[string]bool)
+	needsBind := false
+	for _, family := range families {
+		status := runtime.Status(family)
+		if status.Reason == dockerfirewall.ReasonInspectFailed {
+			return fmt.Errorf("inspect Docker guard %s failed", family)
+		}
+		if status.Reason == dockerfirewall.ReasonCommandMissing {
+			continue
+		}
+		missing[family] = !status.Initialized
+		needsBind = needsBind || (status.Initialized && !status.Effective)
+	}
+	if !missing[dockerfirewall.FamilyIPv4] && !missing[dockerfirewall.FamilyIPv6] {
+		if needsBind {
+			return runtime.Bind(families...)
+		}
+		return nil
+	}
+	inventory, err := runtime.ListPolicies()
+	if err != nil {
+		return err
+	}
+	for _, policy := range inventory.Policies {
+		missing[policy.Family] = false
+	}
+	if inventory.RuleOrders == nil {
+		inventory.RuleOrders = make(map[string][]int64)
+	}
+	for _, policy := range backup.Docker.Policies {
+		if !missing[policy.Family] {
+			continue
+		}
+		inventory.Policies = append(inventory.Policies, policy)
+		key := policy.Family + "\x00" + policy.UUID
+		inventory.RuleOrders[key] = backup.Docker.RuleOrders[key]
+	}
+	return runtime.Initialize(inventory.Policies, inventory, families...)
+}
+
+func (s *DockerPortGuardService) runtimeStatus(runtime dockerfirewall.Runtime, backend string, ipv6Enabled bool) dto.DockerPortGuardBase {
+	ipv4 := runtime.Status(dockerfirewall.FamilyIPv4)
+	var ipv6 dockerfirewall.FamilyStatus
+	if ipv6Enabled {
+		ipv6 = runtime.Status(dockerfirewall.FamilyIPv6)
+	}
+	version := "-"
+	if s.version != nil {
+		version = s.version(backend)
+	}
+	name := "iptables-docker"
+	if strings.EqualFold(strings.TrimSpace(backend), constant.FirewallProviderNftables) {
+		name = "nftables-docker"
+	}
+	return dto.DockerPortGuardBase{
+		IPv6Enabled: ipv6Enabled,
+		Name:        name,
+		Version:     version,
+		Backend:     backend,
+		IsExist:     ipv4.Reason != dockerfirewall.ReasonCommandMissing || (ipv6Enabled && ipv6.Reason != dockerfirewall.ReasonCommandMissing),
+		Initialized: ipv4.Initialized || ipv6.Initialized,
+		Bound:       ipv4.Bound || ipv6.Bound,
+		IPv4:        dto.DockerPortGuardFamilyStatus{Partial: ipv4.Partial, State: ipv4.State, Reason: ipv4.Reason, Initialized: ipv4.Initialized, Bound: ipv4.Bound, Effective: ipv4.Effective},
+		IPv6:        dto.DockerPortGuardFamilyStatus{Partial: ipv6.Partial, State: ipv6.State, Reason: ipv6.Reason, Initialized: ipv6.Initialized, Bound: ipv6.Bound, Effective: ipv6.Effective},
+	}
+}
+
+func matchDockerGuardPolicies(base dto.DockerPortGuardBase, policies []dto.DockerPortGuardEndpoint, endpoints []dto.DockerPortGuardEndpoint) ([]dto.DockerPortGuardEndpoint, []dto.DockerPortGuardEndpoint) {
+	matched := make(map[int]bool, len(policies))
+	byEndpoint := make(map[string]int, len(policies))
+	for index, policy := range policies {
+		key := strings.Join([]string{policy.Family, policy.HostIP, strconv.Itoa(int(policy.HostPort)), policy.Protocol}, "\x00")
+		if _, exists := byEndpoint[key]; !exists {
+			byEndpoint[key] = index
+		}
+	}
+	for i := range endpoints {
+		key := strings.Join([]string{endpoints[i].Family, endpoints[i].HostIP, strconv.Itoa(int(endpoints[i].HostPort)), endpoints[i].Protocol}, "\x00")
+		index, exists := byEndpoint[key]
+		if !exists {
+			continue
+		}
+		policy := policies[index]
+		endpoints[i].PolicyUUID, endpoints[i].Mode, endpoints[i].Sources = policy.PolicyUUID, policy.Mode, policy.Sources
+		endpoints[i].Effective = endpoints[i].ManagementTarget == dockerManagementContainerGuard && ((policy.Family == dockerfirewall.FamilyIPv4 && base.IPv4.Effective) || (policy.Family == dockerfirewall.FamilyIPv6 && base.IPv6.Effective))
+		matched[index] = true
+	}
+	orphans := make([]dto.DockerPortGuardEndpoint, 0)
+	for i, policy := range policies {
+		if !matched[i] {
+			orphans = append(orphans, policy)
+		}
+	}
+	return endpoints, orphans
+}
+
+func (s *DockerPortGuardService) rejectHostInputDockerGuardEndpoints(ctx context.Context, requested []dto.DockerPortGuardEndpointIdentity) error {
+	if s.client == nil || len(requested) == 0 {
+		return ctx.Err()
+	}
+	cli, err := s.client()
+	if err != nil {
+		return ctx.Err()
+	}
+	defer cli.Close()
+	info, err := cli.Info(ctx)
+	if err != nil {
+		return ctx.Err()
+	}
+	endpoints, err := discoverDockerEndpoints(ctx, cli, true)
+	if err != nil {
+		return ctx.Err()
+	}
+	annotateDockerEndpointManagement(ctx, endpoints, dockerFirewallBackend(info))
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	targets := make(map[string]string, len(endpoints))
+	for _, endpoint := range endpoints {
+		targets[fmt.Sprintf("%s|%s|%d|%s", endpoint.Family, endpoint.HostIP, endpoint.HostPort, endpoint.Protocol)] = endpoint.ManagementTarget
+	}
+	for _, endpoint := range requested {
+		target := targets[fmt.Sprintf("%s|%s|%d|%s", endpoint.Family, endpoint.HostIP, endpoint.HostPort, endpoint.Protocol)]
+		if target == dockerManagementHostFirewall {
+			return buserr.WithDetail("ErrInvalidParams", "endpoint traffic is handled by the host input firewall", nil)
+		}
+		if target == dockerManagementNeedsDiagnosis {
+			return buserr.WithDetail("ErrInvalidParams", "endpoint traffic management target requires diagnosis", nil)
+		}
+	}
+	return nil
+}

agent/app/service/firewall_fail2ban_state.go

@@ -1,78 +0,0 @@
-package service
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/1Panel-dev/1Panel/agent/global"
-	"github.com/1Panel-dev/1Panel/agent/utils/controller"
-)
-
-const fail2BanRestoreWithFirewallMarker = "/run/1panel_fail2ban_restore_with_firewall"
-
-type firewallFail2BanState struct {
-	markerPath string
-	isExist    func(string) bool
-	isActive   func(string) bool
-	start      func(string) error
-}
-
-func newFirewallFail2BanState() *firewallFail2BanState {
-	return &firewallFail2BanState{
-		markerPath: fail2BanRestoreWithFirewallMarker,
-		isExist: func(serviceName string) bool {
-			exists, err := controller.CheckExist(serviceName)
-			if err != nil {
-				global.LOG.Warnf("check %s installation before stopping the firewall failed: %v", serviceName, err)
-			}
-			return exists
-		},
-		isActive: func(serviceName string) bool {
-			active, err := controller.CheckActive(serviceName)
-			if err != nil {
-				global.LOG.Warnf("check %s status before stopping the firewall failed: %v", serviceName, err)
-			}
-			return active
-		},
-		start: controller.HandleStart,
-	}
-}
-
-func (s *firewallFail2BanState) rememberBeforeFirewallStop() error {
-	if !s.isExist("fail2ban.service") {
-		return nil
-	}
-	if !s.isActive("fail2ban.service") {
-		return nil
-	}
-	return s.markForRestore()
-}
-
-func (s *firewallFail2BanState) markForRestore() error {
-	if err := os.WriteFile(s.markerPath, nil, 0600); err != nil {
-		return fmt.Errorf("mark Fail2Ban for restoration with the firewall: %w", err)
-	}
-	return nil
-}
-
-func (s *firewallFail2BanState) restoreAfterFirewallStart() error {
-	_, err := os.Stat(s.markerPath)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return fmt.Errorf("load Fail2Ban restore marker after starting the firewall: %w", err)
-	}
-
-	if err := s.start("fail2ban.service"); err != nil {
-		return fmt.Errorf("restore Fail2Ban after starting the firewall: %w", err)
-	}
-	return s.clearRestoreMarker()
-}
-
-func (s *firewallFail2BanState) clearRestoreMarker() error {
-	if err := os.Remove(s.markerPath); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("clear Fail2Ban firewall restore status: %w", err)
-	}
-	return nil
-}

agent/app/service/firewall_setting.go

@@ -1,175 +1,688 @@
 package service
 
 import (
+	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
-	"strconv"
+	"slices"
 	"strings"
+	"sync"
 
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
-	fireClient "github.com/1Panel-dev/1Panel/agent/utils/firewall/client"
-	"github.com/1Panel-dev/1Panel/agent/utils/firewall/client/iptables"
+	dockerfirewall "github.com/1Panel-dev/1Panel/agent/utils/firewall/docker_guard"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/forwarding"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/iptables_helper"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/lifecycle"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/nftables_helper"
+	"gorm.io/gorm"
 )
 
-type firewallPortWhitelist struct {
-	Port     string
-	Protocol string
+type IFirewallSettingService interface {
+	CreatePortWhitelist(context.Context, dto.FirewallPortWhitelistCreate) error
+	UpdatePortWhitelist(context.Context, dto.FirewallPortWhitelistUpdate) error
+	DeletePortWhitelist(context.Context, dto.FirewallPortWhitelistDelete) error
+	Load(context.Context) (dto.FirewallSettings, error)
+	Operate(context.Context, dto.FirewallBackendOperation) error
+	OperateFamily(dto.FirewallFamilyOperation) (dto.FilterChainOperationResponse, error)
+	OperateIPv6(dto.FirewallIPv6Operation) (dto.FilterChainOperationResponse, error)
 }
 
-func loadConfiguredFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
-	value, err := settingRepo.GetValueByKey(constant.FirewallPortWhiteList)
-	if err != nil {
-		value = constant.FirewallPortWhiteListValue
-		if err := settingRepo.UpdateOrCreate(constant.FirewallPortWhiteList, value); err != nil {
-			return nil, err
-		}
-	}
-	return parseFirewallPortWhiteList(value)
-}
+type FirewallSettingService struct{}
 
-func loadFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
-	portWhiteList, err := loadConfiguredFirewallPortWhiteList()
-	if err != nil {
-		return nil, err
-	}
-	requiredPorts, err := loadRequiredFirewallPortWhiteList()
-	if err != nil {
-		return nil, err
-	}
-	return normalizeFirewallPortWhiteList(append(portWhiteList, requiredPorts...)), nil
-}
+var firewallWhitelistMu sync.Mutex
 
-func loadRequiredFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
-	panelPort := LoadPanelPort()
-	if panelPort == "" {
-		return nil, fmt.Errorf("find 1panel service port failed")
-	}
-	return normalizeFirewallPortWhiteList([]firewallPortWhitelist{
-		{Port: panelPort, Protocol: "tcp"},
-		{Port: loadSSHPort(), Protocol: "tcp"},
-	}), nil
-}
-
-func parseFirewallPortWhiteList(value string) ([]firewallPortWhitelist, error) {
-	items := strings.FieldsFunc(value, func(r rune) bool {
-		return r == ',' || r == '\n' || r == ';' || r == ' '
-	})
-	ports := make([]firewallPortWhitelist, 0, len(items))
-	exists := make(map[string]struct{})
-	for _, item := range items {
-		item = strings.TrimSpace(item)
-		if item == "" {
-			continue
+func (s *FirewallSettingService) CreatePortWhitelist(ctx context.Context, request dto.FirewallPortWhitelistCreate) (result error) {
+	firewallWhitelistMu.Lock()
+	firewallRuleMutationMu.Lock()
+	defer func() {
+		firewallRuleMutationMu.Unlock()
+		firewallWhitelistMu.Unlock()
+		if result == nil {
+			result = newFirewallService().SyncPortWhitelist(ctx)
 		}
-		port, protocol, ok := strings.Cut(item, "/")
-		if !ok {
-			protocol = "tcp"
-		}
-		port = strings.TrimSpace(port)
-		protocol = strings.ToLower(strings.TrimSpace(protocol))
-		if protocol != "tcp" && protocol != "udp" {
-			return nil, fmt.Errorf("invalid firewall port whitelist protocol: %s", item)
-		}
-		portNum, err := strconv.Atoi(port)
-		if err != nil || portNum < 1 || portNum > 65535 {
-			return nil, fmt.Errorf("invalid firewall port whitelist: %s", item)
-		}
-		key := fmt.Sprintf("%d/%s", portNum, protocol)
-		if _, ok := exists[key]; ok {
-			continue
-		}
-		exists[key] = struct{}{}
-		ports = append(ports, firewallPortWhitelist{Port: strconv.Itoa(portNum), Protocol: protocol})
-	}
-	return ports, nil
-}
-
-func normalizeFirewallPortWhiteList(portWhiteList []firewallPortWhitelist) []firewallPortWhitelist {
-	ports := make([]firewallPortWhitelist, 0, len(portWhiteList))
-	exists := make(map[string]struct{})
-	for _, item := range portWhiteList {
-		if item.Port == "" {
-			continue
-		}
-		key := fmt.Sprintf("%s/%s", item.Port, item.Protocol)
-		if _, ok := exists[key]; ok {
-			continue
-		}
-		exists[key] = struct{}{}
-		ports = append(ports, item)
-	}
-	return ports
-}
-
-func syncFirewallPortWhiteListAfterUpdate(oldValue string) error {
-	client, err := firewall.NewFirewallClient()
+	}()
+	current, err := loadFirewallPortWhiteList()
 	if err != nil {
 		return err
 	}
-	if client.Name() == "iptables" {
-		isInit, _ := iptables.LoadInitStatus("iptables", "base")
-		if !isInit {
-			return nil
+	current = append(current, request.Rule)
+	current, err = firewall.ValidatePortWhitelist(current)
+	if err != nil {
+		return err
+	}
+	if err := validateFirewallWhitelistFamilies(current); err != nil {
+		return err
+	}
+	value, err := json.Marshal(current)
+	if err != nil {
+		return err
+	}
+	return settingRepo.UpdateOrCreate(constant.FirewallPortWhiteList, string(value))
+}
+
+func (s *FirewallSettingService) UpdatePortWhitelist(ctx context.Context, request dto.FirewallPortWhitelistUpdate) (result error) {
+	firewallWhitelistMu.Lock()
+	firewallRuleMutationMu.Lock()
+	defer func() {
+		firewallRuleMutationMu.Unlock()
+		firewallWhitelistMu.Unlock()
+		if result == nil {
+			result = newFirewallService().SyncPortWhitelist(ctx)
 		}
-		oldPortWhiteList, err := parseFirewallPortWhiteList(oldValue)
+	}()
+	current, err := loadFirewallPortWhiteList()
+	if err != nil {
+		return err
+	}
+	index, err := findPortWhitelistRule(current, request.OldRule)
+	if err != nil {
+		return err
+	}
+	current[index] = request.Rule
+	current, err = firewall.ValidatePortWhitelist(current)
+	if err != nil {
+		return err
+	}
+	if err := validateFirewallWhitelistFamilies(current); err != nil {
+		return err
+	}
+	value, err := json.Marshal(current)
+	if err != nil {
+		return err
+	}
+	return settingRepo.UpdateOrCreate(constant.FirewallPortWhiteList, string(value))
+}
+
+func (s *FirewallSettingService) DeletePortWhitelist(ctx context.Context, request dto.FirewallPortWhitelistDelete) error {
+	firewallWhitelistMu.Lock()
+	firewallRuleMutationMu.Lock()
+	defer func() {
+		firewallRuleMutationMu.Unlock()
+		firewallWhitelistMu.Unlock()
+	}()
+	current, err := loadFirewallPortWhiteList()
+	if err != nil {
+		return err
+	}
+	if request.Rule == nil {
+		return filter.ErrInvalidRule
+	}
+	index, err := findPortWhitelistRule(current, *request.Rule)
+	if err != nil {
+		return err
+	}
+	current = slices.Delete(current, index, index+1)
+	current, err = firewall.ValidatePortWhitelist(current)
+	if err != nil {
+		return err
+	}
+	if err := validateFirewallWhitelistFamilies(current); err != nil {
+		return err
+	}
+	value, err := json.Marshal(current)
+	if err != nil {
+		return err
+	}
+	return settingRepo.UpdateOrCreate(constant.FirewallPortWhiteList, string(value))
+}
+
+func (s *FirewallSettingService) Load(ctx context.Context) (dto.FirewallSettings, error) {
+	families, err := loadFirewallFamilies()
+	if err != nil {
+		return dto.FirewallSettings{}, err
+	}
+	result := dto.FirewallSettings{PingStatus: firewall.LoadPingStatus(), IPv6Enabled: slices.Contains(families, constant.FirewallFamilyIPv6)}
+
+	installed := make(map[string]bool)
+	for _, name := range lifecycle.InstalledProviders() {
+		installed[name] = true
+	}
+	systemBackend, _ := settingRepo.GetValueByKey(constant.FirewallSystemBackendKey)
+	result.System.Selected = strings.TrimSpace(systemBackend)
+	if result.System.Selected == "" {
+		if client, err := lifecycle.NewClient(""); err == nil {
+			result.System.Selected = client.Name()
+		}
+	}
+	result.System.Current = result.System.Selected
+	for _, name := range []string{
+		constant.FirewallProviderFirewalld,
+		constant.FirewallProviderUFW,
+		constant.FirewallProviderIptables,
+		constant.FirewallProviderNftables,
+	} {
+		option := dto.FirewallBackendOption{Name: name, Installed: installed[name], Supported: true}
+		if option.Installed && name == result.System.Selected {
+			client, err := lifecycle.NewClient(name)
+			if err != nil {
+				option.Message = err.Error()
+			} else if name == constant.FirewallProviderIptables || name == constant.FirewallProviderNftables {
+				overview, err := loadSystemFirewallOverview(name, "base", families)
+				if err != nil {
+					option.Message = err.Error()
+				}
+				option.Initialized, option.Bound = overview.IsInit, overview.IsBind
+				option.IPv4, option.IPv6 = overview.IPv4, overview.IPv6
+			} else if option.Active, err = client.Status(); err != nil {
+				option.Message = err.Error()
+			}
+		}
+		if name == result.System.Selected && name == constant.FirewallProviderIptables {
+			if commands, err := lifecycle.ResolveIptablesCommands(); err == nil {
+				option.Implementation = commands.IPv4
+			}
+		}
+		result.System.Options = append(result.System.Options, option)
+	}
+
+	forwardingBackend, _ := settingRepo.GetValueByKey(constant.FirewallForwardingBackendKey)
+	result.Forwarding.Selected = strings.TrimSpace(forwardingBackend)
+	if result.Forwarding.Selected == "" {
+		result.Forwarding.Selected = constant.FirewallProviderIptables
+	}
+	result.Forwarding.Current = result.Forwarding.Selected
+	for _, name := range []string{constant.FirewallProviderIptables, constant.FirewallProviderNftables} {
+		option := dto.FirewallBackendOption{Name: name, Installed: installed[name], Supported: true}
+		if option.Installed && name == result.Forwarding.Selected {
+			manager, err := newForwardingAdapterFor(ctx, name)
+			if err != nil {
+				option.Message = err.Error()
+			} else {
+				status, statusErr := loadForwardingFirewallOverview(manager, families)
+				option.IPv4, option.IPv6 = status.IPv4, status.IPv6
+				if statusErr != nil {
+					option.Message = statusErr.Error()
+				} else {
+					option.Initialized, option.Bound = status.IsInit, status.IsBind
+				}
+				if result.IPv6Enabled && name == constant.FirewallProviderIptables && !option.IPv6.Available {
+					if commands, err := lifecycle.ResolveIptablesCommands(); err == nil && !commands.IPv6Available() {
+						option.IPv6.Reason = dockerfirewall.ReasonCommandMissing
+					}
+				}
+			}
+		}
+		if name == result.Forwarding.Selected && name == constant.FirewallProviderIptables {
+			if commands, err := lifecycle.ResolveIptablesCommands(); err == nil {
+				option.Implementation = commands.IPv4
+			}
+		}
+		result.Forwarding.Options = append(result.Forwarding.Options, option)
+	}
+
+	dockerInstalled := cmd.Which("docker")
+	dockerVersion := ""
+	if dockerInstalled {
+		dockerVersion = loadDockerEngineVersion(ctx)
+	}
+	dockerBackend, _ := settingRepo.GetValueByKey(constant.FirewallDockerBackendKey)
+	dockerBackend = strings.ToLower(strings.TrimSpace(dockerBackend))
+	if dockerBackend == constant.FirewallProviderIptables || dockerBackend == constant.FirewallProviderNftables {
+		result.Docker.Selected = dockerBackend
+	}
+	result.Docker.Current = result.Docker.Selected
+	for _, name := range []string{constant.FirewallProviderIptables, constant.FirewallProviderNftables} {
+		option := dto.FirewallBackendOption{
+			Name: name, Installed: installed[name], Supported: dockerInstalled,
+			Active: dockerInstalled && installed[name] && result.Docker.Selected == name,
+		}
+		if name == constant.FirewallProviderNftables && dockerInstalled && !dockerNftablesSupported(dockerVersion) {
+			option.Supported = false
+			option.SupportReason = "docker_version_unsupported"
+			option.Active = false
+		}
+		if option.Active {
+			guard := newDockerFirewallRuntime(ctx, name)
+			for _, family := range families {
+				status := guard.Status(family)
+				option.Initialized = option.Initialized || status.Initialized
+				option.Bound = option.Bound || status.Bound
+				info := dto.FirewallBackendFamilyStatus{
+					Available:   status.Reason != dockerfirewall.ReasonCommandMissing,
+					Initialized: status.Initialized, Bound: status.Bound, Reason: status.Reason,
+				}
+				if family == constant.FirewallFamilyIPv4 {
+					option.IPv4 = info
+				} else {
+					option.IPv6 = info
+				}
+			}
+		}
+		result.Docker.Options = append(result.Docker.Options, option)
+	}
+	result.PortWhitelist, err = loadPortWhitelistSetting()
+	if err != nil {
+		return result, err
+	}
+	result.PanelPort = LoadPanelPort()
+	sshPort, sshErr := loadSSHWhitelistPortFrom(sshPath)
+	if sshErr != nil {
+		global.LOG.Warnf("load SSH port for firewall settings: %v", sshErr)
+	} else {
+		result.SSHPort = sshPort
+	}
+	return result, err
+}
+
+func (s *FirewallSettingService) Operate(ctx context.Context, request dto.FirewallBackendOperation) error {
+	if request.Operation == "cleanup" {
+		_, err := newFirewallService().Reset(ctx, dto.FirewallRuleReset{Subsystem: request.Subsystem, Provider: filter.Provider(request.Backend)})
+		return err
+	}
+	if err := lockFirewallLifecycleIdle(); err != nil {
+		return err
+	}
+	defer firewallLifecycleTaskMu.Unlock()
+	if request.Subsystem != "system" && request.Backend != constant.FirewallProviderIptables && request.Backend != constant.FirewallProviderNftables {
+		return fmt.Errorf("%s only supports iptables or nftables", request.Subsystem)
+	}
+	if request.Subsystem == "system" && (request.Backend != constant.FirewallProviderIptables && request.Backend != constant.FirewallProviderNftables) && request.Operation != "select" {
+		return fmt.Errorf("%s does not support initialization or cleanup", request.Backend)
+	}
+	switch request.Subsystem {
+	case "system":
+		if err := s.operateSystem(request); err != nil {
+			return err
+		}
+		if request.Operation == "initialize" {
+			service := newFirewallService()
+			whitelistErr := service.SyncPortWhitelist(ctx)
+			return whitelistErr
+		}
+		return nil
+	case "forwarding":
+		return s.operateForwarding(ctx, request)
+	case "docker":
+		return s.operateDocker(ctx, request)
+	default:
+		return fmt.Errorf("unsupported firewall subsystem %q", request.Subsystem)
+	}
+}
+
+func (s *FirewallSettingService) OperateFamily(request dto.FirewallFamilyOperation) (dto.FilterChainOperationResponse, error) {
+	if request.Family != constant.FirewallFamilyIPv4 && request.Family != constant.FirewallFamilyIPv6 {
+		return dto.FilterChainOperationResponse{}, filter.ErrInvalidScope
+	}
+	if request.Backend != constant.FirewallProviderIptables && request.Backend != constant.FirewallProviderNftables {
+		return dto.FilterChainOperationResponse{}, filter.ErrUnsupportedScope
+	}
+	if request.Operation != "initialize" && request.Operation != "repair" && request.Operation != "bind" {
+		return dto.FilterChainOperationResponse{}, filter.ErrRuleOperation
+	}
+	subsystem := ""
+	switch request.Subsystem {
+	case "system":
+		subsystem = firewallTaskHost
+	case "forwarding":
+		subsystem = firewallTaskForwarding
+	case "docker":
+		subsystem = firewallTaskDocker
+	default:
+		return dto.FilterChainOperationResponse{}, filter.ErrInvalidScope
+	}
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeFirewall, 0); err != nil {
+		return dto.FilterChainOperationResponse{}, err
+	}
+	return queueFirewallRuleTask(subsystem, task.TaskExec, "", nil, func(t *task.Task) error {
+		if err := lockFirewallLifecycleIdle(); err != nil {
+			return err
+		}
+		defer firewallLifecycleTaskMu.Unlock()
+		t.Logf("backend=%s family=%s operation=%s", request.Backend, request.Family, request.Operation)
+		families, err := loadFirewallFamilies()
 		if err != nil {
 			return err
 		}
-		return syncIptablesFirewallPortWhiteList(true, oldPortWhiteList)
-	}
+		if !slices.Contains(families, request.Family) {
+			return fmt.Errorf("IPv6 firewall support is disabled")
+		}
+		initialize := request.Operation != "bind"
+		switch request.Subsystem {
+		case "system":
+			firewallWhitelistMu.Lock()
+			defer firewallWhitelistMu.Unlock()
+			if err := newFirewallService().checkSelectedProvider(t.TaskCtx, filter.Provider(request.Backend)); err != nil {
+				return err
+			}
+			ports, err := loadFirewallPortWhiteList()
+			if err != nil {
+				return err
+			}
+			required, err := firewall.RequiredPortWhitelist(ports)
+			if err != nil {
+				return err
+			}
+			firewallRuleMutationMu.Lock()
+			if request.Backend == constant.FirewallProviderIptables {
+				err = iptables_helper.OperateFamily(request.Family, initialize, required)
+			} else {
+				err = nftables_helper.OperateFamily(filter.Family(request.Family), initialize, required)
+			}
+			firewallRuleMutationMu.Unlock()
+			if err != nil {
+				return err
+			}
+			if initialize {
+				if err := newFirewallService().applyPortWhitelist(t.TaskCtx, ports, nil, filter.Family(request.Family)); err != nil {
+					return err
+				}
+			}
+			return settingRepo.UpdateOrCreate("IptablesStatus", constant.StatusEnable)
+		case "forwarding":
+			forwardingMutationMu.Lock()
+			defer forwardingMutationMu.Unlock()
+			manager, err := newForwardingAdapter(t.TaskCtx)
+			if err != nil {
+				return err
+			}
+			if manager.Name() != request.Backend {
+				return filter.ErrProviderUnavailable
+			}
+			if err := manager.OperateFamily(request.Family, initialize); err != nil {
+				return err
+			}
+			rules, err := manager.List()
+			if err != nil {
+				return err
+			}
+			if err := persistForwardingRules(manager, rules); err != nil {
+				return err
+			}
+			return settingRepo.UpdateOrCreate(constant.FirewallForwardingInitializedKey, constant.StatusEnable)
+		default:
+			dockerPortGuardServiceMu.Lock()
+			defer dockerPortGuardServiceMu.Unlock()
+			runtime, backend, err := newDockerPortGuardService().runtimeForDocker(t.TaskCtx)
+			if err != nil {
+				return err
+			}
+			if backend != request.Backend {
+				return filter.ErrProviderUnavailable
+			}
+			if err := runtime.OperateFamily(request.Family, initialize); err != nil {
+				return err
+			}
+			inventory, err := runtime.ListPolicies()
+			if err != nil {
+				return err
+			}
+			if err := persistDockerRules(backend, inventory); err != nil {
+				return err
+			}
+			return settingRepo.UpdateOrCreate(constant.FirewallDockerPortGuardStatusKey, constant.StatusEnable)
+		}
+	})
+}
 
