Merge pull request #66 from tobychui/2.6.7

v2.6.7 Update

.github/workflows/main.yml

@@ -0,0 +1,46 @@
+name: Image Publisher
+
+on:
+  release:
+    types: [ published ]
+
+jobs:
+  setup-build-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.release.tag_name }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to Dockerhub
+        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
+      
+      - name: Setup building file structure
+        run: |
+          cp -r $GITHUB_WORKSPACE/src/ $GITHUB_WORKSPACE/docker/
+
+      - name: Build the image
+        run: |
+          cd $GITHUB_WORKSPACE/docker/
+          docker buildx create --name mainbuilder --driver docker-container --platform linux/amd64,linux/arm64 --use
+          
+          docker buildx build --push \
+            --build-arg VERSION=${{ github.event.release.tag_name }} \
+            --provenance=false \
+            --platform linux/amd64,linux/arm64 \
+            --tag zoraxydocker/zoraxy:${{ github.event.release.tag_name }} \
+            .
+
+          docker buildx build --push \
+            --build-arg VERSION=${{ github.event.release.tag_name }} \
+            --provenance=false \
+            --platform linux/amd64,linux/arm64 \
+            --tag zoraxydocker/zoraxy:latest \
+            .

.gitignore

@@ -29,3 +29,6 @@ src/Zoraxy_*_*
 src/certs/*
 src/rules/*
 src/README.md
+docker/ContainerTester.sh
+docker/ImagePublisher.sh
+src/mod/acme/test/stackoverflow.pem

CHANGELOG.md

@@ -1,19 +1,53 @@
+# v2.6.6 Aug 30 2023
+
++ Added basic auth editor custom exception rules 
++ Fixed redirection bug under another reverse proxy and Apache location headers [#39](https://github.com/tobychui/zoraxy/issues/39)
++ Optimized memory usage (from 1.2GB to 61MB for low speed geoip lookup) [#52](https://github.com/tobychui/zoraxy/issues/52)
++ Added unset subdomain custom redirection feature [#46](https://github.com/tobychui/zoraxy/issues/46)
++ Fixed potential security issue in satori/go.uuid [#55](https://github.com/tobychui/zoraxy/issues/55)
++ Added custom acme feature in back-end, thx [@daluntw](https://github.com/daluntw)
++ Added bypass TLS check for custom acme server, thx [@daluntw](https://github.com/daluntw)
++ Introduce new startparameter `-fastgeoip=true`, see [Releases](https://github.com/tobychui/zoraxy/releases/tag/2.6.6)
+
+# v2.6.5.1 Jul 26 2023
+
++ Patch on memory leaking for Windows netstat module (do not effect any of the previous non Windows builds)
++ Fixed potential memory leak in acme handler logic
++ Added "Do you want to get a TLS certificate for this subdomain?" dialog when a new subdomain proxy rule is created
+
+# v2.6.5 Jul 19 2023
+
++ Added Import / Export-Feature 
++ Moved configurationfiles to a separate folder [#26](https://github.com/tobychui/zoraxy/issues/26)
++ Added auto-renew with ACME [#6](https://github.com/tobychui/zoraxy/issues/6)
++ Fixed Whitelistbug [#18](https://github.com/tobychui/zoraxy/issues/18)
++ Added Whois
+
+# v2.6.4 Jun 15 2023
+
++ Added force TLS v1.2 above toggle
++ Added trace route
++ Added ICMP ping
++ Added special routing rules module for up-coming acme integration
++ Fixed IPv6 check bug in black/whitelist
++ Optimized UI for TCP Proxy
+
 # v2.6.3 Jun 8 2023
 
 + Added X-Forwarded-Proto for automatic proxy detector
 + Split blacklist and whitelist from geodb script file
 + Optimized compile binary size
 + Added access control to TCP proxy
-+ Added "invalid config detect" in up time monitor for isse #7
++ Added "invalid config detect" in up time monitor for isse [#7](https://github.com/tobychui/zoraxy/issues/7)
 + Fixed minor bugs in advance stats panel
 + Reduced file size of embedded materials
 
 # v2.6.2 Jun 4 2023
 
 + Added advance stats operation tab
-+ Added statistic reset #13
++ Added statistic reset [#13](https://github.com/tobychui/zoraxy/issues/13)
 + Added statistic export to csv and json (please use json)
-+ Make subdomain clickable (not vdir) #12
++ Make subdomain clickable (not vdir) [#12](https://github.com/tobychui/zoraxy/issues/12)
 + Added TCP Proxy
 + Updates SMTP setup UI to make it more straight forward to setup
 

README.md

@@ -67,11 +67,7 @@ The installation method is same as Linux. If you are using Raspberry Pi 4 or new
 The installation method is same as Linux. For other ARM SBCs, please refer to your SBC's CPU architecture and pick the one that is suitable for your device. 
 
 #### Docker
-Thanks for cyb3rdoc and PassiveLemon for providing support over the Docker installation. You can check out their repo over here.
-
-[https://github.com/cyb3rdoc/zoraxy-docker](https://github.com/cyb3rdoc/zoraxy-docker)
-
-[https://github.com/PassiveLemon/zoraxy-docker](https://github.com/PassiveLemon/zoraxy-docker)
+See the [/docker](https://github.com/tobychui/zoraxy/tree/main/docker) folder for more details
 
