fix 修复返回了过期的匿名token

shell OOM

.gitattributes

@@ -0,0 +1,2 @@
+* text=auto eol=lf
+*.html linguist-vendored

.github/workflows/docker-ghcr.yml

@@ -3,9 +3,9 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version number'
+        description: '版本号 (例如: v1.0.0)'
         required: true
-        default: 'latest'
+        default: 'v1.0.0'
 
 jobs:
   build:
@@ -15,13 +15,13 @@ jobs:
       packages: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
 
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@v5
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildx-${{ github.sha }}
@@ -29,14 +29,19 @@ jobs:
             ${{ runner.os }}-buildx-
             
       - name: Log in to GitHub Docker Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
           
       - name: Set version from input
-        run: echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
+        run: |
+          VERSION=${{ github.event.inputs.version }}
+          if [[ $VERSION == v* ]]; then
+            VERSION=${VERSION:1}
+          fi
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
 
       - name: Convert repository name to lowercase
         run: |
@@ -47,10 +52,10 @@ jobs:
       - name: Build and push Docker image
         run: |
           docker buildx build --push \
-            --platform linux/amd64,linux/arm64/v8 \
+            --platform linux/amd64,linux/arm64 \
             --tag ghcr.io/${{ env.REPO_LOWER }}:${{ env.VERSION }} \
             --tag ghcr.io/${{ env.REPO_LOWER }}:latest \
             --build-arg VERSION=${{ env.VERSION }} \
             -f Dockerfile .
         env:
-          GHCR_PUBLIC: true  # 将镜像设置为公开
+          GHCR_PUBLIC: true

.github/workflows/release.yml

@@ -1,7 +1,7 @@
 name: 发布二进制文件
 
 on:
-  workflow_dispatch:  # 手动触发
+  workflow_dispatch:
     inputs:
       version:
         description: '版本号 (例如: v1.0.0)'
@@ -16,14 +16,15 @@ jobs:
       
     steps:
       - name: 检出代码
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
-          fetch-depth: 0  # 获取完整历史，用于生成变更日志
+          fetch-depth: 0
           
       - name: 设置Go环境
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version-file: "src/go.mod"
+          cache-dependency-path: "src/go.sum"
           
       - name: 获取版本号
         id: version
@@ -53,34 +54,34 @@ jobs:
         run: |
           mkdir -p build/hubproxy
           
+      - name: 安装 UPX
+        uses: crazy-max/ghaction-upx@v4
+        with:
+          install-only: true
+
+      - name: 安装 nFPM
+        run: go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.46.3
+
       - name: 编译二进制文件
         run: |
           cd src
+          VERSION=${{ steps.version.outputs.version }}
           
           # Linux AMD64
-          GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o ../build/hubproxy/hubproxy-linux-amd64 .
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X main.Version=${VERSION}" -o ../build/hubproxy/hubproxy-linux-amd64 .
           
           # Linux ARM64
-          GOOS=linux GOARCH=arm64 go build -ldflags="-s -w" -o ../build/hubproxy/hubproxy-linux-arm64 .
+          CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w -X main.Version=${VERSION}" -o ../build/hubproxy/hubproxy-linux-arm64 .
           
-      - name: 复制配置文件
+          # 压缩二进制文件
+          upx -9 ../build/hubproxy/hubproxy-linux-amd64
+          upx -9 ../build/hubproxy/hubproxy-linux-arm64
+          
+      - name: 准备压缩包文件
         run: |
           # 复制配置文件
           cp src/config.toml build/hubproxy/
           
-          # 复制systemd服务文件
-          cp hubproxy.service build/hubproxy/
-          
-          # 复制安装脚本
-          cp install-service.sh build/hubproxy/
-         
-          # 创建README文件
-          cat > build/hubproxy/README.md << 'EOF'
-          # HubProxy
-          
-          项目地址：https://github.com/sky22333/hubproxy
-          EOF
-          
       - name: 创建压缩包
         run: |
           cd build
@@ -88,26 +89,64 @@ jobs:
           # Linux AMD64 包
           mkdir -p linux-amd64/hubproxy
           cp hubproxy/hubproxy-linux-amd64 linux-amd64/hubproxy/hubproxy
-          cp hubproxy/config.toml hubproxy/hubproxy.service hubproxy/install-service.sh hubproxy/README.md linux-amd64/hubproxy/
-          tar -czf hubproxy-${{ steps.version.outputs.version }}-linux-amd64.tar.gz -C linux-amd64 hubproxy
+          cp hubproxy/config.toml linux-amd64/hubproxy/
+          tar -czf hubproxy-linux-amd64.tar.gz -C linux-amd64 hubproxy
           
           # Linux ARM64 包
           mkdir -p linux-arm64/hubproxy
           cp hubproxy/hubproxy-linux-arm64 linux-arm64/hubproxy/hubproxy
-          cp hubproxy/config.toml hubproxy/hubproxy.service hubproxy/install-service.sh hubproxy/README.md linux-arm64/hubproxy/
-          tar -czf hubproxy-${{ steps.version.outputs.version }}-linux-arm64.tar.gz -C linux-arm64 hubproxy
+          cp hubproxy/config.toml linux-arm64/hubproxy/
+          tar -czf hubproxy-linux-arm64.tar.gz -C linux-arm64 hubproxy
           
           # 列出生成的文件
           ls -la *.tar.gz
-          
-      - name: 计算文件校验和
+
+      - name: 创建Linux发行版安装包
         run: |
-          cd build
-          sha256sum *.tar.gz > checksums.txt
-          cat checksums.txt
+          mkdir -p build/packages
+          VERSION="${{ steps.version.outputs.version }}"
+          NFPM_VERSION="${VERSION#v}"
+
+          package() {
+            hubproxy_arch="$1"
+            nfpm_arch="$2"
+            packager="$3"
+            config="$4"
+            target="build/packages/hubproxy-linux-${hubproxy_arch}.${packager}"
+            temp_dir="build/packages/${hubproxy_arch}-${packager}"
+            binary="./build/hubproxy/hubproxy-linux-${hubproxy_arch}"
+
+            rm -rf "${temp_dir}"
+            mkdir -p "${temp_dir}"
+            rm -rf build/package-root
+            mkdir -p build/package-root
+            cp "${binary}" build/package-root/hubproxy
+            NFPM_ARCH="${nfpm_arch}" NFPM_VERSION="${NFPM_VERSION}" nfpm package --config "${config}" --packager "${packager}" --target "${temp_dir}/"
+            mv "${temp_dir}"/*.${packager} "${target}"
+            rm -rf "${temp_dir}"
+            rm -rf build/package-root
+          }
+
+          # AMD64 包
+          package amd64 amd64 deb packaging/nfpm.deb-rpm.yaml
+          package amd64 amd64 rpm packaging/nfpm.deb-rpm.yaml
+          package amd64 amd64 apk packaging/nfpm.apk.yaml
+
+          # ARM64 包
+          package arm64 arm64 deb packaging/nfpm.deb-rpm.yaml
+          package arm64 arm64 rpm packaging/nfpm.deb-rpm.yaml
+          package arm64 arm64 apk packaging/nfpm.apk.yaml
+
+          ls -la build/packages
+
+      - name: 检查安装包内容
+        run: |
+          dpkg-deb -c build/packages/hubproxy-linux-amd64.deb
+          rpm -qpl build/packages/hubproxy-linux-amd64.rpm
+          tar -tf build/packages/hubproxy-linux-amd64.apk
           
       - name: 创建或更新Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.version.outputs.version }}
           name: "HubProxy ${{ steps.version.outputs.version }}"
@@ -117,12 +156,16 @@ jobs:
             
             ## 下载文件
             
-            - **Linux AMD64**: `hubproxy-${{ steps.version.outputs.version }}-linux-amd64.tar.gz`
-            - **Linux ARM64**: `hubproxy-${{ steps.version.outputs.version }}-linux-arm64.tar.gz`
+            - **Linux AMD64**: `hubproxy-linux-amd64.tar.gz`
+            - **Linux ARM64**: `hubproxy-linux-arm64.tar.gz`
+            - **Debian/Ubuntu**: `.deb`
+            - **RHEL/CentOS/Fedora**: `.rpm`
+            - **Alpine Linux**: `.apk`
             
           files: |
             build/*.tar.gz
-            build/checksums.txt
+            build/packages/*
+          overwrite_files: true
           draft: false
           prerelease: false
-          token: ${{ secrets.GITHUB_TOKEN }} 
+          token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -0,0 +1,5 @@
+.idea
+.vscode
+.DS_Store
+/hubproxy*
+*.exe

Dockerfile

@@ -1,15 +1,19 @@
-FROM golang:1.24-alpine AS builder
+FROM golang:1.26-alpine AS builder
+
+ARG TARGETARCH
+ARG VERSION=dev
 
 WORKDIR /app
 COPY src/go.mod src/go.sum ./
-RUN go mod download
+RUN apk add --no-cache upx && go mod download
 
 COPY src/ .
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -trimpath -o hubproxy .
+
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -ldflags="-s -w -X main.Version=${VERSION}" -trimpath -o hubproxy . && upx -9 hubproxy
 
 FROM alpine
 
-WORKDIR /root/
+WORKDIR /app
 
 COPY --from=builder /app/hubproxy .
 COPY --from=builder /app/config.toml .

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 sky22333
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,22 +1,35 @@
 # HubProxy
 
-🚀 **Docker 和 GitHub 加速代理服务器**
+ **Docker 和 GitHub 加速代理服务器**
 
-一个轻量级、高性能的多功能代理服务，提供 Docker 镜像加速、GitHub 文件加速等功能。
+一个轻量级、高性能的多功能代理服务，提供 Docker 镜像加速、GitHub 文件加速、下载离线镜像、在线搜索 Docker 镜像等功能。
 
-## ✨ 特性
 
-- 🐳 **Docker 镜像加速** - 单域名实现 Docker Hub、GHCR、Quay 等多个镜像仓库加速，流式传输优化拉取速度。
+<p align="center">
+  <img src="https://count.getloli.com/get/@sky22333.hubproxy?theme=rule34" alt="Visitors">
+</p>
+
+## 特性
+
+- 🐳 **Docker 镜像加速** - 支持 Docker Hub、GHCR、Quay 等多个镜像仓库加速，流式传输优化拉取速度。
 - 🐳 **离线镜像包** - 支持下载离线镜像包，流式传输加防抖设计。
 - 📁 **GitHub 文件加速** - 加速 GitHub Release、Raw 文件下载，支持`api.github.com`，脚本嵌套加速等等
 - 🤖 **AI 模型库支持** - 支持 Hugging Face 模型下载加速
 - 🛡️ **智能限流** - IP 限流保护，防止滥用
 - 🚫 **仓库审计** - 强大的自定义黑名单，白名单，同时审计镜像仓库，和GitHub仓库
 - 🔍 **镜像搜索** - 在线搜索 Docker 镜像
-- ⚡ **轻量高效** - 基于 Go 语言，单二进制文件运行，资源占用低，优雅的内存清理机制。
-- 🔧 **配置热重载** - 统一配置管理，部分配置项支持热重载，无需重启服务
+- ⚡ **轻量高效** - 基于 Go 语言，单二进制文件运行，资源占用低。
+- 🔧 **统一配置** - 统一配置管理，便于维护。
+- 🛡️ **完全自托管** - 避免依赖免费第三方服务的不稳定性，例如`cloudflare`等等。
+- 🚀 **多服务统一加速** - 单个程序即可统一加速 Docker、GitHub、Hugging Face 等多种服务，简化部署与管理。
 
-## 🚀 快速开始
+## 详细文档
+
+[中文文档](https://zread.ai/sky22333/hubproxy)
+
+[English](https://deepwiki.com/sky22333/hubproxy)
+
+## 快速开始
 
 ### Docker部署（推荐）
 ```
@@ -27,23 +40,72 @@ docker run -d \
   ghcr.io/sky22333/hubproxy
 ```
 
+### 脚本安装
 
-
-### 一键安装
+自动识别系统与架构，从 GitHub Releases 下载对应的 `.deb`、`.rpm` 或 `.apk` 安装包：
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/sky22333/hubproxy/main/install-service.sh | sudo bash
+curl -fsSL https://raw.githubusercontent.com/sky22333/hubproxy/main/install.sh | sh
 ```
 
-这个命令会：
-- 🔍 自动检测系统架构（AMD64/ARM64）
-- 📥 从 GitHub Releases 下载最新版本
-- ⚙️ 自动配置系统服务
-- 🔄 保留现有配置（升级时）
+安装包会自动安装并启动 `hubproxy` 服务。
 
+<details>
+  <summary>服务管理命令</summary>
 
+#### systemd（Debian / Ubuntu / RHEL / CentOS / Fedora）
 
-## 📖 使用方法
+```bash
+# 查看状态
+sudo systemctl status hubproxy
+
+# 重启服务
+sudo systemctl restart hubproxy
+
+# 查看实时日志
+sudo journalctl -u hubproxy -f
+
+# 编辑配置文件
+sudo nano /etc/hubproxy/config.toml
+
+# 卸载服务
+sudo apt remove hubproxy
+
+# 连配置一起清理
+sudo apt purge hubproxy
+```
+
+#### OpenRC（Alpine Linux）
+
+```bash
+# 查看状态
+sudo rc-service hubproxy status
+
+# 重启服务
+sudo rc-service hubproxy restart
+
+# 查看实时日志
+sudo tail -f /var/log/hubproxy.log
+
+# 编辑配置文件
+sudo vi /etc/hubproxy/config.toml
+
+# 卸载
+sudo apk del hubproxy
+```
+
+</details>
+
+### 文件路径
+
+- Linux 安装包配置文件：`/etc/hubproxy/config.toml`
+- Linux 安装包二进制文件：`/usr/bin/hubproxy`
+- systemd 服务文件：`/lib/systemd/system/hubproxy.service`
+- Alpine OpenRC 服务文件：`/etc/init.d/hubproxy`
+- Alpine 日志文件：`/var/log/hubproxy.log`
+- Alpine 日志轮转配置：`/etc/logrotate.d/hubproxy`
+
+## 使用方法
 
 ### Docker 镜像加速
 
@@ -55,9 +117,25 @@ docker pull nginx
 docker pull yourdomain.com/nginx
 
 # ghcr加速
-docker pull yourdomain.com/ghcr.io/user/images
+docker pull yourdomain.com/ghcr.io/sky22333/hubproxy
+
+# 符合Docker Registry API v2标准的仓库都支持
 ```
 
+当然也支持配置为全局镜像加速，在主机上新建（或编辑）`/etc/docker/daemon.json`
+
+在 `"registry-mirrors"` 中加入域名：
+
+```json
+{
+  "registry-mirrors": [
+    "https://yourdomain.com"
+  ]
+}
+```
+
+若已设置其他加速地址，直接并列添加后保存，再执行 `sudo systemctl restart docker` 重启docker服务让配置生效。
+
 ### GitHub 文件加速
 
 ```bash
@@ -66,16 +144,147 @@ https://github.com/user/repo/releases/download/v1.0.0/file.tar.gz
 
 # 加速链接
 https://yourdomain.com/https://github.com/user/repo/releases/download/v1.0.0/file.tar.gz
+
+# 加速下载仓库
+git clone https://yourdomain.com/https://github.com/sky22333/hubproxy.git
 ```
 
+## 配置
 
+<details>
+  <summary>config.toml 配置说明</summary>
 
-## ⚙️ 提示
+*此配置是默认配置，已经内置在程序中了*
 
-主配置文件位于 `/opt/hubproxy/config.toml`：
+```
+[server]
+host = "0.0.0.0"
+# 监听端口
+port = 5000
+# Github文件大小限制（字节），默认2GB
+fileSize = 2147483648
+# HTTP/2 多路复用，提升下载速度
+enableH2C = false
+# 是否启用前端静态页面
+enableFrontend = true
+
+[rateLimit]
+# 每个IP每周期允许的请求数(注意Docker镜像会有多个层，会消耗多个次数)
+requestLimit = 500
+# 限流周期（小时）
+periodHours = 3.0
+
+[security]
+# IP白名单，支持单个IP或IP段
+# 白名单中的IP不受限流限制
+whiteList = [
+    "127.0.0.1",
+    "172.17.0.0/16",
+    "192.168.1.0/24"
+]
+
+# IP黑名单，支持单个IP或IP段
+# 黑名单中的IP将被直接拒绝访问
+blackList = [
+    "192.168.100.1",
+    "192.168.100.0/24"
+]
+
+[access]
+# 代理服务白名单（支持GitHub仓库和Docker镜像，支持通配符）
+# 只允许访问白名单中的仓库/镜像，为空时不限制
+whiteList = []
+
+# 代理服务黑名单（支持GitHub仓库和Docker镜像，支持通配符）
+# 禁止访问黑名单中的仓库/镜像
+blackList = [
+    "baduser/malicious-repo",
+    "*/malicious-repo",
+    "baduser/*"
+]
+
+# 代理配置，支持有用户名/密码认证和无认证模式
+# 无认证: socks5://127.0.0.1:1080
+# 有认证: socks5://username:password@127.0.0.1:1080
+# 留空不使用代理
+proxy = "" 
+
+[download]
+# 批量下载离线镜像数量限制
+maxImages = 10
+
+# Registry映射配置，支持多种镜像仓库上游
+[registries]
+
+# GitHub Container Registry
+[registries."ghcr.io"]
+upstream = "ghcr.io"
+authHost = "ghcr.io/token" 
+authType = "github"
+enabled = true
+
+# Google Container Registry
+[registries."gcr.io"]
+upstream = "gcr.io"
+authHost = "gcr.io/v2/token"
+authType = "google"
+enabled = true
+
+# Quay.io Container Registry
+[registries."quay.io"]
+upstream = "quay.io"
+authHost = "quay.io/v2/auth"
+authType = "quay"
+enabled = true
+
+# Kubernetes Container Registry
+[registries."registry.k8s.io"]
+upstream = "registry.k8s.io"
+authHost = "registry.k8s.io"
+authType = "anonymous"
+enabled = true
+
+[tokenCache]
+# 是否启用缓存(同时控制Token和Manifest缓存)显著提升性能
+enabled = true
+# 默认缓存时间(分钟)
+defaultTTL = "20m"
+```
+
+</details>
+
+### 环境变量（可选）
+
+支持通过环境变量覆盖部分配置，优先级高于`config.toml`，以下是默认值：
+
+```
+CONFIG_PATH=config.toml          # 配置文件路径
+SERVER_HOST=0.0.0.0             # 监听地址
+SERVER_PORT=5000                # 监听端口
+ENABLE_H2C=false                # 是否启用 H2C
+ENABLE_FRONTEND=true            # 是否启用前端静态页面
+MAX_FILE_SIZE=2147483648        # GitHub 文件大小限制（字节）
+RATE_LIMIT=500                  # 每周期请求数
+RATE_PERIOD_HOURS=3             # 限流周期（小时）
+IP_WHITELIST=127.0.0.1,192.168.1.0/24   # IP 白名单（逗号分隔）
+IP_BLACKLIST=192.168.100.1,192.168.100.0/24 # IP 黑名单（逗号分隔）
+MAX_IMAGES=10                   # 批量下载镜像数量限制
+ACCESS_PROXY=                   # 代理配置，例如 socks5://127.0.0.1:1080
+```
 
 为了IP限流能够正常运行，反向代理需要传递IP头用来获取访客真实IP，以caddy为例：
 ```
+example.com {
+    reverse_proxy {
+        to 127.0.0.1:5000
+        header_up X-Real-IP {remote}
+        header_up X-Forwarded-For {remote}
+        header_up X-Forwarded-Proto {scheme}
+    }
+}
+```
+cloudflare CDN：
+```
 example.com {
     reverse_proxy 127.0.0.1:5000 {
         header_up X-Forwarded-For {http.request.header.CF-Connecting-IP}
@@ -86,6 +295,8 @@ example.com {
 }
 ```
 
+> 对于使用nginx反代的用户，Github加速提示`无效输入`的问题可以参见[issues/62](https://github.com/sky22333/hubproxy/issues/62#issuecomment-3219572440)
+
 
 ## ⚠️ 免责声明
 
@@ -100,3 +311,10 @@ example.com {
 **⭐ 如果这个项目对你有帮助，请给个 Star！⭐**
 
 </div>
+
+## 界面预览
+
+![1](./.github/demo/demo1.jpg)
+
+## Star 趋势
+[![Star 趋势](https://starchart.cc/sky22333/hubproxy.svg?variant=adaptive)](https://starchart.cc/sky22333/hubproxy)

docker-compose.yml

@@ -1,8 +1,14 @@
 services:
-    ghproxy:
-        build: .
-        restart: always
-        ports:
-            - '5000:5000'
-        volumes:
-            - ./src/config.toml:/root/config.toml
+  hubproxy:
+    image: ghcr.io/sky22333/hubproxy
+    container_name: hubproxy
+    restart: always
+    ports:
+      - "5000:5000"
+    volumes:
+      - ./src/config.toml:/app/config.toml:ro
+    logging:
+      driver: json-file
+      options:
+        max-size: "1g"
+        max-file: "2"

install-service.sh

@@ -1,213 +0,0 @@
-#!/bin/bash
-
-# HubProxy 一键安装脚本
-# 支持自动下载最新版本或使用本地文件安装
-set -e
-
-# 颜色定义
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-# 配置
-REPO="sky22333/hubproxy"
-GITHUB_API="https://api.github.com/repos/${REPO}"
-GITHUB_RELEASES="${GITHUB_API}/releases"
-SERVICE_NAME="hubproxy"
-INSTALL_DIR="/opt/hubproxy"
-CONFIG_FILE="config.toml"
-BINARY_NAME="hubproxy"
-LOG_DIR="/var/log/hubproxy"
-TEMP_DIR="/tmp/hubproxy-install"
-
-echo -e "${BLUE}HubProxy 一键安装脚本${NC}"
-echo "================================================="
-
-# 检查是否以root权限运行
-if [[ $EUID -ne 0 ]]; then
-           echo -e "${RED}此脚本需要root权限运行${NC}"
-   echo "请使用: sudo $0"
-   exit 1
-fi
-
-# 检测系统架构
-detect_arch() {
-    local arch=$(uname -m)
-    case $arch in
-        x86_64)
-            echo "amd64"
-            ;;
-        aarch64|arm64)
-            echo "arm64"
-            ;;
-        *)
-            echo -e "${RED}不支持的架构: $arch${NC}"
-            exit 1
-            ;;
-    esac
-}
-
-ARCH=$(detect_arch)
-echo -e "${BLUE}检测到架构: linux-${ARCH}${NC}"
-
-# 检查是否为本地安装模式
-if [ -f "${BINARY_NAME}" ]; then
-    echo -e "${BLUE}发现本地文件，使用本地安装模式${NC}"
-    LOCAL_INSTALL=true
-else
-    echo -e "${BLUE}本地无文件，使用自动下载模式${NC}"
-    LOCAL_INSTALL=false
-    
-    # 检查依赖
-    missing_deps=()
-    for cmd in curl jq tar; do
-        if ! command -v $cmd &> /dev/null; then
-            missing_deps+=($cmd)
-        fi
-    done
-    
-    if [ ${#missing_deps[@]} -gt 0 ]; then
-        echo -e "${YELLOW}检测到缺少依赖: ${missing_deps[*]}${NC}"
-        echo -e "${BLUE}正在自动安装依赖...${NC}"
-        
-        apt update && apt install -y curl jq
-        if [ $? -ne 0 ]; then
-            echo -e "${RED}依赖安装失败${NC}"
-            exit 1
-        fi
-        
-        # 重新检查依赖
-        for cmd in curl jq tar; do
-            if ! command -v $cmd &> /dev/null; then
-                echo -e "${RED}依赖安装后仍缺少: $cmd${NC}"
-                exit 1
-            fi
-        done
-        
-        echo -e "${GREEN}依赖安装成功${NC}"
-    fi
-fi
-
-# 自动下载功能
-if [ "$LOCAL_INSTALL" = false ]; then
-    echo -e "${BLUE}获取最新版本信息...${NC}"
-    LATEST_RELEASE=$(curl -s "${GITHUB_RELEASES}/latest")
-    if [ $? -ne 0 ]; then
-        echo -e "${RED}无法获取版本信息${NC}"
-        exit 1
-    fi
-
-    VERSION=$(echo "$LATEST_RELEASE" | jq -r '.tag_name')
-    if [ "$VERSION" = "null" ]; then
-        echo -e "${RED}无法解析版本信息${NC}"
-        exit 1
-    fi
-
-    echo -e "${GREEN}最新版本: ${VERSION}${NC}"
-
-    # 构造下载URL
-    ASSET_NAME="hubproxy-${VERSION}-linux-${ARCH}.tar.gz"
-    DOWNLOAD_URL="https://github.com/${REPO}/releases/download/${VERSION}/${ASSET_NAME}"
-
-    echo -e "${BLUE}下载: ${ASSET_NAME}${NC}"
-
-    # 创建临时目录并下载
-    rm -rf "${TEMP_DIR}"
-    mkdir -p "${TEMP_DIR}"
-    cd "${TEMP_DIR}"
-
-    curl -L -o "${ASSET_NAME}" "${DOWNLOAD_URL}"
-    if [ $? -ne 0 ]; then
-        echo -e "${RED}下载失败${NC}"
-        exit 1
-    fi
-
-    # 解压
-    tar -xzf "${ASSET_NAME}"
-    if [ $? -ne 0 ] || [ ! -d "hubproxy" ]; then
-        echo -e "${RED}解压失败${NC}"
-        exit 1
-    fi
-
-    cd hubproxy
-    echo -e "${GREEN}下载完成${NC}"
-fi
-
-echo -e "${YELLOW}开始安装 HubProxy...${NC}"
-
-# 停止现有服务（如果存在）
-if systemctl is-active --quiet ${SERVICE_NAME} 2>/dev/null; then
-    echo -e "${YELLOW}停止现有服务...${NC}"
-    systemctl stop ${SERVICE_NAME}
-fi
-
-# 备份现有配置（如果存在）
-CONFIG_BACKUP_EXISTS=false
-if [ -f "${INSTALL_DIR}/${CONFIG_FILE}" ]; then
-    echo -e "${BLUE}备份现有配置...${NC}"
-    cp "${INSTALL_DIR}/${CONFIG_FILE}" "${TEMP_DIR}/config.toml.backup"
-    CONFIG_BACKUP_EXISTS=true
-fi
-
-# 1. 创建目录结构
-echo -e "${BLUE}创建目录结构${NC}"
-mkdir -p ${INSTALL_DIR}
-mkdir -p ${LOG_DIR}
-chmod 755 ${INSTALL_DIR}
-chmod 755 ${LOG_DIR}
-
-# 2. 复制二进制文件
-echo -e "${BLUE}复制二进制文件${NC}"
-cp "${BINARY_NAME}" "${INSTALL_DIR}/"
-chmod +x "${INSTALL_DIR}/${BINARY_NAME}"
-
-# 3. 复制配置文件
-echo -e "${BLUE}复制配置文件${NC}"
-if [ -f "${CONFIG_FILE}" ]; then
-    if [ "$CONFIG_BACKUP_EXISTS" = false ]; then
-        cp "${CONFIG_FILE}" "${INSTALL_DIR}/"
-        echo -e "${GREEN}配置文件复制成功${NC}"
-    else
-        echo -e "${YELLOW}保留现有配置文件${NC}"
-    fi
-else
-    echo -e "${YELLOW}配置文件不存在，将使用默认配置${NC}"
-fi
-
-# 5. 安装systemd服务文件
-echo -e "${BLUE}安装systemd服务文件${NC}"
-cp "${SERVICE_NAME}.service" "/etc/systemd/system/"
-systemctl daemon-reload
-
-# 6. 恢复配置文件（如果有备份）
-if [ "$CONFIG_BACKUP_EXISTS" = true ]; then
-    echo -e "${BLUE}恢复配置文件...${NC}"
-    cp "${TEMP_DIR}/config.toml.backup" "${INSTALL_DIR}/${CONFIG_FILE}"
-fi
-
-# 7. 启用并启动服务
-echo -e "${BLUE}启用并启动服务${NC}"
-systemctl enable ${SERVICE_NAME}
-systemctl start ${SERVICE_NAME}
-
-# 8. 清理临时文件
-if [ "$LOCAL_INSTALL" = false ]; then
-    echo -e "${BLUE}清理临时文件...${NC}"
-    cd /
-    rm -rf "${TEMP_DIR}"
-fi
-
-# 9. 检查服务状态
-sleep 2
-if systemctl is-active --quiet ${SERVICE_NAME}; then
-    echo ""
-    echo -e "${GREEN}HubProxy 安装成功！${NC}"
-    echo -e "${GREEN}默认运行端口: 5000${NC}"
-    echo -e "${GREEN}配置文件路径: ${INSTALL_DIR}/${CONFIG_FILE}${NC}"
-else
-    echo -e "${RED}服务启动失败${NC}"
-    echo "查看错误日志: sudo journalctl -u ${SERVICE_NAME} -f"
-    exit 1
-fi 

install.sh

@@ -0,0 +1,121 @@
+#!/bin/sh
+set -eu
+
+REPO="${REPO:-sky22333/hubproxy}"
+VERSION="${VERSION:-latest}"
+TMP_DIR="${TMP_DIR:-/tmp/hubproxy-install}"
+
+log() {
+    printf '%s\n' "$*"
+}
+
+fail() {
+    printf 'HubProxy 安装失败：%s\n' "$*" >&2
+    exit 1
+}
+
+need_cmd() {
+    command -v "$1" >/dev/null 2>&1 || fail "缺少必要命令：$1"
+}
+
+detect_arch() {
+    case "$(uname -m)" in
+        x86_64|amd64)
+            echo "amd64"
+            ;;
+        aarch64|arm64)
+            echo "arm64"
+            ;;
+        *)
+            fail "不支持的系统架构：$(uname -m)"
+            ;;
+    esac
+}
+
+detect_packager() {
+    if command -v apk >/dev/null 2>&1; then
+        echo "apk"
+    elif command -v apt-get >/dev/null 2>&1; then
+        echo "deb"
+    elif command -v dnf >/dev/null 2>&1 || command -v yum >/dev/null 2>&1 || command -v rpm >/dev/null 2>&1; then
+        echo "rpm"
+    else
+        fail "不支持的系统：需要 apt、dnf、yum、rpm 或 apk"
+    fi
+}
+
+asset_name() {
+    packager="$1"
+    arch="$2"
+
+    case "$packager:$arch" in
+        deb:amd64|rpm:amd64|apk:amd64) echo "hubproxy-linux-amd64.${packager}" ;;
+        deb:arm64|rpm:arm64|apk:arm64) echo "hubproxy-linux-arm64.${packager}" ;;
+        *) fail "不支持的安装包目标：${packager}/${arch}" ;;
+    esac
+}
+
+asset_url() {
+    asset="$1"
+
+    if [ "$VERSION" = "latest" ]; then
+        echo "https://github.com/${REPO}/releases/latest/download/${asset}"
+    else
+        echo "https://github.com/${REPO}/releases/download/${VERSION}/${asset}"
+    fi
+}
+
+install_package() {
+    package_file="$1"
+    packager="$2"
+
+    case "$packager" in
+        deb)
+            apt-get install -y "$package_file"
+            ;;
+        rpm)
+            if command -v dnf >/dev/null 2>&1; then
+                dnf install -y "$package_file"
+            elif command -v yum >/dev/null 2>&1; then
+                yum install -y "$package_file"
+            else
+                rpm -Uvh "$package_file"
+            fi
+            ;;
+        apk)
+            apk add --allow-untrusted "$package_file"
+            ;;
+        *)
+            fail "不支持的包管理器：$packager"
+            ;;
+    esac
+}
+
+if [ "$(id -u)" -ne 0 ]; then
+    fail "请使用 root 权限运行"
+fi
+
+need_cmd curl
+
+ARCH="$(detect_arch)"
+PACKAGER="$(detect_packager)"
+
+rm -rf "$TMP_DIR"
+mkdir -p "$TMP_DIR"
+trap 'rm -rf "$TMP_DIR"' EXIT INT TERM
+
+log "安装 HubProxy：linux/${ARCH}（${PACKAGER}）"
+
+ASSET="$(asset_name "$PACKAGER" "$ARCH")"
+ASSET_URL="$(asset_url "$ASSET")"
+
+PACKAGE_FILE="${TMP_DIR}/$(basename "$ASSET_URL")"
+log "下载安装包..."
+curl -fL -o "$PACKAGE_FILE" "$ASSET_URL" || fail "下载安装包失败"
+
+log "安装软件包..."
+install_package "$PACKAGE_FILE" "$PACKAGER"
+
+log "安装完成"
+log "默认端口：5000"
+log "配置文件：/etc/hubproxy/config.toml"

packaging/hubproxy.logrotate

@@ -0,0 +1,9 @@
+/var/log/hubproxy.log {
+    weekly
+    maxsize 50M
+    rotate 4
+    compress
+    missingok
+    notifempty
+    copytruncate
+}

packaging/hubproxy.openrc

@@ -0,0 +1,18 @@
+#!/sbin/openrc-run
+
+name="hubproxy"
+description="Docker and GitHub acceleration proxy server"
+command="/usr/bin/hubproxy"
+pidfile="/run/${RC_SVCNAME}.pid"
+output_log="/var/log/hubproxy.log"
+error_log="/var/log/hubproxy.log"
+supervisor="supervise-daemon"
+respawn_delay=5
+respawn_max=0
+
+export CONFIG_PATH="/etc/hubproxy/config.toml"
+
+depend() {
+    need net
+    after firewall
+}

packaging/hubproxy.service

@@ -7,11 +7,10 @@ Wants=network-online.target
 Type=simple
 User=root
 Group=root
-WorkingDirectory=/opt/hubproxy
-ExecStart=/opt/hubproxy/hubproxy
+Environment=CONFIG_PATH=/etc/hubproxy/config.toml
+ExecStart=/usr/bin/hubproxy
 Restart=always
 RestartSec=5
-Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 StandardOutput=journal
 StandardError=journal
 SyslogIdentifier=hubproxy

packaging/nfpm.apk.yaml

@@ -0,0 +1,45 @@
+name: hubproxy
+arch: ${NFPM_ARCH}
+platform: linux
+version: ${NFPM_VERSION}
+release: "1"
+section: net
+priority: optional
+maintainer: sky22333
+description: Docker and GitHub acceleration proxy server
+vendor: sky22333
+homepage: https://github.com/sky22333/hubproxy
+license: MIT
+depends:
+  - logrotate
+
+contents:
+  - src: ./build/package-root/hubproxy
+    dst: /usr/bin/hubproxy
+    file_info:
+      mode: 0755
+
+  - src: ./src/config.toml
+    dst: /etc/hubproxy/config.toml
+    type: config|noreplace
+    file_info:
+      mode: 0644
+
+  - src: ./packaging/hubproxy.openrc
+    dst: /etc/init.d/hubproxy
+    file_info:
+      mode: 0755
+
+  - src: ./packaging/hubproxy.logrotate
+    dst: /etc/logrotate.d/hubproxy
+    file_info:
+      mode: 0644
+
+scripts:
+  postinstall: ./packaging/postinstall.sh
+  preremove: ./packaging/preremove.sh
+  postremove: ./packaging/postremove.sh
+
+apk:
+  scripts:
+    postupgrade: ./packaging/postinstall.sh

packaging/nfpm.deb-rpm.yaml

@@ -0,0 +1,34 @@
+name: hubproxy
+arch: ${NFPM_ARCH}
+platform: linux
+version: ${NFPM_VERSION}
+release: "1"
+section: net
+priority: optional
+maintainer: sky22333
+description: Docker and GitHub acceleration proxy server
+vendor: sky22333
+homepage: https://github.com/sky22333/hubproxy
+license: MIT
+
+contents:
+  - src: ./build/package-root/hubproxy
+    dst: /usr/bin/hubproxy
+    file_info:
+      mode: 0755
+
+  - src: ./src/config.toml
+    dst: /etc/hubproxy/config.toml
+    type: config|noreplace
+    file_info:
+      mode: 0644
+
+  - src: ./packaging/hubproxy.service
+    dst: /lib/systemd/system/hubproxy.service
+    file_info:
+      mode: 0644
+
+scripts:
+  postinstall: ./packaging/postinstall.sh
+  preremove: ./packaging/preremove.sh
+  postremove: ./packaging/postremove.sh

packaging/postinstall.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+set -e
+
+warn() {
+    echo "hubproxy: $1"
+}
+
+if command -v systemctl >/dev/null 2>&1; then
+    systemctl daemon-reload || warn "systemd reload failed"
+    systemctl enable hubproxy >/dev/null 2>&1 || warn "systemd enable failed"
+
+    if [ -d /run/systemd/system ]; then
+        systemctl restart hubproxy || systemctl start hubproxy || {
+            warn "service start failed, check: journalctl -u hubproxy"
+        }
+    fi
+fi
+
+if command -v rc-update >/dev/null 2>&1; then
+    rc-update add hubproxy default >/dev/null 2>&1 || warn "OpenRC enable failed"
+fi
+
+if command -v rc-service >/dev/null 2>&1; then
+    rc-service hubproxy restart || rc-service hubproxy start || {
+        warn "service start failed, check: rc-service hubproxy status"
+    }
+fi