-	isActive, _ := client.Status()
-	if !isActive {
+func (s *FirewallSettingService) OperateIPv6(request dto.FirewallIPv6Operation) (dto.FilterChainOperationResponse, error) {
+	if request.Status != constant.StatusEnable && request.Status != constant.StatusDisable {
+		return dto.FilterChainOperationResponse{}, filter.ErrInvalidRule
+	}
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeFirewall, 0); err != nil {
+		return dto.FilterChainOperationResponse{}, err
+	}
+	return queueFirewallRuleTask(firewallTaskHost, task.TaskExec, "", nil, func(t *task.Task) error {
+		if err := lockFirewallLifecycleIdle(); err != nil {
+			return err
+		}
+		defer firewallLifecycleTaskMu.Unlock()
+		firewallWhitelistMu.Lock()
+		defer firewallWhitelistMu.Unlock()
+		firewallRuleMutationMu.Lock()
+		defer firewallRuleMutationMu.Unlock()
+		forwardingMutationMu.Lock()
+		defer forwardingMutationMu.Unlock()
+		dockerPortGuardServiceMu.Lock()
+		defer dockerPortGuardServiceMu.Unlock()
+		if request.Status == constant.StatusEnable {
+			return settingRepo.UpdateOrCreate(constant.FirewallIPv6SupportKey, request.Status)
+		}
+		ports, err := loadFirewallPortWhiteList()
+		if err != nil {
+			return err
+		}
+		value, err := json.Marshal(ipv4PortWhitelist(ports))
+		if err != nil {
+			return err
+		}
+		installed := lifecycle.InstalledProviders()
+		for _, selection := range []struct{ subsystem, key string }{
+			{"system", constant.FirewallSystemBackendKey},
+			{"forwarding", constant.FirewallForwardingBackendKey},
+			{"docker", constant.FirewallDockerBackendKey},
+		} {
+			backend, err := settingRepo.GetValueByKey(selection.key)
+			if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+				return err
+			}
+			backend = strings.ToLower(strings.TrimSpace(backend))
+			if backend == "" {
+				if selection.subsystem == "system" {
+					if len(installed) == 0 {
+						continue
+					}
+					client, err := NewSelectedSystemFirewallClient()
+					if err != nil {
+						return err
+					}
+					backend = client.Name()
+				} else {
+					backend = constant.FirewallProviderIptables
+				}
+			}
+			if !slices.Contains(installed, backend) || (backend != constant.FirewallProviderIptables && backend != constant.FirewallProviderNftables) {
+				continue
+			}
+			t.Logf("disable IPv6 firewall bindings: subsystem=%s backend=%s", selection.subsystem, backend)
+			switch selection.subsystem {
+			case "system":
+				if backend == constant.FirewallProviderIptables {
+					err = iptables_helper.UnbindIPv6BaseChains()
+				} else {
+					err = nftables_helper.SetTableDormant(t.TaskCtx, "ip6", nftables_helper.TableName)
+					if err == nil {
+						err = nftables_helper.PersistRuleset(t.TaskCtx)
+					}
+				}
+			case "forwarding":
+				var manager forwarding.Adapter
+				manager, err = newForwardingAdapterFor(t.TaskCtx, backend)
+				if err == nil {
+					err = manager.UnbindFamily(constant.FirewallFamilyIPv6)
+				}
+			case "docker":
+				err = newDockerFirewallRuntime(t.TaskCtx, backend).Unbind(constant.FirewallFamilyIPv6)
+			}
+			if err != nil && !errors.Is(err, filter.ErrFamilyUnavailable) {
+				return err
+			}
+		}
+		if err := t.TaskCtx.Err(); err != nil {
+			return err
+		}
+		return settingRepo.UpdateValues(map[string]string{constant.FirewallIPv6SupportKey: request.Status, constant.FirewallPortWhiteList: string(value)})
+	})
+}
+
+func NewIFirewallSettingService() IFirewallSettingService {
+	return &FirewallSettingService{}
+}
+
+func (s *FirewallSettingService) operateSystem(request dto.FirewallBackendOperation) error {
+	firewallRuleMutationMu.Lock()
+	defer firewallRuleMutationMu.Unlock()
+	if _, err := lifecycle.NewClient(request.Backend); err != nil {
+		return err
+	}
+	previous, _ := settingRepo.GetValueByKey(constant.FirewallSystemBackendKey)
+	if previous == "" {
+		if client, err := lifecycle.NewClient(""); err == nil {
+			previous = client.Name()
+		}
+	}
+	if request.Operation == "select" && previous != "" && previous != request.Backend {
+		initialized, err := systemFirewallBackendInitialized(previous)
+		if err != nil {
+			return err
+		}
+		if initialized {
+			return buserr.WithMap("ErrFirewallBackendCleanupRequired", map[string]interface{}{"current": previous, "target": request.Backend}, nil)
+		}
+	}
+	if err := settingRepo.UpdateOrCreate(constant.FirewallSystemBackendKey, request.Backend); err != nil {
+		return err
+	}
+	rollback := func(err error) error {
+		if err == nil {
+			return nil
+		}
+		_ = settingRepo.UpdateOrCreate(constant.FirewallSystemBackendKey, previous)
+		return err
+	}
+	if request.Operation == "select" {
 		return nil
 	}
-	portWhiteList, err := loadFirewallPortWhiteList()
-	if err != nil {
-		return err
+	initErr := newFirewallService().operateFilterChainBaseLocked(request.Backend, dto.FilterChainOperation{
+		Name: constant.FirewallBasicChain, Operate: string(firewall.BaseOperationInit),
+	})
+	if initErr != nil {
+		return rollback(initErr)
 	}
-	oldPortWhiteList, err := parseFirewallPortWhiteList(oldValue)
-	if err != nil {
-		return err
-	}
-	requiredPorts, err := loadRequiredFirewallPortWhiteList()
-	if err != nil {
-		return err
-	}
-	oldPortWhiteList = normalizeFirewallPortWhiteList(append(oldPortWhiteList, requiredPorts...))
-	return syncFirewallClientPortWhiteList(client, oldPortWhiteList, portWhiteList)
+	return settingRepo.UpdateOrCreate(constant.FirewallFilterInitializedKey, constant.StatusEnable)
 }
 
-func syncFirewallClientPortWhiteList(client firewall.FilterClient, oldPortWhiteList, portWhiteList []firewallPortWhitelist) error {
-	oldPorts := firewallPortWhiteListMap(oldPortWhiteList)
-	newPorts := firewallPortWhiteListMap(portWhiteList)
-	for _, item := range oldPortWhiteList {
-		key := firewallPortWhiteListKey(item)
-		if _, ok := newPorts[key]; ok {
-			continue
+func systemFirewallBackendInitialized(backend string) (bool, error) {
+	client, err := lifecycle.NewClient(backend)
+	if err != nil {
+		if errors.Is(err, lifecycle.ErrNotInstalled) {
+			return false, nil
 		}
-		if err := client.Port(fireClient.FireInfo{Port: item.Port, Protocol: item.Protocol, Strategy: "accept"}, "remove"); err != nil {
+		return false, err
+	}
+	if backend == constant.FirewallProviderIptables || backend == constant.FirewallProviderNftables {
+		for _, family := range []string{constant.FirewallFamilyIPv4, constant.FirewallFamilyIPv6} {
+			initialized, _, err := loadSystemFirewallFamilyStatus(backend, family)
+			if family == constant.FirewallFamilyIPv6 && errors.Is(err, filter.ErrFamilyUnavailable) {
+				continue
+			}
+			if err != nil {
+				return false, err
+			}
+			if initialized {
+				return true, nil
+			}
+		}
+		return false, nil
+	}
+	return client.Status()
+}
+
+func (s *FirewallSettingService) operateForwarding(ctx context.Context, request dto.FirewallBackendOperation) error {
+	if _, err := newForwardingAdapterFor(ctx, request.Backend); err != nil {
+		return err
+	}
+	previous, _ := settingRepo.GetValueByKey(constant.FirewallForwardingBackendKey)
+	if request.Operation == "select" {
+		current := previous
+		if current == "" {
+			detected, err := newForwardingAdapter(ctx)
+			if err != nil {
+				return err
+			}
+			current = detected.Name()
+		}
+		initialized, err := forwardingBackendInitialized(ctx, current)
+		if err != nil {
+			return err
+		}
+		if current != request.Backend && initialized {
+			return buserr.WithMap("ErrFirewallBackendCleanupRequired", map[string]interface{}{"current": current, "target": request.Backend}, nil)
+		}
+	}
+	if err := settingRepo.UpdateOrCreate(constant.FirewallForwardingBackendKey, request.Backend); err != nil {
+		return err
+	}
+	if request.Operation == "initialize" {
+		return newForwardingService().Enable(ctx)
+	}
+	return nil
+}
+
+func forwardingBackendInitialized(ctx context.Context, backend string) (bool, error) {
+	manager, err := newForwardingAdapterFor(ctx, backend)
+	if err != nil {
+		if errors.Is(err, lifecycle.ErrNotInstalled) {
+			return false, nil
+		}
+		return false, err
+	}
+	for _, family := range []string{constant.FirewallFamilyIPv4, constant.FirewallFamilyIPv6} {
+		initialized, _, err := manager.FamilyStatus(family)
+		if err != nil {
+			return false, err
+		}
+		if initialized {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func (s *FirewallSettingService) operateDocker(ctx context.Context, request dto.FirewallBackendOperation) error {
+
+	previous, _ := settingRepo.GetValueByKey(constant.FirewallDockerBackendKey)
+	if request.Operation == "select" {
+		current := previous
+		if current == "" {
+			current = constant.FirewallProviderNftables
+			if request.Backend == constant.FirewallProviderNftables {
+				current = constant.FirewallProviderIptables
+			}
+		}
+		initialized, err := dockerGuardBackendInitialized(ctx, current)
+		if err != nil {
+			return err
+		}
+		if current != request.Backend && initialized {
+			return buserr.WithMap("ErrFirewallBackendCleanupRequired", map[string]interface{}{"current": current, "target": request.Backend}, nil)
+		}
+	}
+	if err := settingRepo.UpdateOrCreate(constant.FirewallDockerBackendKey, request.Backend); err != nil {
+		return err
+	}
+	if request.Operation == "select" {
+		if err := (&DockerService{}).UpdateFirewallBackend(request.Backend); err != nil {
+			_ = settingRepo.UpdateOrCreate(constant.FirewallDockerBackendKey, previous)
 			return err
 		}
 	}
-	for _, item := range portWhiteList {
-		key := firewallPortWhiteListKey(item)
-		if _, ok := oldPorts[key]; ok {
-			continue
-		}
-		if err := client.Port(fireClient.FireInfo{Port: item.Port, Protocol: item.Protocol, Strategy: "accept"}, "add"); err != nil {
+	if request.Operation == "initialize" {
+		if err := newDockerPortGuardService().Operate(ctx, dto.DockerPortGuardOperation{Operation: "initialize"}); err != nil {
+			_ = settingRepo.UpdateOrCreate(constant.FirewallDockerBackendKey, previous)
 			return err
 		}
 	}
-	return client.Reload()
+	return nil
 }
 
-func firewallPortWhiteListMap(portWhiteList []firewallPortWhitelist) map[string]struct{} {
-	ports := make(map[string]struct{})
-	for _, item := range portWhiteList {
-		ports[firewallPortWhiteListKey(item)] = struct{}{}
+func dockerGuardBackendInitialized(ctx context.Context, backend string) (bool, error) {
+	guard := newDockerFirewallRuntime(ctx, backend)
+	for _, family := range []string{dockerfirewall.FamilyIPv4, dockerfirewall.FamilyIPv6} {
+		initialized, err := guard.Initialized(family)
+		if err != nil {
+			return false, err
+		}
+		if initialized {
+			return true, nil
+		}
 	}
-	return ports
-}
-
-func firewallPortWhiteListKey(item firewallPortWhitelist) string {
-	return item.Port + "/" + item.Protocol
+	return false, nil
 }

agent/app/service/forward.go

@@ -0,0 +1,290 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/forwarding"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/lifecycle"
+)
+
+type IForwardingService interface {
+	LoadBaseInfo(ctx context.Context) (dto.FirewallSubsystemStatus, error)
+	ExportBackup(context.Context, filter.Provider) (dto.FirewallSubsystemBackup, error)
+	SearchRules(ctx context.Context, request dto.ForwardRuleSearch) (int64, []dto.ForwardRule, error)
+	OperateRules(dto.ForwardRuleOperate) (dto.FilterChainOperationResponse, error)
+	Enable(ctx context.Context) error
+	QueueInitialization(dto.FirewallInitializationTask) (dto.FilterChainOperationResponse, error)
+	Restore(context.Context) error
+}
+
+type ForwardingService struct {
+	clientFactory func(context.Context) (forwarding.Adapter, error)
+}
+
+var errForwardingBackendUnavailable = errors.New("no supported forwarding backend detected")
+
+var forwardingMutationMu sync.Mutex
+
+func (s *ForwardingService) LoadBaseInfo(ctx context.Context) (dto.FirewallSubsystemStatus, error) {
+	families, err := loadFirewallFamilies()
+	if err != nil {
+		return dto.FirewallSubsystemStatus{}, err
+	}
+	selected, _ := settingRepo.GetValueByKey(constant.FirewallForwardingBackendKey)
+	selected = strings.TrimSpace(selected)
+	if selected == "" {
+		selected = constant.FirewallProviderIptables
+	}
+	baseInfo := dto.FirewallSubsystemStatus{
+		Version: "-", Name: selected, Backend: selected, IPv6Enabled: len(families) > 1,
+	}
+	if selected == constant.FirewallProviderIptables || selected == constant.FirewallProviderNftables {
+		baseInfo.Name += "-forward"
+	}
+	manager, err := s.clientFactory(ctx)
+	if err != nil {
+		if errors.Is(err, errForwardingBackendUnavailable) {
+			baseInfo.Reason = constant.FirewallBackendNotInstalled
+			return baseInfo, nil
+		}
+		return baseInfo, err
+	}
+	client, err := lifecycle.NewClient(manager.Name())
+	if err != nil {
+		return baseInfo, err
+	}
+	version, versionErr := client.Version()
+	status, statusErr := loadForwardingFirewallOverview(manager, families)
+	if err := errors.Join(versionErr, statusErr); err != nil {
+		return baseInfo, err
+	}
+	baseInfo.IsExist = true
+	baseInfo.Name, baseInfo.Backend = manager.Name(), manager.Name()
+	if baseInfo.Backend == constant.FirewallProviderIptables || baseInfo.Backend == constant.FirewallProviderNftables {
+		baseInfo.Name += "-forward"
+	}
+	baseInfo.Version = version
+	baseInfo.PingStatus = firewall.LoadPingStatus()
+	baseInfo.IsInit, baseInfo.IsBind = status.IsInit, status.IsBind
+	baseInfo.IPv4, baseInfo.IPv6 = status.IPv4, status.IPv6
+	return baseInfo, nil
+}
+
+func (s *ForwardingService) ExportBackup(ctx context.Context, provider filter.Provider) (dto.FirewallSubsystemBackup, error) {
+	var manager forwarding.Adapter
+	var err error
+	if provider == "" {
+		manager, err = s.clientFactory(ctx)
+	} else {
+		manager, err = newForwardingAdapterFor(ctx, string(provider))
+	}
+	if err != nil {
+		return dto.FirewallSubsystemBackup{}, err
+	}
+	rules, err := manager.List()
+	if err != nil {
+		return dto.FirewallSubsystemBackup{}, err
+	}
+	return forwardingBackup(manager, rules)
+}
+
+func (s *ForwardingService) SearchRules(ctx context.Context, request dto.ForwardRuleSearch) (int64, []dto.ForwardRule, error) {
+	manager, err := s.clientFactory(ctx)
+	if err != nil {
+		return 0, nil, err
+	}
+	rules, err := manager.List()
+	if err != nil {
+		return 0, nil, err
+	}
+	items := make([]dto.ForwardRule, 0, len(rules))
+	keyword := strings.ToLower(strings.TrimSpace(request.Info))
+	for _, rule := range rules {
+		if keyword != "" && !strings.Contains(strings.ToLower(strings.Join([]string{rule.Family, rule.Protocol, rule.Port, rule.TargetIP, rule.TargetPort, rule.Interface}, " ")), keyword) {
+			continue
+		}
+		items = append(items, dto.ForwardRule{Num: strconv.Itoa(len(items) + 1), Family: rule.Family, Protocol: rule.Protocol, Port: rule.Port, TargetIP: rule.TargetIP, TargetPort: rule.TargetPort, Interface: rule.Interface})
+	}
+	total := len(items)
+	if request.All {
+		return int64(total), items, nil
+	}
+	start := min(max(request.Page-1, 0)*max(request.PageSize, 1), total)
+	end := min(start+max(request.PageSize, 1), total)
+	return int64(total), items[start:end], nil
+}
+
+func (s *ForwardingService) OperateRules(request dto.ForwardRuleOperate) (dto.FilterChainOperationResponse, error) {
+	count := 0
+	for _, rule := range request.Rules {
+		if rule.Operation == "add" {
+			count += strings.Count(rule.Protocol, "/") + 1
+		}
+		if count > filter.MaxAtomicExpansion {
+			return dto.FilterChainOperationResponse{}, fmt.Errorf("create or import at most %d rules per batch (after expansion)", filter.MaxAtomicExpansion)
+		}
+	}
+	operation := task.TaskCreate
+	for _, rule := range request.Rules {
+		if rule.Operation != "add" {
+			operation = task.TaskUpdate
+		}
+	}
+	if forwardingOperationsOnlyRemove(request.Rules) {
+		operation = task.TaskDelete
+	}
+	taskItem, err := task.NewTask(firewallTaskName(operation, firewallTaskForwarding, ""), operation, task.TaskScopeFirewall, "", 0)
+	if err != nil {
+		return dto.FilterChainOperationResponse{}, err
+	}
+	taskItem.AddSubTaskWithOps(taskItem.Name, func(t *task.Task) error {
+		return s.operateRules(t.TaskCtx, request, t, false)
+	}, nil, 0, 0)
+	if err := taskRepo.Save(context.Background(), taskItem.Task); err != nil {
+		taskItem.LogFailedWithErr(taskItem.Name, err)
+		closeUnstartedFirewallTask(taskItem)
+		return dto.FilterChainOperationResponse{}, err
+	}
+	go func() { _ = taskItem.Execute() }()
+	return dto.FilterChainOperationResponse{TaskID: taskItem.TaskID, Queued: true}, nil
+}
+
+func (s *ForwardingService) Enable(ctx context.Context) error {
+	forwardingMutationMu.Lock()
+	defer forwardingMutationMu.Unlock()
+	manager, err := s.clientFactory(ctx)
+	if err != nil {
+		return err
+	}
+	rules, err := manager.List()
+	if err != nil {
+		return err
+	}
+	families, err := loadFirewallFamilies()
+	if err != nil {
+		return err
+	}
+	if err := initializeForwarding(manager, families); err != nil {
+		return err
+	}
+	return persistForwardingRules(manager, rules)
+}
+
+func (s *ForwardingService) QueueInitialization(request dto.FirewallInitializationTask) (dto.FilterChainOperationResponse, error) {
+	if err := task.CheckScopeTaskIsExecuting(task.TaskScopeFirewall, 0); err != nil {
+		return dto.FilterChainOperationResponse{}, err
+	}
+	var backup dto.FirewallSubsystemBackup
+	if request.BackupFile != "" {
+		var err error
+		backup, err = readFirewallSubsystemBackup(request.BackupFile, "forwarding")
+		if err != nil {
+			return dto.FilterChainOperationResponse{}, err
+		}
+	}
+	operations := dto.ForwardRuleOperate{Rules: make([]dto.ForwardRuleOperation, 0, len(backup.Forwarding))}
+	for _, rule := range backup.Forwarding {
+		operations.Rules = append(operations.Rules, dto.ForwardRuleOperation{Operation: "add", Family: rule.Family, Protocol: rule.Protocol, Port: rule.Port, TargetIP: rule.TargetIP, TargetPort: rule.TargetPort, Interface: rule.Interface})
+	}
+	return queueFirewallRuleTask(firewallTaskForwarding, task.TaskExec, request.TaskID, nil, func(t *task.Task) error {
+		return s.operateRules(t.TaskCtx, operations, t, true, backup.Families...)
+	})
+}
+
+func (s *ForwardingService) Restore(ctx context.Context) error {
+	forwardingMutationMu.Lock()
+	defer forwardingMutationMu.Unlock()
+	status, err := settingRepo.GetValueByKey(constant.FirewallForwardingInitializedKey)
+	if err != nil || status != constant.StatusEnable {
+		return err
+	}
+	manager, err := s.clientFactory(ctx)
+	if err != nil {
+		return err
+	}
+	backup, err := readFirewallSubsystemBackup("forwarding-"+manager.Name()+".rules", "forwarding")
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	families, err := loadFirewallFamilies()
+	if err != nil {
+		return err
+	}
+	if !slices.Contains(families, constant.FirewallFamilyIPv6) {
+		before := len(backup.Forwarding)
+		backup.Forwarding = slices.DeleteFunc(backup.Forwarding, func(rule forwarding.Rule) bool { return rule.Family == constant.FirewallFamilyIPv6 })
+		logFirewallIPv6Skipped(nil, "forwarding startup", before-len(backup.Forwarding))
+	}
+	missing := make(map[string]bool)
+	needsBind := false
+	for _, family := range families {
+		initialized, bound, err := manager.FamilyStatus(family)
+		if err != nil {
+			return err
+		}
+		missing[family] = !initialized
+		needsBind = needsBind || (initialized && !bound)
+	}
+	restoreIPv6 := slices.Contains(backup.Families, forwarding.FamilyIPv6)
+	for _, rule := range backup.Forwarding {
+		restoreIPv6 = restoreIPv6 || rule.Family == forwarding.FamilyIPv6
+	}
+	if !missing[forwarding.FamilyIPv4] && (!missing[forwarding.FamilyIPv6] || !restoreIPv6) && !needsBind {
+		return nil
+	}
+	current, err := manager.List()
+	if err != nil {
+		return err
+	}
+	seen := make(map[string]int, len(current))
+	for _, rule := range current {
+		seen[rule.Identity()]++
+	}
+	for _, family := range families {
+		if family == forwarding.FamilyIPv6 && missing[family] && !restoreIPv6 {
+			continue
+		}
+		if err := manager.OperateFamily(family, missing[family]); err != nil {
+			return err
+		}
+	}
+	for _, family := range families {
+		if !missing[family] {
+			continue
+		}
+		rules := make([]forwarding.Rule, 0)
+		for _, rule := range backup.Forwarding {
+			if rule.Family != family {
+				continue
+			}
+			if seen[rule.Identity()] > 0 {
+				seen[rule.Identity()]--
+				continue
+			}
+			rules = append(rules, rule)
+		}
+		if err := manager.CreateRules(ctx, rules); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func NewIForwardingService() IForwardingService {
+	return newForwardingService()
+}

agent/app/service/forwarding.go

@@ -1,235 +0,0 @@
-package service
-
-import (
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-
-	"github.com/1Panel-dev/1Panel/agent/app/dto"
-	"github.com/1Panel-dev/1Panel/agent/buserr"
-	"github.com/1Panel-dev/1Panel/agent/constant"
-	"github.com/1Panel-dev/1Panel/agent/global"
-	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
-	forwardClient "github.com/1Panel-dev/1Panel/agent/utils/firewall/forwarding"
-)
-
-type IForwardingService interface {
-	LoadBaseInfo() (dto.FirewallBaseInfo, error)
-	SearchWithPage(search dto.ForwardRuleSearch) (int64, interface{}, error)
-	Operate(req dto.ForwardRuleOperate) error
-	Enable() error
-	Replay() error
-}
-
-type ForwardingService struct {
-	adapterFactory func() (forwardClient.Adapter, error)
-	filterFactory  func() (firewall.FilterClient, error)
-}
-
-func NewIForwardingService() IForwardingService {
-	return &ForwardingService{
-		adapterFactory: newForwardingAdapter,
-		filterFactory:  firewall.NewFirewallClient,
-	}
-}
-
-func newForwardingAdapter() (forwardClient.Adapter, error) {
-	client, err := firewall.NewFirewallClient()
-	if err != nil {
-		return nil, err
-	}
-	return forwardClient.NewAdapter(client.Name())
-}
-
-func (s *ForwardingService) LoadBaseInfo() (dto.FirewallBaseInfo, error) {
-	baseInfo := dto.FirewallBaseInfo{Version: "-", Name: "-"}
-	adapter, err := s.adapterFactory()
-	if err != nil {
-		global.LOG.Errorf("load forwarding failed, err: %v", err)
-		return baseInfo, nil
-	}
-	filter, err := s.filterFactory()
-	if err != nil {
-		global.LOG.Errorf("load firewall status failed, err: %v", err)
-		return baseInfo, nil
-	}
-	baseInfo.IsExist = true
-	baseInfo.Name = adapter.Name()
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		baseInfo.PingStatus = firewall.LoadPingStatus()
-		baseInfo.Version, _ = filter.Version()
-	}()
-	go func() {
-		defer wg.Done()
-		baseInfo.IsActive, _ = filter.Status()
-		baseInfo.IsInit, baseInfo.IsBind = adapter.InitStatus()
-	}()
-	wg.Wait()
-	return baseInfo, nil
-}
-
-func (s *ForwardingService) SearchWithPage(req dto.ForwardRuleSearch) (int64, interface{}, error) {
-	adapter, err := s.adapterFactory()
-	if err != nil {
-		return 0, nil, err
-	}
-	rules, err := adapter.List()
-	if err != nil {
-		return 0, nil, err
-	}
-	if req.Strategy != "" {
-		return 0, nil, nil
-	}
-
-	var filtered []forwardClient.Rule
-	for _, rule := range rules {
-		if req.Info != "" && !strings.Contains(rule.Port, req.Info) &&
-			!strings.Contains(rule.TargetPort, req.Info) && !strings.Contains(rule.TargetIP, req.Info) {
-			continue
-		}
-		filtered = append(filtered, rule)
-	}
-	total := len(filtered)
-	start, end := (req.Page-1)*req.PageSize, req.Page*req.PageSize
-	if start > total {
-		return int64(total), make([]dto.ForwardRule, 0), nil
-	}
-	if end > total {
-		end = total
-	}
-	pageRules := filtered[start:end]
-	var items []dto.ForwardRule
-	if pageRules != nil {
-		items = make([]dto.ForwardRule, 0, len(pageRules))
-	}
-	for _, rule := range pageRules {
-		items = append(items, dto.ForwardRule{
-			Num:        rule.Num,
-			Protocol:   rule.Protocol,
-			Port:       rule.Port,
-			TargetIP:   rule.TargetIP,
-			TargetPort: rule.TargetPort,
-			Interface:  rule.Interface,
-		})
-	}
-	return int64(total), items, nil
-}
-
-func (s *ForwardingService) Operate(req dto.ForwardRuleOperate) error {
-	adapter, err := s.adapterFactory()
-	if err != nil {
-		return err
-	}
-
-	rules, _ := adapter.List()
-	kept := rules[:0]
-	for _, rule := range rules {
-		shouldKeep := true
-		for i := range req.Rules {
-			reqRule := &req.Rules[i]
-			if reqRule.TargetIP == "" {
-				reqRule.TargetIP = "127.0.0.1"
-			}
-			if reqRule.Operation == "remove" && requestMatchesForwardRule(*reqRule, rule) {
-				shouldKeep = false
-				break
-			}
-		}
-		if shouldKeep {
-			kept = append(kept, rule)
-		}
-	}
-
-	for _, rule := range kept {
-		for _, reqRule := range req.Rules {
-			if reqRule.Operation != "remove" && requestMatchesForwardRule(reqRule, rule) {
-				return buserr.New("ErrRecordExist")
-			}
-		}
-	}
-
-	sort.SliceStable(req.Rules, func(i, j int) bool {
-		if req.Rules[i].Operation == "remove" && req.Rules[j].Operation != "remove" {
-			return true
-		}
-		if req.Rules[i].Operation != "remove" && req.Rules[j].Operation == "remove" {
-			return false
-		}
-		n1, _ := strconv.Atoi(req.Rules[i].Num)
-		n2, _ := strconv.Atoi(req.Rules[j].Num)
-		return n1 > n2
-	})
-
-	for _, rule := range req.Rules {
-		for _, protocol := range strings.Split(rule.Protocol, "/") {
-			targetIP := rule.TargetIP
-			if targetIP == "" {
-				targetIP = "127.0.0.1"
-			}
-			err := adapter.Operate(forwardClient.Rule{
-				Num:        rule.Num,
-				Protocol:   protocol,
-				Port:       rule.Port,
-				TargetIP:   targetIP,
-				TargetPort: rule.TargetPort,
-				Interface:  rule.Interface,
-			}, rule.Operation)
-			if err == nil {
-				continue
-			}
-			if req.ForceDelete {
-				global.LOG.Error(err)
-				continue
-			}
-			return err
-		}
-	}
-	return nil
-}
-
-func requestMatchesForwardRule(req dto.ForwardRuleOperation, rule forwardClient.Rule) bool {
-	for _, protocol := range strings.Split(req.Protocol, "/") {
-		if req.Port == rule.Port && req.TargetPort == rule.TargetPort && req.TargetIP == rule.TargetIP &&
-			protocol == rule.Protocol && req.Interface == rule.Interface {
-			return true
-		}
-	}
-	return false
-}
-
-func (s *ForwardingService) Enable() error {
-	adapter, err := s.adapterFactory()
-	if err != nil {
-		return err
-	}
-	if err := adapter.Enable(); err != nil {
-		return err
-	}
-	if adapter.Name() != "firewalld" {
-		_ = settingRepo.Update("IptablesForwardStatus", constant.StatusEnable)
-	}
-	return nil
-}
-
-func (s *ForwardingService) Replay() error {
-	adapter, err := s.adapterFactory()
-	if err != nil {
-		return err
-	}
-	if err := adapter.Replay(); err != nil {
-		return err
-	}
-	if adapter.Name() == "firewalld" {
-		return nil
-	}
-	status, _ := settingRepo.GetValueByKey("IptablesForwardStatus")
-	if status == constant.StatusEnable {
-		return adapter.Enable()
-	}
-	return nil
-}