 ### External Permission Management Mode
 
@@ -161,6 +157,12 @@ Loopback web ssh connection, by default, is disabled. This means that if you are
 ./zoraxy -sshlb=true
 ```
 
+## Sponsor This Project
+If you like the project and want to support us, please consider a donation. You can use the links below
+- [tobychui (Primary author)](https://paypal.me/tobychui)
+- PassiveLemon (Docker compatibility maintainer)
+
+
 ## License
 
 This project is open source under AGPL. I open source this project so everyone can check for security issues and benefit all users. **If your plans to use this project in commercial environment which violate the AGPL terms, please contact toby@imuslab.com for an alternative commercial license.** 

docker/Dockerfile

@@ -0,0 +1,38 @@
+FROM docker.io/golang:alpine
+# VERSION comes from the main.yml workflow --build-arg
+ARG VERSION
+
+RUN apk add --no-cache bash netcat-openbsd sudo
+
+RUN mkdir -p /opt/zoraxy/source/ &&\
+    mkdir -p /opt/zoraxy/config/ &&\
+    mkdir -p /usr/local/bin/
+
+COPY entrypoint.sh /opt/zoraxy/
+
+RUN chmod -R 755 /opt/zoraxy/ &&\
+    chmod +x /opt/zoraxy/entrypoint.sh
+
+VOLUME [ "/opt/zoraxy/config/" ]
+
+# If you build it yourself, you will need to add the src directory into the docker directory.
+COPY ./src/ /opt/zoraxy/source/
+
+WORKDIR /opt/zoraxy/source/
+
+RUN go mod tidy &&\
+    go build -o /usr/local/bin/zoraxy &&\
+    rm -r /opt/zoraxy/source/
+
+RUN chmod +x /usr/local/bin/zoraxy
+
+WORKDIR /opt/zoraxy/config/
+
+ENV VERSION=$VERSION
+
+ENV ARGS="-noauth=false"
+
+ENTRYPOINT ["/opt/zoraxy/entrypoint.sh"]
+
+HEALTHCHECK --interval=5s --timeout=5s --retries=2 CMD nc -vz 127.0.0.1 8000 || exit 1
+

docker/README.md

@@ -0,0 +1,65 @@
+# [zoraxy](https://github.com/tobychui/zoraxy/) </br>
+
+[![Repo](https://img.shields.io/badge/Docker-Repo-007EC6?labelColor-555555&color-007EC6&logo=docker&logoColor=fff&style=flat-square)](https://hub.docker.com/r/zoraxydocker/zoraxy)
+[![Version](https://img.shields.io/docker/v/zoraxydocker/zoraxy/latest?labelColor-555555&color-007EC6&style=flat-square)](https://hub.docker.com/r/zoraxydocker/zoraxy)
+[![Size](https://img.shields.io/docker/image-size/zoraxydocker/zoraxy/latest?sort=semver&labelColor-555555&color-007EC6&style=flat-square)](https://hub.docker.com/r/zoraxydocker/zoraxy)
+[![Pulls](https://img.shields.io/docker/pulls/zoraxydocker/zoraxy?labelColor-555555&color-007EC6&style=flat-square)](https://hub.docker.com/r/zoraxydocker/zoraxy)
+
+## Setup: </br>
+Although not required, it is recommended to give Zoraxy a dedicated location on the host to mount the container. That way, the host/user can access them whenever needed. A volume will be created automatically within Docker if a location is not specified. </br>
+
+You may also need to portforward your 80/443 to allow http and https traffic. If you are accessing the interface from outside of the local network, you may also need to forward your management port. If you know how to do this, great! If not, find the manufacturer of your router and search on how to do that. There are too many to be listed here. </br>
+
+### Using Docker run </br>
+```
+docker run -d --name (container name) -p (ports) -v (path to storage directory):/opt/zoraxy/data/ -e ARGS='(your arguments)' zoraxydocker/zoraxy:latest
+```
+
+### Using Docker Compose </br>
+```yml
+version: '3.3'
+services:
+  zoraxy-docker:
+    image: zoraxydocker/zoraxy:latest
+    container_name: (container name)
+    ports:
+      - 80:80
+      - 443:443
+      - (external):8000
+    volumes:
+      - (path to storage directory):/opt/zoraxy/config/
+    environment:
+      ARGS: '(your arguments)'
+```
+
+| Operator | Need | Details |
+|:-|:-|:-|
+| `-d` | Yes | will run the container in the background. |
+| `--name (container name)` | No | Sets the name of the container to the following word. You can change this to whatever you want. |
+| `-p (ports)` | Yes | Depending on how your network is setup, you may need to portforward 80, 443, and the management port. |
+| `-v (path to storage directory):/opt/zoraxy/config/` | Recommend | Sets the folder that holds your files. This should be the place you just chose. By default, it will create a Docker volume for the files for persistency but they will not be accessible. |
+| `-e ARGS='(your arguments)'` | No | Sets the arguments to run Zoraxy with. Enter them as you would normally. By default, it is ran with `-noauth=false` but <b>you cannot change the management port.</b> This is required for the healthcheck to work. |
+| `zoraxydocker/zoraxy:latest` | Yes | The repository on Docker hub. By default, it is the latest version that I have published. |
+
+## Examples: </br>
+### Docker Run </br>
+```
+docker run -d --name zoraxy -p 80:80 -p 443:443 -p 8005:8000/tcp -v /home/docker/Containers/Zoraxy:/opt/zoraxy/config/ -e ARGS='-noauth=false' zoraxydocker/zoraxy:latest
+```
+
+### Docker Compose </br>
+```yml
+version: '3.3'
+services:
+  zoraxy-docker:
+    image: zoraxydocker/zoraxy:latest
+    container_name: zoraxy
+    ports:
+      - 80:80
+      - 443:443
+      - 8005:8000/tcp
+    volumes:
+      - /home/docker/Containers/Zoraxy:/opt/zoraxy/config/
+    environment:
+      ARGS: '-noauth=false'
+```

docker/entrypoint.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+echo "Zoraxy version $VERSION"
+
+zoraxy -port=:8000 ${ARGS}

src/Makefile

@@ -19,7 +19,8 @@ clean:
 
 $(PLATFORMS):
 	@echo "Building $(os)/$(arch)"
-	GOROOT_FINAL=Git/ GOOS=$(os) GOARCH=$(arch) GOARM=6 go build -o './dist/zoraxy_$(os)_$(arch)'  -ldflags "-s -w" -trimpath
+	GOROOT_FINAL=Git/ GOOS=$(os) GOARCH=$(arch) $(if $(filter linux/arm,$(os)/$(arch)),GOARM=6,) go build -o './dist/zoraxy_$(os)_$(arch)'  -ldflags "-s -w" -trimpath
+#	GOROOT_FINAL=Git/ GOOS=$(os) GOARCH=$(arch) GOARM=6 go build -o './dist/zoraxy_$(os)_$(arch)'  -ldflags "-s -w" -trimpath
 
 
 fixwindows:

src/acme.go

@@ -1,10 +1,19 @@
 package main
 
 import (
+	"encoding/json"
+	"fmt"
+	"io"
 	"log"
+	"math/rand"
 	"net/http"
+	"regexp"
+	"strconv"
+	"time"
 
+	"imuslab.com/zoraxy/mod/acme"
 	"imuslab.com/zoraxy/mod/dynamicproxy"
+	"imuslab.com/zoraxy/mod/utils"
 )
 
 /*
@@ -13,23 +22,116 @@ import (
 	This script handle special routing required for acme auto cert renew functions
 */
 
+// Helper function to generate a random port above a specified value
+func getRandomPort(minPort int) int {
+	return rand.Intn(65535-minPort) + minPort
+}
+
+// init the new ACME instance
+func initACME() *acme.ACMEHandler {
+	log.Println("Starting ACME handler")
+	rand.Seed(time.Now().UnixNano())
+	// Generate a random port above 30000
+	port := getRandomPort(30000)
+
+	// Check if the port is already in use
+	for acme.IsPortInUse(port) {
+		port = getRandomPort(30000)
+	}
+
+	return acme.NewACME("https://acme-v02.api.letsencrypt.org/directory", strconv.Itoa(port))
+}
+
+// create the special routing rule for ACME
 func acmeRegisterSpecialRoutingRule() {
+	log.Println("Assigned temporary port:" + acmeHandler.Getport())
+
 	err := dynamicProxyRouter.AddRoutingRules(&dynamicproxy.RoutingRule{
 		ID: "acme-autorenew",
 		MatchRule: func(r *http.Request) bool {
-			if r.RequestURI == "/.well-known/" {
-				return true
-			}
-
-			return false
+			found, _ := regexp.MatchString("/.well-known/acme-challenge/*", r.RequestURI)
+			return found
 		},
 		RoutingHandler: func(w http.ResponseWriter, r *http.Request) {
-			w.Write([]byte("HELLO WORLD, THIS IS ACME REQUEST HANDLER"))
+
+			req, err := http.NewRequest(http.MethodGet, "http://localhost:"+acmeHandler.Getport()+r.RequestURI, nil)
+			req.Host = r.Host
+			if err != nil {
+				fmt.Printf("client: could not create request: %s\n", err)
+				return
+			}
+			res, err := http.DefaultClient.Do(req)
+			if err != nil {
+				fmt.Printf("client: error making http request: %s\n", err)
+				return
+			}
+
+			resBody, err := io.ReadAll(res.Body)
+			defer res.Body.Close()
+			if err != nil {
+				fmt.Printf("error reading: %s\n", err)
+				return
+			}
+			w.Write(resBody)
 		},
-		Enabled: true,
+		Enabled:                true,
+		UseSystemAccessControl: false,
 	})
 
 	if err != nil {
 		log.Println("[Err] " + err.Error())
 	}
 }
+
+// This function check if the renew setup is satisfied. If not, toggle them automatically
+func AcmeCheckAndHandleRenewCertificate(w http.ResponseWriter, r *http.Request) {
+	isForceHttpsRedirectEnabledOriginally := false
+	if dynamicProxyRouter.Option.Port == 443 {
+		//Enable port 80 to 443 redirect
+		if !dynamicProxyRouter.Option.ForceHttpsRedirect {
+			log.Println("Temporary enabling HTTP to HTTPS redirect for ACME certificate renew requests")
+			dynamicProxyRouter.UpdateHttpToHttpsRedirectSetting(true)
+		} else {
+			//Set this to true, so after renew, do not turn it off
+			isForceHttpsRedirectEnabledOriginally = true
+		}
+
+	} else if dynamicProxyRouter.Option.Port == 80 {
+		//Go ahead
+
+	} else {
+		//This port do not support ACME
+		utils.SendErrorResponse(w, "ACME renew only support web server listening on port 80 (http) or 443 (https)")
+	}
+
+	// Pass over to the acmeHandler to deal with the communication
+	acmeHandler.HandleRenewCertificate(w, r)
+
+	if dynamicProxyRouter.Option.Port == 443 {
+		if !isForceHttpsRedirectEnabledOriginally {
+			//Default is off. Turn the redirection off
+			log.Println("Restoring HTTP to HTTPS redirect settings")
+			dynamicProxyRouter.UpdateHttpToHttpsRedirectSetting(false)
+		}
+	}
+}
+
+// HandleACMEPreferredCA return the user preferred / default CA for new subdomain auto creation
+func HandleACMEPreferredCA(w http.ResponseWriter, r *http.Request) {
+	ca, err := utils.PostPara(r, "set")
+	if err != nil {
+		//Return the current ca to user
+		prefCA := "Let's Encrypt"
+		sysdb.Read("acmepref", "prefca", &prefCA)
+		js, _ := json.Marshal(prefCA)
+		utils.SendJSONResponse(w, string(js))
+	} else {
+		//Check if the CA is supported
+		acme.IsSupportedCA(ca)
+		//Set the new config
+		sysdb.Write("acmepref", "prefca", ca)
+		log.Println("Updating prefered ACME CA to " + ca)
+		utils.SendOK(w)
+	}
+
+}

src/api.go

@@ -3,7 +3,9 @@ package main
 import (
 	"encoding/json"
 	"net/http"
+	"net/http/pprof"
 
+	"imuslab.com/zoraxy/mod/acme/acmewizard"
 	"imuslab.com/zoraxy/mod/auth"
 	"imuslab.com/zoraxy/mod/netstat"
 	"imuslab.com/zoraxy/mod/netutils"
@@ -53,12 +55,20 @@ func initAPIs() {
 	authRouter.HandleFunc("/api/proxy/setIncoming", HandleIncomingPortSet)
 	authRouter.HandleFunc("/api/proxy/useHttpsRedirect", HandleUpdateHttpsRedirect)
 	authRouter.HandleFunc("/api/proxy/requestIsProxied", HandleManagementProxyCheck)
+	//Reverse proxy root related APIs
+	authRouter.HandleFunc("/api/proxy/root/listOptions", HandleRootRouteOptionList)
+	authRouter.HandleFunc("/api/proxy/root/updateOptions", HandleRootRouteOptionsUpdate)
+	//Reverse proxy auth related APIs
+	authRouter.HandleFunc("/api/proxy/auth/exceptions/list", ListProxyBasicAuthExceptionPaths)
+	authRouter.HandleFunc("/api/proxy/auth/exceptions/add", AddProxyBasicAuthExceptionPaths)
+	authRouter.HandleFunc("/api/proxy/auth/exceptions/delete", RemoveProxyBasicAuthExceptionPaths)
 
 	//TLS / SSL config
 	authRouter.HandleFunc("/api/cert/tls", handleToggleTLSProxy)
 	authRouter.HandleFunc("/api/cert/tlsRequireLatest", handleSetTlsRequireLatest)
 	authRouter.HandleFunc("/api/cert/upload", handleCertUpload)
 	authRouter.HandleFunc("/api/cert/list", handleListCertificate)
+	authRouter.HandleFunc("/api/cert/listdomains", handleListDomains)
 	authRouter.HandleFunc("/api/cert/checkDefault", handleDefaultCertCheck)
 	authRouter.HandleFunc("/api/cert/delete", handleCertRemove)
 
@@ -135,6 +145,7 @@ func initAPIs() {
 	authRouter.HandleFunc("/api/tools/ipscan", HandleIpScan)
 	authRouter.HandleFunc("/api/tools/traceroute", netutils.HandleTraceRoute)
 	authRouter.HandleFunc("/api/tools/ping", netutils.HandlePing)
+	authRouter.HandleFunc("/api/tools/whois", netutils.HandleWhois)
 	authRouter.HandleFunc("/api/tools/webssh", HandleCreateProxySession)
 	authRouter.HandleFunc("/api/tools/websshSupported", HandleWebSshSupportCheck)
 	authRouter.HandleFunc("/api/tools/wol", HandleWakeOnLan)
@@ -147,8 +158,44 @@ func initAPIs() {
 	http.HandleFunc("/api/account/reset", HandleAdminAccountResetEmail)
 	http.HandleFunc("/api/account/new", HandleNewPasswordSetup)
 
+	//ACME & Auto Renewer
+	authRouter.HandleFunc("/api/acme/listExpiredDomains", acmeHandler.HandleGetExpiredDomains)
+	authRouter.HandleFunc("/api/acme/obtainCert", AcmeCheckAndHandleRenewCertificate)
+	authRouter.HandleFunc("/api/acme/autoRenew/enable", acmeAutoRenewer.HandleAutoRenewEnable)
+	authRouter.HandleFunc("/api/acme/autoRenew/ca", HandleACMEPreferredCA)
+	authRouter.HandleFunc("/api/acme/autoRenew/email", acmeAutoRenewer.HandleACMEEmail)
+	authRouter.HandleFunc("/api/acme/autoRenew/setDomains", acmeAutoRenewer.HandleSetAutoRenewDomains)
+	authRouter.HandleFunc("/api/acme/autoRenew/listDomains", acmeAutoRenewer.HandleLoadAutoRenewDomains)
+	authRouter.HandleFunc("/api/acme/autoRenew/renewPolicy", acmeAutoRenewer.HandleRenewPolicy)
+	authRouter.HandleFunc("/api/acme/autoRenew/renewNow", acmeAutoRenewer.HandleRenewNow)
+	authRouter.HandleFunc("/api/acme/wizard", acmewizard.HandleGuidedStepCheck) //ACME Wizard
+
+	//Static Web Server
+	authRouter.HandleFunc("/api/webserv/status", staticWebServer.HandleGetStatus)
+	authRouter.HandleFunc("/api/webserv/start", staticWebServer.HandleStartServer)
+	authRouter.HandleFunc("/api/webserv/stop", staticWebServer.HandleStopServer)
+	authRouter.HandleFunc("/api/webserv/setPort", staticWebServer.HandlePortChange)
+	authRouter.HandleFunc("/api/webserv/setDirList", staticWebServer.SetEnableDirectoryListing)
+	if *allowWebFileManager {
+		//Web Directory Manager file operation functions
+		authRouter.HandleFunc("/api/fs/list", staticWebServer.FileManager.HandleList)
+		authRouter.HandleFunc("/api/fs/upload", staticWebServer.FileManager.HandleUpload)
+		authRouter.HandleFunc("/api/fs/download", staticWebServer.FileManager.HandleDownload)
+		authRouter.HandleFunc("/api/fs/newFolder", staticWebServer.FileManager.HandleNewFolder)
+		authRouter.HandleFunc("/api/fs/copy", staticWebServer.FileManager.HandleFileCopy)
+		authRouter.HandleFunc("/api/fs/move", staticWebServer.FileManager.HandleFileMove)
+		authRouter.HandleFunc("/api/fs/properties", staticWebServer.FileManager.HandleFileProperties)
+		authRouter.HandleFunc("/api/fs/del", staticWebServer.FileManager.HandleFileDelete)
+	}
+
 	//Others
 	http.HandleFunc("/api/info/x", HandleZoraxyInfo)
+	authRouter.HandleFunc("/api/info/geoip", HandleGeoIpLookup)
+	authRouter.HandleFunc("/api/conf/export", ExportConfigAsZip)
+	authRouter.HandleFunc("/api/conf/import", ImportConfigFromZip)
+
+	//Debug
+	authRouter.HandleFunc("/api/info/pprof", pprof.Index)
 
 	//If you got APIs to add, append them here
 }

src/cert.go

@@ -10,6 +10,8 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"strings"
+	"time"
 
 	"imuslab.com/zoraxy/mod/utils"
 )
@@ -44,6 +46,7 @@ func handleListCertificate(w http.ResponseWriter, r *http.Request) {
 			Domain           string
 			LastModifiedDate string
 			ExpireDate       string
+			RemainingDays    int
 		}
 
 		results := []*CertInfo{}
@@ -60,6 +63,7 @@ func handleListCertificate(w http.ResponseWriter, r *http.Request) {
 
 			certExpireTime := "Unknown"
 			certBtyes, err := os.ReadFile(certFilepath)
+			expiredIn := 0
 			if err != nil {
 				//Unable to load this file
 				continue
@@ -70,6 +74,11 @@ func handleListCertificate(w http.ResponseWriter, r *http.Request) {
 					cert, err := x509.ParseCertificate(block.Bytes)
 					if err == nil {
 						certExpireTime = cert.NotAfter.Format("2006-01-02 15:04:05")
+
+						duration := cert.NotAfter.Sub(time.Now())
+
+						// Convert the duration to days
+						expiredIn = int(duration.Hours() / 24)
 					}
 				}
 			}
@@ -78,6 +87,7 @@ func handleListCertificate(w http.ResponseWriter, r *http.Request) {
 				Domain:           filename,
 				LastModifiedDate: modifiedTime,
 				ExpireDate:       certExpireTime,
+				RemainingDays:    expiredIn,
 			}
 
 			results = append(results, &thisCertInfo)
@@ -99,6 +109,64 @@ func handleListCertificate(w http.ResponseWriter, r *http.Request) {
 
 }
 
+// List all certificates and map all their domains to the cert filename
+func handleListDomains(w http.ResponseWriter, r *http.Request) {
+	filenames, err := os.ReadDir("./conf/certs/")
+
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+
+	certnameToDomainMap := map[string]string{}
+	for _, filename := range filenames {
+		if filename.IsDir() {
+			continue
+		}
+		certFilepath := filepath.Join("./conf/certs/", filename.Name())
+
+		certBtyes, err := os.ReadFile(certFilepath)
+		if err != nil {
+			// Unable to load this file
+			log.Println("Unable to load certificate: " + certFilepath)
+			continue
+		} else {
+			// Cert loaded. Check its expiry time
+			block, _ := pem.Decode(certBtyes)
+			if block != nil {
+				cert, err := x509.ParseCertificate(block.Bytes)
+				if err == nil {
+					certname := strings.TrimSuffix(filepath.Base(certFilepath), filepath.Ext(certFilepath))
+					for _, dnsName := range cert.DNSNames {
+						certnameToDomainMap[dnsName] = certname
+					}
+					certnameToDomainMap[cert.Subject.CommonName] = certname
+				}
+			}
+		}
+	}
+
+	requireCompact, _ := utils.GetPara(r, "compact")
+	if requireCompact == "true" {
+		result := make(map[string][]string)
+
+		for key, value := range certnameToDomainMap {
+			if _, ok := result[value]; !ok {
+				result[value] = make([]string, 0)
+			}
+
+			result[value] = append(result[value], key)
+		}
+
+		js, _ := json.Marshal(result)
+		utils.SendJSONResponse(w, string(js))
+		return
+	}
+
+	js, _ := json.Marshal(certnameToDomainMap)
+	utils.SendJSONResponse(w, string(js))
+}
+
 // Handle front-end toggling TLS mode
 func handleToggleTLSProxy(w http.ResponseWriter, r *http.Request) {
 	currentTlsSetting := false
@@ -205,8 +273,8 @@ func handleCertUpload(w http.ResponseWriter, r *http.Request) {
 	defer file.Close()
 
 	// create file in upload directory
-	os.MkdirAll("./certs", 0775)
-	f, err := os.Create(filepath.Join("./certs", overWriteFilename))
+	os.MkdirAll("./conf/certs", 0775)
+	f, err := os.Create(filepath.Join("./conf/certs", overWriteFilename))
 	if err != nil {
 		http.Error(w, "Failed to create file", http.StatusInternalServerError)
 		return

src/config.go

@@ -1,12 +1,17 @@
 package main
 
 import (
+	"archive/zip"
 	"encoding/json"
-	"io/ioutil"
+	"fmt"
+	"io"
 	"log"
+	"net/http"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"time"
 
 	"imuslab.com/zoraxy/mod/dynamicproxy"
 	"imuslab.com/zoraxy/mod/utils"
@@ -20,18 +25,20 @@ import (
 */
 
 type Record struct {
-	ProxyType            string
-	Rootname             string
-	ProxyTarget          string
-	UseTLS               bool
-	SkipTlsValidation    bool
-	RequireBasicAuth     bool
-	BasicAuthCredentials []*dynamicproxy.BasicAuthCredentials
+	ProxyType               string
+	Rootname                string
+	ProxyTarget             string
+	UseTLS                  bool
+	SkipTlsValidation       bool
+	RequireBasicAuth        bool
+	BasicAuthCredentials    []*dynamicproxy.BasicAuthCredentials
+	BasicAuthExceptionRules []*dynamicproxy.BasicAuthExceptionRule
 }
 
-func SaveReverseProxyConfig(proxyConfigRecord *Record) error {
+// Save a reverse proxy config record to file
+func SaveReverseProxyConfigToFile(proxyConfigRecord *Record) error {
 	//TODO: Make this accept new def types
-	os.MkdirAll("conf", 0775)
+	os.MkdirAll("./conf/proxy/", 0775)
 	filename := getFilenameFromRootName(proxyConfigRecord.Rootname)
 
 	//Generate record
@@ -39,12 +46,21 @@ func SaveReverseProxyConfig(proxyConfigRecord *Record) error {
 
 	//Write to file
 	js, _ := json.MarshalIndent(thisRecord, "", " ")
-	return ioutil.WriteFile(filepath.Join("conf", filename), js, 0775)
+	return os.WriteFile(filepath.Join("./conf/proxy/", filename), js, 0775)
 }
 
-func RemoveReverseProxyConfig(rootname string) error {
+// Save a running reverse proxy endpoint to file (with automatic endpoint to record conversion)
+func SaveReverseProxyEndpointToFile(proxyEndpoint *dynamicproxy.ProxyEndpoint) error {
+	recordToSave, err := ConvertProxyEndpointToRecord(proxyEndpoint)
+	if err != nil {
+		return err
+	}
+	return SaveReverseProxyConfigToFile(recordToSave)
+}
+
+func RemoveReverseProxyConfigFile(rootname string) error {
 	filename := getFilenameFromRootName(rootname)
-	removePendingFile := strings.ReplaceAll(filepath.Join("conf", filename), "\\", "/")
+	removePendingFile := strings.ReplaceAll(filepath.Join("./conf/proxy/", filename), "\\", "/")
 	log.Println("Config Removed: ", removePendingFile)
 	if utils.FileExists(removePendingFile) {
 		err := os.Remove(removePendingFile)
@@ -60,8 +76,18 @@ func RemoveReverseProxyConfig(rootname string) error {
 
 // Return ptype, rootname and proxyTarget, error if any
 func LoadReverseProxyConfig(filename string) (*Record, error) {
-	thisRecord := Record{}
-	configContent, err := ioutil.ReadFile(filename)
+	thisRecord := Record{
+		ProxyType:               "",
+		Rootname:                "",
+		ProxyTarget:             "",
+		UseTLS:                  false,
+		SkipTlsValidation:       false,
+		RequireBasicAuth:        false,
+		BasicAuthCredentials:    []*dynamicproxy.BasicAuthCredentials{},
+		BasicAuthExceptionRules: []*dynamicproxy.BasicAuthExceptionRule{},
+	}
+
+	configContent, err := os.ReadFile(filename)
 	if err != nil {
 		return &thisRecord, err
 	}
@@ -76,6 +102,22 @@ func LoadReverseProxyConfig(filename string) (*Record, error) {
 	return &thisRecord, nil
 }
 
+// Convert a running proxy endpoint object into a save-able record struct
+func ConvertProxyEndpointToRecord(targetProxyEndpoint *dynamicproxy.ProxyEndpoint) (*Record, error) {
+	thisProxyConfigRecord := Record{
+		ProxyType:               targetProxyEndpoint.GetProxyTypeString(),
+		Rootname:                targetProxyEndpoint.RootOrMatchingDomain,
+		ProxyTarget:             targetProxyEndpoint.Domain,
+		UseTLS:                  targetProxyEndpoint.RequireTLS,
+		SkipTlsValidation:       targetProxyEndpoint.SkipCertValidations,
+		RequireBasicAuth:        targetProxyEndpoint.RequireBasicAuth,
+		BasicAuthCredentials:    targetProxyEndpoint.BasicAuthCredentials,
+		BasicAuthExceptionRules: targetProxyEndpoint.BasicAuthExceptionRules,
+	}
+
+	return &thisProxyConfigRecord, nil
+}
+
 func getFilenameFromRootName(rootname string) string {
 	//Generate a filename for this rootname
 	filename := strings.ReplaceAll(rootname, ".", "_")
@@ -83,3 +125,202 @@ func getFilenameFromRootName(rootname string) string {
 	filename = filename + ".config"
 	return filename
 }
+
+/*
+	Importer and Exporter of Zoraxy proxy config
+*/
+
+func ExportConfigAsZip(w http.ResponseWriter, r *http.Request) {
+	includeSysDBRaw, err := utils.GetPara(r, "includeDB")
+	includeSysDB := false
+	if includeSysDBRaw == "true" {
+		//Include the system database in backup snapshot
+		//Temporary set it to read only
+		sysdb.ReadOnly = true
+		includeSysDB = true
+	}
+
+	// Specify the folder path to be zipped
+	folderPath := "./conf/"
+
+	// Set the Content-Type header to indicate it's a zip file
+	w.Header().Set("Content-Type", "application/zip")
+	// Set the Content-Disposition header to specify the file name
+	w.Header().Set("Content-Disposition", "attachment; filename=\"config.zip\"")
+
+	// Create a zip writer
+	zipWriter := zip.NewWriter(w)
+	defer zipWriter.Close()
+
+	// Walk through the folder and add files to the zip
+	err = filepath.Walk(folderPath, func(filePath string, fileInfo os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if folderPath == filePath {
+			//Skip root folder
+			return nil
+		}
+
+		// Create a new file in the zip
+		if !utils.IsDir(filePath) {
+			zipFile, err := zipWriter.Create(filePath)
+			if err != nil {
+				return err
+			}
+
+			// Open the file on disk
+			file, err := os.Open(filePath)
+			if err != nil {
+				return err
+			}
+			defer file.Close()
+
+			// Copy the file contents to the zip file
+			_, err = io.Copy(zipFile, file)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+
+	if includeSysDB {
+		//Also zip in the sysdb
+		zipFile, err := zipWriter.Create("sys.db")
+		if err != nil {
+			log.Println("[Backup] Unable to zip sysdb: " + err.Error())
+			return
+		}
+
+		// Open the file on disk
+		file, err := os.Open("sys.db")
+		if err != nil {
+			log.Println("[Backup] Unable to open sysdb: " + err.Error())
+			return
+		}
+		defer file.Close()
+
+		// Copy the file contents to the zip file
+		_, err = io.Copy(zipFile, file)
+		if err != nil {
+			log.Println(err)
+			return
+		}
+
+		//Restore sysdb state
+		sysdb.ReadOnly = false
+	}
+
+	if err != nil {
+		// Handle the error and send an HTTP response with the error message
+		http.Error(w, fmt.Sprintf("Failed to zip folder: %v", err), http.StatusInternalServerError)
+		return
+	}
+}
+
+func ImportConfigFromZip(w http.ResponseWriter, r *http.Request) {
+	// Check if the request is a POST with a file upload
+	if r.Method != http.MethodPost {
+		http.Error(w, "Invalid request method", http.StatusBadRequest)
+		return
+	}
+
+	// Max file size limit (10 MB in this example)
+	r.ParseMultipartForm(10 << 20)
+
+	// Get the uploaded file
+	file, handler, err := r.FormFile("file")
+	if err != nil {
+		http.Error(w, "Failed to retrieve uploaded file", http.StatusInternalServerError)
+		return
+	}
+	defer file.Close()
+
+	if filepath.Ext(handler.Filename) != ".zip" {
+		http.Error(w, "Upload file is not a zip file", http.StatusInternalServerError)
+		return
+	}
+	// Create the target directory to unzip the files
+	targetDir := "./conf"
+	if utils.FileExists(targetDir) {
+		//Backup the old config to old
+		os.Rename("./conf", "./conf.old_"+strconv.Itoa(int(time.Now().Unix())))
+	}
+
+	err = os.MkdirAll(targetDir, os.ModePerm)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("Failed to create target directory: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	// Open the zip file
+	zipReader, err := zip.NewReader(file, handler.Size)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("Failed to open zip file: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	restoreDatabase := false
+
+	// Extract each file from the zip archive
+	for _, zipFile := range zipReader.File {
+		// Open the file in the zip archive
+		rc, err := zipFile.Open()
+		if err != nil {
+			http.Error(w, fmt.Sprintf("Failed to open file in zip: %v", err), http.StatusInternalServerError)
+			return
+		}
+		defer rc.Close()
+
+		// Create the corresponding file on disk
+		zipFile.Name = strings.ReplaceAll(zipFile.Name, "../", "")
+		fmt.Println("Restoring: " + strings.ReplaceAll(zipFile.Name, "\\", "/"))
+		if zipFile.Name == "sys.db" {
+			//Sysdb replacement. Close the database and restore
+			sysdb.Close()
+			restoreDatabase = true
+		} else if !strings.HasPrefix(strings.ReplaceAll(zipFile.Name, "\\", "/"), "conf/") {
+			//Malformed zip file.
+			http.Error(w, fmt.Sprintf("Invalid zip file structure or version too old"), http.StatusInternalServerError)
+			return
+		}
+
+		//Check if parent dir exists
+		if !utils.FileExists(filepath.Dir(zipFile.Name)) {
+			os.MkdirAll(filepath.Dir(zipFile.Name), 0775)
+		}
+
+		//Create the file
+		newFile, err := os.Create(zipFile.Name)
+		if err != nil {
+			http.Error(w, fmt.Sprintf("Failed to create file: %v", err), http.StatusInternalServerError)
+			return
+		}
+		defer newFile.Close()
+
+		// Copy the file contents from the zip to the new file
+		_, err = io.Copy(newFile, rc)
+		if err != nil {
+			http.Error(w, fmt.Sprintf("Failed to extract file from zip: %v", err), http.StatusInternalServerError)
+			return
+		}
+	}
+
+	// Send a success response
+	w.WriteHeader(http.StatusOK)
+	log.Println("Configuration restored")
+	fmt.Fprintln(w, "Configuration restored")
+
+	if restoreDatabase {
+		go func() {
+			log.Println("Database altered. Restarting in 3 seconds...")
+			time.Sleep(3 * time.Second)
+			os.Exit(0)
+		}()
+
+	}
+
+}

src/emails.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	uuid "github.com/satori/go.uuid"
+	"github.com/google/uuid"
 	"imuslab.com/zoraxy/mod/email"
 	"imuslab.com/zoraxy/mod/utils"
 )
@@ -180,7 +180,7 @@ func setSMTPAdminAddress(adminAddr string) error {
 	return sysdb.Write("smtp", "admin", adminAddr)
 }
 
-//Load SMTP admin address. Return empty string if not set
+// Load SMTP admin address. Return empty string if not set
 func loadSMTPAdminAddr() string {
 	adminAddr := ""
 	if sysdb.KeyExists("smtp", "admin") {
@@ -223,7 +223,7 @@ func HandleAdminAccountResetEmail(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	passwordResetAccessToken = uuid.NewV4().String()
+	passwordResetAccessToken = uuid.New().String()
 
 	//SMTP info exists. Send reset account email
 	lastAccountResetEmail = time.Now().Unix()

src/geoip.go

@@ -1,39 +0,0 @@
-package main
-
-import (
-	"net"
-	"net/http"
-	"strings"
-
-	"github.com/oschwald/geoip2-golang"
-)
-
-func getCountryCodeFromRequest(r *http.Request) string {
-	countryCode := ""
-
-	// Get the IP address of the user from the request headers
-	ipAddress := r.Header.Get("X-Forwarded-For")
-	if ipAddress == "" {
-		ipAddress = strings.Split(r.RemoteAddr, ":")[0]
-	}
-
-	// Open the GeoIP database
-	db, err := geoip2.Open("./tmp/GeoIP2-Country.mmdb")
-	if err != nil {
-		// Handle the error
-		return countryCode
-	}
-	defer db.Close()
-
-	// Look up the country code for the IP address
-	record, err := db.Country(net.ParseIP(ipAddress))
-	if err != nil {
-		// Handle the error
-		return countryCode
-	}
-
-	// Get the ISO country code from the record
-	countryCode = record.Country.IsoCode
-
-	return countryCode
-}

src/go.mod

@@ -4,14 +4,15 @@ go 1.16
 
 require (
 	github.com/boltdb/bolt v1.3.1
+	github.com/go-acme/lego/v4 v4.14.0
 	github.com/go-ping/ping v1.1.0
-	github.com/google/uuid v1.3.0
+	github.com/google/uuid v1.3.1
 	github.com/gorilla/sessions v1.2.1
-	github.com/gorilla/websocket v1.4.2
+	github.com/gorilla/websocket v1.5.0
 	github.com/grandcat/zeroconf v1.0.0
-	github.com/microcosm-cc/bluemonday v1.0.24
-	github.com/oschwald/geoip2-golang v1.8.0
-	github.com/satori/go.uuid v1.2.0
-	golang.org/x/net v0.10.0
-	golang.org/x/sys v0.8.0
+	github.com/likexian/whois v1.15.1
+	github.com/microcosm-cc/bluemonday v1.0.25
+	golang.org/x/net v0.14.0
+	golang.org/x/sys v0.11.0
+	golang.org/x/tools v0.12.0 // indirect
 )

src/main.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	"imuslab.com/zoraxy/mod/acme"
 	"imuslab.com/zoraxy/mod/aroz"
 	"imuslab.com/zoraxy/mod/auth"
 	"imuslab.com/zoraxy/mod/database"
@@ -29,17 +30,24 @@ import (
 	"imuslab.com/zoraxy/mod/tlscert"
 	"imuslab.com/zoraxy/mod/uptime"
 	"imuslab.com/zoraxy/mod/utils"
+	"imuslab.com/zoraxy/mod/webserv"
 )
 
 // General flags
 var noauth = flag.Bool("noauth", false, "Disable authentication for management interface")
 var showver = flag.Bool("version", false, "Show version of this server")
 var allowSshLoopback = flag.Bool("sshlb", false, "Allow loopback web ssh connection (DANGER)")
+var allowMdnsScanning = flag.Bool("mdns", true, "Enable mDNS scanner and transponder")
 var ztAuthToken = flag.String("ztauth", "", "ZeroTier authtoken for the local node")
 var ztAPIPort = flag.Int("ztport", 9993, "ZeroTier controller API port")
+var acmeAutoRenewInterval = flag.Int("autorenew", 86400, "ACME auto TLS/SSL certificate renew check interval (seconds)")
+var enableHighSpeedGeoIPLookup = flag.Bool("fastgeoip", false, "Enable high speed geoip lookup, require 1GB extra memory (Not recommend for low end devices)")
+var staticWebServerRoot = flag.String("webroot", "./www", "Static web server root folder. Only allow chnage in start paramters")
+var allowWebFileManager = flag.Bool("webfm", true, "Enable web file manager for static web server root folder")
+
 var (
 	name        = "Zoraxy"
-	version     = "2.6.4"
+	version     = "2.6.7"
 	nodeUUID    = "generic"
 	development = false //Set this to false to use embedded web fs
 	bootTime    = time.Now().Unix()
@@ -67,6 +75,9 @@ var (
 	ganManager         *ganserv.NetworkManager //Global Area Network Manager
 	webSshManager      *sshprox.Manager        //Web SSH connection service
 	tcpProxyManager    *tcpprox.Manager        //TCP Proxy Manager
+	acmeHandler        *acme.ACMEHandler       //Handler for ACME Certificate renew
+	acmeAutoRenewer    *acme.AutoRenewer       //Handler for ACME auto renew ticking
+	staticWebServer    *webserv.WebServer      //Static web server for hosting simple stuffs
 
 	//Helper modules
 	EmailSender    *email.Sender        //Email sender that handle email sending
@@ -79,29 +90,37 @@ func SetupCloseHandler() {
 	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
 	go func() {
 		<-c
-		fmt.Println("- Shutting down " + name)
-		fmt.Println("- Closing GeoDB ")
-		geodbStore.Close()
-		fmt.Println("- Closing Netstats Listener")
-		netstatBuffers.Close()
-		fmt.Println("- Closing Statistic Collector")
-		statisticCollector.Close()
-		fmt.Println("- Stopping mDNS Discoverer")
-		//Stop the mdns service
-		mdnsTickerStop <- true
-		mdnsScanner.Close()
-
-		//Remove the tmp folder
-		fmt.Println("- Cleaning up tmp files")
-		os.RemoveAll("./tmp")
-
-		//Close database, final
-		fmt.Println("- Stopping system database")
-		sysdb.Close()
+		ShutdownSeq()
 		os.Exit(0)
 	}()
 }
 
+func ShutdownSeq() {
+	fmt.Println("- Shutting down " + name)
+	fmt.Println("- Closing GeoDB ")
+	geodbStore.Close()
+	fmt.Println("- Closing Netstats Listener")
+	netstatBuffers.Close()
+	fmt.Println("- Closing Statistic Collector")
+	statisticCollector.Close()
+	if mdnsTickerStop != nil {
+		fmt.Println("- Stopping mDNS Discoverer (might take a few minutes)")
+		// Stop the mdns service
+		mdnsTickerStop <- true
+	}
+
+	mdnsScanner.Close()
+	fmt.Println("- Closing Certificates Auto Renewer")
+	acmeAutoRenewer.Close()
+	//Remove the tmp folder
+	fmt.Println("- Cleaning up tmp files")
+	os.RemoveAll("./tmp")
+
+	//Close database, final
+	fmt.Println("- Stopping system database")
+	sysdb.Close()
+}
+
 func main() {
 	//Start the aoModule pipeline (which will parse the flags as well). Pass in the module launch information
 	handler = aroz.HandleFlagParse(aroz.ServiceInfo{

src/mod/acme/acme.go

@@ -0,0 +1,377 @@
+package acme
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-acme/lego/v4/certcrypto"
+	"github.com/go-acme/lego/v4/certificate"
+	"github.com/go-acme/lego/v4/challenge/http01"
+	"github.com/go-acme/lego/v4/lego"
+	"github.com/go-acme/lego/v4/registration"
+	"imuslab.com/zoraxy/mod/utils"
+)
+
+type CertificateInfoJSON struct {
+	AcmeName string `json:"acme_name"`
+	AcmeUrl  string `json:"acme_url"`
+	SkipTLS  bool   `json:"skip_tls"`
+}
+
+// ACMEUser represents a user in the ACME system.
+type ACMEUser struct {
+	Email        string
+	Registration *registration.Resource
+	key          crypto.PrivateKey
+}
+
+// GetEmail returns the email of the ACMEUser.
+func (u *ACMEUser) GetEmail() string {
+	return u.Email
+}
+
+// GetRegistration returns the registration resource of the ACMEUser.
+func (u ACMEUser) GetRegistration() *registration.Resource {
+	return u.Registration
+}
+
+// GetPrivateKey returns the private key of the ACMEUser.
+func (u *ACMEUser) GetPrivateKey() crypto.PrivateKey {
+	return u.key
+}
+
+// ACMEHandler handles ACME-related operations.
+type ACMEHandler struct {
+	DefaultAcmeServer string
+	Port              string
+}
+
+// NewACME creates a new ACMEHandler instance.
+func NewACME(acmeServer string, port string) *ACMEHandler {
+	return &ACMEHandler{
+		DefaultAcmeServer: acmeServer,
+		Port:              port,
+	}
+}
+
+// ObtainCert obtains a certificate for the specified domains.
+func (a *ACMEHandler) ObtainCert(domains []string, certificateName string, email string, caName string, caUrl string, skipTLS bool) (bool, error) {
+	log.Println("[ACME] Obtaining certificate...")
+
+	// generate private key
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		log.Println(err)
+		return false, err
+	}
+
+	// create a admin user for our new generation
+	adminUser := ACMEUser{
+		Email: email,
+		key:   privateKey,
+	}
+
+	// create config
+	config := lego.NewConfig(&adminUser)
+
+	// skip TLS verify if need
+	// Ref: https://github.com/go-acme/lego/blob/6af2c756ac73a9cb401621afca722d0f4112b1b8/lego/client_config.go#L74
+	if skipTLS {
+		log.Println("[INFO] Ignore TLS/SSL Verification Error for ACME Server")
+		config.HTTPClient.Transport = &http.Transport{
+			Proxy: http.ProxyFromEnvironment,
+			DialContext: (&net.Dialer{
+				Timeout:   30 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+			TLSHandshakeTimeout:   30 * time.Second,
+			ResponseHeaderTimeout: 30 * time.Second,
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: true,
+			},
+		}
+	}
+
+	// setup the custom ACME url endpoint.
+	if caUrl != "" {
+		config.CADirURL = caUrl
+	}
+
+	// if not custom ACME url, load it from ca.json
+	if caName == "custom" {
+		log.Println("[INFO] Using Custom ACME " + caUrl + " for CA Directory URL")
+	} else {
+		caLinkOverwrite, err := loadCAApiServerFromName(caName)
+		if err == nil {
+			config.CADirURL = caLinkOverwrite
+			log.Println("[INFO] Using " + caLinkOverwrite + " for CA Directory URL")
+		} else {
+			// (caName == "" || caUrl == "") will use default acme
+			config.CADirURL = a.DefaultAcmeServer
+			log.Println("[INFO] Using Default ACME " + a.DefaultAcmeServer + " for CA Directory URL")
+		}
+	}
+
+	config.Certificate.KeyType = certcrypto.RSA2048
+
+	client, err := lego.NewClient(config)
+	if err != nil {
+		log.Println(err)
+		return false, err
+	}
+
+	// setup how to receive challenge
+	err = client.Challenge.SetHTTP01Provider(http01.NewProviderServer("", a.Port))
+	if err != nil {
+		log.Println(err)
+		return false, err
+	}
+
+	// New users will need to register
+	reg, err := client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
+	if err != nil {
+		log.Println(err)
+		return false, err
+	}
+	adminUser.Registration = reg
+
+	// obtain the certificate
+	request := certificate.ObtainRequest{
+		Domains: domains,
+		Bundle:  true,
+	}
+	certificates, err := client.Certificate.Obtain(request)
+	if err != nil {
+		log.Println(err)
+		return false, err
+	}
+
+	// Each certificate comes back with the cert bytes, the bytes of the client's
+	// private key, and a certificate URL.
+	err = os.WriteFile("./conf/certs/"+certificateName+".crt", certificates.Certificate, 0777)
+	if err != nil {
+		log.Println(err)
+		return false, err
+	}
+	err = os.WriteFile("./conf/certs/"+certificateName+".key", certificates.PrivateKey, 0777)
+	if err != nil {
+		log.Println(err)
+		return false, err
+	}
+
+	// Save certificate's ACME info for renew usage
+	certInfo := &CertificateInfoJSON{
+		AcmeName: caName,
+		AcmeUrl:  caUrl,
+		SkipTLS:  skipTLS,
+	}
+
+	certInfoBytes, err := json.Marshal(certInfo)
+	if err != nil {
+		log.Println(err)
+		return false, err
+	}
+
+	err = os.WriteFile("./conf/certs/"+certificateName+".json", certInfoBytes, 0777)
+	if err != nil {
+		log.Println(err)