packaging/postremove.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+set -e
+
+if command -v systemctl >/dev/null 2>&1; then
+    systemctl daemon-reload >/dev/null 2>&1 || true
+fi

packaging/preremove.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -e
+
+case "${1:-}" in
+    1|upgrade)
+        exit 0
+        ;;
+esac
+
+if command -v systemctl >/dev/null 2>&1; then
+    systemctl stop hubproxy >/dev/null 2>&1 || true
+    systemctl disable hubproxy >/dev/null 2>&1 || true
+fi
+
+if command -v rc-service >/dev/null 2>&1; then
+    rc-service hubproxy stop >/dev/null 2>&1 || true
+fi
+
+if command -v rc-update >/dev/null 2>&1; then
+    rc-update del hubproxy default >/dev/null 2>&1 || true
+fi

src/config.toml

@@ -1,89 +1,92 @@
-[server]
-# 监听地址，默认监听所有接口
-host = "0.0.0.0"
-# 监听端口
-port = 5000
-# 文件大小限制（字节），默认2GB
-fileSize = 2147483648
-
-[rateLimit]
-# 每个IP每小时允许的请求数(Docker镜像每个层为一个请求)
-requestLimit = 200
-# 限流周期（小时）
-periodHours = 1.0
-
-[security]
-# IP白名单，支持单个IP或CIDR格式
-# 白名单中的IP不受限流限制
-whiteList = [
-    "127.0.0.1",
-    "192.168.1.0/24"
-]
-
-# IP黑名单，支持单个IP或CIDR格式  
-# 黑名单中的IP将被直接拒绝访问
-blackList = [
-    "192.168.100.1"
-]
-
-[proxy]
-# 代理服务白名单（支持GitHub仓库和Docker镜像，支持通配符）
-# 只允许访问白名单中的仓库/镜像，为空时不限制
-whiteList = []
-
-# 代理服务黑名单（支持GitHub仓库和Docker镜像，支持通配符）
-# 禁止访问黑名单中的仓库/镜像
-blackList = [
-    "baduser/malicious-repo",
-    "*/malicious-repo",
-    "baduser/*"
-] 
-
-[download]
-# 单次并发下载离线镜像数量限制
-maxImages = 10
-
-# Registry映射配置，支持多种Container Registry
-[registries]
-
-# GitHub Container Registry
-[registries."ghcr.io"]
-upstream = "ghcr.io"
-authHost = "ghcr.io/token" 
-authType = "github"
-enabled = true
-
-# Google Container Registry
-[registries."gcr.io"]
-upstream = "gcr.io"
-authHost = "gcr.io/v2/token"
-authType = "google"
-enabled = true
-
-# Quay.io Container Registry
-[registries."quay.io"]
-upstream = "quay.io"
-authHost = "quay.io/v2/auth"
-authType = "quay"
-enabled = true
-
-# Kubernetes Container Registry
-[registries."registry.k8s.io"]
-upstream = "registry.k8s.io"
-authHost = "registry.k8s.io"
-authType = "anonymous"
-enabled = true
-
-# 私有Registry示例（默认禁用）
-# [registries."harbor.company.com"]
-# upstream = "harbor.company.com"
-# authHost = "harbor.company.com/service/token"
-# authType = "basic"
-# enabled = false
-
-# 缓存配置：Docker临时Token和Manifest统一管理，显著提升性能
-[tokenCache]
-# 是否启用缓存(同时控制Token和Manifest缓存)
-enabled = true
-# 默认缓存时间
-defaultTTL = "20m"
+[server]
+# 可通过 CONFIG_PATH 环境变量指定配置文件路径，默认读取当前工作目录下的 config.toml
+host = "0.0.0.0"
+# 监听端口
+port = 5000
+# Github文件大小限制（字节），默认2GB
+fileSize = 2147483648
+# HTTP/2 多路复用
+enableH2C = false
+enableFrontend = true
+
+[rateLimit]
+# 每个IP每周期允许的请求数
+requestLimit = 500
+# 限流周期（小时）
+periodHours = 3.0
+
+[security]
+# IP白名单，支持单个IP或IP段
+# 白名单中的IP不受限流限制
+whiteList = [
+    "127.0.0.1",
+    "172.17.0.0/16",
+    "192.168.1.0/24"
+]
+
+# IP黑名单，支持单个IP或IP段
+# 黑名单中的IP将被直接拒绝访问
+blackList = [
+    "192.168.100.1",
+    "192.168.100.0/24"
+]
+
+[access]
+# 代理服务白名单（支持GitHub仓库和Docker镜像，支持通配符）
+# 只允许访问白名单中的仓库/镜像，为空时不限制
+whiteList = []
+
+# 代理服务黑名单（支持GitHub仓库和Docker镜像，支持通配符）
+# 禁止访问黑名单中的仓库/镜像
+blackList = [
+    "baduser/malicious-repo",
+    "*/malicious-repo",
+    "baduser/*"
+]
+
+# 代理配置，支持有用户名/密码认证和无认证模式
+# 无认证: socks5://127.0.0.1:1080
+# 有认证: socks5://username:password@127.0.0.1:1080
+# 留空不使用代理
+proxy = "" 
+
+[download]
+# 批量下载离线镜像数量限制
+maxImages = 10
+
+# Registry映射配置，支持多种镜像仓库上游
+[registries]
+
+# GitHub Container Registry
+[registries."ghcr.io"]
+upstream = "ghcr.io"
+authHost = "ghcr.io/token" 
+authType = "github"
+enabled = true
+
+# Google Container Registry
+[registries."gcr.io"]
+upstream = "gcr.io"
+authHost = "gcr.io/v2/token"
+authType = "google"
+enabled = true
+
+# Quay.io Container Registry
+[registries."quay.io"]
+upstream = "quay.io"
+authHost = "quay.io/v2/auth"
+authType = "quay"
+enabled = true
+
+# Kubernetes Container Registry
+[registries."registry.k8s.io"]
+upstream = "registry.k8s.io"
+authHost = "registry.k8s.io"
+authType = "anonymous"
+enabled = true
+
+[tokenCache]
+# 是否启用缓存(同时控制Token和Manifest缓存)显著提升性能
+enabled = true
+# 默认缓存时间(分钟)
+defaultTTL = "20m"

src/config/config.go

@@ -1,367 +1,290 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/pelletier/go-toml/v2"
-	"github.com/spf13/viper"
-	"github.com/fsnotify/fsnotify"
-)
-
-// RegistryMapping Registry映射配置
-type RegistryMapping struct {
-	Upstream string `toml:"upstream"` // 上游Registry地址
-	AuthHost string `toml:"authHost"` // 认证服务器地址
-	AuthType string `toml:"authType"` // 认证类型: docker/github/google/basic
-	Enabled  bool   `toml:"enabled"`  // 是否启用
-}
-
-// AppConfig 应用配置结构体
-type AppConfig struct {
-	Server struct {
-		Host     string `toml:"host"`     // 监听地址
-		Port     int    `toml:"port"`     // 监听端口
-		FileSize int64  `toml:"fileSize"` // 文件大小限制（字节）
-	} `toml:"server"`
-
-	RateLimit struct {
-		RequestLimit int     `toml:"requestLimit"` // 每小时请求限制
-		PeriodHours  float64 `toml:"periodHours"`  // 限制周期（小时）
-	} `toml:"rateLimit"`
-
-	Security struct {
-		WhiteList []string `toml:"whiteList"` // 白名单IP/CIDR列表
-		BlackList []string `toml:"blackList"` // 黑名单IP/CIDR列表
-	} `toml:"security"`
-
-	Proxy struct {
-		WhiteList []string `toml:"whiteList"` // 代理白名单（仓库级别）
-		BlackList []string `toml:"blackList"` // 代理黑名单（仓库级别）
-	} `toml:"proxy"`
-
-	Download struct {
-		MaxImages int `toml:"maxImages"` // 单次下载最大镜像数量限制
-	} `toml:"download"`
-
-	Registries map[string]RegistryMapping `toml:"registries"`
-
-	TokenCache struct {
-		Enabled    bool   `toml:"enabled"`    // 是否启用token缓存
-		DefaultTTL string `toml:"defaultTTL"` // 默认缓存时间
-	} `toml:"tokenCache"`
-}
-
-var (
-	appConfig     *AppConfig
-	appConfigLock sync.RWMutex
-	isViperEnabled bool
-	viperInstance  *viper.Viper
-	
-	cachedConfig     *AppConfig
-	configCacheTime  time.Time
-	configCacheTTL   = 5 * time.Second
-	configCacheMutex sync.RWMutex
-)
-
-// DefaultConfig 返回默认配置
-func DefaultConfig() *AppConfig {
-	return &AppConfig{
-		Server: struct {
-			Host     string `toml:"host"`
-			Port     int    `toml:"port"`
-			FileSize int64  `toml:"fileSize"`
-		}{
-			Host:     "0.0.0.0",
-			Port:     5000,
-			FileSize: 2 * 1024 * 1024 * 1024, // 2GB
-		},
-		RateLimit: struct {
-			RequestLimit int     `toml:"requestLimit"`
-			PeriodHours  float64 `toml:"periodHours"`
-		}{
-			RequestLimit: 20,
-			PeriodHours:  1.0,
-		},
-		Security: struct {
-			WhiteList []string `toml:"whiteList"`
-			BlackList []string `toml:"blackList"`
-		}{
-			WhiteList: []string{},
-			BlackList: []string{},
-		},
-		Proxy: struct {
-			WhiteList []string `toml:"whiteList"`
-			BlackList []string `toml:"blackList"`
-		}{
-			WhiteList: []string{},
-			BlackList: []string{},
-		},
-		Download: struct {
-			MaxImages int `toml:"maxImages"`
-		}{
-			MaxImages: 10, // 默认值：最多同时下载10个镜像
-		},
-		Registries: map[string]RegistryMapping{
-			"ghcr.io": {
-				Upstream: "ghcr.io",
-				AuthHost: "ghcr.io/token",
-				AuthType: "github",
-				Enabled:  true,
-			},
-			"gcr.io": {
-				Upstream: "gcr.io",
-				AuthHost: "gcr.io/v2/token",
-				AuthType: "google",
-				Enabled:  true,
-			},
-			"quay.io": {
-				Upstream: "quay.io",
-				AuthHost: "quay.io/v2/auth",
-				AuthType: "quay",
-				Enabled:  true,
-			},
-			"registry.k8s.io": {
-				Upstream: "registry.k8s.io",
-				AuthHost: "registry.k8s.io",
-				AuthType: "anonymous",
-				Enabled:  true,
-			},
-		},
-		TokenCache: struct {
-			Enabled    bool   `toml:"enabled"`
-			DefaultTTL string `toml:"defaultTTL"`
-		}{
-			Enabled:    true, // docker认证的匿名Token缓存配置，用于提升性能
-			DefaultTTL: "20m",
-		},
-	}
-}
-
-// GetConfig 安全地获取配置副本
-func GetConfig() *AppConfig {
-	configCacheMutex.RLock()
-	if cachedConfig != nil && time.Since(configCacheTime) < configCacheTTL {
-		config := cachedConfig
-		configCacheMutex.RUnlock()
-		return config
-	}
-	configCacheMutex.RUnlock()
-	
-	// 缓存过期，重新生成配置
-	configCacheMutex.Lock()
-	defer configCacheMutex.Unlock()
-	
-	// 双重检查，防止重复生成
-	if cachedConfig != nil && time.Since(configCacheTime) < configCacheTTL {
-		return cachedConfig
-	}
-	
-	appConfigLock.RLock()
-	if appConfig == nil {
-		appConfigLock.RUnlock()
-		defaultCfg := DefaultConfig()
-		cachedConfig = defaultCfg
-		configCacheTime = time.Now()
-		return defaultCfg
-	}
-	
-	// 生成新的配置深拷贝
-	configCopy := *appConfig
-	configCopy.Security.WhiteList = append([]string(nil), appConfig.Security.WhiteList...)
-	configCopy.Security.BlackList = append([]string(nil), appConfig.Security.BlackList...)
-	configCopy.Proxy.WhiteList = append([]string(nil), appConfig.Proxy.WhiteList...)
-	configCopy.Proxy.BlackList = append([]string(nil), appConfig.Proxy.BlackList...)
-	appConfigLock.RUnlock()
-	
-	cachedConfig = &configCopy
-	configCacheTime = time.Now()
-	
-	return cachedConfig
-}
-
-// setConfig 安全地设置配置
-func setConfig(cfg *AppConfig) {
-	appConfigLock.Lock()
-	defer appConfigLock.Unlock()
-	appConfig = cfg
-	
-	configCacheMutex.Lock()
-	cachedConfig = nil
-	configCacheMutex.Unlock()
-}
-
-// LoadConfig 加载配置文件
-func LoadConfig() error {
-	// 首先使用默认配置
-	cfg := DefaultConfig()
-	
-	// 尝试加载TOML配置文件
-	if data, err := os.ReadFile("config.toml"); err == nil {
-		if err := toml.Unmarshal(data, cfg); err != nil {
-			return fmt.Errorf("解析配置文件失败: %v", err)
-		}
-	} else {
-		fmt.Println("未找到config.toml，使用默认配置")
-	}
-	
-	// 从环境变量覆盖配置
-	overrideFromEnv(cfg)
-	
-	// 设置配置
-	setConfig(cfg)
-	
-	if !isViperEnabled {
-		go enableViperHotReload()
-	}
-	
-	return nil
-}
-
-func enableViperHotReload() {
-	if isViperEnabled {
-		return
-	}
-	
-	// 创建Viper实例
-	viperInstance = viper.New()
-	
-	// 配置Viper
-	viperInstance.SetConfigName("config")
-	viperInstance.SetConfigType("toml")
-	viperInstance.AddConfigPath(".")
-	
-	// 读取配置文件
-	if err := viperInstance.ReadInConfig(); err != nil {
-		fmt.Printf("读取配置失败，继续使用当前配置: %v\n", err)
-		return
-	}
-	
-	isViperEnabled = true
-	
-	viperInstance.WatchConfig()
-	viperInstance.OnConfigChange(func(e fsnotify.Event) {
-		fmt.Printf("检测到配置文件变化: %s\n", e.Name)
-		hotReloadWithViper()
-	})
-}
-
-func hotReloadWithViper() {
-	start := time.Now()
-	fmt.Println("🔄 自动热重载...")
-	
-	// 创建新配置
-	cfg := DefaultConfig()
-	
-	// 使用Viper解析配置到结构体
-	if err := viperInstance.Unmarshal(cfg); err != nil {
-		fmt.Printf("❌ 配置解析失败: %v\n", err)
-		return
-	}
-	
-	overrideFromEnv(cfg)
-	
-	setConfig(cfg)
-	
-	// 异步更新受影响的组件
-	go func() {
-		updateAffectedComponents()
-		fmt.Printf("✅ Viper配置热重载完成，耗时: %v\n", time.Since(start))
-	}()
-}
-
-func updateAffectedComponents() {
-	// 重新初始化限流器
-	if globalLimiter != nil {
-		fmt.Println("📡 重新初始化限流器...")
-		initLimiter()
-	}
-	
-	// 重新加载访问控制
-	fmt.Println("🔒 重新加载访问控制规则...")
-	if GlobalAccessController != nil {
-		GlobalAccessController.Reload()
-	}
-	
-	fmt.Println("🌐 更新Registry配置映射...")
-	reloadRegistryConfig()
-	
-	// 其他需要重新初始化的组件可以在这里添加
-	fmt.Println("🔧 组件更新完成")
-}
-
-func reloadRegistryConfig() {
-	cfg := GetConfig()
-	enabledCount := 0
-	
-	// 统计启用的Registry数量
-	for _, mapping := range cfg.Registries {
-		if mapping.Enabled {
-			enabledCount++
-		}
-	}
-	
-	fmt.Printf("🌐 Registry配置已更新: %d个启用\n", enabledCount)
-	
-}
-
-// overrideFromEnv 从环境变量覆盖配置
-func overrideFromEnv(cfg *AppConfig) {
-	// 服务器配置
-	if val := os.Getenv("SERVER_HOST"); val != "" {
-		cfg.Server.Host = val
-	}
-	if val := os.Getenv("SERVER_PORT"); val != "" {
-		if port, err := strconv.Atoi(val); err == nil && port > 0 {
-			cfg.Server.Port = port
-		}
-	}
-	if val := os.Getenv("MAX_FILE_SIZE"); val != "" {
-		if size, err := strconv.ParseInt(val, 10, 64); err == nil && size > 0 {
-			cfg.Server.FileSize = size
-		}
-	}
-	
-	// 限流配置
-	if val := os.Getenv("RATE_LIMIT"); val != "" {
-		if limit, err := strconv.Atoi(val); err == nil && limit > 0 {
-			cfg.RateLimit.RequestLimit = limit
-		}
-	}
-	if val := os.Getenv("RATE_PERIOD_HOURS"); val != "" {
-		if period, err := strconv.ParseFloat(val, 64); err == nil && period > 0 {
-			cfg.RateLimit.PeriodHours = period
-		}
-	}
-	
-	// IP限制配置
-	if val := os.Getenv("IP_WHITELIST"); val != "" {
-		cfg.Security.WhiteList = append(cfg.Security.WhiteList, strings.Split(val, ",")...)
-	}
-	if val := os.Getenv("IP_BLACKLIST"); val != "" {
-		cfg.Security.BlackList = append(cfg.Security.BlackList, strings.Split(val, ",")...)
-	}
-	
-	// 下载限制配置
-	if val := os.Getenv("MAX_IMAGES"); val != "" {
-		if maxImages, err := strconv.Atoi(val); err == nil && maxImages > 0 {
-			cfg.Download.MaxImages = maxImages
-		}
-	}
-}
-
-// CreateDefaultConfigFile 创建默认配置文件
-func CreateDefaultConfigFile() error {
-	cfg := DefaultConfig()
-	
-	data, err := toml.Marshal(cfg)
-	if err != nil {
-		return fmt.Errorf("序列化默认配置失败: %v", err)
-	}
-	
-	return os.WriteFile("config.toml", data, 0644)
-} 
+package config
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/pelletier/go-toml/v2"
+)
+
+// RegistryMapping Registry映射配置
+type RegistryMapping struct {
+	Upstream string `toml:"upstream"`
+	AuthHost string `toml:"authHost"`
+	AuthType string `toml:"authType"`
+	Enabled  bool   `toml:"enabled"`
+}
+
+// AppConfig 应用配置结构体
+type AppConfig struct {
+	Server struct {
+		Host           string `toml:"host"`
+		Port           int    `toml:"port"`
+		FileSize       int64  `toml:"fileSize"`
+		EnableH2C      bool   `toml:"enableH2C"`
+		EnableFrontend bool   `toml:"enableFrontend"`
+	} `toml:"server"`
+
+	RateLimit struct {
+		RequestLimit int     `toml:"requestLimit"`
+		PeriodHours  float64 `toml:"periodHours"`
+	} `toml:"rateLimit"`
+
+	Security struct {
+		WhiteList []string `toml:"whiteList"`
+		BlackList []string `toml:"blackList"`
+	} `toml:"security"`
+
+	Access struct {
+		WhiteList []string `toml:"whiteList"`
+		BlackList []string `toml:"blackList"`
+		Proxy     string   `toml:"proxy"`
+	} `toml:"access"`
+
+	Download struct {
+		MaxImages int `toml:"maxImages"`
+	} `toml:"download"`
+
+	Registries map[string]RegistryMapping `toml:"registries"`
+
+	TokenCache struct {
+		Enabled    bool   `toml:"enabled"`
+		DefaultTTL string `toml:"defaultTTL"`
+	} `toml:"tokenCache"`
+}
+
+var (
+	appConfig     *AppConfig
+	appConfigLock sync.RWMutex
+
+	cachedConfig     *AppConfig
+	configCacheTime  time.Time
+	configCacheTTL   = 5 * time.Second
+	configCacheMutex sync.RWMutex
+)
+
+// DefaultConfig 返回默认配置
+func DefaultConfig() *AppConfig {
+	return &AppConfig{
+		Server: struct {
+			Host           string `toml:"host"`
+			Port           int    `toml:"port"`
+			FileSize       int64  `toml:"fileSize"`
+			EnableH2C      bool   `toml:"enableH2C"`
+			EnableFrontend bool   `toml:"enableFrontend"`
+		}{
+			Host:           "0.0.0.0",
+			Port:           5000,
+			FileSize:       2 * 1024 * 1024 * 1024,
+			EnableH2C:      false,
+			EnableFrontend: true,
+		},
+		RateLimit: struct {
+			RequestLimit int     `toml:"requestLimit"`
+			PeriodHours  float64 `toml:"periodHours"`
+		}{
+			RequestLimit: 500,
+			PeriodHours:  3.0,
+		},
+		Security: struct {
+			WhiteList []string `toml:"whiteList"`
+			BlackList []string `toml:"blackList"`
+		}{
+			WhiteList: []string{},
+			BlackList: []string{},
+		},
+		Access: struct {
+			WhiteList []string `toml:"whiteList"`
+			BlackList []string `toml:"blackList"`
+			Proxy     string   `toml:"proxy"`
+		}{
+			WhiteList: []string{},
+			BlackList: []string{},
+			Proxy:     "",
+		},
+		Download: struct {
+			MaxImages int `toml:"maxImages"`
+		}{
+			MaxImages: 10,
+		},
+		Registries: map[string]RegistryMapping{
+			"ghcr.io": {
+				Upstream: "ghcr.io",
+				AuthHost: "ghcr.io/token",
+				AuthType: "github",
+				Enabled:  true,
+			},
+			"gcr.io": {
+				Upstream: "gcr.io",
+				AuthHost: "gcr.io/v2/token",
+				AuthType: "google",
+				Enabled:  true,
+			},
+			"quay.io": {
+				Upstream: "quay.io",
+				AuthHost: "quay.io/v2/auth",
+				AuthType: "quay",
+				Enabled:  true,
+			},
+			"registry.k8s.io": {
+				Upstream: "registry.k8s.io",
+				AuthHost: "registry.k8s.io",
+				AuthType: "anonymous",
+				Enabled:  true,
+			},
+		},
+		TokenCache: struct {
+			Enabled    bool   `toml:"enabled"`
+			DefaultTTL string `toml:"defaultTTL"`
+		}{
+			Enabled:    true,
+			DefaultTTL: "20m",
+		},
+	}
+}
+
+// GetConfig 安全地获取配置副本
+func GetConfig() *AppConfig {
+	configCacheMutex.RLock()
+	if cachedConfig != nil && time.Since(configCacheTime) < configCacheTTL {
+		config := cachedConfig
+		configCacheMutex.RUnlock()
+		return config
+	}
+	configCacheMutex.RUnlock()
+
+	configCacheMutex.Lock()
+	defer configCacheMutex.Unlock()
+
+	if cachedConfig != nil && time.Since(configCacheTime) < configCacheTTL {
+		return cachedConfig
+	}
+
+	appConfigLock.RLock()
+	if appConfig == nil {
+		appConfigLock.RUnlock()
+		defaultCfg := DefaultConfig()
+		cachedConfig = defaultCfg
+		configCacheTime = time.Now()
+		return defaultCfg
+	}
+
+	configCopy := *appConfig
+	configCopy.Security.WhiteList = append([]string(nil), appConfig.Security.WhiteList...)
+	configCopy.Security.BlackList = append([]string(nil), appConfig.Security.BlackList...)
+	configCopy.Access.WhiteList = append([]string(nil), appConfig.Access.WhiteList...)
+	configCopy.Access.BlackList = append([]string(nil), appConfig.Access.BlackList...)
+	appConfigLock.RUnlock()
+
+	cachedConfig = &configCopy
+	configCacheTime = time.Now()
+
+	return cachedConfig
+}
+
+// setConfig 安全地设置配置
+func setConfig(cfg *AppConfig) {
+	appConfigLock.Lock()
+	defer appConfigLock.Unlock()
+	appConfig = cfg
+
+	configCacheMutex.Lock()
+	cachedConfig = nil
+	configCacheMutex.Unlock()
+}
+
+func configFilePath() string {
+	if path := strings.TrimSpace(os.Getenv("CONFIG_PATH")); path != "" {
+		return path
+	}
+	return "config.toml"
+}
+
+func LoadConfig() error {
+	cfg := DefaultConfig()
+	path := configFilePath()
+
+	if data, err := os.ReadFile(path); err == nil {
+		if err := toml.Unmarshal(data, cfg); err != nil {
+			return fmt.Errorf("解析配置文件 %s 失败: %v", path, err)
+		}
+	} else {
+		fmt.Printf("未找到配置文件 %s，使用默认配置\n", path)
+	}
+
+	overrideFromEnv(cfg)
+	setConfig(cfg)
+
+	return nil
+}
+
+// overrideFromEnv 从环境变量覆盖配置
+func overrideFromEnv(cfg *AppConfig) {
+	if val := os.Getenv("SERVER_HOST"); val != "" {
+		cfg.Server.Host = val
+	}
+	if val := os.Getenv("SERVER_PORT"); val != "" {
+		if port, err := strconv.Atoi(val); err == nil && port > 0 {
+			cfg.Server.Port = port
+		}
+	}
+	if val := os.Getenv("ENABLE_H2C"); val != "" {
+		if enable, err := strconv.ParseBool(val); err == nil {
+			cfg.Server.EnableH2C = enable
+		}
+	}
+	if val := os.Getenv("ENABLE_FRONTEND"); val != "" {
+		if enable, err := strconv.ParseBool(val); err == nil {
+			cfg.Server.EnableFrontend = enable
+		}
+	}
+	if val := os.Getenv("MAX_FILE_SIZE"); val != "" {
+		if size, err := strconv.ParseInt(val, 10, 64); err == nil && size > 0 {
+			cfg.Server.FileSize = size
+		}
+	}
+
+	if val := os.Getenv("RATE_LIMIT"); val != "" {
+		if limit, err := strconv.Atoi(val); err == nil && limit > 0 {
+			cfg.RateLimit.RequestLimit = limit
+		}
+	}
+	if val := os.Getenv("RATE_PERIOD_HOURS"); val != "" {
+		if period, err := strconv.ParseFloat(val, 64); err == nil && period > 0 {
+			cfg.RateLimit.PeriodHours = period
+		}
+	}
+
+	if val := os.Getenv("IP_WHITELIST"); val != "" {
+		cfg.Security.WhiteList = append(cfg.Security.WhiteList, strings.Split(val, ",")...)
+	}
+	if val := os.Getenv("IP_BLACKLIST"); val != "" {
+		cfg.Security.BlackList = append(cfg.Security.BlackList, strings.Split(val, ",")...)
+	}
+
+	if val, ok := os.LookupEnv("ACCESS_PROXY"); ok {
+		cfg.Access.Proxy = strings.TrimSpace(val)
+	}
+
+	if val := os.Getenv("MAX_IMAGES"); val != "" {
+		if maxImages, err := strconv.Atoi(val); err == nil && maxImages > 0 {
+			cfg.Download.MaxImages = maxImages
+		}
+	}
+}
+
+// CreateDefaultConfigFile 创建默认配置文件
+func CreateDefaultConfigFile() error {
+	cfg := DefaultConfig()
+
+	data, err := toml.Marshal(cfg)
+	if err != nil {
+		return fmt.Errorf("序列化默认配置失败: %v", err)
+	}
+
+	return os.WriteFile("config.toml", data, 0644)
+}

src/config/config_test.go

@@ -0,0 +1,41 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadConfigUsesConfigPathAndEnvOverrides(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "custom.toml")
+	data := []byte(`
+[server]
+host = "127.0.0.1"
+port = 5999
+
+[access]
+proxy = "socks5://127.0.0.1:1080"
+`)
+	if err := os.WriteFile(path, data, 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("CONFIG_PATH", path)
+	t.Setenv("SERVER_PORT", "6001")
+	t.Setenv("ACCESS_PROXY", "")
+
+	if err := LoadConfig(); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := GetConfig()
+	if cfg.Server.Host != "127.0.0.1" {
+		t.Fatalf("Server.Host = %q", cfg.Server.Host)
+	}
+	if cfg.Server.Port != 6001 {
+		t.Fatalf("Server.Port = %d, want 6001", cfg.Server.Port)
+	}
+	if cfg.Access.Proxy != "" {
+		t.Fatalf("Access.Proxy = %q, want empty override", cfg.Access.Proxy)
+	}
+}