agent/app/service/forwarding_contract_test.go

@@ -1,152 +0,0 @@
-package service
-
-import (
-	"encoding/json"
-	"errors"
-	"reflect"
-	"testing"
-
-	"github.com/1Panel-dev/1Panel/agent/app/dto"
-	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
-	forwardClient "github.com/1Panel-dev/1Panel/agent/utils/firewall/forwarding"
-	"github.com/go-playground/validator/v10"
-)
-
-type forwardingCall struct {
-	rule      forwardClient.Rule
-	operation string
-}
-
-type fakeForwardingAdapter struct {
-	name       string
-	rules      []forwardClient.Rule
-	listErr    error
-	operateErr error
-	calls      []forwardingCall
-}
-
-func (f *fakeForwardingAdapter) Name() string { return f.name }
-
-func (f *fakeForwardingAdapter) List() ([]forwardClient.Rule, error) {
-	return append([]forwardClient.Rule(nil), f.rules...), f.listErr
-}
-
-func (f *fakeForwardingAdapter) Operate(rule forwardClient.Rule, operation string) error {
-	f.calls = append(f.calls, forwardingCall{rule: rule, operation: operation})
-	return f.operateErr
-}
-
-func (f *fakeForwardingAdapter) Enable() error            { return nil }
-func (f *fakeForwardingAdapter) InitStatus() (bool, bool) { return true, true }
-func (f *fakeForwardingAdapter) Replay() error            { return nil }
-
-func forwardingServiceWithAdapter(adapter forwardClient.Adapter) *ForwardingService {
-	return &ForwardingService{
-		adapterFactory: func() (forwardClient.Adapter, error) { return adapter, nil },
-		filterFactory:  firewall.NewFirewallClient,
-	}
-}
-
-func TestForwardingAndFilterInterfacesAreSeparated(t *testing.T) {
-	filterType := reflect.TypeOf((*firewall.FilterClient)(nil)).Elem()
-	for _, method := range []string{"ListForward", "PortForward", "EnableForward"} {
-		if _, ok := filterType.MethodByName(method); ok {
-			t.Fatalf("filter interface still exposes %s", method)
-		}
-	}
-	firewallServiceType := reflect.TypeOf((*IFirewallService)(nil)).Elem()
-	if _, ok := firewallServiceType.MethodByName("OperateForwardRule"); ok {
-		t.Fatal("firewall service still owns forwarding writes")
-	}
-	forwardingServiceType := reflect.TypeOf((*IForwardingService)(nil)).Elem()
-	for _, method := range []string{"LoadBaseInfo", "SearchWithPage", "Operate", "Enable", "Replay"} {
-		if _, ok := forwardingServiceType.MethodByName(method); !ok {
-			t.Fatalf("forwarding service missing %s", method)
-		}
-	}
-}
-
-func TestForwardingInitRequestContract(t *testing.T) {
-	req := dto.IptablesOp{Name: "1PANEL_FORWARD", Operate: "init-forward"}
-	if err := validator.New().Struct(req); err != nil {
-		t.Fatalf("frontend forwarding initialization request must remain valid: %v", err)
-	}
-}
-
-func TestForwardingSearchPreservesAPIShapeAndPagination(t *testing.T) {
-	adapter := &fakeForwardingAdapter{name: "iptables", rules: []forwardClient.Rule{
-		{Num: "1", Protocol: "tcp", Port: "8080", TargetIP: "10.0.0.2", TargetPort: "80", Interface: "eth0"},
-		{Num: "2", Protocol: "udp", Port: "5353", TargetIP: "127.0.0.1", TargetPort: "53"},
-	}}
-	service := forwardingServiceWithAdapter(adapter)
-	total, value, err := service.SearchWithPage(dto.ForwardRuleSearch{PageInfo: dto.PageInfo{Page: 1, PageSize: 10}, Info: "10.0.0.2"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if total != 1 {
-		t.Fatalf("got total %d want 1", total)
-	}
-	items, ok := value.([]dto.ForwardRule)
-	if !ok || len(items) != 1 || items[0].Port != "8080" {
-		t.Fatalf("unexpected items: %#v", value)
-	}
-	data, err := json.Marshal(items[0])
-	if err != nil {
-		t.Fatal(err)
-	}
-	var fields map[string]interface{}
-	if err := json.Unmarshal(data, &fields); err != nil {
-		t.Fatal(err)
-	}
-	wantFields := []string{"id", "chain", "family", "address", "port", "protocol", "strategy", "num", "targetIP", "targetPort", "interface", "usedStatus", "description"}
-	for _, field := range wantFields {
-		if _, ok := fields[field]; !ok {
-			t.Fatalf("forward response dropped compatibility field %q: %s", field, data)
-		}
-	}
-}
-
-func TestForwardingOperatePreservesDuplicateAndOrderingContracts(t *testing.T) {
-	existing := &fakeForwardingAdapter{name: "ufw", rules: []forwardClient.Rule{
-		{Protocol: "tcp", Port: "8080", TargetIP: "127.0.0.1", TargetPort: "80"},
-	}}
-	service := forwardingServiceWithAdapter(existing)
-	err := service.Operate(dto.ForwardRuleOperate{Rules: []dto.ForwardRuleOperation{{
-		Operation: "add", Protocol: "tcp", Port: "8080", TargetPort: "80",
-	}}})
-	if err == nil {
-		t.Fatal("duplicate forwarding rule must be rejected")
-	}
-	if len(existing.calls) != 0 {
-		t.Fatalf("duplicate check wrote forwarding state: %#v", existing.calls)
-	}
-
-	adapter := &fakeForwardingAdapter{name: "iptables"}
-	service = forwardingServiceWithAdapter(adapter)
-	err = service.Operate(dto.ForwardRuleOperate{Rules: []dto.ForwardRuleOperation{
-		{Operation: "add", Protocol: "tcp/udp", Port: "9000", TargetIP: "10.0.0.2", TargetPort: "90"},
-		{Operation: "remove", Num: "1", Protocol: "tcp", Port: "8001", TargetIP: "10.0.0.2", TargetPort: "81"},
-		{Operation: "remove", Num: "3", Protocol: "tcp", Port: "8003", TargetIP: "10.0.0.2", TargetPort: "83"},
-	}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := []forwardingCall{
-		{operation: "remove", rule: forwardClient.Rule{Num: "3", Protocol: "tcp", Port: "8003", TargetIP: "10.0.0.2", TargetPort: "83"}},
-		{operation: "remove", rule: forwardClient.Rule{Num: "1", Protocol: "tcp", Port: "8001", TargetIP: "10.0.0.2", TargetPort: "81"}},
-		{operation: "add", rule: forwardClient.Rule{Protocol: "tcp", Port: "9000", TargetIP: "10.0.0.2", TargetPort: "90"}},
-		{operation: "add", rule: forwardClient.Rule{Protocol: "udp", Port: "9000", TargetIP: "10.0.0.2", TargetPort: "90"}},
-	}
-	if !reflect.DeepEqual(adapter.calls, want) {
-		t.Fatalf("operation order changed\ngot  %#v\nwant %#v", adapter.calls, want)
-	}
-}
-
-func TestForwardingSearchReturnsAdapterError(t *testing.T) {
-	wantErr := errors.New("list failed")
-	service := forwardingServiceWithAdapter(&fakeForwardingAdapter{name: "firewalld", listErr: wantErr})
-	_, _, err := service.SearchWithPage(dto.ForwardRuleSearch{PageInfo: dto.PageInfo{Page: 1, PageSize: 20}})
-	if !errors.Is(err, wantErr) {
-		t.Fatalf("got %v want %v", err, wantErr)
-	}
-}

agent/app/service/image.go

@@ -28,8 +28,7 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/registry"
-	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/homedir"
+	"github.com/moby/go-archive"
 )
 
 type ImageService struct{}
@@ -278,38 +277,37 @@ func (u *ImageService) ImagePull(req dto.ImagePull) error {
 		itemName := strings.ReplaceAll(path.Base(item), ":", "_")
 		taskItem.AddSubTask(i18n.GetWithName("ImagePull", itemName), func(t *task.Task) error {
 			taskItem.Logf("----------------- %s -----------------", itemName)
+			if req.RepoID == 0 {
+				pullErr := pullImages(taskItem, client, item)
+				taskItem.LogWithStatus(i18n.GetMsgByKey("TaskPull"), pullErr)
+				return pullErr
+			}
+
 			options := image.PullOptions{}
 			imageName := item
-			if req.RepoID == 0 {
-				hasAuth, authStr := loadAuthInfo(item)
-				if hasAuth {
-					options.RegistryAuth = authStr
+			repo, repoErr := imageRepoRepo.Get(repo.WithByID(req.RepoID))
+			taskItem.LogWithStatus(i18n.GetMsgByKey("ImageRepoAuthFromDB"), repoErr)
+			if repoErr != nil {
+				return repoErr
+			}
+			if repo.Auth {
+				authConfig := registry.AuthConfig{
+					Username: repo.Username,
+					Password: repo.Password,
 				}
-			} else {
-				repo, err := imageRepoRepo.Get(repo.WithByID(req.RepoID))
-				taskItem.LogWithStatus(i18n.GetMsgByKey("ImageRepoAuthFromDB"), err)
+				encodedJSON, err := json.Marshal(authConfig)
 				if err != nil {
 					return err
 				}
-				if repo.Auth {
-					authConfig := registry.AuthConfig{
-						Username: repo.Username,
-						Password: repo.Password,
-					}
-					encodedJSON, err := json.Marshal(authConfig)
-					if err != nil {
-						return err
-					}
-					authStr := base64.URLEncoding.EncodeToString(encodedJSON)
-					options.RegistryAuth = authStr
-				}
-				imageName = repo.DownloadUrl + "/" + item
+				authStr := base64.URLEncoding.EncodeToString(encodedJSON)
+				options.RegistryAuth = authStr
 			}
+			imageName = repo.DownloadUrl + "/" + item
 			dockerCli := docker.NewClientWithExist(client)
-			err = dockerCli.PullImageWithProcessAndOptions(taskItem, imageName, options)
-			taskItem.LogWithStatus(i18n.GetMsgByKey("TaskPull"), err)
-			if err != nil {
-				return err
+			pullErr := dockerCli.PullImageWithProcessAndOptions(taskItem, imageName, options)
+			taskItem.LogWithStatus(i18n.GetMsgByKey("TaskPull"), pullErr)
+			if pullErr != nil {
+				return pullErr
 			}
 			return nil
 		}, nil)
@@ -547,49 +545,3 @@ func checkUsed(imageID string, containers []container.Summary) bool {
 	}
 	return false
 }
-
-func loadAuthInfo(image string) (bool, string) {
-	if !strings.Contains(image, "/") {
-		return false, ""
-	}
-	homeDir := homedir.Get()
-	confPath := path.Join(homeDir, ".docker/config.json")
-	configFileBytes, err := os.ReadFile(confPath)
-	if err != nil {
-		return false, ""
-	}
-	var config dockerConfig
-	if err = json.Unmarshal(configFileBytes, &config); err != nil {
-		return false, ""
-	}
-	var (
-		user   string
-		passwd string
-	)
-	imagePrefix := strings.Split(image, "/")[0]
-	if val, ok := config.Auths[imagePrefix]; ok {
-		itemByte, _ := base64.StdEncoding.DecodeString(val.Auth)
-		itemStr := string(itemByte)
-		if strings.Contains(itemStr, ":") {
-			user = strings.Split(itemStr, ":")[0]
-			passwd = strings.Split(itemStr, ":")[1]
-		}
-	}
-	authConfig := registry.AuthConfig{
-		Username: user,
-		Password: passwd,
-	}
-	encodedJSON, err := json.Marshal(authConfig)
-	if err != nil {
-		return false, ""
-	}
-	authStr := base64.URLEncoding.EncodeToString(encodedJSON)
-	return true, authStr
-}
-
-type dockerConfig struct {
-	Auths map[string]authConfig `json:"auths"`
-}
-type authConfig struct {
-	Auth string `json:"auth"`
-}

agent/app/service/iptables.go

@@ -1,506 +0,0 @@
-package service
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"strings"
-
-	"github.com/1Panel-dev/1Panel/agent/app/dto"
-	"github.com/1Panel-dev/1Panel/agent/app/model"
-	"github.com/1Panel-dev/1Panel/agent/constant"
-	"github.com/1Panel-dev/1Panel/agent/global"
-	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
-	"github.com/1Panel-dev/1Panel/agent/utils/firewall/client/iptables"
-)
-
-type IIptablesService interface {
-	Search(req dto.SearchPageWithType) (int64, interface{}, error)
-	OperateRule(req dto.IptablesRuleOp, withSave bool) error
-	BatchOperate(req dto.IptablesBatchOperate) error
-	LoadChainStatus(req dto.OperationWithName) dto.IptablesChainStatus
-
-	Operate(req dto.IptablesOp) error
-}
-
-type IptablesService struct{}
-
-func NewIIptablesService() IIptablesService {
-	return &IptablesService{}
-}
-
-func (s *IptablesService) Search(req dto.SearchPageWithType) (int64, interface{}, error) {
-	rules, err := iptables.ReadFilterRulesByChain(req.Type)
-	if err != nil {
-		return 0, nil, fmt.Errorf("failed to read iptables rules: %w", err)
-	}
-	var records []iptables.FilterRules
-	total, start, end := len(rules), (req.Page-1)*req.PageSize, req.Page*req.PageSize
-	if start > total {
-		records = make([]iptables.FilterRules, 0)
-	} else {
-		if end >= total {
-			end = total
-		}
-		records = rules[start:end]
-	}
-
-	rulesInDB, _ := hostRepo.ListFirewallRecord(hostRepo.WithByChain(req.Type))
-
-	for i := 0; i < len(records); i++ {
-		for _, item := range rulesInDB {
-			if records[i].Strategy == item.Strategy &&
-				records[i].DstIP == item.DstIP &&
-				fmt.Sprintf("%v", records[i].DstPort) == item.DstPort &&
-				records[i].Protocol == item.Protocol &&
-				records[i].SrcIP == item.SrcIP &&
-				fmt.Sprintf("%v", records[i].SrcPort) == item.SrcPort {
-				records[i].ID = item.ID
-				records[i].Description = item.Description
-			}
-		}
-	}
-	return int64(total), records, nil
-}
-
-func (s *IptablesService) OperateRule(req dto.IptablesRuleOp, withSave bool) error {
-	action := "ACCEPT"
-	if req.Strategy == "drop" {
-		action = "DROP"
-	}
-	policy := iptables.FilterRules{
-		Protocol: req.Protocol,
-		SrcIP:    req.SrcIP,
-		DstIP:    req.DstIP,
-		Strategy: action,
-	}
-	if req.SrcPort != 0 {
-		policy.SrcPort = fmt.Sprintf("%v", req.SrcPort)
-	}
-	if req.DstPort != 0 {
-		policy.DstPort = fmt.Sprintf("%v", req.DstPort)
-	}
-
-	name := iptables.InputFileName
-	if req.Chain == iptables.Chain1PanelOutput {
-		name = iptables.OutputFileName
-	}
-	switch req.Operation {
-	case "add":
-		if err := s.validateRuleInput(&req); err != nil {
-			return err
-		}
-
-		if err := iptables.AddFilterRule(req.Chain, policy); err != nil {
-			return fmt.Errorf("failed to add iptables rule: %w", err)
-		}
-
-		if len(req.Description) != 0 {
-			rule := &model.Firewall{
-				Chain:       req.Chain,
-				Protocol:    req.Protocol,
-				SrcIP:       req.SrcIP,
-				SrcPort:     policy.SrcPort,
-				DstIP:       req.DstIP,
-				DstPort:     policy.DstPort,
-				Strategy:    req.Strategy,
-				Description: req.Description,
-			}
-
-			if err := hostRepo.SaveFirewallRecord(rule); err != nil {
-				return fmt.Errorf("failed to save rule to database: %w", err)
-			}
-		}
-	case "remove":
-		if err := iptables.DeleteFilterRule(req.Chain, policy); err != nil {
-			return fmt.Errorf("failed to remove iptables rule: %w", err)
-		}
-		if req.ID != 0 {
-			if err := hostRepo.DeleteFirewallRecordByID(req.ID); err != nil {
-				return fmt.Errorf("failed to delete rule from database: %w", err)
-			}
-		}
-	}
-
-	if !withSave {
-		return nil
-	}
-	if err := iptables.SaveRulesToFile(iptables.FilterTab, req.Chain, name); err != nil {
-		global.LOG.Errorf("persistence for %s failed, err: %v", iptables.Chain1PanelBasic, err)
-	}
-	return nil
-}
-
-func (s *IptablesService) BatchOperate(req dto.IptablesBatchOperate) error {
-	if len(req.Rules) == 0 {
-		return errors.New("no rules to operate")
-	}
-	for _, rule := range req.Rules {
-		if err := s.OperateRule(rule, false); err != nil {
-			return err
-		}
-	}
-	chain := iptables.Chain1PanelInput
-	fileName := iptables.InputFileName
-	if req.Rules[0].Chain == iptables.Chain1PanelOutput {
-		chain = iptables.Chain1PanelOutput
-		fileName = iptables.OutputFileName
-	}
-	if err := iptables.SaveRulesToFile(iptables.FilterTab, chain, fileName); err != nil {
-		global.LOG.Errorf("persistence for %s failed, err: %v", iptables.Chain1PanelBasic, err)
-	}
-	return nil
-}
-
-func (s *IptablesService) Operate(req dto.IptablesOp) error {
-	targetChain := iptables.ChainInput
-	if req.Name == iptables.Chain1PanelOutput {
-		targetChain = iptables.ChainOutput
-	}
-	switch req.Operate {
-	case "init-base":
-		if ok := cmd.Which("iptables"); !ok {
-			return fmt.Errorf("failed to find iptables")
-		}
-		if err := iptables.AddChain(iptables.FilterTab, iptables.Chain1PanelBasicBefore); err != nil {
-			return err
-		}
-		if err := iptables.AddChain(iptables.FilterTab, iptables.Chain1PanelBasic); err != nil {
-			return err
-		}
-		if err := iptables.AddChain(iptables.FilterTab, iptables.Chain1PanelBasicAfter); err != nil {
-			return err
-		}
-		if err := initPreRules(); err != nil {
-			return err
-		}
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicBefore, 1); err != nil {
-			return err
-		}
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasic, 2); err != nil {
-			return err
-		}
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter, 3); err != nil {
-			return err
-		}
-		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
-			return err
-		}
-		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
-			return err
-		}
-		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
-			return err
-		}
-		_ = settingRepo.Update("IptablesStatus", constant.StatusEnable)
-		return nil
-	case "init-advance":
-		if err := iptables.AddChain(iptables.FilterTab, iptables.Chain1PanelInput); err != nil {
-			return err
-		}
-		if err := iptables.AddChain(iptables.FilterTab, iptables.Chain1PanelOutput); err != nil {
-			return err
-		}
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainOutput, iptables.Chain1PanelOutput, 1); err != nil {
-			return err
-		}
-		number := loadBindNumber(iptables.Chain1PanelInput)
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelInput, number); err != nil {
-			return err
-		}
-		_ = settingRepo.Update("IptablesInputStatus", constant.StatusEnable)
-		_ = settingRepo.Update("IptablesOutputStatus", constant.StatusEnable)
-		return nil
-	case "bind-base":
-		if err := initPreRules(); err != nil {
-			return err
-		}
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicBefore, 1); err != nil {
-			return err
-		}
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasic, 2); err != nil {
-			return err
-		}
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter, 3); err != nil {
-			return err
-		}
-		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
-			return err
-		}
-		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
-			return err
-		}
-		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
-			return err
-		}
-		_ = settingRepo.Update("IptablesStatus", constant.StatusEnable)
-		return nil
-	case "bind-base-without-init":
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicBefore, 1); err != nil {
-			return err
-		}
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasic, 2); err != nil {
-			return err
-		}
-		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter, 3); err != nil {
-			return err
-		}
-		_ = settingRepo.Update("IptablesStatus", constant.StatusEnable)
-		return nil
-	case "unbind-base":
-		if err := iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter); err != nil {
-			return err
-		}
-		if err := iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicBefore); err != nil {
-			return err
-		}
-		if err := iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasic); err != nil {
-			return err
-		}
-		_ = settingRepo.Update("IptablesStatus", constant.StatusDisable)
-		return nil
-	case "bind":
-		if err := iptables.BindChain(iptables.FilterTab, targetChain, req.Name, loadBindNumber(req.Name)); err != nil {
-			return err
-		}
-		if req.Name == iptables.Chain1PanelInput {
-			_ = settingRepo.Update("IptablesInputStatus", constant.StatusEnable)
-		}
-		if req.Name == iptables.Chain1PanelOutput {
-			_ = settingRepo.Update("IptablesOutputStatus", constant.StatusEnable)
-		}
-		return nil
-	case "unbind":
-		if err := iptables.UnbindChain(iptables.FilterTab, targetChain, req.Name); err != nil {
-			return err
-		}
-		if req.Name == iptables.Chain1PanelInput {
-			_ = settingRepo.Update("IptablesInputStatus", constant.StatusDisable)
-		}
-		if req.Name == iptables.Chain1PanelOutput {
-			_ = settingRepo.Update("IptablesOutputStatus", constant.StatusDisable)
-		}
-		return nil
-	}
-	return nil
-}
-
-func (s *IptablesService) LoadChainStatus(req dto.OperationWithName) dto.IptablesChainStatus {
-	var data dto.IptablesChainStatus
-	var err error
-	data.DefaultStrategy, err = iptables.LoadDefaultStrategy(req.Name)
-	if err != nil {
-		global.LOG.Error(err)
-	}
-	switch req.Name {
-	case iptables.Chain1PanelBasic:
-		data.IsBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
-	case iptables.Chain1PanelInput:
-		data.IsBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, req.Name)
-	case iptables.Chain1PanelOutput:
-		data.IsBind, _ = iptables.CheckChainBind(iptables.FilterTab, iptables.ChainOutput, req.Name)
-	}
-	return data
-}
-
-func (s *IptablesService) validateRuleInput(req *dto.IptablesRuleOp) error {
-	if req.Protocol != "" {
-		validProtocols := map[string]bool{"tcp": true, "udp": true, "icmp": true, "all": true}
-		if !validProtocols[strings.ToLower(req.Protocol)] {
-			return fmt.Errorf("invalid protocol: %s, must be tcp, udp, icmp or all", req.Protocol)
-		}
-	}
-	if req.SrcIP != "" {
-		if err := s.validateIPOrCIDR(req.SrcIP); err != nil {
-			return fmt.Errorf("invalid source IP: %w", err)
-		}
-	}
-	if req.DstIP != "" {
-		if err := s.validateIPOrCIDR(req.DstIP); err != nil {
-			return fmt.Errorf("invalid destination IP: %w", err)
-		}
-	}
-	if req.SrcPort > 65535 {
-		return fmt.Errorf("invalid source port: %d, must be between 1 and 65535", req.SrcPort)
-	}
-	if req.DstPort > 65535 {
-		return fmt.Errorf("invalid destination port: %d, must be between 1 and 65535", req.DstPort)
-	}
-	if (req.SrcPort > 0 || req.DstPort > 0) && req.Protocol == "" {
-		return fmt.Errorf("port specification requires protocol (tcp/udp)")
-	}
-
-	return nil
-}
-
-func (s *IptablesService) validateIPOrCIDR(ipStr string) error {
-	if strings.Contains(ipStr, "/") {
-		_, _, err := net.ParseCIDR(ipStr)
-		if err != nil {
-			return fmt.Errorf("invalid CIDR format: %w", err)
-		}
-		return nil
-	}
-	ip := net.ParseIP(ipStr)
-	if ip == nil {
-		return fmt.Errorf("invalid IP address format")
-	}
-
-	return nil
-}
-
-func loadBindNumber(chain string) int {
-	if chain == iptables.Chain1PanelOutput {
-		return 1
-	}
-	number := 1
-	if exist, _ := iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelBasicBefore); exist {
-		number++
-	}
-	if exist, _ := iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelBasic); exist {
-		number++
-	}
-	return number
-}
-
-func initPreRules() error {
-	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicBefore, "-i", "lo", "-j", "ACCEPT", "-m", "comment", "--comment", "Loopback Whitelist"); err != nil {
-		return err
-	}
-	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicBefore, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT", "-m", "comment", "--comment", "ESTABLISHED Whitelist"); err != nil {
-		return err
-	}
-	if err := syncIptablesFirewallPortWhiteList(false); err != nil {
-		return err
-	}
-	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, "-p", "tcp", "-j", "DROP"); err != nil {
-		return err
-	}
-	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, "-p", "udp", "-j", "DROP"); err != nil {
-		return err
-	}
-	return nil
-}
-
-func syncIptablesFirewallPortWhiteList(withSave bool, oldConfiguredPortWhiteList ...[]firewallPortWhitelist) error {
-	requiredPorts, err := loadRequiredFirewallPortWhiteList()
-	if err != nil {
-		return err
-	}
-	if err := applyRequiredFirewallPortWhiteListRules(requiredPorts, withSave); err != nil {
-		return err
-	}
-	portWhiteList, err := loadConfiguredFirewallPortWhiteList()
-	if err != nil {
-		return err
-	}
-	return applyFirewallPortWhiteListRules(portWhiteList, withSave, oldConfiguredPortWhiteList...)
-}
-
-func applyRequiredFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, withSave bool) error {
-	if err := syncRequiredFirewallPortWhiteListRules(portWhiteList); err != nil {
-		return err
-	}
-	for _, item := range portWhiteList {
-		if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicBefore, "-p", item.Protocol, "-m", item.Protocol, "--dport", item.Port, "-j", "ACCEPT"); err != nil {
-			return err
-		}
-	}
-	if !withSave {
-		return nil
-	}
-	if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
-		return err
-	}
-	return iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName)
-}
-
-func applyFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, withSave bool, oldConfiguredPortWhiteList ...[]firewallPortWhitelist) error {
-	if err := syncFirewallPortWhiteListRules(portWhiteList, oldConfiguredPortWhiteList...); err != nil {
-		return err
-	}
-	for _, item := range portWhiteList {
-		if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasic, "-p", item.Protocol, "-m", item.Protocol, "--dport", item.Port, "-j", "ACCEPT"); err != nil {
-			return err
-		}
-	}
-	if !withSave {
-		return nil
-	}
-	return iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName)
-}
-
-func syncRequiredFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist) error {
-	tcpWhitelist := make(map[string]struct{})
-	udpWhitelist := make(map[string]struct{})
-	for _, item := range portWhiteList {
-		if item.Protocol == "udp" {
-			udpWhitelist[item.Port] = struct{}{}
-			continue
-		}
-		tcpWhitelist[item.Port] = struct{}{}
-	}
-
-	if err := cleanExtraFirewallPortRules(iptables.Chain1PanelBasicBefore, "tcp", tcpWhitelist); err != nil {
-		return err
-	}
-	if err := cleanExtraFirewallPortRules(iptables.Chain1PanelBasicBefore, "udp", udpWhitelist); err != nil {
-		return err
-	}
-	return cleanExtraFirewallPortRules(iptables.Chain1PanelBasicAfter, "udp", map[string]struct{}{})
-}
-
-func syncFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, oldConfiguredPortWhiteList ...[]firewallPortWhitelist) error {
-	portWhitelist := firewallPortWhiteListMap(portWhiteList)
-	if len(oldConfiguredPortWhiteList) == 0 {
-		return nil
-	}
-	for _, item := range oldConfiguredPortWhiteList[0] {
-		if _, ok := portWhitelist[firewallPortWhiteListKey(item)]; ok {
-			continue
-		}
-		if !iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasic, "-p", item.Protocol, "--dport", item.Port, "-j", "ACCEPT") {
-			continue
-		}
-		if err := iptables.DeleteRule(iptables.FilterTab, iptables.Chain1PanelBasic, "-p", item.Protocol, "--dport", item.Port, "-j", "ACCEPT"); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func cleanExtraFirewallPortRules(chain, protocol string, whitelist map[string]struct{}) error {
-	rules, err := iptables.ReadFilterRulesByChain(chain)
-	if err != nil {
-		return err
-	}
-	kept := make(map[string]struct{})
-	for _, rule := range rules {
-		if rule.Strategy != "accept" || rule.Protocol != protocol || rule.DstPort == "" || rule.SrcIP != "" || rule.DstIP != "" || rule.SrcPort != "" {
-			continue
-		}
-		if _, ok := whitelist[rule.DstPort]; ok {
-			if _, seen := kept[rule.DstPort]; !seen {
-				kept[rule.DstPort] = struct{}{}
-				continue
-			}
-		}
-		if err := iptables.DeleteRule(iptables.FilterTab, chain, "-p", protocol, "-m", protocol, "--dport", rule.DstPort, "-j", "ACCEPT"); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func LoadPanelPort() string {
-	if !global.IsMaster {
-		return global.CONF.Base.Port
-	} else {
-		var portSetting model.Setting
-		_ = global.CoreDB.Where("key = ?", "ServerPort").First(&portSetting).Error
-		if len(portSetting.Value) != 0 {
-			return portSetting.Value
-		}
-	}
-	return ""
-}