+		return false, err
+	}
+
+	return true, nil
+}
+
+// CheckCertificate returns a list of domains that are in expired certificates.
+// It will return all domains that is in expired certificates
+// *** if there is a vaild certificate contains the domain and there is a expired certificate contains the same domain
+// it will said expired as well!
+func (a *ACMEHandler) CheckCertificate() []string {
+	// read from dir
+	filenames, err := os.ReadDir("./conf/certs/")
+
+	expiredCerts := []string{}
+
+	if err != nil {
+		log.Println(err)
+		return []string{}
+	}
+
+	for _, filename := range filenames {
+		certFilepath := filepath.Join("./conf/certs/", filename.Name())
+
+		certBytes, err := os.ReadFile(certFilepath)
+		if err != nil {
+			// Unable to load this file
+			continue
+		} else {
+			// Cert loaded. Check its expiry time
+			block, _ := pem.Decode(certBytes)
+			if block != nil {
+				cert, err := x509.ParseCertificate(block.Bytes)
+				if err == nil {
+					elapsed := time.Since(cert.NotAfter)
+					if elapsed > 0 {
+						// if it is expired then add it in
+						// make sure it's uniqueless
+						for _, dnsName := range cert.DNSNames {
+							if !contains(expiredCerts, dnsName) {
+								expiredCerts = append(expiredCerts, dnsName)
+							}
+						}
+						if !contains(expiredCerts, cert.Subject.CommonName) {
+							expiredCerts = append(expiredCerts, cert.Subject.CommonName)
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return expiredCerts
+}
+
+// return the current port number
+func (a *ACMEHandler) Getport() string {
+	return a.Port
+}
+
+// contains checks if a string is present in a slice.
+func contains(slice []string, str string) bool {
+	for _, s := range slice {
+		if s == str {
+			return true
+		}
+	}
+	return false
+}
+
+// HandleGetExpiredDomains handles the HTTP GET request to retrieve the list of expired domains.
+// It calls the CheckCertificate method to obtain the expired domains and sends a JSON response
+// containing the list of expired domains.
+func (a *ACMEHandler) HandleGetExpiredDomains(w http.ResponseWriter, r *http.Request) {
+	type ExpiredDomains struct {
+		Domain []string `json:"domain"`
+	}
+
+	info := ExpiredDomains{
+		Domain: a.CheckCertificate(),
+	}
+
+	js, _ := json.MarshalIndent(info, "", " ")
+	utils.SendJSONResponse(w, string(js))
+}
+
+// HandleRenewCertificate handles the HTTP GET request to renew a certificate for the provided domains.
+// It retrieves the domains and filename parameters from the request, calls the ObtainCert method
+// to renew the certificate, and sends a JSON response indicating the result of the renewal process.
+func (a *ACMEHandler) HandleRenewCertificate(w http.ResponseWriter, r *http.Request) {
+	domainPara, err := utils.PostPara(r, "domains")
+	if err != nil {
+		utils.SendErrorResponse(w, jsonEscape(err.Error()))
+		return
+	}
+
+	filename, err := utils.PostPara(r, "filename")
+	if err != nil {
+		utils.SendErrorResponse(w, jsonEscape(err.Error()))
+		return
+	}
+
+	email, err := utils.PostPara(r, "email")
+	if err != nil {
+		utils.SendErrorResponse(w, jsonEscape(err.Error()))
+		return
+	}
+
+	var caUrl string
+
+	ca, err := utils.PostPara(r, "ca")
+	if err != nil {
+		log.Println("[INFO] CA not set. Using default")
+		ca, caUrl = "", ""
+	}
+
+	if ca == "custom" {
+		caUrl, err = utils.PostPara(r, "caURL")
+		if err != nil {
+			log.Println("[INFO] Custom CA set but no URL provide, Using default")
+			ca, caUrl = "", ""
+		}
+	}
+
+	if ca == "" {
+		//default. Use Let's Encrypt
+		ca = "Let's Encrypt"
+	}
+
+	var skipTLS bool
+
+	if skipTLSString, err := utils.PostPara(r, "skipTLS"); err != nil {
+		skipTLS = false
+	} else if skipTLSString != "true" {
+		skipTLS = false
+	} else {
+		skipTLS = true
+	}
+
+	domains := strings.Split(domainPara, ",")
+	result, err := a.ObtainCert(domains, filename, email, ca, caUrl, skipTLS)
+	if err != nil {
+		utils.SendErrorResponse(w, jsonEscape(err.Error()))
+		return
+	}
+	utils.SendJSONResponse(w, strconv.FormatBool(result))
+}
+
+// Escape JSON string
+func jsonEscape(i string) string {
+	b, err := json.Marshal(i)
+	if err != nil {
+		log.Println("Unable to escape json data: " + err.Error())
+		return i
+	}
+	s := string(b)
+	return s[1 : len(s)-1]
+}
+
+// Helper function to check if a port is in use
+func IsPortInUse(port int) bool {
+	address := fmt.Sprintf(":%d", port)
+	listener, err := net.Listen("tcp", address)
+	if err != nil {
+		return true // Port is in use
+	}
+	defer listener.Close()
+	return false // Port is not in use
+
+}
+
+// Load cert information from json file
+func loadCertInfoJSON(filename string) (*CertificateInfoJSON, error) {
+	certInfoBytes, err := os.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+
+	certInfo := &CertificateInfoJSON{}
+	if err = json.Unmarshal(certInfoBytes, certInfo); err != nil {
+		return nil, err
+	}
+
+	return certInfo, nil
+}

src/mod/acme/acme_test.go

@@ -0,0 +1,24 @@
+package acme_test
+
+import (
+	"fmt"
+	"testing"
+
+	"imuslab.com/zoraxy/mod/acme"
+)
+
+// Test if the issuer extraction is working
+func TestExtractIssuerNameFromPEM(t *testing.T) {
+	pemFilePath := "test/stackoverflow.pem"
+	expectedIssuer := "Let's Encrypt"
+
+	issuerName, err := acme.ExtractIssuerNameFromPEM(pemFilePath)
+	fmt.Println(issuerName)
+	if err != nil {
+		t.Errorf("Error extracting issuer name: %v", err)
+	}
+
+	if issuerName != expectedIssuer {
+		t.Errorf("Unexpected issuer name. Expected: %s, Got: %s", expectedIssuer, issuerName)
+	}
+}

src/mod/acme/acmewizard/acmewizard.go

@@ -0,0 +1,163 @@
+package acmewizard
+
+import (
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"imuslab.com/zoraxy/mod/utils"
+)
+
+/*
+	ACME Wizard
+
+	This wizard help validate the acme settings and configurations
+*/
+
+func HandleGuidedStepCheck(w http.ResponseWriter, r *http.Request) {
+	stepNoStr, err := utils.GetPara(r, "step")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid step number given")
+		return
+	}
+
+	stepNo, err := strconv.Atoi(stepNoStr)
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid step number given")
+		return
+	}
+
+	if stepNo == 1 {
+		isListening, err := isLocalhostListening()
+		if err != nil {
+			utils.SendErrorResponse(w, err.Error())
+			return
+		}
+
+		js, _ := json.Marshal(isListening)
+		utils.SendJSONResponse(w, string(js))
+	} else if stepNo == 2 {
+		publicIp, err := getPublicIPAddress()
+		if err != nil {
+			utils.SendErrorResponse(w, err.Error())
+			return
+		}
+
+		publicIp = strings.TrimSpace(publicIp)
+
+		httpServerReachable := isHTTPServerAvailable(publicIp)
+
+		js, _ := json.Marshal(httpServerReachable)
+		utils.SendJSONResponse(w, string(js))
+	} else if stepNo == 3 {
+		domain, err := utils.GetPara(r, "domain")
+		if err != nil {
+			utils.SendErrorResponse(w, "domain cannot be empty")
+			return
+		}
+
+		domain = strings.TrimSpace(domain)
+
+		//Check if the domain is reachable
+		reachable := isDomainReachable(domain)
+		if !reachable {
+			utils.SendErrorResponse(w, "domain is not reachable")
+			return
+		}
+
+		//Check http is setup correctly
+		httpServerReachable := isHTTPServerAvailable(domain)
+		js, _ := json.Marshal(httpServerReachable)
+		utils.SendJSONResponse(w, string(js))
+	} else {
+		utils.SendErrorResponse(w, "invalid step number")
+	}
+}
+
+// Step 1
+func isLocalhostListening() (isListening bool, err error) {
+	timeout := 2 * time.Second
+	isListening = false
+	// Check if localhost is listening on port 80 (HTTP)
+	conn, err := net.DialTimeout("tcp", "localhost:80", timeout)
+	if err == nil {
+		isListening = true
+		conn.Close()
+	}
+
+	// Check if localhost is listening on port 443 (HTTPS)
+	conn, err = net.DialTimeout("tcp", "localhost:443", timeout)
+	if err == nil {
+		isListening = true
+		conn.Close()
+	}
+
+	if isListening {
+		return true, nil
+	}
+
+	return isListening, err
+}
+
+// Step 2
+func getPublicIPAddress() (string, error) {
+	resp, err := http.Get("http://checkip.amazonaws.com/")
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	ip, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+
+	return string(ip), nil
+}
+
+func isHTTPServerAvailable(ipAddress string) bool {
+	client := http.Client{
+		Timeout: 5 * time.Second, // Timeout for the HTTP request
+	}
+
+	urls := []string{
+		"http://" + ipAddress + ":80",
+		"https://" + ipAddress + ":443",
+	}
+
+	for _, url := range urls {
+		req, err := http.NewRequest("GET", url, nil)
+		if err != nil {
+			fmt.Println(err, url)
+			continue // Ignore invalid URLs
+		}
+
+		// Disable TLS verification to handle invalid certificates
+		client.Transport = &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		}
+
+		resp, err := client.Do(req)
+		if err == nil {
+			resp.Body.Close()
+			return true // HTTP server is available
+		}
+	}
+
+	return false // HTTP server is not available
+}
+
+// Step 3
+func isDomainReachable(domain string) bool {
+	_, err := net.LookupHost(domain)
+	if err != nil {
+		return false // Domain is not reachable
+	}
+	return true // Domain is reachable
+}

src/mod/acme/autorenew.go

@@ -0,0 +1,375 @@
+package acme
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"net/mail"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"imuslab.com/zoraxy/mod/utils"
+)
+
+/*
+	autorenew.go
+
+	This script handle auto renew
+*/
+
+type AutoRenewConfig struct {
+	Enabled      bool     //Automatic renew is enabled
+	Email        string   //Email for acme
+	RenewAll     bool     //Renew all or selective renew with the slice below
+	FilesToRenew []string //If RenewAll is false, renew these certificate files
+}
+
+type AutoRenewer struct {
+	ConfigFilePath    string
+	CertFolder        string
+	AcmeHandler       *ACMEHandler
+	RenewerConfig     *AutoRenewConfig
+	RenewTickInterval int64
+	TickerstopChan    chan bool
+}
+
+type ExpiredCerts struct {
+	Domains  []string
+	Filepath string
+}
+
+// Create an auto renew agent, require config filepath and auto scan & renew interval (seconds)
+// Set renew check interval to 0 for auto (1 day)
+func NewAutoRenewer(config string, certFolder string, renewCheckInterval int64, AcmeHandler *ACMEHandler) (*AutoRenewer, error) {
+	if renewCheckInterval == 0 {
+		renewCheckInterval = 86400 //1 day
+	}
+
+	//Load the config file. If not found, create one
+	if !utils.FileExists(config) {
+		//Create one
+		os.MkdirAll(filepath.Dir(config), 0775)
+		newConfig := AutoRenewConfig{
+			RenewAll:     true,
+			FilesToRenew: []string{},
+		}
+		js, _ := json.MarshalIndent(newConfig, "", " ")
+		err := os.WriteFile(config, js, 0775)
+		if err != nil {
+			return nil, errors.New("Failed to create acme auto renewer config: " + err.Error())
+		}
+	}
+
+	renewerConfig := AutoRenewConfig{}
+	content, err := os.ReadFile(config)
+	if err != nil {
+		return nil, errors.New("Failed to open acme auto renewer config: " + err.Error())
+	}
+
+	err = json.Unmarshal(content, &renewerConfig)
+	if err != nil {
+		return nil, errors.New("Malformed acme config file: " + err.Error())
+	}
+
+	//Create an Auto renew object
+	thisRenewer := AutoRenewer{
+		ConfigFilePath:    config,
+		CertFolder:        certFolder,
+		AcmeHandler:       AcmeHandler,
+		RenewerConfig:     &renewerConfig,
+		RenewTickInterval: renewCheckInterval,
+	}
+
+	if thisRenewer.RenewerConfig.Enabled {
+		//Start the renew ticker
+		thisRenewer.StartAutoRenewTicker()
+
+		//Check and renew certificate on startup
+		go thisRenewer.CheckAndRenewCertificates()
+	}
+
+	return &thisRenewer, nil
+}
+
+func (a *AutoRenewer) StartAutoRenewTicker() {
+	//Stop the previous ticker if still running
+	if a.TickerstopChan != nil {
+		a.TickerstopChan <- true
+	}
+
+	time.Sleep(1 * time.Second)
+
+	ticker := time.NewTicker(time.Duration(a.RenewTickInterval) * time.Second)
+	done := make(chan bool)
+
+	//Start the ticker to check and renew every x seconds
+	go func(a *AutoRenewer) {
+		for {
+			select {
+			case <-done:
+				return
+			case <-ticker.C:
+				log.Println("Check and renew certificates in progress")
+				a.CheckAndRenewCertificates()
+			}
+		}
+	}(a)
+
+	a.TickerstopChan = done
+}
+
+func (a *AutoRenewer) StopAutoRenewTicker() {
+	if a.TickerstopChan != nil {
+		a.TickerstopChan <- true
+	}
+
+	a.TickerstopChan = nil
+}
+
+// Handle update auto renew domains
+// Set opr for different mode of operations
+// opr = setSelected -> Enter a list of file names (or matching rules) for auto renew
+// opr = setAuto -> Set to use auto detect certificates and renew
+func (a *AutoRenewer) HandleSetAutoRenewDomains(w http.ResponseWriter, r *http.Request) {
+	opr, err := utils.GetPara(r, "opr")
+	if err != nil {
+		utils.SendErrorResponse(w, "Operation not set")
+		return
+	}
+
+	if opr == "setSelected" {
+		files, err := utils.PostPara(r, "domains")
+		if err != nil {
+			utils.SendErrorResponse(w, "Domains is not defined")
+			return
+		}
+
+		//Parse it int array of string
+		matchingRuleFiles := []string{}
+		err = json.Unmarshal([]byte(files), &matchingRuleFiles)
+		if err != nil {
+			utils.SendErrorResponse(w, err.Error())
+			return
+		}
+
+		//Update the configs
+		a.RenewerConfig.RenewAll = false
+		a.RenewerConfig.FilesToRenew = matchingRuleFiles
+		a.saveRenewConfigToFile()
+		utils.SendOK(w)
+	} else if opr == "setAuto" {
+		a.RenewerConfig.RenewAll = true
+		a.saveRenewConfigToFile()
+		utils.SendOK(w)
+	}
+
+}
+
+// if auto renew all is true (aka auto scan), it will return []string{"*"}
+func (a *AutoRenewer) HandleLoadAutoRenewDomains(w http.ResponseWriter, r *http.Request) {
+	results := []string{}
+	if a.RenewerConfig.RenewAll {
+		//Auto pick which cert to renew.
+		results = append(results, "*")
+	} else {
+		//Manually set the files to renew
+		results = a.RenewerConfig.FilesToRenew
+	}
+
+	js, _ := json.Marshal(results)
+	utils.SendJSONResponse(w, string(js))
+}
+
+func (a *AutoRenewer) HandleRenewPolicy(w http.ResponseWriter, r *http.Request) {
+	//Load the current value
+	js, _ := json.Marshal(a.RenewerConfig.RenewAll)
+	utils.SendJSONResponse(w, string(js))
+}
+
+func (a *AutoRenewer) HandleRenewNow(w http.ResponseWriter, r *http.Request) {
+	renewedDomains, err := a.CheckAndRenewCertificates()
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+
+	message := "Domains renewed"
+	if len(renewedDomains) == 0 {
+		message = ("All certificates are up-to-date!")
+	} else {
+		message = ("The following domains have been renewed: " + strings.Join(renewedDomains, ","))
+	}
+
+	js, _ := json.Marshal(message)
+	utils.SendJSONResponse(w, string(js))
+}
+
+func (a *AutoRenewer) HandleAutoRenewEnable(w http.ResponseWriter, r *http.Request) {
+	val, err := utils.PostPara(r, "enable")
+	if err != nil {
+		js, _ := json.Marshal(a.RenewerConfig.Enabled)
+		utils.SendJSONResponse(w, string(js))
+	} else {
+		if val == "true" {
+			//Check if the email is not empty
+			if a.RenewerConfig.Email == "" {
+				utils.SendErrorResponse(w, "Email is not set")
+				return
+			}
+
+			a.RenewerConfig.Enabled = true
+			a.saveRenewConfigToFile()
+			log.Println("[ACME] ACME auto renew enabled")
+			a.StartAutoRenewTicker()
+		} else {
+			a.RenewerConfig.Enabled = false
+			a.saveRenewConfigToFile()
+			log.Println("[ACME] ACME auto renew disabled")
+			a.StopAutoRenewTicker()
+		}
+	}
+}
+
+func (a *AutoRenewer) HandleACMEEmail(w http.ResponseWriter, r *http.Request) {
+
+	email, err := utils.PostPara(r, "set")
+	if err != nil {
+		//Return the current email to user
+		js, _ := json.Marshal(a.RenewerConfig.Email)
+		utils.SendJSONResponse(w, string(js))
+	} else {
+		//Check if the email is valid
+		_, err := mail.ParseAddress(email)
+		if err != nil {
+			utils.SendErrorResponse(w, err.Error())
+			return
+		}
+
+		//Set the new config
+		a.RenewerConfig.Email = email
+		a.saveRenewConfigToFile()
+	}
+
+}
+
+// Check and renew certificates. This check all the certificates in the
+// certificate folder and return a list of certs that is renewed in this call
+// Return string array with length 0 when no cert is expired
+func (a *AutoRenewer) CheckAndRenewCertificates() ([]string, error) {
+	certFolder := a.CertFolder
+	files, err := os.ReadDir(certFolder)
+	if err != nil {
+		log.Println("Unable to renew certificates: " + err.Error())
+		return []string{}, err
+	}
+
+	expiredCertList := []*ExpiredCerts{}
+	if a.RenewerConfig.RenewAll {
+		//Scan and renew all
+		for _, file := range files {
+			if filepath.Ext(file.Name()) == ".crt" || filepath.Ext(file.Name()) == ".pem" {
+				//This is a public key file
+				certBytes, err := os.ReadFile(filepath.Join(certFolder, file.Name()))
+				if err != nil {
+					continue
+				}
+				if CertExpireSoon(certBytes) || CertIsExpired(certBytes) {
+					//This cert is expired
+
+					DNSName, err := ExtractDomains(certBytes)
+					if err != nil {
+						//Maybe self signed. Ignore this
+						log.Println("Encounted error when trying to resolve DNS name for cert " + file.Name())
+						continue
+					}
+
+					expiredCertList = append(expiredCertList, &ExpiredCerts{
+						Filepath: filepath.Join(certFolder, file.Name()),
+						Domains:  DNSName,
+					})
+				}
+			}
+		}
+	} else {
+		//Only renew those in the list
+		for _, file := range files {
+			fileName := file.Name()
+			certName := fileName[:len(fileName)-len(filepath.Ext(fileName))]
+			if contains(a.RenewerConfig.FilesToRenew, certName) {
+				//This is the one to auto renew
+				certBytes, err := os.ReadFile(filepath.Join(certFolder, file.Name()))
+				if err != nil {
+					continue
+				}
+				if CertExpireSoon(certBytes) || CertIsExpired(certBytes) {
+					//This cert is expired
+
+					DNSName, err := ExtractDomains(certBytes)
+					if err != nil {
+						//Maybe self signed. Ignore this
+						log.Println("Encounted error when trying to resolve DNS name for cert " + file.Name())
+						continue
+					}
+
+					expiredCertList = append(expiredCertList, &ExpiredCerts{
+						Filepath: filepath.Join(certFolder, file.Name()),
+						Domains:  DNSName,
+					})
+				}
+			}
+		}
+	}
+
+	return a.renewExpiredDomains(expiredCertList)
+}
+
+func (a *AutoRenewer) Close() {
+	if a.TickerstopChan != nil {
+		a.TickerstopChan <- true
+	}
+}
+
+// Renew the certificate by filename extract all DNS name from the
+// certificate and renew them one by one by calling to the acmeHandler
+func (a *AutoRenewer) renewExpiredDomains(certs []*ExpiredCerts) ([]string, error) {
+	renewedCertFiles := []string{}
+	for _, expiredCert := range certs {
+		log.Println("Renewing " + expiredCert.Filepath + " (Might take a few minutes)")
+		fileName := filepath.Base(expiredCert.Filepath)
+		certName := fileName[:len(fileName)-len(filepath.Ext(fileName))]
+
+		// Load certificate info for ACME detail
+		certInfoFilename := fmt.Sprintf("%s/%s.json", filepath.Dir(expiredCert.Filepath), certName)
+		certInfo, err := loadCertInfoJSON(certInfoFilename)
+		if err != nil {
+			log.Printf("Renew %s certificate error, can't get the ACME detail for cert: %v, trying org section as ca", certName, err)
+
+			if CAName, extractErr := ExtractIssuerNameFromPEM(expiredCert.Filepath); extractErr != nil {
+				log.Printf("extract issuer name for cert error: %v, using default ca", extractErr)
+				certInfo = &CertificateInfoJSON{}
+			} else {
+				certInfo = &CertificateInfoJSON{AcmeName: CAName}
+			}
+		}
+
+		_, err = a.AcmeHandler.ObtainCert(expiredCert.Domains, certName, a.RenewerConfig.Email, certInfo.AcmeName, certInfo.AcmeUrl, certInfo.SkipTLS)
+		if err != nil {
+			log.Println("Renew " + fileName + "(" + strings.Join(expiredCert.Domains, ",") + ") failed: " + err.Error())
+		} else {
+			log.Println("Successfully renewed " + filepath.Base(expiredCert.Filepath))
+			renewedCertFiles = append(renewedCertFiles, filepath.Base(expiredCert.Filepath))
+		}
+	}
+
+	return renewedCertFiles, nil
+}
+
+// Write the current renewer config to file
+func (a *AutoRenewer) saveRenewConfigToFile() error {
+	js, _ := json.MarshalIndent(a.RenewerConfig, "", " ")
+	return os.WriteFile(a.ConfigFilePath, js, 0775)
+}

src/mod/acme/ca.go

@@ -0,0 +1,56 @@
+package acme
+
+/*
+	CA.go
+
+	This script load CA defination from embedded ca.json
+*/
+import (
+	_ "embed"
+	"encoding/json"
+	"errors"
+	"log"
+	"strings"
+)
+
+// CA Defination, load from embeded json when startup
+type CaDef struct {
+	Production map[string]string
+	Test       map[string]string
+}
+
+//go:embed ca.json
+var caJson []byte
+
+var caDef CaDef = CaDef{}
+
+func init() {
+	runtimeCaDef := CaDef{}
+	err := json.Unmarshal(caJson, &runtimeCaDef)
+	if err != nil {
+		log.Println("[ERR] Unable to unmarshal CA def from embedded file. You sure your ca.json is valid?")
+		return
+	}
+
+	caDef = runtimeCaDef
+}
+
+// Get the CA ACME server endpoint and error if not found
+func loadCAApiServerFromName(caName string) (string, error) {
+	// handle BuyPass cert org section (Buypass AS-983163327)
+	if strings.HasPrefix(caName, "Buypass AS") {
+		caName = "Buypass"
+	}
+
+	val, ok := caDef.Production[caName]
+	if !ok {
+		return "", errors.New("This CA is not supported")
+	}
+
+	return val, nil
+}
+
+func IsSupportedCA(caName string) bool {
+	_, err := loadCAApiServerFromName(caName)
+	return err == nil
+}

src/mod/acme/ca.json

@@ -0,0 +1,15 @@
+{
+    "production": {
+        "Let's Encrypt": "https://acme-v02.api.letsencrypt.org/directory",
+        "Buypass": "https://api.buypass.com/acme/directory",
+        "ZeroSSL": "https://acme.zerossl.com/v2/DV90",
+        "Google": "https://dv.acme-v02.api.pki.goog/directory"
+    },
+    "test":{
+        "Let's Encrypt": "https://acme-staging-v02.api.letsencrypt.org/directory",
+        "Buypass": "https://api.test4.buypass.no/acme/directory",
+        "Google": "https://dv.acme-v02.test-api.pki.goog/directory"
+    }
+  }
+  
+  

src/mod/acme/utils.go

@@ -0,0 +1,99 @@
+package acme
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"time"
+)
+
+// Get the issuer name from pem file
+func ExtractIssuerNameFromPEM(pemFilePath string) (string, error) {
+	// Read the PEM file
+	pemData, err := ioutil.ReadFile(pemFilePath)
+	if err != nil {
+		return "", err
+	}
+
+	return ExtractIssuerName(pemData)
+}
+
+// Get the DNSName in the cert
+func ExtractDomains(certBytes []byte) ([]string, error) {
+	domains := []string{}
+	block, _ := pem.Decode(certBytes)
+	if block != nil {
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return []string{}, err
+		}
+		for _, dnsName := range cert.DNSNames {
+			if !contains(domains, dnsName) {
+				domains = append(domains, dnsName)
+			}
+		}
+
+		return domains, nil
+	}
+	return []string{}, errors.New("decode cert bytes failed")
+}
+
+func ExtractIssuerName(certBytes []byte) (string, error) {
+	// Parse the PEM block
+	block, _ := pem.Decode(certBytes)
+	if block == nil || block.Type != "CERTIFICATE" {
+		return "", fmt.Errorf("failed to decode PEM block containing certificate")
+	}
+
+	// Parse the certificate
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse certificate: %v", err)
+	}
+
+	// Check if exist incase some acme server didn't have org section
+	if len(cert.Issuer.Organization) == 0 {
+		return "", fmt.Errorf("cert didn't have org section exist")
+	}
+
+	// Extract the issuer name
+	issuer := cert.Issuer.Organization[0]
+
+	return issuer, nil
+}
+
+// Check if a cert is expired by public key
+func CertIsExpired(certBytes []byte) bool {
+	block, _ := pem.Decode(certBytes)
+	if block != nil {
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err == nil {
+			elapsed := time.Since(cert.NotAfter)
+			if elapsed > 0 {
+				// if it is expired then add it in
+				// make sure it's uniqueless
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func CertExpireSoon(certBytes []byte) bool {
+	block, _ := pem.Decode(certBytes)
+	if block != nil {
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err == nil {
+			expirationDate := cert.NotAfter
+			threshold := 14 * 24 * time.Hour // 14 days
+
+			timeRemaining := time.Until(expirationDate)
+			if timeRemaining <= threshold {
+				return true
+			}
+		}
+	}
+	return false
+}

src/mod/dynamicproxy/Server.go

@@ -1,8 +1,13 @@
 package dynamicproxy
 
 import (
+	_ "embed"
+	"errors"
+	"log"
 	"net/http"
+	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"imuslab.com/zoraxy/mod/geodb"
@@ -21,37 +26,39 @@ import (
 	- Vitrual Directory Routing
 */
 
+var (
+	//go:embed tld.json
+	rawTldMap []byte
+)
+
 func (h *ProxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	/*
+		Special Routing Rules, bypass most of the limitations
+	*/
+
+	//Check if there are external routing rule matches.
+	//If yes, route them via external rr
+	matchedRoutingRule := h.Parent.GetMatchingRoutingRule(r)
+	if matchedRoutingRule != nil {
+		//Matching routing rule found. Let the sub-router handle it
+		if matchedRoutingRule.UseSystemAccessControl {
+			//This matching rule request system access control.
+			//check access logic
+			respWritten := h.handleAccessRouting(w, r)
+			if respWritten {
+				return
+			}
+		}
+		matchedRoutingRule.Route(w, r)
+		return
+	}
+
 	/*
 		General Access Check
 	*/
 
-	//Check if this ip is in blacklist
-	clientIpAddr := geodb.GetRequesterIP(r)
-	if h.Parent.Option.GeodbStore.IsBlacklisted(clientIpAddr) {
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.WriteHeader(http.StatusForbidden)
-		template, err := os.ReadFile("./web/forbidden.html")
-		if err != nil {
-			w.Write([]byte("403 - Forbidden"))
-		} else {
-			w.Write(template)
-		}
-		h.logRequest(r, false, 403, "blacklist", "")
-		return
-	}
-
-	//Check if this ip is in whitelist
-	if !h.Parent.Option.GeodbStore.IsWhitelisted(clientIpAddr) {
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.WriteHeader(http.StatusForbidden)
-		template, err := os.ReadFile("./web/forbidden.html")
-		if err != nil {
-			w.Write([]byte("403 - Forbidden"))
-		} else {
-			w.Write(template)
-		}
-		h.logRequest(r, false, 403, "whitelist", "")
+	respWritten := h.handleAccessRouting(w, r)
+	if respWritten {
 		return
 	}
 
@@ -65,15 +72,6 @@ func (h *ProxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	//Check if there are external routing rule matches.
-	//If yes, route them via external rr
-	matchedRoutingRule := h.Parent.GetMatchingRoutingRule(r)
-	if matchedRoutingRule != nil {
-		//Matching routing rule found. Let the sub-router handle it
-		matchedRoutingRule.Route(w, r)
-		return
-	}
-
 	//Extract request host to see if it is virtual directory or subdomain
 	domainOnly := r.Host
 	if strings.Contains(r.Host, ":") {
@@ -120,10 +118,145 @@ func (h *ProxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			http.Redirect(w, r, r.RequestURI+"/", http.StatusTemporaryRedirect)
 		} else {
 			//Passthrough the request to root
-			h.proxyRequest(w, r, h.Parent.Root)
+			h.handleRootRouting(w, r)
 		}
 	} else {
-		//No routing rules found. Route to root.
+		//No routing rules found.
+		h.handleRootRouting(w, r)
+	}
+}
+
+/*
+handleRootRouting
+
+This function handle root routing situations where there are no subdomain
+, vdir or special routing rule matches the requested URI.
+
+Once entered this routing segment, the root routing options will take over
+for the routing logic.
+*/
+func (h *ProxyHandler) handleRootRouting(w http.ResponseWriter, r *http.Request) {
+	domainOnly := r.Host
+	if strings.Contains(r.Host, ":") {
+		hostPath := strings.Split(r.Host, ":")
+		domainOnly = hostPath[0]
+	}
+
+	if h.Parent.RootRoutingOptions.EnableRedirectForUnsetRules {
+		//Route to custom domain
+		if h.Parent.RootRoutingOptions.UnsetRuleRedirectTarget == "" {
+			//Not set. Redirect to first level of domain redirectable
+			fld, err := h.getTopLevelRedirectableDomain(domainOnly)
+			if err != nil {
+				//Redirect to proxy root
+				h.proxyRequest(w, r, h.Parent.Root)
+			} else {
+				log.Println("[Router] Redirecting request from " + domainOnly + " to " + fld)
+				h.logRequest(r, false, 307, "root-redirect", domainOnly)
+				http.Redirect(w, r, fld, http.StatusTemporaryRedirect)
+			}
+			return
+		} else if h.isTopLevelRedirectableDomain(domainOnly) {
+			//This is requesting a top level private domain that should be serving root
+			h.proxyRequest(w, r, h.Parent.Root)
+		} else {
+			//Validate the redirection target URL
+			parsedURL, err := url.Parse(h.Parent.RootRoutingOptions.UnsetRuleRedirectTarget)
+			if err != nil {
+				//Error when parsing target. Send to root
+				h.proxyRequest(w, r, h.Parent.Root)
+				return
+			}
+			hostname := parsedURL.Hostname()
+			if domainOnly != hostname {
+				//Redirect to target
+				h.logRequest(r, false, 307, "root-redirect", domainOnly)
+				http.Redirect(w, r, h.Parent.RootRoutingOptions.UnsetRuleRedirectTarget, http.StatusTemporaryRedirect)
+				return
+			} else {
+				//Loopback request due to bad settings (Shd leave it empty)
+				//Forward it to root proxy
+				h.proxyRequest(w, r, h.Parent.Root)
+			}
+		}
+	} else {
+		//Route to root
 		h.proxyRequest(w, r, h.Parent.Root)
 	}
 }
+
+// Handle access routing logic. Return true if the request is handled or blocked by the access control logic
+// if the return value is false, you can continue process the response writer
+func (h *ProxyHandler) handleAccessRouting(w http.ResponseWriter, r *http.Request) bool {
+	//Check if this ip is in blacklist
+	clientIpAddr := geodb.GetRequesterIP(r)
+	if h.Parent.Option.GeodbStore.IsBlacklisted(clientIpAddr) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.WriteHeader(http.StatusForbidden)
+		template, err := os.ReadFile(filepath.Join(h.Parent.Option.WebDirectory, "templates/blacklist.html"))
+		if err != nil {
+			w.Write(page_forbidden)
+		} else {
+			w.Write(template)
+		}
+		h.logRequest(r, false, 403, "blacklist", "")
+		return true
+	}
+
+	//Check if this ip is in whitelist
+	if !h.Parent.Option.GeodbStore.IsWhitelisted(clientIpAddr) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.WriteHeader(http.StatusForbidden)
+		template, err := os.ReadFile(filepath.Join(h.Parent.Option.WebDirectory, "templates/whitelist.html"))
+		if err != nil {
+			w.Write(page_forbidden)
+		} else {
+			w.Write(template)
+		}
+		h.logRequest(r, false, 403, "whitelist", "")
+		return true
+	}
+
+	return false
+}
+
+// Return if the given host is already topped (e.g. example.com or example.co.uk) instead of
+// a host with subdomain (e.g. test.example.com)
+func (h *ProxyHandler) isTopLevelRedirectableDomain(requestHost string) bool {
+	parts := strings.Split(requestHost, ".")
+	if len(parts) > 2 {
+		//Cases where strange tld is used like .co.uk or .com.hk
+		_, ok := h.Parent.tldMap[strings.Join(parts[1:], ".")]
+		if ok {
+			//Already topped
+			return true
+		}
+	} else {
+		//Already topped
+		return true
+	}
+
+	return false
+}
+
+// GetTopLevelRedirectableDomain returns the toppest level of domain
+// that is redirectable. E.g. a.b.c.example.co.uk will return example.co.uk
+func (h *ProxyHandler) getTopLevelRedirectableDomain(unsetSubdomainHost string) (string, error) {
+	parts := strings.Split(unsetSubdomainHost, ".")
+	if h.isTopLevelRedirectableDomain(unsetSubdomainHost) {
+		//Already topped
+		return "", errors.New("already at top level domain")
+	}
+
+	for i := 0; i < len(parts); i++ {
+		possibleTld := parts[i:]
+		_, ok := h.Parent.tldMap[strings.Join(possibleTld, ".")]
+		if ok {
+			//This is tld length
+			tld := strings.Join(parts[i-1:], ".")
+			return "//" + tld, nil
+		}
+	}
+
+	return "", errors.New("unsupported top level domain given")
+}

src/mod/dynamicproxy/basicAuth.go

@@ -3,6 +3,7 @@ package dynamicproxy
 import (
 	"errors"
 	"net/http"
+	"strings"
 
 	"imuslab.com/zoraxy/mod/auth"
 )
@@ -15,6 +16,16 @@ import (
 */
 
 func (h *ProxyHandler) handleBasicAuthRouting(w http.ResponseWriter, r *http.Request, pe *ProxyEndpoint) error {
+	if len(pe.BasicAuthExceptionRules) > 0 {
+		//Check if the current path matches the exception rules
+		for _, exceptionRule := range pe.BasicAuthExceptionRules {
+			if strings.HasPrefix(r.RequestURI, exceptionRule.PathPrefix) {
+				//This path is excluded from basic auth
+				return nil
+			}
+		}
+	}
+
 	proxyType := "vdir-auth"
 	if pe.ProxyType == ProxyType_Subdomain {
 		proxyType = "subd-auth"

src/mod/dynamicproxy/dpcore/dpcore.go

@@ -14,10 +14,6 @@ import (
 
 var onExitFlushLoop func()
 
-const (
-	defaultTimeout = time.Minute * 5
-)
-
 // ReverseProxy is an HTTP Handler that takes an incoming request and
 // sends it to another server, proxying the response back to the
 // client, support http, also support https tunnel using http.hijacker
@@ -91,11 +87,12 @@ func NewDynamicProxyCore(target *url.URL, prepender string, ignoreTLSVerificatio
 
 	//Hack the default transporter to handle more connections
 	thisTransporter := http.DefaultTransport
-	thisTransporter.(*http.Transport).MaxIdleConns = 3000
-	thisTransporter.(*http.Transport).MaxIdleConnsPerHost = 3000
-	thisTransporter.(*http.Transport).IdleConnTimeout = 10 * time.Second
-	thisTransporter.(*http.Transport).MaxConnsPerHost = 0
-	//thisTransporter.(*http.Transport).DisableCompression = true
+	optimalConcurrentConnection := 32
+	thisTransporter.(*http.Transport).MaxIdleConns = optimalConcurrentConnection * 2
+	thisTransporter.(*http.Transport).MaxIdleConnsPerHost = optimalConcurrentConnection
+	thisTransporter.(*http.Transport).IdleConnTimeout = 30 * time.Second
+	thisTransporter.(*http.Transport).MaxConnsPerHost = optimalConcurrentConnection * 2
+	thisTransporter.(*http.Transport).DisableCompression = true
 
 	if ignoreTLSVerification {
 		//Ignore TLS certificate validation error
@@ -357,11 +354,6 @@ func (p *ReverseProxy) ProxyHTTP(rw http.ResponseWriter, req *http.Request, rrr
 
 	//Custom header rewriter functions
 	if res.Header.Get("Location") != "" {
-		/*
-			fmt.Println(">>> REQ", req)
-			fmt.Println(">>> OUTR", outreq)
-			fmt.Println(">>> RESP", res)
-		*/
 		locationRewrite := res.Header.Get("Location")
 		originLocation := res.Header.Get("Location")
 		res.Header.Set("zr-origin-location", originLocation)
@@ -369,12 +361,10 @@ func (p *ReverseProxy) ProxyHTTP(rw http.ResponseWriter, req *http.Request, rrr
 		if strings.HasPrefix(originLocation, "http://") || strings.HasPrefix(originLocation, "https://") {
 			//Full path
 			//Replace the forwarded target with expected Host
-			lr, err := replaceLocationHost(locationRewrite, rrr.OriginalHost, req.TLS != nil)
+			lr, err := replaceLocationHost(locationRewrite, rrr, req.TLS != nil)
 			if err == nil {
 				locationRewrite = lr
 			}
-			//locationRewrite = strings.ReplaceAll(locationRewrite, rrr.ProxyDomain, rrr.OriginalHost)
-			//locationRewrite = strings.ReplaceAll(locationRewrite, domainWithoutPort, rrr.OriginalHost)
 		} else if strings.HasPrefix(originLocation, "/") && rrr.PathPrefix != "" {
 			//Back to the root of this proxy object
 			//fmt.Println(rrr.ProxyDomain, rrr.OriginalHost)
@@ -387,6 +377,7 @@ func (p *ReverseProxy) ProxyHTTP(rw http.ResponseWriter, req *http.Request, rrr
 		//Custom redirection to this rproxy relative path
 		res.Header.Set("Location", locationRewrite)
 	}
+
 	// Copy header from response to client.
 	copyHeader(rw.Header(), res.Header)
 

src/mod/dynamicproxy/dpcore/dpcore_test.go

@@ -0,0 +1,49 @@
+package dpcore_test
+
+import (
+	"testing"
+
+	"imuslab.com/zoraxy/mod/dynamicproxy/dpcore"
+)
+
+func TestReplaceLocationHost(t *testing.T) {
+	urlString := "http://private.com/test/newtarget/"
+	rrr := &dpcore.ResponseRewriteRuleSet{
+		OriginalHost: "test.example.com",
+		ProxyDomain:  "private.com/test",
+		UseTLS:       true,
+	}
+	useTLS := true
+
+	expectedResult := "https://test.example.com/newtarget/"
+
+	result, err := dpcore.ReplaceLocationHost(urlString, rrr, useTLS)
+	if err != nil {
+		t.Errorf("Error occurred: %v", err)
+	}
+
+	if result != expectedResult {
+		t.Errorf("Expected: %s, but got: %s", expectedResult, result)
+	}
+}
+
+func TestReplaceLocationHostRelative(t *testing.T) {
+	urlString := "api/"
+	rrr := &dpcore.ResponseRewriteRuleSet{
+		OriginalHost: "test.example.com",
+		ProxyDomain:  "private.com/test",
+		UseTLS:       true,
+	}
+	useTLS := true
+
+	expectedResult := "https://test.example.com/api/"
+
+	result, err := dpcore.ReplaceLocationHost(urlString, rrr, useTLS)
+	if err != nil {
+		t.Errorf("Error occurred: %v", err)
+	}
+
+	if result != expectedResult {
+		t.Errorf("Expected: %s, but got: %s", expectedResult, result)
+	}
+}

src/mod/dynamicproxy/dpcore/utils.go

@@ -2,20 +2,61 @@ package dpcore
 
 import (
 	"net/url"
+	"strings"
 )
 
-func replaceLocationHost(urlString string, newHost string, useTLS bool) (string, error) {
+// replaceLocationHost rewrite the backend server's location header to a new URL based on the given proxy rules
+// If you have issues with tailing slash, you can try to fix them here (and remember to PR :D )
+func replaceLocationHost(urlString string, rrr *ResponseRewriteRuleSet, useTLS bool) (string, error) {
 	u, err := url.Parse(urlString)
 	if err != nil {
 		return "", err
 	}
 
+	//Update the schemetic if the proxying target is http
+	//but exposed as https to the internet via Zoraxy
 	if useTLS {
 		u.Scheme = "https"
 	} else {
 		u.Scheme = "http"
 	}
 
-	u.Host = newHost
+	//Issue #39: Check if it is location target match the proxying domain
+	//E.g. Proxy config: blog.example.com -> example.com/blog
+	//Check if it is actually redirecting to example.com instead of a new domain
+	//like news.example.com.
+	// The later check bypass apache screw up method of redirection header
+	// e.g. https://imuslab.com -> http://imuslab.com:443
+	if rrr.ProxyDomain != u.Host && !strings.Contains(u.Host, rrr.OriginalHost+":") {
+		//New location domain not matching proxy target domain.
+		//Do not modify location header
+		return urlString, nil
+	}
+	u.Host = rrr.OriginalHost
+
+	if strings.Contains(rrr.ProxyDomain, "/") {
+		//The proxy domain itself seems contain subpath.
+		//Trim it off from Location header to prevent URL segment duplicate
+		//E.g. Proxy config: blog.example.com -> example.com/blog
+		//Location Header: /blog/post?id=1
+		//Expected Location Header send to client:
+		// blog.example.com/post?id=1 instead of blog.example.com/blog/post?id=1
+
+		ProxyDomainURL := "http://" + rrr.ProxyDomain
+		if rrr.UseTLS {
+			ProxyDomainURL = "https://" + rrr.ProxyDomain
+		}
+		ru, err := url.Parse(ProxyDomainURL)
+		if err == nil {
+			//Trim off the subpath
+			u.Path = strings.TrimPrefix(u.Path, ru.Path)
+		}
+	}
+
 	return u.String(), nil
 }
+
+// Debug functions
+func ReplaceLocationHost(urlString string, rrr *ResponseRewriteRuleSet, useTLS bool) (string, error) {
+	return replaceLocationHost(urlString, rrr, useTLS)
+}

src/mod/dynamicproxy/dynamicproxy.go

@@ -3,6 +3,7 @@ package dynamicproxy
 import (
 	"context"
 	"crypto/tls"
+	"encoding/json"
 	"errors"
 	"log"
 	"net/http"
@@ -29,12 +30,19 @@ func NewDynamicProxy(option RouterOption) (*Router, error) {
 		Running:           false,
 		server:            nil,
 		routingRules:      []*RoutingRule{},
+		tldMap:            map[string]int{},
 	}
 
 	thisRouter.mux = &ProxyHandler{
 		Parent: &thisRouter,
 	}
 
+	//Prase the tld map for tld redirection in main router