src/docker.go

@@ -1,677 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/google/go-containerregistry/pkg/authn"
-	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/google/go-containerregistry/pkg/v1/remote"
-)
-
-// DockerProxy Docker代理配置
-type DockerProxy struct {
-	registry name.Registry
-	options  []remote.Option
-}
-
-var dockerProxy *DockerProxy
-
-// RegistryDetector Registry检测器
-type RegistryDetector struct{}
-
-// detectRegistryDomain 检测Registry域名并返回域名和剩余路径
-func (rd *RegistryDetector) detectRegistryDomain(path string) (string, string) {
-	cfg := GetConfig()
-	
-	// 检查路径是否以已知Registry域名开头
-	for domain := range cfg.Registries {
-		if strings.HasPrefix(path, domain+"/") {
-			// 找到匹配的域名，返回域名和剩余路径
-			remainingPath := strings.TrimPrefix(path, domain+"/")
-			return domain, remainingPath
-		}
-	}
-	
-	return "", path
-}
-
-// isRegistryEnabled 检查Registry是否启用
-func (rd *RegistryDetector) isRegistryEnabled(domain string) bool {
-	cfg := GetConfig()
-	if mapping, exists := cfg.Registries[domain]; exists {
-		return mapping.Enabled
-	}
-	return false
-}
-
-// getRegistryMapping 获取Registry映射配置
-func (rd *RegistryDetector) getRegistryMapping(domain string) (RegistryMapping, bool) {
-	cfg := GetConfig()
-	mapping, exists := cfg.Registries[domain]
-	return mapping, exists && mapping.Enabled
-}
-
-var registryDetector = &RegistryDetector{}
-
-// 初始化Docker代理
-func initDockerProxy() {
-	// 创建目标registry
-	registry, err := name.NewRegistry("registry-1.docker.io")
-	if err != nil {
-		fmt.Printf("创建Docker registry失败: %v\n", err)
-		return
-	}
-
-	// 配置代理选项
-	options := []remote.Option{
-		remote.WithAuth(authn.Anonymous),
-		remote.WithUserAgent("hubproxy/go-containerregistry"),
-	}
-
-	dockerProxy = &DockerProxy{
-		registry: registry,
-		options:  options,
-	}
-}
-
-// ProxyDockerRegistryGin 标准Docker Registry API v2代理
-func ProxyDockerRegistryGin(c *gin.Context) {
-	path := c.Request.URL.Path
-
-	// 处理 /v2/ API版本检查
-	if path == "/v2/" {
-		c.JSON(http.StatusOK, gin.H{})
-		return
-	}
-
-	// 处理不同的API端点
-	if strings.HasPrefix(path, "/v2/") {
-		handleRegistryRequest(c, path)
-	} else {
-		c.String(http.StatusNotFound, "Docker Registry API v2 only")
-	}
-}
-
-// handleRegistryRequest 处理Registry请求
-func handleRegistryRequest(c *gin.Context, path string) {
-	// 移除 /v2/ 前缀
-	pathWithoutV2 := strings.TrimPrefix(path, "/v2/")
-	
-	if registryDomain, remainingPath := registryDetector.detectRegistryDomain(pathWithoutV2); registryDomain != "" {
-		if registryDetector.isRegistryEnabled(registryDomain) {
-			// 设置目标Registry信息到Context
-			c.Set("target_registry_domain", registryDomain)
-			c.Set("target_path", remainingPath)
-			
-			// 处理多Registry请求
-			handleMultiRegistryRequest(c, registryDomain, remainingPath)
-			return
-		}
-	}
-	
-	imageName, apiType, reference := parseRegistryPath(pathWithoutV2)
-	if imageName == "" || apiType == "" {
-		c.String(http.StatusBadRequest, "Invalid path format")
-		return
-	}
-
-	// 自动处理官方镜像的library命名空间
-	if !strings.Contains(imageName, "/") {
-		imageName = "library/" + imageName
-	}
-
-	// Docker镜像访问控制检查
-	if allowed, reason := GlobalAccessController.CheckDockerAccess(imageName); !allowed {
-		fmt.Printf("Docker镜像 %s 访问被拒绝: %s\n", imageName, reason)
-		c.String(http.StatusForbidden, "镜像访问被限制")
-		return
-	}
-
-	// 构建完整的镜像引用
-	imageRef := fmt.Sprintf("%s/%s", dockerProxy.registry.Name(), imageName)
-
-	switch apiType {
-	case "manifests":
-		handleManifestRequest(c, imageRef, reference)
-	case "blobs":
-		handleBlobRequest(c, imageRef, reference)
-	case "tags":
-		handleTagsRequest(c, imageRef)
-	default:
-		c.String(http.StatusNotFound, "API endpoint not found")
-	}
-}
-
-// parseRegistryPath 解析Registry路径
-func parseRegistryPath(path string) (imageName, apiType, reference string) {
-	// 查找API端点关键字
-	if idx := strings.Index(path, "/manifests/"); idx != -1 {
-		imageName = path[:idx]
-		apiType = "manifests"
-		reference = path[idx+len("/manifests/"):]
-		return
-	}
-	
-	if idx := strings.Index(path, "/blobs/"); idx != -1 {
-		imageName = path[:idx]
-		apiType = "blobs"
-		reference = path[idx+len("/blobs/"):]
-		return
-	}
-	
-	if idx := strings.Index(path, "/tags/list"); idx != -1 {
-		imageName = path[:idx]
-		apiType = "tags"
-		reference = "list"
-		return
-	}
-
-	return "", "", ""
-}
-
-// handleManifestRequest 处理manifest请求
-func handleManifestRequest(c *gin.Context, imageRef, reference string) {
-	// Manifest缓存逻辑(仅对GET请求缓存)
-	if isCacheEnabled() && c.Request.Method == http.MethodGet {
-		cacheKey := buildManifestCacheKey(imageRef, reference)
-		
-		// 优先从缓存获取
-		if cachedItem := globalCache.Get(cacheKey); cachedItem != nil {
-			writeCachedResponse(c, cachedItem)
-			return
-		}
-	}
-	
-	var ref name.Reference
-	var err error
-
-	// 判断reference是digest还是tag
-	if strings.HasPrefix(reference, "sha256:") {
-		// 是digest
-		ref, err = name.NewDigest(fmt.Sprintf("%s@%s", imageRef, reference))
-	} else {
-		// 是tag
-		ref, err = name.NewTag(fmt.Sprintf("%s:%s", imageRef, reference))
-	}
-
-	if err != nil {
-		fmt.Printf("解析镜像引用失败: %v\n", err)
-		c.String(http.StatusBadRequest, "Invalid reference")
-		return
-	}
-
-	// 根据请求方法选择操作
-	if c.Request.Method == http.MethodHead {
-		// HEAD请求，使用remote.Head
-		desc, err := remote.Head(ref, dockerProxy.options...)
-		if err != nil {
-			fmt.Printf("HEAD请求失败: %v\n", err)
-			c.String(http.StatusNotFound, "Manifest not found")
-			return
-		}
-
-		// 设置响应头
-		c.Header("Content-Type", string(desc.MediaType))
-		c.Header("Docker-Content-Digest", desc.Digest.String())
-		c.Header("Content-Length", fmt.Sprintf("%d", desc.Size))
-		c.Status(http.StatusOK)
-	} else {
-		// GET请求，使用remote.Get
-		desc, err := remote.Get(ref, dockerProxy.options...)
-		if err != nil {
-			fmt.Printf("GET请求失败: %v\n", err)
-			c.String(http.StatusNotFound, "Manifest not found")
-			return
-		}
-
-		// 设置响应头
-		headers := map[string]string{
-			"Docker-Content-Digest": desc.Digest.String(),
-			"Content-Length":        fmt.Sprintf("%d", len(desc.Manifest)),
-		}
-		
-		// 缓存响应
-		if isCacheEnabled() {
-			cacheKey := buildManifestCacheKey(imageRef, reference)
-			ttl := getManifestTTL(reference)
-			globalCache.Set(cacheKey, desc.Manifest, string(desc.MediaType), headers, ttl)
-		}
-
-		// 设置响应头
-		c.Header("Content-Type", string(desc.MediaType))
-		for key, value := range headers {
-			c.Header(key, value)
-		}
-
-		// 返回manifest内容
-		c.Data(http.StatusOK, string(desc.MediaType), desc.Manifest)
-	}
-}
-
-// handleBlobRequest 处理blob请求
-func handleBlobRequest(c *gin.Context, imageRef, digest string) {
-	// 构建digest引用
-	digestRef, err := name.NewDigest(fmt.Sprintf("%s@%s", imageRef, digest))
-	if err != nil {
-		fmt.Printf("解析digest引用失败: %v\n", err)
-		c.String(http.StatusBadRequest, "Invalid digest reference")
-		return
-	}
-
-	// 使用remote.Layer获取layer
-	layer, err := remote.Layer(digestRef, dockerProxy.options...)
-	if err != nil {
-		fmt.Printf("获取layer失败: %v\n", err)
-		c.String(http.StatusNotFound, "Layer not found")
-		return
-	}
-
-	// 获取layer信息
-	size, err := layer.Size()
-	if err != nil {
-		fmt.Printf("获取layer大小失败: %v\n", err)
-		c.String(http.StatusInternalServerError, "Failed to get layer size")
-		return
-	}
-
-	// 获取layer内容
-	reader, err := layer.Compressed()
-	if err != nil {
-		fmt.Printf("获取layer内容失败: %v\n", err)
-		c.String(http.StatusInternalServerError, "Failed to get layer content")
-		return
-	}
-	defer reader.Close()
-
-	// 设置响应头
-	c.Header("Content-Type", "application/octet-stream")
-	c.Header("Content-Length", fmt.Sprintf("%d", size))
-	c.Header("Docker-Content-Digest", digest)
-
-	// 流式传输blob内容
-	c.Status(http.StatusOK)
-	io.Copy(c.Writer, reader)
-}
-
-// handleTagsRequest 处理tags列表请求
-func handleTagsRequest(c *gin.Context, imageRef string) {
-	// 解析repository
-	repo, err := name.NewRepository(imageRef)
-	if err != nil {
-		fmt.Printf("解析repository失败: %v\n", err)
-		c.String(http.StatusBadRequest, "Invalid repository")
-		return
-	}
-
-	// 使用remote.List获取tags
-	tags, err := remote.List(repo, dockerProxy.options...)
-	if err != nil {
-		fmt.Printf("获取tags失败: %v\n", err)
-		c.String(http.StatusNotFound, "Tags not found")
-		return
-	}
-
-	// 构建响应
-	response := map[string]interface{}{
-		"name": strings.TrimPrefix(imageRef, dockerProxy.registry.Name()+"/"),
-		"tags": tags,
-	}
-
-	c.JSON(http.StatusOK, response)
-}
-
-// ProxyDockerAuthGin Docker认证代理（带缓存优化）
-func ProxyDockerAuthGin(c *gin.Context) {
-	// 检查是否启用token缓存
-	if isTokenCacheEnabled() {
-		proxyDockerAuthWithCache(c)
-	} else {
-		proxyDockerAuthOriginal(c)
-	}
-}
-
-// proxyDockerAuthWithCache 带缓存的认证代理
-func proxyDockerAuthWithCache(c *gin.Context) {
-	// 1. 构建缓存key（基于完整的查询参数）
-	cacheKey := buildTokenCacheKey(c.Request.URL.RawQuery)
-	
-	// 2. 尝试从缓存获取token
-	if cachedToken := globalCache.GetToken(cacheKey); cachedToken != "" {
-		writeTokenResponse(c, cachedToken)
-		return
-	}
-	
-	// 3. 缓存未命中，创建响应记录器
-	recorder := &ResponseRecorder{
-		ResponseWriter: c.Writer,
-		statusCode:     200,
-	}
-	c.Writer = recorder
-	
-	// 4. 调用原有认证逻辑
-	proxyDockerAuthOriginal(c)
-	
-	// 5. 如果认证成功，缓存响应
-	if recorder.statusCode == 200 && len(recorder.body) > 0 {
-		ttl := extractTTLFromResponse(recorder.body)
-		globalCache.SetToken(cacheKey, string(recorder.body), ttl)
-	}
-	
-	// 6. 写入实际响应（如果还没写入）
-	if !recorder.written {
-		c.Writer = recorder.ResponseWriter
-		c.Data(recorder.statusCode, "application/json", recorder.body)
-	}
-}
-
-// ResponseRecorder HTTP响应记录器
-type ResponseRecorder struct {
-	gin.ResponseWriter
-	statusCode int
-	body       []byte
-	written    bool
-}
-
-func (r *ResponseRecorder) WriteHeader(code int) {
-	r.statusCode = code
-}
-
-func (r *ResponseRecorder) Write(data []byte) (int, error) {
-	r.body = append(r.body, data...)
-	r.written = true
-	return r.ResponseWriter.Write(data)
-}
-
-func proxyDockerAuthOriginal(c *gin.Context) {
-	var authURL string
-	if targetDomain, exists := c.Get("target_registry_domain"); exists {
-		if mapping, found := registryDetector.getRegistryMapping(targetDomain.(string)); found {
-			// 使用Registry特定的认证服务器
-			authURL = "https://" + mapping.AuthHost + c.Request.URL.Path
-		} else {
-			// fallback到默认Docker认证
-			authURL = "https://auth.docker.io" + c.Request.URL.Path
-		}
-	} else {
-		// 构建默认Docker认证URL
-		authURL = "https://auth.docker.io" + c.Request.URL.Path
-	}
-	
-	if c.Request.URL.RawQuery != "" {
-		authURL += "?" + c.Request.URL.RawQuery
-	}
-
-	// 创建HTTP客户端
-	client := &http.Client{
-		Timeout: 30 * time.Second,
-	}
-
-	// 创建请求
-	req, err := http.NewRequestWithContext(
-		context.Background(),
-		c.Request.Method,
-		authURL,
-		c.Request.Body,
-	)
-	if err != nil {
-		c.String(http.StatusInternalServerError, "Failed to create request")
-		return
-	}
-
-	// 复制请求头
-	for key, values := range c.Request.Header {
-		for _, value := range values {
-			req.Header.Add(key, value)
-		}
-	}
-
-	// 执行请求
-	resp, err := client.Do(req)
-	if err != nil {
-		c.String(http.StatusBadGateway, "Auth request failed")
-		return
-	}
-	defer resp.Body.Close()
-
-	// 获取当前代理的Host地址
-	proxyHost := c.Request.Host
-	if proxyHost == "" {
-		// 使用配置中的服务器地址和端口
-		cfg := GetConfig()
-		proxyHost = fmt.Sprintf("%s:%d", cfg.Server.Host, cfg.Server.Port)
-		if cfg.Server.Host == "0.0.0.0" {
-			proxyHost = fmt.Sprintf("localhost:%d", cfg.Server.Port)
-		}
-	}
-
-	// 复制响应头并重写认证URL
-	for key, values := range resp.Header {
-		for _, value := range values {
-			// 重写WWW-Authenticate头中的realm URL
-			if key == "Www-Authenticate" {
-				// 支持多Registry的URL重写
-				value = rewriteAuthHeader(value, proxyHost)
-			}
-			c.Header(key, value)
-		}
-	}
-
-	// 返回响应
-	c.Status(resp.StatusCode)
-	io.Copy(c.Writer, resp.Body)
-}
-
-// rewriteAuthHeader 重写认证头
-func rewriteAuthHeader(authHeader, proxyHost string) string {
-	// 重写各种Registry的认证URL
-	authHeader = strings.ReplaceAll(authHeader, "https://auth.docker.io", "http://"+proxyHost)
-	authHeader = strings.ReplaceAll(authHeader, "https://ghcr.io", "http://"+proxyHost)
-	authHeader = strings.ReplaceAll(authHeader, "https://gcr.io", "http://"+proxyHost)
-	authHeader = strings.ReplaceAll(authHeader, "https://quay.io", "http://"+proxyHost)
-	
-	return authHeader
-}
-
-// handleMultiRegistryRequest 处理多Registry请求
-func handleMultiRegistryRequest(c *gin.Context, registryDomain, remainingPath string) {
-	// 获取Registry映射配置
-	mapping, exists := registryDetector.getRegistryMapping(registryDomain)
-	if !exists {
-		c.String(http.StatusBadRequest, "Registry not configured")
-		return
-	}
-	
-	// 解析剩余路径
-	imageName, apiType, reference := parseRegistryPath(remainingPath)
-	if imageName == "" || apiType == "" {
-		c.String(http.StatusBadRequest, "Invalid path format")
-		return
-	}
-
-	// 访问控制检查（使用完整的镜像路径）
-	fullImageName := registryDomain + "/" + imageName
-	if allowed, reason := GlobalAccessController.CheckDockerAccess(fullImageName); !allowed {
-		fmt.Printf("镜像 %s 访问被拒绝: %s\n", fullImageName, reason)
-		c.String(http.StatusForbidden, "镜像访问被限制")
-		return
-	}
-
-	// 构建上游Registry引用
-	upstreamImageRef := fmt.Sprintf("%s/%s", mapping.Upstream, imageName)
-
-	// 根据API类型处理请求
-	switch apiType {
-	case "manifests":
-		handleUpstreamManifestRequest(c, upstreamImageRef, reference, mapping)
-	case "blobs":
-		handleUpstreamBlobRequest(c, upstreamImageRef, reference, mapping)
-	case "tags":
-		handleUpstreamTagsRequest(c, upstreamImageRef, mapping)
-	default:
-		c.String(http.StatusNotFound, "API endpoint not found")
-	}
-}
-
-// handleUpstreamManifestRequest 处理上游Registry的manifest请求
-func handleUpstreamManifestRequest(c *gin.Context, imageRef, reference string, mapping RegistryMapping) {
-	// Manifest缓存逻辑(仅对GET请求缓存)
-	if isCacheEnabled() && c.Request.Method == http.MethodGet {
-		cacheKey := buildManifestCacheKey(imageRef, reference)
-		
-		// 优先从缓存获取
-		if cachedItem := globalCache.Get(cacheKey); cachedItem != nil {
-			writeCachedResponse(c, cachedItem)
-			return
-		}
-	}
-	
-	var ref name.Reference
-	var err error
-
-	// 判断reference是digest还是tag
-	if strings.HasPrefix(reference, "sha256:") {
-		ref, err = name.NewDigest(fmt.Sprintf("%s@%s", imageRef, reference))
-	} else {
-		ref, err = name.NewTag(fmt.Sprintf("%s:%s", imageRef, reference))
-	}
-
-	if err != nil {
-		fmt.Printf("解析镜像引用失败: %v\n", err)
-		c.String(http.StatusBadRequest, "Invalid reference")
-		return
-	}
-
-	// 创建针对上游Registry的选项
-	options := createUpstreamOptions(mapping)
-
-	// 根据请求方法选择操作
-	if c.Request.Method == http.MethodHead {
-		desc, err := remote.Head(ref, options...)
-		if err != nil {
-			fmt.Printf("HEAD请求失败: %v\n", err)
-			c.String(http.StatusNotFound, "Manifest not found")
-			return
-		}
-
-		c.Header("Content-Type", string(desc.MediaType))
-		c.Header("Docker-Content-Digest", desc.Digest.String())
-		c.Header("Content-Length", fmt.Sprintf("%d", desc.Size))
-		c.Status(http.StatusOK)
-	} else {
-		desc, err := remote.Get(ref, options...)
-		if err != nil {
-			fmt.Printf("GET请求失败: %v\n", err)
-			c.String(http.StatusNotFound, "Manifest not found")
-			return
-		}
-
-		// 设置响应头
-		headers := map[string]string{
-			"Docker-Content-Digest": desc.Digest.String(),
-			"Content-Length":        fmt.Sprintf("%d", len(desc.Manifest)),
-		}
-		
-		// 缓存响应
-		if isCacheEnabled() {
-			cacheKey := buildManifestCacheKey(imageRef, reference)
-			ttl := getManifestTTL(reference)
-			globalCache.Set(cacheKey, desc.Manifest, string(desc.MediaType), headers, ttl)
-		}
-
-		// 设置响应头
-		c.Header("Content-Type", string(desc.MediaType))
-		for key, value := range headers {
-			c.Header(key, value)
-		}
-		
-		c.Data(http.StatusOK, string(desc.MediaType), desc.Manifest)
-	}
-}
-
-// handleUpstreamBlobRequest 处理上游Registry的blob请求
-func handleUpstreamBlobRequest(c *gin.Context, imageRef, digest string, mapping RegistryMapping) {
-	digestRef, err := name.NewDigest(fmt.Sprintf("%s@%s", imageRef, digest))
-	if err != nil {
-		fmt.Printf("解析digest引用失败: %v\n", err)
-		c.String(http.StatusBadRequest, "Invalid digest reference")
-		return
-	}
-
-	options := createUpstreamOptions(mapping)
-	layer, err := remote.Layer(digestRef, options...)
-	if err != nil {
-		fmt.Printf("获取layer失败: %v\n", err)
-		c.String(http.StatusNotFound, "Layer not found")
-		return
-	}
-
-	size, err := layer.Size()
-	if err != nil {
-		fmt.Printf("获取layer大小失败: %v\n", err)
-		c.String(http.StatusInternalServerError, "Failed to get layer size")
-		return
-	}
-
-	reader, err := layer.Compressed()
-	if err != nil {
-		fmt.Printf("获取layer内容失败: %v\n", err)
-		c.String(http.StatusInternalServerError, "Failed to get layer content")
-		return
-	}
-	defer reader.Close()
-
-	c.Header("Content-Type", "application/octet-stream")
-	c.Header("Content-Length", fmt.Sprintf("%d", size))
-	c.Header("Docker-Content-Digest", digest)
-
-	c.Status(http.StatusOK)
-	io.Copy(c.Writer, reader)
-}
-
-// handleUpstreamTagsRequest 处理上游Registry的tags请求
-func handleUpstreamTagsRequest(c *gin.Context, imageRef string, mapping RegistryMapping) {
-	repo, err := name.NewRepository(imageRef)
-	if err != nil {
-		fmt.Printf("解析repository失败: %v\n", err)
-		c.String(http.StatusBadRequest, "Invalid repository")
-		return
-	}
-
-	options := createUpstreamOptions(mapping)
-	tags, err := remote.List(repo, options...)
-	if err != nil {
-		fmt.Printf("获取tags失败: %v\n", err)
-		c.String(http.StatusNotFound, "Tags not found")
-		return
-	}
-
-	response := map[string]interface{}{
-		"name": strings.TrimPrefix(imageRef, mapping.Upstream+"/"),
-		"tags": tags,
-	}
-
-	c.JSON(http.StatusOK, response)
-}
-
-// createUpstreamOptions 创建上游Registry选项
-func createUpstreamOptions(mapping RegistryMapping) []remote.Option {
-	options := []remote.Option{
-		remote.WithAuth(authn.Anonymous),
-		remote.WithUserAgent("hubproxy/go-containerregistry"),
-	}
-
-	// 根据Registry类型添加特定的认证选项（方便后续扩展）
-	switch mapping.AuthType {
-	case "github":
-	case "google":
-	case "quay":
-	}
-
-	return options
-}

src/go.mod

@@ -1,35 +1,33 @@
 module hubproxy
 
-go 1.24.0
+go 1.26
 
 require (
-	github.com/fsnotify/fsnotify v1.8.0
-	github.com/gin-gonic/gin v1.10.0
-	github.com/google/go-containerregistry v0.20.5
-	github.com/pelletier/go-toml/v2 v2.2.3
-	github.com/spf13/viper v1.20.1
-	golang.org/x/time v0.11.0
+	github.com/gin-gonic/gin v1.12.0
+	github.com/google/go-containerregistry v0.21.5
+	github.com/pelletier/go-toml/v2 v2.3.1
+	golang.org/x/net v0.53.0
+	golang.org/x/time v0.15.0
 )
 
 require (
-	github.com/bytedance/sonic v1.11.6 // indirect
-	github.com/bytedance/sonic/loader v0.1.1 // indirect
-	github.com/cloudwego/base64x v0.1.4 // indirect
-	github.com/cloudwego/iasm v0.2.0 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
-	github.com/docker/cli v28.1.1+incompatible // indirect
-	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/bytedance/gopkg v0.1.3 // indirect
+	github.com/bytedance/sonic v1.15.0 // indirect
+	github.com/bytedance/sonic/loader v0.5.0 // indirect
+	github.com/cloudwego/base64x v0.1.6 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
+	github.com/docker/cli v29.4.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
-	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
+	github.com/gin-contrib/sse v1.1.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.20.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/go-playground/validator/v10 v10.30.1 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
@@ -37,25 +35,18 @@ require (
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
-	github.com/sagikazarmark/locafero v0.7.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/sourcegraph/conc v0.3.0 // indirect
-	github.com/spf13/afero v1.12.0 // indirect
-	github.com/spf13/cast v1.7.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
-	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/quic-go/quic-go v0.59.0 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.2.12 // indirect
-	github.com/vbatts/tar-split v0.12.1 // indirect
-	go.uber.org/atomic v1.9.0 // indirect
-	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/arch v0.8.0 // indirect
-	golang.org/x/crypto v0.32.0 // indirect
-	golang.org/x/net v0.33.0 // indirect
-	golang.org/x/sync v0.14.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	google.golang.org/protobuf v1.36.3 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	github.com/ugorji/go/codec v1.3.1 // indirect
+	github.com/vbatts/tar-split v0.12.2 // indirect
+	go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
+	golang.org/x/arch v0.22.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
+	gotest.tools/v3 v3.5.2 // indirect
 )

src/go.sum

@@ -1,61 +1,49 @@
-github.com/bytedance/sonic v1.11.6 h1:oUp34TzMlL+OY1OUWxHqsdkgC/Zfc85zGqw9siXjrc0=
-github.com/bytedance/sonic v1.11.6/go.mod h1:LysEHSvpvDySVdC2f87zGWf6CIKJcAvqab1ZaiQtds4=
-github.com/bytedance/sonic/loader v0.1.1 h1:c+e5Pt1k/cy5wMveRDyk2X4B9hF4g7an8N3zCYjJFNM=
-github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
-github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/0Y=
-github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
-github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
-github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
+github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
+github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
+github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
+github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
+github.com/bytedance/sonic/loader v0.5.0 h1:gXH3KVnatgY7loH5/TkeVyXPfESoqSBSBEiDd5VjlgE=
+github.com/bytedance/sonic/loader v0.5.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
+github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
+github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
+github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
+github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docker/cli v28.1.1+incompatible h1:eyUemzeI45DY7eDPuwUcmDyDj1pM98oD5MdSpiItp8k=
-github.com/docker/cli v28.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
-github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/cli v29.4.0+incompatible h1:+IjXULMetlvWJiuSI0Nbor36lcJ5BTcVpUmB21KBoVM=
+github.com/docker/cli v29.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
-github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
-github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
-github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
-github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
-github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
-github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU=
-github.com/gin-gonic/gin v1.10.0/go.mod h1:4PMNQiOhvDRa013RKVbsiNwoyezlm2rm0uX/T7kzp5Y=
+github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
+github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
+github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
+github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
+github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.20.0 h1:K9ISHbSaI0lyB2eWMPJo+kOS/FBExVwjEviJTixqxL8=
-github.com/go-playground/validator/v10 v10.20.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
-github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
-github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
-github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
+github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.20.5 h1:4RnlYcDs5hoA++CeFjlbZ/U9Yp1EuWr+UhhTyYQjOP0=
-github.com/google/go-containerregistry v0.20.5/go.mod h1:Q14vdOOzug02bwnhMkZKD4e30pDaD9W65qzXpyzF49E=
+github.com/google/go-containerregistry v0.21.5 h1:KTJG9Pn/jC0VdZR6ctV3/jcN+q6/Iqlx0sTVz3ywZlM=
+github.com/google/go-containerregistry v0.21.5/go.mod h1:ySvMuiWg+dOsRW0Hw8GYwfMwBlNRTmpYBFJPlkco5zU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
-github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
-github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -71,77 +59,57 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
-github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
+github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
-github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
-github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
-github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
-github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
-github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
-github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
-github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
+github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
-github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
-github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
-github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
-github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo=
-github.com/vbatts/tar-split v0.12.1/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
-go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
-go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
-go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
-golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
-golang.org/x/arch v0.8.0 h1:3wRIsP3pM4yUptoR96otTUOXI367OS0+c9eeRi9doIc=
-golang.org/x/arch v0.8.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
-golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
+github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
+github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
+github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
+go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
+go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+golang.org/x/arch v0.22.0 h1:c/Zle32i5ttqRXjdLyyHZESLD/bB90DCU1g9l/0YBDI=
+golang.org/x/arch v0.22.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
-golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
-google.golang.org/protobuf v1.36.3 h1:82DV7MYdb8anAVi3qge1wSnMDrnKK7ebr+I0hHRN1BU=
-google.golang.org/protobuf v1.36.3/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
-gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
-nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
-rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=

src/handlers/docker.go

@@ -0,0 +1,669 @@
+package handlers
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"hubproxy/config"
+	"hubproxy/utils"
+)
+
+type registryTarget struct {
+	Name              string
+	Upstream          string
+	AuthRealm         string
+	AuthService       string
+	AutoLibraryPrefix bool
+}
+
+const (
+	dockerHubName         = "docker.io"
+	dockerHubUpstream     = "https://registry-1.docker.io"
+	dockerHubAuthRealm    = "https://auth.docker.io/token"
+	dockerHubAuthService  = "registry.docker.io"
+	maxCachedManifestSize = 4 << 20
+	maxAnonymousTokens    = 4096
+)
+
+var hopByHopHeaders = map[string]struct{}{
+	"connection":          {},
+	"keep-alive":          {},
+	"proxy-authenticate":  {},
+	"proxy-authorization": {},
+	"te":                  {},
+	"trailer":             {},
+	"transfer-encoding":   {},
+	"upgrade":             {},
+}
+
+var forwardedRequestHeaders = []string{
+	"Authorization",
+	"Accept",
+	"Range",
+	"If-Range",
+	"If-Match",
+	"If-None-Match",
+	"If-Modified-Since",
+	"If-Unmodified-Since",
+}
+
+type anonymousTokenStore struct {
+	mu      sync.Mutex
+	entries map[string]time.Time
+}
+
+var anonymousTokens = &anonymousTokenStore{entries: make(map[string]time.Time)}
+
+// 保留初始化入口，在线代理无状态。
+func InitDockerProxy() {}
+
+func defaultRegistryTarget() registryTarget {
+	cfg := config.GetConfig()
+	if mapping, exists := cfg.Registries[dockerHubName]; exists && mapping.Enabled {
+		target := registryTargetFromMapping(dockerHubName, mapping)
+		target.AuthService = dockerHubAuthService
+		target.AutoLibraryPrefix = true
+		return target
+	}
+
+	return registryTarget{
+		Name:              dockerHubName,
+		Upstream:          dockerHubUpstream,
+		AuthRealm:         dockerHubAuthRealm,
+		AuthService:       dockerHubAuthService,
+		AutoLibraryPrefix: true,
+	}
+}
+
+func registryTargetFromMapping(name string, mapping config.RegistryMapping) registryTarget {
+	upstream := strings.TrimRight(strings.TrimSpace(mapping.Upstream), "/")
+	if upstream == "" {
+		upstream = name
+	}
+	if !strings.HasPrefix(upstream, "http://") && !strings.HasPrefix(upstream, "https://") {
+		upstream = "https://" + upstream
+	}
+
+	authRealm := strings.TrimSpace(mapping.AuthHost)
+	if authRealm == "" {
+		authRealm = strings.TrimPrefix(upstream, "https://")
+		authRealm = strings.TrimPrefix(authRealm, "http://")
+	}
+	if !strings.HasPrefix(authRealm, "http://") && !strings.HasPrefix(authRealm, "https://") {
+		authRealm = "https://" + authRealm
+	}
+
+	authService := strings.TrimPrefix(strings.TrimPrefix(upstream, "https://"), "http://")
+
+	return registryTarget{
+		Name:              name,
+		Upstream:          upstream,
+		AuthRealm:         authRealm,
+		AuthService:       authService,
+		AutoLibraryPrefix: false,
+	}
+}
+
+func resolveRegistryTarget(c *gin.Context, pathWithoutV2 string) (registryTarget, string) {
+	cfg := config.GetConfig()
+
+	if ns := strings.TrimSpace(c.Query("ns")); ns != "" {
+		if mapping, exists := cfg.Registries[ns]; exists && mapping.Enabled {
+			return registryTargetFromMapping(ns, mapping), pathWithoutV2
+		}
+	}
+
+	for domain, mapping := range cfg.Registries {
+		if mapping.Enabled && strings.HasPrefix(pathWithoutV2, domain+"/") {
+			return registryTargetFromMapping(domain, mapping), strings.TrimPrefix(pathWithoutV2, domain+"/")
+		}
+	}
+
+	return defaultRegistryTarget(), pathWithoutV2
+}
+
+func resolveTokenTarget(c *gin.Context) (registryTarget, bool) {
+	name := strings.Trim(strings.TrimSpace(c.Param("path")), "/")
+	if name == "" || isDockerHubAlias(name) {
+		return inferTokenTargetFromScope(c.Query("scope"))
+	}
+
+	cfg := config.GetConfig()
+	if mapping, exists := cfg.Registries[name]; exists && mapping.Enabled {
+		return registryTargetFromMapping(name, mapping), true
+	}
+
+	return registryTarget{}, false
+}
+
+func inferTokenTargetFromScope(scope string) (registryTarget, bool) {
+	if registryName, ok := registryNameFromScope(scope); ok {
+		if isDockerHubAlias(registryName) {
+			return defaultRegistryTarget(), true
+		}
+
+		cfg := config.GetConfig()
+		if mapping, exists := cfg.Registries[registryName]; exists && mapping.Enabled {
+			return registryTargetFromMapping(registryName, mapping), true
+		}
+	}
+
+	return defaultRegistryTarget(), true
+}
+
+func registryNameFromScope(scope string) (string, bool) {
+	parts := strings.Split(scope, ":")
+	if len(parts) != 3 || parts[0] != "repository" {
+		return "", false
+	}
+
+	repo := parts[1]
+	slash := strings.Index(repo, "/")
+	if slash == -1 {
+		return "", false
+	}
+
+	registryName := repo[:slash]
+	if strings.Contains(registryName, ".") || strings.Contains(registryName, ":") || registryName == "localhost" {
+		return registryName, true
+	}
+	return "", false
+}
+
+func isDockerHubAlias(name string) bool {
+	return name == dockerHubName || name == "dockerhub" || name == "registry-1.docker.io"
+}
+
+// 透明代理 Docker Registry API v2 请求。
+func ProxyDockerRegistryGin(c *gin.Context) {
+	path := c.Request.URL.Path
+
+	if path == "/v2/" {
+		target, _ := resolveRegistryTarget(c, "")
+		proxyRegistryHTTP(c, target, "/v2/")
+		return
+	}
+
+	if !strings.HasPrefix(path, "/v2/") {
+		c.String(http.StatusNotFound, "Docker Registry API v2 only")
+		return
+	}
+
+	handleRegistryRequest(c, path)
+}
+
+func handleRegistryRequest(c *gin.Context, path string) {
+	pathWithoutV2 := strings.TrimPrefix(path, "/v2/")
+	target, targetPath := resolveRegistryTarget(c, pathWithoutV2)
+
+	imageName, apiType, _ := parseRegistryPath(targetPath)
+	if imageName == "" || apiType == "" {
+		c.String(http.StatusBadRequest, "Invalid path format")
+		return
+	}
+
+	if target.AutoLibraryPrefix && !strings.Contains(imageName, "/") {
+		imageName = "library/" + imageName
+		targetPath = strings.TrimPrefix(targetPath, strings.TrimPrefix(imageName, "library/"))
+		targetPath = imageName + targetPath
+	}
+
+	accessName := imageName
+	if target.Name != dockerHubName {
+		accessName = target.Name + "/" + imageName
+	}
+	if allowed, reason := utils.GlobalAccessController.CheckDockerAccess(accessName); !allowed {
+		fmt.Printf("Docker image %s access denied: %s\n", accessName, reason)
+		c.String(http.StatusForbidden, reason)
+		return
+	}
+
+	proxyRegistryHTTP(c, target, "/v2/"+targetPath)
+}
+
+// 解析去掉 /v2/ 前缀后的 Registry 路径。
+func parseRegistryPath(path string) (imageName, apiType, reference string) {
+	if idx := strings.Index(path, "/manifests/"); idx != -1 {
+		return path[:idx], "manifests", path[idx+len("/manifests/"):]
+	}
+	if idx := strings.Index(path, "/blobs/"); idx != -1 {
+		return path[:idx], "blobs", path[idx+len("/blobs/"):]
+	}
+	if idx := strings.Index(path, "/tags/list"); idx != -1 {
+		return path[:idx], "tags", "list"
+	}
+	return "", "", ""
+}
+
+// 代理 Docker token 请求，并透传客户端认证头。
+func ProxyDockerAuthGin(c *gin.Context) {
+	target, ok := resolveTokenTarget(c)
+	if !ok {
+		c.String(http.StatusBadRequest, "Unknown registry target")
+		return
+	}
+
+	cacheable := c.GetHeader("Authorization") == "" && utils.IsTokenCacheEnabled() && c.Request.Method == http.MethodGet
+	cacheKey := utils.BuildTokenCacheKey(target.Name + ":" + c.Request.URL.RawQuery)
+	if cacheable {
+		if cachedToken := utils.GlobalCache.GetToken(cacheKey); cachedToken != "" {
+			utils.WriteTokenResponse(c, cachedToken)
+			return
+		}
+	}
+
+	authURL, err := buildAuthURL(target, c.Request.URL.RawQuery)
+	if err != nil {
+		c.String(http.StatusInternalServerError, "Failed to build auth request")
+		return
+	}
+
+	req, err := http.NewRequestWithContext(c.Request.Context(), c.Request.Method, authURL, nil)
+	if err != nil {
+		c.String(http.StatusInternalServerError, "Failed to create auth request")
+		return
+	}
+	forwardSelectedRequestHeaders(req.Header, c.Request.Header)
+
+	resp, err := utils.GetGlobalHTTPClient().Do(req)
+	if err != nil {
+		c.String(http.StatusBadGateway, "Auth request failed")
+		return
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		c.String(http.StatusBadGateway, "Failed to read auth response")
+		return
+	}
+
+	copyResponseHeaders(c, resp.Header, target)
+	if cacheable && resp.StatusCode == http.StatusOK && len(body) > 0 {
+		ttl := utils.ExtractTTLFromResponse(body)
+		utils.GlobalCache.SetToken(cacheKey, string(body), ttl)
+		anonymousTokens.RememberFromResponse(body, ttl)
+	}
+
+	c.Data(resp.StatusCode, resp.Header.Get("Content-Type"), body)
+}
+
+func (s *anonymousTokenStore) RememberFromResponse(body []byte, ttl time.Duration) {
+	token := tokenFromAuthResponse(body)
+	if token == "" || ttl <= 0 {
+		return
+	}
+
+	now := time.Now()
+	expiresAt := now.Add(ttl)
+	key := tokenHash(token)
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.cleanupLocked(now)
+	if len(s.entries) >= maxAnonymousTokens {
+		return
+	}
+	s.entries[key] = expiresAt
+}
+
+func (s *anonymousTokenStore) IsKnown(token string) bool {
+	if token == "" {
+		return false
+	}
+
+	key := tokenHash(token)
+	now := time.Now()
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	expiresAt, ok := s.entries[key]
+	if !ok {
+		return false
+	}
+	if now.After(expiresAt) {
+		delete(s.entries, key)
+		return false
+	}
+	return true
+}
+
+func (s *anonymousTokenStore) cleanupLocked(now time.Time) {
+	for key, expiresAt := range s.entries {
+		if now.After(expiresAt) {
+			delete(s.entries, key)
+		}
+	}
+}
+
+func tokenFromAuthResponse(body []byte) string {
+	var tokenResp struct {
+		Token       string `json:"token"`
+		AccessToken string `json:"access_token"`
+	}
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return ""
+	}
+	if tokenResp.Token != "" {
+		return tokenResp.Token
+	}
+	return tokenResp.AccessToken
+}
+
+func tokenHash(token string) string {
+	sum := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(sum[:])
+}
+
+func buildAuthURL(target registryTarget, rawQuery string) (string, error) {
+	authURL, err := url.Parse(target.AuthRealm)
+	if err != nil {
+		return "", err
+	}
+
+	query := authURL.Query()
+	query.Set("service", target.AuthService)
+
+	if rawQuery != "" {
+		incoming, err := url.ParseQuery(rawQuery)
+		if err != nil {
+			return "", err
+		}
+		for key, values := range incoming {
+			if strings.EqualFold(key, "service") {
+				continue
+			}
+			for _, value := range values {
+				if strings.EqualFold(key, "scope") {
+					value = normalizeScopeForTarget(value, target)
+				}
+				query.Add(key, value)
+			}
+		}
+	}
+
+	authURL.RawQuery = query.Encode()
+	return authURL.String(), nil
+}
+
+func normalizeScopeForTarget(scope string, target registryTarget) string {
+	scope = stripTargetRegistryFromScope(scope, target)
+	if target.AutoLibraryPrefix {
+		return addLibraryPrefixToScope(scope)
+	}
+	return scope
+}
+
+func stripTargetRegistryFromScope(scope string, target registryTarget) string {
+	parts := strings.Split(scope, ":")
+	if len(parts) != 3 || parts[0] != "repository" {
+		return scope
+	}
+
+	prefixes := []string{target.Name + "/"}
+	if target.Name == dockerHubName {
+		prefixes = append(prefixes, "dockerhub/", "registry-1.docker.io/")
+	}
+
+	for _, prefix := range prefixes {
+		if strings.HasPrefix(parts[1], prefix) {
+			parts[1] = strings.TrimPrefix(parts[1], prefix)
+			return strings.Join(parts, ":")
+		}
+	}
+	return scope
+}
+
+func addLibraryPrefixToScope(scope string) string {
+	parts := strings.Split(scope, ":")
+	if len(parts) != 3 || parts[0] != "repository" || strings.Contains(parts[1], "/") {
+		return scope
+	}
+	return "repository:library/" + parts[1] + ":" + parts[2]
+}
+
+func proxyRegistryHTTP(c *gin.Context, target registryTarget, upstreamPath string) {
+	if cacheKey, ok := manifestCacheKey(c, target, upstreamPath); ok {
+		if cachedItem := utils.GlobalCache.Get(cacheKey); cachedItem != nil {
+			utils.WriteCachedResponse(c, cachedItem)
+			return
+		}
+	}
+
+	targetURL := target.Upstream + upstreamPath
+	if c.Request.URL.RawQuery != "" {
+		targetURL += "?" + c.Request.URL.RawQuery
+	}
+
+	req, err := http.NewRequestWithContext(c.Request.Context(), c.Request.Method, targetURL, nil)
+	if err != nil {
+		c.String(http.StatusInternalServerError, "Failed to create registry request")
+		return
+	}
+	forwardSelectedRequestHeaders(req.Header, c.Request.Header)
+
+	resp, err := utils.GetGlobalHTTPClient().Do(req)
+	if err != nil {
+		c.String(http.StatusBadGateway, "Registry request failed")
+		return
+	}
+	defer resp.Body.Close()
+
+	copyResponseHeaders(c, resp.Header, target)
+	c.Status(resp.StatusCode)
+
+	if c.Request.Method == http.MethodHead {
+		return
+	}
+
+	if cacheKey, ok := manifestCacheKey(c, target, upstreamPath); ok && canCacheManifestResponse(resp) {
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			fmt.Printf("Failed to read manifest response: %v\n", err)
+			return
+		}
+		contentType := resp.Header.Get("Content-Type")
+		utils.GlobalCache.Set(cacheKey, body, contentType, cacheHeaders(resp.Header), utils.GetManifestTTL(manifestReference(upstreamPath)))
+		c.Data(resp.StatusCode, contentType, body)
+		return
+	}
+
+	if _, err := io.Copy(c.Writer, resp.Body); err != nil {
+		fmt.Printf("Failed to stream registry response: %v\n", err)
+	}
+}
+
+func manifestCacheKey(c *gin.Context, target registryTarget, upstreamPath string) (string, bool) {
+	if c.Request.Method != http.MethodGet || !utils.IsCacheEnabled() || !isAnonymousManifestRequest(c) {
+		return "", false
+	}
+	if !strings.Contains(upstreamPath, "/manifests/") {
+		return "", false
+	}
+
+	key := strings.Join([]string{
+		target.Name,
+		upstreamPath,
+		c.Request.URL.RawQuery,
+		strings.Join(c.Request.Header.Values("Accept"), ","),
+	}, "|")
+	return utils.BuildCacheKey("manifest", key), true
+}
+
+func isAnonymousManifestRequest(c *gin.Context) bool {
+	authHeader := strings.TrimSpace(c.GetHeader("Authorization"))
+	if authHeader == "" {
+		return true
+	}
+
+	const bearerPrefix = "bearer "
+	if len(authHeader) <= len(bearerPrefix) || !strings.EqualFold(authHeader[:len(bearerPrefix)], bearerPrefix) {
+		return false
+	}
+
+	token := strings.TrimSpace(authHeader[len(bearerPrefix):])
+	return anonymousTokens.IsKnown(token)
+}
+
+func canCacheManifestResponse(resp *http.Response) bool {
+	return resp.StatusCode == http.StatusOK &&
+		resp.ContentLength > 0 &&
+		resp.ContentLength <= maxCachedManifestSize
+}
+
+func manifestReference(upstreamPath string) string {
+	_, _, reference := parseRegistryPath(strings.TrimPrefix(upstreamPath, "/v2/"))
+	return reference
+}
+
+func cacheHeaders(headers http.Header) map[string]string {
+	cached := make(map[string]string)
+	for name, values := range headers {
+		if shouldSkipResponseHeader(name) || strings.EqualFold(name, "WWW-Authenticate") || len(values) == 0 {
+			continue
+		}
+		cached[name] = values[0]
+	}
+	return cached
+}
+
+func forwardSelectedRequestHeaders(dst http.Header, src http.Header) {
+	for _, name := range forwardedRequestHeaders {
+		for _, value := range src.Values(name) {
+			dst.Add(name, value)
+		}
+	}
+}
+
+func copyResponseHeaders(c *gin.Context, headers http.Header, target registryTarget) {
+	for name, values := range headers {
+		if shouldSkipResponseHeader(name) {
+			continue
+		}
+
+		for _, value := range values {
+			if strings.EqualFold(name, "WWW-Authenticate") {
+				value = rewriteAuthChallenge(value, target, publicBaseURL(c))
+				c.Header("WWW-Authenticate", value)
+			} else {
+				c.Header(name, value)
+			}
+		}
+	}
+}
+
+func shouldSkipResponseHeader(name string) bool {
+	_, hopByHop := hopByHopHeaders[strings.ToLower(name)]
+	return hopByHop
+}
+
+func publicBaseURL(c *gin.Context) string {
+	proto := "http"
+	if c.Request.TLS != nil {
+		proto = "https"
+	}
+	if forwardedProto := strings.TrimSpace(c.GetHeader("X-Forwarded-Proto")); forwardedProto != "" {
+		proto = strings.Split(forwardedProto, ",")[0]
+	}
+
+	host := c.Request.Host
+	if host == "" {
+		cfg := config.GetConfig()
+		host = fmt.Sprintf("%s:%d", cfg.Server.Host, cfg.Server.Port)
+		if cfg.Server.Host == "0.0.0.0" {
+			host = fmt.Sprintf("localhost:%d", cfg.Server.Port)
+		}
+	}
+
+	return strings.TrimRight(proto+"://"+host, "/")
+}
+
+func rewriteAuthChallenge(authHeader string, target registryTarget, baseURL string) string {
+	if !strings.HasPrefix(strings.TrimSpace(strings.ToLower(authHeader)), "bearer ") {
+		return authHeader
+	}
+
+	scope := bearerParam(authHeader, "scope")
+	challenge := fmt.Sprintf(
+		`Bearer realm="%s/token/%s",service="%s"`,
+		baseURL,
+		escapeAuthParam(target.Name),
+		escapeAuthParam(target.AuthService),
+	)
+	if scope != "" {
+		challenge += fmt.Sprintf(`,scope="%s"`, escapeAuthParam(scope))
+	}
+	return challenge
+}
+
+func bearerParam(authHeader, paramName string) string {
+	input := strings.TrimSpace(authHeader)
+	if len(input) < len("Bearer ") || !strings.EqualFold(input[:len("Bearer ")], "Bearer ") {
+		return ""
+	}
+	input = strings.TrimSpace(input[len("Bearer "):])
+
+	for input != "" {
+		input = strings.TrimLeft(input, ", \t")
+		key, rest, found := strings.Cut(input, "=")
+		if !found {
+			return ""
+		}
+		key = strings.TrimSpace(key)
+		rest = strings.TrimSpace(rest)
+
+		var value string
+		if strings.HasPrefix(rest, `"`) {
+			rest = rest[1:]
+			var b strings.Builder
+			escaped := false
+			end := -1
+			for i, r := range rest {
+				if escaped {
+					b.WriteRune(r)
+					escaped = false
+					continue
+				}
+				if r == '\\' {
+					escaped = true
+					continue
+				}
+				if r == '"' {
+					end = i + 1
+					break
+				}
+				b.WriteRune(r)
+			}
+			if end == -1 {
+				return ""
+			}
+			value = b.String()
+			input = rest[end:]
+		} else {
+			value, input, _ = strings.Cut(rest, ",")
+			value = strings.TrimSpace(value)
+		}
+
+		if strings.EqualFold(key, paramName) {
+			return value
+		}
+	}
+
+	return ""
+}
+
+func escapeAuthParam(value string) string {
+	value = strings.ReplaceAll(value, `\`, `\\`)
+	return strings.ReplaceAll(value, `"`, `\"`)
+}