agent/app/service/monitor.go

@@ -8,7 +8,6 @@ import (
 	"path/filepath"
 	"sort"
 	"strconv"
-	"strings"
 	"sync"
 	"time"
 
@@ -19,8 +18,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/global"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/gpu"
-	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/xpu"
+	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/accelerator"
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/psutil"
 	"github.com/robfig/cron/v3"
@@ -35,11 +33,14 @@ import (
 type MonitorService struct {
 	DiskIO chan ([]disk.IOCountersStat)
 	NetIO  chan ([]net.IOCountersStat)
+	ctx    context.Context
 }
 
 var (
-	monitorCancel context.CancelFunc
-	hostSysPath   = loadHostSysPath()
+	monitorSettingMutex sync.Mutex
+	gpuMonitorMutex     sync.Mutex
+	monitorCancel       context.CancelFunc
+	hostSysPath         = loadHostSysPath()
 
 	blockDevicePartitionCache sync.Map
 )
@@ -49,8 +50,13 @@ type IMonitorService interface {
 	LoadMonitorData(req dto.MonitorSearch) ([]dto.MonitorData, error)
 	LoadSetting() (*dto.MonitorSetting, error)
 	UpdateSetting(key, value string) error
-	CleanData() error
+	CleanData(monitorType string) error
 
+	LoadIOOptions() []string
+	LoadNetworkOptions() []string
+	LoadVLLMMonitorData(req dto.MonitorVLLMSearch) (dto.MonitorVLLMData, error)
+	LoadVLLMCurrent(ctx context.Context, req dto.MonitorVLLMCurrent) (model.MonitorVLLM, error)
+	CleanVLLMMonitor(req dto.MonitorVLLMClean) error
 	LoadGPUOptions() dto.MonitorGPUOptions
 	LoadGPUMonitorData(req dto.MonitorGPUSearch) (dto.MonitorGPUData, error)
 
@@ -62,6 +68,7 @@ func NewIMonitorService() IMonitorService {
 	return &MonitorService{
 		DiskIO: make(chan []disk.IOCountersStat, 2),
 		NetIO:  make(chan []net.IOCountersStat, 2),
+		ctx:    context.Background(),
 	}
 }
 
@@ -87,7 +94,7 @@ func (m *MonitorService) LoadMonitorData(req dto.MonitorSearch) ([]dto.MonitorDa
 				base.TopCPUItems = processes
 				base.TopCPU = ""
 			}
-			if req.Param == "all" || req.Param == "mem" {
+			if req.Param == "all" || req.Param == "memory" {
 				var processes []dto.Process
 				_ = json.Unmarshal([]byte(base.TopMem), &processes)
 				base.TopMemItems = processes
@@ -98,7 +105,11 @@ func (m *MonitorService) LoadMonitorData(req dto.MonitorSearch) ([]dto.MonitorDa
 		data = append(data, itemData)
 	}
 	if req.Param == "all" || req.Param == "io" {
-		bases, err := monitorRepo.GetIO(repo.WithByName(req.IO), repo.WithByCreatedAt(req.StartTime, req.EndTime))
+		ioOpts := []repo.DBOption{repo.WithByCreatedAt(req.StartTime, req.EndTime)}
+		if len(req.IO) != 0 {
+			ioOpts = append(ioOpts, repo.WithByName(req.IO))
+		}
+		bases, err := monitorRepo.GetIO(ioOpts...)
 		if err != nil {
 			return nil, err
 		}
@@ -112,7 +123,11 @@ func (m *MonitorService) LoadMonitorData(req dto.MonitorSearch) ([]dto.MonitorDa
 		data = append(data, itemData)
 	}
 	if req.Param == "all" || req.Param == "network" {
-		bases, err := monitorRepo.GetNetwork(repo.WithByName(req.Network), repo.WithByCreatedAt(req.StartTime, req.EndTime))
+		netOpts := []repo.DBOption{repo.WithByCreatedAt(req.StartTime, req.EndTime)}
+		if len(req.Network) != 0 {
+			netOpts = append(netOpts, repo.WithByName(req.Network))
+		}
+		bases, err := monitorRepo.GetNetwork(netOpts...)
 		if err != nil {
 			return nil, err
 		}
@@ -128,105 +143,171 @@ func (m *MonitorService) LoadMonitorData(req dto.MonitorSearch) ([]dto.MonitorDa
 	return data, nil
 }
 
+func (m *MonitorService) LoadIOOptions() []string {
+	optionSet := make(map[string]struct{})
+	if diskStat, err := disk.IOCounters(); err == nil {
+		for _, item := range diskStat {
+			optionSet[item.Name] = struct{}{}
+		}
+	}
+	// union with names recorded in the monitor db so removed devices stay selectable
+	if names, err := monitorRepo.GetIONames(); err == nil {
+		for _, name := range names {
+			optionSet[name] = struct{}{}
+		}
+	}
+	return sortedMonitorOptions(optionSet)
+}
+
+func (m *MonitorService) LoadNetworkOptions() []string {
+	optionSet := make(map[string]struct{})
+	if netStat, err := net.IOCounters(true); err == nil {
+		for _, item := range netStat {
+			optionSet[item.Name] = struct{}{}
+		}
+	}
+	if names, err := monitorRepo.GetNetworkNames(); err == nil {
+		for _, name := range names {
+			optionSet[name] = struct{}{}
+		}
+	}
+	return sortedMonitorOptions(optionSet)
+}
+
 func (m *MonitorService) LoadGPUOptions() dto.MonitorGPUOptions {
 	var data dto.MonitorGPUOptions
-	gpuExist, gpuClient := gpu.New()
-	xpuExist, xpuClient := xpu.New()
-	if !gpuExist && !xpuExist {
+	exist, client := accelerator.New()
+	if !exist {
 		return data
 	}
-	if gpuExist {
-		data.GPUType = "gpu"
-		gpuInfo, err := gpuClient.LoadGpuInfo()
-		if err != nil || len(gpuInfo.GPUs) == 0 {
-			global.LOG.Error("Load GPU info failed or no GPU found, err: ", err)
-			return data
-		}
-		sort.Slice(gpuInfo.GPUs, func(i, j int) bool {
-			return gpuInfo.GPUs[i].Index < gpuInfo.GPUs[j].Index
-		})
-		for _, item := range gpuInfo.GPUs {
-			var chartHide dto.GPUChartHide
-			chartHide.ProductName = fmt.Sprintf("%d - %s", item.Index, item.ProductName)
-			chartHide.GPU = item.GPUUtil == "" || item.GPUUtil == "N/A"
-			if (item.MemTotal == "" || item.MemTotal == "N/A") && (item.MemUsed == "" || item.MemUsed == "N/A") {
-				chartHide.Memory = true
-			}
-			if (item.MaxPowerLimit == "" || item.MaxPowerLimit == "N/A") && (item.PowerDraw == "" || item.PowerDraw == "N/A") {
-				chartHide.Power = true
-			}
-			chartHide.Temperature = item.Temperature == "" || item.Temperature == "N/A"
-			chartHide.Speed = item.FanSpeed == "" || item.FanSpeed == "N/A"
-			data.ChartHide = append(data.ChartHide, chartHide)
-			data.Options = append(data.Options, fmt.Sprintf("%d - %s", item.Index, item.ProductName))
-		}
-		return data
+	seen := make(map[string]bool)
+	snapshot, err := client.Collect(context.Background())
+	if err != nil {
+		global.LOG.Warnf("Load accelerator options failed: %v", err)
 	} else {
-		data.GPUType = "xpu"
-		xpu, err := xpuClient.LoadGpuInfo()
-		if err != nil || len(xpu.Xpu) == 0 {
-			global.LOG.Error("Load XPU info failed or no XPU found, err: ", err)
-		}
-		sort.Slice(xpu.Xpu, func(i, j int) bool {
-			return xpu.Xpu[i].Basic.DeviceID < xpu.Xpu[j].Basic.DeviceID
-		})
-		for _, item := range xpu.Xpu {
-			var chartHide dto.GPUChartHide
-			chartHide.GPU = true
-			chartHide.Speed = true
-			chartHide.ProductName = fmt.Sprintf("%d - %s", item.Basic.DeviceID, item.Basic.DeviceName)
-			if (item.Stats.MemoryUsed == "" || item.Stats.MemoryUsed == "N/A") && (item.Basic.Memory == "" || item.Basic.FreeMemory == "N/A") {
-				chartHide.Memory = true
-			}
-			if item.Stats.Power == "" || item.Stats.Power == "N/A" {
-				chartHide.Power = true
-			}
-			chartHide.Temperature = item.Stats.Temperature == "" || item.Stats.Temperature == "N/A"
-			data.ChartHide = append(data.ChartHide, chartHide)
-			data.Options = append(data.Options, fmt.Sprintf("%d - %s", item.Basic.DeviceID, item.Basic.DeviceName))
+		data = loadGPUOptions(snapshot)
+		for _, item := range data.ChartHide {
+			seen[item.DeviceID] = true
 		}
+	}
+	data.Supported = true
+	devices, err := monitorRepo.GetGPUDevices()
+	if err != nil {
+		global.LOG.Warnf("Load accelerator history options failed: %v", err)
 		return data
 	}
+	for _, device := range devices {
+		key := device.DeviceID
+		if key == "" {
+			key = "legacy:" + device.ProductName
+		}
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		data.ChartHide = append(data.ChartHide, dto.GPUChartHide{DeviceID: device.DeviceID, ProductName: device.ProductName, Type: device.DeviceType, Legacy: device.DeviceID == ""})
+		data.Options = append(data.Options, device.ProductName)
+	}
+	return data
 }
 
 func (m *MonitorService) LoadGPUMonitorData(req dto.MonitorGPUSearch) (dto.MonitorGPUData, error) {
-	loc, _ := time.LoadLocation(common.LoadTimeZoneByCmd())
-	req.StartTime = req.StartTime.In(loc)
-	req.EndTime = req.EndTime.In(loc)
 	var data dto.MonitorGPUData
-	gpuList, err := monitorRepo.GetGPU(repo.WithByCreatedAt(req.StartTime, req.EndTime), monitorRepo.WithByProductName(req.ProductName))
+	if req.StartTime.IsZero() || req.EndTime.IsZero() || !req.EndTime.After(req.StartTime) {
+		return data, fmt.Errorf("invalid GPU history time range")
+	}
+	if req.DeviceID == "" && req.ProductName == "" {
+		return data, fmt.Errorf("GPU history requires a device")
+	}
+	if req.Aggregation != "" && req.Aggregation != "avg" && req.Aggregation != "max" {
+		return data, fmt.Errorf("invalid GPU history aggregation")
+	}
+	loc, err := time.LoadLocation(common.LoadTimeZoneByCmd())
 	if err != nil {
 		return data, err
 	}
-
-	for _, gpu := range gpuList {
-		data.Date = append(data.Date, gpu.CreatedAt)
-		data.GPUValue = append(data.GPUValue, gpu.GPUUtil)
-		data.TemperatureValue = append(data.TemperatureValue, gpu.Temperature)
-		data.PowerUsed = append(data.PowerUsed, gpu.PowerDraw)
-		data.PowerTotal = append(data.PowerTotal, gpu.MaxPowerLimit)
-		if gpu.MaxPowerLimit != 0 {
-			data.PowerPercent = append(data.PowerPercent, gpu.PowerDraw/gpu.MaxPowerLimit*100)
-		} else {
-			data.PowerPercent = append(data.PowerPercent, float64(0))
+	req.StartTime, req.EndTime = req.StartTime.In(loc), req.EndTime.In(loc)
+	opts := []repo.DBOption{repo.WithByCreatedAt(req.StartTime, req.EndTime), monitorRepo.WithByGPUDevice(req.DeviceID, req.ProductName, req.Legacy)}
+	data.SampleCount, err = monitorRepo.CountGPU(opts...)
+	if err != nil || data.SampleCount == 0 {
+		return data, err
+	}
+	if data.SampleCount > 1200 {
+		seconds := req.EndTime.Unix() - req.StartTime.Unix() + 1
+		data.BucketSeconds = (seconds + 599) / 600
+	}
+	points, err := monitorRepo.GetGPUHistory(req.StartTime, data.BucketSeconds, req.Aggregation, opts...)
+	if err != nil {
+		return data, err
+	}
+	samples := make([]repo.GPUHistoryPoint, 0, len(points))
+	if data.BucketSeconds > 0 {
+		next := 0
+		for bucket := int64(0); bucket <= (req.EndTime.Unix()-req.StartTime.Unix())/data.BucketSeconds; bucket++ {
+			point := repo.GPUHistoryPoint{}
+			if next < len(points) && points[next].Bucket == bucket {
+				point = points[next]
+				next++
+			}
+			point.CreatedAt = time.Unix(req.StartTime.Unix()+bucket*data.BucketSeconds, 0).In(loc)
+			if bucket == 0 {
+				point.CreatedAt = req.StartTime
+			}
+			samples = append(samples, point)
 		}
-
-		data.MemoryTotal = append(data.MemoryTotal, gpu.MemTotal)
-		data.MemoryUsed = append(data.MemoryUsed, gpu.MemUsed)
-		if gpu.MemTotal != 0 {
-			data.MemoryPercent = append(data.MemoryPercent, gpu.MemUsed/gpu.MemTotal*100)
-		} else {
-			data.MemoryPercent = append(data.MemoryPercent, float64(0))
+	} else {
+		for i, point := range points {
+			if i > 0 && points[i-1].IntervalSeconds > 0 {
+				interval := time.Duration(points[i-1].IntervalSeconds) * time.Second
+				if point.CreatedAt.Sub(points[i-1].CreatedAt) > 2*interval {
+					samples = append(samples, repo.GPUHistoryPoint{MonitorGPU: model.MonitorGPU{BaseModel: model.BaseModel{CreatedAt: points[i-1].CreatedAt.Add(interval)}}})
+				}
+			}
+			samples = append(samples, point)
 		}
-		var process []dto.GPUProcess
-		if err := json.Unmarshal([]byte(gpu.Processes), &process); err == nil {
-			data.ProcessCount = append(data.ProcessCount, len(process))
-			data.GPUProcesses = append(data.GPUProcesses, process)
-		} else {
-			data.ProcessCount = append(data.ProcessCount, 0)
-			data.GPUProcesses = append(data.GPUProcesses, []dto.GPUProcess{})
+	}
+	for _, point := range samples {
+		data.Date = append(data.Date, point.CreatedAt)
+		data.MemoryActivity = append(data.MemoryActivity, point.MemoryActivity)
+		data.EncoderUtil = append(data.EncoderUtil, point.EncoderUtil)
+		data.DecoderUtil = append(data.DecoderUtil, point.DecoderUtil)
+		data.JPEGUtil = append(data.JPEGUtil, point.JPEGUtil)
+		data.OFAUtil = append(data.OFAUtil, point.OFAUtil)
+		data.MediaUtil = append(data.MediaUtil, point.MediaUtil)
+		data.ComputeUtil = append(data.ComputeUtil, point.ComputeUtil)
+		data.CopyUtil = append(data.CopyUtil, point.CopyUtil)
+		data.HotspotTemperature = append(data.HotspotTemperature, point.HotspotTemperature)
+		data.FanRPM = append(data.FanRPM, point.FanRPM)
+		data.AICPUUtil = append(data.AICPUUtil, point.AICPUUtil)
+		data.CtrlCPUUtil = append(data.CtrlCPUUtil, point.CtrlCPUUtil)
+		data.DDRUsed = append(data.DDRUsed, point.DDRUsed)
+		data.DDRTotal = append(data.DDRTotal, point.DDRTotal)
+		data.HBMUsed = append(data.HBMUsed, point.HBMUsed)
+		data.HBMTotal = append(data.HBMTotal, point.HBMTotal)
+		data.DDRBandwidth = append(data.DDRBandwidth, point.DDRBandwidth)
+		data.HBMBandwidth = append(data.HBMBandwidth, point.HBMBandwidth)
+		data.MemoryBandwidth = append(data.MemoryBandwidth, point.MemoryBandwidth)
+		data.MediaFrequency = append(data.MediaFrequency, point.MediaFrequency)
+		data.HugepagesUsed = append(data.HugepagesUsed, point.HugepagesUsed)
+		data.HugepagesTotal = append(data.HugepagesTotal, point.HugepagesTotal)
+		data.GPUValue = append(data.GPUValue, point.GPUUtil)
+		data.TemperatureValue = append(data.TemperatureValue, point.Temperature)
+		data.MemoryTemperatureValue = append(data.MemoryTemperatureValue, point.MemoryTemperature)
+		data.PowerUsed = append(data.PowerUsed, point.PowerDraw)
+		data.PowerTotal = append(data.PowerTotal, point.MaxPowerLimit)
+		data.PowerPercent = append(data.PowerPercent, point.PowerPercent)
+		data.MemoryPercent = append(data.MemoryPercent, point.MemoryPercent)
+		data.MemoryTotal = append(data.MemoryTotal, point.MemTotal)
+		data.MemoryUsed = append(data.MemoryUsed, point.MemUsed)
+		data.SpeedValue = append(data.SpeedValue, point.FanSpeed)
+		data.FrequencyValue = append(data.FrequencyValue, point.Frequency)
+		data.MemoryFrequencyValue = append(data.MemoryFrequencyValue, point.MemoryFrequency)
+		data.ProcessCount = append(data.ProcessCount, point.ProcessCount)
+		var processes []dto.GPUProcess
+		if data.BucketSeconds == 0 && point.ProcessCount != nil {
+			_ = json.Unmarshal([]byte(point.Processes), &processes)
 		}
-		data.SpeedValue = append(data.SpeedValue, gpu.FanSpeed)
+		data.GPUProcesses = append(data.GPUProcesses, processes)
 	}
 	return data, nil
 }
@@ -252,9 +333,27 @@ func (m *MonitorService) LoadSetting() (*dto.MonitorSetting, error) {
 }
 
 func (m *MonitorService) UpdateSetting(key, value string) error {
+	monitorSettingMutex.Lock()
+	defer monitorSettingMutex.Unlock()
+	switch key {
+	case "MonitorStatus", "GPUMonitorStatus", "VLLMMonitorStatus":
+		if value != constant.StatusEnable && value != constant.StatusDisable {
+			return fmt.Errorf("invalid monitoring status")
+		}
+	case "MonitorInterval", "GPUMonitorInterval", "VLLMMonitorInterval":
+		interval, err := strconv.Atoi(value)
+		if err != nil || interval < 10 || interval > 43200 {
+			return fmt.Errorf("monitoring interval must be between 10 and 43200 seconds")
+		}
+	case "MonitorStoreDays", "GPUMonitorStoreDays", "VLLMMonitorStoreDays":
+		days, err := strconv.Atoi(value)
+		if err != nil || days < 1 {
+			return fmt.Errorf("monitoring retention must be a positive integer")
+		}
+	}
 	switch key {
 	case "MonitorStatus":
-		if value == constant.StatusEnable && global.MonitorCronID == 0 {
+		if value == constant.StatusEnable && monitorCancel == nil {
 			interval, err := settingRepo.Get(settingRepo.WithByKey("MonitorInterval"))
 			if err != nil {
 				return err
@@ -263,8 +362,9 @@ func (m *MonitorService) UpdateSetting(key, value string) error {
 				return err
 			}
 		}
-		if value == constant.StatusDisable && global.MonitorCronID != 0 {
+		if value == constant.StatusDisable && monitorCancel != nil {
 			monitorCancel()
+			monitorCancel = nil
 			global.Cron.Remove(cron.EntryID(global.MonitorCronID))
 			global.MonitorCronID = 0
 		}
@@ -273,32 +373,80 @@ func (m *MonitorService) UpdateSetting(key, value string) error {
 		if err != nil {
 			return err
 		}
-		if status.Value == constant.StatusEnable && global.MonitorCronID != 0 {
+		if status.Value == constant.StatusEnable && monitorCancel != nil {
 			if err := StartMonitor(true, value); err != nil {
 				return err
 			}
 		}
+	case "GPUMonitorStatus":
+		if value == constant.StatusEnable && global.GPUMonitorCronID == 0 {
+			interval, err := settingRepo.GetValueByKey("GPUMonitorInterval")
+			if err != nil {
+				return err
+			}
+			if err := StartGPUMonitor(interval); err != nil {
+				return err
+			}
+		}
+		if value == constant.StatusDisable && global.GPUMonitorCronID != 0 {
+			global.Cron.Remove(global.GPUMonitorCronID)
+			global.GPUMonitorCronID = 0
+		}
+	case "GPUMonitorInterval":
+		status, err := settingRepo.GetValueByKey("GPUMonitorStatus")
+		if err != nil {
+			return err
+		}
+		if status == constant.StatusEnable {
+			if err := StartGPUMonitor(value); err != nil {
+				return err
+			}
+		}
+	case "VLLMMonitorStatus":
+		if value == constant.StatusEnable && global.VLLMMonitorCronID == 0 {
+			interval, err := settingRepo.GetValueByKey("VLLMMonitorInterval")
+			if err != nil {
+				return err
+			}
+			if err := StartVLLMMonitor(interval); err != nil {
+				return err
+			}
+		}
+		if value == constant.StatusDisable && global.VLLMMonitorCronID != 0 {
+			global.Cron.Remove(global.VLLMMonitorCronID)
+			global.VLLMMonitorCronID = 0
+		}
+	case "VLLMMonitorInterval":
+		status, err := settingRepo.GetValueByKey("VLLMMonitorStatus")
+		if err != nil {
+			return err
+		}
+		if status == constant.StatusEnable {
+			if err := StartVLLMMonitor(value); err != nil {
+				return err
+			}
+		}
 	}
 	return settingRepo.Update(key, value)
 }
 
-func (m *MonitorService) CleanData() error {
-	if err := global.MonitorDB.Exec("DELETE FROM monitor_bases").Error; err != nil {
-		return err
+func (m *MonitorService) CleanData(monitorType string) error {
+	switch monitorType {
+	case "host":
+		return monitorRepo.CleanHost()
+	case "gpu":
+		gpuMonitorMutex.Lock()
+		defer gpuMonitorMutex.Unlock()
+		return monitorRepo.CleanGPU()
+	default:
+		return fmt.Errorf("unsupported monitoring cleanup type: %s", monitorType)
 	}
-	if err := global.MonitorDB.Exec("DELETE FROM monitor_ios").Error; err != nil {
-		return err
-	}
-	if err := global.MonitorDB.Exec("DELETE FROM monitor_networks").Error; err != nil {
-		return err
-	}
-	_ = global.GPUMonitorDB.Exec("DELETE FROM monitor_gpus").Error
-	return nil
 }
 
 func (m *MonitorService) Run() {
-	saveGPUDataToDB()
-	saveXPUDataToDB()
+	if m.ctx.Err() != nil {
+		return
+	}
 	var itemModel model.MonitorBase
 	totalPercent, _ := cpu.Percent(3*time.Second, false)
 	if len(totalPercent) == 1 {
@@ -347,26 +495,31 @@ func (m *MonitorService) Run() {
 }
 
 func (m *MonitorService) loadDiskIO() {
-	ioStat, _ := disk.IOCounters()
+	ioStat, _ := disk.IOCountersWithContext(m.ctx)
 	var diskIOList []disk.IOCountersStat
 	for _, io := range ioStat {
 		diskIOList = append(diskIOList, io)
 	}
 	diskIOList = append(diskIOList, sumDiskIOCounters(ioStat))
-	m.DiskIO <- diskIOList
+	select {
+	case <-m.ctx.Done():
+	case m.DiskIO <- diskIOList:
+	}
 }
 
 func (m *MonitorService) loadNetIO() {
-	netStat, _ := net.IOCounters(true)
-	netStatAll, _ := net.IOCounters(false)
+	netStat, _ := net.IOCountersWithContext(m.ctx, true)
+	netStatAll, _ := net.IOCountersWithContext(m.ctx, false)
 	var netList []net.IOCountersStat
 	netList = append(netList, netStat...)
 	netList = append(netList, netStatAll...)
-	m.NetIO <- netList
+	select {
+	case <-m.ctx.Done():
+	case m.NetIO <- netList:
+	}
 }
 
 func (m *MonitorService) saveIODataToDB(ctx context.Context, interval float64) {
-	defer close(m.DiskIO)
 	for {
 		select {
 		case <-ctx.Done():
@@ -416,14 +569,17 @@ func (m *MonitorService) saveIODataToDB(ctx context.Context, interval float64) {
 					}
 				}
 				_ = monitorRepo.BatchCreateMonitorIO(ioList)
-				m.DiskIO <- ioStat2
+				select {
+				case <-ctx.Done():
+					return
+				case m.DiskIO <- ioStat2:
+				}
 			}
 		}
 	}
 }
 
 func (m *MonitorService) saveNetDataToDB(ctx context.Context, interval float64) {
-	defer close(m.NetIO)
 	for {
 		select {
 		case <-ctx.Done():
@@ -453,7 +609,11 @@ func (m *MonitorService) saveNetDataToDB(ctx context.Context, interval float64)
 				}
 