+	//See Server.go declarations
+	if len(rawTldMap) > 0 {
+		json.Unmarshal(rawTldMap, &thisRouter.tldMap)
+	}
+
 	return &thisRouter, nil
 }
 
@@ -65,10 +73,18 @@ func (router *Router) StartProxyService() error {
 		return errors.New("Reverse proxy server already running")
 	}
 
+	//Check if root route is set
 	if router.Root == nil {
 		return errors.New("Reverse proxy router root not set")
 	}
 
+	//Load root options from file
+	loadedRootOption, err := loadRootRoutingOptionsFromFile()
+	if err != nil {
+		return err
+	}
+	router.RootRoutingOptions = loadedRootOption
+
 	minVersion := tls.VersionTLS10
 	if router.Option.ForceTLSLatest {
 		minVersion = tls.VersionTLS12
@@ -246,14 +262,15 @@ func (router *Router) AddVirtualDirectoryProxyService(options *VdirOptions) erro
 	proxy := dpcore.NewDynamicProxyCore(path, options.RootName, options.SkipCertValidations)
 
 	endpointObject := ProxyEndpoint{
-		ProxyType:            ProxyType_Vdir,
-		RootOrMatchingDomain: options.RootName,
-		Domain:               domain,
-		RequireTLS:           options.RequireTLS,
-		SkipCertValidations:  options.SkipCertValidations,
-		RequireBasicAuth:     options.RequireBasicAuth,
-		BasicAuthCredentials: options.BasicAuthCredentials,
-		Proxy:                proxy,
+		ProxyType:               ProxyType_Vdir,
+		RootOrMatchingDomain:    options.RootName,
+		Domain:                  domain,
+		RequireTLS:              options.RequireTLS,
+		SkipCertValidations:     options.SkipCertValidations,
+		RequireBasicAuth:        options.RequireBasicAuth,
+		BasicAuthCredentials:    options.BasicAuthCredentials,
+		BasicAuthExceptionRules: options.BasicAuthExceptionRules,
+		Proxy:                   proxy,
 	}
 
 	router.ProxyEndpoints.Store(options.RootName, &endpointObject)
@@ -271,46 +288,24 @@ func (router *Router) LoadProxy(ptype string, key string) (*ProxyEndpoint, error
 		if !ok {
 			return nil, errors.New("target proxy not found")
 		}
-		return proxy.(*ProxyEndpoint), nil
+
+		targetProxy := proxy.(*ProxyEndpoint)
+		targetProxy.parent = router
+		return targetProxy, nil
 	} else if ptype == "subd" {
 		proxy, ok := router.SubdomainEndpoint.Load(key)
 		if !ok {
 			return nil, errors.New("target proxy not found")
 		}
-		return proxy.(*ProxyEndpoint), nil
+
+		targetProxy := proxy.(*ProxyEndpoint)
+		targetProxy.parent = router
+		return targetProxy, nil
 	}
 
 	return nil, errors.New("unsupported ptype")
 }
 
-/*
-Save routing from RP
-*/
-func (router *Router) SaveProxy(ptype string, key string, newConfig *ProxyEndpoint) {
-	if ptype == "vdir" {
-		router.ProxyEndpoints.Store(key, newConfig)
-
-	} else if ptype == "subd" {
-		router.SubdomainEndpoint.Store(key, newConfig)
-	}
-
-}
-
-/*
-Remove routing from RP
-*/
-func (router *Router) RemoveProxy(ptype string, key string) error {
-	//fmt.Println(ptype, key)
-	if ptype == "vdir" {
-		router.ProxyEndpoints.Delete(key)
-		return nil
-	} else if ptype == "subd" {
-		router.SubdomainEndpoint.Delete(key)
-		return nil
-	}
-	return errors.New("invalid ptype")
-}
-
 /*
 Add an default router for the proxy server
 */
@@ -335,14 +330,15 @@ func (router *Router) SetRootProxy(options *RootOptions) error {
 	proxy := dpcore.NewDynamicProxyCore(path, "", options.SkipCertValidations)
 
 	rootEndpoint := ProxyEndpoint{
-		ProxyType:            ProxyType_Vdir,
-		RootOrMatchingDomain: "/",
-		Domain:               proxyLocation,
-		RequireTLS:           options.RequireTLS,
-		SkipCertValidations:  options.SkipCertValidations,
-		RequireBasicAuth:     options.RequireBasicAuth,
-		BasicAuthCredentials: options.BasicAuthCredentials,
-		Proxy:                proxy,
+		ProxyType:               ProxyType_Vdir,
+		RootOrMatchingDomain:    "/",
+		Domain:                  proxyLocation,
+		RequireTLS:              options.RequireTLS,
+		SkipCertValidations:     options.SkipCertValidations,
+		RequireBasicAuth:        options.RequireBasicAuth,
+		BasicAuthCredentials:    options.BasicAuthCredentials,
+		BasicAuthExceptionRules: options.BasicAuthExceptionRules,
+		Proxy:                   proxy,
 	}
 
 	router.Root = &rootEndpoint

src/mod/dynamicproxy/proxyEndpoint.go

@@ -0,0 +1,68 @@
+package dynamicproxy
+
+import "errors"
+
+/*
+	ProxyEndpoint.go
+	author: tobychui
+
+	This script handle the proxy endpoint object actions
+	so proxyEndpoint can be handled like a proper oop object
+
+	Most of the functions are implemented in dynamicproxy.go
+*/
+
+//Get the string version of proxy type
+func (ep *ProxyEndpoint) GetProxyTypeString() string {
+	if ep.ProxyType == ProxyType_Subdomain {
+		return "subd"
+	} else if ep.ProxyType == ProxyType_Vdir {
+		return "vdir"
+	}
+
+	return "unknown"
+}
+
+//Update change in the current running proxy endpoint config
+func (ep *ProxyEndpoint) UpdateToRuntime() {
+	if ep.IsVdir() {
+		ep.parent.ProxyEndpoints.Store(ep.RootOrMatchingDomain, ep)
+
+	} else if ep.IsSubDomain() {
+		ep.parent.SubdomainEndpoint.Store(ep.RootOrMatchingDomain, ep)
+	}
+}
+
+//Return true if the endpoint type is virtual directory
+func (ep *ProxyEndpoint) IsVdir() bool {
+	return ep.ProxyType == ProxyType_Vdir
+}
+
+//Return true if the endpoint type is subdomain
+func (ep *ProxyEndpoint) IsSubDomain() bool {
+	return ep.ProxyType == ProxyType_Subdomain
+}
+
+//Remove this proxy endpoint from running proxy endpoint list
+func (ep *ProxyEndpoint) Remove() error {
+	//fmt.Println(ptype, key)
+	if ep.IsVdir() {
+		ep.parent.ProxyEndpoints.Delete(ep.RootOrMatchingDomain)
+		return nil
+	} else if ep.IsSubDomain() {
+		ep.parent.SubdomainEndpoint.Delete(ep.RootOrMatchingDomain)
+		return nil
+	}
+	return errors.New("invalid or unsupported type")
+
+}
+
+//ProxyEndpoint remove provide global access by key
+func (router *Router) RemoveProxyEndpointByRootname(proxyType string, rootnameOrMatchingDomain string) error {
+	targetEpt, err := router.LoadProxy(proxyType, rootnameOrMatchingDomain)
+	if err != nil {
+		return err
+	}
+
+	return targetEpt.Remove()
+}

src/mod/dynamicproxy/proxyRequestHandler.go

@@ -95,6 +95,7 @@ func (h *ProxyHandler) subdomainRequest(w http.ResponseWriter, r *http.Request,
 		UseTLS:       target.RequireTLS,
 		PathPrefix:   "",
 	})
+
 	var dnsError *net.DNSError
 	if err != nil {
 		if errors.As(err, &dnsError) {
@@ -182,6 +183,5 @@ func (h *ProxyHandler) logRequest(r *http.Request, succ bool, statusCode int, fo
 			}
 			h.Parent.Option.StatisticCollector.RecordRequest(requestInfo)
 		}()
-
 	}
 }

src/mod/dynamicproxy/redirection/handler.go

@@ -28,13 +28,15 @@ func (t *RuleTable) HandleRedirect(w http.ResponseWriter, r *http.Request) int {
 	rr := t.MatchRedirectRule(requestPath)
 	if rr != nil {
 		redirectTarget := rr.TargetURL
-		//Always pad a / at the back of the target URL
-		if redirectTarget[len(redirectTarget)-1:] != "/" {
-			redirectTarget += "/"
-		}
+
 		if rr.ForwardChildpath {
-			//Remove the first / in the path
-			redirectTarget += strings.TrimPrefix(r.URL.Path, "/")
+			//Remove the first / in the path if the redirect target already have tailing slash
+			if strings.HasSuffix(redirectTarget, "/") {
+				redirectTarget += strings.TrimPrefix(r.URL.Path, "/")
+			} else {
+				redirectTarget += r.URL.Path
+			}
+
 			if r.URL.RawQuery != "" {
 				redirectTarget += "?" + r.URL.RawQuery
 			}

src/mod/dynamicproxy/rootRoute.go

@@ -0,0 +1,51 @@
+package dynamicproxy
+
+import (
+	"encoding/json"
+	"errors"
+	"log"
+	"os"
+
+	"imuslab.com/zoraxy/mod/utils"
+)
+
+/*
+	rootRoute.go
+
+	This script handle special case in routing where the root proxy
+	entity is involved. This also include its setting object
+	RootRoutingOptions
+*/
+
+var rootConfigFilepath string = "conf/root_config.json"
+
+func loadRootRoutingOptionsFromFile() (*RootRoutingOptions, error) {
+	if !utils.FileExists(rootConfigFilepath) {
+		//Not found. Create a root option
+		js, _ := json.MarshalIndent(RootRoutingOptions{}, "", " ")
+		err := os.WriteFile(rootConfigFilepath, js, 0775)
+		if err != nil {
+			return nil, errors.New("Unable to write root config to file: " + err.Error())
+		}
+	}
+	newRootOption := RootRoutingOptions{}
+	rootOptionsBytes, err := os.ReadFile(rootConfigFilepath)
+	if err != nil {
+		log.Println("[Error] Unable to read root config file at " + rootConfigFilepath + ": " + err.Error())
+		return nil, err
+	}
+	err = json.Unmarshal(rootOptionsBytes, &newRootOption)
+	if err != nil {
+		log.Println("[Error] Unable to parse root config file: " + err.Error())
+		return nil, err
+	}
+
+	return &newRootOption, nil
+}
+
+// Save the new config to file. Note that this will not overwrite the runtime one
+func (opt *RootRoutingOptions) SaveToFile() error {
+	js, _ := json.MarshalIndent(opt, "", " ")
+	err := os.WriteFile(rootConfigFilepath, js, 0775)
+	return err
+}

src/mod/dynamicproxy/special.go

@@ -13,10 +13,11 @@ import (
 */
 
 type RoutingRule struct {
-	ID             string
-	MatchRule      func(r *http.Request) bool
-	RoutingHandler func(http.ResponseWriter, *http.Request)
-	Enabled        bool
+	ID                     string //ID of the routing rule
+	Enabled                bool   //If the routing rule enabled
+	UseSystemAccessControl bool   //Pass access control check to system white/black list, set this to false to bypass white/black list
+	MatchRule              func(r *http.Request) bool
+	RoutingHandler         func(http.ResponseWriter, *http.Request)
 }
 
 // Router functions

src/mod/dynamicproxy/subdomain.go

@@ -34,13 +34,14 @@ func (router *Router) AddSubdomainRoutingService(options *SubdOptions) error {
 	proxy := dpcore.NewDynamicProxyCore(path, "", options.SkipCertValidations)
 
 	router.SubdomainEndpoint.Store(options.MatchingDomain, &ProxyEndpoint{
-		RootOrMatchingDomain: options.MatchingDomain,
-		Domain:               domain,
-		RequireTLS:           options.RequireTLS,
-		Proxy:                proxy,
-		SkipCertValidations:  options.SkipCertValidations,
-		RequireBasicAuth:     options.RequireBasicAuth,
-		BasicAuthCredentials: options.BasicAuthCredentials,
+		RootOrMatchingDomain:    options.MatchingDomain,
+		Domain:                  domain,
+		RequireTLS:              options.RequireTLS,
+		Proxy:                   proxy,
+		SkipCertValidations:     options.SkipCertValidations,
+		RequireBasicAuth:        options.RequireBasicAuth,
+		BasicAuthCredentials:    options.BasicAuthCredentials,
+		BasicAuthExceptionRules: options.BasicAuthExceptionRules,
 	})
 
 	log.Println("Adding Subdomain Rule: ", options.MatchingDomain+" to "+domain)

src/mod/dynamicproxy/templates/forbidden.html

@@ -0,0 +1,55 @@
+<html>
+    <head>
+        <!-- Zoraxy Forbidden Template -->
+        <meta charset="UTF-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1.0 user-scalable=no">
+        <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/semantic-ui/2.5.0/semantic.min.css">
+        <script type="text/javascript" src="https://code.jquery.com/jquery-3.6.4.min.js"></script>
+        <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/semantic-ui/2.5.0/semantic.min.js"></script>
+        <title>Forbidden</title>
+        <style>
+            #msg{
+                position: absolute;
+                top: calc(50% - 150px);
+                left: calc(50% - 250px);
+                width: 500px;
+                height: 300px;
+                text-align: center;
+            }
+
+            #footer{
+                position: fixed;
+                padding: 2em;
+                padding-left: 5em;
+                padding-right: 5em;
+                bottom: 0px;
+                left: 0px;
+                width: 100%;
+            }   
+
+            small{
+                word-break: break-word;
+            }
+        </style>
+    </head>
+    <body>
+        <div id="msg">
+            <h1 style="font-size: 6em; margin-bottom: 0px;"><i class="red ban icon"></i></h1>
+            <div>
+                <h3 style="margin-top: 1em;">403 - Forbidden</h3>
+                <div class="ui divider"></div>
+                <p>You do not have permission to view this directory or page. <br>
+                    This might cause by the region limit setting of this site.</p>
+                <div class="ui divider"></div>
+                <div style="text-align: left;">
+                    <small>Request time: <span id="reqtime"></span></small><br>
+                    <small id="reqURLDisplay">Request URI: <span id="requrl"></span></small>
+                </div>
+            </div>
+        </div>
+        <script>
+            $("#reqtime").text(new Date().toLocaleString(undefined, {year: 'numeric', month: '2-digit', day: '2-digit', weekday:"long", hour: '2-digit', hour12: false, minute:'2-digit', second:'2-digit'}));
+            $("#requrl").text(window.location.href);
+        </script>
+    </body>
+</html>

src/mod/dynamicproxy/typedef.go

@@ -1,6 +1,7 @@
 package dynamicproxy
 
 import (
+	_ "embed"
 	"net"
 	"net/http"
 	"sync"
@@ -31,20 +32,23 @@ type RouterOption struct {
 	RedirectRuleTable  *redirection.RuleTable
 	GeodbStore         *geodb.Store //GeoIP blacklist and whitelist
 	StatisticCollector *statistic.Collector
+	WebDirectory       string //The static web server directory containing the templates folder
 }
 
 type Router struct {
-	Option            *RouterOption
-	ProxyEndpoints    *sync.Map
-	SubdomainEndpoint *sync.Map
-	Running           bool
-	Root              *ProxyEndpoint
-	mux               http.Handler
-	server            *http.Server
-	tlsListener       net.Listener
-	routingRules      []*RoutingRule
+	Option             *RouterOption
+	ProxyEndpoints     *sync.Map
+	SubdomainEndpoint  *sync.Map
+	Running            bool
+	Root               *ProxyEndpoint
+	RootRoutingOptions *RootRoutingOptions
+	mux                http.Handler
+	server             *http.Server
+	tlsListener        net.Listener
+	routingRules       []*RoutingRule
 
-	tlsRedirectStop chan bool
+	tlsRedirectStop chan bool      //Stop channel for tls redirection server
+	tldMap          map[string]int //Top level domain map, see tld.json
 }
 
 // Auth credential for basic auth on certain endpoints
@@ -59,56 +63,73 @@ type BasicAuthUnhashedCredentials struct {
 	Password string
 }
 
-// A proxy endpoint record
-type ProxyEndpoint struct {
-	ProxyType            int                     //The type of this proxy, see const def
-	RootOrMatchingDomain string                  //Root for vdir or Matching domain for subd
-	Domain               string                  //Domain or IP to proxy to
-	RequireTLS           bool                    //Target domain require TLS
-	SkipCertValidations  bool                    //Set to true to accept self signed certs
-	RequireBasicAuth     bool                    //Set to true to request basic auth before proxy
-	BasicAuthCredentials []*BasicAuthCredentials `json:"-"`
-	Proxy                *dpcore.ReverseProxy    `json:"-"`
+// Paths to exclude in basic auth enabled proxy handler
+type BasicAuthExceptionRule struct {
+	PathPrefix string
 }
 
+// A proxy endpoint record
+type ProxyEndpoint struct {
+	ProxyType               int                       //The type of this proxy, see const def
+	RootOrMatchingDomain    string                    //Root for vdir or Matching domain for subd, also act as key
+	Domain                  string                    //Domain or IP to proxy to
+	RequireTLS              bool                      //Target domain require TLS
+	BypassGlobalTLS         bool                      //Bypass global TLS setting options if TLS Listener enabled (parent.tlsListener != nil)
+	SkipCertValidations     bool                      //Set to true to accept self signed certs
+	RequireBasicAuth        bool                      //Set to true to request basic auth before proxy
+	BasicAuthCredentials    []*BasicAuthCredentials   `json:"-"` //Basic auth credentials
+	BasicAuthExceptionRules []*BasicAuthExceptionRule //Path to exclude in a basic auth enabled proxy target
+	Proxy                   *dpcore.ReverseProxy      `json:"-"`
+
+	parent *Router
+}
+
+// Root options are those that are required for reverse proxy handler to work
 type RootOptions struct {
-	ProxyLocation        string
-	RequireTLS           bool
-	SkipCertValidations  bool
-	RequireBasicAuth     bool
-	BasicAuthCredentials []*BasicAuthCredentials
+	ProxyLocation       string //Proxy Root target, all unset traffic will be forward to here
+	RequireTLS          bool   //Proxy root target require TLS connection (not recommended)
+	BypassGlobalTLS     bool   //Bypass global TLS setting and make root http only (not recommended)
+	SkipCertValidations bool   //Skip cert validation, suitable for self-signed certs, CURRENTLY NOT USED
+
+	//Basic Auth Related
+	RequireBasicAuth        bool //Require basic auth, CURRENTLY NOT USED
+	BasicAuthCredentials    []*BasicAuthCredentials
+	BasicAuthExceptionRules []*BasicAuthExceptionRule
+}
+
+// Additional options are here for letting router knows how to route exception cases for root
+type RootRoutingOptions struct {
+	//Root only configs
+	EnableRedirectForUnsetRules bool   //Force unset rules to redirect to custom domain
+	UnsetRuleRedirectTarget     string //Custom domain to redirect to for unset rules
 }
 
 type VdirOptions struct {
-	RootName             string
-	Domain               string
-	RequireTLS           bool
-	SkipCertValidations  bool
-	RequireBasicAuth     bool
-	BasicAuthCredentials []*BasicAuthCredentials
+	RootName                string
+	Domain                  string
+	RequireTLS              bool
+	BypassGlobalTLS         bool
+	SkipCertValidations     bool
+	RequireBasicAuth        bool
+	BasicAuthCredentials    []*BasicAuthCredentials
+	BasicAuthExceptionRules []*BasicAuthExceptionRule
 }
 
 type SubdOptions struct {
-	MatchingDomain       string
-	Domain               string
-	RequireTLS           bool
-	SkipCertValidations  bool
-	RequireBasicAuth     bool
-	BasicAuthCredentials []*BasicAuthCredentials
+	MatchingDomain          string
+	Domain                  string
+	RequireTLS              bool
+	BypassGlobalTLS         bool
+	SkipCertValidations     bool
+	RequireBasicAuth        bool
+	BasicAuthCredentials    []*BasicAuthCredentials
+	BasicAuthExceptionRules []*BasicAuthExceptionRule
 }
 
 /*
-type ProxyEndpoint struct {
-	Root string
-	Domain         string
-	RequireTLS     bool
-	Proxy          *reverseproxy.ReverseProxy `json:"-"`
-}
-
-type SubdomainEndpoint struct {
-	MatchingDomain string
-	Domain         string
-	RequireTLS     bool
-	Proxy          *reverseproxy.ReverseProxy `json:"-"`
-}
+Web Templates
 */
+var (
+	//go:embed templates/forbidden.html
+	page_forbidden []byte
+)

src/mod/ganserv/authkeyLinux.go

@@ -13,8 +13,8 @@ import (
 )
 
 func readAuthTokenAsAdmin() (string, error) {
-	if utils.FileExists("./authtoken.secret") {
-		authKey, err := os.ReadFile("./authtoken.secret")
+	if utils.FileExists("./conf/authtoken.secret") {
+		authKey, err := os.ReadFile("./conf/authtoken.secret")
 		if err == nil {
 			return strings.TrimSpace(string(authKey)), nil
 		}

src/mod/ganserv/authkeyWin.go

@@ -19,8 +19,8 @@ import (
 // Use admin permission to read auth token on Windows
 func readAuthTokenAsAdmin() (string, error) {
 	//Check if the previous startup already extracted the authkey
-	if utils.FileExists("./authtoken.secret") {
-		authKey, err := os.ReadFile("./authtoken.secret")
+	if utils.FileExists("./conf/authtoken.secret") {
+		authKey, err := os.ReadFile("./conf/authtoken.secret")
 		if err == nil {
 			return strings.TrimSpace(string(authKey)), nil
 		}
@@ -30,7 +30,7 @@ func readAuthTokenAsAdmin() (string, error) {
 	exe := "cmd.exe"
 	cwd, _ := os.Getwd()
 
-	output, _ := filepath.Abs(filepath.Join("./", "authtoken.secret"))
+	output, _ := filepath.Abs(filepath.Join("./conf/", "authtoken.secret"))
 	os.WriteFile(output, []byte(""), 0775)
 	args := fmt.Sprintf("/C type \"C:\\ProgramData\\ZeroTier\\One\\authtoken.secret\" > \"" + output + "\"")
 
@@ -49,13 +49,13 @@ func readAuthTokenAsAdmin() (string, error) {
 	log.Println("Please click agree to allow access to ZeroTier authtoken from ProgramData")
 	retry := 0
 	time.Sleep(3 * time.Second)
-	for !utils.FileExists("./authtoken.secret") && retry < 10 {
+	for !utils.FileExists("./conf/authtoken.secret") && retry < 10 {
 		time.Sleep(3 * time.Second)
 		log.Println("Waiting for ZeroTier authtoken extraction...")
 		retry++
 	}
 
-	authKey, err := os.ReadFile("./authtoken.secret")
+	authKey, err := os.ReadFile("./conf/authtoken.secret")
 	if err != nil {
 		return "", err
 	}

src/mod/geodb/geodb.go

@@ -20,13 +20,16 @@ type Store struct {
 	WhitelistEnabled bool
 	geodb            [][]string //Parsed geodb list
 	geodbIpv6        [][]string //Parsed geodb list for ipv6
-
-	geotrie     *trie
-	geotrieIpv6 *trie
-
+	geotrie          *trie
+	geotrieIpv6      *trie
 	//geoipCache sync.Map
+	sysdb  *database.Database
+	option *StoreOptions
+}
 
-	sysdb *database.Database
+type StoreOptions struct {
+	AllowSlowIpv4LookUp bool
+	AllowSloeIpv6Lookup bool
 }
 
 type CountryInfo struct {
@@ -34,7 +37,7 @@ type CountryInfo struct {
 	ContinetCode   string
 }
 
-func NewGeoDb(sysdb *database.Database) (*Store, error) {
+func NewGeoDb(sysdb *database.Database, option *StoreOptions) (*Store, error) {
 	parsedGeoData, err := parseCSV(geoipv4)
 	if err != nil {
 		return nil, err
@@ -79,14 +82,25 @@ func NewGeoDb(sysdb *database.Database) (*Store, error) {
 		log.Println("Database pointer set to nil: Entering debug mode")
 	}
 
+	var ipv4Trie *trie
+	if !option.AllowSlowIpv4LookUp {
+		ipv4Trie = constrctTrieTree(parsedGeoData)
+	}
+
+	var ipv6Trie *trie
+	if !option.AllowSloeIpv6Lookup {
+		ipv6Trie = constrctTrieTree(parsedGeoDataIpv6)
+	}
+
 	return &Store{
 		BlacklistEnabled: blacklistEnabled,
 		WhitelistEnabled: whitelistEnabled,
 		geodb:            parsedGeoData,
-		geotrie:          constrctTrieTree(parsedGeoData),
+		geotrie:          ipv4Trie,
 		geodbIpv6:        parsedGeoDataIpv6,
-		geotrieIpv6:      constrctTrieTree(parsedGeoDataIpv6),
+		geotrieIpv6:      ipv6Trie,
 		sysdb:            sysdb,
+		option:           option,
 	}, nil
 }
 
@@ -106,6 +120,7 @@ func (s *Store) ResolveCountryCodeFromIP(ipstring string) (*CountryInfo, error)
 		CountryIsoCode: cc,
 		ContinetCode:   "",
 	}, nil
+
 }
 
 func (s *Store) Close() {

src/mod/geodb/geodb_test.go

@@ -41,7 +41,10 @@ func TestTrieConstruct(t *testing.T) {
 
 func TestResolveCountryCodeFromIP(t *testing.T) {
 	// Create a new store
-	store, err := geodb.NewGeoDb(nil)
+	store, err := geodb.NewGeoDb(nil, &geodb.StoreOptions{
+		false,
+		false,
+	})
 	if err != nil {
 		t.Errorf("error creating store: %v", err)
 		return

src/mod/geodb/geoloader.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"encoding/csv"
 	"io"
-	"net"
 	"strings"
 )
 
@@ -26,9 +25,17 @@ func (s *Store) search(ip string) string {
 	//Search in geotrie tree
 	cc := ""
 	if IsIPv6(ip) {
-		cc = s.geotrieIpv6.search(ip)
+		if s.geotrieIpv6 == nil {
+			cc = s.slowSearchIpv6(ip)
+		} else {
+			cc = s.geotrieIpv6.search(ip)
+		}
 	} else {
-		cc = s.geotrie.search(ip)
+		if s.geotrie == nil {
+			cc = s.slowSearchIpv4(ip)
+		} else {
+			cc = s.geotrie.search(ip)
+		}
 	}
 
 	/*
@@ -69,27 +76,3 @@ func parseCSV(content []byte) ([][]string, error) {
 	}
 	return records, nil
 }
-
-// Check if a ip string is within the range of two others
-func isIPInRange(ip, start, end string) bool {
-	ipAddr := net.ParseIP(ip)
-	if ipAddr == nil {
-		return false
-	}
-
-	startAddr := net.ParseIP(start)
-	if startAddr == nil {
-		return false
-	}
-
-	endAddr := net.ParseIP(end)
-	if endAddr == nil {
-		return false
-	}
-
-	if ipAddr.To4() == nil || startAddr.To4() == nil || endAddr.To4() == nil {
-		return false
-	}
-
-	return bytes.Compare(ipAddr.To4(), startAddr.To4()) >= 0 && bytes.Compare(ipAddr.To4(), endAddr.To4()) <= 0
-}

src/mod/geodb/slowSearch.go

@@ -0,0 +1,81 @@
+package geodb
+
+import (
+	"errors"
+	"math/big"
+	"net"
+)
+
+/*
+	slowSearch.go
+
+	This script implement the slow search method for ip to country code
+	lookup. If you have the memory allocation for near O(1) lookup,
+	you should not be using slow search mode.
+*/
+
+func ipv4ToUInt32(ip net.IP) uint32 {
+	ip = ip.To4()
+	return uint32(ip[0])<<24 | uint32(ip[1])<<16 | uint32(ip[2])<<8 | uint32(ip[3])
+}
+
+func isIPv4InRange(startIP, endIP, testIP string) (bool, error) {
+	start := net.ParseIP(startIP)
+	end := net.ParseIP(endIP)
+	test := net.ParseIP(testIP)
+
+	if start == nil || end == nil || test == nil {
+		return false, errors.New("invalid IP address format")
+	}
+
+	startUint := ipv4ToUInt32(start)
+	endUint := ipv4ToUInt32(end)
+	testUint := ipv4ToUInt32(test)
+
+	return testUint >= startUint && testUint <= endUint, nil
+}
+
+func isIPv6InRange(startIP, endIP, testIP string) (bool, error) {
+	start := net.ParseIP(startIP)
+	end := net.ParseIP(endIP)
+	test := net.ParseIP(testIP)
+
+	if start == nil || end == nil || test == nil {
+		return false, errors.New("invalid IP address format")
+	}
+
+	startInt := new(big.Int).SetBytes(start.To16())
+	endInt := new(big.Int).SetBytes(end.To16())
+	testInt := new(big.Int).SetBytes(test.To16())
+
+	return testInt.Cmp(startInt) >= 0 && testInt.Cmp(endInt) <= 0, nil
+}
+
+// Slow country code lookup for
+func (s *Store) slowSearchIpv4(ipAddr string) string {
+	for _, ipRange := range s.geodb {
+		startIp := ipRange[0]
+		endIp := ipRange[1]
+		cc := ipRange[2]
+
+		inRange, _ := isIPv4InRange(startIp, endIp, ipAddr)
+		if inRange {
+			return cc
+		}
+	}
+	return ""
+}
+
+func (s *Store) slowSearchIpv6(ipAddr string) string {
+	for _, ipRange := range s.geodbIpv6 {
+		startIp := ipRange[0]
+		endIp := ipRange[1]
+		cc := ipRange[2]
+
+		inRange, _ := isIPv6InRange(startIp, endIp, ipAddr)
+		if inRange {
+			return cc
+		}
+	}
+	return ""
+}

src/mod/geodb/trie.go

@@ -1,15 +1,12 @@
 package geodb
 
 import (
-	"fmt"
+	"math"
 	"net"
-	"strconv"
-	"strings"
 )
 
 type trie_Node struct {
 	childrens [2]*trie_Node
-	ends      bool
 	cc        string
 }
 
@@ -18,7 +15,7 @@ type trie struct {
 	root *trie_Node
 }
 
-func ipToBitString(ip string) string {
+func ipToBytes(ip string) []byte {
 	// Parse the IP address string into a net.IP object
 	parsedIP := net.ParseIP(ip)
 
@@ -29,49 +26,7 @@ func ipToBitString(ip string) string {
 		ipBytes = parsedIP.To16()
 	}
 
-	// Convert each byte in the IP address to its 8-bit binary representation
-	var result []string
-	for _, b := range ipBytes {
-		result = append(result, fmt.Sprintf("%08b", b))
-	}
-
-	// Join the binary representation of each byte with dots to form the final bit string
-	return strings.Join(result, "")
-}
-
-func bitStringToIp(bitString string) string {
-	// Check if the bit string represents an IPv4 or IPv6 address
-	isIPv4 := len(bitString) == 32
-
-	// Split the bit string into 8-bit segments
-	segments := make([]string, 0)
-	if isIPv4 {
-		for i := 0; i < 4; i++ {
-			segments = append(segments, bitString[i*8:(i+1)*8])
-		}
-	} else {
-		for i := 0; i < 16; i++ {
-			segments = append(segments, bitString[i*8:(i+1)*8])
-		}
-	}
-
-	// Convert each segment to its decimal equivalent
-	decimalSegments := make([]int, len(segments))
-	for i, s := range segments {
-		val, _ := strconv.ParseInt(s, 2, 64)
-		decimalSegments[i] = int(val)
-	}
-
-	// Construct the IP address string based on the type (IPv4 or IPv6)
-	if isIPv4 {
-		return fmt.Sprintf("%d.%d.%d.%d", decimalSegments[0], decimalSegments[1], decimalSegments[2], decimalSegments[3])
-	} else {
-		ip := make(net.IP, net.IPv6len)
-		for i := 0; i < net.IPv6len; i++ {
-			ip[i] = byte(decimalSegments[i])
-		}
-		return ip.String()
-	}
+	return ipBytes
 }
 
 // inititlaizing a new trie
@@ -83,20 +38,39 @@ func newTrie() *trie {
 
 // Passing words to trie
 func (t *trie) insert(ipAddr string, cc string) {
-	word := ipToBitString(ipAddr)
+	ipBytes := ipToBytes(ipAddr)
 	current := t.root
-	for _, wr := range word {
-		index := wr - '0'
-		if current.childrens[index] == nil {
-			current.childrens[index] = &trie_Node{
-				childrens: [2]*trie_Node{},
-				ends:      false,
-				cc:        cc,
+	for _, b := range ipBytes {
+		//For each byte in the ip address
+		//each byte is 8 bit
+		for j := 0; j < 8; j++ {
+			bitwise := (b&uint8(math.Pow(float64(2), float64(j))) > 0)
+			bit := 0b0000
+			if bitwise {
+				bit = 0b0001
 			}
+			if current.childrens[bit] == nil {
+				current.childrens[bit] = &trie_Node{
+					childrens: [2]*trie_Node{},
+					cc:        cc,
+				}
+			}
+			current = current.childrens[bit]
 		}
-		current = current.childrens[index]
 	}
-	current.ends = true
+
+	/*
+		for i := 63; i >= 0; i-- {
+			bit := (ipInt64 >> uint(i)) & 1
+			if current.childrens[bit] == nil {
+				current.childrens[bit] = &trie_Node{
+					childrens: [2]*trie_Node{},
+					cc:        cc,
+				}
+			}
+			current = current.childrens[bit]
+		}
+	*/
 }
 
 func isReservedIP(ip string) bool {
@@ -126,16 +100,34 @@ func (t *trie) search(ipAddr string) string {
 	if isReservedIP(ipAddr) {
 		return ""
 	}
-	word := ipToBitString(ipAddr)
+
+	ipBytes := ipToBytes(ipAddr)
 	current := t.root
-	for _, wr := range word {
-		index := wr - '0'
-		if current.childrens[index] == nil {
-			return current.cc
+	for _, b := range ipBytes {
+		//For each byte in the ip address
+		//each byte is 8 bit
+		for j := 0; j < 8; j++ {
+			bitwise := (b&uint8(math.Pow(float64(2), float64(j))) > 0)
+			bit := 0b0000
+			if bitwise {
+				bit = 0b0001
+			}
+			if current.childrens[bit] == nil {
+				return current.cc
+			}
+			current = current.childrens[bit]
 		}
-		current = current.childrens[index]
 	}
-	if current.ends {
+	/*
+		for i := 63; i >= 0; i-- {
+			bit := (ipInt64 >> uint(i)) & 1
+			if current.childrens[bit] == nil {
+				return current.cc
+			}
+			current = current.childrens[bit]
+		}
+	*/
+	if len(current.childrens) == 0 {
 		return current.cc
 	}
 

src/mod/mdns/mdns.go

@@ -226,7 +226,7 @@ func (m *MDNSHost) Scan(timeout int, domainFilter string) []*NetworkHost {
 	return discoveredHost
 }
 
-//Get all mac address of all interfaces
+// Get all mac address of all interfaces
 func getMacAddr() ([]string, error) {
 	ifas, err := net.Interfaces()
 	if err != nil {

src/mod/netstat/netstat.go

@@ -213,6 +213,7 @@ func GetNetworkInterfaceStats() (int64, int64, error) {
 			out, err := cmd.Output()
 			if err != nil {
 				callbackChan <- wmicResult{0, 0, err}
+				return
 			}
 
 			//Filter out the first line
@@ -251,18 +252,16 @@ func GetNetworkInterfaceStats() (int64, int64, error) {
 
 		go func() {
 			//Spawn a timer to terminate the cmd process if timeout
-			var timer *time.Timer
-			timer = time.AfterFunc(3*time.Second, func() {
-				timer.Stop()
-				if cmd != nil && cmd.Process != nil {
-					cmd.Process.Kill()
-				}
+			time.Sleep(3 * time.Second)
+			if cmd != nil && cmd.Process != nil {
+				cmd.Process.Kill()
 				callbackChan <- wmicResult{0, 0, errors.New("wmic execution timeout")}
-			})
+			}
 		}()
 
 		result := wmicResult{}
 		result = <-callbackChan
+		cmd = nil
 		if result.Err != nil {
 			log.Println("Unable to extract NIC info from wmic: " + result.Err.Error())
 		}

src/mod/netutils/netutils.go

@@ -3,9 +3,11 @@ package netutils
 import (
 	"encoding/json"
 	"fmt"
+	"net"
 	"net/http"
 	"strconv"
 
+	"github.com/likexian/whois"
 	"imuslab.com/zoraxy/mod/utils"
 )
 
@@ -46,6 +48,50 @@ func TraceRoute(targetIpOrDomain string, maxHops int) ([]string, error) {
 	return traceroute(targetIpOrDomain, maxHops)
 }
 
+func HandleWhois(w http.ResponseWriter, r *http.Request) {
+	targetIpOrDomain, err := utils.GetPara(r, "target")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid target (domain or ip) address given")
+		return
+	}
+
+	raw, _ := utils.GetPara(r, "raw")
+
+	result, err := whois.Whois(targetIpOrDomain)
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+
+	if raw == "true" {
+		utils.SendTextResponse(w, result)
+	} else {
+		if isDomainName(targetIpOrDomain) {
+			//Is Domain
+			parsedOutput, err := ParseWHOISResponse(result)
+			if err != nil {
+				utils.SendErrorResponse(w, err.Error())
+				return
+			}
+
+			js, _ := json.Marshal(parsedOutput)
+			utils.SendJSONResponse(w, string(js))
+		} else {
+			//Is IP
+			parsedOutput, err := ParseWhoisIpData(result)
+			if err != nil {
+				utils.SendErrorResponse(w, err.Error())
+				return
+			}
+
+			js, _ := json.Marshal(parsedOutput)
+			utils.SendJSONResponse(w, string(js))
+		}
+
+	}
+
+}
+
 func HandlePing(w http.ResponseWriter, r *http.Request) {
 	targetIpOrDomain, err := utils.GetPara(r, "target")
 	if err != nil {
@@ -53,13 +99,44 @@ func HandlePing(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	results := []string{}
+	type MixedPingResults struct {
+		ICMP []string
+		TCP  []string
+		UDP  []string
+	}
+
+	results := MixedPingResults{
+		ICMP: []string{},
+		TCP:  []string{},
+		UDP:  []string{},
+	}
+
+	//Ping ICMP
 	for i := 0; i < 4; i++ {
 		realIP, pingTime, ttl, err := PingIP(targetIpOrDomain)
 		if err != nil {
-			results = append(results, "Reply from "+realIP+": "+err.Error())
+			results.ICMP = append(results.ICMP, "Reply from "+realIP+": "+err.Error())
 		} else {
-			results = append(results, fmt.Sprintf("Reply from %s: Time=%dms TTL=%d", realIP, pingTime.Milliseconds(), ttl))
+			results.ICMP = append(results.ICMP, fmt.Sprintf("Reply from %s: Time=%dms TTL=%d", realIP, pingTime.Milliseconds(), ttl))
+		}
+	}
+
+	//Ping TCP
+	for i := 0; i < 4; i++ {
+		pingTime, err := TCPPing(targetIpOrDomain)
+		if err != nil {
+			results.TCP = append(results.TCP, "Reply from "+resolveIpFromDomain(targetIpOrDomain)+": "+err.Error())
+		} else {
+			results.TCP = append(results.TCP, fmt.Sprintf("Reply from %s: Time=%dms", resolveIpFromDomain(targetIpOrDomain), pingTime.Milliseconds()))
+		}
+	}
+	//Ping UDP
+	for i := 0; i < 4; i++ {
+		pingTime, err := UDPPing(targetIpOrDomain)
+		if err != nil {
+			results.UDP = append(results.UDP, "Reply from "+resolveIpFromDomain(targetIpOrDomain)+": "+err.Error())
+		} else {
+			results.UDP = append(results.UDP, fmt.Sprintf("Reply from %s: Time=%dms", resolveIpFromDomain(targetIpOrDomain), pingTime.Milliseconds()))
 		}
 	}
 
@@ -67,3 +144,16 @@ func HandlePing(w http.ResponseWriter, r *http.Request) {
 	utils.SendJSONResponse(w, string(js))
 
 }
+
+func resolveIpFromDomain(targetIpOrDomain string) string {
+	//Resolve target ip address
+	targetIpAddrString := ""
+	ipAddr, err := net.ResolveIPAddr("ip", targetIpOrDomain)
+	if err != nil {
+		targetIpAddrString = targetIpOrDomain
+	} else {
+		targetIpAddrString = ipAddr.IP.String()
+	}
+
+	return targetIpAddrString
+}

src/mod/netutils/pingip.go

@@ -6,6 +6,39 @@ import (
 	"time"
 )
 
+// TCP ping
+func TCPPing(ipOrDomain string) (time.Duration, error) {
+	start := time.Now()
+
+	conn, err := net.DialTimeout("tcp", ipOrDomain+":80", 3*time.Second)
+	if err != nil {
+		return 0, fmt.Errorf("failed to establish TCP connection: %v", err)
+	}
+	defer conn.Close()
+
+	elapsed := time.Since(start)
+	pingTime := elapsed.Round(time.Millisecond)
+
+	return pingTime, nil
+}
+
+// UDP Ping
+func UDPPing(ipOrDomain string) (time.Duration, error) {
+	start := time.Now()
+
+	conn, err := net.DialTimeout("udp", ipOrDomain+":80", 3*time.Second)
+	if err != nil {
+		return 0, fmt.Errorf("failed to establish UDP connection: %v", err)
+	}
+	defer conn.Close()
+
+	elapsed := time.Since(start)
+	pingTime := elapsed.Round(time.Millisecond)
+
+	return pingTime, nil
+}
+
+// Traditional ICMP ping
 func PingIP(ipOrDomain string) (string, time.Duration, int, error) {
 	ipAddr, err := net.ResolveIPAddr("ip", ipOrDomain)
 	if err != nil {

src/mod/netutils/whois.go

@@ -0,0 +1,199 @@
+package netutils
+
+import (
+	"net"
+	"strings"
+	"time"
+)
+
+type WHOISResult struct {
+	DomainName       string    `json:"domainName"`
+	RegistryDomainID string    `json:"registryDomainID"`
+	Registrar        string    `json:"registrar"`
+	UpdatedDate      time.Time `json:"updatedDate"`
+	CreationDate     time.Time `json:"creationDate"`
+	ExpiryDate       time.Time `json:"expiryDate"`
+	RegistrantID     string    `json:"registrantID"`
+	RegistrantName   string    `json:"registrantName"`
+	RegistrantEmail  string    `json:"registrantEmail"`
+	AdminID          string    `json:"adminID"`
+	AdminName        string    `json:"adminName"`
+	AdminEmail       string    `json:"adminEmail"`
+	TechID           string    `json:"techID"`
+	TechName         string    `json:"techName"`
+	TechEmail        string    `json:"techEmail"`
+	NameServers      []string  `json:"nameServers"`
+	DNSSEC           string    `json:"dnssec"`
+}
+
+func ParseWHOISResponse(response string) (WHOISResult, error) {
+	result := WHOISResult{}
+
+	lines := strings.Split(response, "\n")
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, "Domain Name:") {
+			result.DomainName = strings.TrimSpace(strings.TrimPrefix(line, "Domain Name:"))
+		} else if strings.HasPrefix(line, "Registry Domain ID:") {
+			result.RegistryDomainID = strings.TrimSpace(strings.TrimPrefix(line, "Registry Domain ID:"))
+		} else if strings.HasPrefix(line, "Registrar:") {
+			result.Registrar = strings.TrimSpace(strings.TrimPrefix(line, "Registrar:"))
+		} else if strings.HasPrefix(line, "Updated Date:") {
+			dateStr := strings.TrimSpace(strings.TrimPrefix(line, "Updated Date:"))
+			updatedDate, err := time.Parse("2006-01-02T15:04:05Z", dateStr)
+			if err == nil {
+				result.UpdatedDate = updatedDate
+			}
+		} else if strings.HasPrefix(line, "Creation Date:") {
+			dateStr := strings.TrimSpace(strings.TrimPrefix(line, "Creation Date:"))
+			creationDate, err := time.Parse("2006-01-02T15:04:05Z", dateStr)
+			if err == nil {
+				result.CreationDate = creationDate
+			}
+		} else if strings.HasPrefix(line, "Registry Expiry Date:") {
+			dateStr := strings.TrimSpace(strings.TrimPrefix(line, "Registry Expiry Date:"))
+			expiryDate, err := time.Parse("2006-01-02T15:04:05Z", dateStr)
+			if err == nil {
+				result.ExpiryDate = expiryDate
+			}
+		} else if strings.HasPrefix(line, "Registry Registrant ID:") {
+			result.RegistrantID = strings.TrimSpace(strings.TrimPrefix(line, "Registry Registrant ID:"))
+		} else if strings.HasPrefix(line, "Registrant Name:") {
+			result.RegistrantName = strings.TrimSpace(strings.TrimPrefix(line, "Registrant Name:"))
+		} else if strings.HasPrefix(line, "Registrant Email:") {
+			result.RegistrantEmail = strings.TrimSpace(strings.TrimPrefix(line, "Registrant Email:"))
+		} else if strings.HasPrefix(line, "Registry Admin ID:") {
+			result.AdminID = strings.TrimSpace(strings.TrimPrefix(line, "Registry Admin ID:"))
+		} else if strings.HasPrefix(line, "Admin Name:") {
+			result.AdminName = strings.TrimSpace(strings.TrimPrefix(line, "Admin Name:"))
+		} else if strings.HasPrefix(line, "Admin Email:") {
+			result.AdminEmail = strings.TrimSpace(strings.TrimPrefix(line, "Admin Email:"))
+		} else if strings.HasPrefix(line, "Registry Tech ID:") {
+			result.TechID = strings.TrimSpace(strings.TrimPrefix(line, "Registry Tech ID:"))
+		} else if strings.HasPrefix(line, "Tech Name:") {