src/handlers/docker_test.go

@@ -0,0 +1,937 @@
+package handlers
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"hubproxy/config"
+	"hubproxy/utils"
+)
+
+type zeroReader struct{}
+
+func (zeroReader) Read(p []byte) (int, error) {
+	for i := range p {
+		p[i] = 0
+	}
+	return len(p), nil
+}
+
+type discardResponseWriter struct {
+	header http.Header
+	status int
+	bytes  int64
+}
+
+func newDiscardResponseWriter() *discardResponseWriter {
+	return &discardResponseWriter{header: make(http.Header)}
+}
+
+func (w *discardResponseWriter) Header() http.Header {
+	return w.header
+}
+
+func (w *discardResponseWriter) WriteHeader(status int) {
+	w.status = status
+}
+
+func (w *discardResponseWriter) Write(p []byte) (int, error) {
+	if w.status == 0 {
+		w.status = http.StatusOK
+	}
+	w.bytes += int64(len(p))
+	return len(p), nil
+}
+
+func TestParseRegistryPath(t *testing.T) {
+	tests := []struct {
+		path      string
+		image     string
+		apiType   string
+		reference string
+	}{
+		{"library/nginx/manifests/latest", "library/nginx", "manifests", "latest"},
+		{"library/nginx/blobs/sha256:abc", "library/nginx", "blobs", "sha256:abc"},
+		{"library/nginx/tags/list", "library/nginx", "tags", "list"},
+	}
+
+	for _, tt := range tests {
+		image, apiType, reference := parseRegistryPath(tt.path)
+		if image != tt.image || apiType != tt.apiType || reference != tt.reference {
+			t.Fatalf("parseRegistryPath(%q) = %q %q %q", tt.path, image, apiType, reference)
+		}
+	}
+}
+
+func TestParseRegistryPathInvalid(t *testing.T) {
+	image, apiType, reference := parseRegistryPath("library/nginx/unknown/latest")
+	if image != "" || apiType != "" || reference != "" {
+		t.Fatalf("invalid path parsed as %q %q %q", image, apiType, reference)
+	}
+}
+
+type testEnv interface {
+	Helper()
+	TempDir() string
+	Setenv(string, string)
+	Fatal(...interface{})
+}
+
+func initDockerProxyTest(t testEnv, configBody string) {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "config.toml")
+	if err := os.WriteFile(path, []byte(configBody), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("CONFIG_PATH", path)
+	if err := config.LoadConfig(); err != nil {
+		t.Fatal(err)
+	}
+	utils.InitHTTPClients()
+}
+
+func TestRewriteAuthChallengePreservesScopeAndUsesProxyRealm(t *testing.T) {
+	target := registryTarget{
+		Name:        "ghcr.io",
+		AuthService: "ghcr.io",
+	}
+
+	got := rewriteAuthChallenge(
+		`Bearer realm="https://ghcr.io/token",service="ghcr.io",scope="repository:owner/image:pull"`,
+		target,
+		"https://proxy.example.com",
+	)
+
+	want := `Bearer realm="https://proxy.example.com/token/ghcr.io",service="ghcr.io",scope="repository:owner/image:pull"`
+	if got != want {
+		t.Fatalf("challenge = %q, want %q", got, want)
+	}
+}
+
+func TestBuildAuthURLForDockerHubAddsLibraryScopeAndService(t *testing.T) {
+	got, err := buildAuthURL(
+		defaultRegistryTarget(),
+		"service=ignored&scope=repository%3Aalpine%3Apull&client_id=docker",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !strings.HasPrefix(got, dockerHubAuthRealm+"?") {
+		t.Fatalf("auth URL = %q", got)
+	}
+	if !strings.Contains(got, "service=registry.docker.io") {
+		t.Fatalf("auth URL missing service: %q", got)
+	}
+	if !strings.Contains(got, "scope=repository%3Alibrary%2Falpine%3Apull") {
+		t.Fatalf("auth URL missing normalized scope: %q", got)
+	}
+}
+
+func TestTokenTargetIsInferredFromPathBasedRegistryScope(t *testing.T) {
+	initDockerProxyTest(t, `
+[registries."ghcr.io"]
+upstream = "ghcr.io"
+authHost = "ghcr.io/token"
+authType = "github"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	req := httptest.NewRequest(http.MethodGet, "/token/docker.io?scope=repository:ghcr.io/jeessy2/ddns-go:pull&service=registry.docker.io", nil)
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = req
+	c.Params = gin.Params{{Key: "path", Value: "/docker.io"}}
+
+	target, ok := resolveTokenTarget(c)
+	if !ok {
+		t.Fatal("resolveTokenTarget returned false")
+	}
+	if target.Name != "ghcr.io" {
+		t.Fatalf("target.Name = %q, want ghcr.io", target.Name)
+	}
+	if target.AuthService != "ghcr.io" {
+		t.Fatalf("AuthService = %q, want ghcr.io", target.AuthService)
+	}
+}
+
+func TestBuildAuthURLStripsPathBasedRegistryPrefixForGHCR(t *testing.T) {
+	target := registryTarget{
+		Name:        "ghcr.io",
+		AuthRealm:   "https://ghcr.io/token",
+		AuthService: "ghcr.io",
+	}
+
+	got, err := buildAuthURL(
+		target,
+		"scope=repository%3Aghcr.io%2Fjeessy2%2Fddns-go%3Apull&service=registry.docker.io",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !strings.Contains(got, "service=ghcr.io") {
+		t.Fatalf("auth URL missing ghcr service: %q", got)
+	}
+	if !strings.Contains(got, "scope=repository%3Ajeessy2%2Fddns-go%3Apull") {
+		t.Fatalf("auth URL missing stripped scope: %q", got)
+	}
+	if strings.Contains(got, "registry.docker.io") {
+		t.Fatalf("auth URL leaked Docker Hub service: %q", got)
+	}
+}
+
+func TestDockerIODefaultTargetUsesBuiltInWhenUnconfigured(t *testing.T) {
+	initDockerProxyTest(t, "")
+
+	target := defaultRegistryTarget()
+	if target.Upstream != dockerHubUpstream {
+		t.Fatalf("Upstream = %q, want %q", target.Upstream, dockerHubUpstream)
+	}
+	if target.AuthRealm != dockerHubAuthRealm {
+		t.Fatalf("AuthRealm = %q, want %q", target.AuthRealm, dockerHubAuthRealm)
+	}
+	if !target.AutoLibraryPrefix {
+		t.Fatal("AutoLibraryPrefix = false, want true")
+	}
+}
+
+func TestDockerIODefaultTargetCanBeOverriddenByConfig(t *testing.T) {
+	initDockerProxyTest(t, `
+[registries."docker.io"]
+upstream = "mirror.local"
+authHost = "auth.mirror.local/token"
+authType = "docker"
+enabled = true
+`)
+
+	target := defaultRegistryTarget()
+	if target.Upstream != "https://mirror.local" {
+		t.Fatalf("Upstream = %q, want custom mirror", target.Upstream)
+	}
+	if target.AuthRealm != "https://auth.mirror.local/token" {
+		t.Fatalf("AuthRealm = %q, want custom auth realm", target.AuthRealm)
+	}
+	if target.AuthService != dockerHubAuthService {
+		t.Fatalf("AuthService = %q, want %q", target.AuthService, dockerHubAuthService)
+	}
+	if !target.AutoLibraryPrefix {
+		t.Fatal("AutoLibraryPrefix = false, want true")
+	}
+}
+
+func TestDockerIODefaultTargetIgnoresDisabledOverride(t *testing.T) {
+	initDockerProxyTest(t, `
+[registries."docker.io"]
+upstream = "mirror.local"
+authHost = "auth.mirror.local/token"
+authType = "docker"
+enabled = false
+`)
+
+	target := defaultRegistryTarget()
+	if target.Upstream != dockerHubUpstream {
+		t.Fatalf("Upstream = %q, want built-in %q", target.Upstream, dockerHubUpstream)
+	}
+}
+
+func TestProxyDockerRegistryTransparentlyForwardsAuthAndRewritesChallenge(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v2/team/app/manifests/latest" {
+			t.Fatalf("upstream path = %q", r.URL.Path)
+		}
+		if got := r.Header.Get("Authorization"); got != "Bearer client-token" {
+			t.Fatalf("Authorization = %q", got)
+		}
+		if got := r.Header.Get("Accept"); got != "application/vnd.docker.distribution.manifest.v2+json" {
+			t.Fatalf("Accept = %q", got)
+		}
+		if got := r.Header.Get("Range"); got != "bytes=0-99" {
+			t.Fatalf("Range = %q", got)
+		}
+
+		w.Header().Set("WWW-Authenticate", `Bearer realm="https://upstream.example/token",service="upstream.example",scope="repository:team/app:pull"`)
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	req := httptest.NewRequest(http.MethodGet, "/v2/test.local/team/app/manifests/latest", nil)
+	req.Host = "proxy.example.com"
+	req.Header.Set("X-Forwarded-Proto", "https")
+	req.Header.Set("Authorization", "Bearer client-token")
+	req.Header.Set("Accept", "application/vnd.docker.distribution.manifest.v2+json")
+	req.Header.Set("Range", "bytes=0-99")
+	w := httptest.NewRecorder()
+
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401; body=%s", w.Code, w.Body.String())
+	}
+
+	wantChallenge := `Bearer realm="https://proxy.example.com/token/test.local",service="` + strings.TrimPrefix(upstream.URL, "http://") + `",scope="repository:team/app:pull"`
+	if got := w.Header().Get("WWW-Authenticate"); got != wantChallenge {
+		t.Fatalf("WWW-Authenticate = %q, want %q", got, wantChallenge)
+	}
+}
+
+func TestDockerV2BaseProxiesUpstreamChallenge(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v2/" {
+			t.Fatalf("upstream path = %q", r.URL.Path)
+		}
+		w.Header().Set("WWW-Authenticate", `Bearer realm="https://registry.example/token",service="registry.example"`)
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."docker.io"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.example/token"
+authType = "docker"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/", ProxyDockerRegistryGin)
+
+	req := httptest.NewRequest(http.MethodGet, "/v2/", nil)
+	req.Host = "hub.example.com"
+	req.Header.Set("X-Forwarded-Proto", "https")
+	w := httptest.NewRecorder()
+
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401; body=%s", w.Code, w.Body.String())
+	}
+
+	wantChallenge := `Bearer realm="https://hub.example.com/token/docker.io",service="registry.docker.io"`
+	if got := w.Header().Get("WWW-Authenticate"); got != wantChallenge {
+		t.Fatalf("WWW-Authenticate = %q, want %q", got, wantChallenge)
+	}
+}
+
+func TestProxyDockerAuthForwardsBasicCredentials(t *testing.T) {
+	authServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "Basic dXNlcjpwYXNz" {
+			t.Fatalf("Authorization = %q", got)
+		}
+		if got := r.URL.Query().Get("service"); got != "127.0.0.1" {
+			t.Fatalf("service = %q", got)
+		}
+		if got := r.URL.Query().Get("scope"); got != "repository:team/app:pull" {
+			t.Fatalf("scope = %q", got)
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"token":"secret","expires_in":3600}`))
+	}))
+	defer authServer.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "https://127.0.0.1"
+authHost = "`+authServer.URL+`"
+authType = "anonymous"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/token/*path", ProxyDockerAuthGin)
+
+	req := httptest.NewRequest(http.MethodGet, "/token/test.local?scope=repository:team/app:pull", nil)
+	req.Header.Set("Authorization", "Basic dXNlcjpwYXNz")
+	w := httptest.NewRecorder()
+
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", w.Code, w.Body.String())
+	}
+	if got := w.Body.String(); !strings.Contains(got, `"token":"secret"`) {
+		t.Fatalf("body = %q", got)
+	}
+}
+
+func TestProxyDockerAuthRoutesPathBasedGHCRScopeToGHCRAuth(t *testing.T) {
+	authServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.URL.Query().Get("service"); got != "ghcr.io" {
+			t.Fatalf("service = %q, want ghcr.io", got)
+		}
+		if got := r.URL.Query().Get("scope"); got != "repository:jeessy2/ddns-go:pull" {
+			t.Fatalf("scope = %q, want repository:jeessy2/ddns-go:pull", got)
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"token":"ghcr-token","expires_in":3600}`))
+	}))
+	defer authServer.Close()
+
+	initDockerProxyTest(t, `
+[registries."ghcr.io"]
+upstream = "ghcr.io"
+authHost = "`+authServer.URL+`"
+authType = "github"
+enabled = true
+`)
+	utils.GlobalCache = &utils.UniversalCache{}
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/token/*path", ProxyDockerAuthGin)
+
+	req := httptest.NewRequest(http.MethodGet, "/token/docker.io?scope=repository%3Aghcr.io%2Fjeessy2%2Fddns-go%3Apull&service=registry.docker.io", nil)
+	w := httptest.NewRecorder()
+
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", w.Code, w.Body.String())
+	}
+	if got := w.Body.String(); !strings.Contains(got, `"token":"ghcr-token"`) {
+		t.Fatalf("body = %q", got)
+	}
+}
+
+func TestDockerHubShortNameIsProxiedWithLibraryPrefix(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v2/library/nginx/manifests/latest" {
+			t.Fatalf("upstream path = %q", r.URL.Path)
+		}
+		w.Header().Set("Content-Type", "application/vnd.docker.distribution.manifest.v2+json")
+		w.Header().Set("Docker-Content-Digest", "sha256:abc")
+		_, _ = w.Write([]byte(`{"schemaVersion":2}`))
+	}))
+	defer upstream.Close()
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	target := defaultRegistryTarget()
+	target.Upstream = upstream.URL
+
+	req := httptest.NewRequest(http.MethodGet, "/v2/nginx/manifests/latest", nil)
+	w := httptest.NewRecorder()
+
+	c, _ := gin.CreateTestContext(w)
+	c.Request = req
+	proxyRegistryHTTP(c, target, "/v2/library/nginx/manifests/latest")
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", w.Code, w.Body.String())
+	}
+	if got := w.Header().Get("Docker-Content-Digest"); got != "sha256:abc" {
+		t.Fatalf("Docker-Content-Digest = %q", got)
+	}
+}
+
+func TestProxyDockerRegistryHeadReturnsHeadersWithoutBody(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodHead {
+			t.Fatalf("method = %s, want HEAD", r.Method)
+		}
+		w.Header().Set("Content-Length", "123")
+		w.Header().Set("Docker-Content-Digest", "sha256:head")
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	req := httptest.NewRequest(http.MethodHead, "/v2/test.local/team/app/blobs/sha256:abc", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+	if got := w.Header().Get("Docker-Content-Digest"); got != "sha256:head" {
+		t.Fatalf("Docker-Content-Digest = %q", got)
+	}
+	if body := w.Body.String(); body != "" {
+		t.Fatalf("HEAD body = %q, want empty", body)
+	}
+}
+
+func TestProxyDockerRegistryStreamsBlobAndSkipsHopByHopHeaders(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Connection", "close")
+		w.Header().Set("Transfer-Encoding", "chunked")
+		w.Header().Set("Content-Type", "application/octet-stream")
+		_, _ = io.WriteString(w, "layer-data")
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	req := httptest.NewRequest(http.MethodGet, "/v2/test.local/team/app/blobs/sha256:abc", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", w.Code, w.Body.String())
+	}
+	if got := w.Body.String(); got != "layer-data" {
+		t.Fatalf("body = %q", got)
+	}
+	if got := w.Header().Get("Connection"); got != "" {
+		t.Fatalf("Connection header leaked: %q", got)
+	}
+}
+
+func TestProxyDockerRegistryCachesAnonymousManifestByAccept(t *testing.T) {
+	var hits int32
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		count := atomic.AddInt32(&hits, 1)
+		body := fmt.Sprintf(`{"schemaVersion":2,"hit":%d}`, count)
+		w.Header().Set("Content-Type", r.Header.Get("Accept"))
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", len(body)))
+		_, _ = w.Write([]byte(body))
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+	utils.GlobalCache = &utils.UniversalCache{}
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	for i := 0; i < 2; i++ {
+		req := httptest.NewRequest(http.MethodGet, "/v2/test.local/team/app/manifests/latest", nil)
+		req.Header.Set("Accept", "application/vnd.docker.distribution.manifest.v2+json")
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		if w.Code != http.StatusOK {
+			t.Fatalf("request %d status = %d; body=%s", i, w.Code, w.Body.String())
+		}
+		if !strings.Contains(w.Body.String(), `"hit":1`) {
+			t.Fatalf("request %d body = %q", i, w.Body.String())
+		}
+	}
+	if got := atomic.LoadInt32(&hits); got != 1 {
+		t.Fatalf("hits = %d, want 1", got)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/v2/test.local/team/app/manifests/latest", nil)
+	req.Header.Set("Accept", "application/vnd.oci.image.index.v1+json")
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+	if w.Code != http.StatusOK {
+		t.Fatalf("second accept status = %d; body=%s", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), `"hit":2`) {
+		t.Fatalf("second accept body = %q", w.Body.String())
+	}
+}
+
+func TestProxyDockerRegistryDoesNotCacheAuthenticatedManifest(t *testing.T) {
+	var hits int32
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		count := atomic.AddInt32(&hits, 1)
+		body := fmt.Sprintf(`{"schemaVersion":2,"hit":%d}`, count)
+		w.Header().Set("Content-Type", "application/vnd.docker.distribution.manifest.v2+json")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", len(body)))
+		_, _ = w.Write([]byte(body))
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+	utils.GlobalCache = &utils.UniversalCache{}
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	for i := 1; i <= 2; i++ {
+		req := httptest.NewRequest(http.MethodGet, "/v2/test.local/team/app/manifests/latest", nil)
+		req.Header.Set("Authorization", "Bearer token")
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		if w.Code != http.StatusOK {
+			t.Fatalf("request %d status = %d; body=%s", i, w.Code, w.Body.String())
+		}
+		if !strings.Contains(w.Body.String(), fmt.Sprintf(`"hit":%d`, i)) {
+			t.Fatalf("request %d body = %q", i, w.Body.String())
+		}
+	}
+	if got := atomic.LoadInt32(&hits); got != 2 {
+		t.Fatalf("hits = %d, want 2", got)
+	}
+}
+
+func TestProxyDockerRegistryCachesKnownAnonymousBearerManifest(t *testing.T) {
+	anonymousTokens = &anonymousTokenStore{entries: make(map[string]time.Time)}
+	anonymousTokens.RememberFromResponse([]byte(`{"token":"anonymous-token","expires_in":3600}`), time.Hour)
+
+	var hits int32
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		count := atomic.AddInt32(&hits, 1)
+		body := fmt.Sprintf(`{"schemaVersion":2,"hit":%d}`, count)
+		w.Header().Set("Content-Type", "application/vnd.docker.distribution.manifest.v2+json")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", len(body)))
+		_, _ = w.Write([]byte(body))
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+	utils.GlobalCache = &utils.UniversalCache{}
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	for i := 0; i < 2; i++ {
+		req := httptest.NewRequest(http.MethodGet, "/v2/test.local/team/app/manifests/latest", nil)
+		req.Header.Set("Authorization", "Bearer anonymous-token")
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		if w.Code != http.StatusOK {
+			t.Fatalf("request %d status = %d; body=%s", i, w.Code, w.Body.String())
+		}
+		if !strings.Contains(w.Body.String(), `"hit":1`) {
+			t.Fatalf("request %d body = %q", i, w.Body.String())
+		}
+	}
+	if got := atomic.LoadInt32(&hits); got != 1 {
+		t.Fatalf("hits = %d, want 1", got)
+	}
+}
+
+func TestProxyDockerRegistryDoesNotCacheUnknownBearerManifest(t *testing.T) {
+	anonymousTokens = &anonymousTokenStore{entries: make(map[string]time.Time)}
+
+	var hits int32
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		count := atomic.AddInt32(&hits, 1)
+		body := fmt.Sprintf(`{"schemaVersion":2,"hit":%d}`, count)
+		w.Header().Set("Content-Type", "application/vnd.docker.distribution.manifest.v2+json")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", len(body)))
+		_, _ = w.Write([]byte(body))
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+	utils.GlobalCache = &utils.UniversalCache{}
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	for i := 1; i <= 2; i++ {
+		req := httptest.NewRequest(http.MethodGet, "/v2/test.local/team/app/manifests/latest", nil)
+		req.Header.Set("Authorization", "Bearer user-token")
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		if w.Code != http.StatusOK {
+			t.Fatalf("request %d status = %d; body=%s", i, w.Code, w.Body.String())
+		}
+		if !strings.Contains(w.Body.String(), fmt.Sprintf(`"hit":%d`, i)) {
+			t.Fatalf("request %d body = %q", i, w.Body.String())
+		}
+	}
+	if got := atomic.LoadInt32(&hits); got != 2 {
+		t.Fatalf("hits = %d, want 2", got)
+	}
+}
+
+func TestProxyDockerRegistryUsesNsQueryForContainerd(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v2/team/app/manifests/latest" {
+			t.Fatalf("upstream path = %q", r.URL.Path)
+		}
+		if got := r.URL.Query().Get("ns"); got != "test.local" {
+			t.Fatalf("ns query = %q", got)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	req := httptest.NewRequest(http.MethodGet, "/v2/team/app/manifests/latest?ns=test.local", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", w.Code, w.Body.String())
+	}
+}
+
+func TestProxyDockerAuthCachesOnlyAnonymousTokenRequests(t *testing.T) {
+	var hits int32
+	authServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		count := atomic.AddInt32(&hits, 1)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = fmt.Fprintf(w, `{"token":"token-%d","expires_in":3600}`, count)
+	}))
+	defer authServer.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "https://test.local"
+authHost = "`+authServer.URL+`"
+authType = "anonymous"
+enabled = true
+`)
+	utils.GlobalCache = &utils.UniversalCache{}
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/token/*path", ProxyDockerAuthGin)
+
+	for i := 0; i < 2; i++ {
+		req := httptest.NewRequest(http.MethodGet, "/token/test.local?scope=repository:team/app:pull", nil)
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		if w.Code != http.StatusOK {
+			t.Fatalf("anonymous request %d status = %d; body=%s", i, w.Code, w.Body.String())
+		}
+		if got := w.Body.String(); !strings.Contains(got, `"token":"token-1"`) {
+			t.Fatalf("anonymous request %d body = %q", i, got)
+		}
+	}
+
+	if got := atomic.LoadInt32(&hits); got != 1 {
+		t.Fatalf("anonymous token hits = %d, want 1", got)
+	}
+
+	for i := 0; i < 2; i++ {
+		req := httptest.NewRequest(http.MethodGet, "/token/test.local?scope=repository:team/app:pull", nil)
+		req.Header.Set("Authorization", "Basic dXNlcjpwYXNz")
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		if w.Code != http.StatusOK {
+			t.Fatalf("authenticated request %d status = %d; body=%s", i, w.Code, w.Body.String())
+		}
+	}
+
+	if got := atomic.LoadInt32(&hits); got != 3 {
+		t.Fatalf("authenticated token hits total = %d, want 3", got)
+	}
+}
+
+func TestProxyDockerAuthRejectsUnknownRegistry(t *testing.T) {
+	initDockerProxyTest(t, "")
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/token/*path", ProxyDockerAuthGin)
+
+	req := httptest.NewRequest(http.MethodGet, "/token/missing.local?scope=repository:team/app:pull", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400; body=%s", w.Code, w.Body.String())
+	}
+}
+
+func TestProxyDockerRegistryConcurrentRequests(t *testing.T) {
+	const requests = 64
+	var hits int32
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		atomic.AddInt32(&hits, 1)
+		if got := r.Header.Get("Authorization"); got == "" {
+			t.Fatal("missing Authorization")
+		}
+		w.Header().Set("Content-Type", "application/octet-stream")
+		_, _ = w.Write([]byte("ok"))
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	var wg sync.WaitGroup
+	errs := make(chan string, requests)
+	for i := 0; i < requests; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			req := httptest.NewRequest(http.MethodGet, "/v2/test.local/team/app/blobs/sha256:abc", nil)
+			req.Header.Set("Authorization", fmt.Sprintf("Bearer token-%d", i))
+			w := httptest.NewRecorder()
+			router.ServeHTTP(w, req)
+			if w.Code != http.StatusOK || w.Body.String() != "ok" {
+				errs <- fmt.Sprintf("request %d status=%d body=%q", i, w.Code, w.Body.String())
+			}
+		}(i)
+	}
+	wg.Wait()
+	close(errs)
+
+	for err := range errs {
+		t.Fatal(err)
+	}
+	if got := atomic.LoadInt32(&hits); got != requests {
+		t.Fatalf("hits = %d, want %d", got, requests)
+	}
+}
+
+func TestProxyDockerRegistryLargeBlobStreamsWithoutRecorderBuffer(t *testing.T) {
+	const blobSize = 8 << 20
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/octet-stream")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", blobSize))
+		_, _ = io.CopyN(w, zeroReader{}, blobSize)
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(t, `
+[registries."test.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.test.local/token"
+authType = "anonymous"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	req := httptest.NewRequest(http.MethodGet, "/v2/test.local/team/app/blobs/sha256:large", nil)
+	w := newDiscardResponseWriter()
+	router.ServeHTTP(w, req)
+
+	if w.status != http.StatusOK {
+		t.Fatalf("status = %d, want 200", w.status)
+	}
+	if w.bytes != blobSize {
+		t.Fatalf("streamed bytes = %d, want %d", w.bytes, blobSize)
+	}
+	if got := w.Header().Get("Content-Length"); got != fmt.Sprintf("%d", blobSize) {
+		t.Fatalf("Content-Length = %q", got)
+	}
+}
+
+func BenchmarkProxyDockerRegistryBlobStreaming(b *testing.B) {
+	const blobSize = 1 << 20
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/octet-stream")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", blobSize))
+		_, _ = io.CopyN(w, zeroReader{}, blobSize)
+	}))
+	defer upstream.Close()
+
+	initDockerProxyTest(b, `
+[registries."bench.local"]
+upstream = "`+upstream.URL+`"
+authHost = "https://auth.bench.local/token"
+authType = "anonymous"
+enabled = true
+`)
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Any("/v2/*path", ProxyDockerRegistryGin)
+
+	b.ReportAllocs()
+	b.SetBytes(blobSize)
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		req := httptest.NewRequest(http.MethodGet, "/v2/bench.local/team/app/blobs/sha256:bench", nil)
+		w := newDiscardResponseWriter()
+		router.ServeHTTP(w, req)
+		if w.status != http.StatusOK || w.bytes != blobSize {
+			b.Fatalf("status=%d bytes=%d", w.status, w.bytes)
+		}
+	}
+}

src/handlers/github.go

@@ -0,0 +1,234 @@
+package handlers
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"hubproxy/config"
+	"hubproxy/utils"
+)
+
+var (
+	// GitHub URL匹配正则表达式
+	githubExps = []*regexp.Regexp{
+		regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:releases|archive)/.*`),
+		regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:blob|raw)/.*`),
+		regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:info|git-).*`),
+		regexp.MustCompile(`^(?:https?://)?raw\.github(?:usercontent|)\.com/([^/]+)/([^/]+)/.+?/.+`),
+		regexp.MustCompile(`^(?:https?://)?gist\.(?:githubusercontent|github)\.com/([^/]+)/([^/]+).*`),
+		regexp.MustCompile(`^(?:https?://)?api\.github\.com/repos/([^/]+)/([^/]+)/.*`),
+		regexp.MustCompile(`^(?:https?://)?huggingface\.co(?:/spaces)?/([^/]+)/(.+)`),
+		regexp.MustCompile(`^(?:https?://)?cdn-lfs\.hf\.co(?:/spaces)?/([^/]+)/([^/]+)(?:/(.*))?`),
+		regexp.MustCompile(`^(?:https?://)?download\.docker\.com/([^/]+)/.*\.(tgz|zip)`),
+		regexp.MustCompile(`^(?:https?://)?(github|opengraph)\.githubassets\.com/([^/]+)/.+?`),
+	}
+)
+
+// 全局变量：被阻止的内容类型
+var blockedContentTypes = map[string]bool{
+	"text/html":             true,
+	"application/xhtml+xml": true,
+	"text/xml":              true,
+	"application/xml":       true,
+}
+
+// GitHubProxyHandler GitHub代理处理器
+func GitHubProxyHandler(c *gin.Context) {
+	rawPath := strings.TrimPrefix(c.Request.URL.RequestURI(), "/")
+
+	for strings.HasPrefix(rawPath, "/") {
+		rawPath = strings.TrimPrefix(rawPath, "/")
+	}
+
+	// 自动补全协议头
+	if !strings.HasPrefix(rawPath, "https://") {
+		if strings.HasPrefix(rawPath, "http:/") || strings.HasPrefix(rawPath, "https:/") {
+			rawPath = strings.Replace(rawPath, "http:/", "", 1)
+			rawPath = strings.Replace(rawPath, "https:/", "", 1)
+		} else if strings.HasPrefix(rawPath, "http://") {
+			rawPath = strings.TrimPrefix(rawPath, "http://")
+		}
+		rawPath = "https://" + rawPath
+	}
+
+	matches := CheckGitHubURL(rawPath)
+	if matches != nil {
+		if allowed, reason := utils.GlobalAccessController.CheckGitHubAccess(matches); !allowed {
+			var repoPath string
+			if len(matches) >= 2 {
+				username := matches[0]
+				repoName := strings.TrimSuffix(matches[1], ".git")
+				repoPath = username + "/" + repoName
+			}
+			fmt.Printf("GitHub仓库 %s 访问被拒绝: %s\n", repoPath, reason)
+			c.String(http.StatusForbidden, reason)
+			return
+		}
+	} else {
+		c.String(http.StatusForbidden, "无效输入")
+		return
+	}
+
+	// 将blob链接转换为raw链接
+	if githubExps[1].MatchString(rawPath) {
+		rawPath = strings.Replace(rawPath, "/blob/", "/raw/", 1)
+	}
+
+	ProxyGitHubRequest(c, rawPath)
+}
+
+// CheckGitHubURL 检查URL是否匹配GitHub模式
+func CheckGitHubURL(u string) []string {
+	for _, exp := range githubExps {
+		if matches := exp.FindStringSubmatch(u); matches != nil {
+			return matches[1:]
+		}
+	}
+	return nil
+}
+
+// ProxyGitHubRequest 代理GitHub请求
+func ProxyGitHubRequest(c *gin.Context, u string) {
+	proxyGitHubWithRedirect(c, u, 0)
+}
+
+// proxyGitHubWithRedirect 带重定向的GitHub代理请求
+func proxyGitHubWithRedirect(c *gin.Context, u string, redirectCount int) {
+	const maxRedirects = 20
+	if redirectCount > maxRedirects {
+		c.String(http.StatusLoopDetected, "重定向次数过多，可能存在循环重定向")
+		return
+	}
+
+	req, err := http.NewRequest(c.Request.Method, u, c.Request.Body)
+	if err != nil {
+		c.String(http.StatusInternalServerError, fmt.Sprintf("server error %v", err))
+		return
+	}
+
+	// 复制请求头
+	for key, values := range c.Request.Header {
+		for _, value := range values {
+			req.Header.Add(key, value)
+		}
+	}
+	req.Header.Del("Host")
+
+	resp, err := utils.GetGlobalHTTPClient().Do(req)
+	if err != nil {
+		c.String(http.StatusInternalServerError, fmt.Sprintf("server error %v", err))
+		return
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			fmt.Printf("关闭响应体失败: %v\n", err)
+		}
+	}()
+
+	// 检查并处理被阻止的内容类型
+	if c.Request.Method == "GET" {
+		if contentType := resp.Header.Get("Content-Type"); blockedContentTypes[strings.ToLower(strings.Split(contentType, ";")[0])] {
+			c.JSON(http.StatusForbidden, map[string]string{
+				"error":   "Content type not allowed",
+				"message": "检测到网页类型，本服务不支持加速网页，请检查您的链接是否正确。",
+			})
+			return
+		}
+	}
+
+	// 检查文件大小限制
+	cfg := config.GetConfig()
+	if contentLength := resp.Header.Get("Content-Length"); contentLength != "" {
+		if size, err := strconv.ParseInt(contentLength, 10, 64); err == nil && size > cfg.Server.FileSize {
+			c.String(http.StatusRequestEntityTooLarge,
+				fmt.Sprintf("文件过大，限制大小: %d MB", cfg.Server.FileSize/(1024*1024)))
+			return
+		}
+	}
+
+	// 清理安全相关的头
+	resp.Header.Del("Content-Security-Policy")
+	resp.Header.Del("Referrer-Policy")
+	resp.Header.Del("Strict-Transport-Security")
+
+	// 获取真实域名
+	realHost := c.Request.Header.Get("X-Forwarded-Host")
+	if realHost == "" {
+		realHost = c.Request.Host
+	}
+	if !strings.HasPrefix(realHost, "http://") && !strings.HasPrefix(realHost, "https://") {
+		realHost = "https://" + realHost
+	}
+
+	// 处理.sh和.ps1文件的智能处理
+	if strings.HasSuffix(strings.ToLower(u), ".sh") || strings.HasSuffix(strings.ToLower(u), ".ps1") {
+		isGzipCompressed := resp.Header.Get("Content-Encoding") == "gzip"
+
+		processedBody, processedSize, err := utils.ProcessSmart(resp.Body, isGzipCompressed, realHost)
+		if err != nil {
+			fmt.Printf("脚本处理失败: %v\n", err)
+			c.String(http.StatusBadGateway, "Script processing failed: %v", err)
+			return
+		}
+
+		// 智能设置响应头
+		if processedSize > 0 {
+			resp.Header.Del("Content-Length")
+			resp.Header.Del("Content-Encoding")
+			resp.Header.Set("Transfer-Encoding", "chunked")
+		}
+
+		// 复制其他响应头
+		for key, values := range resp.Header {
+			for _, value := range values {
+				c.Header(key, value)
+			}
+		}
+
+		// 处理重定向
+		if location := resp.Header.Get("Location"); location != "" {
+			if CheckGitHubURL(location) != nil {
+				c.Header("Location", "/"+location)
+			} else {
+				proxyGitHubWithRedirect(c, location, redirectCount+1)
+				return
+			}
+		}
+
+		c.Status(resp.StatusCode)
+
+		// 输出处理后的内容
+		if _, err := io.Copy(c.Writer, processedBody); err != nil {
+			return
+		}
+	} else {
+		// 复制响应头
+		for key, values := range resp.Header {
+			for _, value := range values {
+				c.Header(key, value)
+			}
+		}
+
+		// 处理重定向
+		if location := resp.Header.Get("Location"); location != "" {
+			if CheckGitHubURL(location) != nil {
+				c.Header("Location", "/"+location)
+			} else {
+				proxyGitHubWithRedirect(c, location, redirectCount+1)
+				return
+			}
+		}
+
+		c.Status(resp.StatusCode)
+
+		// 直接流式转发
+		if _, err := io.Copy(c.Writer, resp.Body); err != nil {
+			fmt.Printf("转发响应体失败: %v\n", err)
+		}
+	}
+}