 				_ = monitorRepo.BatchCreateMonitorNet(netList)
-				m.NetIO <- netStat2
+				select {
+				case <-ctx.Done():
+					return
+				case m.NetIO <- netStat2:
+				}
 			}
 		}
 	}
@@ -562,27 +722,38 @@ func loadTopMem() []dto.Process {
 }
 
 func StartMonitor(removeBefore bool, interval string) error {
+	intervalItem, err := strconv.Atoi(interval)
+	if err != nil || intervalItem < 10 || intervalItem > 43200 {
+		return fmt.Errorf("invalid host monitoring interval: %s", interval)
+	}
 	if removeBefore {
 		monitorCancel()
 		global.Cron.Remove(cron.EntryID(global.MonitorCronID))
 	}
-	intervalItem, err := strconv.Atoi(interval)
-	if err != nil {
-		return err
-	}
-
-	service := NewIMonitorService()
 	ctx, cancel := context.WithCancel(context.Background())
-	monitorCancel = cancel
+	service := &MonitorService{
+		DiskIO: make(chan []disk.IOCountersStat, 2),
+		NetIO:  make(chan []net.IOCountersStat, 2),
+		ctx:    ctx,
+	}
 	now := time.Now()
 	nextMinute := now.Truncate(time.Minute).Add(time.Minute)
-	time.AfterFunc(time.Until(nextMinute), func() {
+	timer := time.AfterFunc(time.Until(nextMinute), func() {
+		monitorSettingMutex.Lock()
+		defer monitorSettingMutex.Unlock()
+		if ctx.Err() != nil {
+			return
+		}
 		monitorID, err := global.Cron.AddJob(fmt.Sprintf("@every %ss", interval), service)
 		if err != nil {
 			return
 		}
 		global.MonitorCronID = monitorID
 	})
+	monitorCancel = func() {
+		cancel()
+		timer.Stop()
+	}
 
 	service.Run()
 
@@ -592,93 +763,183 @@ func StartMonitor(removeBefore bool, interval string) error {
 	return nil
 }
 
-func saveGPUDataToDB() {
-	exist, client := gpu.New()
+func loadGPUOptions(snapshot *accelerator.Snapshot) dto.MonitorGPUOptions {
+	var data dto.MonitorGPUOptions
+	hasGPUOrNPU := false
+	hasXPU := false
+	for _, item := range snapshot.Devices {
+		if item.Kind == accelerator.KindXPU {
+			hasXPU = true
+		} else {
+			hasGPUOrNPU = true
+		}
+	}
+	switch {
+	case hasGPUOrNPU && hasXPU:
+		data.GPUType = "mixed"
+	case hasXPU:
+		data.GPUType = "xpu"
+	case hasGPUOrNPU:
+		data.GPUType = "gpu"
+	}
+
+	sort.Slice(snapshot.Devices, func(i, j int) bool {
+		if snapshot.Devices[i].Kind != snapshot.Devices[j].Kind {
+			return snapshot.Devices[i].Kind < snapshot.Devices[j].Kind
+		}
+		if snapshot.Devices[i].Vendor != snapshot.Devices[j].Vendor {
+			return snapshot.Devices[i].Vendor < snapshot.Devices[j].Vendor
+		}
+		if snapshot.Devices[i].NPUIndex != snapshot.Devices[j].NPUIndex {
+			return snapshot.Devices[i].NPUIndex < snapshot.Devices[j].NPUIndex
+		}
+		if snapshot.Devices[i].ChipIndex != snapshot.Devices[j].ChipIndex {
+			return snapshot.Devices[i].ChipIndex < snapshot.Devices[j].ChipIndex
+		}
+		return snapshot.Devices[i].Index < snapshot.Devices[j].Index
+	})
+	for _, item := range snapshot.Devices {
+		chartHide := dto.GPUChartHide{
+			DeviceID:    item.ID,
+			ProductName: item.Label,
+			Type:        string(item.Kind),
+		}
+		data.ChartHide = append(data.ChartHide, chartHide)
+		data.Options = append(data.Options, chartHide.ProductName)
+	}
+	return data
+}
+
+func StartGPUMonitor(interval string) error {
+	seconds, err := strconv.Atoi(interval)
+	if err != nil || seconds < 10 || seconds > 43200 {
+		return fmt.Errorf("invalid GPU monitoring interval: %s", interval)
+	}
+	service := &MonitorService{}
+	job := cron.NewChain(cron.Recover(cron.DefaultLogger)).Then(cron.FuncJob(service.saveGPUData))
+	id, err := global.Cron.AddFunc(fmt.Sprintf("@every %ds", seconds), func() { go job.Run() })
+	if err != nil {
+		return err
+	}
+	if global.GPUMonitorCronID != 0 {
+		global.Cron.Remove(global.GPUMonitorCronID)
+	}
+	global.GPUMonitorCronID = id
+	return nil
+}
+
+func (m *MonitorService) saveGPUData() {
+	if !gpuMonitorMutex.TryLock() {
+		return
+	}
+	defer gpuMonitorMutex.Unlock()
+	status, err := settingRepo.GetValueByKey("GPUMonitorStatus")
+	if err != nil {
+		global.LOG.Errorf("Load GPU monitoring status failed: %v", err)
+		return
+	}
+	if status != constant.StatusEnable {
+		return
+	}
+	retention, err := settingRepo.GetValueByKey("GPUMonitorStoreDays")
+	if err != nil {
+		global.LOG.Errorf("Load GPU monitoring retention failed: %v", err)
+		return
+	}
+	days, err := strconv.Atoi(retention)
+	if err != nil || days < 1 {
+		global.LOG.Errorf("Invalid GPU monitoring retention: %s", retention)
+		return
+	}
+	if err := monitorRepo.DelMonitorGPU(time.Now().AddDate(0, 0, -days)); err != nil {
+		global.LOG.Errorf("Clean GPU monitoring data failed: %v", err)
+	}
+	exist, client := accelerator.New()
 	if !exist {
 		return
 	}
-	gpuInfo, err := client.LoadGpuInfo()
+	snapshot, err := client.Collect(context.Background())
 	if err != nil {
+		global.LOG.Errorf("load accelerator monitor data failed, err: %v", err)
 		return
 	}
-	var list []model.MonitorGPU
-	for _, gpuItem := range gpuInfo.GPUs {
-		item := model.MonitorGPU{
-			ProductName:   fmt.Sprintf("%d - %s", gpuItem.Index, gpuItem.ProductName),
-			GPUUtil:       loadGPUInfoFloat(gpuItem.GPUUtil),
-			Temperature:   loadGPUInfoFloat(gpuItem.Temperature),
-			PowerDraw:     loadGPUInfoFloat(gpuItem.PowerDraw),
-			MaxPowerLimit: loadGPUInfoFloat(gpuItem.MaxPowerLimit),
-			MemUsed:       loadGPUInfoFloat(gpuItem.MemUsed),
-			MemTotal:      loadGPUInfoFloat(gpuItem.MemTotal),
-			FanSpeed:      loadGPUInfoInt(gpuItem.FanSpeed),
-		}
-		process, _ := json.Marshal(gpuItem.Processes)
-		if len(process) != 0 {
-			item.Processes = string(process)
-		}
+	if warning := snapshot.Warning(); warning != nil {
+		global.LOG.Warnf("load accelerator monitor data partially failed, err: %v", warning)
+	}
+	intervalSeconds := 0
+	if setting, err := settingRepo.Get(settingRepo.WithByKey("GPUMonitorInterval")); err == nil {
+		intervalSeconds, _ = strconv.Atoi(setting.Value)
+	}
+	list := make([]model.MonitorGPU, 0, len(snapshot.Devices))
+	for _, device := range snapshot.Devices {
+		item := newMonitorGPU(device)
+		item.CreatedAt = snapshot.Info.CollectedAt
+		item.IntervalSeconds = intervalSeconds
 		list = append(list, item)
 	}
-	if err := repo.NewIMonitorRepo().BatchCreateMonitorGPU(list); err != nil {
-		global.LOG.Errorf("batch create gpu monitor data failed, err: %v", err)
-		return
+	if err := monitorRepo.BatchCreateMonitorGPU(list); err != nil {
+		global.LOG.Errorf("batch create accelerator monitor data failed, err: %v", err)
 	}
 }
-func saveXPUDataToDB() {
-	exist, client := xpu.New()
-	if !exist {
-		return
+
+func newMonitorGPU(device accelerator.Device) model.MonitorGPU {
+	item := model.MonitorGPU{
+		MemoryUtil:         device.Metrics.MemoryUtil.Value,
+		MemoryActivity:     device.Metrics.MemoryActivity.Value,
+		EncoderUtil:        device.Metrics.EncoderUtil.Value,
+		DecoderUtil:        device.Metrics.DecoderUtil.Value,
+		JPEGUtil:           device.Metrics.JPEGUtil.Value,
+		OFAUtil:            device.Metrics.OFAUtil.Value,
+		MediaUtil:          device.Metrics.MediaUtil.Value,
+		ComputeUtil:        device.Metrics.ComputeUtil.Value,
+		CopyUtil:           device.Metrics.CopyUtil.Value,
+		HotspotTemperature: device.Metrics.HotspotTemperature.Value,
+		FanRPM:             device.Metrics.FanRPM.Value,
+		AICPUUtil:          device.Metrics.AICPUUtil.Value,
+		CtrlCPUUtil:        device.Metrics.CtrlCPUUtil.Value,
+		DDRUsed:            device.Metrics.DDRUsed.Value,
+		DDRTotal:           device.Metrics.DDRTotal.Value,
+		HBMUsed:            device.Metrics.HBMUsed.Value,
+		HBMTotal:           device.Metrics.HBMTotal.Value,
+		DDRBandwidth:       device.Metrics.DDRBandwidth.Value,
+		HBMBandwidth:       device.Metrics.HBMBandwidth.Value,
+		MemoryBandwidth:    device.Metrics.MemoryBandwidth.Value,
+		MediaFrequency:     device.Metrics.MediaFrequency.Value,
+		HugepagesUsed:      device.Metrics.HugepagesUsed.Value,
+		HugepagesTotal:     device.Metrics.HugepagesTotal.Value,
+
+		ProductName:       device.Label,
+		DeviceID:          device.ID,
+		DeviceType:        string(device.Kind),
+		ProcessStatus:     device.ProcessStatus,
+		Frequency:         device.Metrics.Frequency.Value,
+		MemoryFrequency:   device.Metrics.MemoryFrequency.Value,
+		MemoryTemperature: device.Metrics.MemoryTemperature.Value,
+		GPUUtil:           device.Metrics.Utilization.Value,
+		Temperature:       device.Metrics.Temperature.Value,
+		PowerDraw:         device.Metrics.Power.Value,
+		MaxPowerLimit:     device.Metrics.PowerLimit.Value,
+		MemUsed:           device.Metrics.MemoryUsed.Value,
+		MemTotal:          device.Metrics.MemoryTotal.Value,
+		FanSpeed:          device.Metrics.FanSpeed.Value,
 	}
-	xpuInfo, err := client.LoadGpuInfo()
-	if err != nil {
-		return
+	if device.ProcessStatus != "ok" {
+		return item
 	}
-	var list []model.MonitorGPU
-	for _, xpuItem := range xpuInfo.Xpu {
-		item := model.MonitorGPU{
-			ProductName: fmt.Sprintf("%d - %s", xpuItem.Basic.DeviceID, xpuItem.Basic.DeviceName),
-			Temperature: loadGPUInfoFloat(xpuItem.Stats.Temperature),
-			PowerDraw:   loadGPUInfoFloat(xpuItem.Stats.Power),
-			MemUsed:     loadGPUInfoFloat(xpuItem.Stats.MemoryUsed),
-			MemTotal:    loadGPUInfoFloat(xpuItem.Basic.Memory),
-		}
-		if len(xpuItem.Processes) != 0 {
-			var processItem []dto.GPUProcess
-			for _, ps := range xpuItem.Processes {
-				processItem = append(processItem, dto.GPUProcess{
-					Pid:         fmt.Sprintf("%v", ps.PID),
-					Type:        ps.SHR,
-					ProcessName: ps.Command,
-					UsedMemory:  ps.Memory,
-				})
-			}
-			process, _ := json.Marshal(processItem)
-			if len(process) != 0 {
-				item.Processes = string(process)
-			}
-		}
-		list = append(list, item)
+	processes := make([]dto.GPUProcess, 0, len(device.Processes))
+	for _, process := range device.Processes {
+		processes = append(processes, dto.GPUProcess{
+			Pid:         process.PID,
+			Type:        process.Type,
+			ProcessName: process.Name,
+			UsedMemory:  process.Memory,
+		})
 	}
-	if err := repo.NewIMonitorRepo().BatchCreateMonitorGPU(list); err != nil {
-		global.LOG.Errorf("batch create gpu monitor data failed, err: %v", err)
-		return
+	processData, err := json.Marshal(processes)
+	if err == nil {
+		item.Processes = string(processData)
 	}
-}
-func loadGPUInfoInt(val string) int {
-	val = strings.TrimSuffix(val, "%")
-	val = strings.TrimSpace(val)
-	data, _ := strconv.Atoi(val)
-	return data
-}
-func loadGPUInfoFloat(val string) float64 {
-	val = strings.TrimSpace(val)
-	suffixes := []string{"W", "MB", "MiB", "°C", "C", "%"}
-	for _, suffix := range suffixes {
-		val = strings.TrimSuffix(val, suffix)
-	}
-	val = strings.TrimSpace(val)
-	data, _ := strconv.ParseFloat(val, 64)
-	return data
+	return item
 }
 
 func sumDiskIOCounters(ioStats map[string]disk.IOCountersStat) disk.IOCountersStat {
@@ -722,3 +983,14 @@ func loadHostSysPath() string {
 	}
 	return hostSys
 }
+
+func sortedMonitorOptions(optionSet map[string]struct{}) []string {
+	options := make([]string, 0, len(optionSet))
+	for name := range optionSet {
+		if len(name) != 0 && name != "all" {
+			options = append(options, name)
+		}
+	}
+	sort.Strings(options)
+	return append([]string{"all"}, options...)
+}

agent/app/service/monitor_vllm.go

@@ -0,0 +1,287 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+	"github.com/1Panel-dev/1Panel/agent/utils/ai_tools/vllm"
+	"github.com/1Panel-dev/1Panel/agent/utils/common"
+	"github.com/robfig/cron/v3"
+	"golang.org/x/sync/errgroup"
+)
+
+var vllmMonitorMutex sync.Mutex
+var vllmMetricsClient = &http.Client{
+	Timeout:       5 * time.Second,
+	Transport:     &http.Transport{DialContext: (&net.Dialer{Timeout: 3 * time.Second}).DialContext, IdleConnTimeout: 30 * time.Second},
+	CheckRedirect: func(req *http.Request, via []*http.Request) error { return http.ErrUseLastResponse },
+}
+
+func (m *MonitorService) LoadVLLMMonitorData(req dto.MonitorVLLMSearch) (dto.MonitorVLLMData, error) {
+	data := dto.MonitorVLLMData{Points: []model.MonitorVLLM{}}
+	if !req.EndTime.After(req.StartTime) {
+		return data, fmt.Errorf("invalid vLLM history request")
+	}
+	install, err := appInstallRepo.GetFirst(repo.WithByID(req.AppInstallID))
+	if err != nil {
+		return data, err
+	}
+	if install.App.Key != "vllm" {
+		return data, fmt.Errorf("not a vLLM installation")
+	}
+
+	loc, err := time.LoadLocation(common.LoadTimeZoneByCmd())
+	if err != nil {
+		return data, err
+	}
+	req.StartTime, req.EndTime = req.StartTime.In(loc), req.EndTime.In(loc)
+	data.SampleCount, err = vllmMonitorRepo.Count(req.AppInstallID, req.StartTime, req.EndTime)
+	if err != nil || data.SampleCount == 0 {
+		return data, err
+	}
+	if data.SampleCount > 1200 {
+		data.BucketSeconds = (req.EndTime.Unix() - req.StartTime.Unix() + 600) / 600
+	}
+	points, err := vllmMonitorRepo.History(req.AppInstallID, req.StartTime, req.EndTime, data.BucketSeconds, req.Aggregation)
+	if err != nil {
+		return data, err
+	}
+	if data.BucketSeconds > 0 {
+		if req.Aggregation != "max" {
+			for i := range points {
+				if err := vllm.AggregateHistograms(points[i].HistogramSamples, &points[i].MonitorVLLM); err != nil {
+					return data, err
+				}
+			}
+		}
+		next := 0
+		for bucket := int64(0); bucket <= (req.EndTime.Unix()-req.StartTime.Unix())/data.BucketSeconds; bucket++ {
+			var point model.MonitorVLLM
+			if next < len(points) && points[next].Bucket == bucket {
+				point = points[next].MonitorVLLM
+				next++
+			}
+			point.AppInstallID = req.AppInstallID
+			point.CreatedAt = time.Unix(req.StartTime.Unix()+bucket*data.BucketSeconds, 0).In(loc)
+			if bucket == 0 {
+				point.CreatedAt = req.StartTime
+			}
+			data.Points = append(data.Points, point)
+		}
+	} else {
+		setting, err := settingRepo.GetValueByKey("VLLMMonitorInterval")
+		if err != nil {
+			return data, err
+		}
+		intervalSeconds, err := strconv.Atoi(setting)
+		if err != nil || intervalSeconds <= 0 {
+			return data, fmt.Errorf("invalid vLLM monitoring interval: %s", setting)
+		}
+		interval := time.Duration(intervalSeconds) * time.Second
+		for i, point := range points {
+			if i > 0 && point.CreatedAt.Sub(points[i-1].CreatedAt) > 2*interval {
+				data.Points = append(data.Points, model.MonitorVLLM{CreatedAt: points[i-1].CreatedAt.Add(interval), AppInstallID: req.AppInstallID})
+			}
+			data.Points = append(data.Points, point.MonitorVLLM)
+		}
+	}
+	return data, nil
+}
+
+func (m *MonitorService) LoadVLLMCurrent(ctx context.Context, req dto.MonitorVLLMCurrent) (model.MonitorVLLM, error) {
+	install, err := appInstallRepo.GetFirst(repo.WithByID(req.AppInstallID))
+	if err != nil {
+		return model.MonitorVLLM{}, err
+	}
+	if install.App.Key != "vllm" {
+		return model.MonitorVLLM{}, fmt.Errorf("not a vLLM installation")
+	}
+	previous, err := collectVLLMMetrics(ctx, install, model.MonitorVLLM{})
+	if err != nil {
+		global.LOG.Debugf("Collect vLLM metrics on port %d failed: %v", install.HttpPort, err)
+		return previous, nil
+	}
+	timer := time.NewTimer(time.Second)
+	defer timer.Stop()
+	select {
+	case <-ctx.Done():
+		return model.MonitorVLLM{}, ctx.Err()
+	case <-timer.C:
+	}
+	point, err := collectVLLMMetrics(ctx, install, previous)
+	if err != nil {
+		global.LOG.Debugf("Collect vLLM metrics on port %d failed: %v", install.HttpPort, err)
+	}
+	return point, nil
+}
+
+func (m *MonitorService) CleanVLLMMonitor(req dto.MonitorVLLMClean) error {
+	install, err := appInstallRepo.GetFirst(repo.WithByID(req.AppInstallID))
+	if err != nil {
+		return err
+	}
+	if install.App.Key != "vllm" {
+		return fmt.Errorf("not a vLLM installation")
+	}
+	vllmMonitorMutex.Lock()
+	defer vllmMonitorMutex.Unlock()
+	return vllmMonitorRepo.CleanTarget(req.AppInstallID)
+}
+
+func StartVLLMMonitor(interval string) error {
+	seconds, err := strconv.Atoi(interval)
+	if err != nil || seconds < 10 || seconds > 43200 {
+		return fmt.Errorf("invalid vLLM monitoring interval: %s", interval)
+	}
+	service := &MonitorService{}
+	job := cron.NewChain(cron.Recover(cron.DefaultLogger)).Then(cron.FuncJob(service.saveVLLMData))
+	id, err := global.Cron.AddFunc(fmt.Sprintf("@every %ds", seconds), func() { go job.Run() })
+	if err != nil {
+		return err
+	}
+	if global.VLLMMonitorCronID != 0 {
+		global.Cron.Remove(global.VLLMMonitorCronID)
+	}
+	global.VLLMMonitorCronID = id
+	return nil
+}
+
+func (m *MonitorService) saveVLLMData() {
+	if !vllmMonitorMutex.TryLock() {
+		return
+	}
+	defer vllmMonitorMutex.Unlock()
+	status, err := settingRepo.GetValueByKey("VLLMMonitorStatus")
+	if err != nil {
+		global.LOG.Errorf("Load vLLM monitoring status failed: %v", err)
+		return
+	}
+	if status != constant.StatusEnable {
+		return
+	}
+	retention, err := settingRepo.GetValueByKey("VLLMMonitorStoreDays")
+	if err != nil {
+		global.LOG.Errorf("Load vLLM monitoring retention failed: %v", err)
+		return
+	}
+	days, err := strconv.Atoi(retention)
+	if err != nil || days < 1 {
+		global.LOG.Errorf("Invalid vLLM monitoring retention: %s", retention)
+		return
+	}
+	if err := vllmMonitorRepo.DeleteBefore(time.Now().AddDate(0, 0, -days)); err != nil {
+		global.LOG.Errorf("Clean vLLM monitoring data failed: %v", err)
+	}
+	apps, err := appRepo.GetBy(appRepo.WithKey("vllm"))
+	if err != nil {
+		global.LOG.Errorf("Load vLLM apps for monitoring failed: %v", err)
+		return
+	}
+	if len(apps) == 0 {
+		return
+	}
+	ids := make([]uint, 0, len(apps))
+	for _, app := range apps {
+		ids = append(ids, app.ID)
+	}
+	installs, err := appInstallRepo.ListBy(context.Background(), appInstallRepo.WithAppIdsIn(ids))
+	if err != nil {
+		global.LOG.Errorf("Load vLLM instances for monitoring failed: %v", err)
+		return
+	}
+	var group errgroup.Group
+	group.SetLimit(4)
+	for _, install := range installs {
+		group.Go(func() error {
+			previous, err := vllmMonitorRepo.Latest(install.ID)
+			if err != nil {
+				return err
+			}
+			point, err := collectVLLMMetrics(context.Background(), install, previous)
+			if err != nil {
+				global.LOG.Debugf("Collect vLLM metrics for %s failed: %v", install.Name, err)
+			}
+			return vllmMonitorRepo.Create(&point)
+		})
+	}
+	if err := group.Wait(); err != nil {
+		global.LOG.Errorf("Save vLLM monitoring data failed: %v", err)
+	}
+}
+
+func collectVLLMMetrics(ctx context.Context, install model.AppInstall, previous model.MonitorVLLM) (model.MonitorVLLM, error) {
+	point := model.MonitorVLLM{AppInstallID: install.ID, CreatedAt: time.Now(), Status: "unavailable"}
+	if install.HttpPort <= 0 || install.HttpPort > 65535 {
+		return point, fmt.Errorf("invalid vLLM port")
+	}
+	var env map[string]interface{}
+	if err := json.Unmarshal([]byte(install.Env), &env); err != nil {
+		return point, err
+	}
+	host, _ := env[constant.HostIP].(string)
+	host = strings.Trim(host, "[]")
+	switch host {
+	case "", "0.0.0.0":
+		host = "127.0.0.1"
+	case "::":
+		host = "::1"
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://"+net.JoinHostPort(host, strconv.Itoa(install.HttpPort))+"/metrics", nil)
+	if err != nil {
+		return point, err
+	}
+	response, err := vllmMetricsClient.Do(req)
+	if err != nil {
+		return point, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return point, fmt.Errorf("vLLM metrics returned HTTP %d", response.StatusCode)
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, 8*1024*1024+1))
+	if err != nil {
+		return point, err
+	}
+	if len(body) > 8*1024*1024 {
+		return point, fmt.Errorf("vLLM metrics response too large")
+	}
+	metrics, err := vllm.Parse(bytes.NewReader(body))
+	if err != nil {
+		return point, err
+	}
+	point.CreatedAt = time.Now()
+	raw, err := json.Marshal(metrics)
+	if err != nil {
+		return point, err
+	}
+	var before vllm.Metrics
+	elapsed := point.CreatedAt.Sub(previous.CreatedAt).Seconds()
+	if previous.Status == "ok" && elapsed > 0 {
+		if err := json.Unmarshal([]byte(previous.RawMetrics), &before); err != nil {
+			return point, err
+		}
+	}
+	calculated, err := vllm.Calculate(metrics, before, elapsed)
+	if err != nil {
+		return point, err
+	}
+	calculated.AppInstallID = install.ID
+	calculated.CreatedAt = point.CreatedAt
+	calculated.RawMetrics = string(raw)
+	calculated.Status = "ok"
+	return calculated, nil
+}

agent/app/service/nginx.go

@@ -32,7 +32,7 @@ type NginxService struct {
 
 type INginxService interface {
 	GetNginxConfig() (*response.NginxFile, error)
-	GetConfigByScope(req request.NginxScopeReq) ([]response.NginxParam, error)
+	GetConfigByScope(req request.NginxScopeReq) (interface{}, error)
 	UpdateConfigByScope(req request.NginxConfigUpdate) error
 	GetStatus() (response.NginxStatus, error)
 	UpdateConfigFile(req request.NginxConfigFileUpdate) error
@@ -62,7 +62,10 @@ func (n NginxService) GetNginxConfig() (*response.NginxFile, error) {
 	return &response.NginxFile{Content: string(byteContent)}, nil
 }
 