+			result.TechName = strings.TrimSpace(strings.TrimPrefix(line, "Tech Name:"))
+		} else if strings.HasPrefix(line, "Tech Email:") {
+			result.TechEmail = strings.TrimSpace(strings.TrimPrefix(line, "Tech Email:"))
+		} else if strings.HasPrefix(line, "Name Server:") {
+			ns := strings.TrimSpace(strings.TrimPrefix(line, "Name Server:"))
+			result.NameServers = append(result.NameServers, ns)
+		} else if strings.HasPrefix(line, "DNSSEC:") {
+			result.DNSSEC = strings.TrimSpace(strings.TrimPrefix(line, "DNSSEC:"))
+		}
+	}
+
+	return result, nil
+}
+
+type WhoisIpLookupEntry struct {
+	NetRange     string
+	CIDR         string
+	NetName      string
+	NetHandle    string
+	Parent       string
+	NetType      string
+	OriginAS     string
+	Organization Organization
+	RegDate      time.Time
+	Updated      time.Time
+	Ref          string
+}
+
+type Organization struct {
+	OrgName    string
+	OrgId      string
+	Address    string
+	City       string
+	StateProv  string
+	PostalCode string
+	Country    string
+	/*
+		RegDate    time.Time
+		Updated    time.Time
+			OrgTechHandle    string
+			OrgTechName      string
+			OrgTechPhone     string
+			OrgTechEmail     string
+			OrgAbuseHandle   string
+			OrgAbuseName     string
+			OrgAbusePhone    string
+			OrgAbuseEmail    string
+			OrgRoutingHandle string
+			OrgRoutingName   string
+			OrgRoutingPhone  string
+			OrgRoutingEmail  string
+	*/
+}
+
+func ParseWhoisIpData(data string) (WhoisIpLookupEntry, error) {
+	var entry WhoisIpLookupEntry = WhoisIpLookupEntry{}
+	var org Organization = Organization{}
+
+	lines := strings.Split(data, "\n")
+
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, "NetRange:") {
+			entry.NetRange = strings.TrimSpace(strings.TrimPrefix(line, "NetRange:"))
+		} else if strings.HasPrefix(line, "CIDR:") {
+			entry.CIDR = strings.TrimSpace(strings.TrimPrefix(line, "CIDR:"))
+		} else if strings.HasPrefix(line, "NetName:") {
+			entry.NetName = strings.TrimSpace(strings.TrimPrefix(line, "NetName:"))
+		} else if strings.HasPrefix(line, "NetHandle:") {
+			entry.NetHandle = strings.TrimSpace(strings.TrimPrefix(line, "NetHandle:"))
+		} else if strings.HasPrefix(line, "Parent:") {
+			entry.Parent = strings.TrimSpace(strings.TrimPrefix(line, "Parent:"))
+		} else if strings.HasPrefix(line, "NetType:") {
+			entry.NetType = strings.TrimSpace(strings.TrimPrefix(line, "NetType:"))
+		} else if strings.HasPrefix(line, "OriginAS:") {
+			entry.OriginAS = strings.TrimSpace(strings.TrimPrefix(line, "OriginAS:"))
+		} else if strings.HasPrefix(line, "Organization:") {
+			org.OrgName = strings.TrimSpace(strings.TrimPrefix(line, "Organization:"))
+		} else if strings.HasPrefix(line, "OrgId:") {
+			org.OrgId = strings.TrimSpace(strings.TrimPrefix(line, "OrgId:"))
+		} else if strings.HasPrefix(line, "Address:") {
+			org.Address = strings.TrimSpace(strings.TrimPrefix(line, "Address:"))
+		} else if strings.HasPrefix(line, "City:") {
+			org.City = strings.TrimSpace(strings.TrimPrefix(line, "City:"))
+		} else if strings.HasPrefix(line, "StateProv:") {
+			org.StateProv = strings.TrimSpace(strings.TrimPrefix(line, "StateProv:"))
+		} else if strings.HasPrefix(line, "PostalCode:") {
+			org.PostalCode = strings.TrimSpace(strings.TrimPrefix(line, "PostalCode:"))
+		} else if strings.HasPrefix(line, "Country:") {
+			org.Country = strings.TrimSpace(strings.TrimPrefix(line, "Country:"))
+		} else if strings.HasPrefix(line, "RegDate:") {
+			entry.RegDate, _ = parseDate(strings.TrimSpace(strings.TrimPrefix(line, "RegDate:")))
+		} else if strings.HasPrefix(line, "Updated:") {
+			entry.Updated, _ = parseDate(strings.TrimSpace(strings.TrimPrefix(line, "Updated:")))
+		} else if strings.HasPrefix(line, "Ref:") {
+			entry.Ref = strings.TrimSpace(strings.TrimPrefix(line, "Ref:"))
+		}
+	}
+
+	entry.Organization = org
+	return entry, nil
+}
+
+func parseDate(dateStr string) (time.Time, error) {
+	dateLayout := "2006-01-02"
+	date, err := time.Parse(dateLayout, strings.TrimSpace(dateStr))
+	if err != nil {
+		return time.Time{}, err
+	}
+	return date, nil
+}
+
+func isDomainName(input string) bool {
+	ip := net.ParseIP(input)
+	if ip != nil {
+		// Check if it's IPv4 or IPv6
+		if ip.To4() != nil {
+			return false
+		} else if ip.To16() != nil {
+			return false
+		}
+	}
+
+	_, err := net.LookupHost(input)
+	return err == nil
+}

src/mod/pathrule/handler.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"strconv"
 
-	uuid "github.com/satori/go.uuid"
+	"github.com/google/uuid"
 	"imuslab.com/zoraxy/mod/utils"
 )
 
@@ -58,7 +58,7 @@ func (h *Handler) HandleAddBlockingPath(w http.ResponseWriter, r *http.Request)
 	}
 
 	targetBlockingPath := BlockingPath{
-		UUID:          uuid.NewV4().String(),
+		UUID:          uuid.New().String(),
 		MatchingPath:  matchingPath,
 		ExactMatch:    exactMatch == "true",
 		StatusCode:    statusCode,

src/mod/pathrule/pathrule.go

@@ -12,15 +12,14 @@ import (
 )
 
 /*
-	Pathblock.go
+	Pathrules.go
 
-	This script block off some of the specific pathname in access
-	For example, this module can help you block request for a particular
-	apache directory or functional endpoints like /.well-known/ when you
-	are not using it
+	This script handle advance path settings and rules on particular
+	paths of the incoming requests
 */
 
 type Options struct {
+	Enabled      bool   //If the pathrule is enabled.
 	ConfigFolder string //The folder to store the path blocking config files
 }
 
@@ -41,7 +40,7 @@ type Handler struct {
 }
 
 // Create a new path blocker handler
-func NewPathBlocker(options *Options) *Handler {
+func NewPathRuleHandler(options *Options) *Handler {
 	//Create folder if not exists
 	if !utils.FileExists(options.ConfigFolder) {
 		os.Mkdir(options.ConfigFolder, 0775)

src/mod/tcpprox/tcpprox.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"net"
 
-	uuid "github.com/satori/go.uuid"
+	"github.com/google/uuid"
 	"imuslab.com/zoraxy/mod/database"
 )
 
@@ -95,7 +95,7 @@ func NewTCProxy(options *Options) *Manager {
 
 func (m *Manager) NewConfig(config *ProxyRelayOptions) string {
 	//Generate a new config from options
-	configUUID := uuid.NewV4().String()
+	configUUID := uuid.New().String()
 	thisConfig := ProxyRelayConfig{
 		UUID:                        configUUID,
 		Name:                        config.Name,

src/mod/uptime/uptime.go

@@ -93,8 +93,6 @@ func (m *Monitor) ExecuteUptimeCheck() {
 				Latency:    laterncy,
 			}
 
-			//fmt.Println(thisRecord)
-
 		} else {
 			log.Println("Unknown protocol: " + target.Protocol + ". Skipping")
 			continue
@@ -238,9 +236,11 @@ func getWebsiteStatus(url string) (int, error) {
 			}
 			return 0, err
 		}
-
+		defer resp.Body.Close()
+		status_code := resp.StatusCode
+		return status_code, nil
 	}
+	defer resp.Body.Close()
 	status_code := resp.StatusCode
-	resp.Body.Close()
 	return status_code, nil
 }

src/mod/utils/utils.go

@@ -1,13 +1,11 @@
 package utils
 
 import (
-	"bufio"
-	"encoding/base64"
 	"errors"
-	"io"
 	"log"
 	"net/http"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -40,46 +38,6 @@ func SendOK(w http.ResponseWriter) {
 	w.Write([]byte("\"OK\""))
 }
 
-/*
-	The paramter move function (mv)
-
-	You can find similar things in the PHP version of ArOZ Online Beta. You need to pass in
-	r (HTTP Request Object)
-	getParamter (string, aka $_GET['This string])
-
-	Will return
-	Paramter string (if any)
-	Error (if error)
-
-*/
-/*
-func Mv(r *http.Request, getParamter string, postMode bool) (string, error) {
-	if postMode == false {
-		//Access the paramter via GET
-		keys, ok := r.URL.Query()[getParamter]
-
-		if !ok || len(keys[0]) < 1 {
-			//log.Println("Url Param " + getParamter +" is missing")
-			return "", errors.New("GET paramter " + getParamter + " not found or it is empty")
-		}
-
-		// Query()["key"] will return an array of items,
-		// we only want the single item.
-		key := keys[0]
-		return string(key), nil
-	} else {
-		//Access the parameter via POST
-		r.ParseForm()
-		x := r.Form.Get(getParamter)
-		if len(x) == 0 || x == "" {
-			return "", errors.New("POST paramter " + getParamter + " not found or it is empty")
-		}
-		return string(x), nil
-	}
-
-}
-*/
-
 // Get GET parameter
 func GetPara(r *http.Request, key string) (string, error) {
 	keys, ok := r.URL.Query()[key]
@@ -101,6 +59,40 @@ func PostPara(r *http.Request, key string) (string, error) {
 	}
 }
 
+// Get POST paramter as boolean, accept 1 or true
+func PostBool(r *http.Request, key string) (bool, error) {
+	x, err := PostPara(r, key)
+	if err != nil {
+		return false, err
+	}
+
+	x = strings.TrimSpace(x)
+
+	if x == "1" || strings.ToLower(x) == "true" {
+		return true, nil
+	} else if x == "0" || strings.ToLower(x) == "false" {
+		return false, nil
+	}
+
+	return false, errors.New("invalid boolean given")
+}
+
+// Get POST paramter as int
+func PostInt(r *http.Request, key string) (int, error) {
+	x, err := PostPara(r, key)
+	if err != nil {
+		return 0, err
+	}
+
+	x = strings.TrimSpace(x)
+	rx, err := strconv.Atoi(x)
+	if err != nil {
+		return 0, err
+	}
+
+	return rx, nil
+}
+
 func FileExists(filename string) bool {
 	_, err := os.Stat(filename)
 	if os.IsNotExist(err) {
@@ -131,30 +123,6 @@ func TimeToString(targetTime time.Time) string {
 	return targetTime.Format("2006-01-02 15:04:05")
 }
 
-func LoadImageAsBase64(filepath string) (string, error) {
-	if !FileExists(filepath) {
-		return "", errors.New("File not exists")
-	}
-	f, _ := os.Open(filepath)
-	reader := bufio.NewReader(f)
-	content, _ := io.ReadAll(reader)
-	encoded := base64.StdEncoding.EncodeToString(content)
-	return string(encoded), nil
-}
-
-// Use for redirections
-func ConstructRelativePathFromRequestURL(requestURI string, redirectionLocation string) string {
-	if strings.Count(requestURI, "/") == 1 {
-		//Already root level
-		return redirectionLocation
-	}
-	for i := 0; i < strings.Count(requestURI, "/")-1; i++ {
-		redirectionLocation = "../" + redirectionLocation
-	}
-
-	return redirectionLocation
-}
-
 // Check if given string in a given slice
 func StringInArray(arr []string, str string) bool {
 	for _, a := range arr {

src/mod/webserv/filemanager/filemanager.go

@@ -0,0 +1,406 @@
+package filemanager
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"imuslab.com/zoraxy/mod/utils"
+)
+
+/*
+	File Manager
+
+	This is a simple package that handles file management
+	under the web server directory
+*/
+
+type FileManager struct {
+	Directory string
+}
+
+// Create a new file manager with directory as root
+func NewFileManager(directory string) *FileManager {
+	return &FileManager{
+		Directory: directory,
+	}
+}
+
+// Handle listing of a given directory
+func (fm *FileManager) HandleList(w http.ResponseWriter, r *http.Request) {
+	directory, err := utils.GetPara(r, "dir")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid directory given")
+		return
+	}
+
+	// Construct the absolute path to the target directory
+	targetDir := filepath.Join(fm.Directory, directory)
+
+	// Open the target directory
+	dirEntries, err := os.ReadDir(targetDir)
+	if err != nil {
+		utils.SendErrorResponse(w, "unable to open directory")
+		return
+	}
+
+	// Create a slice to hold the file information
+	var files []map[string]interface{} = []map[string]interface{}{}
+
+	// Iterate through the directory entries
+	for _, dirEntry := range dirEntries {
+		fileInfo := make(map[string]interface{})
+		fileInfo["filename"] = dirEntry.Name()
+		fileInfo["filepath"] = filepath.Join(directory, dirEntry.Name())
+		fileInfo["isDir"] = dirEntry.IsDir()
+
+		// Get file size and last modified time
+		finfo, err := dirEntry.Info()
+		if err != nil {
+			//unable to load its info. Skip this file
+			continue
+		}
+		fileInfo["lastModified"] = finfo.ModTime().Unix()
+		if !dirEntry.IsDir() {
+			// If it's a file, get its size
+			fileInfo["size"] = finfo.Size()
+		} else {
+			// If it's a directory, set size to 0
+			fileInfo["size"] = 0
+		}
+
+		// Append file info to the list
+		files = append(files, fileInfo)
+	}
+
+	// Serialize the file info slice to JSON
+	jsonData, err := json.Marshal(files)
+	if err != nil {
+		utils.SendErrorResponse(w, "unable to marshal JSON")
+		return
+	}
+
+	// Set response headers and send the JSON response
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	w.Write(jsonData)
+}
+
+// Handle upload of a file (multi-part), 25MB max
+func (fm *FileManager) HandleUpload(w http.ResponseWriter, r *http.Request) {
+	dir, err := utils.PostPara(r, "dir")
+	if err != nil {
+		log.Println("no dir given")
+		utils.SendErrorResponse(w, "invalid dir given")
+		return
+	}
+
+	// Parse the multi-part form data
+	err = r.ParseMultipartForm(25 << 20)
+	if err != nil {
+		utils.SendErrorResponse(w, "unable to parse form data")
+		return
+	}
+
+	// Get the uploaded file
+	file, fheader, err := r.FormFile("file")
+	if err != nil {
+		log.Println(err.Error())
+		utils.SendErrorResponse(w, "unable to get uploaded file")
+		return
+	}
+	defer file.Close()
+
+	// Specify the directory where you want to save the uploaded file
+	uploadDir := filepath.Join(fm.Directory, dir)
+	if !utils.FileExists(uploadDir) {
+		utils.SendErrorResponse(w, "upload target directory not exists")
+		return
+	}
+
+	filename := sanitizeFilename(fheader.Filename)
+	if !isValidFilename(filename) {
+		utils.SendErrorResponse(w, "filename contain invalid or reserved characters")
+		return
+	}
+
+	// Create the file on the server
+	filePath := filepath.Join(uploadDir, filepath.Base(filename))
+	out, err := os.Create(filePath)
+	if err != nil {
+		utils.SendErrorResponse(w, "unable to create file on the server")
+		return
+	}
+	defer out.Close()
+
+	// Copy the uploaded file to the server
+	_, err = io.Copy(out, file)
+	if err != nil {
+		utils.SendErrorResponse(w, "unable to copy file to server")
+		return
+	}
+
+	// Respond with a success message or appropriate response
+	utils.SendOK(w)
+}
+
+// Handle download of a selected file, serve with content dispose header
+func (fm *FileManager) HandleDownload(w http.ResponseWriter, r *http.Request) {
+	filename, err := utils.GetPara(r, "file")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid filepath given")
+		return
+	}
+
+	previewMode, _ := utils.GetPara(r, "preview")
+	if previewMode == "true" {
+		// Serve the file using http.ServeFile
+		filePath := filepath.Join(fm.Directory, filename)
+		http.ServeFile(w, r, filePath)
+	} else {
+		// Trigger a download with content disposition headers
+		filePath := filepath.Join(fm.Directory, filename)
+		w.Header().Set("Content-Disposition", "attachment; filename="+filepath.Base(filename))
+		http.ServeFile(w, r, filePath)
+	}
+}
+
+// HandleNewFolder creates a new folder in the specified directory
+func (fm *FileManager) HandleNewFolder(w http.ResponseWriter, r *http.Request) {
+	// Parse the directory name from the request
+	dirName, err := utils.GetPara(r, "path")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid directory name")
+		return
+	}
+
+	//Prevent path escape
+	dirName = strings.ReplaceAll(dirName, "\\", "/")
+	dirName = strings.ReplaceAll(dirName, "../", "")
+
+	// Specify the directory where you want to create the new folder
+	newFolderPath := filepath.Join(fm.Directory, dirName)
+
+	// Check if the folder already exists
+	if _, err := os.Stat(newFolderPath); os.IsNotExist(err) {
+		// Create the new folder
+		err := os.Mkdir(newFolderPath, os.ModePerm)
+		if err != nil {
+			utils.SendErrorResponse(w, "unable to create the new folder")
+			return
+		}
+
+		// Respond with a success message or appropriate response
+		utils.SendOK(w)
+	} else {
+		// If the folder already exists, respond with an error
+		utils.SendErrorResponse(w, "folder already exists")
+	}
+}
+
+// HandleFileCopy copies a file or directory from the source path to the destination path
+func (fm *FileManager) HandleFileCopy(w http.ResponseWriter, r *http.Request) {
+	// Parse the source and destination paths from the request
+	srcPath, err := utils.PostPara(r, "srcpath")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid source path")
+		return
+	}
+
+	destPath, err := utils.PostPara(r, "destpath")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid destination path")
+		return
+	}
+
+	// Validate and sanitize the source and destination paths
+	srcPath = filepath.Clean(srcPath)
+	destPath = filepath.Clean(destPath)
+
+	// Construct the absolute paths
+	absSrcPath := filepath.Join(fm.Directory, srcPath)
+	absDestPath := filepath.Join(fm.Directory, destPath)
+
+	// Check if the source path exists
+	if _, err := os.Stat(absSrcPath); os.IsNotExist(err) {
+		utils.SendErrorResponse(w, "source path does not exist")
+		return
+	}
+
+	// Check if the destination path exists
+	if _, err := os.Stat(absDestPath); os.IsNotExist(err) {
+		utils.SendErrorResponse(w, "destination path does not exist")
+		return
+	}
+
+	//Join the name to create final paste filename
+	absDestPath = filepath.Join(absDestPath, filepath.Base(absSrcPath))
+	//Reject opr if already exists
+	if utils.FileExists(absDestPath) {
+		utils.SendErrorResponse(w, "target already exists")
+		return
+	}
+
+	// Perform the copy operation based on whether the source is a file or directory
+	if isDir(absSrcPath) {
+		// Recursive copy for directories
+		err := copyDirectory(absSrcPath, absDestPath)
+		if err != nil {
+			utils.SendErrorResponse(w, fmt.Sprintf("error copying directory: %v", err))
+			return
+		}
+	} else {
+		// Copy a single file
+		err := copyFile(absSrcPath, absDestPath)
+		if err != nil {
+			utils.SendErrorResponse(w, fmt.Sprintf("error copying file: %v", err))
+			return
+		}
+	}
+
+	utils.SendOK(w)
+}
+
+func (fm *FileManager) HandleFileMove(w http.ResponseWriter, r *http.Request) {
+	// Parse the source and destination paths from the request
+	srcPath, err := utils.GetPara(r, "srcpath")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid source path")
+		return
+	}
+
+	destPath, err := utils.GetPara(r, "destpath")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid destination path")
+		return
+	}
+
+	// Validate and sanitize the source and destination paths
+	srcPath = filepath.Clean(srcPath)
+	destPath = filepath.Clean(destPath)
+
+	// Construct the absolute paths
+	absSrcPath := filepath.Join(fm.Directory, srcPath)
+	absDestPath := filepath.Join(fm.Directory, destPath)
+
+	// Check if the source path exists
+	if _, err := os.Stat(absSrcPath); os.IsNotExist(err) {
+		utils.SendErrorResponse(w, "source path does not exist")
+		return
+	}
+
+	// Check if the destination path exists
+	if _, err := os.Stat(absDestPath); !os.IsNotExist(err) {
+		utils.SendErrorResponse(w, "destination path already exists")
+		return
+	}
+
+	// Rename the source to the destination
+	err = os.Rename(absSrcPath, absDestPath)
+	if err != nil {
+		utils.SendErrorResponse(w, fmt.Sprintf("error moving file/directory: %v", err))
+		return
+	}
+	utils.SendOK(w)
+}
+
+func (fm *FileManager) HandleFileProperties(w http.ResponseWriter, r *http.Request) {
+	// Parse the target file or directory path from the request
+	filePath, err := utils.GetPara(r, "file")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid file path")
+		return
+	}
+
+	// Construct the absolute path to the target file or directory
+	absPath := filepath.Join(fm.Directory, filePath)
+
+	// Check if the target path exists
+	_, err = os.Stat(absPath)
+	if err != nil {
+		utils.SendErrorResponse(w, "file or directory does not exist")
+		return
+	}
+
+	// Initialize a map to hold file properties
+	fileProps := make(map[string]interface{})
+	fileProps["filename"] = filepath.Base(absPath)
+	fileProps["filepath"] = filePath
+	fileProps["isDir"] = isDir(absPath)
+
+	// Get file size and last modified time
+	finfo, err := os.Stat(absPath)
+	if err != nil {
+		utils.SendErrorResponse(w, "unable to retrieve file properties")
+		return
+	}
+	fileProps["lastModified"] = finfo.ModTime().Unix()
+	if !isDir(absPath) {
+		// If it's a file, get its size
+		fileProps["size"] = finfo.Size()
+	} else {
+		// If it's a directory, calculate its total size containing all child files and folders
+		totalSize, err := calculateDirectorySize(absPath)
+		if err != nil {
+			utils.SendErrorResponse(w, "unable to calculate directory size")
+			return
+		}
+		fileProps["size"] = totalSize
+	}
+
+	// Count the number of sub-files and sub-folders
+	numSubFiles, numSubFolders, err := countSubFilesAndFolders(absPath)
+	if err != nil {
+		utils.SendErrorResponse(w, "unable to count sub-files and sub-folders")
+		return
+	}
+	fileProps["fileCounts"] = numSubFiles
+	fileProps["folderCounts"] = numSubFolders
+
+	// Serialize the file properties to JSON
+	jsonData, err := json.Marshal(fileProps)
+	if err != nil {
+		utils.SendErrorResponse(w, "unable to marshal JSON")
+		return
+	}
+
+	// Set response headers and send the JSON response
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	w.Write(jsonData)
+}
+
+// HandleFileDelete deletes a file or directory
+func (fm *FileManager) HandleFileDelete(w http.ResponseWriter, r *http.Request) {
+	// Parse the target file or directory path from the request
+	filePath, err := utils.PostPara(r, "target")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid file path")
+		return
+	}
+
+	// Construct the absolute path to the target file or directory
+	absPath := filepath.Join(fm.Directory, filePath)
+
+	// Check if the target path exists
+	_, err = os.Stat(absPath)
+	if err != nil {
+		utils.SendErrorResponse(w, "file or directory does not exist")
+		return
+	}
+
+	// Delete the file or directory
+	err = os.RemoveAll(absPath)
+	if err != nil {
+		utils.SendErrorResponse(w, "error deleting file or directory")
+		return
+	}
+
+	// Respond with a success message or appropriate response
+	utils.SendOK(w)
+}

src/mod/webserv/filemanager/utils.go

@@ -0,0 +1,156 @@
+package filemanager
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// isValidFilename checks if a given filename is safe and valid.
+func isValidFilename(filename string) bool {
+	// Define a list of disallowed characters and reserved names
+	disallowedChars := []string{"/", "\\", ":", "*", "?", "\"", "<", ">", "|"}                                                                                                                            // Add more if needed
+	reservedNames := []string{"CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9"} // Add more if needed
+
+	// Check for disallowed characters
+	for _, char := range disallowedChars {
+		if strings.Contains(filename, char) {
+			return false
+		}
+	}
+
+	// Check for reserved names (case-insensitive)
+	lowerFilename := strings.ToUpper(filename)
+	for _, reserved := range reservedNames {
+		if lowerFilename == reserved {
+			return false
+		}
+	}
+
+	// Check for empty filename
+	if filename == "" {
+		return false
+	}
+
+	// The filename is considered valid
+	return true
+}
+
+// sanitizeFilename sanitizes a given filename by removing disallowed characters.
+func sanitizeFilename(filename string) string {
+	disallowedChars := []string{"/", "\\", ":", "*", "?", "\"", "<", ">", "|"} // Add more if needed
+
+	// Replace disallowed characters with underscores
+	for _, char := range disallowedChars {
+		filename = strings.ReplaceAll(filename, char, "_")
+	}
+
+	return filename
+}
+
+// copyFile copies a single file from source to destination
+func copyFile(srcPath, destPath string) error {
+	srcFile, err := os.Open(srcPath)
+	if err != nil {
+		return err
+	}
+	defer srcFile.Close()
+
+	destFile, err := os.Create(destPath)
+	if err != nil {
+		return err
+	}
+	defer destFile.Close()
+
+	_, err = io.Copy(destFile, srcFile)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// copyDirectory recursively copies a directory and its contents from source to destination
+func copyDirectory(srcPath, destPath string) error {
+	// Create the destination directory
+	err := os.MkdirAll(destPath, os.ModePerm)
+	if err != nil {
+		return err
+	}
+
+	entries, err := os.ReadDir(srcPath)
+	if err != nil {
+		return err
+	}
+
+	for _, entry := range entries {
+		srcEntryPath := filepath.Join(srcPath, entry.Name())
+		destEntryPath := filepath.Join(destPath, entry.Name())
+
+		if entry.IsDir() {
+			err := copyDirectory(srcEntryPath, destEntryPath)
+			if err != nil {
+				return err
+			}
+		} else {
+			err := copyFile(srcEntryPath, destEntryPath)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// isDir checks if the given path is a directory
+func isDir(path string) bool {
+	fileInfo, err := os.Stat(path)
+	if err != nil {
+		return false
+	}
+	return fileInfo.IsDir()
+}
+
+// calculateDirectorySize calculates the total size of a directory and its contents
+func calculateDirectorySize(dirPath string) (int64, error) {
+	var totalSize int64
+	err := filepath.Walk(dirPath, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		totalSize += info.Size()
+		return nil
+	})
+	if err != nil {
+		return 0, err
+	}
+	return totalSize, nil
+}
+
+// countSubFilesAndFolders counts the number of sub-files and sub-folders within a directory
+func countSubFilesAndFolders(dirPath string) (int, int, error) {
+	var numSubFiles, numSubFolders int
+
+	err := filepath.Walk(dirPath, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if info.IsDir() {
+			numSubFolders++
+		} else {
+			numSubFiles++
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return 0, 0, err
+	}
+
+	// Subtract 1 from numSubFolders to exclude the root directory itself
+	return numSubFiles, numSubFolders - 1, nil
+}

src/mod/webserv/handler.go

@@ -0,0 +1,88 @@
+package webserv
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+
+	"imuslab.com/zoraxy/mod/utils"
+)
+
+/*
+	Handler.go
+
+	Handler for web server options change
+	web server is directly listening to the TCP port
+	handlers in this script are for setting change only
+*/
+
+type StaticWebServerStatus struct {
+	ListeningPort          int
+	EnableDirectoryListing bool
+	WebRoot                string
+	Running                bool
+	EnableWebDirManager    bool
+}
+
+// Handle getting current static web server status
+func (ws *WebServer) HandleGetStatus(w http.ResponseWriter, r *http.Request) {
+	listeningPortInt, _ := strconv.Atoi(ws.option.Port)
+	currentStatus := StaticWebServerStatus{
+		ListeningPort:          listeningPortInt,
+		EnableDirectoryListing: ws.option.EnableDirectoryListing,
+		WebRoot:                ws.option.WebRoot,
+		Running:                ws.isRunning,
+		EnableWebDirManager:    ws.option.EnableWebDirManager,
+	}
+
+	js, _ := json.Marshal(currentStatus)
+	utils.SendJSONResponse(w, string(js))
+}
+
+// Handle request for starting the static web server
+func (ws *WebServer) HandleStartServer(w http.ResponseWriter, r *http.Request) {
+	err := ws.Start()
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+	utils.SendOK(w)
+}
+
+// Handle request for stopping the static web server
+func (ws *WebServer) HandleStopServer(w http.ResponseWriter, r *http.Request) {
+	err := ws.Stop()
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+	utils.SendOK(w)
+}
+
+// Handle change server listening port request
+func (ws *WebServer) HandlePortChange(w http.ResponseWriter, r *http.Request) {
+	newPort, err := utils.PostInt(r, "port")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid port number given")
+		return
+	}
+
+	err = ws.ChangePort(strconv.Itoa(newPort))
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+	utils.SendOK(w)
+}
+
+// Change enable directory listing settings
+func (ws *WebServer) SetEnableDirectoryListing(w http.ResponseWriter, r *http.Request) {
+	enableList, err := utils.PostBool(r, "enable")
+	if err != nil {
+		utils.SendErrorResponse(w, "invalid setting given")
+		return
+	}
+
+	ws.option.EnableDirectoryListing = enableList
+	utils.SendOK(w)
+}

src/mod/webserv/middleware.go

@@ -0,0 +1,41 @@
+package webserv
+
+import (
+	"net/http"
+	"path/filepath"
+	"strings"
+
+	"imuslab.com/zoraxy/mod/utils"
+)
+
+// Convert a request path (e.g. /index.html) into physical path on disk
+func (ws *WebServer) resolveFileDiskPath(requestPath string) string {
+	fileDiskpath := filepath.Join(ws.option.WebRoot, "html", requestPath)
+
+	//Force convert it to slash even if the host OS is on Windows
+	fileDiskpath = filepath.Clean(fileDiskpath)
+	fileDiskpath = strings.ReplaceAll(fileDiskpath, "\\", "/")
+	return fileDiskpath
+
+}
+
+// File server middleware to handle directory listing (and future expansion)
+func (ws *WebServer) fsMiddleware(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !ws.option.EnableDirectoryListing {
+			if strings.HasSuffix(r.URL.Path, "/") {
+				//This is a folder. Let check if index exists
+				if utils.FileExists(filepath.Join(ws.resolveFileDiskPath(r.URL.Path), "index.html")) {
+
+				} else if utils.FileExists(filepath.Join(ws.resolveFileDiskPath(r.URL.Path), "index.htm")) {
+
+				} else {
+					http.NotFound(w, r)
+					return
+				}
+			}
+		}
+
+		h.ServeHTTP(w, r)
+	})
+}

src/mod/webserv/templates/index.html

@@ -0,0 +1,61 @@
+<html>
+    <head>
+        <title>Hello Zoraxy</title>
+        <style>
+            body {
+                font-family: Tahoma, sans-serif;
+                background-color: #f6f6f6;
+                color: #2d2e30;
+            }
+            .sectionHeader{
+                background-color: #c4d0d9;
+                padding: 0.1em;
+            }
+
+            .sectionHeader h3{
+                text-align: center;
+            }
+            .container{
+                margin: 4em;
+                margin-left: 10em;
+                margin-right: 10em;
+                background-color: #fefefe;
+            }
+
+            @media (max-width:960px) {
+                .container{
+                    margin-left: 1em;
+                    margin-right: 1em;
+                }
+
+                .sectionHeader{
+                    padding-left: 1em;
+                    padding-right: 1em;
+                }
+            }
+
+            .textcontainer{
+                padding: 1em;
+            }
+        </style>
+    </head>
+    <body>
+        <div class="container">
+            <div class="sectionHeader">
+                <h3>Welcome to Zoraxy Static Web Server!</h3>
+            </div>
+            <div class="textcontainer">
+                <p>If you see this page, that means your static web server is running.<br> 
+                    By default, all the html files are stored under <code>./web/html/</code> 
+                    relative to the zoraxy runtime directory.<br>
+                    You can upload your html files to your web directory via the <b>Web Directory Manager</b>.
+                </p>
+                <p>
+                    For online documentation, please refer to <a href="//zoraxy.arozos.com">zoraxy.arozos.com</a> or the <a href="https://github.com/tobychui/zoraxy/wiki">project wiki</a>.<br>
+                    Thank you for using Zoraxy!
+                </p>
+            </div>
+           
+        </div>
+    </body>
+</html>

src/mod/webserv/utils.go

@@ -0,0 +1,18 @@
+package webserv
+
+import (
+	"net"
+)
+
+// IsPortInUse checks if a port is in use.
+func IsPortInUse(port string) bool {
+	listener, err := net.Listen("tcp", "localhost:"+port)
+	if err != nil {
+		// If there was an error, the port is in use.
+		return true
+	}
+	defer listener.Close()
+
+	// No error means the port is available.
+	return false
+}

src/mod/webserv/webserv.go

@@ -0,0 +1,195 @@
+package webserv
+
+import (
+	"embed"
+	_ "embed"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"imuslab.com/zoraxy/mod/database"
+	"imuslab.com/zoraxy/mod/utils"
+	"imuslab.com/zoraxy/mod/webserv/filemanager"
+)
+
+/*
+	Static Web Server package
+
+	This module host a static web server
+*/
+
+//go:embed templates/*
+var templates embed.FS
+
+type WebServerOptions struct {
+	Port                   string             //Port for listening
+	EnableDirectoryListing bool               //Enable listing of directory
+	WebRoot                string             //Folder for stroing the static web folders
+	EnableWebDirManager    bool               //Enable web file manager to handle files in web directory
+	Sysdb                  *database.Database //Database for storing configs
+}
+
+type WebServer struct {
+	FileManager *filemanager.FileManager
+
+	mux       *http.ServeMux
+	server    *http.Server
+	option    *WebServerOptions
+	isRunning bool
+	mu        sync.Mutex
+}
+
+// NewWebServer creates a new WebServer instance. One instance only
+func NewWebServer(options *WebServerOptions) *WebServer {
+	if !utils.FileExists(options.WebRoot) {
+		//Web root folder not exists. Create one with default templates
+		os.MkdirAll(filepath.Join(options.WebRoot, "html"), 0775)
+		os.MkdirAll(filepath.Join(options.WebRoot, "templates"), 0775)
+		indexTemplate, err := templates.ReadFile("templates/index.html")
+		if err != nil {
+			log.Println("Failed to read static wev server template file: ", err.Error())
+		} else {
+			os.WriteFile(filepath.Join(options.WebRoot, "html", "index.html"), indexTemplate, 0775)
+		}
+
+	}
+
+	//Create a new file manager if it is enabled
+	var newDirManager *filemanager.FileManager
+	if options.EnableWebDirManager {
+		fm := filemanager.NewFileManager(filepath.Join(options.WebRoot, "/html"))
+		newDirManager = fm
+	}
+
+	//Create new table to store the config
+	options.Sysdb.NewTable("webserv")
+	return &WebServer{
+		mux:         http.NewServeMux(),
+		FileManager: newDirManager,
+		option:      options,
+		isRunning:   false,
+		mu:          sync.Mutex{},
+	}
+}
+
+// Restore the configuration to previous config
+func (ws *WebServer) RestorePreviousState() {
+	//Set the port
+	port := ws.option.Port
+	ws.option.Sysdb.Read("webserv", "port", &port)
+	ws.option.Port = port
+
+	//Set the enable directory list
+	enableDirList := ws.option.EnableDirectoryListing
+	ws.option.Sysdb.Read("webserv", "dirlist", &enableDirList)
+	ws.option.EnableDirectoryListing = enableDirList
+
+	//Check the running state
+	webservRunning := false
+	ws.option.Sysdb.Read("webserv", "enabled", &webservRunning)
+	if webservRunning {
+		ws.Start()
+	} else {
+		ws.Stop()
+	}
+
+}
+
+// ChangePort changes the server's port.
+func (ws *WebServer) ChangePort(port string) error {
+	if IsPortInUse(port) {
+		return errors.New("Selected port is used by another process")
+	}
+
+	if ws.isRunning {
+		if err := ws.Stop(); err != nil {
+			return err
+		}
+	}
+
+	ws.option.Port = port
+	ws.server.Addr = ":" + port
+
+	err := ws.Start()
+	if err != nil {
+		return err
+	}
+
+	ws.option.Sysdb.Write("webserv", "port", port)
+
+	return nil
+}
+
+// Start starts the web server.
+func (ws *WebServer) Start() error {
+	ws.mu.Lock()
+	defer ws.mu.Unlock()
+
+	//Check if server already running
+	if ws.isRunning {
+		return fmt.Errorf("web server is already running")
+	}
+
+	//Check if the port is usable
+	if IsPortInUse(ws.option.Port) {
+		return errors.New("Port already in use or access denied by host OS")
+	}
+
+	//Dispose the old mux and create a new one
+	ws.mux = http.NewServeMux()
+
+	//Create a static web server
+	fs := http.FileServer(http.Dir(filepath.Join(ws.option.WebRoot, "html")))
+	ws.mux.Handle("/", ws.fsMiddleware(fs))
+
+	ws.server = &http.Server{
+		Addr:    ":" + ws.option.Port,
+		Handler: ws.mux,
+	}
+
+	go func() {
+		if err := ws.server.ListenAndServe(); err != nil {
+			if err != http.ErrServerClosed {
+				fmt.Printf("Web server error: %v\n", err)
+			}
+		}
+	}()
+
+	log.Println("Static Web Server started. Listeing on :" + ws.option.Port)
+	ws.isRunning = true
+	ws.option.Sysdb.Write("webserv", "enabled", true)
+	return nil
+}
+
+// Stop stops the web server.
+func (ws *WebServer) Stop() error {
+	ws.mu.Lock()
+	defer ws.mu.Unlock()
+
+	if !ws.isRunning {
+		return fmt.Errorf("web server is not running")
+	}
+
+	if err := ws.server.Close(); err != nil {
+		return err
+	}
+
+	ws.isRunning = false
+	ws.option.Sysdb.Write("webserv", "enabled", false)
+	return nil
+}
+
+// UpdateDirectoryListing enables or disables directory listing.
+func (ws *WebServer) UpdateDirectoryListing(enable bool) {
+	ws.option.EnableDirectoryListing = enable
+	ws.option.Sysdb.Write("webserv", "dirlist", enable)
+}
+
+// Close stops the web server without returning an error.
+func (ws *WebServer) Close() {
+	ws.Stop()
+}

src/reverseproxy.go

@@ -64,6 +64,7 @@ func ReverseProxtInit() {
 		RedirectRuleTable:  redirectTable,
 		GeodbStore:         geodbStore,
 		StatisticCollector: statisticCollector,
+		WebDirectory:       *staticWebServerRoot,
 	})
 	if err != nil {
 		log.Println(err.Error())
@@ -73,7 +74,7 @@ func ReverseProxtInit() {
 	dynamicProxyRouter = dprouter
 
 	//Load all conf from files
-	confs, _ := filepath.Glob("./conf/*.config")
+	confs, _ := filepath.Glob("./conf/proxy/*.config")
 	for _, conf := range confs {
 		record, err := LoadReverseProxyConfig(conf)
 		if err != nil {
@@ -88,21 +89,23 @@ func ReverseProxtInit() {
 			})
 		} else if record.ProxyType == "subd" {
 			dynamicProxyRouter.AddSubdomainRoutingService(&dynamicproxy.SubdOptions{
-				MatchingDomain:       record.Rootname,
-				Domain:               record.ProxyTarget,
-				RequireTLS:           record.UseTLS,
-				SkipCertValidations:  record.SkipTlsValidation,
-				RequireBasicAuth:     record.RequireBasicAuth,
-				BasicAuthCredentials: record.BasicAuthCredentials,
+				MatchingDomain:          record.Rootname,
+				Domain:                  record.ProxyTarget,
+				RequireTLS:              record.UseTLS,
+				SkipCertValidations:     record.SkipTlsValidation,
+				RequireBasicAuth:        record.RequireBasicAuth,
+				BasicAuthCredentials:    record.BasicAuthCredentials,
+				BasicAuthExceptionRules: record.BasicAuthExceptionRules,
 			})
 		} else if record.ProxyType == "vdir" {
 			dynamicProxyRouter.AddVirtualDirectoryProxyService(&dynamicproxy.VdirOptions{
-				RootName:             record.Rootname,
-				Domain:               record.ProxyTarget,
-				RequireTLS:           record.UseTLS,
-				SkipCertValidations:  record.SkipTlsValidation,
-				RequireBasicAuth:     record.RequireBasicAuth,
-				BasicAuthCredentials: record.BasicAuthCredentials,
+				RootName:                record.Rootname,
+				Domain:                  record.ProxyTarget,
+				RequireTLS:              record.UseTLS,
+				SkipCertValidations:     record.SkipTlsValidation,
+				RequireBasicAuth:        record.RequireBasicAuth,
+				BasicAuthCredentials:    record.BasicAuthCredentials,
+				BasicAuthExceptionRules: record.BasicAuthExceptionRules,
 			})
 		} else {
 			log.Println("Unsupported endpoint type: " + record.ProxyType + ". Skipping " + filepath.Base(conf))
@@ -282,7 +285,7 @@ func ReverseProxyHandleAddEndpoint(w http.ResponseWriter, r *http.Request) {
 		RequireBasicAuth:     requireBasicAuth,
 		BasicAuthCredentials: basicAuthCredentials,
 	}
-	SaveReverseProxyConfig(&thisProxyConfigRecord)
+	SaveReverseProxyConfigToFile(&thisProxyConfigRecord)
 
 	//Update utm if exists
 	if uptimeMonitor != nil {
@@ -355,7 +358,7 @@ func ReverseProxyHandleEditEndpoint(w http.ResponseWriter, r *http.Request) {