src/handlers/github_test.go

@@ -0,0 +1,32 @@
+package handlers
+
+import "testing"
+
+func TestCheckGitHubURL(t *testing.T) {
+	tests := []struct {
+		name string
+		url  string
+		user string
+		repo string
+	}{
+		{"release", "https://github.com/user/repo/releases/download/v1/file.tar.gz", "user", "repo"},
+		{"raw", "https://raw.githubusercontent.com/user/repo/main/file.sh", "user", "repo"},
+		{"api", "https://api.github.com/repos/user/repo/releases/latest", "user", "repo"},
+		{"huggingface", "https://huggingface.co/user/model/resolve/main/file", "user", "model/resolve/main/file"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := CheckGitHubURL(tt.url)
+			if len(got) < 2 || got[0] != tt.user || got[1] != tt.repo {
+				t.Fatalf("CheckGitHubURL(%q) = %#v", tt.url, got)
+			}
+		})
+	}
+}
+
+func TestCheckGitHubURLRejectsOtherHosts(t *testing.T) {
+	if got := CheckGitHubURL("https://example.com/user/repo/file"); got != nil {
+		t.Fatalf("unexpected match: %#v", got)
+	}
+}

src/handlers/imagetar_test.go

@@ -0,0 +1,60 @@
+package handlers
+
+import (
+	"testing"
+	"time"
+)
+
+func TestDownloadDebouncer(t *testing.T) {
+	d := NewDownloadDebouncer(time.Minute)
+	if !d.ShouldAllow("user", "content") {
+		t.Fatal("first request denied")
+	}
+	if d.ShouldAllow("user", "content") {
+		t.Fatal("duplicate request allowed")
+	}
+	if !d.ShouldAllow("other", "content") {
+		t.Fatal("different user denied")
+	}
+}
+
+func TestTokenStoreCreateConsume(t *testing.T) {
+	store := newTokenStore[SingleDownloadRequest]()
+	req := SingleDownloadRequest{Image: "nginx:latest", Platform: "linux/amd64", UseCompressedLayers: true}
+
+	token, err := store.create(req, "127.0.0.1", "ua")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, ok := store.consume(token, "127.0.0.1", "ua")
+	if !ok {
+		t.Fatal("token not consumed")
+	}
+	if got != req {
+		t.Fatalf("request = %#v, want %#v", got, req)
+	}
+	if _, ok := store.consume(token, "127.0.0.1", "ua"); ok {
+		t.Fatal("token consumed twice")
+	}
+}
+
+func TestTokenStoreRejectsDifferentClient(t *testing.T) {
+	store := newTokenStore[SingleDownloadRequest]()
+	token, err := store.create(SingleDownloadRequest{Image: "nginx:latest"}, "127.0.0.1", "ua")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := store.consume(token, "127.0.0.2", "ua"); ok {
+		t.Fatal("token accepted for different IP")
+	}
+}
+
+func TestGenerateContentFingerprintStable(t *testing.T) {
+	a := generateContentFingerprint([]string{"b:1", "a:1"}, "linux/amd64")
+	b := generateContentFingerprint([]string{"a:1", "b:1"}, "linux/amd64")
+	c := generateContentFingerprint([]string{"a:1", "b:1"}, "linux/arm64")
+	if a != b || a == c {
+		t.Fatalf("unexpected fingerprints: %q %q %q", a, b, c)
+	}
+}

src/handlers/search.go

@@ -0,0 +1,517 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"hubproxy/utils"
+)
+
+// SearchResult Docker Hub搜索结果
+type SearchResult struct {
+	Count    int          `json:"count"`
+	Next     string       `json:"next"`
+	Previous string       `json:"previous"`
+	Results  []Repository `json:"results"`
+}
+
+// Repository 仓库信息
+type Repository struct {
+	Name          string `json:"repo_name"`
+	Description   string `json:"short_description"`
+	IsOfficial    bool   `json:"is_official"`
+	IsAutomated   bool   `json:"is_automated"`
+	StarCount     int    `json:"star_count"`
+	PullCount     int    `json:"pull_count"`
+	RepoOwner     string `json:"repo_owner"`
+	LastUpdated   string `json:"last_updated"`
+	Status        int    `json:"status"`
+	Organization  string `json:"affiliation"`
+	PullsLastWeek int    `json:"pulls_last_week"`
+	Namespace     string `json:"namespace"`
+}
+
+// TagInfo 标签信息
+type TagInfo struct {
+	Name            string    `json:"name"`
+	FullSize        int64     `json:"full_size"`
+	LastUpdated     time.Time `json:"last_updated"`
+	LastPusher      string    `json:"last_pusher"`
+	Images          []Image   `json:"images"`
+	Vulnerabilities struct {
+		Critical int `json:"critical"`
+		High     int `json:"high"`
+		Medium   int `json:"medium"`
+		Low      int `json:"low"`
+		Unknown  int `json:"unknown"`
+	} `json:"vulnerabilities"`
+}
+
+// Image 镜像信息
+type Image struct {
+	Architecture string `json:"architecture"`
+	Features     string `json:"features"`
+	Variant      string `json:"variant,omitempty"`
+	Digest       string `json:"digest"`
+	OS           string `json:"os"`
+	OSFeatures   string `json:"os_features"`
+	Size         int64  `json:"size"`
+}
+
+// TagPageResult 分页标签结果
+type TagPageResult struct {
+	Tags    []TagInfo `json:"tags"`
+	HasMore bool      `json:"has_more"`
+}
+
+type cacheEntry struct {
+	data      interface{}
+	expiresAt time.Time
+}
+
+const (
+	maxCacheSize       = 1000
+	maxPaginationCache = 200
+	cacheTTL           = 30 * time.Minute
+)
+
+type Cache struct {
+	data    map[string]cacheEntry
+	mu      sync.RWMutex
+	maxSize int
+}
+
+var (
+	searchCache = &Cache{
+		data:    make(map[string]cacheEntry),
+		maxSize: maxCacheSize,
+	}
+)
+
+func (c *Cache) Get(key string) (interface{}, bool) {
+	c.mu.RLock()
+	entry, exists := c.data[key]
+	c.mu.RUnlock()
+
+	if !exists {
+		return nil, false
+	}
+
+	if time.Now().After(entry.expiresAt) {
+		c.mu.Lock()
+		delete(c.data, key)
+		c.mu.Unlock()
+		return nil, false
+	}
+
+	return entry.data, true
+}
+
+func (c *Cache) Set(key string, data interface{}) {
+	c.SetWithTTL(key, data, cacheTTL)
+}
+
+func (c *Cache) SetWithTTL(key string, data interface{}, ttl time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if len(c.data) >= c.maxSize {
+		c.cleanupExpiredLocked()
+	}
+
+	c.data[key] = cacheEntry{
+		data:      data,
+		expiresAt: time.Now().Add(ttl),
+	}
+}
+
+func (c *Cache) Cleanup() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.cleanupExpiredLocked()
+}
+
+func (c *Cache) cleanupExpiredLocked() {
+	now := time.Now()
+	for key, entry := range c.data {
+		if now.After(entry.expiresAt) {
+			delete(c.data, key)
+		}
+	}
+}
+
+func init() {
+	go func() {
+		ticker := time.NewTicker(5 * time.Minute)
+		defer ticker.Stop()
+
+		for range ticker.C {
+			searchCache.Cleanup()
+		}
+	}()
+}
+
+// normalizeRepository 统一规范化仓库信息
+func normalizeRepository(repo *Repository) {
+	if repo.IsOfficial {
+		repo.Namespace = "library"
+		if !strings.Contains(repo.Name, "/") {
+			repo.Name = "library/" + repo.Name
+		}
+	} else {
+		if repo.Namespace == "" && repo.RepoOwner != "" {
+			repo.Namespace = repo.RepoOwner
+		}
+
+		if strings.Contains(repo.Name, "/") {
+			parts := strings.Split(repo.Name, "/")
+			if len(parts) > 1 {
+				if repo.Namespace == "" {
+					repo.Namespace = parts[0]
+				}
+				repo.Name = parts[len(parts)-1]
+			}
+		}
+	}
+}
+
+// searchDockerHub 搜索镜像
+func searchDockerHub(ctx context.Context, query string, page, pageSize int) (*SearchResult, error) {
+	return searchDockerHubWithDepth(ctx, query, page, pageSize, 0)
+}
+
+func searchDockerHubWithDepth(ctx context.Context, query string, page, pageSize int, depth int) (*SearchResult, error) {
+	if depth > 1 {
+		return nil, fmt.Errorf("搜索请求过于复杂，请尝试更具体的关键词")
+	}
+	cacheKey := fmt.Sprintf("search:%s:%d:%d", query, page, pageSize)
+
+	if cached, ok := searchCache.Get(cacheKey); ok {
+		return cached.(*SearchResult), nil
+	}
+
+	isUserRepo := strings.Contains(query, "/")
+	var namespace, repoName string
+
+	if isUserRepo {
+		parts := strings.Split(query, "/")
+		if len(parts) == 2 {
+			namespace = parts[0]
+			repoName = parts[1]
+		}
+	}
+
+	baseURL := "https://registry.hub.docker.com/v2"
+	var fullURL string
+	var params url.Values
+
+	if isUserRepo && namespace != "" {
+		fullURL = fmt.Sprintf("%s/repositories/%s/", baseURL, namespace)
+		params = url.Values{
+			"page":      {fmt.Sprintf("%d", page)},
+			"page_size": {fmt.Sprintf("%d", pageSize)},
+		}
+	} else {
+		fullURL = baseURL + "/search/repositories/"
+		params = url.Values{
+			"query":     {query},
+			"page":      {fmt.Sprintf("%d", page)},
+			"page_size": {fmt.Sprintf("%d", pageSize)},
+		}
+	}
+
+	fullURL = fullURL + "?" + params.Encode()
+
+	resp, err := utils.GetSearchHTTPClient().Get(fullURL)
+	if err != nil {
+		return nil, fmt.Errorf("请求Docker Hub API失败: %v", err)
+	}
+	defer safeCloseResponseBody(resp.Body, "搜索响应体")
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("读取响应失败: %v", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		switch resp.StatusCode {
+		case http.StatusTooManyRequests:
+			return nil, fmt.Errorf("请求过于频繁，请稍后重试")
+		case http.StatusNotFound:
+			if isUserRepo && namespace != "" {
+				return searchDockerHubWithDepth(ctx, repoName, page, pageSize, depth+1)
+			}
+			return nil, fmt.Errorf("未找到相关镜像")
+		case http.StatusBadGateway, http.StatusServiceUnavailable:
+			return nil, fmt.Errorf("docker hub 服务暂时不可用，请稍后重试")
+		default:
+			return nil, fmt.Errorf("请求失败: 状态码=%d, 响应=%s", resp.StatusCode, string(body))
+		}
+	}
+
+	var result *SearchResult
+	if isUserRepo && namespace != "" {
+		var userRepos struct {
+			Count    int          `json:"count"`
+			Next     string       `json:"next"`
+			Previous string       `json:"previous"`
+			Results  []Repository `json:"results"`
+		}
+		if err := json.Unmarshal(body, &userRepos); err != nil {
+			return nil, fmt.Errorf("解析响应失败: %v", err)
+		}
+
+		result = &SearchResult{
+			Count:    userRepos.Count,
+			Next:     userRepos.Next,
+			Previous: userRepos.Previous,
+			Results:  make([]Repository, 0),
+		}
+
+		for _, repo := range userRepos.Results {
+			if repoName == "" || strings.Contains(strings.ToLower(repo.Name), strings.ToLower(repoName)) {
+				repo.Namespace = namespace
+				normalizeRepository(&repo)
+				result.Results = append(result.Results, repo)
+			}
+		}
+
+		if len(result.Results) == 0 {
+			return searchDockerHubWithDepth(ctx, repoName, page, pageSize, depth+1)
+		}
+
+		result.Count = len(result.Results)
+	} else {
+		result = &SearchResult{}
+		if err := json.Unmarshal(body, &result); err != nil {
+			return nil, fmt.Errorf("解析响应失败: %v", err)
+		}
+
+		for i := range result.Results {
+			normalizeRepository(&result.Results[i])
+		}
+
+		if isUserRepo && namespace != "" {
+			filteredResults := make([]Repository, 0)
+			for _, repo := range result.Results {
+				if strings.EqualFold(repo.Namespace, namespace) {
+					filteredResults = append(filteredResults, repo)
+				}
+			}
+			result.Results = filteredResults
+			result.Count = len(filteredResults)
+		}
+	}
+
+	searchCache.Set(cacheKey, result)
+	return result, nil
+}
+
+func isRetryableError(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	if strings.Contains(err.Error(), "timeout") ||
+		strings.Contains(err.Error(), "connection refused") ||
+		strings.Contains(err.Error(), "no such host") ||
+		strings.Contains(err.Error(), "too many requests") {
+		return true
+	}
+
+	return false
+}
+
+// getRepositoryTags 获取仓库标签信息
+func getRepositoryTags(ctx context.Context, namespace, name string, page, pageSize int) ([]TagInfo, bool, error) {
+	if namespace == "" || name == "" {
+		return nil, false, fmt.Errorf("无效输入：命名空间和名称不能为空")
+	}
+
+	if page <= 0 {
+		page = 1
+	}
+	if pageSize <= 0 || pageSize > 100 {
+		pageSize = 100
+	}
+
+	cacheKey := fmt.Sprintf("tags:%s:%s:page_%d", namespace, name, page)
+	if cached, ok := searchCache.Get(cacheKey); ok {
+		result := cached.(TagPageResult)
+		return result.Tags, result.HasMore, nil
+	}
+
+	baseURL := fmt.Sprintf("https://registry.hub.docker.com/v2/repositories/%s/%s/tags", namespace, name)
+	params := url.Values{}
+	params.Set("page", fmt.Sprintf("%d", page))
+	params.Set("page_size", fmt.Sprintf("%d", pageSize))
+	params.Set("ordering", "last_updated")
+
+	fullURL := baseURL + "?" + params.Encode()
+
+	pageResult, err := fetchTagPage(ctx, fullURL, 3)
+	if err != nil {
+		return nil, false, fmt.Errorf("获取标签失败: %v", err)
+	}
+
+	hasMore := pageResult.Next != ""
+
+	result := TagPageResult{Tags: pageResult.Results, HasMore: hasMore}
+	searchCache.SetWithTTL(cacheKey, result, 30*time.Minute)
+
+	return pageResult.Results, hasMore, nil
+}
+
+func fetchTagPage(ctx context.Context, url string, maxRetries int) (*struct {
+	Count    int       `json:"count"`
+	Next     string    `json:"next"`
+	Previous string    `json:"previous"`
+	Results  []TagInfo `json:"results"`
+}, error) {
+	var lastErr error
+
+	for retry := 0; retry < maxRetries; retry++ {
+		if retry > 0 {
+			time.Sleep(time.Duration(retry) * 500 * time.Millisecond)
+		}
+
+		resp, err := utils.GetSearchHTTPClient().Get(url)
+		if err != nil {
+			lastErr = err
+			if isRetryableError(err) && retry < maxRetries-1 {
+				continue
+			}
+			return nil, fmt.Errorf("发送请求失败: %v", err)
+		}
+
+		body, err := func() ([]byte, error) {
+			defer safeCloseResponseBody(resp.Body, "标签响应体")
+			return io.ReadAll(resp.Body)
+		}()
+
+		if err != nil {
+			lastErr = err
+			if retry < maxRetries-1 {
+				continue
+			}
+			return nil, fmt.Errorf("读取响应失败: %v", err)
+		}
+
+		if resp.StatusCode != http.StatusOK {
+			lastErr = fmt.Errorf("状态码=%d, 响应=%s", resp.StatusCode, string(body))
+			if resp.StatusCode >= 400 && resp.StatusCode < 500 && resp.StatusCode != 429 {
+				return nil, fmt.Errorf("请求失败: %v", lastErr)
+			}
+			if retry < maxRetries-1 {
+				continue
+			}
+			return nil, fmt.Errorf("请求失败: %v", lastErr)
+		}
+
+		var result struct {
+			Count    int       `json:"count"`
+			Next     string    `json:"next"`
+			Previous string    `json:"previous"`
+			Results  []TagInfo `json:"results"`
+		}
+		if err := json.Unmarshal(body, &result); err != nil {
+			lastErr = err
+			if retry < maxRetries-1 {
+				continue
+			}
+			return nil, fmt.Errorf("解析响应失败: %v", err)
+		}
+
+		return &result, nil
+	}
+
+	return nil, lastErr
+}
+
+func parsePaginationParams(c *gin.Context, defaultPageSize int) (page, pageSize int) {
+	page = 1
+	pageSize = defaultPageSize
+
+	if p := c.Query("page"); p != "" {
+		if _, err := fmt.Sscanf(p, "%d", &page); err != nil {
+			fmt.Printf("解析page参数失败: %v\n", err)
+		}
+	}
+	if ps := c.Query("page_size"); ps != "" {
+		if _, err := fmt.Sscanf(ps, "%d", &pageSize); err != nil {
+			fmt.Printf("解析page_size参数失败: %v\n", err)
+		}
+	}
+
+	return page, pageSize
+}
+
+func safeCloseResponseBody(body io.ReadCloser, context string) {
+	if body != nil {
+		if err := body.Close(); err != nil {
+			fmt.Printf("关闭%s失败: %v\n", context, err)
+		}
+	}
+}
+
+func sendErrorResponse(c *gin.Context, message string) {
+	c.JSON(http.StatusBadRequest, gin.H{"error": message})
+}
+
+// RegisterSearchRoute 注册搜索相关路由
+func RegisterSearchRoute(r *gin.Engine) {
+	r.GET("/search", func(c *gin.Context) {
+		query := c.Query("q")
+		if query == "" {
+			sendErrorResponse(c, "搜索关键词不能为空")
+			return
+		}
+
+		page, pageSize := parsePaginationParams(c, 25)
+
+		result, err := searchDockerHub(c.Request.Context(), query, page, pageSize)
+		if err != nil {
+			sendErrorResponse(c, err.Error())
+			return
+		}
+
+		c.JSON(http.StatusOK, result)
+	})
+
+	r.GET("/tags/:namespace/:name", func(c *gin.Context) {
+		namespace := c.Param("namespace")
+		name := c.Param("name")
+
+		if namespace == "" || name == "" {
+			sendErrorResponse(c, "命名空间和名称不能为空")
+			return
+		}
+
+		page, pageSize := parsePaginationParams(c, 100)
+
+		tags, hasMore, err := getRepositoryTags(c.Request.Context(), namespace, name, page, pageSize)
+		if err != nil {
+			sendErrorResponse(c, err.Error())
+			return
+		}
+
+		if c.Query("page") != "" || c.Query("page_size") != "" {
+			c.JSON(http.StatusOK, gin.H{
+				"tags":      tags,
+				"has_more":  hasMore,
+				"page":      page,
+				"page_size": pageSize,
+			})
+		} else {
+			c.JSON(http.StatusOK, tags)
+		}
+	})
+}

src/handlers/search_test.go

@@ -0,0 +1,45 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestNormalizeRepository(t *testing.T) {
+	official := &Repository{Name: "nginx", IsOfficial: true}
+	normalizeRepository(official)
+	if official.Namespace != "library" || official.Name != "library/nginx" {
+		t.Fatalf("official normalized to %#v", official)
+	}
+
+	userRepo := &Repository{Name: "owner/app", RepoOwner: "owner"}
+	normalizeRepository(userRepo)
+	if userRepo.Namespace != "owner" || userRepo.Name != "app" {
+		t.Fatalf("user repo normalized to %#v", userRepo)
+	}
+}
+
+func TestParsePaginationParams(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	req := httptest.NewRequest(http.MethodGet, "/?page=3&page_size=50", nil)
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	c.Request = req
+
+	page, pageSize := parsePaginationParams(c, 25)
+	if page != 3 || pageSize != 50 {
+		t.Fatalf("pagination = %d %d", page, pageSize)
+	}
+}
+
+func TestSearchCacheExpires(t *testing.T) {
+	cache := &Cache{data: make(map[string]cacheEntry), maxSize: 10}
+	cache.SetWithTTL("k", "v", -time.Second)
+
+	if got, ok := cache.Get("k"); ok || got != nil {
+		t.Fatalf("expired cache returned: %#v", got)
+	}
+}

src/main.go

@@ -1,381 +1,176 @@
-package main
-
-import (
-	"embed"
-	"fmt"
-	"io"
-	"log"
-	"net/http"
-	"regexp"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/gin-gonic/gin"
-)
-
-//go:embed public/*
-var staticFiles embed.FS
-
-// 服务嵌入的静态文件
-func serveEmbedFile(c *gin.Context, filename string) {
-	data, err := staticFiles.ReadFile(filename)
-	if err != nil {
-		c.Status(404)
-		return
-	}
-	contentType := "text/html; charset=utf-8"
-	if strings.HasSuffix(filename, ".ico") {
-		contentType = "image/x-icon"
-	}
-	c.Data(200, contentType, data)
-}
-
-var (
-	exps = []*regexp.Regexp{
-		regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:releases|archive)/.*$`),
-		regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:blob|raw)/.*$`),
-		regexp.MustCompile(`^(?:https?://)?github\.com/([^/]+)/([^/]+)/(?:info|git-).*$`),
-		regexp.MustCompile(`^(?:https?://)?raw\.github(?:usercontent|)\.com/([^/]+)/([^/]+)/.+?/.+$`),
-		regexp.MustCompile(`^(?:https?://)?gist\.github(?:usercontent|)\.com/([^/]+)/.+?/.+`),
-		regexp.MustCompile(`^(?:https?://)?api\.github\.com/repos/([^/]+)/([^/]+)/.*`),
-		regexp.MustCompile(`^(?:https?://)?huggingface\.co(?:/spaces)?/([^/]+)/(.+)$`),
-		regexp.MustCompile(`^(?:https?://)?cdn-lfs\.hf\.co(?:/spaces)?/([^/]+)/([^/]+)(?:/(.*))?$`),
-		regexp.MustCompile(`^(?:https?://)?download\.docker\.com/([^/]+)/.*\.(tgz|zip)$`),
-		regexp.MustCompile(`^(?:https?://)?(github|opengraph)\.githubassets\.com/([^/]+)/.+?$`),
-	}
-	globalLimiter *IPRateLimiter
-	
-	// 服务启动时间
-	serviceStartTime = time.Now()
-)
-
-func main() {
-	// 加载配置
-	if err := LoadConfig(); err != nil {
-		fmt.Printf("配置加载失败: %v\n", err)
-		return
-	}
-	
-	// 初始化HTTP客户端
-	initHTTPClients()
-	
-	// 初始化限流器
-	initLimiter()
-	
-	// 初始化Docker流式代理
-	initDockerProxy()
-
-	// 初始化镜像流式下载器
-	initImageStreamer()
-
-	// 初始化防抖器
-	initDebouncer()
-
-	gin.SetMode(gin.ReleaseMode)
-	router := gin.Default()
-
-	// 全局Panic恢复保护
-	router.Use(gin.CustomRecovery(func(c *gin.Context, recovered interface{}) {
-		log.Printf("🚨 Panic recovered: %v", recovered)
-		c.JSON(http.StatusInternalServerError, gin.H{
-			"error": "Internal server error",
-			"code":  "INTERNAL_ERROR",
-		})
-	}))
-
-	// 初始化监控端点
-	initHealthRoutes(router)
-	
-	// 初始化镜像tar下载路由
-	initImageTarRoutes(router)
-	
-	// 静态文件路由
-	router.GET("/", func(c *gin.Context) {
-		serveEmbedFile(c, "public/index.html")
-	})
-	router.GET("/public/*filepath", func(c *gin.Context) {
-		filepath := strings.TrimPrefix(c.Param("filepath"), "/")
-		serveEmbedFile(c, "public/"+filepath)
-	})
-
-	router.GET("/images.html", func(c *gin.Context) {
-		serveEmbedFile(c, "public/images.html")
-	})
-	router.GET("/search.html", func(c *gin.Context) {
-		serveEmbedFile(c, "public/search.html")
-	})
-	router.GET("/favicon.ico", func(c *gin.Context) {
-		serveEmbedFile(c, "public/favicon.ico")
-	})
-
-	// 注册dockerhub搜索路由
-	RegisterSearchRoute(router)
-	
-	// 注册Docker认证路由（/token*）
-	router.Any("/token", RateLimitMiddleware(globalLimiter), ProxyDockerAuthGin)
-	router.Any("/token/*path", RateLimitMiddleware(globalLimiter), ProxyDockerAuthGin)
-	
-	// 注册Docker Registry代理路由
-	router.Any("/v2/*path", RateLimitMiddleware(globalLimiter), ProxyDockerRegistryGin)
-	
-
-	// 注册NoRoute处理器
-	router.NoRoute(RateLimitMiddleware(globalLimiter), handler)
-
-	cfg := GetConfig()
-	fmt.Printf("🚀 HubProxy 启动成功\n")
-	fmt.Printf("📡 监听地址: %s:%d\n", cfg.Server.Host, cfg.Server.Port)
-	fmt.Printf("⚡ 限流配置: %d请求/%g小时\n", cfg.RateLimit.RequestLimit, cfg.RateLimit.PeriodHours)
-	fmt.Printf("🔗 项目地址: https://github.com/sky22333/hubproxy\n")
-	
-	err := router.Run(fmt.Sprintf("%s:%d", cfg.Server.Host, cfg.Server.Port))
-	if err != nil {
-		fmt.Printf("启动服务失败: %v\n", err)
-	}
-}
-
-func handler(c *gin.Context) {
-	rawPath := strings.TrimPrefix(c.Request.URL.RequestURI(), "/")
-
-	for strings.HasPrefix(rawPath, "/") {
-		rawPath = strings.TrimPrefix(rawPath, "/")
-	}
-
-	if !strings.HasPrefix(rawPath, "http") {
-		c.String(http.StatusForbidden, "无效输入")
-		return
-	}
-
-	matches := checkURL(rawPath)
-	if matches != nil {
-		// GitHub仓库访问控制检查
-		if allowed, reason := GlobalAccessController.CheckGitHubAccess(matches); !allowed {
-			// 构建仓库名用于日志
-			var repoPath string
-			if len(matches) >= 2 {
-				username := matches[0]
-				repoName := strings.TrimSuffix(matches[1], ".git")
-				repoPath = username + "/" + repoName
-			}
-			fmt.Printf("GitHub仓库 %s 访问被拒绝: %s\n", repoPath, reason)
-			c.String(http.StatusForbidden, reason)
-			return
-		}
-	} else {
-		c.String(http.StatusForbidden, "无效输入")
-		return
-	}
-
-	if exps[1].MatchString(rawPath) {
-		rawPath = strings.Replace(rawPath, "/blob/", "/raw/", 1)
-	}
-
-	proxy(c, rawPath)
-}
-
-
-func proxy(c *gin.Context, u string) {
-	proxyWithRedirect(c, u, 0)
-}
-
-
-func proxyWithRedirect(c *gin.Context, u string, redirectCount int) {
-	// 限制最大重定向次数，防止无限递归
-	const maxRedirects = 20
-	if redirectCount > maxRedirects {
-		c.String(http.StatusLoopDetected, "重定向次数过多，可能存在循环重定向")
-		return
-	}
-	req, err := http.NewRequest(c.Request.Method, u, c.Request.Body)
-	if err != nil {
-		c.String(http.StatusInternalServerError, fmt.Sprintf("server error %v", err))
-		return
-	}
-
-	for key, values := range c.Request.Header {
-		for _, value := range values {
-			req.Header.Add(key, value)
-		}
-	}
-	req.Header.Del("Host")
-
-	resp, err := GetGlobalHTTPClient().Do(req)
-	if err != nil {
-		c.String(http.StatusInternalServerError, fmt.Sprintf("server error %v", err))
-		return
-	}
-	defer func() {
-		if err := resp.Body.Close(); err != nil {
-			fmt.Printf("关闭响应体失败: %v\n", err)
-		}
-	}()
-
-	// 检查文件大小限制
-	cfg := GetConfig()
-	if contentLength := resp.Header.Get("Content-Length"); contentLength != "" {
-		if size, err := strconv.ParseInt(contentLength, 10, 64); err == nil && size > cfg.Server.FileSize {
-			c.String(http.StatusRequestEntityTooLarge, 
-				fmt.Sprintf("文件过大，限制大小: %d MB", cfg.Server.FileSize/(1024*1024)))
-			return
-		}
-	}
-
-	// 清理安全相关的头
-	resp.Header.Del("Content-Security-Policy")
-	resp.Header.Del("Referrer-Policy")
-	resp.Header.Del("Strict-Transport-Security")
-	
-	// 获取真实域名
-	realHost := c.Request.Header.Get("X-Forwarded-Host")
-	if realHost == "" {
-		realHost = c.Request.Host
-	}
-	// 如果域名中没有协议前缀，添加https://
-	if !strings.HasPrefix(realHost, "http://") && !strings.HasPrefix(realHost, "https://") {
-		realHost = "https://" + realHost
-	}
-
-	if strings.HasSuffix(strings.ToLower(u), ".sh") {
-		isGzipCompressed := resp.Header.Get("Content-Encoding") == "gzip"
-		
-		processedBody, processedSize, err := ProcessSmart(resp.Body, isGzipCompressed, realHost)
-		if err != nil {
-			fmt.Printf("智能处理失败，回退到直接代理: %v\n", err)
-			processedBody = resp.Body
-			processedSize = 0
-		}
-
-		// 智能设置响应头
-		if processedSize > 0 {
-			resp.Header.Del("Content-Length")
-			resp.Header.Del("Content-Encoding")
-			resp.Header.Set("Transfer-Encoding", "chunked")
-		}
-
-		// 复制其他响应头
-		for key, values := range resp.Header {
-			for _, value := range values {
-				c.Header(key, value)
-			}
-		}
-
-		if location := resp.Header.Get("Location"); location != "" {
-			if checkURL(location) != nil {
-				c.Header("Location", "/"+location)
-			} else {
-				proxyWithRedirect(c, location, redirectCount+1)
-				return
-			}
-		}
-
-		c.Status(resp.StatusCode)
-
-		// 输出处理后的内容
-		if _, err := io.Copy(c.Writer, processedBody); err != nil {
-			return
-		}
-	} else {
-		for key, values := range resp.Header {
-			for _, value := range values {
-				c.Header(key, value)
-			}
-		}
-
-		// 处理重定向
-		if location := resp.Header.Get("Location"); location != "" {
-			if checkURL(location) != nil {
-				c.Header("Location", "/"+location)
-			} else {
-				proxyWithRedirect(c, location, redirectCount+1)
-				return
-			}
-		}
-
-		c.Status(resp.StatusCode)
-
-		// 直接流式转发
-		if _, err := io.Copy(c.Writer, resp.Body); err != nil {
-			fmt.Printf("直接代理失败: %v\n", err)
-		}
-	}
-}
-
-func checkURL(u string) []string {
-	for _, exp := range exps {
-		if matches := exp.FindStringSubmatch(u); matches != nil {
-			return matches[1:]
-		}
-	}
-	return nil
-}
-
-// 初始化健康监控路由
-func initHealthRoutes(router *gin.Engine) {
-	// 健康检查端点
-	router.GET("/health", func(c *gin.Context) {
-		c.JSON(http.StatusOK, gin.H{
-			"status":    "healthy",
-			"timestamp": time.Now().Unix(),
-			"uptime":    time.Since(serviceStartTime).Seconds(),
-			"service":   "hubproxy",
-		})
-	})
-	
-	// 就绪检查端点
-	router.GET("/ready", func(c *gin.Context) {
-		checks := make(map[string]string)
-		allReady := true
-		
-		if GetConfig() != nil {
-			checks["config"] = "ok"
-		} else {
-			checks["config"] = "failed"
-			allReady = false
-		}
-		
-		// 检查全局缓存状态
-		if globalCache != nil {
-			checks["cache"] = "ok"
-		} else {
-			checks["cache"] = "failed"
-			allReady = false
-		}
-		
-		// 检查限流器状态
-		if globalLimiter != nil {
-			checks["ratelimiter"] = "ok"
-		} else {
-			checks["ratelimiter"] = "failed"
-			allReady = false
-		}
-		
-		// 检查镜像下载器状态
-		if globalImageStreamer != nil {
-			checks["imagestreamer"] = "ok"
-		} else {
-			checks["imagestreamer"] = "failed"
-			allReady = false
-		}
-		
-		// 检查HTTP客户端状态
-		if GetGlobalHTTPClient() != nil {
-			checks["httpclient"] = "ok"
-		} else {
-			checks["httpclient"] = "failed"
-			allReady = false
-		}
-		
-		status := http.StatusOK
-		if !allReady {
-			status = http.StatusServiceUnavailable
-		}
-		
-		c.JSON(status, gin.H{
-			"ready":     allReady,
-			"checks":    checks,
-			"timestamp": time.Now().Unix(),
-			"uptime":    time.Since(serviceStartTime).Seconds(),
-		})
-	})
-}
+package main
+
+import (
+	"embed"
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+	"hubproxy/config"
+	"hubproxy/handlers"
+	"hubproxy/utils"
+)
+
+//go:embed public/*
+var staticFiles embed.FS
+
+var (
+	globalLimiter    *utils.IPRateLimiter
+	serviceStartTime = time.Now()
+)
+
+var Version = "dev"
+
+func serveEmbedFile(c *gin.Context, filename string) {
+	data, err := staticFiles.ReadFile(filename)
+	if err != nil {
+		c.Status(http.StatusNotFound)
+		return
+	}
+
+	contentType := "text/html; charset=utf-8"
+	if strings.HasSuffix(filename, ".ico") {
+		contentType = "image/x-icon"
+	}
+	c.Data(http.StatusOK, contentType, data)
+}
+
+func buildRouter(cfg *config.AppConfig) *gin.Engine {
+	gin.SetMode(gin.ReleaseMode)
+	router := gin.Default()
+
+	router.Use(gin.CustomRecovery(func(c *gin.Context, recovered interface{}) {
+		log.Printf("Panic 已恢复: %v", recovered)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error": "Internal server error",
+			"code":  "INTERNAL_ERROR",
+		})
+	}))
+
+	router.Use(utils.RateLimitMiddleware(globalLimiter))
+
+	initHealthRoutes(router)
+	handlers.InitImageTarRoutes(router)
+
+	if cfg.Server.EnableFrontend {
+		router.GET("/", func(c *gin.Context) {
+			serveEmbedFile(c, "public/index.html")
+		})
+		router.GET("/public/*filepath", func(c *gin.Context) {
+			filepath := strings.TrimPrefix(c.Param("filepath"), "/")
+			serveEmbedFile(c, "public/"+filepath)
+		})
+		router.GET("/images.html", func(c *gin.Context) {
+			serveEmbedFile(c, "public/images.html")
+		})
+		router.GET("/search.html", func(c *gin.Context) {
+			serveEmbedFile(c, "public/search.html")
+		})
+		router.GET("/favicon.ico", func(c *gin.Context) {
+			serveEmbedFile(c, "public/favicon.ico")
+		})
+	} else {
+		router.GET("/", func(c *gin.Context) { c.Status(http.StatusNotFound) })
+		router.GET("/public/*filepath", func(c *gin.Context) { c.Status(http.StatusNotFound) })
+		router.GET("/images.html", func(c *gin.Context) { c.Status(http.StatusNotFound) })
+		router.GET("/search.html", func(c *gin.Context) { c.Status(http.StatusNotFound) })
+		router.GET("/favicon.ico", func(c *gin.Context) { c.Status(http.StatusNotFound) })
+	}
+
+	handlers.RegisterSearchRoute(router)
+
+	router.Any("/token", handlers.ProxyDockerAuthGin)
+	router.Any("/token/*path", handlers.ProxyDockerAuthGin)
+	router.Any("/v2/*path", handlers.ProxyDockerRegistryGin)
+	router.NoRoute(handlers.GitHubProxyHandler)
+
+	return router
+}
+
+func main() {
+	if err := config.LoadConfig(); err != nil {
+		fmt.Printf("配置加载失败: %v\n", err)
+		return
+	}
+
+	utils.InitHTTPClients()
+	globalLimiter = utils.InitGlobalLimiter()
+	handlers.InitDockerProxy()
+	handlers.InitImageStreamer()
+	handlers.InitDebouncer()
+
+	cfg := config.GetConfig()
+	router := buildRouter(cfg)
+
+	fmt.Printf("HubProxy 启动成功\n")
+	fmt.Printf("监听地址: %s:%d\n", cfg.Server.Host, cfg.Server.Port)
+	fmt.Printf("限流配置: %d请求/%g小时\n", cfg.RateLimit.RequestLimit, cfg.RateLimit.PeriodHours)
+	if cfg.Server.EnableH2C {
+		fmt.Printf("H2c: 已启用\n")
+	}
+	fmt.Printf("版本号: %s\n", Version)
+	fmt.Printf("项目地址: https://github.com/sky22333/hubproxy\n")
+
+	server := &http.Server{
+		Addr:         fmt.Sprintf("%s:%d", cfg.Server.Host, cfg.Server.Port),
+		ReadTimeout:  60 * time.Second,
+		WriteTimeout: 30 * time.Minute,
+		IdleTimeout:  120 * time.Second,
+	}
+
+	if cfg.Server.EnableH2C {
+		server.Handler = h2c.NewHandler(router, &http2.Server{
+			MaxConcurrentStreams:         250,
+			IdleTimeout:                  300 * time.Second,
+			MaxReadFrameSize:             4 << 20,
+			MaxUploadBufferPerConnection: 8 << 20,
+			MaxUploadBufferPerStream:     2 << 20,
+		})
+	} else {
+		server.Handler = router
+	}
+
+	if err := server.ListenAndServe(); err != nil {
+		fmt.Printf("启动服务失败: %v\n", err)
+	}
+}
+
+func formatDuration(d time.Duration) string {
+	if d < time.Minute {
+		return fmt.Sprintf("%d秒", int(d.Seconds()))
+	}
+	if d < time.Hour {
+		return fmt.Sprintf("%d分钟%d秒", int(d.Minutes()), int(d.Seconds())%60)
+	}
+	if d < 24*time.Hour {
+		return fmt.Sprintf("%d小时%d分钟", int(d.Hours()), int(d.Minutes())%60)
+	}
+
+	days := int(d.Hours()) / 24
+	hours := int(d.Hours()) % 24
+	return fmt.Sprintf("%d天%d小时", days, hours)
+}
+
+func getUptimeInfo() (time.Duration, float64, string) {
+	uptime := time.Since(serviceStartTime)
+	return uptime, uptime.Seconds(), formatDuration(uptime)
+}
+
+func initHealthRoutes(router *gin.Engine) {
+	router.GET("/ready", func(c *gin.Context) {
+		_, uptimeSec, uptimeHuman := getUptimeInfo()
+		c.JSON(http.StatusOK, gin.H{
+			"ready":           true,
+			"service":         "hubproxy",
+			"version":         Version,
+			"start_time_unix": serviceStartTime.Unix(),
+			"uptime_sec":      uptimeSec,
+			"uptime_human":    uptimeHuman,
+		})
+	})
+}