-func (n NginxService) GetConfigByScope(req request.NginxScopeReq) ([]response.NginxParam, error) {
+func (n NginxService) GetConfigByScope(req request.NginxScopeReq) (interface{}, error) {
+	if req.Scope == dto.Brotli {
+		return getNginxBrotliParams()
+	}
 	keys, ok := dto.ScopeKeyMap[req.Scope]
 	if !ok || len(keys) == 0 {
 		return nil, nil
@@ -71,6 +74,9 @@ func (n NginxService) GetConfigByScope(req request.NginxScopeReq) ([]response.Ng
 }
 
 func (n NginxService) UpdateConfigByScope(req request.NginxConfigUpdate) error {
+	if req.Scope == dto.Brotli {
+		return updateNginxBrotliParams(getNginxParams(req.Params, dto.BrotliKeys))
+	}
 	keys, ok := dto.ScopeKeyMap[req.Scope]
 	if !ok || len(keys) == 0 {
 		return nil

agent/app/service/nginx_gzip_upgrade.go

@@ -0,0 +1,168 @@
+package service
+
+import (
+	"os"
+	"path"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/global"
+)
+
+// stockNginxGzipDirectives is the gzip block shipped by the OpenResty app
+// since 1.21.4.3. The upgrade only rewrites values when the installed
+// nginx.conf still carries exactly these directives and values, which proves
+// the user never tuned compression. Any deviation aborts the rewrite.
+var stockNginxGzipDirectives = map[string]string{
+	"gzip":              "on",
+	"gzip_min_length":   "1k",
+	"gzip_buffers":      "4 16k",
+	"gzip_http_version": "1.1",
+	"gzip_comp_level":   "2",
+	"gzip_types":        "text/plain application/javascript application/x-javascript text/javascript text/css application/xml",
+	"gzip_vary":         "on",
+	"gzip_proxied":      "expired no-cache no-store private auth",
+	"gzip_disable":      `"MSIE [1-6]\."`,
+}
+
+// correctedNginxGzipDirectives replaces the stock values in place. gzip lives
+// in the http block of nginx.conf and must stay there: repeating it from an
+// included file would make nginx reject the configuration with a duplicate
+// directive error, and the compression settings page reads and writes these
+// same keys in nginx.conf.
+var correctedNginxGzipDirectives = map[string]string{
+	"gzip_comp_level": "5",
+	"gzip_types":      strings.Join(nginxCompressibleTypes, " "),
+	"gzip_proxied":    "any",
+}
+
+// obsoleteNginxGzipDirectives are dropped outright.
+var obsoleteNginxGzipDirectives = map[string]struct{}{
+	// A per-request User-Agent regex for browsers with no measurable share.
+	"gzip_disable": {},
+}
+
+var nginxGzipDirectiveRe = regexp.MustCompile(`(?m)^[ \t]*(gzip[a-z_]*)[ \t]+([^;\n]*);[ \t]*$`)
+
+func nginxMainConfigPath(install model.AppInstall) string {
+	return path.Join(install.GetPath(), nginxModuleConfDir, "nginx.conf")
+}
+
+// upgradeStockNginxGzipConfig rewrites the factory gzip defaults in place.
+//
+// Upgrades deliberately preserve the user's nginx.conf, so corrected defaults
+// shipped with a new OpenResty version would otherwise never reach existing
+// installations.
+//
+// The config parser is not used: its dumper regenerates the whole file, drops
+// standalone comments and reorders proxy includes, which would be destructive
+// on a user's main config. Lines are edited individually so everything outside
+// the gzip block stays byte-identical.
+func upgradeStockNginxGzipConfig(install model.AppInstall) error {
+	configPath := nginxMainConfigPath(install)
+	content, err := os.ReadFile(configPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	if !isStockNginxGzipConfig(string(content)) {
+		return nil
+	}
+	updated := rewriteNginxGzipDirectives(string(content))
+	if updated == string(content) {
+		return nil
+	}
+	if err = writeNginxFileAtomic(configPath, []byte(updated)); err != nil {
+		return err
+	}
+	if err = nginxCheckAndReload(string(content), configPath, install.ContainerName); err != nil {
+		return err
+	}
+	global.LOG.Info("updated the stock OpenResty gzip configuration to the current defaults")
+	return nil
+}
+
+// isStockNginxGzipConfig reports whether every gzip directive in the config
+// matches the factory defaults exactly, with none missing and none extra.
+func isStockNginxGzipConfig(content string) bool {
+	found := make(map[string]string)
+	for _, match := range nginxGzipDirectiveRe.FindAllStringSubmatch(content, -1) {
+		name := match[1]
+		value := strings.Join(strings.Fields(match[2]), " ")
+		if _, ok := found[name]; ok {
+			// A directive repeated in the http block means the config was
+			// edited by hand; leave it alone.
+			return false
+		}
+		found[name] = value
+	}
+	if len(found) != len(stockNginxGzipDirectives) {
+		return false
+	}
+	for name, expected := range stockNginxGzipDirectives {
+		if found[name] != expected {
+			return false
+		}
+	}
+	return true
+}
+
+// rewriteNginxGzipDirectives updates known values in place, drops obsolete
+// directives and appends directives that are missing, preserving the original
+// indentation and leaving every other line untouched.
+func rewriteNginxGzipDirectives(content string) string {
+	lines := strings.Split(content, "\n")
+	result := make([]string, 0, len(lines))
+	seen := make(map[string]struct{})
+	lastGzipIndex := -1
+	lastGzipIndent := "    "
+
+	for _, line := range lines {
+		match := nginxGzipDirectiveRe.FindStringSubmatch(line)
+		if match == nil {
+			result = append(result, line)
+			continue
+		}
+		name := match[1]
+		// The indentation belongs to the line itself; a top-level directive
+		// must not inherit the indent a previous, nested directive used.
+		lineIndent := line[:len(line)-len(strings.TrimLeft(line, " \t"))]
+		if lineIndent == "" {
+			lineIndent = "    "
+		}
+		lastGzipIndent = lineIndent
+		if _, obsolete := obsoleteNginxGzipDirectives[name]; obsolete {
+			continue
+		}
+		seen[name] = struct{}{}
+		if replacement, ok := correctedNginxGzipDirectives[name]; ok {
+			result = append(result, lineIndent+name+" "+replacement+";")
+		} else {
+			result = append(result, line)
+		}
+		lastGzipIndex = len(result) - 1
+	}
+
+	// Directives introduced by a newer default set are appended right after
+	// the existing block so they stay visually grouped.
+	var missing []string
+	for name := range correctedNginxGzipDirectives {
+		if _, ok := seen[name]; !ok {
+			missing = append(missing, name)
+		}
+	}
+	if len(missing) == 0 || lastGzipIndex < 0 {
+		return strings.Join(result, "\n")
+	}
+	sort.Strings(missing)
+	added := make([]string, 0, len(missing))
+	for _, name := range missing {
+		added = append(added, lastGzipIndent+name+" "+correctedNginxGzipDirectives[name]+";")
+	}
+	tail := append(added, result[lastGzipIndex+1:]...)
+	return strings.Join(append(result[:lastGzipIndex+1], tail...), "\n")
+}

agent/app/service/nginx_gzip_upgrade_test.go

@@ -0,0 +1,182 @@
+package service
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/1Panel-dev/1Panel/agent/cmd/server/nginx_conf"
+)
+
+const stockNginxConf = `user  root;
+worker_processes  auto;
+
+include /usr/local/openresty/nginx/conf/modules-enabled/*.conf;
+
+events {
+      use epoll;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    server_names_hash_bucket_size 512;
+    keepalive_requests 5000;
+
+    gzip on;
+    gzip_min_length  1k;
+    gzip_buffers     4 16k;
+    gzip_http_version 1.1;
+    gzip_comp_level 2;
+    gzip_types     text/plain application/javascript application/x-javascript text/javascript text/css application/xml;
+    gzip_vary on;
+    gzip_proxied   expired no-cache no-store private auth;
+    gzip_disable   "MSIE [1-6]\.";
+
+    limit_conn_zone $binary_remote_addr zone=perip:10m;
+
+    include /usr/local/openresty/nginx/conf/http.d/*.conf;
+    include /usr/local/openresty/nginx/conf/conf.d/*.conf;
+}
+`
+
+func TestIsStockNginxGzipConfig(t *testing.T) {
+	if !isStockNginxGzipConfig(stockNginxConf) {
+		t.Fatal("factory configuration should be detected as stock")
+	}
+}
+
+func TestIsStockNginxGzipConfigRejectsTunedValues(t *testing.T) {
+	cases := map[string]string{
+		"comp level changed": strings.Replace(stockNginxConf, "gzip_comp_level 2;", "gzip_comp_level 6;", 1),
+		"gzip disabled":      strings.Replace(stockNginxConf, "gzip on;", "gzip off;", 1),
+		"types extended": strings.Replace(stockNginxConf,
+			"application/xml;", "application/xml application/json;", 1),
+		"directive removed": strings.Replace(stockNginxConf, "    gzip_vary on;\n", "", 1),
+		"directive added": strings.Replace(stockNginxConf, "    gzip_vary on;\n",
+			"    gzip_vary on;\n    gzip_static on;\n", 1),
+	}
+	for name, content := range cases {
+		if isStockNginxGzipConfig(content) {
+			t.Errorf("%s: tuned configuration must not be rewritten", name)
+		}
+	}
+}
+
+func TestIsStockNginxGzipConfigRejectsDuplicateDirective(t *testing.T) {
+	content := strings.Replace(stockNginxConf, "    gzip on;\n", "    gzip on;\n    gzip on;\n", 1)
+	if isStockNginxGzipConfig(content) {
+		t.Fatal("a duplicated directive indicates a hand-edited config")
+	}
+}
+
+func TestRewriteNginxGzipDirectives(t *testing.T) {
+	result := rewriteNginxGzipDirectives(stockNginxConf)
+
+	for _, expected := range []string{
+		"    gzip_comp_level 5;",
+		"    gzip_proxied any;",
+		"    gzip on;",
+		"    gzip_vary on;",
+	} {
+		if !strings.Contains(result, expected) {
+			t.Errorf("expected directive missing: %s\n%s", expected, result)
+		}
+	}
+	if !strings.Contains(result, "application/json") {
+		t.Error("gzip_types should now cover application/json")
+	}
+	if strings.Contains(result, "gzip_disable") {
+		t.Error("obsolete gzip_disable should have been dropped")
+	}
+	if strings.Contains(result, "gzip_comp_level 2;") {
+		t.Error("stale comp level should have been replaced")
+	}
+	// Everything outside the gzip block must survive untouched.
+	for _, keep := range []string{
+		"server_names_hash_bucket_size 512;",
+		"keepalive_requests 5000;",
+		"limit_conn_zone $binary_remote_addr zone=perip:10m;",
+		"include /usr/local/openresty/nginx/conf/http.d/*.conf;",
+		"include /usr/local/openresty/nginx/conf/conf.d/*.conf;",
+		"include /usr/local/openresty/nginx/conf/modules-enabled/*.conf;",
+		"user  root;",
+	} {
+		if !strings.Contains(result, keep) {
+			t.Errorf("unrelated line was altered or dropped: %s", keep)
+		}
+	}
+	if !strings.HasSuffix(result, "}\n") {
+		t.Error("trailing newline was not preserved")
+	}
+}
+
+func TestRewriteNginxGzipDirectivesIsIdempotent(t *testing.T) {
+	once := rewriteNginxGzipDirectives(stockNginxConf)
+	twice := rewriteNginxGzipDirectives(once)
+	if once != twice {
+		t.Errorf("rewrite is not idempotent:\n--- once ---\n%s\n--- twice ---\n%s", once, twice)
+	}
+}
+
+func TestRewriteNginxGzipDirectivesAppendsMissing(t *testing.T) {
+	// gzip_proxied absent from the source must be appended, not silently lost.
+	content := strings.Replace(stockNginxConf,
+		"    gzip_proxied   expired no-cache no-store private auth;\n", "", 1)
+	result := rewriteNginxGzipDirectives(content)
+	if !strings.Contains(result, "gzip_proxied any;") {
+		t.Errorf("missing directive was not appended:\n%s", result)
+	}
+	if !strings.Contains(result, "limit_conn_zone $binary_remote_addr zone=perip:10m;") {
+		t.Error("appending must not clobber following lines")
+	}
+}
+
+func TestRewriteNginxGzipDirectivesKeepsGzipLikeNames(t *testing.T) {
+	// gunzip and proxy_set_header must survive: only directives whose name
+	// starts with "gzip" are managed here.
+	content := "http {\n    gunzip on;\n    gzip on;\n    proxy_set_header Accept-Encoding gzip;\n}\n"
+	result := rewriteNginxGzipDirectives(content)
+	if !strings.Contains(result, "gunzip on;") {
+		t.Error("gunzip directive must be preserved")
+	}
+	if !strings.Contains(result, "proxy_set_header Accept-Encoding gzip;") {
+		t.Error("proxy_set_header must be preserved")
+	}
+	if !strings.Contains(result, "    gzip on;") {
+		t.Error("gzip directive should be kept in place")
+	}
+}
+
+// The gzip.conf template, the upgrade maps and the appstore defaults are three
+// copies of one intent. Pin the first two so they cannot drift apart silently.
+func TestGzipTemplateMatchesCorrectedDefaults(t *testing.T) {
+	template := nginx_conf.GetWebsiteFile("gzip.conf")
+	if len(template) == 0 {
+		t.Fatal("gzip.conf template is missing from the embedded files")
+	}
+	expected := make(map[string]string, len(stockNginxGzipDirectives))
+	for name, value := range stockNginxGzipDirectives {
+		expected[name] = value
+	}
+	for name := range obsoleteNginxGzipDirectives {
+		delete(expected, name)
+	}
+	for name, value := range correctedNginxGzipDirectives {
+		expected[name] = value
+	}
+	found := make(map[string]string)
+	for _, match := range nginxGzipDirectiveRe.FindAllStringSubmatch(string(template), -1) {
+		found[match[1]] = strings.Join(strings.Fields(match[2]), " ")
+	}
+	if len(found) != len(expected) {
+		t.Fatalf("template has %d directives, corrected defaults have %d", len(found), len(expected))
+	}
+	for name, want := range expected {
+		if got, ok := found[name]; !ok {
+			t.Errorf("template is missing %s", name)
+		} else if got != want {
+			t.Errorf("%s: template has %q, corrected defaults have %q", name, got, want)
+		}
+	}
+}

agent/app/service/nginx_http_config.go

@@ -0,0 +1,245 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+)
+
+const (
+	// nginxHTTPConfDir holds http-context directives generated by 1Panel.
+	// load_module is a main-context directive and therefore lives in
+	// modules-enabled, which cannot host http-context directives such as
+	// "brotli on". The directory is included by nginx.conf before conf.d so
+	// that per-site configuration keeps overriding these defaults.
+	nginxHTTPConfDir = "http.d"
+
+	nginxHTTPConfigPrefix = "1panel-http-"
+	nginxHTTPConfigHeader = "# Managed by 1Panel. Manual changes will be overwritten.\n"
+
+	// nginxHTTPIncludeDirective is the include line that loads the managed
+	// directory. Fresh installs carry it in the shipped nginx.conf; existing
+	// ones get it inserted by the panel the first time a module needs
+	// http-context configuration.
+	nginxHTTPIncludeDirective = "include /usr/local/openresty/nginx/conf/http.d/*.conf;"
+)
+
+var (
+	// nginxHTTPIncludeRe matches the include line wherever it appears. The
+	// absolute path prefix, quoting and whitespace are all optional in the
+	// match so a variant written by an older installer or by hand still
+	// counts; a commented-out copy does not.
+	nginxHTTPIncludeRe = regexp.MustCompile(`(?m)^[ \t]*include\s+"?(/usr/local/openresty/nginx/conf/)?http\.d/\*\.conf"?\s*;[ \t]*\r?$`)
+
+	// nginxConfDIncludeRe locates the site-config include, the preferred
+	// insertion point, and captures its indentation.
+	nginxConfDIncludeRe = regexp.MustCompile(`(?m)^([ \t]*)include\s+"?(/usr/local/openresty/nginx/conf/)?conf\.d/\*\.conf"?\s*;[ \t]*\r?$`)
+
+	// nginxHTTPBlockStartRe locates the http block opening, the fallback
+	// insertion point, and captures its indentation.
+	nginxHTTPBlockStartRe = regexp.MustCompile(`(?m)^([ \t]*)http[ \t]*\{[ \t]*\r?$`)
+)
+
+// nginxHTTPIncludePresent reports whether nginx.conf already loads http.d.
+func nginxHTTPIncludePresent(install model.AppInstall) bool {
+	content, err := os.ReadFile(nginxMainConfigPath(install))
+	if err != nil {
+		return false
+	}
+	return nginxHTTPIncludeRe.MatchString(string(content))
+}
+
+// writeNginxFileAtomic writes through a temp file plus rename so a crash or a
+// concurrent reader never observes a half-written config.
+func writeNginxFileAtomic(filePath string, content []byte) error {
+	tmpPath := filePath + ".tmp"
+	if err := os.WriteFile(tmpPath, content, constant.FilePerm); err != nil {
+		return err
+	}
+	return os.Rename(tmpPath, filePath)
+}
+
+// nginxFileLineEnding picks the file's own style so an inserted or rewritten
+// line does not mix LF into a CRLF file.
+func nginxFileLineEnding(content string) string {
+	if strings.Contains(content, "\r\n") {
+		return "\r\n"
+	}
+	return "\n"
+}
+
+// insertNginxHTTPInclude returns the config with the http.d include added.
+//
+// The include goes right before the conf.d include so panel-managed defaults
+// are evaluated before per-site configuration; without one, it goes at the
+// top of the http block. The inserted line follows the file's own line-ending
+// style, and everything else stays byte-identical. A config without a
+// locatable http block is rejected, and callers degrade instead of failing
+// their operation over it.
+func insertNginxHTTPInclude(content string) (string, error) {
+	if nginxHTTPIncludeRe.MatchString(content) {
+		return content, nil
+	}
+	eol := nginxFileLineEnding(content)
+	if m := nginxConfDIncludeRe.FindStringSubmatchIndex(content); m != nil {
+		indent := content[m[2]:m[3]]
+		return content[:m[0]] + indent + nginxHTTPIncludeDirective + eol + content[m[0]:], nil
+	}
+	if m := nginxHTTPBlockStartRe.FindStringSubmatchIndex(content); m != nil {
+		indent := content[m[2]:m[3]] + "    "
+		return content[:m[1]] + eol + indent + nginxHTTPIncludeDirective + content[m[1]:], nil
+	}
+	return "", errors.New("no insertion point for the http.d include in nginx.conf")
+}
+
+// ensureNginxHTTPIncludeActive makes nginx.conf load http.d, inserting the
+// include when missing. It returns whether the directory is loaded after the
+// call, plus the original config content so the caller can roll back the edit
+// together with the rest of its changes.
+func ensureNginxHTTPIncludeActive(install model.AppInstall) (active bool, snapshot []byte, err error) {
+	configPath := nginxMainConfigPath(install)
+	content, readErr := os.ReadFile(configPath)
+	if readErr != nil {
+		return false, nil, readErr
+	}
+	if nginxHTTPIncludeRe.MatchString(string(content)) {
+		if err = os.MkdirAll(nginxHTTPConfigDir(install), constant.DirPerm); err != nil {
+			return false, nil, err
+		}
+		return true, nil, nil
+	}
+	updated, insErr := insertNginxHTTPInclude(string(content))
+	if insErr != nil {
+		return false, nil, insErr
+	}
+	if err = writeNginxFileAtomic(configPath, []byte(updated)); err != nil {
+		return false, nil, err
+	}
+	if err = os.MkdirAll(nginxHTTPConfigDir(install), constant.DirPerm); err != nil {
+		return false, nil, err
+	}
+	return true, content, nil
+}
+
+// nginxHTTPDirective is a single http-context directive rendered into a
+// managed file.
+type nginxHTTPDirective struct {
+	Name   string
+	Params []string
+}
+
+func (d nginxHTTPDirective) render() string {
+	if len(d.Params) == 0 {
+		return d.Name + ";"
+	}
+	return d.Name + " " + strings.Join(d.Params, " ") + ";"
+}
+
+func nginxHTTPConfigDir(install model.AppInstall) string {
+	return path.Join(install.GetPath(), nginxModuleConfDir, nginxHTTPConfDir)
+}
+
+func nginxHTTPConfigFileName(order int, name string) string {
+	return fmt.Sprintf("%s%04d-%s.conf", nginxHTTPConfigPrefix, order, nginxModulePathName(name))
+}
+
+// renderNginxHTTPConfig builds the content of a managed http.d file.
+func renderNginxHTTPConfig(directives []nginxHTTPDirective) []byte {
+	var content strings.Builder
+	content.WriteString(nginxHTTPConfigHeader)
+	for _, directive := range directives {
+		content.WriteString(directive.render())
+		content.WriteString("\n")
+	}
+	return []byte(content.String())
+}
+
+var nginxHTTPDirectiveRe = regexp.MustCompile(`^[ \t]*([a-z_][a-z0-9_]*)[ \t]+([^;]*);[ \t]*$`)
+
+// readNginxHTTPDirectives parses a managed file back into directive values.
+// A missing or unreadable file yields no directives, which makes callers fall
+// back to their defaults.
+func readNginxHTTPDirectives(filePath string) map[string][]string {
+	content, err := os.ReadFile(filePath)
+	if err != nil {
+		return nil
+	}
+	directives := make(map[string][]string)
+	for _, line := range strings.Split(string(content), "\n") {
+		match := nginxHTTPDirectiveRe.FindStringSubmatch(line)
+		if match == nil {
+			continue
+		}
+		directives[match[1]] = strings.Fields(match[2])
+	}
+	return directives
+}
+
+// snapshotManagedNginxHTTPConfigs captures every managed file so a failed
+// nginx -t can be rolled back.
+func snapshotManagedNginxHTTPConfigs(configDir string) (nginxModuleConfigSnapshot, error) {
+	snapshot := make(nginxModuleConfigSnapshot)
+	entries, err := os.ReadDir(configDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return snapshot, nil
+		}
+		return nil, err
+	}
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasPrefix(entry.Name(), nginxHTTPConfigPrefix) {
+			continue
+		}
+		content, readErr := os.ReadFile(path.Join(configDir, entry.Name()))
+		if readErr != nil {
+			return nil, readErr
+		}
+		snapshot[entry.Name()] = content
+	}
+	return snapshot, nil
+}
+
+// applyManagedNginxHTTPConfigs writes the desired managed files and removes
+// managed files that are no longer wanted. Files not carrying the managed
+// prefix are never touched.
+func applyManagedNginxHTTPConfigs(configDir string, desired map[string][]byte) error {
+	if err := os.MkdirAll(configDir, constant.DirPerm); err != nil {
+		return err
+	}
+	entries, err := os.ReadDir(configDir)
+	if err != nil {
+		return err
+	}
+	names := make([]string, 0, len(desired))
+	for fileName := range desired {
+		names = append(names, fileName)
+	}
+	sort.Strings(names)
+	for _, fileName := range names {
+		tmpPath := path.Join(configDir, "."+fileName+".tmp")
+		if err = os.WriteFile(tmpPath, desired[fileName], constant.FilePerm); err != nil {
+			return err
+		}
+		if err = os.Rename(tmpPath, path.Join(configDir, fileName)); err != nil {
+			return err
+		}
+	}
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasPrefix(entry.Name(), nginxHTTPConfigPrefix) {
+			continue
+		}
+		if _, ok := desired[entry.Name()]; !ok {
+			if err = os.Remove(path.Join(configDir, entry.Name())); err != nil && !os.IsNotExist(err) {
+				return err
+			}
+		}
+	}
+	return nil
+}

agent/app/service/nginx_http_config_test.go

@@ -0,0 +1,176 @@
+package service
+
+import (
+	"strings"
+	"testing"
+)
+
+const plainNginxConf = `user  root;
+worker_processes  auto;
+
+include /usr/local/openresty/nginx/conf/modules-enabled/*.conf;
+
+events {
+      use epoll;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    gzip on;
+    gzip_comp_level 5;
+
+    limit_conn_zone $binary_remote_addr zone=perip:10m;
+
+    include /usr/local/openresty/nginx/conf/conf.d/*.conf;
+    include /usr/local/openresty/nginx/conf/default/*.conf;
+}
+`
+
+func TestInsertNginxHTTPIncludeBeforeConfD(t *testing.T) {
+	got, err := insertNginxHTTPInclude(plainNginxConf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(got, "    "+nginxHTTPIncludeDirective) {
+		t.Fatalf("include not inserted with matching indent:\n%s", got)
+	}
+	// Ordering is the point of the insertion site: panel defaults must be
+	// evaluated before per-site configuration.
+	httpIdx := strings.Index(got, "conf/http.d/*.conf")
+	confDIdx := strings.Index(got, "conf/conf.d/*.conf")
+	if httpIdx < 0 || confDIdx < 0 || httpIdx > confDIdx {
+		t.Fatalf("http.d must be included before conf.d (http.d=%d conf.d=%d)", httpIdx, confDIdx)
+	}
+	// The rest of the file must be untouched.
+	stripped := strings.Replace(got, "    "+nginxHTTPIncludeDirective+"\n", "", 1)
+	if stripped != plainNginxConf {
+		t.Fatal("insertion altered content outside the inserted line")
+	}
+}
+
+func TestInsertNginxHTTPIncludeIsIdempotent(t *testing.T) {
+	once, err := insertNginxHTTPInclude(plainNginxConf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	twice, err := insertNginxHTTPInclude(once)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if twice != once {
+		t.Fatal("a second insertion must be a no-op")
+	}
+}
+
+func TestInsertNginxHTTPIncludeFallsBackToHTTPBlock(t *testing.T) {
+	content := strings.Replace(plainNginxConf,
+		"    include /usr/local/openresty/nginx/conf/conf.d/*.conf;\n", "", 1)
+	got, err := insertNginxHTTPInclude(content)
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpIdx := strings.Index(got, "http {")
+	incIdx := strings.Index(got, nginxHTTPIncludeDirective)
+	if incIdx < 0 || incIdx < httpIdx {
+		t.Fatalf("include should land inside the http block:\n%s", got)
+	}
+	// Indented one level deeper than the http keyword.
+	if !strings.Contains(got, "    "+nginxHTTPIncludeDirective) {
+		t.Errorf("fallback indentation is wrong:\n%s", got)
+	}
+}
+
+func TestInsertNginxHTTPIncludeRejectsConfigWithoutHTTPBlock(t *testing.T) {
+	if _, err := insertNginxHTTPInclude("events {}\n"); err == nil {
+		t.Fatal("a config without an http block must be rejected so callers can degrade")
+	}
+}
+
+func TestInsertNginxHTTPIncludeIgnoresCommentedIncludes(t *testing.T) {
+	commented := strings.Replace(plainNginxConf,
+		"    include /usr/local/openresty/nginx/conf/conf.d/*.conf;",
+		"    # include /usr/local/openresty/nginx/conf/conf.d/*.conf;", 1)
+	got, err := insertNginxHTTPInclude(commented)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The commented conf.d line is not a valid anchor; the fallback must win.
+	if strings.Index(got, nginxHTTPIncludeDirective) < strings.Index(got, "http {") {
+		t.Fatal("a commented include must not be used as the anchor")
+	}
+}
+
+func TestInsertNginxHTTPIncludeHandlesCRLF(t *testing.T) {
+	crlf := strings.ReplaceAll(plainNginxConf, "\n", "\r\n")
+	got, err := insertNginxHTTPInclude(crlf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(got, nginxHTTPIncludeDirective) {
+		t.Fatal("include missing on a CRLF file")
+	}
+}
+
+func TestNginxHTTPIncludeRe(t *testing.T) {
+	cases := []struct {
+		name    string
+		content string
+		want    bool
+	}{
+		{"present", plainNginxConf + "    " + nginxHTTPIncludeDirective + "\n", true},
+		{"absent", plainNginxConf, false},
+		{"commented out", "# " + nginxHTTPIncludeDirective, false},
+		// nginx accepts quoted paths, and a hand-written or legacy installer
+		// may use them; a quoted include must count as present.
+		{"quoted absolute path", `include "/usr/local/openresty/nginx/conf/http.d/*.conf";`, true},
+		{"quoted with extra whitespace", `  include   "/usr/local/openresty/nginx/conf/http.d/*.conf"  ;`, true},
+		{"relative path form", `    include http.d/*.conf;`, true},
+		{"a different directory does not count", `    include /usr/local/openresty/nginx/conf/conf.d/*.conf;`, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := nginxHTTPIncludeRe.MatchString(tc.content); got != tc.want {
+				t.Fatalf("expected %v, got %v", tc.want, got)
+			}
+		})
+	}
+}
+
+// The anchor for insertion must tolerate the same variants, or a config with
+// a quoted conf.d include would take the http-block fallback for no reason.
+func TestInsertNginxHTTPIncludeWithQuotedConfDAnchor(t *testing.T) {
+	quoted := strings.Replace(plainNginxConf,
+		"    include /usr/local/openresty/nginx/conf/conf.d/*.conf;",
+		`    include "/usr/local/openresty/nginx/conf/conf.d/*.conf";`, 1)
+	got, err := insertNginxHTTPInclude(quoted)
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpIdx := strings.Index(got, "conf/http.d/*.conf")
+	confDIdx := strings.Index(got, "conf/conf.d/*.conf")
+	if httpIdx < 0 || confDIdx < 0 || httpIdx > confDIdx {
+		t.Fatalf("quoted anchor not used; include misplaced:\n%s", got)
+	}
+}
+
+// A CRLF file must keep its own line endings after insertion.
+func TestInsertNginxHTTPIncludeKeepsCRLFStyle(t *testing.T) {
+	crlf := strings.ReplaceAll(plainNginxConf, "\n", "\r\n")
+	got, err := insertNginxHTTPInclude(crlf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	idx := strings.Index(got, nginxHTTPIncludeDirective)
+	if idx < 0 {
+		t.Fatal("include missing")
+	}
+	if got[idx-1] == '\n' || (idx >= 2 && got[idx-2:idx] != "\r\n" && got[idx-1] != ' ') {
+		// The inserted line must end with \r\n like the rest of the file.
+	}
+	end := idx + len(nginxHTTPIncludeDirective)
+	if end+2 > len(got) || got[end:end+2] != "\r\n" {
+		t.Fatalf("inserted line does not end with CRLF: %q", got[end:end+4])
+	}
+}

agent/app/service/nginx_module.go

@@ -18,6 +18,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
 	"github.com/1Panel-dev/1Panel/agent/app/task"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
@@ -164,6 +165,51 @@ func nginxModuleDynamicSupported(install model.AppInstall) bool {
 		fileOp.Stat(path.Join(buildPath, nginxModuleCatalogFile))
 }
 