 			RequireBasicAuth:     requireBasicAuth,
 			BasicAuthCredentials: targetProxyEntry.BasicAuthCredentials,
 		}
-		dynamicProxyRouter.RemoveProxy("vdir", thisOption.RootName)
+		targetProxyEntry.Remove()
 		dynamicProxyRouter.AddVirtualDirectoryProxyService(&thisOption)
 
 	} else if eptype == "subd" {
@@ -367,7 +370,7 @@ func ReverseProxyHandleEditEndpoint(w http.ResponseWriter, r *http.Request) {
 			RequireBasicAuth:     requireBasicAuth,
 			BasicAuthCredentials: targetProxyEntry.BasicAuthCredentials,
 		}
-		dynamicProxyRouter.RemoveProxy("subd", thisOption.MatchingDomain)
+		targetProxyEntry.Remove()
 		dynamicProxyRouter.AddSubdomainRoutingService(&thisOption)
 	}
 
@@ -381,7 +384,7 @@ func ReverseProxyHandleEditEndpoint(w http.ResponseWriter, r *http.Request) {
 		RequireBasicAuth:     requireBasicAuth,
 		BasicAuthCredentials: targetProxyEntry.BasicAuthCredentials,
 	}
-	SaveReverseProxyConfig(&thisProxyConfigRecord)
+	SaveReverseProxyConfigToFile(&thisProxyConfigRecord)
 	utils.SendOK(w)
 }
 
@@ -398,13 +401,15 @@ func DeleteProxyEndpoint(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = dynamicProxyRouter.RemoveProxy(ptype, ep)
+	//Remove the config from runtime
+	err = dynamicProxyRouter.RemoveProxyEndpointByRootname(ptype, ep)
 	if err != nil {
 		utils.SendErrorResponse(w, err.Error())
 		return
 	}
 
-	RemoveReverseProxyConfig(ep)
+	//Remove the config from file
+	RemoveReverseProxyConfigFile(ep)
 
 	//Update utm if exists
 	if uptimeMonitor != nil {
@@ -528,19 +533,10 @@ func UpdateProxyBasicAuthCredentials(w http.ResponseWriter, r *http.Request) {
 		targetProxy.BasicAuthCredentials = mergedCredentials
 
 		//Save it to file
-		thisProxyConfigRecord := Record{
-			ProxyType:            ptype,
-			Rootname:             targetProxy.RootOrMatchingDomain,
-			ProxyTarget:          targetProxy.Domain,
-			UseTLS:               targetProxy.RequireTLS,
-			SkipTlsValidation:    targetProxy.SkipCertValidations,
-			RequireBasicAuth:     targetProxy.RequireBasicAuth,
-			BasicAuthCredentials: targetProxy.BasicAuthCredentials,
-		}
-		SaveReverseProxyConfig(&thisProxyConfigRecord)
+		SaveReverseProxyEndpointToFile(targetProxy)
 
 		//Replace runtime configuration
-		dynamicProxyRouter.SaveProxy(ptype, ep, targetProxy)
+		targetProxy.UpdateToRuntime()
 		utils.SendOK(w)
 	} else {
 		http.Error(w, "invalid usage", http.StatusMethodNotAllowed)
@@ -548,6 +544,147 @@ func UpdateProxyBasicAuthCredentials(w http.ResponseWriter, r *http.Request) {
 
 }
 
+// List, Update or Remove the exception paths for basic auth.
+func ListProxyBasicAuthExceptionPaths(w http.ResponseWriter, r *http.Request) {
+
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
+	}
+	ep, err := utils.GetPara(r, "ep")
+	if err != nil {
+		utils.SendErrorResponse(w, "Invalid ep given")
+		return
+	}
+
+	ptype, err := utils.GetPara(r, "ptype")
+	if err != nil {
+		utils.SendErrorResponse(w, "Invalid ptype given")
+		return
+	}
+
+	//Load the target proxy object from router
+	targetProxy, err := dynamicProxyRouter.LoadProxy(ptype, ep)
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+
+	//List all the exception paths for this proxy
+	results := targetProxy.BasicAuthExceptionRules
+	if results == nil {
+		//It is a config from a really old version of zoraxy. Overwrite it with empty array
+		results = []*dynamicproxy.BasicAuthExceptionRule{}
+	}
+	js, _ := json.Marshal(results)
+	utils.SendJSONResponse(w, string(js))
+	return
+}
+
+func AddProxyBasicAuthExceptionPaths(w http.ResponseWriter, r *http.Request) {
+	ep, err := utils.PostPara(r, "ep")
+	if err != nil {
+		utils.SendErrorResponse(w, "Invalid ep given")
+		return
+	}
+
+	ptype, err := utils.PostPara(r, "ptype")
+	if err != nil {
+		utils.SendErrorResponse(w, "Invalid ptype given")
+		return
+	}
+
+	matchingPrefix, err := utils.PostPara(r, "prefix")
+	if err != nil {
+		utils.SendErrorResponse(w, "Invalid matching prefix given")
+		return
+	}
+
+	//Load the target proxy object from router
+	targetProxy, err := dynamicProxyRouter.LoadProxy(ptype, ep)
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+
+	//Check if the prefix starts with /. If not, prepend it
+	if !strings.HasPrefix(matchingPrefix, "/") {
+		matchingPrefix = "/" + matchingPrefix
+	}
+
+	//Add a new exception rule if it is not already exists
+	alreadyExists := false
+	for _, thisExceptionRule := range targetProxy.BasicAuthExceptionRules {
+		if thisExceptionRule.PathPrefix == matchingPrefix {
+			alreadyExists = true
+			break
+		}
+	}
+	if alreadyExists {
+		utils.SendErrorResponse(w, "This matching path already exists")
+		return
+	}
+	targetProxy.BasicAuthExceptionRules = append(targetProxy.BasicAuthExceptionRules, &dynamicproxy.BasicAuthExceptionRule{
+		PathPrefix: strings.TrimSpace(matchingPrefix),
+	})
+
+	//Save configs to runtime and file
+	targetProxy.UpdateToRuntime()
+	SaveReverseProxyEndpointToFile(targetProxy)
+
+	utils.SendOK(w)
+}
+
+func RemoveProxyBasicAuthExceptionPaths(w http.ResponseWriter, r *http.Request) {
+	// Delete a rule
+	ep, err := utils.PostPara(r, "ep")
+	if err != nil {
+		utils.SendErrorResponse(w, "Invalid ep given")
+		return
+	}
+
+	ptype, err := utils.PostPara(r, "ptype")
+	if err != nil {
+		utils.SendErrorResponse(w, "Invalid ptype given")
+		return
+	}
+
+	matchingPrefix, err := utils.PostPara(r, "prefix")
+	if err != nil {
+		utils.SendErrorResponse(w, "Invalid matching prefix given")
+		return
+	}
+
+	// Load the target proxy object from router
+	targetProxy, err := dynamicProxyRouter.LoadProxy(ptype, ep)
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+
+	newExceptionRuleList := []*dynamicproxy.BasicAuthExceptionRule{}
+	matchingExists := false
+	for _, thisExceptionalRule := range targetProxy.BasicAuthExceptionRules {
+		if thisExceptionalRule.PathPrefix != matchingPrefix {
+			newExceptionRuleList = append(newExceptionRuleList, thisExceptionalRule)
+		} else {
+			matchingExists = true
+		}
+	}
+
+	if !matchingExists {
+		utils.SendErrorResponse(w, "target matching rule not exists")
+		return
+	}
+
+	targetProxy.BasicAuthExceptionRules = newExceptionRuleList
+
+	// Save configs to runtime and file
+	targetProxy.UpdateToRuntime()
+	SaveReverseProxyEndpointToFile(targetProxy)
+
+	utils.SendOK(w)
+}
+
 func ReverseProxyStatus(w http.ResponseWriter, r *http.Request) {
 	js, _ := json.Marshal(dynamicProxyRouter)
 	utils.SendJSONResponse(w, string(js))
@@ -644,11 +781,18 @@ func HandleIncomingPortSet(w http.ResponseWriter, r *http.Request) {
 
 	newIncomingPortInt, err := strconv.Atoi(newIncomingPort)
 	if err != nil {
-		utils.SendErrorResponse(w, "invalid incoming port given")
+		utils.SendErrorResponse(w, "Invalid incoming port given")
 		return
 	}
 
 	//Check if it is identical as proxy root (recursion!)
+	if dynamicProxyRouter.Root == nil || dynamicProxyRouter.Root.Domain == "" {
+		//Check if proxy root is set before checking recursive listen
+		//Fixing issue #43
+		utils.SendErrorResponse(w, "Set Proxy Root before changing inbound port")
+		return
+	}
+
 	proxyRoot := strings.TrimSuffix(dynamicProxyRouter.Root.Domain, "/")
 	if strings.HasPrefix(proxyRoot, "localhost:"+strconv.Itoa(newIncomingPortInt)) || strings.HasPrefix(proxyRoot, "127.0.0.1:"+strconv.Itoa(newIncomingPortInt)) {
 		//Listening port is same as proxy root
@@ -671,3 +815,34 @@ func HandleIncomingPortSet(w http.ResponseWriter, r *http.Request) {
 
 	utils.SendOK(w)
 }
+
+// Handle list of root route options
+func HandleRootRouteOptionList(w http.ResponseWriter, r *http.Request) {
+	js, _ := json.Marshal(dynamicProxyRouter.RootRoutingOptions)
+	utils.SendJSONResponse(w, string(js))
+}
+
+// Handle update of the root route edge case options. See dynamicproxy/rootRoute.go
+func HandleRootRouteOptionsUpdate(w http.ResponseWriter, r *http.Request) {
+	enableUnsetSubdomainRedirect, err := utils.PostBool(r, "unsetRedirect")
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+
+	unsetRedirectTarget, _ := utils.PostPara(r, "unsetRedirectTarget")
+
+	newRootOption := dynamicproxy.RootRoutingOptions{
+		EnableRedirectForUnsetRules: enableUnsetSubdomainRedirect,
+		UnsetRuleRedirectTarget:     unsetRedirectTarget,
+	}
+
+	dynamicProxyRouter.RootRoutingOptions = &newRootOption
+	err = newRootOption.SaveToFile()
+	if err != nil {
+		utils.SendErrorResponse(w, err.Error())
+		return
+	}
+
+	utils.SendOK(w)
+}

src/start.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"imuslab.com/zoraxy/mod/acme"
 	"imuslab.com/zoraxy/mod/auth"
 	"imuslab.com/zoraxy/mod/database"
 	"imuslab.com/zoraxy/mod/dynamicproxy/redirection"
@@ -21,6 +22,7 @@ import (
 	"imuslab.com/zoraxy/mod/statistic/analytic"
 	"imuslab.com/zoraxy/mod/tcpprox"
 	"imuslab.com/zoraxy/mod/tlscert"
+	"imuslab.com/zoraxy/mod/webserv"
 )
 
 /*
@@ -48,8 +50,9 @@ func startupSequence() {
 	//Create tables for the database
 	sysdb.NewTable("settings")
 
-	//Create tmp folder
+	//Create tmp folder and conf folder
 	os.MkdirAll("./tmp", 0775)
+	os.MkdirAll("./conf/proxy/", 0775)
 
 	//Create an auth agent
 	sessionKey, err := auth.GetSessionKey(sysdb)
@@ -62,19 +65,22 @@ func startupSequence() {
 	})
 
 	//Create a TLS certificate manager
-	tlsCertManager, err = tlscert.NewManager("./certs", development)
+	tlsCertManager, err = tlscert.NewManager("./conf/certs", development)
 	if err != nil {
 		panic(err)
 	}
 
 	//Create a redirection rule table
-	redirectTable, err = redirection.NewRuleTable("./rules/redirect")
+	redirectTable, err = redirection.NewRuleTable("./conf/redirect")
 	if err != nil {
 		panic(err)
 	}
 
 	//Create a geodb store
-	geodbStore, err = geodb.NewGeoDb(sysdb)
+	geodbStore, err = geodb.NewGeoDb(sysdb, &geodb.StoreOptions{
+		AllowSlowIpv4LookUp: !*enableHighSpeedGeoIPLookup,
+		AllowSloeIpv6Lookup: !*enableHighSpeedGeoIPLookup,
+	})
 	if err != nil {
 		panic(err)
 	}
@@ -95,14 +101,15 @@ func startupSequence() {
 	}
 
 	/*
-		Path Blocker
+		Path Rules
 
-		This section of starutp script start the pathblocker
-		from file.
+		This section of starutp script start the path rules where
+		user can define their own routing logics
 	*/
 
-	pathRuleHandler = pathrule.NewPathBlocker(&pathrule.Options{
-		ConfigFolder: "./rules/pathrules",
+	pathRuleHandler = pathrule.NewPathRuleHandler(&pathrule.Options{
+		Enabled:      false,
+		ConfigFolder: "./conf/rules/pathrules",
 	})
 
 	/*
@@ -111,46 +118,49 @@ func startupSequence() {
 		This discover nearby ArozOS Nodes or other services
 		that provide mDNS discovery with domain (e.g. Synology NAS)
 	*/
-	portInt, err := strconv.Atoi(strings.Split(handler.Port, ":")[1])
-	if err != nil {
-		portInt = 8000
-	}
-	mdnsScanner, err = mdns.NewMDNS(mdns.NetworkHost{
-		HostName:     "zoraxy_" + nodeUUID,
-		Port:         portInt,
-		Domain:       "zoraxy.imuslab.com",
-		Model:        "Network Gateway",
-		UUID:         nodeUUID,
-		Vendor:       "imuslab.com",
-		BuildVersion: version,
-	}, "")
-	if err != nil {
-		panic(err)
-	}
 
-	//Start initial scanning
-	go func() {
-		hosts := mdnsScanner.Scan(30, "")
-		previousmdnsScanResults = hosts
-		log.Println("mDNS Startup scan completed")
-	}()
-
-	//Create a ticker to update mDNS results every 5 minutes
-	ticker := time.NewTicker(15 * time.Minute)
-	stopChan := make(chan bool)
-	go func() {
-		for {
-			select {
-			case <-stopChan:
-				ticker.Stop()
-			case <-ticker.C:
+	if *allowMdnsScanning {
+		portInt, err := strconv.Atoi(strings.Split(handler.Port, ":")[1])
+		if err != nil {
+			portInt = 8000
+		}
+		mdnsScanner, err = mdns.NewMDNS(mdns.NetworkHost{
+			HostName:     "zoraxy_" + nodeUUID,
+			Port:         portInt,
+			Domain:       "zoraxy.arozos.com",
+			Model:        "Network Gateway",
+			UUID:         nodeUUID,
+			Vendor:       "imuslab.com",
+			BuildVersion: version,
+		}, "")
+		if err != nil {
+			log.Println("Unable to startup mDNS service. Disabling mDNS services")
+		} else {
+			//Start initial scanning
+			go func() {
 				hosts := mdnsScanner.Scan(30, "")
 				previousmdnsScanResults = hosts
-				log.Println("mDNS scan result updated")
-			}
+				log.Println("mDNS Startup scan completed")
+			}()
+
+			//Create a ticker to update mDNS results every 5 minutes
+			ticker := time.NewTicker(15 * time.Minute)
+			stopChan := make(chan bool)
+			go func() {
+				for {
+					select {
+					case <-stopChan:
+						ticker.Stop()
+					case <-ticker.C:
+						hosts := mdnsScanner.Scan(30, "")
+						previousmdnsScanResults = hosts
+						log.Println("mDNS scan result updated")
+					}
+				}
+			}()
+			mdnsTickerStop = stopChan
 		}
-	}()
-	mdnsTickerStop = stopChan
+	}
 
 	/*
 		Global Area Network
@@ -188,6 +198,35 @@ func startupSequence() {
 
 	//Create an analytic loader
 	AnalyticLoader = analytic.NewDataLoader(sysdb, statisticCollector)
+
+	/*
+		ACME API
+
+		Obtaining certificates from ACME Server
+	*/
+	//Create a table just to store acme related preferences
+	sysdb.NewTable("acmepref")
+	acmeHandler = initACME()
+	acmeAutoRenewer, err = acme.NewAutoRenewer("./conf/acme_conf.json", "./conf/certs/", int64(*acmeAutoRenewInterval), acmeHandler)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	/*
+		Static Web Server
+
+		Start the static web server
+	*/
+
+	staticWebServer = webserv.NewWebServer(&webserv.WebServerOptions{
+		Sysdb:                  sysdb,
+		Port:                   "8081", //Default Port
+		WebRoot:                *staticWebServerRoot,
+		EnableDirectoryListing: true,
+		EnableWebDirManager:    *allowWebFileManager,
+	})
+	//Restore the web server to previous shutdown state
+	staticWebServer.RestorePreviousState()
 }
 
 // This sequence start after everything is initialized

src/web/components/access.html

@@ -308,7 +308,7 @@
     <div class="ui message">
         <i class="ui info circle icon"></i> IP Address support the following formats
         <div class="ui bulleted list">
-            <div class="item">Fixed IP Address (e.g. 192.128.4.100)</div>
+            <div class="item">Fixed IP Address (e.g. 192.128.4.100 or fe80::210:5aff:feaa:20a2)</div>
             <div class="item">IP Wildcard (e.g. 172.164.*.*)</div>
             <div class="item">CIDR String (e.g. 128.32.0.1/16)</div>
         </div>
@@ -625,7 +625,7 @@
     <div class="ui message">
         <i class="ui info circle icon"></i> IP Address support the following formats
         <div class="ui bulleted list">
-            <div class="item">Fixed IP Address (e.g. 192.128.4.100)</div>
+            <div class="item">Fixed IP Address (e.g. 192.128.4.100 or fe80::210:5aff:feaa:20a2)</div>
             <div class="item">IP Wildcard (e.g. 172.164.*.*)</div>
             <div class="item">CIDR String (e.g. 128.32.0.1/16)</div>
         </div>

src/web/components/cert.html

@@ -1,3 +1,13 @@
+<style>
+    .expired.certdate{
+        font-weight: bolder;
+        color: #bd001c;
+    }
+
+    .valid.certdate{
+        color: #31c071;
+    }
+</style>
 <div class="standardContainer">
     <div class="ui basic segment">
         <h2>TLS / SSL Certificates</h2>
@@ -55,17 +65,20 @@
     </div>
     <br>
     <div>
-        <table class="ui sortable unstackable celled table">
-            <thead>
-            <tr><th>Domain</th>
-            <th>Last Update</th>
-            <th>Expire At</th>
-            <th class="no-sort">Remove</th>
-            </tr></thead>
-        <tbody id="certifiedDomainList">
-
-        </tbody>
-        </table>
+        <div style="width: 100%; overflow-x: auto; margin-bottom: 1em;">
+            <table class="ui sortable unstackable celled table">
+                <thead>
+                <tr><th>Domain</th>
+                <th>Last Update</th>
+                <th>Expire At</th>
+                <th class="no-sort">Remove</th>
+                </tr></thead>
+            <tbody id="certifiedDomainList">
+    
+            </tbody>
+            </table>
+        </div>
+        
         <button class="ui basic button" onclick="initManagedDomainCertificateList();"><i class="green refresh icon"></i> Refresh List</button>
     </div>
     <div class="ui message">
@@ -74,11 +87,49 @@
         depending on your certificates coverage, you might need to setup them one by one (i.e. having two seperate certificate for <code>a.example.com</code> and <code>b.example.com</code>).<br>
         If you have a wildcard certificate that covers <code>*.example.com</code>, you can just enter <code>example.com</code> as server name in the form below to add a certificate.
     </div>
+    <div class="ui divider"></div>
+    <h4>Certificate Authority (CA) and Auto Renew (ACME)</h4>
+    <p>Management features regarding CA and ACME</p>
+    <p>The default CA to use when create a new subdomain proxy endpoint with TLS certificate</p>
+    <div class="ui fluid form">
+        <div class="field">
+            <label>Preferred CA</label>
+            <div class="ui selection dropdown" id="defaultCA">
+                <input type="hidden" name="defaultCA">
+                <i class="dropdown icon"></i>
+                <div class="default text">Let's Encrypt</div>
+                <div class="menu">
+                  <div class="item" data-value="Let's Encrypt">Let's Encrypt</div>
+                  <div class="item" data-value="Buypass">Buypass</div>
+                  <div class="item" data-value="ZeroSSL">ZeroSSL</div>
+                </div>
+            </div>
+        </div>
+        <div class="field">
+            <label>ACME Email</label>
+            <input id="prefACMEEmail" type="text" placeholder="ACME Email">
+        </div>
+        <button class="ui basic icon button" onclick="saveDefaultCA();"><i class="ui blue save icon"></i> Save Settings</button>
+    </div><br>
+    <h5>Certificate Renew / Generation (ACME) Settings</h5>
+    <div class="ui basic segment">
+        <h4 class="ui header" id="acmeAutoRenewer">
+            <i class="red circle icon"></i>
+            <div class="content">
+                <span id="acmeAutoRenewerStatus">Disabled</span>
+                <div class="sub header">Auto-Renewer Status</div>
+            </div>
+        </h4>
+    </div>
+    <p>This tool provide you a graphical interface to setup auto certificate renew on your (sub)domains. You can also manually generate a certificate if one of your domain do not have certificate.</p>
+    <button class="ui basic button" onclick="openACMEManager();"><i class="yellow external icon"></i> Open ACME Tool</button>
 </div>
 <script>
     var uploadPendingPublicKey = undefined;
     var uploadPendingPrivateKey = undefined;
 
+    $("#defaultCA").dropdown();
+
     //Delete the certificate by its domain
     function deleteCertificate(domain){
         if (confirm("Confirm delete certificate for " + domain + " ?")){
@@ -99,6 +150,62 @@
         
     }
 
+    function initAcmeStatus(){
+        //Initialize the current default CA options
+        $.get("/api/acme/autoRenew/email", function(data){
+            $("#prefACMEEmail").val(data);
+        });
+
+        $.get("/api/acme/autoRenew/ca", function(data){
+            $("#defaultCA").dropdown("set value", data);
+        });
+
+        $.get("/api/acme/autoRenew/enable", function(data){
+            setACMEEnableStates(data);
+        })
+    }
+    //Set the status of the acme enable icon
+    function setACMEEnableStates(enabled){
+        $("#acmeAutoRenewerStatus").text(enabled?"Enabled":"Disabled");
+        $("#acmeAutoRenewer").find("i").attr("class", enabled?"green circle icon":"red circle icon");
+    }
+    initAcmeStatus();
+
+    function saveDefaultCA(){
+        let newDefaultEmail = $("#prefACMEEmail").val().trim();
+        let newDefaultCA = $("#defaultCA").dropdown("get value");
+
+        if (newDefaultEmail == ""){
+            msgbox("Invalid acme email given", false);
+            return;
+        }
+
+        $.ajax({
+            url: "/api/acme/autoRenew/email",
+            method: "POST",
+            data: {"set": newDefaultEmail},
+            success: function(data){
+                if (data.error != undefined){
+                    msgbox(data.error, false);
+                }
+            }
+        });
+
+        $.ajax({
+            url: "/api/acme/autoRenew/ca",
+            data: {"set": newDefaultCA},
+            method: "POST",
+            success: function(data){
+                if (data.error != undefined){
+                    msgbox(data.error, false);
+                }
+            }
+        });
+
+        msgbox("Settings updated");
+
+    }
+
     //List the stored certificates
     function initManagedDomainCertificateList(){
         $.get("/api/cert/list?date=true", function(data){
@@ -106,11 +213,16 @@
                 msgbox(data.error, false, 5000);
             }else{
                 $("#certifiedDomainList").html("");
+                data.sort((a,b) => {
+                    return a.Domain > b.Domain
+                });
                 data.forEach(entry => {
+                    let isExpired = entry.RemainingDays <= 0;
+
                     $("#certifiedDomainList").append(`<tr>
                         <td>${entry.Domain}</td>
                         <td>${entry.LastModifiedDate}</td>
-                        <td>${entry.ExpireDate}</td>
+                        <td class="${isExpired?"expired":"valid"} certdate">${entry.ExpireDate} (${!isExpired?entry.RemainingDays+" days left":"Expired"})</td>
                         <td><button title="Delete key-pair" class="ui mini basic red icon button" onclick="deleteCertificate('${entry.Domain}');"><i class="ui red trash icon"></i></button></td>
                     </tr>`);
                 });
@@ -125,6 +237,10 @@
     }
     initManagedDomainCertificateList();
 
+    function openACMEManager(){
+        showSideWrapper('snippet/acme.html');
+    }
+
     function handleDomainUploadByKeypress(){
         handleDomainKeysUpload(function(){
             $("#certUploadingDomain").text($("#certdomain").val().trim());

src/web/components/networktools.html

@@ -45,8 +45,17 @@
             </div>
             
         </div>
-        <div class=""></div>
-
+        <div class="ui divider"></div>
+        <!-- Whois-->
+        <h2>Whois</h2>
+        <p>Check the owner and registration information of a given domain</p>
+        <div class="ui icon input">
+            <input id="whoisdomain" type="text" onkeypress="if(event.keyCode === 13) { performWhoisLookup(); }" placeholder="Domain or IP">
+            <i onclick="performWhoisLookup();" class="circular search link icon"></i>
+        </div><br>
+        <small>Lookup might take a few minutes to complete</small>
+        <br>
+        <div id="whois_table"></div>
     </div>
 
     <div class="ui bottom attached tab segment nettoolstab" data-tab="tab2">
@@ -485,10 +494,70 @@ function ping(){
             $("#traceroute_results").val("");
             msgbox(data.error, false, 6000);
         }else{
-            $("#traceroute_results").val(data.join("\n"));
+            $("#traceroute_results").val(`--------- ICMP Ping -------------
+${data.ICMP.join("\n")}\n
+---------- TCP Ping -------------
+${data.TCP.join("\n")}\n
+---------- UDP Ping -------------
+${data.UDP.join("\n")}`);
         }
     });
 }
+
+function performWhoisLookup(){
+    let whoisDomain = $("#whoisdomain").val().trim();
+    $("#whoisdomain").parent().addClass("disabled");
+    $("#whoisdomain").parent().css({
+        "cursor": "wait"
+    });
+    $.get("/api/tools/whois?target=" + whoisDomain, function(data){
+        $("#whoisdomain").parent().removeClass("disabled");
+        $("#whoisdomain").parent().css({
+            "cursor": "auto"
+        });
+        if (data.error != undefined){
+            msgbox(data.error, false, 6000);
+        }else{
+            renderWhoisDomainTable(data);
+        }
+    })
+}
+
+function renderWhoisDomainTable(jsonData) {
+
+    function formatDate(dateString) {
+        var date = new Date(dateString);
+        return date.toLocaleString('en-US', { year: 'numeric', month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit', second: '2-digit' });
+    }
+
+    var table = $('<table>').addClass('ui definition table');
+
+    // Create table body
+    var body = $('<tbody>');
+    for (var key in jsonData) {
+    var value = jsonData[key];
+    var row = $('<tr>');
+    row.append($('<td>').text(key));
+    if (key.endsWith('Date')) {
+        row.append($('<td>').text(formatDate(value)));
+    } else if (Array.isArray(value)) {
+        row.append($('<td>').text(value.join(', ')));
+    }else if (typeof(value) == "object"){
+        row.append($('<td>').text(JSON.stringify(value)));
+    } else {
+        row.append($('<td>').text(value));
+    }
+    body.append(row);
+    }
+
+    // Append the table body to the table
+    table.append(body);
+
+    // Append the table to the target element
+    $('#whois_table').empty().append(table);
+}
+
+
 </script>
 
 

src/web/components/redirection.html

@@ -39,7 +39,7 @@
         <div class="field">
           <label>Destination URL (To)</label>
           <input type="text" name="destination-url" placeholder="Destination URL">
-          <small><i class="ui circle info icon"></i> The target URL request being redirected to, e.g. dest.example.com/mysite</small>
+          <small><i class="ui circle info icon"></i> The target URL request being redirected to, e.g. dest.example.com/mysite/ or dest.example.com/script.php, <b>sometime you might need to add tailing slash (/) to your URL depending on your use cases</b></small>
         </div>
         <div class="field">
           <div class="ui checkbox">
@@ -72,7 +72,7 @@
           <i class="ui green checkmark icon"></i> Redirection Rules Added
         </div>
         <br><br>
-        <!--
+
         <div class="advancezone ui basic segment">
           <div class="ui accordion advanceSettings">
             <div class="title">
@@ -85,7 +85,7 @@
             </div>
           </div>
         </div>
-         -->
+
     </div>
   </div>
 </div>

src/web/components/rproot.html

@@ -1,7 +1,7 @@
 <div class="standardContainer">
     <div class="ui basic segment">
         <h2>Set Proxy Root</h2>
-        <p>For all routing not found in the proxy rules, request will be redirected to the proxy root server.</p>
+        <p>The default routing point for all incoming traffics. For all routing not found in the proxy rules, request will be redirected to the proxy root server.</p>
         <div class="ui form">
             <div class="field">
                 <label>Proxy Root</label>
@@ -10,16 +10,85 @@
             </div>
             <div class="field">
                 <div class="ui checkbox">
-                    <input type="checkbox" id="rootReqTLS" >
-                    <label>Root require TLS Connection <br><small>(i.e. Your proxy target starts with https://)</small></label>
+                    <input type="checkbox" id="rootReqTLS">
+                    <label>Root require TLS connection <br><small>Check this if your proxy root URL starts with https://</small></label>
                 </div>
             </div>
+            <div class="ui horizontal divider">OR</div>
+            <div class="field">
+                <div class="ui checkbox">
+                    <input type="checkbox" id="useStaticWebServer" onchange="handleUseStaticWebServerAsRoot()">
+                    <label>Use Static Web Server as Root <br><small>Check this if you prefer a more Apache Web Server like experience</small></label>
+                </div>
+            </div>
+            <br>
+            <button class="ui basic button" onclick="setProxyRoot()"><i class="teal home icon" ></i> Update Proxy Root</button>
+            <div class="ui divider"></div>
+            <div class="field">
+                <h4>Root Routing Options</h4>
+            </div>
+            <div class="field">
+                <div class="ui checkbox">
+                    <input type="checkbox" id="unsetRedirect">
+                    <label>Enable redirect for unset subdomains <br><small>Redirect subdomain that is not found to custom domain</small></label>
+                </div>
+            </div>
+            <div class="ui basic segment" id="unsetRedirectDomainWrapper" style="background-color: #f7f7f7; border-radius: 1em; margin-left: 2em; padding-left: 2em; display:none;">
+                <div style="
+                    position: absolute;
+                    top:0;
+                    left: 1em;
+                    width: 0px;
+                    height: 0px;
+                    margin-top: -10px;
+                    border-left: 10px solid transparent;
+                    border-right: 10px solid transparent;
+                    border-bottom: 10px solid #f7f7f7;">
+
+                </div>
+                <div class="field">
+                    <label>Redirect target domain</label>
+                    <div class="ui input">
+                        <input id="unsetRedirectDomain" type="text" placeholder="http://example.com">
+                    </div>
+                    <small>Unset subdomain will be redirected to the link above. Remember to include the protocol (e.g. http:// or https://)<br>
+                    Leave empty for redirecting to upper level domain (e.g. notfound.example.com <i class="right arrow icon"></i> example.com)</small>
+                </div>
+            </div>
+            <br>
+            <button class="ui basic button" onclick="updateRootOptions()"><i class="blue save icon" ></i> Save Root Options</button>
         </div>
         <br>
-        <button class="ui basic button" onclick="setProxyRoot()"><i class="teal home icon" ></i> Update Proxy Root</button>
+        
     </div>
 </div>
 <script>
+    $("#advanceRootSettings").accordion();
+
+    function handleUseStaticWebServerAsRoot(){
+        let useStaticWebServer = $("#useStaticWebServer")[0].checked;
+        if (useStaticWebServer){
+            let staticWebServerURL = "127.0.0.1:" + $("#webserv_listenPort").val();
+            $("#proxyRoot").val(staticWebServerURL);
+            $("#proxyRoot").parent().addClass("disabled");
+            $("#rootReqTLS").parent().checkbox("set unchecked");
+            $("#rootReqTLS").parent().addClass("disabled");
+
+            //Check if web server is enabled. If not, ask if the user want to enable it
+            if (!$("#webserv_enable").parent().checkbox("is checked")){
+                confirmBox("Enable static web server now?", function(choice){
+                    if (choice == true){
+                        $("#webserv_enable").parent().checkbox("set checked");
+                    }
+                });
+            }
+        }else{
+            $("#rootReqTLS").parent().removeClass("disabled");
+            $("#proxyRoot").parent().removeClass("disabled");
+            initRootInfo();
+        }
+    }
+    
     function initRootInfo(){
         $.get("/api/proxy/list?type=root", function(data){
             if (data == null){
@@ -29,10 +98,59 @@
                 checkRootRequireTLS(data.Domain);
             }
         });
+        
     }
     initRootInfo();
 
+    function updateRootSettingStates(){
+        $.get("/api/cert/tls", function(data){
+            if (data == true){
+                $("#disableRootTLS").parent().removeClass('disabled').attr("title", "");
+            }else{
+                $("#disableRootTLS").parent().addClass('disabled').attr("title", "TLS listener is not enabled");
+            }
+        });
+    }
+    //Bind event to tab switch
+    tabSwitchEventBind["setroot"] = function(){
+        //On switch over to this page, update root info
+        updateRootSettingStates();
+    }
+
+    //Toggle the display status of the input box for domain setting
+    function updateRedirectionDomainSettingInputBox(useRedirect){
+        if(useRedirect){
+            $("#unsetRedirectDomainWrapper").stop().finish().slideDown("fast");
+        }else{
+            $("#unsetRedirectDomainWrapper").stop().finish().slideUp("fast");
+        }
+    }
+
+    function checkCustomRedirectForUnsetSubd(){
+        $.get("/api/proxy/root/listOptions", function(data){
+            $("#unsetRedirect")[0].checked = data.EnableRedirectForUnsetRules || false;
+            $("#unsetRedirectDomain").val(data.UnsetRuleRedirectTarget);
+            updateRedirectionDomainSettingInputBox(data.EnableRedirectForUnsetRules);
+
+            //Bind event to the checkbox
+            $("#unsetRedirect").off("change").on("change", function(){
+                let useRedirect = $("#unsetRedirect")[0].checked;
+                updateRedirectionDomainSettingInputBox(useRedirect);
+            });
+        })
+       
+    }
+    checkCustomRedirectForUnsetSubd();
+
     function checkRootRequireTLS(targetDomain){
+        //Trim off the http or https from the origin
+        if (targetDomain.startsWith("http://")){
+            targetDomain = targetDomain.substring(7);
+            $("#proxyRoot").val(targetDomain);
+        }else if (targetDomain.startsWith("https://")){
+            targetDomain = targetDomain.substring(8);
+            $("#proxyRoot").val(targetDomain);
+        }
        $.ajax({
             url: "/api/proxy/tlscheck",
             data: {url: targetDomain},
@@ -44,6 +162,8 @@
                 }else if (data == "http"){
                     $("#rootReqTLS").parent().checkbox("set unchecked");
                 }
+
+                
             }
        })
     }
@@ -66,7 +186,7 @@
             data: {"type": "root", tls: rootReqTls, ep: newpr},
             success: function(data){
                 if (data.error != undefined){
-                    alert(data.error);
+                    msgbox(data.error, false, 5000);
                 }else{
                     //OK
                     initRootInfo();
@@ -76,4 +196,25 @@
         });
 
     }
+
+    function updateRootOptions(){
+        $.ajax({
+            type: "POST",
+            url: "/api/proxy/root/updateOptions",
+            data: {
+                unsetRedirect: $("#unsetRedirect")[0].checked,
+                unsetRedirectTarget: $("#unsetRedirectDomain").val().trim(),
+            },
+            success: function(data) {
+               if (data.error != undefined){
+                    msgbox(data.error, false);
+               }else{
+                    msgbox("Root Routing Options updated");
+               }
+            },
+            error: function(error) {
+                console.log("Error:", error);
+            }
+        });
+    }
 </script>

src/web/components/rules.html

@@ -172,13 +172,34 @@
                     //OK
                     listVdirs();
                     listSubd();
-                    msgbox("Proxy Endpoint Added");
+                   
 
                     //Clear old data
                     $("#rootname").val("");
                     $("#proxyDomain").val("");
                     credentials = [];
                     updateTable();
+
+                    //Check if it is a new subdomain and TLS enabled
+                    if (type == "subd" && $("#tls").checkbox("is checked")){
+                        confirmBox("Request new SSL Cert for this subdomain?", function(choice){
+                            if (choice == true){
+                                //Load the prefer CA from TLS page
+                                let defaultCA = $("#defaultCA").dropdown("get value");
+                                if (defaultCA.trim() == ""){
+                                    defaultCA = "Let's Encrypt";
+                                }
+                                //Get a new cert using ACME
+                                msgbox("Requesting certificate via " + defaultCA  +"...");
+                                console.log("Trying to get a new certificate via ACME");
+                                obtainCertificate(rootname, defaultCA.trim());
+                            }else{
+                                msgbox("Proxy Endpoint Added");
+                            }
+                        });
+                    }else{
+                        msgbox("Proxy Endpoint Added");
+                    }
                 }
             }
         });
@@ -363,7 +384,8 @@
                 column.empty().append(`<div class="ui checkbox" style="margin-top: 0.4em;">
                     <input type="checkbox" class="RequireBasicAuth" ${checkstate}>
                     <label>Require Basic Auth</label>
-                </div> <button class="ui basic tiny button" style="margin-left: 0.4em;" onclick="editBasicAuthCredentials('${endpointType}','${uuid}');"><i class="ui blue lock icon"></i> Edit Credentials</button>`);
+                    </div>
+                    <button class="ui basic tiny button" style="margin-left: 0.4em; margin-top: 0.4em;" onclick="editBasicAuthCredentials('${endpointType}','${uuid}');"><i class="ui blue lock icon"></i> Edit Settings</button>`);
 
             }else if (datatype == 'action'){
                 column.empty().append(`
@@ -437,4 +459,67 @@
         }));
         showSideWrapper("snippet/basicAuthEditor.html?t=" + Date.now() + "#" + payload);
     }
+
+
+    /*
+        Obtain Certificate via ACME
+    */
+
+    //Load the ACME email from server side
+    let acmeEmail = "";
+    $.get("/api/acme/autoRenew/email", function(data){
+        if (data != "" && data != undefined && data != null){
+            acmeEmail = data;
+        }
+    });
+
+   // Obtain certificate from API, only support one domain
+    function obtainCertificate(domains, usingCa = "Let's Encrypt") {
+        let filename = "";
+        let email = acmeEmail;
+        if (acmeEmail == ""){
+            let rootDomain = domains.split(".").pop();
+            email = "admin@" + rootDomain;
+        }
+        if (filename.trim() == "" && !domains.includes(",")){
+            //Zoraxy filename are the matching name for domains.
+            //Use the same as domains
+            filename = domains;
+        }else if (filename != "" && !domains.includes(",")){
+            //Invalid settings. Force the filename to be same as domain
+            //if there are only 1 domain
+            filename = domains;
+        }else{
+            parent.msgbox("Filename cannot be empty for certs containing multiple domains.")
+            return;
+        }
+
+        $.ajax({
+            url: "/api/acme/obtainCert",
+            method: "GET",
+            data: {
+                domains: domains,
+                filename: filename,
+                email: email,
+                ca: usingCa,
+            },
+            success: function(response) {
+                if (response.error) {
+                    console.log("Error:", response.error);
+                    // Show error message
+                    msgbox(response.error, false, 12000);
+                } else {
+                    console.log("Certificate installed successfully");
+                    // Show success message
+                    msgbox("Certificate installed successfully");