src/main_test.go

@@ -0,0 +1,167 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"hubproxy/config"
+	"hubproxy/handlers"
+	"hubproxy/utils"
+)
+
+func newTestRouter(t *testing.T, configBody string) *gin.Engine {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "config.toml")
+	if err := os.WriteFile(path, []byte(configBody), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("CONFIG_PATH", path)
+	if err := config.LoadConfig(); err != nil {
+		t.Fatal(err)
+	}
+
+	utils.InitHTTPClients()
+	globalLimiter = utils.InitGlobalLimiter()
+	handlers.InitDockerProxy()
+	handlers.InitImageStreamer()
+	handlers.InitDebouncer()
+
+	return buildRouter(config.GetConfig())
+}
+
+func performRequest(router http.Handler, method, path, body string) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(method, path, strings.NewReader(body))
+	if body != "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("User-Agent", "hubproxy-test")
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+	return w
+}
+
+func TestReadyRoute(t *testing.T) {
+	router := newTestRouter(t, "")
+
+	w := performRequest(router, http.MethodGet, "/ready", "")
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", w.Code, w.Body.String())
+	}
+
+	var got map[string]any
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatal(err)
+	}
+	if got["ready"] != true || got["service"] != "hubproxy" {
+		t.Fatalf("unexpected ready response: %#v", got)
+	}
+}
+
+func TestFrontendDisabledRoutesReturnNotFound(t *testing.T) {
+	router := newTestRouter(t, `
+[server]
+enableFrontend = false
+`)
+
+	for _, path := range []string{"/", "/images.html", "/search.html", "/favicon.ico"} {
+		w := performRequest(router, http.MethodGet, path, "")
+		if w.Code != http.StatusNotFound {
+			t.Fatalf("%s status = %d, want 404", path, w.Code)
+		}
+	}
+}
+
+func TestSingleImageDownloadPrepareReturnsURL(t *testing.T) {
+	router := newTestRouter(t, "")
+
+	w := performRequest(router, http.MethodGet, "/api/image/download/nginx?mode=prepare", "")
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", w.Code, w.Body.String())
+	}
+
+	var got struct {
+		DownloadURL string `json:"download_url"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasPrefix(got.DownloadURL, "/api/image/download/nginx?token=") {
+		t.Fatalf("download_url = %q", got.DownloadURL)
+	}
+}
+
+func TestBatchImageDownloadPrepareReturnsURL(t *testing.T) {
+	router := newTestRouter(t, "")
+
+	body := `{"images":["nginx"],"useCompressedLayers":true}`
+	w := performRequest(router, http.MethodPost, "/api/image/batch?mode=prepare", body)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", w.Code, w.Body.String())
+	}
+
+	var got struct {
+		DownloadURL string `json:"download_url"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasPrefix(got.DownloadURL, "/api/image/batch?token=") {
+		t.Fatalf("download_url = %q", got.DownloadURL)
+	}
+}
+
+func TestBatchImageDownloadRejectsTooManyImages(t *testing.T) {
+	router := newTestRouter(t, `
+[download]
+maxImages = 1
+`)
+
+	body := `{"images":["nginx","redis"],"useCompressedLayers":true}`
+	w := performRequest(router, http.MethodPost, "/api/image/batch?mode=prepare", body)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400; body=%s", w.Code, w.Body.String())
+	}
+}
+
+func TestGitHubNoRouteRejectsUnsupportedHost(t *testing.T) {
+	router := newTestRouter(t, "")
+
+	w := performRequest(router, http.MethodGet, "/https://example.com/file.zip", "")
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body=%s", w.Code, w.Body.String())
+	}
+}
+
+func TestDockerV2InvalidPath(t *testing.T) {
+	router := newTestRouter(t, "")
+
+	w := performRequest(router, http.MethodGet, "/v2/library/nginx/unknown/latest", "")
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("invalid v2 status = %d, want 400; body=%s", w.Code, w.Body.String())
+	}
+}
+
+func TestSearchRouteRejectsMissingQuery(t *testing.T) {
+	router := newTestRouter(t, "")
+
+	w := performRequest(router, http.MethodGet, "/search", "")
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400; body=%s", w.Code, w.Body.String())
+	}
+
+	var got map[string]string
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatal(err)
+	}
+	if got["error"] == "" {
+		t.Fatalf("missing error response: %#v", got)
+	}
+}

src/proxysh.go

@@ -1,95 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"compress/gzip"
-	"fmt"
-	"io"
-	"regexp"
-	"strings"
-)
-
-// GitHub URL正则表达式
-var githubRegex = regexp.MustCompile(`https?://(?:github\.com|raw\.githubusercontent\.com|raw\.github\.com|gist\.githubusercontent\.com|gist\.github\.com|api\.github\.com)[^\s'"]+`)
-
-// ProcessSmart Shell脚本智能处理函数
-func ProcessSmart(input io.ReadCloser, isCompressed bool, host string) (io.Reader, int64, error) {
-	defer input.Close()
-	
-	content, err := readShellContent(input, isCompressed)
-	if err != nil {
-		return nil, 0, fmt.Errorf("内容读取失败: %v", err)
-	}
-	
-	if len(content) == 0 {
-		return strings.NewReader(""), 0, nil
-	}
-	
-	if len(content) > 10*1024*1024 {
-		return strings.NewReader(content), int64(len(content)), nil
-	}
-	
-	if !strings.Contains(content, "github.com") && !strings.Contains(content, "githubusercontent.com") {
-		return strings.NewReader(content), int64(len(content)), nil
-	}
-	
-	processed := processGitHubURLs(content, host)
-	
-	return strings.NewReader(processed), int64(len(processed)), nil
-}
-
-func readShellContent(input io.ReadCloser, isCompressed bool) (string, error) {
-	var reader io.Reader = input
-	
-	// 处理gzip压缩
-	if isCompressed {
-		peek := make([]byte, 2)
-		n, err := input.Read(peek)
-		if err != nil && err != io.EOF {
-			return "", fmt.Errorf("读取数据失败: %v", err)
-		}
-		
-		if n >= 2 && peek[0] == 0x1f && peek[1] == 0x8b {
-			combinedReader := io.MultiReader(bytes.NewReader(peek[:n]), input)
-			gzReader, err := gzip.NewReader(combinedReader)
-			if err != nil {
-				return "", fmt.Errorf("gzip解压失败: %v", err)
-			}
-			defer gzReader.Close()
-			reader = gzReader
-		} else {
-			reader = io.MultiReader(bytes.NewReader(peek[:n]), input)
-		}
-	}
-	
-	data, err := io.ReadAll(reader)
-	if err != nil {
-		return "", fmt.Errorf("读取内容失败: %v", err)
-	}
-	
-	return string(data), nil
-}
-
-func processGitHubURLs(content, host string) string {
-	return githubRegex.ReplaceAllStringFunc(content, func(url string) string {
-		return transformURL(url, host)
-	})
-}
-
-// transformURL URL转换函数
-func transformURL(url, host string) string {
-	if strings.Contains(url, host) {
-		return url
-	}
-	
-	if strings.HasPrefix(url, "http://") {
-		url = "https" + url[4:]
-	} else if !strings.HasPrefix(url, "https://") && !strings.HasPrefix(url, "//") {
-		url = "https://" + url
-	}
-	cleanHost := strings.TrimPrefix(host, "https://")
-	cleanHost = strings.TrimPrefix(cleanHost, "http://")
-	cleanHost = strings.TrimSuffix(cleanHost, "/")
-	
-	return cleanHost + "/" + url
-}

src/public/images.html

@@ -1,13 +1,13 @@
 <!DOCTYPE html>
-<html lang="zh">
+<html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <meta name="description" content="Docker镜像流式下载工具,即点即下,无需等待">
-    <meta name="keywords" content="Docker,镜像下载,流式下载,即时下载">
+    <meta name="description" content="Docker镜像流式下载工具、即点即下无需等待">
+    <meta name="keywords" content="Docker镜像下载、流式下载、即时下载">
     <meta name="color-scheme" content="dark light">
     <title>Docker离线镜像下载</title>
-    <link rel="icon" href="./favicon.ico">
+    <link rel="icon" href="/favicon.ico">
     <style>
         :root {
             --background: #ffffff;
@@ -399,6 +399,67 @@
             100% { transform: rotate(360deg); }
         }
 
+        /* 切换开关样式 */
+        .switch-container {
+            display: flex;
+            align-items: center;
+            gap: 0.75rem;
+            margin-bottom: 1.5rem;
+        }
+
+        .switch {
+            position: relative;
+            display: inline-block;
+            width: 50px;
+            height: 24px;
+        }
+
+        .switch input {
+            opacity: 0;
+            width: 0;
+            height: 0;
+        }
+
+        .slider {
+            position: absolute;
+            cursor: pointer;
+            top: 0;
+            left: 0;
+            right: 0;
+            bottom: 0;
+            background-color: var(--muted);
+            transition: 0.2s;
+            border-radius: 24px;
+            border: 1px solid var(--border);
+        }
+
+        .slider:before {
+            position: absolute;
+            content: "";
+            height: 18px;
+            width: 18px;
+            left: 2px;
+            bottom: 2px;
+            background-color: white;
+            transition: 0.2s;
+            border-radius: 50%;
+            box-shadow: 0 1px 3px rgba(0,0,0,0.1);
+        }
+
+        input:checked + .slider {
+            background-color: var(--primary);
+        }
+
+        input:checked + .slider:before {
+            transform: translateX(26px);
+        }
+
+        .switch-label {
+            font-weight: 500;
+            color: var(--foreground);
+            cursor: pointer;
+        }
+
         .hidden {
             display: none;
         }
@@ -520,7 +581,7 @@
                     </div>
                     <div class="feature">
                         <span class="feature-icon">💾</span>
-                        <span>无需打包</span>
+                        <span>无需等待</span>
                     </div>
                     <div class="feature">
                         <span class="feature-icon">🏗️</span>
@@ -559,6 +620,14 @@
                         </div>
                     </div>
                     
+                    <div class="switch-container">
+                        <label class="switch">
+                            <input type="checkbox" id="compressedToggle" checked>
+                            <span class="slider"></span>
+                        </label>
+                        <label for="compressedToggle" class="switch-label">使用压缩层（减小包体积）</label>
+                    </div>
+                    
                     <button type="submit" class="btn btn-primary btn-full" id="downloadBtn">
                         <span id="downloadText">立即下载</span>
                         <span id="downloadLoading" class="loading hidden"></span>
@@ -573,7 +642,7 @@
                 
                 <form id="batchForm">
                     <div class="form-group">
-                        <label class="form-label" for="imagesTextarea">镜像列表，每行一个，会将多个镜像自动合并，符合官方标准，完全兼容docker load</label>
+                        <label class="form-label" for="imagesTextarea">镜像列表，每行一个，会将多个镜像自动合并，符合官方标准，兼容docker load</label>
                         <textarea 
                             id="imagesTextarea" 
                             class="textarea" 
@@ -595,6 +664,14 @@
                         </div>
                     </div>
                     
+                    <div class="switch-container">
+                        <label class="switch">
+                            <input type="checkbox" id="batchCompressedToggle" checked>
+                            <span class="slider"></span>
+                        </label>
+                        <label for="batchCompressedToggle" class="switch-label">使用压缩层（减小包体积）</label>
+                    </div>
+                    
                     <button type="submit" class="btn btn-primary btn-full" id="batchDownloadBtn">
                         <span id="batchDownloadText">开始下载</span>
                         <span id="batchDownloadLoading" class="loading hidden"></span>
@@ -651,18 +728,85 @@
             }
         }
 
-        function buildDownloadUrl(imageName, platform = '') {
+        function buildDownloadUrl(imageName, platform = '', useCompressed = true, mode = '') {
             const encodedImage = imageName.replace(/\//g, '_');
             let url = `/api/image/download/${encodedImage}`;
             
+            const params = new URLSearchParams();
             if (platform && platform.trim()) {
-                url += `?platform=${encodeURIComponent(platform.trim())}`;
+                params.append('platform', platform.trim());
+            }
+            params.append('compressed', useCompressed.toString());
+            if (mode) {
+                params.append('mode', mode);
+            }
+            
+            if (params.toString()) {
+                url += '?' + params.toString();
             }
             
             return url;
         }
 
-        document.getElementById('singleForm').addEventListener('submit', function(e) {
+        function buildInfoUrl(imageName) {
+            const encodedImage = imageName.replace(/\//g, '_');
+            return `/api/image/info/${encodedImage}`;
+        }
+
+        async function preflightImageDownload(imageName) {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), 8000);
+            try {
+                const response = await fetch(buildInfoUrl(imageName), {
+                    method: 'GET',
+                    headers: {
+                        'Accept': 'application/json'
+                    },
+                    cache: 'no-store',
+                    signal: controller.signal
+                });
+
+                const contentType = response.headers.get('Content-Type') || '';
+                let payload = null;
+                if (contentType.includes('application/json')) {
+                    payload = await response.json();
+                }
+
+                if (!response.ok) {
+                    return { ok: false, error: (payload && payload.error) ? payload.error : '镜像预检失败' };
+                }
+
+                if (payload && payload.success === false) {
+                    return { ok: false, error: payload.error || '镜像预检失败' };
+                }
+
+                return { ok: true };
+            } catch (error) {
+                if (error.name === 'AbortError') {
+                    return { ok: false, error: '预检超时，请稍后重试' };
+                }
+                return { ok: false, error: '网络错误: ' + error.message };
+            } finally {
+                clearTimeout(timeoutId);
+            }
+        }
+
+        async function preflightImages(images) {
+            const uniqueImages = Array.from(new Set(images));
+            const results = await Promise.allSettled(uniqueImages.map((imageName) => preflightImageDownload(imageName)));
+            for (let i = 0; i < results.length; i++) {
+                const result = results[i];
+                if (result.status === 'rejected') {
+                    return { ok: false, error: '预检失败，请稍后重试' };
+                }
+                if (!result.value.ok) {
+                    return { ok: false, error: result.value.error || '预检失败' };
+                }
+            }
+            return { ok: true };
+        }
+
+        document.getElementById('singleForm').addEventListener('submit', async function(e) {
             e.preventDefault();
             
             const imageName = document.getElementById('imageInput').value.trim();
@@ -672,24 +816,55 @@
             }
             
             const platform = document.getElementById('platformInput').value.trim();
+            const useCompressed = document.getElementById('compressedToggle').checked;
             
             hideStatus('singleStatus');
             setButtonLoading('downloadBtn', 'downloadText', 'downloadLoading', true);
             
-            const downloadUrl = buildDownloadUrl(imageName, platform);
-            
-            const link = document.createElement('a');
-            link.href = downloadUrl;
-            link.download = '';
-            link.style.display = 'none';
-            document.body.appendChild(link);
-            
-            link.click();
-            document.body.removeChild(link);
-            
-            const platformText = platform ? ` (${platform})` : '';
-            showStatus('singleStatus', `开始下载 ${imageName}${platformText}`, 'success');
-            setButtonLoading('downloadBtn', 'downloadText', 'downloadLoading', false);
+            showStatus('singleStatus', '正在准备下载...', 'success');
+            const preflightResult = await preflightImages([imageName]);
+            if (!preflightResult.ok) {
+                showStatus('singleStatus', preflightResult.error, 'error');
+                setButtonLoading('downloadBtn', 'downloadText', 'downloadLoading', false);
+                return;
+            }
+
+            const prepareUrl = buildDownloadUrl(imageName, platform, useCompressed, 'prepare');
+            try {
+                const response = await fetch(prepareUrl, {
+                    method: 'GET',
+                    headers: {
+                        'Accept': 'application/json'
+                    },
+                    cache: 'no-store'
+                });
+
+                if (response.ok) {
+                    const data = await response.json();
+                    if (!data || !data.download_url) {
+                        showStatus('singleStatus', '下载地址生成失败', 'error');
+                        return;
+                    }
+
+                    const link = document.createElement('a');
+                    link.href = data.download_url;
+                    link.download = '';
+                    link.style.display = 'none';
+                    document.body.appendChild(link);
+                    link.click();
+                    document.body.removeChild(link);
+
+                    const platformText = platform ? ` (${platform})` : '';
+                    showStatus('singleStatus', `开始下载 ${imageName}${platformText}`, 'success');
+                } else {
+                    const error = await response.json();
+                    showStatus('singleStatus', error.error || '下载失败', 'error');
+                }
+            } catch (error) {
+                showStatus('singleStatus', '网络错误: ' + error.message, 'error');
+            } finally {
+                setButtonLoading('downloadBtn', 'downloadText', 'downloadLoading', false);
+            }
         });
 
         document.getElementById('batchForm').addEventListener('submit', async function(e) {
@@ -711,9 +886,11 @@
             }
             
             const platform = document.getElementById('batchPlatformInput').value.trim();
+            const useCompressed = document.getElementById('batchCompressedToggle').checked;
             
             const options = {
-                images: images
+                images: images,
+                useCompressedLayers: useCompressed
             };
             
             if (platform) {
@@ -722,9 +899,16 @@
             
             hideStatus('batchStatus');
             setButtonLoading('batchDownloadBtn', 'batchDownloadText', 'batchDownloadLoading', true);
+            showStatus('batchStatus', '正在准备下载...', 'success');
+            const preflightResult = await preflightImages(images);
+            if (!preflightResult.ok) {
+                showStatus('batchStatus', preflightResult.error, 'error');
+                setButtonLoading('batchDownloadBtn', 'batchDownloadText', 'batchDownloadLoading', false);
+                return;
+            }
             
             try {
-                const response = await fetch('/api/image/batch', {
+                const response = await fetch('/api/image/batch?mode=prepare', {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/json',
@@ -733,24 +917,19 @@
                 });
                 
                 if (response.ok) {
-                    const contentDisposition = response.headers.get('Content-Disposition');
-                    let filename = `batch_${images.length}_images.tar`;
-                    
-                    if (contentDisposition) {
-                        const matches = contentDisposition.match(/filename="(.+)"/);
-                        if (matches) filename = matches[1];
+                    const data = await response.json();
+                    if (!data || !data.download_url) {
+                        showStatus('batchStatus', '下载地址生成失败', 'error');
+                        return;
                     }
-                    
-                    const blob = await response.blob();
-                    const url = window.URL.createObjectURL(blob);
+
+                    const url = data.download_url;
                     const link = document.createElement('a');
                     link.href = url;
-                    link.download = filename;
                     link.style.display = 'none';
                     document.body.appendChild(link);
                     link.click();
                     document.body.removeChild(link);
-                    window.URL.revokeObjectURL(url);
                     
                     const platformText = platform ? ` (${platform})` : '';
                     showStatus('batchStatus', `开始下载 ${images.length} 个镜像${platformText}`, 'success');
@@ -786,4 +965,4 @@
         initMobileMenu();
     </script>
 </body>
-</html> 
+</html> 

src/public/index.html

@@ -1,14 +1,13 @@
 <!DOCTYPE html>
-<html lang="zh">
-
+<html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <meta name="description" content="Github文件加速,docker镜像加速">
-    <meta name="keywords" content="Github,文件加速,ghproxy,docker镜像加速">
+    <meta name="description" content="Github文件加速、docker镜像加速">
+    <meta name="keywords" content="Github、文件加速、ghproxy、docker镜像加速">
     <meta name="color-scheme" content="dark light">
-    <title>Github文件加速</title>
-    <link rel="icon" href="./favicon.ico">
+    <title>Github、Docker加速</title>
+    <link rel="icon" href="/favicon.ico">
     <style>
         :root {
             --background: #ffffff;
@@ -602,17 +601,17 @@
             <div class="hero">
                 <h1 class="hero-title">GitHub 文件加速</h1>
                 <p class="hero-subtitle">
-                    快速下载GitHub上的文件和仓库，解决国内访问GitHub速度慢的问题，支持AI模型库Hugging Face
+                    快速下载GitHub上的文件和仓库，解决国内访问GitHub速度慢的问题，支持Docker镜像加速和Hugging Face仓库。
                 </p>
             </div>
 
             <div class="card">
                 <div class="card-header">
                     <h2 class="card-title">
-                        ⚡ 快速生成加速链接
+                        ⚡ 快速转换加速链接
                     </h2>
                     <p class="card-description">
-                        输入GitHub文件或仓库链接，自动转换加速链接，可以直接在Github域名前面加上本站域名使用。
+                        输入GitHub文件链接，自动转换加速链接，可以直接在Github文件链接前加上本站域名使用。
                     </p>
                 </div>
 
@@ -622,7 +621,7 @@
                             type="text" 
                             class="input" 
                             id="githubLinkInput" 
-                            placeholder="请输入GitHub链接，例如：https://github.com/user/repo/releases/download/..."
+                            placeholder="请输入GitHub文件链接，例如：https://github.com/user/repo/releases/download/..."
                         >
                         <button class="button button-primary" id="formatButton">
                             获取加速链接
@@ -653,12 +652,12 @@
                         🐳 Docker 镜像加速
                     </h3>
                     <p class="card-description">
-                        支持多种Registry，在镜像名前添加本站域名即可加速下载。
+                        支持多种镜像仓库，在镜像名称前添加本站域名即可加速下载。
                     </p>
                 </div>
                 
                 <button class="docker-button" id="dockerButton">
-                    查看 Docker 镜像加速配置
+                    查看 Docker 镜像加速使用说明
                 </button>
             </div>
         </div>
@@ -669,23 +668,23 @@
             <button class="close-button" id="closeModal">&times;</button>
             <div class="modal-header">
                 <h2 class="modal-title">Docker 镜像加速</h2>
-                <p>支持多种Registry，在镜像名前添加本站域名即可加速下载。</p>
+                <p>支持多种镜像仓库，在镜像名称前添加本站域名即可加速下载。</p>
             </div>
             
             <div class="domain-examples">
-                <strong>Docker Hub 官方镜像：</strong>
+                <strong>Docker 官方镜像：</strong>
                 docker pull <span class="domain-base"></span>/nginx
 
-                <strong>Docker Hub 第三方镜像：</strong>
+                <strong>Docker 镜像：</strong>
                 docker pull <span class="domain-base"></span>/user/image
 
-                <strong>GitHub Container Registry：</strong>
+                <strong>ghcr.io 镜像：</strong>
                 docker pull <span class="domain-base"></span>/ghcr.io/user/image
 
-                <strong>Quay.io Registry：</strong>
+                <strong>Quay.io 镜像：</strong>
                 docker pull <span class="domain-base"></span>/quay.io/org/image
 
-                <strong>Kubernetes Registry：</strong>
+                <strong>Kubernetes 镜像：</strong>
                 docker pull <span class="domain-base"></span>/registry.k8s.io/pause:3.8
             </div>
         </div>

src/public/search.html

@@ -1,13 +1,13 @@
 <!DOCTYPE html>
-<html lang="zh">
+<html lang="zh-CN">
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <meta name="description" content="Docker镜像搜索">
-    <meta name="keywords" content="Docker,镜像搜索,docker search">
+    <meta name="keywords" content="Docker、镜像搜索、docker search">
     <meta name="color-scheme" content="dark light">
     <title>Docker镜像搜索</title>
-    <link rel="icon" href="./favicon.ico">
+    <link rel="icon" href="/favicon.ico">
     <style>
         :root {
             --background: #ffffff;
@@ -782,7 +782,6 @@
     </div>
 
     <div id="toast"></div>
-
     <script>
         const formatUtils = {
             formatNumber(num) {
@@ -853,6 +852,10 @@
         let totalPages = 1;
         let currentQuery = '';
         let currentRepo = null;
+        
+        // 标签分页相关变量
+        let currentTagPage = 1;
+        let totalTagPages = 1;
 
         document.getElementById('searchButton').addEventListener('click', () => {
             currentPage = 1;
@@ -884,6 +887,21 @@
             showSearchResults();
         });
 
+        // 使用事件委托处理分页按钮点击（避免DOM重建导致事件丢失）
+        document.addEventListener('click', (e) => {
+            if (e.target.id === 'tagPrevPage') {
+                if (currentTagPage > 1) {
+                    currentTagPage--;
+                    loadTagPage();
+                }
+            } else if (e.target.id === 'tagNextPage') {
+                if (currentTagPage < totalTagPages) {
+                    currentTagPage++;
+                    loadTagPage();
+                }
+            }
+        });
+
         function showLoading() {
             document.querySelector('.loading').style.display = 'block';
         }
@@ -901,71 +919,134 @@
             }, 3000);
         }
 
-        function updatePagination() {
-            const prevButton = document.getElementById('prevPage');
-            const nextButton = document.getElementById('nextPage');
+        // 统一分页更新函数（支持搜索和标签分页）
+        function updatePagination(config = {}) {
+            const {
+                currentPage: page = currentPage,
+                totalPages: total = totalPages,
+                prefix = ''
+            } = config;
+
+            const prevButtonId = prefix ? `${prefix}PrevPage` : 'prevPage';
+            const nextButtonId = prefix ? `${prefix}NextPage` : 'nextPage';
+            const paginationId = prefix ? `${prefix}Pagination` : '.pagination';
+
+            const prevButton = document.getElementById(prevButtonId);
+            const nextButton = document.getElementById(nextButtonId);
+            const paginationDiv = prefix ? document.getElementById(paginationId) : document.querySelector(paginationId);
             
-            prevButton.disabled = currentPage <= 1;
-            nextButton.disabled = currentPage >= totalPages;
+            if (!prevButton || !nextButton || !paginationDiv) {
+                return; // 静默处理，避免控制台警告
+            }
+            
+            // 更新按钮状态
+            prevButton.disabled = page <= 1;
+            nextButton.disabled = page >= total;
+            
+            // 更新或创建页面信息
+            const pageInfoId = prefix ? `${prefix}PageInfo` : 'pageInfo';
+            let pageInfo = document.getElementById(pageInfoId);
             
-            const paginationDiv = document.querySelector('.pagination');
-            let pageInfo = document.getElementById('pageInfo');
             if (!pageInfo) {
-                const container = document.createElement('div');
-                container.id = 'pageInfo';
-                container.style.margin = '0 10px';
-                container.style.display = 'flex';
-                container.style.alignItems = 'center';
-                container.style.gap = '10px';
-                
-                const pageText = document.createElement('span');
-                pageText.id = 'pageText';
-                
-                const jumpInput = document.createElement('input');
-                jumpInput.type = 'number';
-                jumpInput.min = '1';
-                jumpInput.id = 'jumpPage';
-                jumpInput.style.width = '60px';
-                jumpInput.style.padding = '4px';
-                jumpInput.style.borderRadius = '4px';
-                jumpInput.style.border = '1px solid var(--border)';
-                jumpInput.style.backgroundColor = 'var(--input)';
-                jumpInput.style.color = 'var(--foreground)';
-                
-                const jumpButton = document.createElement('button');
-                jumpButton.textContent = '跳转';
-                jumpButton.className = 'btn search-button';
-                jumpButton.style.padding = '4px 8px';
-                jumpButton.onclick = () => {
-                    const page = parseInt(jumpInput.value);
-                    if (page && page >= 1 && page <= totalPages) {
-                        currentPage = page;
-                        performSearch();
-                    } else {
-                        showToast('请输入有效的页码');
-                    }
-                };
-                
-                container.appendChild(pageText);
-                container.appendChild(jumpInput);
-                container.appendChild(jumpButton);
-                
-                paginationDiv.insertBefore(container, nextButton);
-                pageInfo = container;
+                pageInfo = createPageInfo(pageInfoId, prefix, total);
+                paginationDiv.insertBefore(pageInfo, nextButton);
             }
             
-            const pageText = document.getElementById('pageText');
-            pageText.textContent = `第 ${currentPage} / ${totalPages || 1} 页 共 ${totalPages || 1} 页`;
-            
-            const jumpInput = document.getElementById('jumpPage');
-            if (jumpInput) {
-                jumpInput.max = totalPages;
-                jumpInput.value = currentPage;
-            }
-            
-            paginationDiv.style.display = totalPages > 1 ? 'flex' : 'none';
+            updatePageInfo(pageInfo, page, total, prefix);
+            paginationDiv.style.display = total > 1 ? 'flex' : 'none';
         }
 
+        // 创建页面信息元素
+        function createPageInfo(pageInfoId, prefix, total) {
+            const container = document.createElement('div');
+            container.id = pageInfoId;
+            container.style.cssText = 'margin: 0 10px; display: flex; align-items: center; gap: 10px;';
+            
+            const pageText = document.createElement('span');
+            pageText.id = prefix ? `${prefix}PageText` : 'pageText';
+            
+            const jumpInput = document.createElement('input');
+            jumpInput.type = 'number';
+            jumpInput.min = '1';
+            jumpInput.max = prefix === 'tag' ? total : Math.min(total, 100); // 搜索页面限制100页
+            jumpInput.id = prefix ? `${prefix}JumpPage` : 'jumpPage';
+            jumpInput.style.cssText = 'width: 60px; padding: 4px; border-radius: 4px; border: 1px solid var(--border); background-color: var(--input); color: var(--foreground);';
+            
+            const jumpButton = document.createElement('button');
+            jumpButton.textContent = '跳转';
+            jumpButton.className = 'btn search-button';
+            jumpButton.style.padding = '4px 8px';
+            jumpButton.onclick = () => handlePageJump(jumpInput, prefix, total);
+            
+            container.append(pageText, jumpInput, jumpButton);
+            return container;
+        }
+
+        // 更新页面信息显示
+        function updatePageInfo(pageInfo, page, total, prefix) {
+            const pageText = pageInfo.querySelector('span');
+            const jumpInput = pageInfo.querySelector('input');
+            
+            // 标签分页显示策略：根据是否确定总页数显示不同格式
+            const isTagPagination = prefix === 'tag';
+            const maxDisplayPages = isTagPagination ? total : Math.min(total, 100);
+            const pageTextContent = isTagPagination 
+                ? `第 ${page} 页` + (total > page ? ` (至少 ${total} 页)` : ` (共 ${total} 页)`)
+                : `第 ${page} / ${maxDisplayPages} 页 共 ${maxDisplayPages} 页` + (total > 100 ? ' (最多100页)' : '');
+            
+            pageText.textContent = pageTextContent;
+            jumpInput.max = maxDisplayPages;
+            jumpInput.value = page;
+        }
+
+        // 处理页面跳转
+        function handlePageJump(jumpInput, prefix, total) {
+            const inputPage = parseInt(jumpInput.value);
+            const maxPage = prefix === 'tag' ? total : Math.min(total, 100);
+            if (!inputPage || inputPage < 1 || inputPage > maxPage) {
+                const limitText = prefix === 'tag' ? '页码' : '页码 (最多100页)';
+                showToast(`请输入有效的${limitText}`);
+                return;
+            }
+            
+            if (prefix === 'tag') {
+                currentTagPage = inputPage;
+                loadTagPage();
+            } else {
+                currentPage = inputPage;
+                performSearch();
+            }
+        }
+
+        // 统一仓库信息处理
+        function parseRepositoryInfo(repo) {
+            const namespace = repo.namespace || (repo.is_official ? 'library' : '');
+            let name = repo.name || repo.repo_name || '';
+            
+            // 清理名称，确保不包含命名空间前缀
+            if (name.includes('/')) {
+                const parts = name.split('/');
+                name = parts[parts.length - 1];
+            }
+            
+            const cleanName = name.replace(/^library\//, '');
+            const fullRepoName = repo.is_official ? cleanName : `${namespace}/${cleanName}`;
+            
+            return {
+                namespace,
+                name,
+                cleanName,
+                fullRepoName
+            };
+        }
+
+        // 分页更新函数
+        const updateTagPagination = () => updatePagination({
+            currentPage: currentTagPage,
+            totalPages: totalTagPages,
+            prefix: 'tag'
+        });
+
         function showSearchResults() {
             document.querySelector('.search-results').style.display = 'block';
             document.querySelector('.tag-list').style.display = 'none';
@@ -1006,7 +1087,7 @@
                     throw new Error(data.error || '搜索请求失败');
                 }
                 
-                totalPages = Math.ceil(data.count / 25);
+                totalPages = Math.min(Math.ceil(data.count / 25), 100);
                 updatePagination();
                 
                 displayResults(data.results, targetRepo);
@@ -1108,23 +1189,55 @@
             });
         }
 
+        // 内存管理
+        
         async function loadTags(namespace, name) {
+            currentTagPage = 1;
+            await loadTagPage(namespace, name);
+        }
+
+        async function loadTagPage(namespace = null, name = null) {
             showLoading();
             try {
-                if (!namespace || !name) {
+                // 如果传入了新的namespace和name，更新currentRepo
+                if (namespace && name) {
+                    // 清理旧数据，防止内存泄露
+                    cleanupOldTagData();
+                }
+
+                // 获取当前仓库信息
+                const repoInfo = parseRepositoryInfo(currentRepo);
+                const currentNamespace = namespace || repoInfo.namespace;
+                const currentName = name || repoInfo.name;
+                
+                if (!currentNamespace || !currentName) {
                     showToast('命名空间和镜像名称不能为空');
                     return;
                 }
 
-                const response = await fetch(`/tags/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`);
+                const response = await fetch(`/tags/${encodeURIComponent(currentNamespace)}/${encodeURIComponent(currentName)}?page=${currentTagPage}&page_size=100`);
                 if (!response.ok) {
                     const errorText = await response.text();
                     throw new Error(errorText || '获取标签信息失败');
                 }
 
                 const data = await response.json();
-                displayTags(data);
-                showTagList();
+                
+                // 改进的总页数计算：使用更准确的分页策略
+                if (data.has_more) {
+                    // 如果还有更多页面，至少有当前页+1页，但可能更多
+                    totalTagPages = Math.max(currentTagPage + 1, totalTagPages);
+                } else {
+                    // 如果没有更多页面，当前页就是最后一页
+                    totalTagPages = currentTagPage;
+                }
+                
+                displayTags(data.tags, data.has_more);
+                updateTagPagination();
+                
+                if (namespace && name) {
+                    showTagList();
+                }
             } catch (error) {
                 console.error('加载标签错误:', error);
                 showToast(error.message || '获取标签信息失败，请稍后重试');
@@ -1133,12 +1246,24 @@
             }
         }
 