+// nginxModuleStaticSupported reports whether the install can recompile its own
+// OpenResty image, which is what a static module build needs. Versions before
+// dynamic modules existed ship a compose file with a build section and the
+// sources under build/; the oldest ones only reference a prebuilt image and
+// cannot compile anything.
+func nginxModuleStaticSupported(install model.AppInstall) bool {
+	if !files.NewFileOp().Stat(path.Join(install.GetPath(), nginxModuleBuildDir, "Dockerfile")) {
+		return false
+	}
+	envStr, err := coverEnvJsonToStr(install.Env)
+	if err != nil {
+		return false
+	}
+	project, err := dockerUtils.GetComposeProject(install.Name, install.GetPath(),
+		[]byte(install.DockerCompose), []byte(envStr), true)
+	if err != nil {
+		return false
+	}
+	for _, service := range project.AllServices() {
+		if service.Build != nil {
+			return true
+		}
+	}
+	return false
+}
+
+// defaultNginxModuleBuildMode picks the mode an install can actually perform.
+//
+// Module state written before build modes existed carries no buildMode at all.
+// Rejecting it would fail loadNginxModules, and with it every module operation
+// and the upgrade itself, so the value is inferred from what the install can
+// do rather than assumed.
+func defaultNginxModuleBuildMode(install model.AppInstall) string {
+	if nginxModuleDynamicSupported(install) {
+		return nginxModuleBuildDynamic
+	}
+	if nginxModuleStaticSupported(install) {
+		return nginxModuleBuildStatic
+	}
+	// Neither builder is available. Dynamic keeps the module inert instead of
+	// triggering an image rebuild that cannot succeed; the build itself still
+	// reports the missing capability.
+	return nginxModuleBuildDynamic
+}
+
 func syncNginxModuleBuilder(detailBuildDir, installBuildDir string) error {
 	sourcePath := path.Join(detailBuildDir, nginxModuleBuilderFile)
 	targetPath := path.Join(installBuildDir, nginxModuleBuilderFile)
@@ -654,10 +700,56 @@ func reconcileDynamicNginxModuleConfig(install model.AppInstall, modules []dto.N
 			return fmt.Errorf("validate combined dynamic module configuration: %w", err)
 		}
 	}
-	if err = applyManagedNginxModuleConfigs(configDir, desired); err != nil {
+
+	// Runtime directives live in http.d because load_module is main-context
+	// while directives such as "brotli on" are http-context. Both sets are
+	// written before nginx -t runs, so nginx only ever observes the final,
+	// consistent state; on failure both are rolled back together.
+	//
+	// The include that loads http.d is inserted on demand: only when a module
+	// actually needs runtime configuration. An install whose nginx.conf cannot
+	// be edited safely keeps the previous behaviour — the module loads but the
+	// runtime directives are skipped — rather than failing the operation.
+	httpConfigDir := nginxHTTPConfigDir(install)
+	desiredHTTP := desiredNginxModuleRuntimeConfigs(install, modules, target)
+	httpActive := nginxHTTPIncludePresent(install)
+	var nginxConfSnapshot []byte
+	if len(desiredHTTP) > 0 && !httpActive {
+		active, confSnapshot, includeErr := ensureNginxHTTPIncludeActive(install)
+		if includeErr != nil {
+			global.LOG.Warnf("cannot insert the http.d include into nginx.conf, skipping runtime directives: %v", includeErr)
+			desiredHTTP = nil
+		} else {
+			httpActive = active
+			nginxConfSnapshot = confSnapshot
+		}
+	}
+	var httpSnapshot nginxModuleConfigSnapshot
+	if httpActive {
+		if httpSnapshot, err = snapshotManagedNginxHTTPConfigs(httpConfigDir); err != nil {
+			return err
+		}
+	}
+	restore := func() {
 		_ = applyManagedNginxModuleConfigs(configDir, snapshot)
+		if httpActive {
+			_ = applyManagedNginxHTTPConfigs(httpConfigDir, httpSnapshot)
+		}
+		if nginxConfSnapshot != nil {
+			_ = os.WriteFile(nginxMainConfigPath(install), nginxConfSnapshot, constant.FilePerm)
+		}
+	}
+
+	if err = applyManagedNginxModuleConfigs(configDir, desired); err != nil {
+		restore()
 		return err
 	}
+	if httpActive {
+		if err = applyManagedNginxHTTPConfigs(httpConfigDir, desiredHTTP); err != nil {
+			restore()
+			return err
+		}
+	}
 	if !reload {
 		return nil
 	}
@@ -666,11 +758,11 @@ func reconcileDynamicNginxModuleConfig(install model.AppInstall, modules []dto.N
 		return nil
 	}
 	if err = opNginx(install.ContainerName, constant.NginxCheck); err != nil {
-		_ = applyManagedNginxModuleConfigs(configDir, snapshot)
+		restore()
 		return err
 	}
 	if err = opNginx(install.ContainerName, constant.NginxReload); err != nil {
-		_ = applyManagedNginxModuleConfigs(configDir, snapshot)
+		restore()
 		return err
 	}
 	return nil
@@ -722,6 +814,14 @@ func applyManagedNginxModuleConfigs(configDir string, desired map[string][]byte)
 	return nil
 }
 
+// hasEnabledStaticNginxModules reports whether a full image rebuild is needed.
+//
+// Module state is the only input on purpose. RESTY_CONFIG_OPTIONS_MORE in .env
+// is derived state: configureStaticNginxModules rewrites it from the modules
+// below, and every build path calls that function before building. Treating a
+// leftover value as a reason to rebuild would start a full recompile that
+// configureStaticNginxModules has already reduced to an empty option list, so
+// the rebuild could only reproduce the image it started from.
 func hasEnabledStaticNginxModules(modules []dto.NginxModule) bool {
 	for _, module := range modules {
 		normalizeNginxModule(&module)
@@ -732,17 +832,6 @@ func hasEnabledStaticNginxModules(modules []dto.NginxModule) bool {
 	return false
 }
 
-func staticNginxBuildRequired(install model.AppInstall, modules []dto.NginxModule) bool {
-	if hasEnabledStaticNginxModules(modules) {
-		return true
-	}
-	envs, err := gotenv.Read(install.GetEnvPath())
-	if err != nil {
-		return false
-	}
-	return strings.TrimSpace(envs["RESTY_CONFIG_OPTIONS_MORE"]) != ""
-}
-
 func configureStaticNginxModules(install model.AppInstall, modules []dto.NginxModule, mirror string) error {
 	buildPath := path.Join(install.GetPath(), nginxModuleBuildDir)
 	var params, packages []string
@@ -807,11 +896,17 @@ func executeNginxModuleBuild(install model.AppInstall, reqModules []string, forc
 	if err != nil {
 		return err
 	}
-	staticBuild := staticNginxBuildRequired(install, modules)
-	if !staticBuild && hasDynamicNginxModuleBuildTask(modules, reqModules) {
-		if !nginxModuleDynamicSupported(install) {
-			return errors.New("the installed OpenResty version does not support dynamic module builds")
-		}
+	// Only the module list decides this. A leftover RESTY_CONFIG_OPTIONS_MORE
+	// used to force the static path here, which meant a full image rebuild for
+	// an install that has no static module left to compile.
+	staticBuild := hasEnabledStaticNginxModules(modules)
+	if !staticBuild && hasDynamicNginxModuleBuildTask(modules, reqModules) && !nginxModuleDynamicSupported(install) {
+		// The catalog and the builder have always shipped together, and an
+		// install missing the catalog fails to load its module state before
+		// this point, so this branch is a guard rather than a real path. Keep
+		// the error actionable instead of faking a build the state machine
+		// cannot record.
+		return buserr.New("ErrModuleBuildUnsupported")
 	}
 	if staticBuild {
 		return executeStaticNginxModuleBuild(install, modules, mirror, force, parentTask)
@@ -886,7 +981,17 @@ func loadNginxModulesWithCatalog(install model.AppInstall, catalogPath string) (
 			Builds: state.Builds, LastError: state.LastError,
 		})
 	}
+	// Catalog entries always declare a mode; state written before build modes
+	// existed does not. Fill the gap from the install's capabilities so an
+	// upgrade from such a version can still read its own module state.
+	fallbackMode := ""
 	for i := range modules {
+		if modules[i].BuildMode == "" {
+			if fallbackMode == "" {
+				fallbackMode = defaultNginxModuleBuildMode(install)
+			}
+			modules[i].BuildMode = fallbackMode
+		}
 		if err = validateNginxModuleBuildMode(modules[i]); err != nil {
 			return nil, err
 		}

agent/app/service/nginx_module_runtime.go

@@ -0,0 +1,483 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/dto/response"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
+)
+
+// nginxCompressibleTypes is shared by gzip_types and brotli_types so both
+// encoders cover the same content. Already compressed formats (images other
+// than SVG, woff/woff2, archives, media) are deliberately excluded:
+// recompressing them costs CPU and usually grows the payload.
+var nginxCompressibleTypes = []string{
+	"text/plain",
+	"text/css",
+	"text/xml",
+	"text/javascript",
+	"application/json",
+	"application/ld+json",
+	"application/javascript",
+	"application/x-javascript",
+	"application/xml",
+	"application/xhtml+xml",
+	"application/rss+xml",
+	"application/atom+xml",
+	"application/wasm",
+	"image/svg+xml",
+	"font/ttf",
+	"font/otf",
+}
+
+// nginxModuleRuntimeDefaults maps a module to the http-context directives that
+// make it actually do something once loaded. Without these, enabling a module
+// only emits load_module, leaving it loaded but inert.
+//
+// brotli_static is intentionally omitted: nginx does not verify that a .br
+// file is newer than its source, so a stale artifact would be served
+// indefinitely with no error.
+var nginxModuleRuntimeDefaults = map[string][]nginxHTTPDirective{
+	"ngx_brotli": {
+		{Name: "brotli", Params: []string{"on"}},
+		// Brotli level 5 reaches roughly gzip level 9 ratio at a fraction of
+		// the cost. The nginx default of 6 is tuned for static assets and is
+		// too expensive for dynamic responses.
+		{Name: "brotli_comp_level", Params: []string{"5"}},
+		{Name: "brotli_min_length", Params: []string{"1k"}},
+		{Name: "brotli_types", Params: nginxCompressibleTypes},
+	},
+}
+
+// nginxModuleRuntimeLoadOrder keeps managed file names stable and ordered
+// independently of the module load order used for load_module.
+var nginxModuleRuntimeLoadOrder = map[string]int{
+	"ngx_brotli": 100,
+}
+
+func nginxModuleRuntimeOrder(name string) int {
+	if order, ok := nginxModuleRuntimeLoadOrder[name]; ok {
+		return order
+	}
+	return 900
+}
+
+// desiredNginxModuleRuntimeConfigs renders the managed http.d files for every
+// enabled module that has a ready build and known runtime defaults.
+//
+// Values the user changed through the compression settings page are read back
+// from the current managed file, so reconciling after an unrelated module
+// change does not silently reset them to the defaults.
+//
+// A module the user already configured by hand in nginx.conf is skipped
+// entirely. Emitting the same directive from an included file would make nginx
+// reject the configuration as a duplicate, so their setup is left as the only
+// definition.
+func desiredNginxModuleRuntimeConfigs(install model.AppInstall, modules []dto.NginxModule, target dto.NginxModuleTarget) map[string][]byte {
+	desired := make(map[string][]byte)
+	for _, module := range modules {
+		normalizeNginxModule(&module)
+		// A custom module that happens to share a built-in name must not pick
+		// up the built-in's runtime defaults; the table is for catalog modules.
+		if module.Custom {
+			continue
+		}
+		directives, ok := nginxModuleRuntimeDefaults[module.Name]
+		if !ok || !module.Enable {
+			continue
+		}
+		if !nginxModuleRuntimeReady(module, target) {
+			continue
+		}
+		if nginxModuleConfiguredByUser(install, module.Name) {
+			continue
+		}
+		fileName := nginxHTTPConfigFileName(nginxModuleRuntimeOrder(module.Name), module.Name)
+		current := readNginxHTTPDirectives(path.Join(nginxHTTPConfigDir(install), fileName))
+		desired[fileName] = renderNginxHTTPConfig(mergeNginxRuntimeDirectives(directives, current))
+	}
+	return desired
+}
+
+// nginxModuleConfiguredByUser reports whether the user already manages any of
+// the module's directives by hand.
+//
+// Users who enabled brotli before the panel managed it did so by editing
+// nginx.conf or a file it includes. That definition has to keep winning: it is
+// the one nginx has been running with, and adding a second one from http.d
+// would break the configuration outright.
+//
+// Any brotli* directive counts, not just the primary one. A user who only
+// tuned brotli_comp_level has still taken ownership of the block, and nginx
+// allows the same directive at http and server scope, so a site-scoped value
+// must suppress the managed one too.
+func nginxModuleConfiguredByUser(install model.AppInstall, moduleName string) bool {
+	if _, ok := nginxModuleRuntimeDefaults[moduleName]; !ok {
+		return false
+	}
+	for _, filePath := range nginxModuleUserConfigPaths(install) {
+		content, err := os.ReadFile(filePath)
+		if err != nil {
+			continue
+		}
+		if nginxModuleUserDirectiveRe.MatchString(string(content)) {
+			return true
+		}
+	}
+	return false
+}
+
+// nginxModuleUserDirectiveRe matches any active (non-commented) brotli*
+// directive at the start of a line, wherever it was written.
+var nginxModuleUserDirectiveRe = regexp.MustCompile(`(?m)^[ \t]*brotli[a-z_]*[ \t]+[^;\n]*;`)
+
+// nginxModuleUserConfigPaths lists the files that may carry a user's brotli
+// configuration: the main config and the http-scope files it includes. The
+// stream include is skipped on purpose — brotli is an http module and has no
+// business there.
+func nginxModuleUserConfigPaths(install model.AppInstall) []string {
+	return nginxModuleUserConfigPathsWithSiteDir(install, GetWebSiteRootDir())
+}
+
+// nginxModuleUserConfigPathsWithSiteDir is the testable core: the site conf
+// directory is injected so unit tests do not need the settings database.
+func nginxModuleUserConfigPathsWithSiteDir(install model.AppInstall, siteDir string) []string {
+	paths := []string{nginxMainConfigPath(install)}
+	paths = append(paths, globConfFiles(path.Join(siteDir, "conf.d"))...)
+	paths = append(paths, globConfFiles(path.Join(install.GetPath(), nginxModuleConfDir, "default"))...)
+	return paths
+}
+
+func globConfFiles(dir string) []string {
+	matches, err := filepath.Glob(path.Join(dir, "*.conf"))
+	if err != nil {
+		return nil
+	}
+	return matches
+}
+
+// nginxUserDirectivePattern matches a directive the user wrote in nginx.conf,
+// capturing its indentation so a rewrite can keep the line's shape. Leading
+// whitespace only, so a commented-out line never matches.
+func nginxUserDirectivePattern(name string) *regexp.Regexp {
+	return regexp.MustCompile(`(?m)^([ \t]*)` + regexp.QuoteMeta(name) + `[ \t]+[^;\n]*;`)
+}
+
+// nginxConfigDefinesDirective reports whether a directive is set anywhere in
+// the file, ignoring commented-out lines.
+func nginxConfigDefinesDirective(content, name string) bool {
+	return nginxUserDirectivePattern(name).MatchString(content)
+}
+
+// mergeNginxRuntimeDirectives keeps the declared directive set and ordering
+// while preferring values already present in the managed file.
+func mergeNginxRuntimeDirectives(defaults []nginxHTTPDirective, current map[string][]string) []nginxHTTPDirective {
+	if len(current) == 0 {
+		return defaults
+	}
+	merged := make([]nginxHTTPDirective, 0, len(defaults))
+	for _, directive := range defaults {
+		if params, ok := current[directive.Name]; ok && len(params) > 0 {
+			directive.Params = params
+		}
+		merged = append(merged, directive)
+	}
+	return merged
+}
+
+// nginxBrotliModuleName is the catalog name of the brotli module.
+const nginxBrotliModuleName = "ngx_brotli"
+
+// getNginxBrotliParams reports the brotli settings currently in effect, and
+// where they come from.
+//
+// Brotli is normally served from the managed http.d file instead of
+// nginx.conf, so the directives can be removed together with the module. When
+// the module is disabled the declared defaults are returned, which lets the
+// settings page show what would be applied once it is enabled.
+//
+// If the user configured brotli anywhere nginx loads it from, those values
+// are reported instead and ManagedExternally is set. Showing the managed
+// defaults there would misrepresent what the server is actually running, and
+// the panel must not write a second copy.
+func getNginxBrotliParams() (*response.NginxBrotliRes, error) {
+	install, err := getAppInstallByKey(constant.AppOpenresty)
+	if err != nil {
+		return nil, err
+	}
+	managedExternally := nginxModuleConfiguredByUser(install, nginxBrotliModuleName)
+	var current map[string][]string
+	if managedExternally {
+		current = readNginxUserBrotliDirectives(install)
+	} else {
+		fileName := nginxHTTPConfigFileName(nginxModuleRuntimeOrder(nginxBrotliModuleName), nginxBrotliModuleName)
+		current = readNginxHTTPDirectives(path.Join(nginxHTTPConfigDir(install), fileName))
+	}
+	res := &response.NginxBrotliRes{
+		ManagedExternally: managedExternally,
+		// Without the include, values the panel would write would never reach
+		// nginx, so they are reported as unavailable rather than shown as if
+		// they were in effect.
+		ManagedUnavailable: !managedExternally && !nginxHTTPIncludePresent(install),
+	}
+	for _, directive := range mergeNginxRuntimeDirectives(nginxModuleRuntimeDefaults[nginxBrotliModuleName], current) {
+		res.Params = append(res.Params, response.NginxParam{Name: directive.Name, Params: directive.Params})
+	}
+	return res, nil
+}
+
+// readNginxUserBrotliDirectives collects the brotli directives the user wrote
+// in any of the files nginx loads them from.
+func readNginxUserBrotliDirectives(install model.AppInstall) map[string][]string {
+	directives := make(map[string][]string)
+	for _, filePath := range nginxModuleUserConfigPaths(install) {
+		content, err := os.ReadFile(filePath)
+		if err != nil {
+			continue
+		}
+		for _, name := range dto.BrotliKeys {
+			pattern := regexp.MustCompile(`(?m)^[ \t]*` + regexp.QuoteMeta(name) + `[ \t]+([^;\n]*);`)
+			if match := pattern.FindStringSubmatch(string(content)); match != nil {
+				if _, exists := directives[name]; !exists {
+					directives[name] = strings.Fields(strings.TrimSpace(match[1]))
+				}
+			}
+		}
+	}
+	return directives
+}
+
+// nginxBrotliValueRe whitelists what a brotli value may contain. The values
+// are written into nginx.conf and the managed files verbatim; rejecting
+// anything outside this set blocks both directive injection (`;`, newline,
+// braces, quotes) and the `$` group-reference expansion of
+// regexp.ReplaceAllString, which the in-place rewrite uses.
+var nginxBrotliValueRe = regexp.MustCompile(`^[a-zA-Z0-9._+\-/:* ]+$`)
+
+// validateNginxBrotliValues rejects any value outside the whitelist. The UI
+// only sends on/off, numbers and sizes, but the endpoint is reachable
+// directly.
+func validateNginxBrotliValues(values map[string][]string) error {
+	for name, params := range values {
+		for _, param := range params {
+			if !nginxBrotliValueRe.MatchString(param) {
+				return buserr.WithDetail("ErrInvalidParams", fmt.Sprintf("invalid value for %s", name), nil)
+			}
+		}
+	}
+	return nil
+}
+
+// updateNginxBrotliParams persists brotli settings to the managed http.d file.
+//
+// Writing is refused unless the module is enabled and built: the directives
+// would reference a module that is not loaded and nginx would fail to start.
+func updateNginxBrotliParams(params []dto.NginxParam) error {
+	install, err := getAppInstallByKey(constant.AppOpenresty)
+	if err != nil {
+		return err
+	}
+	modules, err := loadNginxModules(install)
+	if err != nil {
+		return err
+	}
+	values := make(map[string][]string, len(params))
+	for _, param := range params {
+		values[param.Name] = param.Params
+	}
+	if err = validateNginxBrotliValues(values); err != nil {
+		return err
+	}
+	for i := range modules {
+		if modules[i].Name != nginxBrotliModuleName {
+			continue
+		}
+		if !modules[i].Enable {
+			return buserr.New("ErrBrotliDisabled")
+		}
+		// The user configured brotli in nginx.conf before the panel managed
+		// it. Update those lines in place: writing a managed file as well
+		// would define every directive twice and nginx would refuse to start.
+		if nginxModuleConfiguredByUser(install, nginxBrotliModuleName) {
+			return updateUserNginxBrotliParams(install, values)
+		}
+		// A managed write needs the include. Installations missing it are
+		// upgraded in place here; when nginx.conf cannot be edited safely the
+		// write is refused with an actionable error instead of writing values
+		// nginx would never load.
+		if !nginxHTTPIncludePresent(install) {
+			configPath := nginxMainConfigPath(install)
+			content, readErr := os.ReadFile(configPath)
+			if readErr != nil {
+				return readErr
+			}
+			updated, insErr := insertNginxHTTPInclude(string(content))
+			if insErr != nil {
+				return buserr.New("ErrBrotliUnsupported")
+			}
+			if err = writeNginxFileAtomic(configPath, []byte(updated)); err != nil {
+				return err
+			}
+			if err = os.MkdirAll(nginxHTTPConfigDir(install), constant.DirPerm); err != nil {
+				return err
+			}
+			if err = nginxCheckAndReload(string(content), configPath, install.ContainerName); err != nil {
+				return err
+			}
+		}
+		fileName := nginxHTTPConfigFileName(nginxModuleRuntimeOrder(nginxBrotliModuleName), nginxBrotliModuleName)
+		configDir := nginxHTTPConfigDir(install)
+		snapshot, snapErr := snapshotManagedNginxHTTPConfigs(configDir)
+		if snapErr != nil {
+			return snapErr
+		}
+		merged := mergeNginxRuntimeDirectives(nginxModuleRuntimeDefaults[nginxBrotliModuleName], values)
+		desired := map[string][]byte{fileName: renderNginxHTTPConfig(merged)}
+		for name, content := range snapshot {
+			if name != fileName {
+				desired[name] = content
+			}
+		}
+		if err = applyManagedNginxHTTPConfigs(configDir, desired); err != nil {
+			_ = applyManagedNginxHTTPConfigs(configDir, snapshot)
+			return err
+		}
+		if err = opNginx(install.ContainerName, constant.NginxCheck); err != nil {
+			_ = applyManagedNginxHTTPConfigs(configDir, snapshot)
+			return err
+		}
+		if err = opNginx(install.ContainerName, constant.NginxReload); err != nil {
+			_ = applyManagedNginxHTTPConfigs(configDir, snapshot)
+			return err
+		}
+		// The directory is bind-mounted read-only and the include is a glob: a
+		// missing mount or an unrecognised include lets nginx -t pass while
+		// loading nothing. Read the effective configuration back instead of
+		// trusting the files we wrote.
+		if err = assertNginxBrotliActive(install.ContainerName); err != nil {
+			_ = applyManagedNginxHTTPConfigs(configDir, snapshot)
+			return buserr.New("ErrBrotliUnsupported")
+		}
+		return nil
+	}
+	return buserr.New("ErrBrotliDisabled")
+}
+
+// assertNginxBrotliActive confirms the managed brotli directives are in the
+// running server's effective configuration. It is the only check that catches
+// a bind mount that never reached the container or an include variant the
+// detection missed — both pass nginx -t and reload silently.
+func assertNginxBrotliActive(containerName string) error {
+	out, err := cmd.NewCommandMgr(cmd.WithTimeout(20*time.Second)).RunWithStdout(
+		"docker", "exec", "-i", containerName, "nginx", "-T")
+	if err != nil {
+		return err
+	}
+	if !nginxModuleUserDirectiveRe.MatchString(out) {
+		return errors.New("brotli directives are not in the effective nginx configuration")
+	}
+	return nil
+}
+
+// updateUserNginxBrotliParams rewrites the brotli directives the user wrote
+// into nginx.conf, in place.
+//
+// Only the values change: each directive keeps its original line and
+// indentation, and every other line is untouched, so a hand-maintained config
+// survives an edit from the settings page. Directives the user did not write
+// are not introduced, since the panel cannot know where they intended them.
+//
+// A managed file can still be on disk when the panel managed brotli before
+// the user wrote their own directives. Leaving it behind would make every
+// directive duplicate once the user's config is touched, so it is removed
+// first and rolled back together with the config on a failed nginx -t.
+func updateUserNginxBrotliParams(install model.AppInstall, values map[string][]string) error {
+	configPath := nginxMainConfigPath(install)
+	content, err := os.ReadFile(configPath)
+	if err != nil {
+		return err
+	}
+	configDir := nginxHTTPConfigDir(install)
+	httpSnapshot, snapErr := snapshotManagedNginxHTTPConfigs(configDir)
+	if snapErr != nil {
+		return snapErr
+	}
+	managedFile := nginxHTTPConfigFileName(nginxModuleRuntimeOrder(nginxBrotliModuleName), nginxBrotliModuleName)
+	if _, stale := httpSnapshot[managedFile]; stale {
+		remaining := make(map[string][]byte, len(httpSnapshot))
+		for name, fileContent := range httpSnapshot {
+			if name != managedFile {
+				remaining[name] = fileContent
+			}
+		}
+		if err = applyManagedNginxHTTPConfigs(configDir, remaining); err != nil {
+			return err
+		}
+	}
+	restore := func() {
+		_ = writeNginxFileAtomic(configPath, content)
+		_ = applyManagedNginxHTTPConfigs(configDir, httpSnapshot)
+	}
+
+	updated := string(content)
+	for _, name := range dto.BrotliKeys {
+		params, ok := values[name]
+		if !ok || len(params) == 0 {
+			continue
+		}
+		pattern := nginxUserDirectivePattern(name)
+		if !pattern.MatchString(updated) {
+			continue
+		}
+		replacement := "${1}" + name + " " + strings.Join(params, " ") + ";"
+		updated = pattern.ReplaceAllString(updated, replacement)
+	}
+	if updated == string(content) {
+		return nil
+	}
+	if err = writeNginxFileAtomic(configPath, []byte(updated)); err != nil {
+		restore()
+		return err
+	}
+	if err = opNginx(install.ContainerName, constant.NginxCheck); err != nil {
+		restore()
+		return err
+	}
+	if err = opNginx(install.ContainerName, constant.NginxReload); err != nil {
+		restore()
+		return err
+	}
+	return nil
+}
+
+// nginxModuleRuntimeReady reports whether the module is actually usable.
+//
+// Dynamic modules need a ready build for the current target, otherwise the
+// .so is missing and nginx would reject the directives. Static modules are
+// compiled into the binary and carry no artifacts, so an enabled static
+// module is considered ready. This rests on a data premise: the catalog only
+// declares a module static when the image ships it. Checking for a build
+// record instead would be wrong here — reconcile runs inside the static build
+// flow, before the record for the build in progress exists, and would drop
+// the runtime configuration of the module that was just compiled in.
+func nginxModuleRuntimeReady(module dto.NginxModule, target dto.NginxModuleTarget) bool {
+	if module.BuildMode == nginxModuleBuildStatic {
+		return true
+	}
+	build := findCurrentNginxModuleBuild(module, target)
+	if build == nil || build.Status != nginxModuleStatusReady {
+		build = findLatestNginxModuleBuild(module, target)
+	}
+	return build != nil && build.Status == nginxModuleStatusReady
+}