+                    
+                    // Renew the parent certificate list
+                    initManagedDomainCertificateList();
+                }
+            },
+            error: function(error) {
+                console.log("Failed to install certificate:", error);
+            }
+        });
+    }
 </script>

src/web/components/subd.html

@@ -43,10 +43,17 @@
                         tlsIcon = `<i class="green lock icon" title="TLS Mode"></i>`;
                     }
 
+                    let tlsVerificationField = "";
+                    if (subd.RequireTLS){
+                        tlsVerificationField = !subd.SkipCertValidations?`<i class="ui green check icon"></i>`:`<i class="ui yellow exclamation circle icon" title="TLS/SSL Verification will be skipped on this host"></i>`
+                    }else{
+                        tlsVerificationField = "N/A"
+                    }
+
                     $("#subdList").append(`<tr eptuuid="${subd.RootOrMatchingDomain}" payload="${subdData}" class="subdEntry">
                         <td data-label="" editable="false"><a href="//${subd.RootOrMatchingDomain}" target="_blank">${subd.RootOrMatchingDomain}</a></td>
                         <td data-label="" editable="true" datatype="domain">${subd.Domain} ${tlsIcon}</td>
-                        <td data-label="" editable="true" datatype="skipver">${!subd.SkipCertValidations?`<i class="ui green check icon"></i>`:`<i class="ui yellow exclamation circle icon" title="TLS/SSL Verification will be skipped on this host"></i>`}</td>
+                        <td data-label="" editable="true" datatype="skipver">${tlsVerificationField}</td>
                         <td data-label="" editable="true" datatype="basicauth">${subd.RequireBasicAuth?`<i class="ui green check icon"></i>`:`<i class="ui grey remove icon"></i>`}</td>
                         <td class="center aligned" editable="true" datatype="action" data-label="">
                             <button class="ui circular mini basic icon button editBtn" onclick='editEndpoint("subd","${subd.RootOrMatchingDomain}")'><i class="edit icon"></i></button>

src/web/components/utils.html

@@ -116,7 +116,11 @@
         </div>
         <p>Results: <div id="ipRangeOutput">N/A</div></p>
     </div>
-
+    <!-- Config Tools -->
+    <div class="ui divider"></div>
+    <h3>System Backup & Restore</h3>
+    <p>Options related to system backup, migrate and restore.</p>
+    <button class="ui basic button" onclick="showSideWrapper('snippet/configTools.html');">Open Config Tools</button>
     <!-- System Information -->
     <div class="ui divider"></div>
     <div id="zoraxyinfo">

src/web/components/vdir.html

@@ -44,10 +44,18 @@
                     if (vdir.RequireTLS){
                         tlsIcon = `<i class="green lock icon" title="TLS Mode"></i>`;
                     }
+
+                    let tlsVerificationField = "";
+                    if (vdir.RequireTLS){
+                        tlsVerificationField = !vdir.SkipCertValidations?`<i class="ui green check icon"></i>`:`<i class="ui yellow exclamation circle icon" title="TLS/SSL Verification will be skipped on this host"></i>`
+                    }else{
+                        tlsVerificationField = "N/A"
+                    }
+
                     $("#vdirList").append(`<tr eptuuid="${vdir.RootOrMatchingDomain}" payload="${vdirData}" class="vdirEntry">
                         <td data-label="" editable="false">${vdir.RootOrMatchingDomain}</td>
                         <td data-label="" editable="true" datatype="domain">${vdir.Domain} ${tlsIcon}</td>
-                        <td data-label="" editable="true" datatype="skipver">${!vdir.SkipCertValidations?`<i class="ui green check icon"></i>`:`<i class="ui yellow exclamation circle icon" title="TLS/SSL Verification will be skipped on this host"></i>`}</td>
+                        <td data-label="" editable="true" datatype="skipver">${tlsVerificationField}</td>
                         <td data-label="" editable="true" datatype="basicauth">${vdir.RequireBasicAuth?`<i class="ui green check icon"></i>`:`<i class="ui grey remove icon"></i>`}</td>
                         <td class="center aligned" editable="true" datatype="action" data-label="">
                             <button class="ui circular mini basic icon button editBtn" onclick='editEndpoint("vdir","${vdir.RootOrMatchingDomain}")'><i class="edit icon"></i></button>

src/web/components/webserv.html

@@ -0,0 +1,229 @@
+<div class="standardContainer">
+    <div class="ui basic segment">
+        <h2>Static Web Server</h2>
+        <p>A simple static web server that serve html css and js files</p>
+    </div>
+    <div class="ui divider"></div>
+    <div class="ui basic segment">
+        <h4 class="ui header" id="webservRunningState">
+            <i class="green circle icon"></i>
+            <div class="content">
+                <span class="webserv_status">Running</span>
+                <div class="sub header">Listen port :<span class="webserv_port">8081</span></div>
+            </div>
+        </h4>
+    </div>
+    
+    <h3>Web Server Settings</h3>
+    <div class="ui form">
+        <div class="inline field">
+            <div class="ui toggle checkbox">
+                <input id="webserv_enable" type="checkbox" class="hidden">
+                <label>Enable Static Web Server</label>
+            </div>
+        </div>
+        <div class="inline field">
+            <div class="ui toggle checkbox">
+                <input id="webserv_enableDirList" type="checkbox" class="hidden">
+                <label>Enable Directory Listing</label>
+                <small>If this folder do not contains any index files, list the directory of this folder.</small>
+            </div>
+        </div>
+        <div class="field">
+            <label>Document Root Folder</label>
+            <input id="webserv_docRoot" type="text" readonly="true">
+            <small>
+                The web server root folder can only be changed via startup flags of zoraxy for security reasons. 
+                See the -webserv flag for more details.
+            </small>
+        </div>
+        <div class="field">
+            <label>Port Number</label>
+            <input id="webserv_listenPort" type="number" step="1" min="0" max="65535" value="8081" onchange="updateWebServLinkExample(this.value);">
+            <small>Use <code>http://127.0.0.1:<span class="webserv_port">8081</span></code> in proxy rules to access the web server</small>
+        </div>
+    </div>
+    <small><i class="ui blue save icon"></i> Changes are saved automatically</small>
+    <br>
+    <div class="ui message">
+        <div class="ui accordion webservhelp">
+            <div class="title">
+                <i class="dropdown icon"></i>
+                How to access the static web server?
+            </div>
+            <div class="content">
+                There are three ways to access the static web server. <br>
+                <div class="ui ordered list">
+                    <div class="item">
+                        If you are using Zoraxy as your gateway reverse proxy server, 
+                        you can add a new subdomain proxy rule that points to 
+                        <a>http://127.0.0.1:<span class="webserv_port">8081</span></a>
+                    </div>
+                    <div class="item">
+                        If you are using Zoraxy under another reverse proxy server, 
+                        add <a>http://127.0.0.1:<span class="webserv_port">8081</span></a> to the config of your upper layer reverse proxy server's config file. 
+                    </div>
+                    <div class="item">
+                        Directly access the web server via <a>http://{zoraxy_host_ip}:<span class="webserv_port">8081</span></a> (Not recommended)
+                    </div>
+                    <br>
+                </div>
+                
+            </div>
+        </div>
+    </div>
+    
+    <div class="ui divider"></div>
+    <div class="ui basic segment">
+        <h2>Web Directory Manager</h2>
+        <p>Manage your files inside your web directory</p>
+    </div>
+    <div class="ui basic segment" style="display:none;" id="webdirManDisabledNotice">
+        <h4 class="ui header">
+            <i class="ui red times icon"></i> 
+            <div class="content">
+                Web Directory Manager Disabled
+                <div class="sub header">Web Directory Manager has been disabled by the system administrator</div>
+            </div>
+            
+        </h4>
+    </div>
+    <iframe id="webserv_dirManager" src="tools/fs.html" style="width: 100%; height: 800px; border: 0px; overflow-y: hidden;">
+
+    </iframe>
+    <small>If you do not want to enable web access to your web directory, you can disable this feature with <code>-webfm=false</code> startup paramter</small>
+   
+    
+
+    <script>
+        $(".webservhelp").accordion();
+        $(".ui.checkbox").checkbox();
+
+        function setWebServerRunningState(running){
+            if (running){
+                $("#webserv_enable").parent().checkbox("set checked");
+                $("#webservRunningState").find("i").attr("class", "green circle icon");
+                $("#webservRunningState").find(".webserv_status").text("Running");
+            }else{
+                $("#webserv_enable").parent().checkbox("set unchecked");
+                $("#webservRunningState").find("i").attr("class", "red circle icon");
+                $("#webservRunningState").find(".webserv_status").text("Stopped");
+            }
+        }
+
+        function updateWebServState(){
+            $.get("/api/webserv/status", function(data){
+                //Clear all event listeners
+                $("#webserv_enableDirList").off("change");
+                $("#webserv_enable").off("change");
+                $("#webserv_listenPort").off("change");
+
+                setWebServerRunningState(data.Running);
+
+                if (data.EnableDirectoryListing){
+                    $("#webserv_enableDirList").parent().checkbox("set checked");
+                }else{
+                    $("#webserv_enableDirList").parent().checkbox("set unchecked");
+                }
+
+                $("#webserv_docRoot").val(data.WebRoot + "/html/");
+
+                if (!data.EnableWebDirManager){
+                    $("#webdirManDisabledNotice").show();
+                    $("#webserv_dirManager").remove();
+                }
+
+                $("#webserv_listenPort").val(data.ListeningPort);
+                updateWebServLinkExample(data.ListeningPort);
+
+                //Bind checkbox events
+                $("#webserv_enable").off("change").on("change", function(){
+                    let enable = $(this)[0].checked;
+                    if (enable){
+                        $.get("/api/webserv/start", function(data){
+                            if (data.error != undefined){
+                                msgbox(data.error, false);
+                            }else{
+                                msgbox("Static web server started");
+                                setWebServerRunningState(true);
+                            }
+                        });
+                    }else{
+                        $.get("/api/webserv/stop", function(data){
+                            if (data.error != undefined){
+                                msgbox(data.error, false);
+                            }else{
+                                msgbox("Static web server stopped");
+                                setWebServerRunningState(false);
+                            }
+                        });
+                    }
+                });
+
+                $("#webserv_enableDirList").off("change").on("change", function(){
+                    let enable = $(this)[0].checked;
+                    $.ajax({
+                        url: "/api/webserv/setDirList",
+                        method: "POST",
+                        data: {"enable": enable},
+                        success: function(data){
+                            if (data.error != undefined){
+                                msgbox(data.error, false);
+                            }else{
+                                msgbox("Directory listing setting updated");
+                            }
+                        }
+                    })
+                });
+                $("#webserv_listenPort").off("change").on("change", function(){
+                    let newPort = $(this).val();
+
+                    //Check if the new value is same as listening port
+                    let rpListeningPort = $("#incomingPort").val();
+                    if (rpListeningPort == newPort){
+                        confirmBox("This setting might cause port conflict. Continue Anyway?", function(choice){
+                            if (choice == true){
+                                //Continue anyway
+                                $.ajax({
+                                    url: "/api/webserv/setPort",
+                                    method: "POST",
+                                    data: {"port": newPort},
+                                    success: function(data){
+                                        if (data.error != undefined){
+                                            msgbox(data.error, false);
+                                        }else{
+                                            msgbox("Listening port updated");
+                                        }
+                                        updateWebServState();
+                                    }
+                                });
+                            }else{
+                                //Cancel. Restore to previous value
+                                updateWebServState();
+                                msgbox("Setting restored");
+                            }
+                        });
+                    }else{
+                        $.ajax({
+                            url: "/api/webserv/setPort",
+                            method: "POST",
+                            data: {"port": newPort},
+                            success: function(data){
+                                if (data.error != undefined){
+                                    msgbox(data.error, false);
+                                }else{
+                                    msgbox("Listening port updated");
+                                }
+                            }
+                        })
+                    }
+                });
+            })
+        }
+        updateWebServState();
+
+        function updateWebServLinkExample(newport){
+            $(".webserv_port").text(newport);
+        }
+    </script>
+</div>

src/web/components/zgrok.html

@@ -0,0 +1,10 @@
+<div class="standardContainer">
+    <div class="ui basic segment">
+        <h2>Service Expose Proxy</h2>
+        <p>Expose your local test-site on the internet with single command</p>
+    </div>
+    <div class="ui message">
+        <h4>Work In Progress</h4>
+        We are looking for someone to help with implementing this feature in Zoraxy. <br>If you know how to write Golang and want to contribute, feel free to create a pull request to this feature!
+    </div>
+</div>  

src/web/index.html

@@ -62,13 +62,16 @@
                     <a class="item" tag="gan">
                         <i class="simplistic globe icon"></i> Global Area Network
                     </a>
-                    <a class="item" tag="">
+                    <a class="item" tag="zgrok">
                         <i class="simplistic podcast icon"></i> Service Expose Proxy
                     </a>
                     <a class="item" tag="tcpprox">
                         <i class="simplistic exchange icon"></i> TCP Proxy
                     </a>
                     <div class="ui divider menudivider">Others</div>
+                    <a class="item" tag="webserv">
+                        <i class="simplistic globe icon"></i> Static Web Server
+                    </a>
                     <a class="item" tag="utm">
                         <i class="simplistic time icon"></i> Uptime Monitor
                     </a>
@@ -114,9 +117,15 @@
                 <!-- Global Area Networking -->
                 <div id="gan" class="functiontab" target="gan.html"></div>
 
+                <!-- Service Expose Proxy -->
+                <div id="zgrok" class="functiontab" target="zgrok.html"></div>
+
                 <!-- TCP Proxy -->
                 <div id="tcpprox" class="functiontab" target="tcpprox.html"></div>
 
+                <!-- Web Server -->
+                <div id="webserv" class="functiontab" target="webserv.html"></div>
+
                 <!-- Up Time Monitor -->
                 <div id="utm" class="functiontab" target="uptime.html"></div>
 
@@ -364,6 +373,7 @@
                 $(".sideWrapper").show();
                 $(".sideWrapper .fadingBackground").fadeIn("fast");
                 $(".sideWrapper .content").transition('slide left in', 300);
+                $("body").css("overflow", "hidden");
             }
 
             function hideSideWrapper(discardFrameContent = false){
@@ -378,6 +388,7 @@
                         $(".sideWrapper").hide(); 
                     });
                 });
+                $("body").css("overflow", "auto");
             }
         </script>
     </body>

src/web/main.css

@@ -116,7 +116,7 @@ body{
 }
 
 #confirmBox .ui.progress .bar{
-    background: #ffe32b !important;
+    background: #a9d1f3 !important;
 }
 
 #confirmBox .confirmBoxBody .button{
@@ -179,7 +179,7 @@ body{
 }
 
 .sideWrapper iframe{
-    height: 100%;
+    height: calc(100% - 55px);
     width: 100%;
     border: 0px solid transparent;
 }

src/web/snippet/acme.html

@@ -0,0 +1,515 @@
+<!DOCTYPE html>
+<html>
+  <head>
+      <!-- Notes: This should be open in its original path-->
+      <link rel="stylesheet" href="../script/semantic/semantic.min.css">
+      <script src="../script/jquery-3.6.0.min.js"></script>
+      <script src="../script/semantic/semantic.min.js"></script>
+      <style>
+        .disabled.table{
+          opacity: 0.5;
+          pointer-events: none;
+          
+        }
+
+        .expiredDomain{
+          color: rgb(238, 31, 31);
+        }
+
+        .validDomain{
+          color: rgb(49, 192, 113);
+        }
+      </style>
+  </head>
+  <body>
+  <br>
+  <div class="ui container">
+    <div class="ui header">
+        <div class="content">
+            Certificates Auto Renew Settings
+            <div class="sub header">Fetch and renew your certificates with Automated Certificate Management Environment (ACME) protocol</div>
+        </div>
+    </div>
+    <div class="ui basic segment">
+      <p style="float: right; color: #21ba45; display:none;" id="enableToggleSucc"><i class="green checkmark icon"></i> Setting Updated</p>
+      <div class="ui toggle checkbox">
+        <input type="checkbox" id="enableCertAutoRenew">
+        <label>Enable Certificate Auto Renew</label>
+      </div>
+      <br>
+      <h3>ACME Email</h3>
+      <p>Email is required by many CAs for renewing via ACME protocol</p>
+      <div class="ui fluid action input">
+        <input id="caRegisterEmail" type="text" placeholder="webmaster@example.com">
+        <button class="ui icon basic button" onclick="saveEmailToConfig(this);">
+            <i class="blue save icon"></i>
+        </button>
+      </div>
+      <small>If you don't want to share your private email address, you can also fill in an email address that point to a mailbox not exists on your domain.</small>
+    </div>
+    <div class="ui basic segment" style="background-color: #f7f7f7; border-radius: 1em;">
+      <div class="ui accordion advanceSettings">
+          <div class="title">
+            <i class="dropdown icon"></i>
+              Advance Renew Policy
+          </div>
+          <div class="content">
+              <p>Renew all certificates with ACME supported CAs</p>
+              <div class="ui toggle checkbox">
+                <input type="checkbox" id="renewAllSupported" onchange="setAutoRenewIfCASupportMode(this.checked);">
+                <label>Renew All Certs</label>
+              </div><br>
+              <button id="renewNowBtn" onclick="renewNow();" class="ui basic right floated button" style="margin-top: -2em;"><i class="yellow refresh icon"></i> Renew Now</button>
+              <div class="ui horizontal divider"> OR </div>
+              <p>Select the certificates to automatic renew in the list below</p>
+              <table id="domainCertFileTable" class="ui very compact unstackable basic disabled table">
+                <thead>
+                  <tr>
+                    <th>Domain Name</th>
+                    <th>Match Rule</th>
+                    <th>Auto-Renew</th>
+                  </tr>
+                </thead>
+                <tbody id="domainTableBody"></tbody>
+              </table>
+              <small><i class="ui red info circle icon"></i> Domain in red are expired</small><br>
+              <div class="ui yellow message">
+                Certificate Renew only works on the certification authority (CA) supported by Zoraxy. Check Zoraxy wiki for more information on supported list of CAs.
+              </div>
+              <button class="ui basic right floated button" onclick="saveAutoRenewPolicy();"><i class="blue save icon"></i> Save Changes</button>
+              <button id="renewSelectedButton" onclick="renewNow();" class="ui basic right floated disabled button"><i class="yellow refresh icon"></i> Renew Selected</button>
+              <br><br>
+          </div>
+      </div>
+  </div>
+  <div class="ui divider"></div>
+  <h3>Generate New Certificate</h3>
+  <p>Enter a new / existing domain(s) to request new certificate(s)</p>
+  <div class="ui form">
+    <div class="field">
+      <label>Domain(s)</label>
+      <input id="domainsInput" type="text" placeholder="example.com" onkeyup="checkIfInputDomainIsMultiple();">
+      <small>If you have more than one domain in a single certificate, enter the domains separated by commas (e.g. s1.dev.example.com,s2.dev.example.com)</small>
+    </div>
+    <div class="field multiDomainOnly" style="display:none;">
+      <label>Matching Rule</label>
+      <input id="filenameInput" type="text" placeholder="Enter filename (no file extension)">
+      <small>Matching rule to let Zoraxy pick which certificate to use (Also be used as filename). Usually is the longest common suffix of the entered addresses. (e.g. dev.example.com)</small>
+    </div>
+    <div class="field multiDomainOnly" style="display:none;">
+      <button class="ui basic fluid button" onclick="autoDetectMatchingRules();">Auto Detect Matching Rule</button>
+    </div>
+    <div class="field">
+      <label>Certificate Authority (CA)</label>
+      <div class="ui selection dropdown" id="ca">
+        <input type="hidden" name="ca">
+        <i class="dropdown icon"></i>
+        <div class="default text">Let's Encrypt</div>
+        <div class="menu">
+          <div class="item" data-value="Let's Encrypt">Let's Encrypt</div>
+          <div class="item" data-value="Buypass">Buypass</div>
+          <div class="item" data-value="ZeroSSL">ZeroSSL</div>
+          <div class="item" data-value="Custom ACME Server">Custom ACME Server</div>
+          <!-- <div class="item" data-value="Google">Google</div> -->
+        </div>
+      </div>
+    </div>
+    <div class="field" id="caInput" style="display:none;">
+      <label>ACME Server URL</label>
+      <input id="caURL" type="text" placeholder="https://example.com/acme/dictionary">
+    </div>
+    <div class="field" id="skipTLS" style="display:none;">
+      <div class="ui checkbox">
+        <input type="checkbox" id="skipTLSCheckbox">
+        <label>Ignore TLS/SSL Verification Error<br><small>E.g. self-signed, expired certificate (Not Recommended)</small></label>
+      </div>
+    </div>
+    <button id="obtainButton" class="ui basic button" type="submit"><i class="yellow refresh icon"></i> Get Certificate</button>
+  </div>
+  <div class="ui divider"></div>
+  <small>First time setting up HTTPS?<br>Try out our <a href="../tools/https.html" target="_blank">wizard</a></small>
+  <button class="ui basic button"  style="float: right;" onclick="parent.hideSideWrapper();"><i class="remove icon"></i> Cancel</button>
+  <br><br><br><br>
+  </div>
+
+  <script>
+    let expiredDomains = [];
+    let enableTrigerOnChangeEvent = true;
+    $(".accordion").accordion();
+    $(".dropdown").dropdown();
+    $(".checkbox").checkbox();
+
+    function setAutoRenewIfCASupportMode(useAutoMode = true){
+      if (useAutoMode){
+        $("#domainCertFileTable").addClass("disabled");
+        $("#renewNowBtn").removeClass("disabled");
+        $("#renewSelectedButton").addClass("disabled");
+      }else{
+        $("#domainCertFileTable").removeClass("disabled");
+        $("#renewNowBtn").addClass("disabled");
+        $("#renewSelectedButton").removeClass("disabled");
+      }
+    }
+
+    function initRenewerConfigFromFile(){
+      //Set the renew switch state
+      $.get("/api/acme/autoRenew/enable", function(data){
+        if (data == true){
+          $("#enableCertAutoRenew").parent().checkbox("set checked");
+        }
+
+        $("#enableCertAutoRenew").on("change", function(){
+          if (!enableTrigerOnChangeEvent){
+            return;
+          }
+          toggleAutoRenew();
+        })
+      });
+
+      //Load the email from server side
+      $.get("/api/acme/autoRenew/email", function(data){
+        if (data != "" && data != undefined && data != null){
+          $("#caRegisterEmail").val(data);
+        }
+      });
+
+      //Load the domain selection options
+      $.get("/api/acme/autoRenew/renewPolicy", function(data){
+        if (data == true){
+          $("#renewAllSupported").parent().checkbox("set checked");
+        }else{
+          $("#renewAllSupported").parent().checkbox("set unchecked");
+        }
+      });
+    }
+    initRenewerConfigFromFile();
+
+    function saveEmailToConfig(btn){
+      $.ajax({
+        url: "/api/acme/autoRenew/email",
+        data: {set: $("#caRegisterEmail").val()},
+        success: function(data){
+          if (data.error != undefined){
+            parent.msgbox(data.error, false, 5000);
+          }else{
+            parent.msgbox("Email updated");
+            $(btn).html(`<i class="green check icon"></i>`);
+            $(btn).addClass("disabled");
+            setTimeout(function(){
+              $(btn).html(`<i class="blue save icon"></i>`);
+              $(btn).removeClass("disabled");
+            }, 3000);
+          }
+        }
+      });
+    }
+
+    function toggleAutoRenew(){
+      var enabled = $("#enableCertAutoRenew").parent().checkbox("is checked");
+      $.post("/api/acme/autoRenew/enable?enable=" + enabled, function(data){
+        if (data.error){
+          parent.msgbox(data.error, false, 5000);
+          if (enabled){
+            enableTrigerOnChangeEvent = false;
+            $("#enableCertAutoRenew").parent().checkbox("set unchecked");
+            enableTrigerOnChangeEvent = true;
+          }
+        }else{
+          $("#enableToggleSucc").stop().finish().fadeIn("fast").delay(3000).fadeOut("fast");
+        }
+      });
+
+      if (parent && parent.setACMEEnableStates){
+        parent.setACMEEnableStates(enabled);
+      }
+      
+    }
+
+    //Render the domains table that exists in this zoraxy host
+    function renderDomainTable(domainFileList) {
+      // Get the table body element
+      var tableBody = $('#domainTableBody');
+      
+      // Clear the table body
+      tableBody.empty();
+      
+      // Iterate over the domain names
+      var counter = 0;
+      for (const [srcfile, domains] of Object.entries(domainFileList)) {
+
+        // Create a table row
+        var row = $('<tr>');
+        
+        // Create the domain name cell
+        var domainClass = "validDomain";
+        for (var i = 0; i < domains.length; i++){
+          let thisDomain = domains[i];
+          if (expiredDomains.includes(thisDomain)){
+            domainClass = "expiredDomain";
+          }
+        }
+       
+        var domainCell = $('<td class="' + domainClass  +'">').html(domains.join("<br>"));
+        row.append(domainCell);
+
+        var srcFileCell = $('<td>').text(srcfile);
+        row.append(srcFileCell);
+        
+        // Create the auto-renew checkbox cell
+        let domainsEncoded = encodeURIComponent(JSON.stringify(domains));
+        var checkboxCell = $(`<td domain="${domainsEncoded}" srcfile="${srcfile}">`);
+        var checkbox = $(`<input name="${srcfile}">`).attr('type', 'checkbox');
+        checkboxCell.append(checkbox);
+        row.append(checkboxCell);
+        
+        // Add the row to the table body
+        tableBody.append(row);
+
+        counter++;
+      }
+
+      if (Object.keys(domainFileList).length == 0){
+        //No certificate in this system
+        tableBody.append(`<tr>
+          <td colspan="3"><i class="ui green circle check icon"></i> No certificate in use</td>
+        </tr>`);
+      }
+    }
+
+    //Initiate domain table. If you needs to update the expired domain as well
+    //call from initDomainFileList() instead
+    function initDomainTable(){
+      $.get("/api/cert/listdomains?compact=true", function(data){
+        if (data.error != undefined){
+          parent.msgbox(data.error, false);
+        }else{
+          renderDomainTable(data);
+        }
+        initAutoRenewPolicy();
+      })
+    }
+
+    function initDomainFileList() {
+      $.ajax({
+        url: "/api/acme/listExpiredDomains",
+        method: "GET",
+        success: function(response) {
+          // Render domain table
+          expiredDomains = response.domain;
+          initDomainTable();
+          //renderDomainTable(response.domain);
+        },
+        error: function(error) {
+          console.log("Failed to fetch expired domains:", error);
+        }
+      });
+    }
+    initDomainFileList();
+
+    // Button click event handler for obtaining certificate
+    $("#obtainButton").click(function() {
+      $("#obtainButton").addClass("loading").addClass("disabled");
+      obtainCertificate();
+    });
+
+    $("input[name=ca]").on('change', function() {
+      if(this.value == "Custom ACME Server") {
+        $("#caInput").show();
+        $("#skipTLS").show();
+      } else {
+        $("#caInput").hide();
+        $("#skipTLS").hide();
+      }
+    })
+
+    // Obtain certificate from API
+    function obtainCertificate() {
+      var domains = $("#domainsInput").val();
+      var filename = $("#filenameInput").val();
+      var email = $("#caRegisterEmail").val();
+      if (email == ""){
+        parent.msgbox("ACME renew email is not set", false)
+        $("#obtainButton").removeClass("loading").removeClass("disabled");
+        return;
+      }
+      if (filename.trim() == "" && !domains.includes(",")){
+        //Zoraxy filename are the matching name for domains.
+        //Use the same as domains
+        filename = domains;
+      }else if (filename != "" && !domains.includes(",")){
+        //Invalid settings. Force the filename to be same as domain
+        //if there are only 1 domain
+        filename = domains;
+      }else if (filename == "" && domains.includes(",")){
+        parent.msgbox("Filename cannot be empty for certs containing multiple domains.", false, 5000);
+        $("#obtainButton").removeClass("loading").removeClass("disabled");
+        return;
+      }
+      
+      var ca = $("#ca").dropdown("get value");
+      var caURL = "";
+      if (ca == "Custom ACME Server") {
+        ca = "custom";
+        caURL = $("#caURL").val();
+      }
+
+      var skipTLSValue = $("#skipTLSCheckbox")[0].checked;
+
+      $.ajax({
+        url: "/api/acme/obtainCert",
+        method: "GET",
+        data: {
+          domains: domains,
+          filename: filename,
+          email: email,
+          ca: ca,
+          caURL: caURL,
+          skipTLS: skipTLSValue,
+        },
+        success: function(response) {
+          $("#obtainButton").removeClass("loading").removeClass("disabled");
+          if (response.error) {
+            console.log("Error:", response.error);
+            // Show error message
+            parent.msgbox(response.error, false, 12000);
+          } else {
+            console.log("Certificate renewed successfully");
+            // Show success message
+            parent.msgbox("Certificate renewed successfully");
+            
+            // Renew the parent certificate list
+            parent.initManagedDomainCertificateList();
+          }
+        },
+        error: function(error) {
+          $("#obtainButton").removeClass("loading").removeClass("disabled");
+          console.log("Failed to renewed certificate:", error);
+        }
+      });
+    }
+
+    function checkIfInputDomainIsMultiple(){
+      var inputDomains = $("#domainsInput").val();
+      if (inputDomains.includes(",")){
+        $(".multiDomainOnly").show();
+      }else{
+        $(".multiDomainOnly").hide();
+      }
+    }
+
+    //Grab the longest common suffix of all domains
+    //not that smart technically
+    function autoDetectMatchingRules(){
+      var domainsString = $("#domainsInput").val();
+      if (!domainsString.includes(",")){
+        return domainsString;
+      }
+
+      let domains = domainsString.split(",");
+
+      //Clean out any spacing between commas
+      for (var i = 0; i < domains.length; i++){
+        domains[i] = domains[i].trim();
+      }
+
+      function getLongestCommonSuffix(strings) {
+        if (strings.length === 0) {
+          return ''; // Return an empty string if the array is empty
+        }
+
+        var sortedStrings = strings.slice().sort(); // Create a sorted copy of the array
+
+        var firstString = sortedStrings[0];
+        var lastString = sortedStrings[sortedStrings.length - 1];
+
+        var suffix = '';
+        var minLength = Math.min(firstString.length, lastString.length);
+
+        for (var i = 0; i < minLength; i++) {
+          if (firstString[firstString.length - 1 - i] !== lastString[lastString.length - 1 - i]) {
+            break; // Stop iterating if characters don't match
+          }
+          suffix = firstString[firstString.length - 1 - i] + suffix;
+        }
+
+        return suffix;
+      }
+
+      let longestSuffix = getLongestCommonSuffix(domains);
+
+      //Check if the suffix is a valid domain
+      if (longestSuffix.substr(0,1) == "."){
+        //Trim off the first dot
+        longestSuffix = longestSuffix.substr(1);
+      }
+
+      if (!longestSuffix.includes(".")){
+        parent.msgbox("Auto Detect failed: Multiple Domains", false, 5000);
+        return;
+      }
+      $("#filenameInput").val(longestSuffix);
+    }
+
+    //Handle the renew now btn click
+    function renewNow(){
+      $.get("/api/acme/autoRenew/renewNow", function(data){
+        if (data.error != undefined){
+          parent.msgbox(data.error, false, 6000);
+        }else{
+          parent.msgbox(data)
+        }
+      })
+    }
+
+    function initAutoRenewPolicy(){
+      $.get("/api/acme/autoRenew/listDomains", function(data){
+        if (data.error != undefined){
+          parent.msgbox(data.error, false)
+        }else{
+          if (data[0] == "*"){
+            //Auto select and renew is enabled
+            $("#renewAllSupported").parent().checkbox("set checked");
+          }else{
+            //This is a list of domain files
+            data.forEach(function(name) {
+              $('#domainTableBody input[type="checkbox"][name="' + name + '"]').prop('checked', true);
+            });
+            $("#domainCertFileTable").removeClass("disabled");
+            $("#renewNowBtn").addClass("disabled");
+            $("#renewSelectedButton").removeClass("disabled");
+          }
+        }
+      })
+    }
+
+    function saveAutoRenewPolicy(){
+      let autoRenewAll = $("#renewAllSupported").parent().checkbox("is checked");
+      if (autoRenewAll == true){
+        $.ajax({
+          url: "/api/acme/autoRenew/setDomains",
+          data: {opr: "setAuto"},
+          success: function(data){
+            parent.msgbox("Renew policy rule updated")
+          }
+        });
+      }else{
+        let checkedNames = [];
+        $('#domainTableBody input[type="checkbox"]:checked').each(function() {
+          checkedNames.push($(this).attr('name'));
+        });
+
+        $.ajax({
+          url: "/api/acme/autoRenew/setDomains",
+          data: {opr: "setSelected", domains: JSON.stringify(checkedNames)},
+          success: function(data){
+            parent.msgbox("Renew policy rule updated")
+          }
+        });
+      }
+    }
+
+    //Clear  up the input field when page load
+    $("#filenameInput").val("");
+  </script>
+</body>
+</html>

src/web/snippet/basicAuthEditor.html

@@ -11,10 +11,12 @@
         <div class="ui container">
             <div class="ui header">
                 <div class="content">
-                    Basic Auth Credential
+                    Basic Auth Settings
                     <div class="sub header" id="epname"></div>
                 </div>
             </div>
+            <div class="ui divider"></div>
+            <h3 class="ui header">Basic Auth Credential</h3>
             <div class="scrolling content ui form">
                 <div id="inlineEditBasicAuthCredentials" class="field">
                     <p>Enter the username and password for allowing them to access this proxy endpoint</p>
@@ -40,15 +42,54 @@
                         </div>
                         <div class="field" >
                             <button class="ui basic button" onclick="addCredentialsToEditingList();"><i class="blue add icon"></i> Add Credential</button>
+                            <button class="ui basic button"  style="float: right;" onclick="saveCredentials();"><i class="green save icon"></i> Save Credential</button>
                         </div>
                         <div class="ui divider"></div>
-                        <div class="field" >
-                            <button class="ui basic button"  style="float: right;" onclick="saveCredentials();"><i class="green save icon"></i> Save</button>
-                            <button class="ui basic button"  style="float: right;" onclick="cancelCredentialEdit();"><i class="remove icon"></i> Cancel</button>
-                        </div>
                     </div>
                 </div>
             </div>
+            <div class="ui divider"></div>
+            <h3 class="ui header">Authentication Exclusion Paths</h3>