-        function displayTags(tags) {
+        function cleanupOldTagData() {
+            // 清理全局变量，释放内存
+            if (window.currentPageTags) {
+                window.currentPageTags.length = 0;
+                window.currentPageTags = null;
+            }
+            
+            // 清理DOM缓存
+            const tagsContainer = document.getElementById('tagsContainer');
+            if (tagsContainer) {
+                tagsContainer.innerHTML = '';
+            }
+        }
+
+        function displayTags(tags, hasMore = false) {
             const tagList = document.getElementById('tagList');
-            const namespace = currentRepo.namespace || (currentRepo.is_official ? 'library' : '');
-            const name = currentRepo.name || currentRepo.repo_name || '';
-            const cleanName = name.replace(/^library\//, '');
-            const fullRepoName = currentRepo.is_official ? cleanName : `${namespace}/${cleanName}`;
+            const repoInfo = parseRepositoryInfo(currentRepo);
+            const { fullRepoName } = repoInfo;
             
             let header = `
                 <div class="tag-header">
@@ -1165,22 +1290,60 @@
                     <button class="tag-search-clear" onclick="clearTagSearch()">×</button>
                 </div>
                 <div id="tagsContainer"></div>
+                <div class="pagination" id="tagPagination" style="display: none;">
+                    <button id="tagPrevPage" disabled>上一页</button>
+                    <button id="tagNextPage" disabled>下一页</button>
+                </div>
             `;
 
             tagList.innerHTML = header;
             
-            window.allTags = tags;
+            // 存储当前页标签数据
+            window.currentPageTags = tags;
             renderFilteredTags(tags);
         }
 
         function renderFilteredTags(filteredTags) {
             const tagsContainer = document.getElementById('tagsContainer');
-            const namespace = currentRepo.namespace || (currentRepo.is_official ? 'library' : '');
-            const name = currentRepo.name || currentRepo.repo_name || '';
-            const cleanName = name.replace(/^library\//, '');
-            const fullRepoName = currentRepo.is_official ? cleanName : `${namespace}/${cleanName}`;
+            const repoInfo = parseRepositoryInfo(currentRepo);
+            const { fullRepoName } = repoInfo;
 
-            let tagsHtml = filteredTags.map(tag => {
+            if (filteredTags.length === 0) {
+                tagsContainer.innerHTML = '<div class="text-center" style="padding: 20px;">未找到匹配的标签</div>';
+                return;
+            }
+
+            // 渐进式渲染：分批处理大数据集
+            const BATCH_SIZE = 50;
+            
+            if (filteredTags.length <= BATCH_SIZE) {
+                // 小数据集：直接渲染
+                renderTagsBatch(filteredTags, fullRepoName, tagsContainer, true);
+            } else {
+                // 大数据集：分批渲染
+                tagsContainer.innerHTML = ''; // 清空容器
+                let currentBatch = 0;
+                
+                function renderNextBatch() {
+                    const start = currentBatch * BATCH_SIZE;
+                    const end = Math.min(start + BATCH_SIZE, filteredTags.length);
+                    const batch = filteredTags.slice(start, end);
+                    
+                    renderTagsBatch(batch, fullRepoName, tagsContainer, false);
+                    
+                    currentBatch++;
+                    if (end < filteredTags.length) {
+                        // 使用requestAnimationFrame确保UI响应性
+                        requestAnimationFrame(renderNextBatch);
+                    }
+                }
+                
+                renderNextBatch();
+            }
+        }
+
+        function renderTagsBatch(tags, fullRepoName, container, replaceContent = false) {
+            const tagsHtml = tags.map(tag => {
                 const vulnIndicators = Object.entries(tag.vulnerabilities || {})
                     .map(([level, count]) => count > 0 ? `<span class="vulnerability-dot vulnerability-${level.toLowerCase()}" title="${level}: ${count}"></span>` : '')
                     .join('');
@@ -1212,23 +1375,23 @@
                 `;
             }).join('');
 
-            if (filteredTags.length === 0) {
-                tagsHtml = '<div class="text-center" style="padding: 20px;">未找到匹配的标签</div>';
+            if (replaceContent) {
+                container.innerHTML = tagsHtml;
+            } else {
+                container.insertAdjacentHTML('beforeend', tagsHtml);
             }
-
-            tagsContainer.innerHTML = tagsHtml;
         }
 
         function filterTags(searchText) {
-            if (!window.allTags) return;
+            if (!window.currentPageTags) return;
 
             const searchLower = searchText.toLowerCase();
             let filteredTags;
 
             if (!searchText) {
-                filteredTags = window.allTags;
+                filteredTags = window.currentPageTags;
             } else {
-                const scoredTags = window.allTags.map(tag => {
+                const scoredTags = window.currentPageTags.map(tag => {
                     const name = tag.name.toLowerCase();
                     let score = 0;
 
@@ -1263,6 +1426,8 @@
             }
         }
 
+
+
         function copyToClipboard(text) {
             navigator.clipboard.writeText(text).then(() => {
                 showToast('已复制到剪贴板');
@@ -1313,4 +1478,4 @@
     </script>
     </main>
 </body>
-</html> 
+</html> 

src/ratelimiter.go

@@ -1,299 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"net"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"golang.org/x/time/rate"
-)
-
-const (
-	// 清理间隔
-	CleanupInterval = 10 * time.Minute
-	MaxIPCacheSize = 10000
-)
-
-// IPRateLimiter IP限流器结构体
-type IPRateLimiter struct {
-	ips       map[string]*rateLimiterEntry // IP到限流器的映射
-	mu        *sync.RWMutex                // 读写锁，保证并发安全
-	r         rate.Limit                   // 速率限制（每秒允许的请求数）
-	b         int                          // 令牌桶容量（突发请求数）
-	whitelist []*net.IPNet                 // 白名单IP段
-	blacklist []*net.IPNet                 // 黑名单IP段
-}
-
-// rateLimiterEntry 限流器条目
-type rateLimiterEntry struct {
-	limiter    *rate.Limiter
-	lastAccess time.Time
-}
-
-// initGlobalLimiter 初始化全局限流器
-func initGlobalLimiter() *IPRateLimiter {
-	cfg := GetConfig()
-	
-	whitelist := make([]*net.IPNet, 0, len(cfg.Security.WhiteList))
-	for _, item := range cfg.Security.WhiteList {
-		if item = strings.TrimSpace(item); item != "" {
-			if !strings.Contains(item, "/") {
-				item = item + "/32" // 单个IP转为CIDR格式
-			}
-			_, ipnet, err := net.ParseCIDR(item)
-			if err == nil {
-				whitelist = append(whitelist, ipnet)
-			} else {
-				fmt.Printf("警告: 无效的白名单IP格式: %s\n", item)
-			}
-		}
-	}
-	
-	// 解析黑名单IP段
-	blacklist := make([]*net.IPNet, 0, len(cfg.Security.BlackList))
-	for _, item := range cfg.Security.BlackList {
-		if item = strings.TrimSpace(item); item != "" {
-			if !strings.Contains(item, "/") {
-				item = item + "/32" // 单个IP转为CIDR格式
-			}
-			_, ipnet, err := net.ParseCIDR(item)
-			if err == nil {
-				blacklist = append(blacklist, ipnet)
-			} else {
-				fmt.Printf("警告: 无效的黑名单IP格式: %s\n", item)
-			}
-		}
-	}
-	
-	// 计算速率：将 "每N小时X个请求" 转换为 "每秒Y个请求"
-	ratePerSecond := rate.Limit(float64(cfg.RateLimit.RequestLimit) / (cfg.RateLimit.PeriodHours * 3600))
-	
-	burstSize := cfg.RateLimit.RequestLimit
-	if burstSize < 1 {
-		burstSize = 1
-	}
-	
-	limiter := &IPRateLimiter{
-		ips:       make(map[string]*rateLimiterEntry),
-		mu:        &sync.RWMutex{},
-		r:         ratePerSecond,
-		b:         burstSize,
-		whitelist: whitelist,
-		blacklist: blacklist,
-	}
-	
-	// 启动定期清理goroutine
-	go limiter.cleanupRoutine()
-	
-	return limiter
-}
-
-// initLimiter 初始化限流器
-func initLimiter() {
-	globalLimiter = initGlobalLimiter()
-}
-
-// cleanupRoutine 定期清理过期的限流器
-func (i *IPRateLimiter) cleanupRoutine() {
-	ticker := time.NewTicker(CleanupInterval)
-	defer ticker.Stop()
-	
-	for range ticker.C {
-		now := time.Now()
-		expired := make([]string, 0)
-		
-		// 查找过期的条目
-		i.mu.RLock()
-		for ip, entry := range i.ips {
-			// 如果最后访问时间超过1小时，认为过期
-			if now.Sub(entry.lastAccess) > 1*time.Hour {
-				expired = append(expired, ip)
-			}
-		}
-		i.mu.RUnlock()
-		
-		// 如果有过期条目或者缓存过大，进行清理
-		if len(expired) > 0 || len(i.ips) > MaxIPCacheSize {
-			i.mu.Lock()
-			// 删除过期条目
-			for _, ip := range expired {
-				delete(i.ips, ip)
-			}
-			
-			// 如果缓存仍然过大，全部清理
-			if len(i.ips) > MaxIPCacheSize {
-				i.ips = make(map[string]*rateLimiterEntry)
-			}
-			i.mu.Unlock()
-		}
-	}
-}
-
-// extractIPFromAddress 从地址中提取纯IP，去除端口号
-func extractIPFromAddress(address string) string {
-	// 处理IPv6地址 [::1]:8080 格式
-	if strings.HasPrefix(address, "[") {
-		if endIndex := strings.Index(address, "]"); endIndex != -1 {
-			return address[1:endIndex]
-		}
-	}
-	
-	// 处理IPv4地址 192.168.1.1:8080 格式
-	if lastColon := strings.LastIndex(address, ":"); lastColon != -1 {
-		return address[:lastColon]
-	}
-	
-	return address
-}
-
-// isIPInCIDRList 检查IP是否在CIDR列表中
-func isIPInCIDRList(ip string, cidrList []*net.IPNet) bool {
-	// 先提取纯IP地址
-	cleanIP := extractIPFromAddress(ip)
-	parsedIP := net.ParseIP(cleanIP)
-	if parsedIP == nil {
-		return false
-	}
-	
-	for _, cidr := range cidrList {
-		if cidr.Contains(parsedIP) {
-			return true
-		}
-	}
-	return false
-}
-
-// GetLimiter 获取指定IP的限流器，同时返回是否允许访问
-func (i *IPRateLimiter) GetLimiter(ip string) (*rate.Limiter, bool) {
-	// 提取纯IP地址
-	cleanIP := extractIPFromAddress(ip)
-	
-	// 检查是否在黑名单中
-	if isIPInCIDRList(cleanIP, i.blacklist) {
-		return nil, false
-	}
-	
-	// 检查是否在白名单中
-	if isIPInCIDRList(cleanIP, i.whitelist) {
-		return rate.NewLimiter(rate.Inf, i.b), true
-	}
-	
-	now := time.Now()
-	
-	i.mu.RLock()
-	entry, exists := i.ips[cleanIP]
-	i.mu.RUnlock()
-	
-	if exists {
-		i.mu.Lock()
-		if entry, stillExists := i.ips[cleanIP]; stillExists {
-			entry.lastAccess = now
-			i.mu.Unlock()
-			return entry.limiter, true
-		}
-		i.mu.Unlock()
-	}
-	
-	i.mu.Lock()
-	if entry, exists := i.ips[cleanIP]; exists {
-		entry.lastAccess = now
-		i.mu.Unlock()
-		return entry.limiter, true
-	}
-	
-	entry = &rateLimiterEntry{
-		limiter:    rate.NewLimiter(i.r, i.b),
-		lastAccess: now,
-	}
-	i.ips[cleanIP] = entry
-	i.mu.Unlock()
-	
-	return entry.limiter, true
-}
-
-// RateLimitMiddleware 速率限制中间件
-func RateLimitMiddleware(limiter *IPRateLimiter) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		// 获取客户端真实IP
-		var ip string
-		
-		// 优先尝试从请求头获取真实IP
-		if forwarded := c.GetHeader("X-Forwarded-For"); forwarded != "" {
-			// X-Forwarded-For可能包含多个IP，取第一个
-			ips := strings.Split(forwarded, ",")
-			ip = strings.TrimSpace(ips[0])
-		} else if realIP := c.GetHeader("X-Real-IP"); realIP != "" {
-			// 如果有X-Real-IP头
-			ip = realIP
-		} else if remoteIP := c.GetHeader("X-Original-Forwarded-For"); remoteIP != "" {
-			// 某些代理可能使用此头
-			ips := strings.Split(remoteIP, ",")
-			ip = strings.TrimSpace(ips[0])
-		} else {
-			// 回退到ClientIP方法
-			ip = c.ClientIP()
-		}
-		
-		// 提取纯IP地址（去除端口号）
-		cleanIP := extractIPFromAddress(ip)
-		
-		// 日志记录请求IP和头信息
-		fmt.Printf("请求IP: %s (去除端口后: %s), X-Forwarded-For: %s, X-Real-IP: %s\n", 
-			ip, 
-			cleanIP,
-			c.GetHeader("X-Forwarded-For"), 
-			c.GetHeader("X-Real-IP"))
-		
-		// 获取限流器并检查是否允许访问
-		ipLimiter, allowed := limiter.GetLimiter(cleanIP)
-		
-		// 如果IP在黑名单中
-		if !allowed {
-			c.JSON(403, gin.H{
-				"error": "您已被限制访问",
-			})
-			c.Abort()
-			return
-		}
-		
-		// 智能限流判断：检查是否应该跳过限流计数
-		shouldSkip := smartLimiter.ShouldSkipRateLimit(cleanIP, c.Request.URL.Path)
-		
-		// 只有在不跳过的情况下才检查限流
-		if !shouldSkip && !ipLimiter.Allow() {
-			c.JSON(429, gin.H{
-				"error": "请求频率过快，暂时限制访问",
-			})
-			c.Abort()
-			return
-		}
-		
-		c.Next()
-	}
-}
-
-// ApplyRateLimit 应用限流到特定路由
-func ApplyRateLimit(router *gin.Engine, path string, method string, handler gin.HandlerFunc) {
-	// 使用全局限流器
-	limiter := globalLimiter
-	if limiter == nil {
-		limiter = initGlobalLimiter()
-	}
-	
-	// 根据HTTP方法应用限流
-	switch method {
-	case "GET":
-		router.GET(path, RateLimitMiddleware(limiter), handler)
-	case "POST":
-		router.POST(path, RateLimitMiddleware(limiter), handler)
-	case "PUT":
-		router.PUT(path, RateLimitMiddleware(limiter), handler)
-	case "DELETE":
-		router.DELETE(path, RateLimitMiddleware(limiter), handler)
-	default:
-		router.Any(path, RateLimitMiddleware(limiter), handler)
-	}
-}

src/search.go

@@ -1,500 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/gin-gonic/gin"
-)
-
-// SearchResult Docker Hub搜索结果
-type SearchResult struct {
-	Count    int          `json:"count"`
-	Next     string       `json:"next"`
-	Previous string       `json:"previous"`
-	Results  []Repository `json:"results"`
-}
-
-// Repository 仓库信息
-type Repository struct {
-	Name           string    `json:"repo_name"`
-	Description    string    `json:"short_description"`
-	IsOfficial     bool      `json:"is_official"`
-	IsAutomated    bool      `json:"is_automated"`
-	StarCount      int       `json:"star_count"`
-	PullCount      int       `json:"pull_count"`
-	RepoOwner      string    `json:"repo_owner"`
-	LastUpdated    string    `json:"last_updated"`
-	Status         int       `json:"status"`
-	Organization   string    `json:"affiliation"`
-	PullsLastWeek  int       `json:"pulls_last_week"`
-	Namespace      string    `json:"namespace"`
-}
-
-// TagInfo 标签信息
-type TagInfo struct {
-	Name          string    `json:"name"`
-	FullSize      int64     `json:"full_size"`
-	LastUpdated   time.Time `json:"last_updated"`
-	LastPusher    string    `json:"last_pusher"`
-	Images        []Image   `json:"images"`
-	Vulnerabilities struct {
-		Critical int `json:"critical"`
-		High     int `json:"high"`
-		Medium   int `json:"medium"`
-		Low      int `json:"low"`
-		Unknown  int `json:"unknown"`
-	} `json:"vulnerabilities"`
-}
-
-// Image 镜像信息
-type Image struct {
-	Architecture string `json:"architecture"`
-	Features     string `json:"features"`
-	Variant      string `json:"variant,omitempty"`
-	Digest       string `json:"digest"`
-	OS           string `json:"os"`
-	OSFeatures   string `json:"os_features"`
-	Size         int64  `json:"size"`
-}
-
-type cacheEntry struct {
-	data      interface{}
-	timestamp time.Time
-}
-
-const (
-	maxCacheSize = 1000 // 最大缓存条目数
-	cacheTTL     = 30 * time.Minute
-)
-
-type Cache struct {
-	data     map[string]cacheEntry
-	mu       sync.RWMutex
-	maxSize  int
-}
-
-var (
-	searchCache = &Cache{
-		data:    make(map[string]cacheEntry),
-		maxSize: maxCacheSize,
-	}
-)
-
-func (c *Cache) Get(key string) (interface{}, bool) {
-	c.mu.RLock()
-	entry, exists := c.data[key]
-	c.mu.RUnlock()
-	
-	if !exists {
-		return nil, false
-	}
-	
-	if time.Since(entry.timestamp) > cacheTTL {
-		c.mu.Lock()
-		delete(c.data, key)
-		c.mu.Unlock()
-		return nil, false
-	}
-	
-	return entry.data, true
-}
-
-func (c *Cache) Set(key string, data interface{}) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	
-	now := time.Now()
-	for k, v := range c.data {
-		if now.Sub(v.timestamp) > cacheTTL {
-			delete(c.data, k)
-		}
-	}
-	
-	if len(c.data) >= c.maxSize {
-		toDelete := len(c.data) / 4
-		for k := range c.data {
-			if toDelete <= 0 {
-				break
-			}
-			delete(c.data, k)
-			toDelete--
-		}
-	}
-	
-	c.data[key] = cacheEntry{
-		data:      data,
-		timestamp: now,
-	}
-}
-
-func (c *Cache) Cleanup() {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	
-	now := time.Now()
-	for key, entry := range c.data {
-		if now.Sub(entry.timestamp) > cacheTTL {
-			delete(c.data, key)
-		}
-	}
-}
-
-// 定期清理过期缓存
-func init() {
-	go func() {
-		ticker := time.NewTicker(5 * time.Minute)
-		for range ticker.C {
-			searchCache.Cleanup()
-		}
-	}()
-}
-
-func filterSearchResults(results []Repository, query string) []Repository {
-	searchTerm := strings.ToLower(strings.TrimPrefix(query, "library/"))
-	filtered := make([]Repository, 0)
-	
-	for _, repo := range results {
-		// 标准化仓库名称
-		repoName := strings.ToLower(repo.Name)
-		repoDesc := strings.ToLower(repo.Description)
-		
-		// 计算相关性得分
-		score := 0
-		
-		// 完全匹配
-		if repoName == searchTerm {
-			score += 100
-		}
-		
-		// 前缀匹配
-		if strings.HasPrefix(repoName, searchTerm) {
-			score += 50
-		}
-		
-		// 包含匹配
-		if strings.Contains(repoName, searchTerm) {
-			score += 30
-		}
-		
-		// 描述匹配
-		if strings.Contains(repoDesc, searchTerm) {
-			score += 10
-		}
-		
-		// 官方镜像加分
-		if repo.IsOfficial {
-			score += 20
-		}
-		
-		// 分数达到阈值的结果才保留
-		if score > 0 {
-			filtered = append(filtered, repo)
-		}
-	}
-	
-	// 按相关性排序
-	sort.Slice(filtered, func(i, j int) bool {
-		// 优先考虑官方镜像
-		if filtered[i].IsOfficial != filtered[j].IsOfficial {
-			return filtered[i].IsOfficial
-		}
-		// 其次考虑拉取次数
-		return filtered[i].PullCount > filtered[j].PullCount
-	})
-	
-	return filtered
-}
-
-// searchDockerHub 搜索镜像
-func searchDockerHub(ctx context.Context, query string, page, pageSize int) (*SearchResult, error) {
-	cacheKey := fmt.Sprintf("search:%s:%d:%d", query, page, pageSize)
-	
-	// 尝试从缓存获取
-	if cached, ok := searchCache.Get(cacheKey); ok {
-		return cached.(*SearchResult), nil
-	}
-	
-	// 判断是否是用户/仓库格式的搜索
-	isUserRepo := strings.Contains(query, "/")
-	var namespace, repoName string
-	
-	if isUserRepo {
-		parts := strings.Split(query, "/")
-		if len(parts) == 2 {
-			namespace = parts[0]
-			repoName = parts[1]
-		}
-	}
-	
-	// 构建搜索URL
-	baseURL := "https://registry.hub.docker.com/v2"
-	var fullURL string
-	var params url.Values
-	
-	if isUserRepo && namespace != "" {
-		// 如果是用户/仓库格式，使用repositories接口
-		fullURL = fmt.Sprintf("%s/repositories/%s/", baseURL, namespace)
-		params = url.Values{
-			"page":      {fmt.Sprintf("%d", page)},
-			"page_size": {fmt.Sprintf("%d", pageSize)},
-		}
-	} else {
-		// 普通搜索
-		fullURL = baseURL + "/search/repositories/"
-		params = url.Values{
-			"query":     {query},
-			"page":      {fmt.Sprintf("%d", page)},
-			"page_size": {fmt.Sprintf("%d", pageSize)},
-		}
-	}
-	
-	fullURL = fullURL + "?" + params.Encode()
-	
-	// 使用统一的搜索HTTP客户端
-	resp, err := GetSearchHTTPClient().Get(fullURL)
-	if err != nil {
-		return nil, fmt.Errorf("请求Docker Hub API失败: %v", err)
-	}
-	defer func() {
-		if err := resp.Body.Close(); err != nil {
-			fmt.Printf("关闭搜索响应体失败: %v\n", err)
-		}
-	}()
-	
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("读取响应失败: %v", err)
-	}
-	
-	if resp.StatusCode != http.StatusOK {
-		switch resp.StatusCode {
-		case http.StatusTooManyRequests:
-			return nil, fmt.Errorf("请求过于频繁，请稍后重试")
-		case http.StatusNotFound:
-			if isUserRepo && namespace != "" {
-				// 如果用户仓库搜索失败，尝试普通搜索
-				return searchDockerHub(ctx, repoName, page, pageSize)
-			}
-			return nil, fmt.Errorf("未找到相关镜像")
-		case http.StatusBadGateway, http.StatusServiceUnavailable:
-			return nil, fmt.Errorf("Docker Hub服务暂时不可用，请稍后重试")
-		default:
-			return nil, fmt.Errorf("请求失败: 状态码=%d, 响应=%s", resp.StatusCode, string(body))
-		}
-	}
-	
-	// 解析响应
-	var result *SearchResult
-	if isUserRepo && namespace != "" {
-		// 解析用户仓库列表响应
-		var userRepos struct {
-			Count    int          `json:"count"`
-			Next     string       `json:"next"`
-			Previous string       `json:"previous"`
-			Results  []Repository `json:"results"`
-		}
-		if err := json.Unmarshal(body, &userRepos); err != nil {
-			return nil, fmt.Errorf("解析响应失败: %v", err)
-		}
-		
-		// 转换为SearchResult格式
-		result = &SearchResult{
-			Count:    userRepos.Count,
-			Next:     userRepos.Next,
-			Previous: userRepos.Previous,
-			Results:  make([]Repository, 0),
-		}
-		
-		// 处理结果
-		for _, repo := range userRepos.Results {
-			// 如果指定了仓库名，只保留匹配的结果
-			if repoName == "" || strings.Contains(strings.ToLower(repo.Name), strings.ToLower(repoName)) {
-				// 确保设置正确的命名空间和名称
-				repo.Namespace = namespace
-				if !strings.Contains(repo.Name, "/") {
-					repo.Name = fmt.Sprintf("%s/%s", namespace, repo.Name)
-				}
-				result.Results = append(result.Results, repo)
-			}
-		}
-		
-		// 如果没有找到结果，尝试普通搜索
-		if len(result.Results) == 0 {
-			return searchDockerHub(ctx, repoName, page, pageSize)
-		}
-		
-		result.Count = len(result.Results)
-	} else {
-		// 解析普通搜索响应
-		result = &SearchResult{}
-		if err := json.Unmarshal(body, &result); err != nil {
-			return nil, fmt.Errorf("解析响应失败: %v", err)
-		}
-		
-		// 处理搜索结果
-		for i := range result.Results {
-			if result.Results[i].IsOfficial {
-				if !strings.Contains(result.Results[i].Name, "/") {
-					result.Results[i].Name = "library/" + result.Results[i].Name
-				}
-				result.Results[i].Namespace = "library"
-			} else {
-				parts := strings.Split(result.Results[i].Name, "/")
-				if len(parts) > 1 {
-					result.Results[i].Namespace = parts[0]
-					result.Results[i].Name = parts[1]
-				} else if result.Results[i].RepoOwner != "" {
-					result.Results[i].Namespace = result.Results[i].RepoOwner
-					result.Results[i].Name = fmt.Sprintf("%s/%s", result.Results[i].RepoOwner, result.Results[i].Name)
-				}
-			}
-		}
-		
-		// 如果是用户/仓库搜索，过滤结果
-		if isUserRepo && namespace != "" {
-			filteredResults := make([]Repository, 0)
-			for _, repo := range result.Results {
-				if strings.EqualFold(repo.Namespace, namespace) {
-					filteredResults = append(filteredResults, repo)
-				}
-			}
-			result.Results = filteredResults
-			result.Count = len(filteredResults)
-		}
-	}
-	
-	// 缓存结果
-	searchCache.Set(cacheKey, result)
-	return result, nil
-}
-
-// 判断错误是否可重试
-func isRetryableError(err error) bool {
-	if err == nil {
-		return false
-	}
-	
-	// 网络错误、超时等可以重试
-	if strings.Contains(err.Error(), "timeout") ||
-	   strings.Contains(err.Error(), "connection refused") ||
-	   strings.Contains(err.Error(), "no such host") ||
-	   strings.Contains(err.Error(), "too many requests") {
-		return true
-	}
-	
-	return false
-}
-
-// getRepositoryTags 获取仓库标签信息
-func getRepositoryTags(ctx context.Context, namespace, name string) ([]TagInfo, error) {
-	if namespace == "" || name == "" {
-		return nil, fmt.Errorf("无效输入：命名空间和名称不能为空")
-	}
-
-	cacheKey := fmt.Sprintf("tags:%s:%s", namespace, name)
-	if cached, ok := searchCache.Get(cacheKey); ok {
-		return cached.([]TagInfo), nil
-	}
-
-	// 构建API URL
-	baseURL := fmt.Sprintf("https://registry.hub.docker.com/v2/repositories/%s/%s/tags", namespace, name)
-	params := url.Values{}
-	params.Set("page_size", "100")
-	params.Set("ordering", "last_updated")
-
-	fullURL := baseURL + "?" + params.Encode()
-
-	// 使用统一的搜索HTTP客户端
-	resp, err := GetSearchHTTPClient().Get(fullURL)
-	if err != nil {
-		return nil, fmt.Errorf("发送请求失败: %v", err)
-	}
-	defer func() {
-		if err := resp.Body.Close(); err != nil {
-			fmt.Printf("关闭搜索响应体失败: %v\n", err)
-		}
-	}()
-
-	// 读取响应体
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("读取响应失败: %v", err)
-	}
-
-	// 检查响应状态码
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("请求失败: 状态码=%d, 响应=%s", resp.StatusCode, string(body))
-	}
-
-	// 解析响应
-	var result struct {
-		Count    int       `json:"count"`
-		Next     string    `json:"next"`
-		Previous string    `json:"previous"`
-		Results  []TagInfo `json:"results"`
-	}
-	if err := json.Unmarshal(body, &result); err != nil {
-		return nil, fmt.Errorf("解析响应失败: %v", err)
-	}
-
-	// 缓存结果
-	searchCache.Set(cacheKey, result.Results)
-	return result.Results, nil
-}
-
-// RegisterSearchRoute 注册搜索相关路由
-func RegisterSearchRoute(r *gin.Engine) {
-	// 搜索镜像
-	r.GET("/search", func(c *gin.Context) {
-		query := c.Query("q")
-		if query == "" {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "搜索关键词不能为空"})
-			return
-		}
-
-		page := 1
-		pageSize := 25
-		if p := c.Query("page"); p != "" {
-			fmt.Sscanf(p, "%d", &page)
-		}
-		if ps := c.Query("page_size"); ps != "" {
-			fmt.Sscanf(ps, "%d", &pageSize)
-		}
-
-		result, err := searchDockerHub(c.Request.Context(), query, page, pageSize)
-		if err != nil {
-			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-			return
-		}
-
-		c.JSON(http.StatusOK, result)
-	})
-
-	// 获取标签信息
-	r.GET("/tags/:namespace/:name", func(c *gin.Context) {
-		namespace := c.Param("namespace")
-		name := c.Param("name")
-
-		if namespace == "" || name == "" {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "命名空间和名称不能为空"})
-			return
-		}
-
-		tags, err := getRepositoryTags(c.Request.Context(), namespace, name)
-		if err != nil {
-			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-			return
-		}
-
-		c.JSON(http.StatusOK, tags)
-	})
-}

src/smart_ratelimit.go

@@ -1,108 +0,0 @@
-package main
-
-import (
-	"strings"
-	"sync"
-	"time"
-)
-
-// SmartRateLimit 智能限流会话管理
-type SmartRateLimit struct {
-	sessions sync.Map
-}
-
-// PullSession Docker拉取会话
-type PullSession struct {
-	LastManifestTime time.Time
-	RequestCount     int
-}
-
-// 全局智能限流实例
-var smartLimiter = &SmartRateLimit{}
-
-const (
-	// manifest请求后的活跃窗口时间
-	activeWindowDuration = 3 * time.Minute
-	// 活跃窗口内最大免费blob请求数(防止滥用)
-	maxFreeBlobRequests = 100
-	sessionCleanupInterval = 10 * time.Minute
-	sessionExpireTime = 30 * time.Minute
-)
-
-func init() {
-	go smartLimiter.cleanupSessions()
-}
-
-// ShouldSkipRateLimit 判断是否应该跳过限流计数
-func (s *SmartRateLimit) ShouldSkipRateLimit(ip, path string) bool {
-	requestType, _ := parseRequestInfo(path)
-	
-	if requestType != "manifests" && requestType != "blobs" {
-		return false
-	}
-	
-	sessionKey := ip
-	sessionInterface, _ := s.sessions.LoadOrStore(sessionKey, &PullSession{})
-	session := sessionInterface.(*PullSession)
-	
-	now := time.Now()
-	
-	if requestType == "manifests" {
-		session.LastManifestTime = now
-		session.RequestCount = 0
-		return false
-	}
-	
-	if requestType == "blobs" {
-		if !session.LastManifestTime.IsZero() && 
-		   now.Sub(session.LastManifestTime) <= activeWindowDuration {
-			
-			session.RequestCount++
-			if session.RequestCount <= maxFreeBlobRequests {
-				return true
-			}
-		}
-	}
-	
-	return false
-}
-
-func parseRequestInfo(path string) (requestType, imageRef string) {
-	path = strings.TrimPrefix(path, "/v2/")
-	
-	if idx := strings.Index(path, "/manifests/"); idx != -1 {
-		return "manifests", path[:idx]
-	}
-	if idx := strings.Index(path, "/blobs/"); idx != -1 {
-		return "blobs", path[:idx]
-	}
-	if idx := strings.Index(path, "/tags/"); idx != -1 {
-		return "tags", path[:idx]
-	}
-	
-	return "unknown", ""
-}
-
-// cleanupSessions 定期清理过期会话，防止内存泄露
-func (s *SmartRateLimit) cleanupSessions() {
-	ticker := time.NewTicker(sessionCleanupInterval)
-	defer ticker.Stop()
-	
-	for range ticker.C {
-		now := time.Now()
-		expiredKeys := make([]string, 0)
-		
-		s.sessions.Range(func(key, value interface{}) bool {
-			session := value.(*PullSession)
-			if !session.LastManifestTime.IsZero() && 
-			   now.Sub(session.LastManifestTime) > sessionExpireTime {
-				expiredKeys = append(expiredKeys, key.(string))
-			}
-			return true
-		})
-		
-		for _, key := range expiredKeys {
-			s.sessions.Delete(key)
-		}
-	}
-} 