agent/app/service/nginx_module_runtime_test.go

@@ -0,0 +1,231 @@
+package service
+
+import (
+	"os"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/global"
+)
+
+const userBrotliConf = `user  root;
+worker_processes  auto;
+
+include /usr/local/openresty/nginx/conf/modules-enabled/*.conf;
+
+events { use epoll; }
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    gzip on;
+    gzip_comp_level 5;
+
+    # enabled by hand, long before the panel managed it
+    brotli on;
+    brotli_comp_level 6;
+    brotli_types text/plain text/css application/json;
+
+    include /usr/local/openresty/nginx/conf/http.d/*.conf;
+    include /usr/local/openresty/nginx/conf/conf.d/*.conf;
+}
+`
+
+func TestNginxConfigDefinesDirective(t *testing.T) {
+	cases := []struct {
+		name    string
+		content string
+		want    bool
+	}{
+		{"directive present", userBrotliConf, true},
+		{"absent", strings.Replace(userBrotliConf, "    brotli on;\n", "", 1), false},
+		{
+			name:    "commented out does not count",
+			content: strings.Replace(userBrotliConf, "    brotli on;", "    # brotli on;", 1),
+			want:    false,
+		},
+		{
+			name:    "a longer directive name is not a match",
+			content: "http {\n    brotli_comp_level 6;\n}\n",
+			want:    false,
+		},
+		{
+			name:    "indentation does not matter",
+			content: "http {\n\t\tbrotli on;\n}\n",
+			want:    true,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := nginxConfigDefinesDirective(tc.content, "brotli"); got != tc.want {
+				t.Fatalf("expected %v, got %v", tc.want, got)
+			}
+		})
+	}
+}
+
+// The detection must catch any brotli* directive, in any file nginx loads it
+// from, not only the primary directive in nginx.conf.
+func TestNginxModuleUserDirectiveRe(t *testing.T) {
+	cases := []struct {
+		name    string
+		content string
+		want    bool
+	}{
+		{"primary directive", "http {\n    brotli on;\n}", true},
+		{"a tuning directive alone", "server {\n    brotli_comp_level 11;\n}", true},
+		{"another variant", "http {\n    brotli_types text/plain;\n}", true},
+		{"server scope in a site file", "server {\n    listen 80;\n    brotli on;\n}", true},
+		{"commented out does not count", "http {\n    # brotli on;\n}", false},
+		{"indented comment does not count", "http {\n        # brotli_comp_level 6;\n}", false},
+		{"no brotli at all", "http {\n    gzip on;\n}", false},
+		{"a similarly named directive is not a match", "http {\n    gzip on;\n}", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := nginxModuleUserDirectiveRe.MatchString(tc.content); got != tc.want {
+				t.Fatalf("expected %v, got %v", tc.want, got)
+			}
+		})
+	}
+}
+
+// The panel must not emit a managed file for a module the user already
+// configured: nginx rejects the same directive defined twice.
+func TestUserConfiguredBrotliSuppressesManagedFile(t *testing.T) {
+	if !nginxModuleUserDirectiveRe.MatchString(userBrotliConf) {
+		t.Fatal("a hand-written brotli config must be detected")
+	}
+	clean := strings.Replace(userBrotliConf, "    brotli on;\n", "", 1)
+	clean = strings.Replace(clean, "    brotli_comp_level 6;\n", "", 1)
+	clean = strings.Replace(clean, "    brotli_types text/plain text/css application/json;\n", "", 1)
+	if nginxModuleUserDirectiveRe.MatchString(clean) {
+		t.Fatal("a config without brotli must not be treated as user-managed")
+	}
+}
+
+func TestRewriteUserBrotliDirectivesInPlace(t *testing.T) {
+	// Mirrors updateUserNginxBrotliParams without touching the filesystem.
+	rewrite := func(content string, values map[string][]string) string {
+		updated := content
+		for _, name := range []string{"brotli", "brotli_comp_level", "brotli_min_length", "brotli_types"} {
+			params, ok := values[name]
+			if !ok || len(params) == 0 {
+				continue
+			}
+			pattern := nginxUserDirectivePattern(name)
+			if !pattern.MatchString(updated) {
+				continue
+			}
+			updated = pattern.ReplaceAllString(updated, "${1}"+name+" "+strings.Join(params, " ")+";")
+		}
+		return updated
+	}
+
+	got := rewrite(userBrotliConf, map[string][]string{
+		"brotli":            {"off"},
+		"brotli_comp_level": {"4"},
+		// brotli_min_length is absent from the user's config and must not be
+		// introduced: the panel cannot know where they would want it.
+		"brotli_min_length": {"2k"},
+	})
+
+	if !strings.Contains(got, "    brotli off;") {
+		t.Errorf("value was not updated:\n%s", got)
+	}
+	if !strings.Contains(got, "    brotli_comp_level 4;") {
+		t.Errorf("comp level was not updated:\n%s", got)
+	}
+	if strings.Contains(got, "brotli_min_length") {
+		t.Error("a directive the user never wrote must not be added")
+	}
+	// Everything else survives, including the comment the parser would drop.
+	for _, keep := range []string{
+		"# enabled by hand, long before the panel managed it",
+		"    gzip on;",
+		"    gzip_comp_level 5;",
+		"    brotli_types text/plain text/css application/json;",
+		"include /usr/local/openresty/nginx/conf/conf.d/*.conf;",
+		"worker_processes  auto;",
+	} {
+		if !strings.Contains(got, keep) {
+			t.Errorf("unrelated line was altered or lost: %s", keep)
+		}
+	}
+	if strings.Count(got, "brotli on;")+strings.Count(got, "brotli off;") != 1 {
+		t.Error("the directive must remain defined exactly once")
+	}
+}
+
+func TestRewriteUserBrotliPreservesIndentation(t *testing.T) {
+	content := "http {\n\t\tbrotli on;\n}\n"
+	pattern := nginxUserDirectivePattern("brotli")
+	got := pattern.ReplaceAllString(content, "${1}brotli off;")
+	if !strings.Contains(got, "\t\tbrotli off;") {
+		t.Errorf("original indentation was not preserved: %q", got)
+	}
+}
+
+// Detection must cover the default/ directory, which is included at http
+// scope like conf.d but lives under the install directory, not the site root.
+func TestNginxModuleUserConfigPathsCoversDefaultDir(t *testing.T) {
+	siteDir := t.TempDir()
+	installRoot := t.TempDir()
+	installDir := path.Join(installRoot, "openresty", "openresty")
+	defaultDir := path.Join(installDir, "conf", "default")
+	if err := os.MkdirAll(defaultDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path.Join(defaultDir, "00.default.conf"), []byte("server {}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	global.Dir.AppInstallDir = installRoot
+	install := model.AppInstall{Name: "openresty"}
+	install.App.Key = constant.AppOpenresty
+
+	paths := nginxModuleUserConfigPathsWithSiteDir(install, siteDir)
+	foundMain, foundDefault := false, false
+	for _, p := range paths {
+		if strings.HasSuffix(p, path.Join("conf", "nginx.conf")) {
+			foundMain = true
+		}
+		if strings.HasSuffix(p, path.Join("conf", "default", "00.default.conf")) {
+			foundDefault = true
+		}
+	}
+	if !foundMain {
+		t.Error("nginx.conf must be scanned")
+	}
+	if !foundDefault {
+		t.Error("conf/default must be scanned: it is included at http scope")
+	}
+}
+
+// Values outside the whitelist must never reach nginx.conf or the managed
+// files: they could inject directives or trigger regexp group expansion.
+func TestValidateNginxBrotliValues(t *testing.T) {
+	valid := map[string][]string{
+		"brotli":            {"on"},
+		"brotli_comp_level": {"11"},
+		"brotli_min_length": {"1k"},
+		"brotli_types":      {"text/plain", "application/json", "application/ld+json"},
+	}
+	if err := validateNginxBrotliValues(valid); err != nil {
+		t.Fatalf("legitimate values rejected: %v", err)
+	}
+	for name, bad := range map[string]string{
+		"directive injection": "off; gzip on",
+		"newline injection":   "off\nbrotli off;",
+		"group reference":     "$1",
+		"brace":               "${1}",
+		"quote":               `"on"`,
+	} {
+		if err := validateNginxBrotliValues(map[string][]string{"brotli": {bad}}); err == nil {
+			t.Errorf("%s: %q must be rejected", name, bad)
+		}
+	}
+}

agent/app/service/nginx_module_static_test.go

@@ -0,0 +1,83 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto"
+)
+
+func TestHasEnabledStaticNginxModules(t *testing.T) {
+	cases := []struct {
+		name    string
+		modules []dto.NginxModule
+		want    bool
+	}{
+		{
+			name: "an enabled static module requires a rebuild",
+			modules: []dto.NginxModule{
+				{Name: "custom", Enable: true, BuildMode: nginxModuleBuildStatic},
+			},
+			want: true,
+		},
+		{
+			name: "a disabled static module does not",
+			modules: []dto.NginxModule{
+				{Name: "custom", Enable: false, BuildMode: nginxModuleBuildStatic},
+			},
+			want: false,
+		},
+		{
+			name: "dynamic modules never require a rebuild",
+			modules: []dto.NginxModule{
+				{Name: "ngx_brotli", Enable: true, BuildMode: nginxModuleBuildDynamic},
+			},
+			want: false,
+		},
+		{
+			name:    "no modules at all",
+			modules: nil,
+			want:    false,
+		},
+		{
+			name: "one enabled static module among dynamic ones is enough",
+			modules: []dto.NginxModule{
+				{Name: "ngx_brotli", Enable: true, BuildMode: nginxModuleBuildDynamic},
+				{Name: "custom", Enable: true, BuildMode: nginxModuleBuildStatic},
+			},
+			want: true,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := hasEnabledStaticNginxModules(tc.modules); got != tc.want {
+				t.Fatalf("expected %v, got %v", tc.want, got)
+			}
+		})
+	}
+}
+
+// A stale RESTY_CONFIG_OPTIONS_MORE used to force the full-rebuild path even
+// with no static module enabled. configureStaticNginxModules derives that value
+// from the module list and runs before every build, so the rebuild it triggered
+// could only ever reproduce the current image. Module state is now the only
+// input; this test pins that down.
+func TestStaticRebuildIgnoresLeftoverBuildOptions(t *testing.T) {
+	modules := []dto.NginxModule{
+		{Name: "ngx_brotli", Enable: true, BuildMode: nginxModuleBuildDynamic},
+	}
+	if hasEnabledStaticNginxModules(modules) {
+		t.Fatal("dynamic-only modules must not select the static build path")
+	}
+}
+
+// normalizeNginxModule is applied to a copy, so callers keep their entities.
+func TestHasEnabledStaticNginxModulesDoesNotMutateInput(t *testing.T) {
+	modules := []dto.NginxModule{
+		{Name: "custom", Enable: true, BuildMode: nginxModuleBuildStatic, Packages: []string{"", "libfoo", ""}},
+	}
+	_ = hasEnabledStaticNginxModules(modules)
+	if len(modules[0].Packages) != 3 {
+		t.Fatalf("input was normalized in place: %v", modules[0].Packages)
+	}
+}
+

agent/app/service/runtime.go

@@ -640,6 +640,12 @@ func (r *RuntimeService) Update(req request.RuntimeUpdate) error {
 		runtime.Version = req.Version
 		return runtimeRepo.Save(runtime)
 	}
+	appDetail, err := getRuntimeUpdateAppDetail(runtime, req)
+	if err != nil {
+		return err
+	}
+	versionChanged := appDetail.ID != runtime.AppDetailID || appDetail.Version != runtime.Version
+	req.Version = appDetail.Version
 	oldImage := runtime.Image
 	oldEnv := runtime.Env
 	var hostPorts []string
@@ -659,23 +665,6 @@ func (r *RuntimeService) Update(req request.RuntimeUpdate) error {
 			}
 		}
 
-		appDetail, err := appDetailRepo.GetFirst(repo.WithByID(runtime.AppDetailID))
-		if err != nil {
-			return err
-		}
-		app, err := appRepo.GetFirst(repo.WithByID(appDetail.AppId))
-		if err != nil {
-			return err
-		}
-		fileOp := files.NewFileOp()
-		appVersionDir := path.Join(global.Dir.AppResourceDir, app.Resource, app.Key, appDetail.Version)
-		if !fileOp.Stat(appVersionDir) || appDetail.Update {
-			if err := downloadApp(app, appDetail, nil, nil); err != nil {
-				return err
-			}
-			_ = fileOp.Rename(path.Join(runtime.GetPath(), "run.sh"), path.Join(runtime.GetPath(), "run.sh.bak"))
-			_ = fileOp.CopyFile(path.Join(appVersionDir, "run.sh"), runtime.GetPath())
-		}
 	}
 
 	if containerName, ok := req.Params["CONTAINER_NAME"]; ok && containerName != getRuntimeEnv(runtime.Env, "CONTAINER_NAME") {
@@ -685,6 +674,36 @@ func (r *RuntimeService) Update(req request.RuntimeUpdate) error {
 		runtime.ContainerName = containerName.(string)
 	}
 
+	app, err := appRepo.GetFirst(repo.WithByID(appDetail.AppId))
+	if err != nil {
+		return err
+	}
+	fileOp := files.NewFileOp()
+	appVersionDir := filepath.Join(app.GetAppResourcePath(), appDetail.Version)
+	refreshTemplate := !fileOp.Stat(appVersionDir) || appDetail.Update
+	if err = downloadApp(app, appDetail, nil, nil); err != nil {
+		return err
+	}
+	if versionChanged {
+		if err = updateRuntimeVersionFiles(runtime, appVersionDir); err != nil {
+			return err
+		}
+	} else if refreshTemplate && runtime.Type != constant.RuntimePHP {
+		if err = fileOp.CopyFile(filepath.Join(appVersionDir, "run.sh"), runtime.GetPath()); err != nil {
+			return err
+		}
+	}
+	if runtime.Type == constant.RuntimePHP {
+		composeContent, err := fileOp.GetContent(runtime.GetComposePath())
+		if err != nil {
+			return err
+		}
+		req.Environments, err = getDockerComposeEnvironments(composeContent)
+		if err != nil {
+			return err
+		}
+	}
+
 	projectDir := path.Join(global.Dir.RuntimeDir, runtime.Type, runtime.Name)
 	create := request.RuntimeCreate{
 		Image:   req.Image,
@@ -702,19 +721,21 @@ func (r *RuntimeService) Update(req request.RuntimeUpdate) error {
 			ExtraHosts:   req.ExtraHosts,
 		},
 	}
-	composeContent, envContent, _, err := handleParams(create, projectDir)
+	composeContent, envContent, forms, err := handleParams(create, projectDir)
 	if err != nil {
 		return err
 	}
 	runtime.Remark = req.Remark
+	runtime.AppDetailID = appDetail.ID
+	runtime.Version = appDetail.Version
 	runtime.Env = string(envContent)
 	runtime.DockerCompose = string(composeContent)
 
 	switch runtime.Type {
 	case constant.RuntimePHP:
 		runtime.Image = req.Image
+		runtime.Params = string(forms)
 		runtime.Status = constant.StatusBuilding
-		_ = runtimeRepo.Save(runtime)
 		client, err := docker.NewClient()
 		if err != nil {
 			return err
@@ -724,14 +745,18 @@ func (r *RuntimeService) Update(req request.RuntimeUpdate) error {
 		if err != nil {
 			return err
 		}
-		go buildRuntime(runtime, imageID, oldEnv, req.Rebuild)
+		if err = runtimeRepo.Save(runtime); err != nil {
+			return err
+		}
+		go buildRuntime(runtime, imageID, oldEnv, req.Rebuild || versionChanged)
 	case constant.RuntimeNode, constant.RuntimeJava, constant.RuntimeGo, constant.RuntimePython, constant.RuntimeDotNet:
-		runtime.Version = req.Version
 		runtime.CodeDir = req.CodeDir
 		runtime.Port = strings.Join(hostPorts, ",")
 		runtime.Status = constant.StatusReCreating
 		runtime.ContainerName = req.Params["CONTAINER_NAME"].(string)
-		_ = runtimeRepo.Save(runtime)
+		if err = runtimeRepo.Save(runtime); err != nil {
+			return err
+		}
 		go reCreateRuntime(runtime)
 	}
 	return nil

agent/app/service/runtime_update.go

@@ -0,0 +1,106 @@
+package service
+
+import (
+	"path/filepath"
+
+	"github.com/1Panel-dev/1Panel/agent/app/dto/request"
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
+	"github.com/1Panel-dev/1Panel/agent/constant"
+	"github.com/1Panel-dev/1Panel/agent/utils/files"
+	"gopkg.in/yaml.v3"
+)
+
+func getRuntimeUpdateAppDetail(runtime *model.Runtime, req request.RuntimeUpdate) (model.AppDetail, error) {
+	current, err := appDetailRepo.GetFirst(repo.WithByID(runtime.AppDetailID))
+	if err != nil {
+		return model.AppDetail{}, err
+	}
+	if current.ID == 0 {
+		return model.AppDetail{}, buserr.New("ErrRecordNotFound")
+	}
+	opts := []repo.DBOption{appDetailRepo.WithAppId(current.AppId)}
+	if req.AppDetailID != 0 {
+		opts = append(opts, repo.WithByID(req.AppDetailID))
+	} else if req.Version != "" {
+		opts = append(opts, appDetailRepo.WithVersion(req.Version))
+	} else {
+		return current, nil
+	}
+	detail, err := appDetailRepo.GetFirst(opts...)
+	if err != nil {
+		return model.AppDetail{}, err
+	}
+	if detail.ID == 0 || (req.Version != "" && detail.Version != req.Version) {
+		return model.AppDetail{}, buserr.New("ErrInvalidParams")
+	}
+	return detail, nil
+}
+
+func updateRuntimeVersionFiles(runtime *model.Runtime, appVersionDir string) error {
+	fileOp := files.NewFileOp()
+	template, err := fileOp.GetContent(filepath.Join(appVersionDir, "docker-compose.yml"))
+	if err != nil {
+		return err
+	}
+	current, err := fileOp.GetContent(runtime.GetComposePath())
+	if err != nil {
+		return err
+	}
+	composeContent, err := updateRuntimeImageConfig(current, template)
+	if err != nil {
+		return err
+	}
+	if runtime.Type == constant.RuntimePHP {
+		if err = fileOp.CopyDir(filepath.Join(appVersionDir, "build"), runtime.GetPath()); err != nil {
+			return err
+		}
+		if err = fileOp.CopyFile(filepath.Join(appVersionDir, "data.yml"), runtime.GetPath()); err != nil {
+			return err
+		}
+	} else {
+		if err = fileOp.CopyFile(filepath.Join(appVersionDir, "run.sh"), runtime.GetPath()); err != nil {
+			return err
+		}
+	}
+	return fileOp.SaveFile(runtime.GetComposePath(), string(composeContent), constant.FilePerm)
+}
+
+func updateRuntimeImageConfig(current, template []byte) ([]byte, error) {
+	var currentCompose, templateCompose map[string]interface{}
+	if err := yaml.Unmarshal(current, &currentCompose); err != nil {
+		return nil, err
+	}
+	if err := yaml.Unmarshal(template, &templateCompose); err != nil {
+		return nil, err
+	}
+	currentServices, ok := currentCompose["services"].(map[string]interface{})
+	if !ok || len(currentServices) != 1 {
+		return nil, buserr.New("ErrFileParse")
+	}
+	templateServices, ok := templateCompose["services"].(map[string]interface{})
+	if !ok || len(templateServices) != 1 {
+		return nil, buserr.New("ErrFileParse")
+	}
+	// Keep container settings and mounts; only the image and build definition belong to the version.
+	for _, currentService := range currentServices {
+		service, ok := currentService.(map[string]interface{})
+		if !ok {
+			return nil, buserr.New("ErrFileParse")
+		}
+		for _, templateService := range templateServices {
+			target, ok := templateService.(map[string]interface{})
+			if !ok || (target["image"] == nil && target["build"] == nil) {
+				return nil, buserr.New("ErrFileParse")
+			}
+			for _, key := range []string{"image", "build"} {
+				delete(service, key)
+				if value, exists := target[key]; exists {
+					service[key] = value
+				}
+			}
+		}
+	}
+	return yaml.Marshal(currentCompose)
+}

agent/app/service/runtime_utils.go

@@ -838,21 +838,49 @@ func restartRuntime(runtime *model.Runtime) (err error) {
 }
 
 func getDockerComposeEnvironments(yml []byte) ([]request.Environment, error) {
-	var (
-		composeProject docker.ComposeProject
-		err            error
-	)
-	err = yaml.Unmarshal(yml, &composeProject)
-	if err != nil {
+	var project struct {
+		Services yaml.Node `yaml:"services"`
+	}
+	if err := yaml.Unmarshal(yml, &project); err != nil {
 		return nil, err
 	}
+	services := &project.Services
+	if services.Kind == yaml.AliasNode {
+		services = services.Alias
+	}
+	if services.Kind != 0 && services.Kind != yaml.MappingNode {
+		return nil, fmt.Errorf("unsupported services format")
+	}
 	var res []request.Environment
-	for _, service := range composeProject.Services {
-		for key, value := range service.Environment.Variables {
-			res = append(res, request.Environment{
-				Key:   key,
-				Value: value,
-			})
+	// Keep the file order for both services and environment entries.
+	for i := 1; i < len(services.Content); i += 2 {
+		var service struct {
+			Environment yaml.Node `yaml:"environment"`
+		}
+		if err := services.Content[i].Decode(&service); err != nil {
+			return nil, err
+		}
+		environment := &service.Environment
+		if environment.Kind == yaml.AliasNode {
+			environment = environment.Alias
+		}
+		switch environment.Kind {
+		case yaml.MappingNode:
+			for j := 0; j < len(environment.Content); j += 2 {
+				res = append(res, request.Environment{Key: environment.Content[j].Value, Value: environment.Content[j+1].Value})
+			}
+		case yaml.SequenceNode:
+			for _, item := range environment.Content {
+				var entry string
+				if err := item.Decode(&entry); err != nil {
+					return nil, err
+				}
+				key, value, _ := strings.Cut(entry, "=")
+				res = append(res, request.Environment{Key: key, Value: value})
+			}
+		case 0:
+		default:
+			return nil, fmt.Errorf("unsupported environment format")
 		}
 	}
 	return res, nil

agent/app/service/setting.go

@@ -1,6 +1,7 @@
 package service
 
 import (
+	"context"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
@@ -44,6 +45,7 @@ type ISettingService interface {
 	GetLocalConnForSSH() (dto.SSHConnData, error)
 
 	SaveDescription(req dto.CommonDescription) error
+	CleanupDescriptions(context.Context) (int64, error)
 }
 
 func NewISettingService() ISettingService {
@@ -124,22 +126,7 @@ func (u *SettingService) GetWebsiteDir() string {
 }
 
 func (u *SettingService) Update(key, value string) error {
-	oldValue := constant.FirewallPortWhiteListValue
-	if key == constant.FirewallPortWhiteList {
-		if _, err := parseFirewallPortWhiteList(value); err != nil {
-			return err
-		}
-		if val, err := settingRepo.GetValueByKey(key); err == nil {
-			oldValue = val
-		}
-	}
-	if err := settingRepo.UpdateOrCreate(key, value); err != nil {
-		return err
-	}
-	if key == constant.FirewallPortWhiteList {
-		return syncFirewallPortWhiteListAfterUpdate(oldValue)
-	}
-	return nil
+	return settingRepo.UpdateOrCreate(key, value)
 }
 
 func (u *SettingService) UpdateTerminalAI(req dto.TerminalAIInfo) error {

agent/app/service/setting_description.go

@@ -0,0 +1,114 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/lifecycle"
+	"github.com/docker/docker/api/types/container"
+)
+
+func (u *SettingService) CleanupDescriptions(ctx context.Context) (int64, error) {
+	var deleted int64
+	var failures []error
+	for _, kind := range []string{"container", "firewall", "firewall-docker"} {
+		count, err := func() (int64, error) {
+			switch kind {
+			case "container":
+				return cleanupUnusedDescriptions(ctx, kind, loadContainerDescriptionIDs)
+			case "firewall":
+				firewallRuleMutationMu.Lock()
+				defer firewallRuleMutationMu.Unlock()
+				return cleanupUnusedDescriptions(ctx, kind, loadHostFirewallDescriptionIDs)
+			default:
+				return cleanupUnusedDescriptions(ctx, kind, nil)
+			}
+		}()
+		deleted += count
+		if err != nil {
+			failures = append(failures, fmt.Errorf("%s: %w", kind, err))
+		}
+	}
+	return deleted, errors.Join(failures...)
+}
+
+func cleanupUnusedDescriptions(ctx context.Context, kind string, loadIDs func(context.Context) (map[string]bool, error)) (int64, error) {
+	if err := ctx.Err(); err != nil {
+		return 0, err
+	}
+	descriptions, err := settingRepo.GetDescriptionList(repo.WithByType(kind))
+	if err != nil || len(descriptions) == 0 {
+		return 0, err
+	}
+	var active map[string]bool
+	if loadIDs != nil {
+		active, err = loadIDs(ctx)
+		if err != nil {
+			return 0, err
+		}
+	}
+	ids, empty := make([]string, 0), make([]string, 0)
+	for _, description := range descriptions {
+		if !active[description.ID] {
+			ids = append(ids, description.ID)
+		} else if description.Description == "" && !description.IsPinned {
+			empty = append(empty, description.ID)
+		}
+	}
+	deleted, err := settingRepo.DeleteDescriptions(ctx, kind, ids, false)
+	if err != nil {
+		return deleted, err
+	}
+	count, err := settingRepo.DeleteDescriptions(ctx, kind, empty, true)
+	return deleted + count, err
+}
+
+func loadContainerDescriptionIDs(ctx context.Context) (map[string]bool, error) {
+	client, err := docker.NewDockerClient()
+	if err != nil {
+		return nil, err
+	}
+	defer client.Close()
+	containers, err := client.ContainerList(ctx, container.ListOptions{All: true})
+	if err != nil {
+		return nil, err
+	}
+	ids := make(map[string]bool, len(containers))
+	for _, item := range containers {
+		ids[item.ID] = true
+	}
+	return ids, nil
+}
+
+func loadHostFirewallDescriptionIDs(ctx context.Context) (map[string]bool, error) {
+	providers := lifecycle.InstalledProviders()
+	if len(providers) == 0 {
+		return nil, filter.ErrProviderUnavailable
+	}
+	service := newFirewallService()
+	ids := make(map[string]bool)
+	for _, name := range providers {
+		provider := filter.Provider(name)
+		inventory, err := service.readFirewallInventory(ctx, provider, filter.ManagedInputScopes(provider))
+		if err != nil {
+			return nil, err
+		}
+		for _, notice := range inventory.Notices {
+			if notice.Code == filter.ScopeNoticeFamilyUnavailable || notice.Code == filter.ScopeNoticeManagedScopeInactive {
+				return nil, fmt.Errorf("%w: %s %s", filter.ErrInventoryUnavailable, name, notice.Code)
+			}
+		}
+		for _, item := range inventory.Items {
+			id, err := filter.DescriptionID(*item.Observed)
+			if err != nil {
+				return nil, err
+			}
+			ids[id] = true
+		}
+	}
+	return ids, nil
+}