src/utils/access_control.go

@@ -1,220 +1,210 @@
-package main
-
-import (
-	"strings"
-	"sync"
-)
-
-// ResourceType 资源类型
-type ResourceType string
-
-const (
-	ResourceTypeGitHub ResourceType = "github"
-	ResourceTypeDocker ResourceType = "docker"
-)
-
-// AccessController 统一访问控制器
-type AccessController struct {
-	mu sync.RWMutex
-}
-
-// DockerImageInfo Docker镜像信息
-type DockerImageInfo struct {
-	Namespace  string
-	Repository string
-	Tag        string
-	FullName   string
-}
-
-// 全局访问控制器实例
-var GlobalAccessController = &AccessController{}
-
-// ParseDockerImage 解析Docker镜像名称
-func (ac *AccessController) ParseDockerImage(image string) DockerImageInfo {
-	image = strings.TrimPrefix(image, "docker://")
-	
-	var tag string
-	if idx := strings.LastIndex(image, ":"); idx != -1 {
-		part := image[idx+1:]
-		if !strings.Contains(part, "/") {
-			tag = part
-			image = image[:idx]
-		}
-	}
-	if tag == "" {
-		tag = "latest"
-	}
-	
-	var namespace, repository string
-	if strings.Contains(image, "/") {
-		parts := strings.Split(image, "/")
-		if len(parts) >= 2 {
-			if strings.Contains(parts[0], ".") {
-				if len(parts) >= 3 {
-					namespace = parts[1]
-					repository = parts[2]
-				} else {
-					namespace = "library"
-					repository = parts[1]
-				}
-			} else {
-				namespace = parts[0]
-				repository = parts[1]
-			}
-		}
-	} else {
-		namespace = "library"
-		repository = image
-	}
-	
-	fullName := namespace + "/" + repository
-	
-	return DockerImageInfo{
-		Namespace:  namespace,
-		Repository: repository,
-		Tag:        tag,
-		FullName:   fullName,
-	}
-}
-
-// CheckDockerAccess 检查Docker镜像访问权限
-func (ac *AccessController) CheckDockerAccess(image string) (allowed bool, reason string) {
-	cfg := GetConfig()
-	
-	// 解析镜像名称
-	imageInfo := ac.ParseDockerImage(image)
-	
-	// 检查白名单（如果配置了白名单，则只允许白名单中的镜像）
-	if len(cfg.Proxy.WhiteList) > 0 {
-		if !ac.matchImageInList(imageInfo, cfg.Proxy.WhiteList) {
-			return false, "不在Docker镜像白名单内"
-		}
-	}
-	
-	// 检查黑名单
-	if len(cfg.Proxy.BlackList) > 0 {
-		if ac.matchImageInList(imageInfo, cfg.Proxy.BlackList) {
-			return false, "Docker镜像在黑名单内"
-		}
-	}
-	
-	return true, ""
-}
-
-// CheckGitHubAccess 检查GitHub仓库访问权限
-func (ac *AccessController) CheckGitHubAccess(matches []string) (allowed bool, reason string) {
-	if len(matches) < 2 {
-		return false, "无效的GitHub仓库格式"
-	}
-	
-	cfg := GetConfig()
-	
-	// 检查白名单
-	if len(cfg.Proxy.WhiteList) > 0 && !ac.checkList(matches, cfg.Proxy.WhiteList) {
-		return false, "不在GitHub仓库白名单内"
-	}
-	
-	// 检查黑名单
-	if len(cfg.Proxy.BlackList) > 0 && ac.checkList(matches, cfg.Proxy.BlackList) {
-		return false, "GitHub仓库在黑名单内"
-	}
-	
-	return true, ""
-}
-
-// matchImageInList 检查Docker镜像是否在指定列表中
-func (ac *AccessController) matchImageInList(imageInfo DockerImageInfo, list []string) bool {
-	fullName := strings.ToLower(imageInfo.FullName)
-	namespace := strings.ToLower(imageInfo.Namespace)
-	
-	for _, item := range list {
-		item = strings.ToLower(strings.TrimSpace(item))
-		if item == "" {
-			continue
-		}
-		
-		if fullName == item {
-			return true
-		}
-		
-		if item == namespace || item == namespace+"/*" {
-			return true
-		}
-		
-		if strings.HasSuffix(item, "*") {
-			prefix := strings.TrimSuffix(item, "*")
-			if strings.HasPrefix(fullName, prefix) {
-				return true
-			}
-		}
-		
-		if strings.HasPrefix(item, "*/") {
-			repoPattern := strings.TrimPrefix(item, "*/")
-			if strings.HasSuffix(repoPattern, "*") {
-				repoPrefix := strings.TrimSuffix(repoPattern, "*")
-				if strings.HasPrefix(imageInfo.Repository, repoPrefix) {
-					return true
-				}
-			} else {
-				if strings.ToLower(imageInfo.Repository) == repoPattern {
-					return true
-				}
-			}
-		}
-		
-		if strings.HasPrefix(fullName, item+"/") {
-			return true
-		}
-	}
-	return false
-}
-
-// checkList GitHub仓库检查逻辑
-func (ac *AccessController) checkList(matches, list []string) bool {
-	if len(matches) < 2 {
-		return false
-	}
-	
-	username := strings.ToLower(strings.TrimSpace(matches[0]))
-	repoName := strings.ToLower(strings.TrimSpace(strings.TrimSuffix(matches[1], ".git")))
-	fullRepo := username + "/" + repoName
-	
-	for _, item := range list {
-		item = strings.ToLower(strings.TrimSpace(item))
-		if item == "" {
-			continue
-		}
-		
-		// 支持多种匹配模式
-		if fullRepo == item {
-			return true
-		}
-		
-		// 用户级匹配
-		if item == username || item == username+"/*" {
-			return true
-		}
-		
-		// 前缀匹配（支持通配符）
-		if strings.HasSuffix(item, "*") {
-			prefix := strings.TrimSuffix(item, "*")
-			if strings.HasPrefix(fullRepo, prefix) {
-				return true
-			}
-		}
-		
-		// 子仓库匹配（防止 user/repo 匹配到 user/repo-fork）
-		if strings.HasPrefix(fullRepo, item+"/") {
-			return true
-		}
-	}
-	return false
-}
-
-// Reload 热重载访问控制规则
-func (ac *AccessController) Reload() {
-	ac.mu.Lock()
-	defer ac.mu.Unlock()
-	
-	// 访问控制器本身不缓存配置
-} 
+package utils
+
+import (
+	"strings"
+
+	"hubproxy/config"
+)
+
+// ResourceType 资源类型
+type ResourceType string
+
+const (
+	ResourceTypeGitHub ResourceType = "github"
+	ResourceTypeDocker ResourceType = "docker"
+)
+
+// AccessController 统一访问控制器
+type AccessController struct {
+}
+
+// DockerImageInfo Docker镜像信息
+type DockerImageInfo struct {
+	Namespace  string
+	Repository string
+	Tag        string
+	FullName   string
+}
+
+// GlobalAccessController 全局访问控制器实例
+var GlobalAccessController = &AccessController{}
+
+// ParseDockerImage 解析Docker镜像名称
+func (ac *AccessController) ParseDockerImage(image string) DockerImageInfo {
+	image = strings.TrimPrefix(image, "docker://")
+
+	var tag string
+	if idx := strings.LastIndex(image, ":"); idx != -1 {
+		part := image[idx+1:]
+		if !strings.Contains(part, "/") {
+			tag = part
+			image = image[:idx]
+		}
+	}
+	if tag == "" {
+		tag = "latest"
+	}
+
+	var namespace, repository string
+	if strings.Contains(image, "/") {
+		parts := strings.Split(image, "/")
+		if len(parts) >= 2 {
+			if strings.Contains(parts[0], ".") {
+				if len(parts) >= 3 {
+					namespace = parts[1]
+					repository = parts[2]
+				} else {
+					namespace = "library"
+					repository = parts[1]
+				}
+			} else {
+				namespace = parts[0]
+				repository = parts[1]
+			}
+		}
+	} else {
+		namespace = "library"
+		repository = image
+	}
+
+	fullName := namespace + "/" + repository
+
+	return DockerImageInfo{
+		Namespace:  namespace,
+		Repository: repository,
+		Tag:        tag,
+		FullName:   fullName,
+	}
+}
+
+// CheckDockerAccess 检查Docker镜像访问权限
+func (ac *AccessController) CheckDockerAccess(image string) (allowed bool, reason string) {
+	cfg := config.GetConfig()
+
+	imageInfo := ac.ParseDockerImage(image)
+
+	if len(cfg.Access.WhiteList) > 0 {
+		if !ac.matchImageInList(imageInfo, cfg.Access.WhiteList) {
+			return false, "不在Docker镜像白名单内"
+		}
+	}
+
+	if len(cfg.Access.BlackList) > 0 {
+		if ac.matchImageInList(imageInfo, cfg.Access.BlackList) {
+			return false, "Docker镜像在黑名单内"
+		}
+	}
+
+	return true, ""
+}
+
+// CheckGitHubAccess 检查GitHub仓库访问权限
+func (ac *AccessController) CheckGitHubAccess(matches []string) (allowed bool, reason string) {
+	if len(matches) < 2 {
+		return false, "无效的GitHub仓库格式"
+	}
+
+	cfg := config.GetConfig()
+
+	if len(cfg.Access.WhiteList) > 0 && !ac.checkList(matches, cfg.Access.WhiteList) {
+		return false, "不在GitHub仓库白名单内"
+	}
+
+	if len(cfg.Access.BlackList) > 0 && ac.checkList(matches, cfg.Access.BlackList) {
+		return false, "GitHub仓库在黑名单内"
+	}
+
+	return true, ""
+}
+
+// matchImageInList 检查Docker镜像是否在指定列表中
+func (ac *AccessController) matchImageInList(imageInfo DockerImageInfo, list []string) bool {
+	fullName := strings.ToLower(imageInfo.FullName)
+	namespace := strings.ToLower(imageInfo.Namespace)
+
+	for _, item := range list {
+		item = strings.ToLower(strings.TrimSpace(item))
+		if item == "" {
+			continue
+		}
+
+		if fullName == item {
+			return true
+		}
+
+		if item == namespace || item == namespace+"/*" {
+			return true
+		}
+
+		if strings.HasSuffix(item, "*") {
+			prefix := strings.TrimSuffix(item, "*")
+			if strings.HasPrefix(fullName, prefix) {
+				return true
+			}
+		}
+
+		if strings.HasPrefix(item, "*/") {
+			repoPattern := strings.TrimPrefix(item, "*/")
+			if strings.HasSuffix(repoPattern, "*") {
+				repoPrefix := strings.TrimSuffix(repoPattern, "*")
+				if strings.HasPrefix(imageInfo.Repository, repoPrefix) {
+					return true
+				}
+			} else {
+				if strings.ToLower(imageInfo.Repository) == repoPattern {
+					return true
+				}
+			}
+		}
+
+		if strings.HasPrefix(fullName, item+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// checkList GitHub仓库检查逻辑
+func (ac *AccessController) checkList(matches, list []string) bool {
+	if len(matches) < 2 {
+		return false
+	}
+
+	username := strings.ToLower(strings.TrimSpace(matches[0]))
+	repoName := strings.ToLower(strings.TrimSpace(strings.TrimSuffix(matches[1], ".git")))
+	fullRepo := username + "/" + repoName
+
+	for _, item := range list {
+		item = strings.ToLower(strings.TrimSpace(item))
+		if item == "" {
+			continue
+		}
+
+		if fullRepo == item {
+			return true
+		}
+
+		if item == username || item == username+"/*" {
+			return true
+		}
+
+		if strings.HasSuffix(item, "*") {
+			prefix := strings.TrimSuffix(item, "*")
+			if strings.HasPrefix(fullRepo, prefix) {
+				return true
+			}
+		}
+
+		if strings.HasPrefix(fullRepo, item+"/") {
+			return true
+		}
+
+		if strings.HasPrefix(item, "*/") {
+			p := item[2:]
+			if p == repoName || (strings.HasSuffix(p, "*") && strings.HasPrefix(repoName, p[:len(p)-1])) {
+				return true
+			}
+		}
+	}
+	return false
+}

src/utils/access_control_test.go

@@ -0,0 +1,86 @@
+package utils
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"hubproxy/config"
+)
+
+func TestParseDockerImage(t *testing.T) {
+	tests := []struct {
+		name       string
+		image      string
+		namespace  string
+		repository string
+		tag        string
+		fullName   string
+	}{
+		{"official", "nginx", "library", "nginx", "latest", "library/nginx"},
+		{"tagged", "redis:7", "library", "redis", "7", "library/redis"},
+		{"namespaced", "user/app:v1", "user", "app", "v1", "user/app"},
+		{"registry", "ghcr.io/user/app:v2", "user", "app", "v2", "user/app"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := GlobalAccessController.ParseDockerImage(tt.image)
+			if got.Namespace != tt.namespace || got.Repository != tt.repository || got.Tag != tt.tag || got.FullName != tt.fullName {
+				t.Fatalf("ParseDockerImage(%q) = %#v", tt.image, got)
+			}
+		})
+	}
+}
+
+func TestDockerAccessLists(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.toml")
+	data := []byte(`
+[access]
+whiteList = ["library/*", "good/*"]
+blackList = ["good/bad"]
+`)
+	if err := os.WriteFile(path, data, 0644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CONFIG_PATH", path)
+	if err := config.LoadConfig(); err != nil {
+		t.Fatal(err)
+	}
+
+	if allowed, reason := GlobalAccessController.CheckDockerAccess("nginx"); !allowed {
+		t.Fatalf("nginx denied: %s", reason)
+	}
+	if allowed, _ := GlobalAccessController.CheckDockerAccess("good/bad:latest"); allowed {
+		t.Fatal("blacklisted image allowed")
+	}
+	if allowed, _ := GlobalAccessController.CheckDockerAccess("other/app"); allowed {
+		t.Fatal("image outside whitelist allowed")
+	}
+}
+
+func TestGitHubAccessLists(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.toml")
+	data := []byte(`
+[access]
+whiteList = ["allowed/*"]
+blackList = ["allowed/blocked"]
+`)
+	if err := os.WriteFile(path, data, 0644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CONFIG_PATH", path)
+	if err := config.LoadConfig(); err != nil {
+		t.Fatal(err)
+	}
+
+	if allowed, reason := GlobalAccessController.CheckGitHubAccess([]string{"allowed", "repo"}); !allowed {
+		t.Fatalf("allowed/repo denied: %s", reason)
+	}
+	if allowed, _ := GlobalAccessController.CheckGitHubAccess([]string{"allowed", "blocked"}); allowed {
+		t.Fatal("blacklisted repo allowed")
+	}
+	if allowed, _ := GlobalAccessController.CheckGitHubAccess([]string{"other", "repo"}); allowed {
+		t.Fatal("repo outside whitelist allowed")
+	}
+}

src/utils/cache.go

@@ -1,4 +1,4 @@
-package main
+package utils
 
 import (
 	"crypto/md5"
@@ -9,22 +9,23 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"hubproxy/config"
 )
 
-// CachedItem 通用缓存项，支持Token和Manifest
+// CachedItem 通用缓存项
 type CachedItem struct {
-	Data        []byte         // 缓存数据(token字符串或manifest字节)
-	ContentType string         // 内容类型
-	Headers     map[string]string // 额外的响应头
-	ExpiresAt   time.Time      // 过期时间
+	Data        []byte
+	ContentType string
+	Headers     map[string]string
+	ExpiresAt   time.Time
 }
 
-// UniversalCache 通用缓存，支持Token和Manifest
+// UniversalCache 通用缓存
 type UniversalCache struct {
 	cache sync.Map
 }
 
-var globalCache = &UniversalCache{}
+var GlobalCache = &UniversalCache{}
 
 // Get 获取缓存项
 func (c *UniversalCache) Get(key string) *CachedItem {
@@ -57,97 +58,115 @@ func (c *UniversalCache) SetToken(key, token string, ttl time.Duration) {
 	c.Set(key, []byte(token), "application/json", nil, ttl)
 }
 
-// buildCacheKey 构建稳定的缓存key
-func buildCacheKey(prefix, query string) string {
+// BuildCacheKey 构建稳定的缓存key
+func BuildCacheKey(prefix, query string) string {
 	return fmt.Sprintf("%s:%x", prefix, md5.Sum([]byte(query)))
 }
 
-func buildTokenCacheKey(query string) string {
-	return buildCacheKey("token", query)
+func BuildTokenCacheKey(query string) string {
+	return BuildCacheKey("token", query)
 }
 
-func buildManifestCacheKey(imageRef, reference string) string {
+func BuildManifestCacheKey(imageRef, reference string) string {
 	key := fmt.Sprintf("%s:%s", imageRef, reference)
-	return buildCacheKey("manifest", key)
+	return BuildCacheKey("manifest", key)
 }
 
-func buildManifestCacheKeyWithPlatform(imageRef, reference, platform string) string {
-	if platform == "" {
-		platform = "default"
-	}
-	key := fmt.Sprintf("%s:%s@%s", imageRef, reference, platform)
-	return buildCacheKey("manifest", key)
-}
-
-func getManifestTTL(reference string) time.Duration {
-	cfg := GetConfig()
+func GetManifestTTL(reference string) time.Duration {
+	cfg := config.GetConfig()
 	defaultTTL := 30 * time.Minute
 	if cfg.TokenCache.DefaultTTL != "" {
 		if parsed, err := time.ParseDuration(cfg.TokenCache.DefaultTTL); err == nil {
 			defaultTTL = parsed
 		}
 	}
-	
+
 	if strings.HasPrefix(reference, "sha256:") {
 		return 24 * time.Hour
 	}
-	
-	// mutable tag的智能判断
-	if reference == "latest" || reference == "main" || reference == "master" || 
-	   reference == "dev" || reference == "develop" {
-		// 热门可变标签: 短期缓存
+
+	if reference == "latest" || reference == "main" || reference == "master" ||
+		reference == "dev" || reference == "develop" {
 		return 10 * time.Minute
 	}
-	
-	// 普通tag: 中等缓存时间
+
 	return defaultTTL
 }
 
-// extractTTLFromResponse 从响应中智能提取TTL
-func extractTTLFromResponse(responseBody []byte) time.Duration {
+// ExtractTTLFromResponse 从响应中智能提取TTL
+func ExtractTTLFromResponse(responseBody []byte) time.Duration {
 	var tokenResp struct {
 		ExpiresIn int `json:"expires_in"`
 	}
-	
-	// 默认30分钟TTL，确保稳定性
+
 	defaultTTL := 30 * time.Minute
-	
+
 	if json.Unmarshal(responseBody, &tokenResp) == nil && tokenResp.ExpiresIn > 0 {
-		safeTTL := time.Duration(tokenResp.ExpiresIn-300) * time.Second
-		if safeTTL > 5*time.Minute {
-			return safeTTL
+		expires := time.Duration(tokenResp.ExpiresIn) * time.Second
+		skew := expires / 10
+		if skew > 5*time.Minute {
+			skew = 5 * time.Minute
 		}
+		if skew < 10*time.Second {
+			skew = 10 * time.Second
+		}
+		if expires > skew {
+			return expires - skew
+		}
+		return expires / 2
 	}
-	
+
 	return defaultTTL
 }
 
-func writeTokenResponse(c *gin.Context, cachedBody string) {
+func WriteTokenResponse(c *gin.Context, cachedBody string) {
 	c.Header("Content-Type", "application/json")
 	c.String(200, cachedBody)
 }
 
-func writeCachedResponse(c *gin.Context, item *CachedItem) {
+func WriteCachedResponse(c *gin.Context, item *CachedItem) {
 	if item.ContentType != "" {
 		c.Header("Content-Type", item.ContentType)
 	}
-	
-	// 设置额外的响应头
+
 	for key, value := range item.Headers {
 		c.Header(key, value)
 	}
-	
-	// 返回数据
+
 	c.Data(200, item.ContentType, item.Data)
 }
 
-// isCacheEnabled 检查缓存是否启用
-func isCacheEnabled() bool {
-	cfg := GetConfig()
+// IsCacheEnabled 检查缓存是否启用
+func IsCacheEnabled() bool {
+	cfg := config.GetConfig()
 	return cfg.TokenCache.Enabled
 }
 
-// isTokenCacheEnabled 检查token缓存是否启用(向后兼容)
-func isTokenCacheEnabled() bool {
-	return isCacheEnabled()
-} 
+// IsTokenCacheEnabled 检查token缓存是否启用
+func IsTokenCacheEnabled() bool {
+	return IsCacheEnabled()
+}
+
+// 定期清理过期缓存
+func init() {
+	go func() {
+		ticker := time.NewTicker(20 * time.Minute)
+		defer ticker.Stop()
+
+		for range ticker.C {
+			now := time.Now()
+			expiredKeys := make([]string, 0)
+
+			GlobalCache.cache.Range(func(key, value interface{}) bool {
+				if cached := value.(*CachedItem); now.After(cached.ExpiresAt) {
+					expiredKeys = append(expiredKeys, key.(string))
+				}
+				return true
+			})
+
+			for _, key := range expiredKeys {
+				GlobalCache.cache.Delete(key)
+			}
+		}
+	}()
+}

src/utils/cache_test.go

@@ -0,0 +1,53 @@
+package utils
+
+import (
+	"testing"
+	"time"
+)
+
+func TestUniversalCacheSetGetAndExpire(t *testing.T) {
+	cache := &UniversalCache{}
+
+	cache.Set("k", []byte("v"), "text/plain", map[string]string{"X-Test": "1"}, time.Minute)
+	if got := cache.Get("k"); got == nil || string(got.Data) != "v" || got.Headers["X-Test"] != "1" {
+		t.Fatalf("cache hit mismatch: %#v", got)
+	}
+
+	cache.Set("expired", []byte("v"), "", nil, -time.Second)
+	if got := cache.Get("expired"); got != nil {
+		t.Fatalf("expired item returned: %#v", got)
+	}
+}
+
+func TestTokenCacheHelpers(t *testing.T) {
+	cache := &UniversalCache{}
+	cache.SetToken("token", `{"token":"abc"}`, time.Minute)
+
+	if got := cache.GetToken("token"); got != `{"token":"abc"}` {
+		t.Fatalf("GetToken = %q", got)
+	}
+}
+
+func TestExtractTTLFromResponse(t *testing.T) {
+	ttl := ExtractTTLFromResponse([]byte(`{"expires_in":3600}`))
+	if ttl != 55*time.Minute {
+		t.Fatalf("TTL = %s, want 55m", ttl)
+	}
+
+	if ttl := ExtractTTLFromResponse([]byte(`{"expires_in":300}`)); ttl != 270*time.Second {
+		t.Fatalf("short TTL = %s, want 270s", ttl)
+	}
+
+	if ttl := ExtractTTLFromResponse([]byte(`{}`)); ttl != 30*time.Minute {
+		t.Fatalf("default TTL = %s", ttl)
+	}
+}
+
+func TestBuildCacheKeyStable(t *testing.T) {
+	a := BuildCacheKey("p", "query")
+	b := BuildCacheKey("p", "query")
+	c := BuildCacheKey("p", "other")
+	if a != b || a == c {
+		t.Fatalf("unexpected keys: %q %q %q", a, b, c)
+	}
+}

src/utils/http_client.go

@@ -1,59 +1,67 @@
-package main
-
-import (
-	"net"
-	"net/http"
-	"time"
-)
-
-var (
-	// 全局HTTP客户端 - 用于代理请求（长超时）
-	globalHTTPClient *http.Client
-	// 搜索HTTP客户端 - 用于API请求（短超时） 
-	searchHTTPClient *http.Client
-)
-
-// initHTTPClients 初始化HTTP客户端
-func initHTTPClients() {
-	// 代理客户端配置 - 适用于大文件传输
-	globalHTTPClient = &http.Client{
-		Transport: &http.Transport{
-			DialContext: (&net.Dialer{
-				Timeout:   30 * time.Second,
-				KeepAlive: 30 * time.Second,
-			}).DialContext,
-			MaxIdleConns:          1000,
-			MaxIdleConnsPerHost:   1000,
-			IdleConnTimeout:       90 * time.Second,
-			TLSHandshakeTimeout:   10 * time.Second,
-			ExpectContinueTimeout: 1 * time.Second,
-			ResponseHeaderTimeout: 300 * time.Second,
-		},
-	}
-	
-	// 搜索客户端配置 - 适用于API调用
-	searchHTTPClient = &http.Client{
-		Timeout: 10 * time.Second,
-		Transport: &http.Transport{
-			DialContext: (&net.Dialer{
-				Timeout:   5 * time.Second,
-				KeepAlive: 30 * time.Second,
-			}).DialContext,
-			MaxIdleConns:        100,
-			MaxIdleConnsPerHost: 10,
-			IdleConnTimeout:     90 * time.Second,
-			TLSHandshakeTimeout: 5 * time.Second,
-			DisableCompression:  false,
-		},
-	}
-}
-
-// GetGlobalHTTPClient 获取全局HTTP客户端（用于代理）
-func GetGlobalHTTPClient() *http.Client {
-	return globalHTTPClient
-}
-
-// GetSearchHTTPClient 获取搜索HTTP客户端（用于API调用）
-func GetSearchHTTPClient() *http.Client {
-	return searchHTTPClient
-} 
+package utils
+
+import (
+	"net"
+	"net/http"
+	"os"
+	"time"
+
+	"hubproxy/config"
+)
+
+var (
+	globalHTTPClient *http.Client
+	searchHTTPClient *http.Client
+)
+
+// InitHTTPClients 初始化HTTP客户端
+func InitHTTPClients() {
+	cfg := config.GetConfig()
+
+	if p := cfg.Access.Proxy; p != "" {
+		os.Setenv("HTTP_PROXY", p)
+		os.Setenv("HTTPS_PROXY", p)
+	}
+
+	globalHTTPClient = &http.Client{
+		Transport: &http.Transport{
+			Proxy: http.ProxyFromEnvironment,
+			DialContext: (&net.Dialer{
+				Timeout:   30 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+			MaxIdleConns:          1000,
+			MaxIdleConnsPerHost:   1000,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+			ResponseHeaderTimeout: 300 * time.Second,
+		},
+	}
+
+	searchHTTPClient = &http.Client{
+		Timeout: 10 * time.Second,
+		Transport: &http.Transport{
+			Proxy: http.ProxyFromEnvironment,
+			DialContext: (&net.Dialer{
+				Timeout:   5 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+			MaxIdleConns:        100,
+			MaxIdleConnsPerHost: 10,
+			IdleConnTimeout:     90 * time.Second,
+			TLSHandshakeTimeout: 5 * time.Second,
+			DisableCompression:  false,
+		},
+	}
+}
+
+// GetGlobalHTTPClient 获取全局HTTP客户端
+func GetGlobalHTTPClient() *http.Client {
+	return globalHTTPClient
+}
+
+// GetSearchHTTPClient 获取搜索HTTP客户端
+func GetSearchHTTPClient() *http.Client {
+	return searchHTTPClient
+}

src/utils/proxy_shell.go

@@ -0,0 +1,107 @@
+package utils
+
+import (
+	"bytes"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+)
+
+// GitHub URL正则表达式
+var githubRegex = regexp.MustCompile(`(?:^|[\s'"(=,\[{;|&<>])https?://(?:github\.com|raw\.githubusercontent\.com|raw\.github\.com|gist\.githubusercontent\.com|gist\.github\.com|api\.github\.com)[^\s'")]*`)
+
+// MaxShellSize 限制最大处理大小为 10MB
+const MaxShellSize = 10 * 1024 * 1024
+
+// ProcessSmart Shell脚本智能处理函数
+func ProcessSmart(input io.Reader, isCompressed bool, host string) (io.Reader, int64, error) {
+	content, err := readShellContent(input, isCompressed)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	if len(content) == 0 {
+		return strings.NewReader(""), 0, nil
+	}
+
+	if !bytes.Contains(content, []byte("github.com")) && !bytes.Contains(content, []byte("githubusercontent.com")) {
+		return bytes.NewReader(content), int64(len(content)), nil
+	}
+
+	processed := processGitHubURLs(string(content), host)
+
+	return strings.NewReader(processed), int64(len(processed)), nil
+}
+
+func readShellContent(input io.Reader, isCompressed bool) ([]byte, error) {
+	var reader io.Reader = input
+
+	if isCompressed {
+		peek := make([]byte, 2)
+		n, err := input.Read(peek)
+		if err != nil && err != io.EOF {
+			return nil, fmt.Errorf("读取数据失败: %v", err)
+		}
+
+		if n >= 2 && peek[0] == 0x1f && peek[1] == 0x8b {
+			combinedReader := io.MultiReader(bytes.NewReader(peek[:n]), input)
+			gzReader, err := gzip.NewReader(combinedReader)
+			if err != nil {
+				return nil, fmt.Errorf("gzip解压失败: %v", err)
+			}
+			defer gzReader.Close()
+			reader = gzReader
+		} else {
+			reader = io.MultiReader(bytes.NewReader(peek[:n]), input)
+		}
+	}
+
+	limit := int64(MaxShellSize + 1)
+	limitedReader := io.LimitReader(reader, limit)
+
+	data, err := io.ReadAll(limitedReader)
+	if err != nil {
+		return nil, fmt.Errorf("读取内容失败: %v", err)
+	}
+
+	if int64(len(data)) > MaxShellSize {
+		return nil, fmt.Errorf("脚本文件过大，超过 %d MB 限制", MaxShellSize/1024/1024)
+	}
+
+	return data, nil
+}
+
+func processGitHubURLs(content, host string) string {
+	return githubRegex.ReplaceAllStringFunc(content, func(match string) string {
+		// 如果匹配包含前缀分隔符，保留它，防止出现重复转换
+		if len(match) > 0 && match[0] != 'h' {
+			prefix := match[0:1]
+			url := match[1:]
+			return prefix + transformURL(url, host)
+		}
+		return transformURL(match, host)
+	})
+}
+
+// transformURL URL转换函数
+func transformURL(url, host string) string {
+	if strings.Contains(url, host) {
+		return url
+	}
+
+	if strings.HasPrefix(url, "http://") {
+		url = "https" + url[4:]
+	} else if !strings.HasPrefix(url, "https://") && !strings.HasPrefix(url, "//") {
+		url = "https://" + url
+	}
+
+	// 确保 host 有协议头
+	if !strings.HasPrefix(host, "http://") && !strings.HasPrefix(host, "https://") {
+		host = "https://" + host
+	}
+	host = strings.TrimSuffix(host, "/")
+
+	return host + "/" + url
+}

src/utils/proxy_shell_test.go

@@ -0,0 +1,69 @@
+package utils
+
+import (
+	"compress/gzip"
+	"io"
+	"strings"
+	"testing"
+)
+
+func TestProcessSmartRewritesGitHubURLs(t *testing.T) {
+	input := `curl -L https://github.com/user/repo/releases/download/v1/file.sh`
+	reader, size, err := ProcessSmart(strings.NewReader(input), false, "proxy.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	buf := new(strings.Builder)
+	if _, err := io.Copy(buf, reader); err != nil {
+		t.Fatal(err)
+	}
+
+	want := "https://proxy.example.com/https://github.com/user/repo/releases/download/v1/file.sh"
+	if !strings.Contains(buf.String(), want) {
+		t.Fatalf("processed script = %q, want contains %q", buf.String(), want)
+	}
+	if size != int64(len(buf.String())) {
+		t.Fatalf("size = %d, want %d", size, len(buf.String()))
+	}
+}
+
+func TestProcessSmartKeepsNonGitHubContent(t *testing.T) {
+	input := "echo hello"
+	reader, _, err := ProcessSmart(strings.NewReader(input), false, "proxy.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	buf := new(strings.Builder)
+	if _, err := io.Copy(buf, reader); err != nil {
+		t.Fatal(err)
+	}
+	if buf.String() != input {
+		t.Fatalf("content changed: %q", buf.String())
+	}
+}
+
+func TestReadShellContentGzip(t *testing.T) {
+	var compressed strings.Builder
+	gz := gzip.NewWriter(&compressed)
+	if _, err := gz.Write([]byte("echo https://github.com/u/r")); err != nil {
+		t.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	reader, _, err := ProcessSmart(strings.NewReader(compressed.String()), true, "proxy.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	buf := new(strings.Builder)
+	if _, err := io.Copy(buf, reader); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(buf.String(), "https://proxy.example.com/https://github.com/u/r") {
+		t.Fatalf("gzip content not rewritten: %q", buf.String())
+	}
+}

src/utils/ratelimiter.go

@@ -0,0 +1,276 @@
+package utils
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/time/rate"
+	"hubproxy/config"
+)
+
+const (
+	CleanupInterval = 20 * time.Minute
+	MaxIPCacheSize  = 10000
+)
+
+var debugRateLimitLog = strings.EqualFold(os.Getenv("DEBUG_RATE_LIMIT_LOG"), "true")
+
+// IPRateLimiter IP限流器结构体
+type IPRateLimiter struct {
+	ips              map[string]*rateLimiterEntry
+	mu               *sync.RWMutex
+	r                rate.Limit
+	b                int
+	whitelist        []*net.IPNet
+	blacklist        []*net.IPNet
+	whitelistLimiter *rate.Limiter // 全局共享的白名单限流器
+}
+
+// rateLimiterEntry 限流器条目
+type rateLimiterEntry struct {
+	limiter    *rate.Limiter
+	lastAccess time.Time
+}
+
+// InitGlobalLimiter 初始化全局限流器
+func InitGlobalLimiter() *IPRateLimiter {
+	cfg := config.GetConfig()
+
+	whitelist := make([]*net.IPNet, 0, len(cfg.Security.WhiteList))
+	for _, item := range cfg.Security.WhiteList {
+		if item = strings.TrimSpace(item); item != "" {
+			if !strings.Contains(item, "/") {
+				item = item + "/32"
+			}
+			_, ipnet, err := net.ParseCIDR(item)
+			if err == nil {
+				whitelist = append(whitelist, ipnet)
+			} else {
+				fmt.Printf("警告: 无效的白名单IP格式: %s\n", item)
+			}
+		}
+	}
+
+	blacklist := make([]*net.IPNet, 0, len(cfg.Security.BlackList))
+	for _, item := range cfg.Security.BlackList {
+		if item = strings.TrimSpace(item); item != "" {
+			if !strings.Contains(item, "/") {
+				item = item + "/32"
+			}
+			_, ipnet, err := net.ParseCIDR(item)
+			if err == nil {
+				blacklist = append(blacklist, ipnet)
+			} else {
+				fmt.Printf("警告: 无效的黑名单IP格式: %s\n", item)
+			}
+		}
+	}
+
+	ratePerSecond := rate.Limit(float64(cfg.RateLimit.RequestLimit) / (cfg.RateLimit.PeriodHours * 3600))
+
+	burstSize := cfg.RateLimit.RequestLimit
+
+	limiter := &IPRateLimiter{
+		ips:              make(map[string]*rateLimiterEntry),
+		mu:               &sync.RWMutex{},
+		r:                ratePerSecond,
+		b:                burstSize,
+		whitelist:        whitelist,
+		blacklist:        blacklist,
+		whitelistLimiter: rate.NewLimiter(rate.Inf, burstSize),
+	}
+
+	go limiter.cleanupRoutine()
+
+	return limiter
+}
+
+// cleanupRoutine 定期清理过期的限流器
+func (i *IPRateLimiter) cleanupRoutine() {
+	ticker := time.NewTicker(CleanupInterval)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		now := time.Now()
+		expired := make([]string, 0)
+
+		i.mu.RLock()
+		for ip, entry := range i.ips {
+			if now.Sub(entry.lastAccess) > 2*time.Hour {
+				expired = append(expired, ip)
+			}
+		}
+		i.mu.RUnlock()
+
+		if len(expired) > 0 || len(i.ips) > MaxIPCacheSize {
+			i.mu.Lock()
+			for _, ip := range expired {
+				delete(i.ips, ip)
+			}
+
+			if len(i.ips) > MaxIPCacheSize {
+				i.ips = make(map[string]*rateLimiterEntry)
+			}
+			i.mu.Unlock()
+		}
+	}
+}
+
+// extractIPFromAddress 从地址中提取纯IP
+func extractIPFromAddress(address string) string {
+	if host, _, err := net.SplitHostPort(address); err == nil {
+		return host
+	}
+	return address
+}
+
+// normalizeIPForRateLimit 标准化IP地址用于限流
+func normalizeIPForRateLimit(ipStr string) string {
+	ip := net.ParseIP(ipStr)
+	if ip == nil {
+		return ipStr
+	}
+
+	if ip.To4() != nil {
+		return ipStr
+	}
+
+	ipv6 := ip.To16()
+	for i := 8; i < 16; i++ {
+		ipv6[i] = 0
+	}
+	return ipv6.String() + "/64"
+}
+
+// isIPInCIDRList 检查IP是否在CIDR列表中
+func isIPInCIDRList(ip string, cidrList []*net.IPNet) bool {
+	cleanIP := extractIPFromAddress(ip)
+	parsedIP := net.ParseIP(cleanIP)
+	if parsedIP == nil {
+		return false
+	}
+
+	for _, cidr := range cidrList {
+		if cidr.Contains(parsedIP) {
+			return true
+		}
+	}
+	return false
+}
+
+// GetLimiter 获取指定IP的限流器
+func (i *IPRateLimiter) GetLimiter(ip string) (*rate.Limiter, bool) {
+	cleanIP := extractIPFromAddress(ip)
+
+	if isIPInCIDRList(cleanIP, i.blacklist) {
+		return nil, false
+	}
+
+	if isIPInCIDRList(cleanIP, i.whitelist) {
+		return i.whitelistLimiter, true
+	}
+
+	normalizedIP := normalizeIPForRateLimit(cleanIP)
+
+	now := time.Now()
+
+	var entry *rateLimiterEntry
+	i.mu.RLock()
+	_, exists := i.ips[normalizedIP]
+	i.mu.RUnlock()
+
+	if exists {
+		i.mu.Lock()
+		if entry, stillExists := i.ips[normalizedIP]; stillExists {
+			entry.lastAccess = now
+			i.mu.Unlock()
+			return entry.limiter, true
+		}
+		i.mu.Unlock()
+	}
+
+	i.mu.Lock()
+	if entry, exists := i.ips[normalizedIP]; exists {
+		entry.lastAccess = now
+		i.mu.Unlock()
+		return entry.limiter, true
+	}
+
+	entry = &rateLimiterEntry{
+		limiter:    rate.NewLimiter(i.r, i.b),
+		lastAccess: now,
+	}
+	i.ips[normalizedIP] = entry
+	i.mu.Unlock()
+
+	return entry.limiter, true
+}
+
+// RateLimitMiddleware 速率限制中间件
+func RateLimitMiddleware(limiter *IPRateLimiter) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		path := c.Request.URL.Path
+		if path == "/" || path == "/favicon.ico" || path == "/images.html" || path == "/search.html" ||
+			strings.HasPrefix(path, "/public/") {
+			c.Next()
+			return
+		}
+
+		var ip string
+
+		if forwarded := c.GetHeader("X-Forwarded-For"); forwarded != "" {
+			ips := strings.Split(forwarded, ",")
+			ip = strings.TrimSpace(ips[0])
+		} else if realIP := c.GetHeader("X-Real-IP"); realIP != "" {
+			ip = realIP
+		} else if remoteIP := c.GetHeader("X-Original-Forwarded-For"); remoteIP != "" {
+			ips := strings.Split(remoteIP, ",")
+			ip = strings.TrimSpace(ips[0])
+		} else {
+			ip = c.ClientIP()
+		}
+
+		cleanIP := extractIPFromAddress(ip)
+
+		if debugRateLimitLog {
+			normalizedIP := normalizeIPForRateLimit(cleanIP)
+			if cleanIP != normalizedIP {
+				fmt.Printf("请求IP: %s (提纯后: %s, 限流段: %s), X-Forwarded-For: %s, X-Real-IP: %s\n",
+					ip, cleanIP, normalizedIP,
+					c.GetHeader("X-Forwarded-For"),
+					c.GetHeader("X-Real-IP"))
+			} else {
+				fmt.Printf("请求IP: %s (提纯后: %s), X-Forwarded-For: %s, X-Real-IP: %s\n",
+					ip, cleanIP,
+					c.GetHeader("X-Forwarded-For"),
+					c.GetHeader("X-Real-IP"))
+			}
+
+		}
+
+		ipLimiter, allowed := limiter.GetLimiter(cleanIP)
+
+		if !allowed {
+			c.JSON(403, gin.H{
+				"error": "您已被限制访问",
+			})
+			c.Abort()
+			return
+		}
+
+		if !ipLimiter.Allow() {
+			c.JSON(429, gin.H{
+				"error": "请求频率过快，暂时限制访问",
+			})
+			c.Abort()
+			return
+		}
+
+		c.Next()
+	}
+}

src/utils/ratelimiter_test.go

@@ -0,0 +1,21 @@
+package utils
+
+import "testing"
+
+func TestExtractIPFromAddress(t *testing.T) {
+	if got := extractIPFromAddress("127.0.0.1:5000"); got != "127.0.0.1" {
+		t.Fatalf("extract IPv4 = %q", got)
+	}
+	if got := extractIPFromAddress("[2001:db8::1]:5000"); got != "2001:db8::1" {
+		t.Fatalf("extract IPv6 = %q", got)
+	}
+}
+
+func TestNormalizeIPv6ForRateLimit(t *testing.T) {
+	if got := normalizeIPForRateLimit("192.168.1.2"); got != "192.168.1.2" {
+		t.Fatalf("IPv4 normalized = %q", got)
+	}
+	if got := normalizeIPForRateLimit("2001:db8::1"); got != "2001:db8::/64" {
+		t.Fatalf("IPv6 normalized = %q", got)
+	}
+}