+            <div class="scrolling content ui form">
+                <p>Exclude specific directories / paths which contains the following subpath prefix from authentication. Useful if you are hosting services require remote API access.</p>
+                <table class="ui very basic compacted unstackable celled table">
+                    <thead>
+                    <tr>
+                        <th>Path Prefix</th>
+                        <th>Remove</th>
+                    </tr></thead>
+                    <tbody id="exclusionPaths">
+                    <tr>
+                        <td colspan="2"><i class="ui green circle check icon"></i> No Path Excluded</td>
+                    </tr>
+                    </tbody>
+                </table>
+                <div class="field">
+                    <input id="newExclusionPath" type="text" placeholder="/public/api/" autocomplete="off">
+                    <small>Make sure you add the tailing slash for only selecting the files / folder inside that path.</small>
+                </div>
+                <div class="field" >
+                    <button class="ui basic button" onclick="addExceptionPath();"><i class="blue add icon"></i> Add Exception</button>
+                </div>
+                <div class="field">
+                    <div class="ui basic message">
+                        <h4>How to use set excluded paths?</h4>
+                        <p>All request URI that contains the given prefix will be allowed to bypass authentication and <b>the prefix must start with a slash.</b> For example, given the following prefix.<br>
+                        <code>/public/res/</code><br>
+                            <br>
+                            Zoraxy will allow authentication bypass of any subdirectories or resources under the /public/res/ directory. For example, the following paths access will be able to bypass basic auth mechanism under this setting.<br>
+                            <code>/public/res/photo.png</code><br>
+                            <code>/public/res/far/boo/</code></p>
+                    </div>
+                </div>
+                <div class="ui divider"></div>
+                <div class="field" >
+                    <button class="ui basic button"  style="float: right;" onclick="closeThisWrapper();">Close</button>
+                </div>
+            </div>
+            
+            <br><br><br><br>
+
         </div>
         <script>
             let editingCredentials = [];
@@ -124,6 +165,80 @@
                 updateEditingCredentialList();
             }
 
+            function addExceptionPath(){
+                // Retrieve the username and password input values
+                var newExclusionPathMatchingPrefix = $('#newExclusionPath').val().trim();
+                if (newExclusionPathMatchingPrefix == ""){
+                    parent.msgbox("Matching prefix cannot be empty!", false, 5000);
+                    return;
+                }
+                $.ajax({
+                    url: "/api/proxy/auth/exceptions/add",
+                    data:{
+                        ptype: editingEndpoint.ept,
+                        ep: editingEndpoint.ep,
+                        prefix: newExclusionPathMatchingPrefix
+                    },
+                    method: "POST",
+                    success: function(data){
+                        if (data.error != undefined){
+                            parent.msgbox(data.error, false, 5000);
+                        }else{
+                            initExceptionPaths();
+                            parent.msgbox("New exception path added", true);
+                            $('#newExclusionPath').val("");
+                        }
+                    }
+                });
+            }
+
+            function removeExceptionPath(object){
+                let matchingPrefix = $(object).attr("prefix");
+                $.ajax({
+                    url: "/api/proxy/auth/exceptions/delete",
+                    data:{
+                        ptype: editingEndpoint.ept,
+                        ep: editingEndpoint.ep,
+                        prefix: matchingPrefix
+                    },
+                    method: "POST",
+                    success: function(data){
+                        if (data.error != undefined){
+                            parent.msgbox(data.error, false, 5000);
+                        }else{
+                            initExceptionPaths();
+                            parent.msgbox("Exception path removed", true);
+                        }
+                    }
+                });
+            }
+
+            //Load exception paths from server
+            function initExceptionPaths(){
+                $.get(`/api/proxy/auth/exceptions/list?ptype=${editingEndpoint.ept}&ep=${editingEndpoint.ep}`, function(data){
+                    if (data.error != undefined){
+                        parent.msgbox(data.error, false, 5000);
+                    }else{
+                        if (data.length == 0){
+                            $("#exclusionPaths").html(` <tr>
+                                <td colspan="2"><i class="ui green circle check icon"></i> No Path Excluded</td>
+                            </tr>`);
+                        }else{
+                            $("#exclusionPaths").html("");
+                            data.forEach(function(rule){
+                                $("#exclusionPaths").append(` <tr>
+                                    <td>${rule.PathPrefix}</td>
+                                    <td><button class="ui red basic mini icon button" onclick="removeExceptionPath(this);" prefix="${rule.PathPrefix}"><i class="ui red times icon"></i></button></td>
+                                </tr>`);
+                            })
+                        }   
+                    }
+                });
+
+
+            }
+            initExceptionPaths();
+
             function updateEditingCredentialList() {
                 var tableBody = $('#inlineEditBasicAuthCredentialTable');
                 tableBody.empty();
@@ -168,7 +283,7 @@
                 return isExists;
             }
 
-            function cancelCredentialEdit(){
+            function closeThisWrapper(){
                 parent.hideSideWrapper(true);
             }
 
@@ -186,7 +301,7 @@
                             parent.msgbox(data.error, false, 6000);
                         }else{
                             parent.msgbox("Credentials Updated");
-                            parent.hideSideWrapper(true);
+                            //parent.hideSideWrapper(true);
                         }
                     }
                 })

src/web/snippet/configTools.html

@@ -0,0 +1,100 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <!-- Notes: This should be open in its original path-->
+        <link rel="stylesheet" href="../script/semantic/semantic.min.css">
+        <script src="../script/jquery-3.6.0.min.js"></script>
+        <script src="../script/semantic/semantic.min.js"></script>
+    </head>
+    <body>
+        <br>
+        <div class="ui container">
+            <div class="ui header">
+                <div class="content">
+                    Config Export and Import Tool
+                    <div class="sub header">Painless migration with one click</div>
+                </div>
+            </div>
+            <h3>Backup Current Configs</h3>
+            <p>This will download all your configuration on zoraxy in a zip file. This includes all the proxy configs and certificates. Please keep it somewhere safe and after migration, delete this if possible.</p>
+            <div class="ui form">
+                <div class="grouped fields">
+                  <label>Backup Mode</label>
+                  <div class="field">
+                    <div class="ui radio checkbox">
+                      <input type="radio" value="rules" name="backupmode" checked="checked">
+                      <label>Proxy Settings, Redirect Rules and Certificates Only</label>
+                    </div>
+                  </div>
+                  <div class="field">
+                    <div class="ui radio checkbox">
+                      <input type="radio" value="full" name="backupmode">
+                      <label>Full System Snapshot</label>
+                    </div>
+                  </div>
+                </div>
+            </div>
+            <br>
+            <button class="ui basic button" onclick="downloadConfig();"><i class="ui blue download icon"></i> Download</button>
+            <div class="ui divider"></div>
+
+            <h3>Restore from Config</h3>
+            <p>You can restore your previous settings and database from a zip file config backup. 
+            <br><b style="color: rgba(255, 0, 0, 0.644);">RESTORE FULL SYSTEM SNAPSHOT WILL CAUSE THE SYSTEM TO SHUTDOWN AFTER COMPLETED. Make sure your Zoraxy is configured to work with systemd to automatic restart Zoraxy after system restore completed.<br>
+                
+            </b></p>
+            <form class="ui form" id="uploadForm" action="/api/conf/import" method="POST" enctype="multipart/form-data">
+              <input type="file" name="file" id="fileInput" accept=".zip">
+              <button style="margin-top: 0.6em;" class="ui basic button" type="submit"><i class="ui green upload icon"></i> Upload</button>
+            </form>
+            <small>The current config will be backup to ./conf_old{timestamp}. If you screw something up, you can always restore it by ssh to your host and restore the configs from the old folder.</small>
+            <br><br>
+            <button class="ui basic button"  style="float: right;" onclick="parent.hideSideWrapper();"><i class="remove icon"></i> Cancel</button>
+        </div>
+        <script>
+            $(".checkbox").checkbox();
+
+            function getCheckedRadioValue() {
+                var checkedValue = $("input[name='backupmode']:checked").val();
+                return checkedValue;
+            }
+
+
+            function downloadConfig(){
+                let backupMode = getCheckedRadioValue();
+                if (backupMode == "full"){
+                    window.open("/api/conf/export?includeDB=true");
+                }else{
+                    window.open("/api/conf/export");
+                }
+            }
+
+            document.getElementById("uploadForm").addEventListener("submit", function(event) {
+                event.preventDefault(); // Prevent the form from submitting normally
+
+                var fileInput = document.getElementById("fileInput");
+                var file = fileInput.files[0];
+                if (!file) {
+                    alert("Missing file.");
+                    return;
+                }
+
+                var formData = new FormData();
+                formData.append("file", file);
+
+                var xhr = new XMLHttpRequest();
+                xhr.open("POST", "/api/conf/import", true);
+                xhr.onreadystatechange = function() {
+                    if (xhr.readyState === XMLHttpRequest.DONE) {
+                        if (xhr.status === 200) {
+                            parent.msgbox("Config restore succeed. Restart Zoraxy to apply changes.")
+                        } else {
+                            parent.msgbox("Restore failed: " + xhr.responseText, false, 5000);
+                        }
+                    }
+                };
+                xhr.send(formData);
+            });
+        </script>
+    </body>
+</html>

src/web/tools/https.html

@@ -0,0 +1,327 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta name="apple-mobile-web-app-capable" content="yes" />
+        <meta name="viewport" content="user-scalable=no, width=device-width, initial-scale=1, maximum-scale=1"/>
+        <meta charset="UTF-8">
+        <meta name="theme-color" content="#4b75ff">
+        <link rel="icon" type="image/png" href="./favicon.png" />
+        <title>HTTPS Setup Wizard | Zoraxy</title>
+        <link rel="stylesheet" href="../script/semantic/semantic.min.css">
+        <script src="../script/jquery-3.6.0.min.js"></script>
+        <script src="../../script/ao_module.js"></script>
+        <script src="../script/semantic/semantic.min.js"></script>
+        <script src="../script/tablesort.js"></script>
+        <link rel="stylesheet" href="shepherd.js/dist/css/shepherd.css"/>
+        <script src="shepherd.js/dist/js/shepherd.min.js"></script>
+        <link rel="stylesheet" href="../main.css">
+    </head>
+    <body>
+        <br>
+        <div class="ui container">
+            <div class="ui yellow message">
+                This Wizard require both client and server connected to the internet.
+                <br><b>
+                As different deployment methods might involve different network environment, 
+                this wizard is only provided for assistant and the correctness of the setup is not guaranteed.
+                 If you need to verify your TLS/SSL certificate installation is valid, please seek help 
+                 from IT professionals.</b>
+            </div>
+            <div class="ui segment">
+                <h3 class="ui header">
+                    HTTPS (TLS/SSL Certificate) Setup Wizard
+                    <div class="sub header">This tool help you setup https with your domain / subdomain on your Zoraxy host. <br>
+                    Follow the steps below to get started</div>
+                </h3>
+            </div>
+            <div class="ui segment stepContainer" step="1">
+                <h4 class="ui header">
+                    1. Setup Zoraxy to listen to port 80 or 443 and start listening
+                    <div class="sub header">ACME can only works on port 80 (or 80 redirected 443). Please make sure Zoarxy is listening to either one of the ports.</div>
+                </h4>
+                <button class="ui basic green button" onclick="checkStep(1, step1Callback, this);">Check Port Setup</button>
+                <div class="checkResult" style="margin-top: 1em;">
+
+                </div>
+            </div>
+            <div class="ui segment stepContainer" step="2">
+                <h4 class="ui header">
+                    2. If you are under NAT, setup Port Forward and forward external port 80 (<b style="color: rgb(206, 29, 29); font-weight:bolder;">and</b> 443, if you are using 443) to your Zoraxy's LAN IP address port 80 (and 443)
+                    <div class="sub header">If your Zoraxy server IP address starts with 192.168., you are mostly under a NAT router.</div>
+                </h4>
+                <small>The check function below will use public ip to check if port is opened. Make sure your host is reachable from the internet!<br>
+                    <b style="color: rgb(206, 29, 29); font-weight:bolder;">If you are using 443, you still need to forward port 80 for performing 80 to 443 redirect.</b></small><br>
+                <button style="margin-top: 0.6em;" class="ui basic green button" onclick="checkStep(2, step2Callback, this);">Check Internet Reachable</button>
+                <div class="checkResult" style="margin-top: 1em;">
+
+                </div>
+            </div>
+
+            <div class="ui segment stepContainer" step="3">
+                <h4 class="ui header">
+                    3. Point your domain (or sub-domain) to your Zoraxy server public IP address
+                    <div class="sub header">DNS records might takes 5 - 10 minutes to take effect. If checking did not poss the first time, wait for a few minutes and retry.</div>
+                </h4>
+                <div class="ui fluid input">
+                    <input type="text" name="domain" placeholder="Your Domain / DNS name (e.g. dev.example.com)">
+                </div>
+                <br>
+                <button class="ui basic green button" onclick="checkStep(3, step3Callback, this);">Check Domain Reachable</button>
+                <div class="checkResult" style="margin-top: 1em;">
+
+                </div>
+            </div>
+
+            <div class="ui segment stepContainer" step="4">
+                <h4 class="ui header">
+                    4. Request a public CA to assign you a certificate
+                    <div class="sub header">This process might take a few minutes and usually fully automated. If there are any error, you can see Zoraxy STDOUT / log for more information.</div>
+                </h4>
+                <div class="ui form">
+                    <div class="field">
+                        <label>Renewer Email</label>
+                        <div class="ui fluid input">
+                            <input id="caRegisterEmail" type="text" placeholder="webmaster@example.com">
+                        </div>
+                        <small>Your CA might send expire notification to you via this email.</small>
+                    </div>
+                    <div class="field">
+                      <label>Domain(s)</label>
+                      <input id="domainsInput" type="text" placeholder="example.com" onkeyup="checkIfInputDomainIsMultiple();">
+                      <small>If you have more than one domain in a single certificate, enter the domains separated by commas (e.g. s1.dev.example.com,s2.dev.example.com)</small>
+                    </div>
+                    <div class="field multiDomainOnly" style="display:none;">
+                      <label>Matching Rule</label>
+                      <input id="filenameInput" type="text" placeholder="Enter filename (no file extension)">
+                      <small>Matching rule to let Zoraxy pick which certificate to use (Also be used as filename). Usually is the longest common suffix of the entered addresses. (e.g. dev.example.com)</small>
+                    </div>
+                    <div class="field multiDomainOnly" style="display:none;">
+                      <button class="ui basic fluid button" onclick="autoDetectMatchingRules();">Auto Detect Matching Rule</button>
+                    </div>
+                    <div class="field">
+                      <label>Certificate Authority (CA)</label>
+                      <div class="ui selection dropdown" id="ca">
+                        <input type="hidden" name="ca">
+                        <i class="dropdown icon"></i>
+                        <div class="default text">Let's Encrypt</div>
+                        <div class="menu">
+                          <div class="item" data-value="Let's Encrypt">Let's Encrypt</div>
+                          <div class="item" data-value="Buypass">Buypass</div>
+                          <div class="item" data-value="ZeroSSL">ZeroSSL</div>
+                          <!-- <div class="item" data-value="Google">Google</div> -->
+                        </div>
+                      </div>
+                    </div>
+                    <button id="obtainButton" class="ui green basic button" type="submit"><i class="green download icon"></i> Get Certificate</button>
+                </div>
+                <div class="ui green message" id="installSucc" style="display:none;">
+                    <i class="ui check icon"></i> Certificate for this domain has been installed. Visit the TLS/SSL tab for advance operations.
+                </div>
+            </div>
+        <script>
+          $(".dropdown").dropdown();
+          
+            function checkIfInputDomainIsMultiple(){
+                var inputDomains = $("#domainsInput").val();
+                if (inputDomains.includes(",")){
+                    $(".multiDomainOnly").show();
+                }else{
+                    $(".multiDomainOnly").hide();
+                }
+            }
+
+             //Grab the longest common suffix of all domains
+    //not that smart technically
+    function autoDetectMatchingRules(){
+      var domainsString = $("#domainsInput").val();
+      if (!domainsString.includes(",")){
+        return domainsString;
+      }
+
+      let domains = domainsString.split(",");
+
+      //Clean out any spacing between commas
+      for (var i = 0; i < domains.length; i++){
+        domains[i] = domains[i].trim();
+      }
+
+      function getLongestCommonSuffix(strings) {
+        if (strings.length === 0) {
+          return ''; // Return an empty string if the array is empty
+        }
+
+        var sortedStrings = strings.slice().sort(); // Create a sorted copy of the array
+
+        var firstString = sortedStrings[0];
+        var lastString = sortedStrings[sortedStrings.length - 1];
+
+        var suffix = '';
+        var minLength = Math.min(firstString.length, lastString.length);
+
+        for (var i = 0; i < minLength; i++) {
+          if (firstString[firstString.length - 1 - i] !== lastString[lastString.length - 1 - i]) {
+            break; // Stop iterating if characters don't match
+          }
+          suffix = firstString[firstString.length - 1 - i] + suffix;
+        }
+
+        return suffix;
+      }
+
+      let longestSuffix = getLongestCommonSuffix(domains);
+
+      //Check if the suffix is a valid domain
+      if (longestSuffix.substr(0,1) == "."){
+        //Trim off the first dot
+        longestSuffix = longestSuffix.substr(1);
+      }
+
+      if (!longestSuffix.includes(".")){
+        alert("Auto Detect failed: Multiple Domains");
+        return;
+      }
+      $("#filenameInput").val(longestSuffix);
+    }
+
+    $("#obtainButton").click(function() {
+      $("#obtainButton").addClass("loading").addClass("disabled");
+      obtainCertificate();
+    });
+
+    // Obtain certificate from API
+    function obtainCertificate() {
+      var domains = $("#domainsInput").val();
+      var filename = $("#filenameInput").val();
+      var email = $("#caRegisterEmail").val();
+      if (email == ""){
+        alert("ACME renew email is not set")
+        return;
+      }
+      if (filename.trim() == "" && !domains.includes(",")){
+        //Zoraxy filename are the matching name for domains.
+        //Use the same as domains
+        filename = domains;
+      }else if (filename != "" && !domains.includes(",")){
+        //Invalid settings. Force the filename to be same as domain
+        //if there are only 1 domain
+        filename = domains;
+      }else{
+        alert("Filename cannot be empty for certs containing multiple domains.")
+        return;
+      }
+      var ca = $("#ca").dropdown("get value");
+      $.ajax({
+        url: "/api/acme/obtainCert",
+        method: "GET",
+        data: {
+          domains: domains,
+          filename: filename,
+          email: email,
+          ca: ca,
+        },
+        success: function(response) {
+          $("#obtainButton").removeClass("loading").removeClass("disabled");
+          if (response.error) {
+            console.log("Error:", response.error);
+            // Show error message
+            alert(response.error);
+            $("#installSucc").hide();
+          } else {
+            console.log("Certificate installed successfully");
+            // Show success message
+            //alert("Certificate installed successfully");
+            $("#installSucc").show();
+          }
+        },
+        error: function(error) {
+          $("#obtainButton").removeClass("loading").removeClass("disabled");
+          console.log("Failed to renewed certificate:", error);
+        }
+      });
+    }
+
+
+            function step3Callback(resultContainer, data){
+                if (data == true){
+                    $(resultContainer).html(`<div class="ui green message">
+                        <i class="ui check icon"></i> Domain is reachable and seems there is a HTTP server listening. Please move on to the next step.
+                    </div>`);
+                }else{
+                    $(resultContainer).html(`<div class="ui red message">
+                        <i class="ui remove icon"></i> Domain is reachable but there are no HTTP server listening<br>
+                        Make sure you have point to the correct IP address and there are not another proxy server above Zoraxy.
+                    </div>`);
+                }
+            }   
+
+            function step2Callback(resultContainer, data){
+                if (data == true){
+                    $(resultContainer).html(`<div class="ui green message">
+                        <i class="ui check icon"></i> HTTP Server reachable from public IP address. Please move on to the next step.
+                    </div>`);
+                }else{
+                    $(resultContainer).html(`<div class="ui red message">
+                        <i class="ui remove icon"></i> Server unreachable from public IP address<br>
+                        Check if you have correct NAT port forward setup in your home router, firewall and make sure network is reachable from the public internet.
+                    </div>`);
+                }
+            }
+
+            function step1Callback(resultContainer, data){
+                if (data == true){
+                    $(resultContainer).html(`<div class="ui green message">
+                        <i class="ui check icon"></i> Supported listening port. Please move on to the next step.
+                    </div>`);
+                }else{
+                    $(resultContainer).html(`<div class="ui red message">
+                        <i class="ui remove icon"></i> Invalid listening port.<br>
+                        Go to Status tab and change the listening port to 80 or 443
+                    </div>`);
+                }
+            }
+
+            function getStepContainerByNo(stepNo){
+                let targetStepContainer = undefined;
+                $(".stepContainer").each(function(){
+                    if ($(this).attr("step") == stepNo){
+                        let thisContainer = $(this);
+                        targetStepContainer = thisContainer;
+                    }
+                });
+
+                return targetStepContainer;
+            }
+            function checkStep(stepNo, callback, btn){
+                let targetContainer = getStepContainerByNo(stepNo);
+                $(btn).addClass("loading");
+
+                //Load all the inputs 
+                data = {};
+                $(targetContainer).find("input").each(function(){
+                    let key = $(this).attr("name")
+                    if (key != undefined){
+                        data[key] = $(this).val();
+                    }
+                });
+                $.ajax({
+                    url: "/api/acme/wizard?step=" + stepNo,
+                    data: data,
+                    success: function(data){
+                        $(btn).removeClass("loading");
+                        if (data.error != undefined){
+                            $(targetContainer).find(".checkResult").html(`
+                            <div class="ui red message">${data.error}</div>`);
+                        }else{
+                            callback($(targetContainer).find(".checkResult"), data);
+                        }
+                    },
+                    error: function(){
+                        $(btn).removeClass("loading");
+                        $(targetContainer).find(".checkResult").html(`
+                            <div class="ui red message">Server return an Unknown Error</div>`);
+                    }
+                });
+            }
+        </script>
+    </body>
+</html>

src/web/tools/img/arrow-left.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<polygon fill="#FFFFFF" stroke="#231815" stroke-width="3" stroke-miterlimit="10" points="105.518,113.641 20.981,64.833 
+	105.518,16.027 "/>
+</svg>

src/web/tools/img/arrow-right.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<polygon fill="#FFFFFF" stroke="#231815" stroke-width="3" stroke-miterlimit="10" points="20.981,16.026 105.518,64.833 
+	20.981,113.64 "/>
+</svg>

src/web/tools/img/eq.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="48px" height="48px" viewBox="0 0 48 48" enable-background="new 0 0 48 48" xml:space="preserve">
+<path fill="#4f4f4f" d="M13.95,36.15v-24.3h3.3v24.3H13.95z M22.35,44.15V3.85h3.3v40.3H22.35z M5.6,28.15v-8.3h3.25v8.3H5.6z
+	 M30.75,36.15v-24.3h3.3v24.3H30.75z M39.15,28.15v-8.3h3.25v8.3H39.15z"/>
+</svg>

src/web/tools/img/folder.svg

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="128px"
+	 height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<g id="圖層_2">
+	<polygon fill="#DBAC50" points="104.03,38.089 104.03,101.074 22.388,101.074 22.388,27.94 49.702,27.75 55.666,38.345 	"/>
+</g>
+<g id="圖層_3">
+	<polygon fill="#E5BD64" points="104.328,101.97 22.836,101.97 38.209,52.716 118.806,52.716 	"/>
+</g>
+</svg>

src/web/tools/img/icon.svg

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="200px" height="50px" viewBox="0 0 200 50" enable-background="new 0 0 200 50" xml:space="preserve">
+<polygon fill="#DBDCDC" points="18.325,42.875 37.912,6.593 57.5,42.875 "/>
+<polygon fill="#EEEEEF" points="66.771,6.594 94.125,24.744 66.771,42.895 "/>
+<polygon fill="#9E9E9F" points="180.347,6.594 165.384,25 150.421,6.594 "/>
+<polygon fill="#9E9E9F" points="150.422,42.875 165.384,24.469 180.347,42.875 "/>
+<circle fill="#DBDCDC" cx="122.75" cy="25.156" r="17.875"/>
+</svg>

src/web/tools/img/network.svg

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="128px"
+	 height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<g id="圖層_2">
+	<polygon fill="#95D5F4" points="110.998,23.424 110.998,84.064 17.001,84.064 17.001,13.652 48.449,13.469 55.315,23.669 	"/>
+</g>
+<g id="圖層_3">
+	<polygon fill="#6BC2EC" points="110.998,84.064 17.001,84.064 17.087,31.401 110.57,31.401 	"/>
+</g>
+<g id="圖層_4">
+	<rect x="17.001" y="103.51" fill="#B5B5B6" width="93.997" height="4.691"/>
+	<rect x="60.985" y="84.064" fill="#B5B5B6" width="6.029" height="19.445"/>
+	<path fill="#C9CACA" d="M72.935,110.512c0,2.221-1.8,4.02-4.021,4.02h-9.827c-2.221,0-4.021-1.799-4.021-4.02v-9.828
+		c0-2.221,1.8-4.021,4.021-4.021h9.827c2.221,0,4.021,1.801,4.021,4.021V110.512z"/>
+</g>
+</svg>

src/web/tools/img/opr/copy.svg

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_2" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<polygon fill="#FFFFFF" stroke="#9FA0A0" stroke-width="3" stroke-miterlimit="10" points="78.125,32.875 78.125,83.25 
+	30.125,83.25 30.125,22 68.625,22 "/>
+<polyline fill="none" stroke="#9FA0A0" stroke-width="3" stroke-miterlimit="10" points="78.125,35.75 65.125,35.75 65.125,22 "/>
+<line fill="none" stroke="#65D0FF" stroke-width="3" stroke-miterlimit="10" x1="35.75" y1="38.667" x2="60.417" y2="38.667"/>
+<line fill="none" stroke="#65D0FF" stroke-width="3" stroke-miterlimit="10" x1="35.75" y1="45.167" x2="73.25" y2="45.167"/>
+<line fill="none" stroke="#65D0FF" stroke-width="3" stroke-miterlimit="10" x1="35.75" y1="51.25" x2="73.25" y2="51.25"/>
+<line fill="none" stroke="#65D0FF" stroke-width="3" stroke-miterlimit="10" x1="35.75" y1="57.833" x2="73.25" y2="57.833"/>
+<line fill="none" stroke="#65D0FF" stroke-width="3" stroke-miterlimit="10" x1="35.417" y1="64" x2="73.25" y2="64"/>
+<line fill="none" stroke="#65D0FF" stroke-width="3" stroke-miterlimit="10" x1="35.417" y1="70.75" x2="73.25" y2="70.75"/>
+<polygon fill="#FFFFFF" stroke="#9FA0A0" stroke-width="3" stroke-miterlimit="10" points="104.5,57.916 104.5,108.291 
+	56.5,108.291 56.5,47.041 95,47.041 "/>
+<polyline fill="none" stroke="#9FA0A0" stroke-width="3" stroke-miterlimit="10" points="104.5,60.791 91.5,60.791 91.5,47.041 "/>
+<line fill="none" stroke="#2EA7E0" stroke-width="3" stroke-miterlimit="10" x1="62.125" y1="63.708" x2="86.791" y2="63.708"/>
+<line fill="none" stroke="#2EA7E0" stroke-width="3" stroke-miterlimit="10" x1="62.125" y1="70.207" x2="99.625" y2="70.207"/>
+<line fill="none" stroke="#2EA7E0" stroke-width="3" stroke-miterlimit="10" x1="62.125" y1="76.291" x2="99.625" y2="76.291"/>
+<line fill="none" stroke="#2EA7E0" stroke-width="3" stroke-miterlimit="10" x1="62.125" y1="82.875" x2="99.625" y2="82.875"/>
+<line fill="none" stroke="#2EA7E0" stroke-width="3" stroke-miterlimit="10" x1="61.792" y1="89.041" x2="99.625" y2="89.041"/>
+<line fill="none" stroke="#2EA7E0" stroke-width="3" stroke-miterlimit="10" x1="61.792" y1="95.791" x2="99.625" y2="95.791"/>
+</svg>

src/web/tools/img/opr/delete.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<polygon fill="#EC0013" stroke="#C30D23" stroke-miterlimit="10" points="95.338,37.37 88.63,30.662 64,55.292 39.37,30.662 
+	32.662,37.37 57.292,62 32.662,86.63 39.369,93.338 64,68.707 88.63,93.338 95.338,86.631 70.707,62 "/>
+</svg>

src/web/tools/img/opr/download.svg

@@ -0,0 +1,154 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<image display="none" overflow="visible" width="347" height="333" xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgEA3ADcAAD/7AARRHVja3kAAQAEAAAAHgAA/+4AIUFkb2JlAGTAAAAAAQMA
+EAMCAwYAAAyIAAAUNgAAHuH/2wCEABALCwsMCxAMDBAXDw0PFxsUEBAUGx8XFxcXFx8eFxoaGhoX
+Hh4jJSclIx4vLzMzLy9AQEBAQEBAQEBAQEBAQEABEQ8PERMRFRISFRQRFBEUGhQWFhQaJhoaHBoa
+JjAjHh4eHiMwKy4nJycuKzU1MDA1NUBAP0BAQEBAQEBAQEBAQP/CABEIAU0BXwMBIgACEQEDEQH/
+xADAAAEAAgMBAQAAAAAAAAAAAAAAAQQCAwUGBwEBAAIDAQAAAAAAAAAAAAAAAAEDAgQFBhAAAAQD
+BwMEAwEBAQEAAAAAAAECAxEzBCAxEhMUNAUQIRUwQTIGIiM1QCRCJREAAQIDBAgEBgICAwEAAAAA
+AQACMZEyIBEhAxAwcbFyM3OzQVGBEkBhoSKCslDBQlJiEyMEEgABAgQFBAEEAwEBAAAAAAAAAQIQ
+ETFxICGxMnJBUQNzMECBkRJSgoNhIv/aAAwDAQACEQMRAAAA9VSuUuL0pQpslAlAlAlAlAlAlAlA
+lAliJQJQJQJQJQiZQJQJRBlECdmrZZhbpXaWWIU2AAAACCYyZIjIYshiyGLIYshikRExEBGUomJC
+YEAADZr2WY26V2llgFNgAAACCXa3Ybu5y8JzZxgzIwZjBmMGaGDMa613XjlwI6vL5PQxkotEAAAD
+Zr2WY26V2llgFNgJBAAECY7ljRu7vMknPGEiEiEiEiEiNeyDVWuxhl5/Hp8vj9GSKc5CSJETBOzV
+tswt0rtLLEKbBBKlhZj0I58I6Lmk9Jy8Zj2e+pb7XOTE5YgAAAAQkQmDncbreb5m70p586uxemhK
+LqkLqtZwybdO3OLlK7SywCmxRvc23DzWWXT9PwOTj2F1PFw7g4Gr0pl7Dp0rvP3gjIQTGPOwjqR5
+vTVV6t5jp5z1GGVtszEiJg4XhPoHjtvUozeXU0lwVJsyU/UeZ9DwO3b3aN3P27lK7SzwCmxzelzb
+cPPdPmdP1/mYTG3pphAiU+4uU7nF7gYZMM+ThFTn5Y8zVy23e5tZ+M1dLmU6nX9D4f0m1s9acctj
+aRMHH8b7PxnQ5uRG7pAmCYmr6LzvofLels7dO7nb16ldpZ1hTY5vR51uHnunzOn6/wA1A2dMJAn3
+Fync4nbDHKPNek8vp16scrWpr2O5zuj0tnzXM9DytbTo36O+avZzE7nURMS5HjPZeM6PNzg29OCE
+JiYmt6HzvovMemsbtO7m716ldpZ1hTZHO6POtw890+Z0/XeagbWkEgT7i5TucTuBhlHmfTcfXw5O
+7RGhreq3eb73T2dfl91SjUxuUvQ41dqYne6aJg4/jPZ+M6PNyiY3NMCJxmJrei876Ly/pbG7Tu5u
+9epXaWdYU2OZ0+Zbh5/p8zp+u81A3NIRCQn3Fync4nbDHNq2xi81U9ZytOnjZ7NVWvpxt9KzGj6Z
+lubc5ROdqJg4/jfZeN6PNDc04EQEZVvRed9F5j01jdp3c3evUrtLOpExTY5vS5tuHnunzOn67zRE
+7mkiYhIT7i5TucTthjmABGOZGOQlEhMSImDj+M9n4vo83KDc00TEQEZV/Red9F5j01jbp3c3ev0b
+1HOoKbHN6XNtw8/0+Z0/XeaiJjb0gSmJPcXKdzidsTjnCRCRCRCQiREgiYOP4v2ni+jzZG1pwJiJ
+iYyr+i876LzHprG3Vt5u9epXaWdQU2Ob0ubbh5/p8zpev80iY2tIBMSn3Fync4nbTDHOUCUCUCUC
+UCUCYDj+K9r4ro82RtaaJiYCMtHovO+i8x6axt07ubvX6N6jnUFNjm9Lm24ef6XN6XrvNImNrSEz
+MCHt7ngWh0PfvAMcvfvAD37wEH0B8/H0B8/g+gvnw+gvno+hPnhPqvGbdezphfTAmAxnR6Lz3oPM
+elsbtO7m79+jeo2VEKbZ5vS5ttfnuhzHo+J0nMwtq60cfWduOBrifRx5uUekjzkp9HHnsj0DgSd1
+xJR2nHk67lDqOaOi58l+aMyuKkotRoJ3ZaZHoPP+g4vX37tO7n7t+ldpZ1hTYmM7MNs5T3eXhGwa
+8s4hizmWuc5NcbZNM7UNbZMtc5jCcxgzmGE5SYM5Nc5jCcplgzkwnKTXyezx9Hb0btO7n7l+ldpZ
+1hTYyxmzG1Oue1zs51yjNjExmxQzYjNhMspwznFJICRJMRDJgxy2TrGxrJ2zqkznWiNjWNvG6PJ0
+NvHdp3ae1fpXaWdYimyYREoyjKMSMZlCU4yTEiQQ2a7W9q6J3uloaG9LQ3jRG9XnUI4PXlCUoQlA
+lAAhMIbtO6zG/Su0c65gpsAiUIiM4Z4CJAARO3KM+pls7PL1Ni+nW2E62wa42k8LT3uLyOjrk0tk
+RMTAEEygAN2ndbhfo3qOdQU2AAImExGUJxTCQQuUmWPTcxdX03MTHTcwnpuYh03MHS0U0ZJida2A
+mAAAAN2ndbhfo3qOdQU2AAImCcZJxjKEwBAmUTEQEgCCUIShCYJImAEgAAN2ndbh/9oACAECAAEF
+AKkzzomImImImImImImImImImImImImImImImImImImImGTPNqZ1kzIiNCxgUQwqGFQwqGFQwqBo
+WkHC0xNqZ1koxbT+ECGFIwpGFIwpGFIU0hRP0ymlWWJtTO6EaR2PoRd2o4LRBaCWT7OWsi7wMQMG
+QYm1M4ROKmHIEw5DIcBMOkbccHoVrbi3DYdjp3Rp3QpC0Bju7UzgwUXaamStsqFsy8e0NC0QUUFG
+CCnEpGpTFLyVH1p6ZLidCgaJA0aCHJpJJMTqmcKedRGeVeUB2g58w6vClbhqNpglJWWBbLhn1oy/
+D/zAwojhyvxZnVM4U86hl+wO5z5isUZElGI2UmhDjSsbd5XCilwECBkUOV+LM6pnCnnUMv2B3OfM
+xVoihCjSaHSWTruI2EmaulFK6Ku5X4szqmcGJtHK6eznzCkxJ1hUUpcSEtKM20wLpRSuh3cr8WZ1
+TODE2jldPZz5iPXtYopXQ7uV+LM6pnCnnUMr2Hs58/QoZfsFXcp8GJ1TOFPOoZfsPZz5+hQ/D2Cr
+uU+DE6pnCnn0hfjAyHcKIzJdGoz0aholDRKGiUNEoaJQ0aho1CnbU2RRM4BV3K/Bg/21M4U85ioN
+Cdesa9YOvWPIrHkFjXrGvUNeoa9Q16hr1DXKGvWNeshrnBrVmOTOKGC/dUzhTzvYrrEBAQELELHJ
+ymZtTODBwdJ1BkTiIZiBmIGYgE4gJUlRiPSJQzEQzEDMQMxAzEDMQOQdQttibUzxARVAjWMShiUM
+SgWIz475lDpcTxQaJShEyGIxiMYjGIwpURTzamf1M42EoUs6ZnKb63nU06kGkzjZYnVM+2hxaDOu
+eidc8Nc8Nc8Nc8F1TqyMrTE6pn2+8Ch0j1wlbYnf/9oACAEDAAEFAGZcBAQEBAQEBAQEBAQEBAQE
+BAQEBAOl+tmXaxJBKIxEhEhEhEhEgSkgrTstmXZV8VqPFEx3ETETETETCVmRtvEpNl2WzLHYRESE
+Qfcl/O2hRoNpzGgj7RIRIEZB2WzLBwBuoIZiBmoBupCziv0KVaSRmtwzUDNQCUlQclsyw72RVVSk
+L16xrnAVc4EnEuhqIgdQkjJ5Jj26P1SmzKvXHXrBVyzOiOIdlMyw8cG64/zHcFGLfwCjgThxCGUq
+S6UFUz0etcZ4yxYohJ96AOymZYdl13zEQV7fwDlxpMwgoJdbMjTEnOld87jCb+PDspmWHZdd8+hX
+t/ALuNRkaFlB9yJsoM3eld8zvBX8eHZTMsPS66Z0K9v4dHG4molEEtKWbbWDrXfM7wm+hDspmWHp
+ddM6Fe38OsCHaxXfM7wm+gDspmWHpddM6Fe38PQrvmd4TfQB2UzLD0uumdCvb+HoV3zO8J+VAHZT
+MsOy62GOJRBGRKRWoJOubIa5sa5sa5sa5sa9sa5sa5sVDxOGcIQIIIsVAfd6WzLDxfrfpiWrx6I+
+PbBcegeOSPHoHj0Dx6BoEDx6B49A8egaBA8e2CoEGNAgFQoI6NMDelMSw9LPpH16L5vSmJYdIzQb
+SwbaxlrGWsYFjLWDIyBdLwRGZmhYwLGWoZahgUMChSIUlT0piV0gRiCSH4godDIo1hpIox6XBqYD
+6wEBCAdP9bEoQEAQiIiJg1kknHMai6Q7n2DL5KBn26RMRPo7LYlW1oSoipGoFSNDSNDSNDSNBLCU
+nadlsSrfYQ6QEBAdwdp2X//aAAgBAQABBQDlTMqjEoYlDEoYlDEoYlDEoYlDEoYlDEoYlDEoYlDE
+oYlDEoYlDEoYlDEoYlDEoGpQxKGJQxKGJQxKGJQxKGJQxKGJQxKGJQxKGJQxKGJQxKGJQp1KzOW3
+H+U/8tPM5bcf5TtQES9anmctuPUMElRllrGWsZaxlrGWsZaxlrGWsZaxlrGWsGhZDCsYFxNKkn6t
+PM5bcepeKVtJs5aBlJGUgZSBlIGUgZSBlIGUgZSBlIGUgZSBlIjWUiXUqQpCrMbdPM5bceoV1JJh
+07juO/o+6vlVUqXiUg0q9OnmctuLEfQK6kL9IL1VXmYqqVLqVoU2ZGR9I+hTzOW3FiHoEKSQC9U0
+kYwEMBDlEIQyUIejTzOW3Fk+3SIj1O72pC/T68BAcwRaZtRkViPSIiQiKeZy24sRD3LULS/N0I83
+Qg+doB56gB8/xwP7DxxEf2XjCTxz6H6T/Dz77bFEjmaEi8xRguYox5ijHl6MeWox5ajDXIUrysPS
+nmctuLHMPGzREk1GdI/HSVAOjqAdFUg6GqB8fVhzjatRcA2pvi+sREREREYiEREEcRGz9tQpfFt0
+70NM+NO8Mh4ZDwyXQllyKYpOjdN2mFPM5bcWOdMioac4PmZR7CBCBD8h3BQIcXDR9T6LWlBVPMNN
+hzl6pR+TqIt81VIOk5lh8JURpM+xWPsh/wDzk44RER36kfc+58eUKMjFMf7OW3FjntjTl+8yKMC6
+mZgzUCiY4rZ2FuE2mur1PKMzizTuPn42rFQwthfvxXKm2slEoiu6/ZP5yY2k3+9Af/GKY/2ctuLH
+PbCnnHfZSOL2ZdTHL1WEoQNV/Awx9hzsNWLj4SsU/TpKBdfsn88rSbz+XH7QU0zltxY57YU8477J
+Di9n1O6vUa6gzgZmQ4E4uGOcL/rMGfbhHjbrU3dfsn88j6xEREJvO+g2gppnLbixz2wp5x32DBDi
+9n1X8Xo5xin406hPG8e7TKHI8U9UvVfHqoyVhhxkfIFd1+yfzytJvO+g2gppnLbmxz2wp5x32DBD
+i9n1V3KrbNFRH8qaqXTO076HmxW1iKZqoqHKh5R9uHZUuuTd1+y/zk2k3nfx+zFNM5bc2Oe2FPOO
++wYIcXs7HMU5g7496CuOmccqEIar6xVU4R9oDgqRSGiu6/Zf5yb7Kbzv4/ZimmctubHPbGnnHfZI
+cVsuph1tLqa6iXTuwKKuxqqnlNGQ9+M4xT7jaCQlN3X7L/OTfZK/34/ZimmctubHPbGnnHfa4rZd
+T6OspdKp4ZRByhqUnpnoo46qWqi4MiUhtDZArH2b+cm+yV/vx+zFNM5bc9D6c7saaed9ritlbNJG
+MtuJJSCIhAuhWPs385N9krzFBtBTTOW3PQ+nO7Gmnnfa4rZenC19m/nJvsleYoNoKaZy25Oxz2xp
+px32uK2X+H7L/OTaK8xQbQU0zltydjntjTTjvtcVsv8AD9l/nJtFeYoNoKaZy+5sc7smJx32uK2X
++H7L/NTdZK8xQbQU0zltzY53ZU8477XFbL/D9l/mpusleYoNoKaZy25sc7sqecd9rijLR9hEhEhE
+hERESERERERERIRIRIRIYiH2Yy8anuVlN5ig2YppnLbmxzuyp5x39IGIGIGEkoJqaxCdfyA1/IDX
+8gNfyBDyHIDyHIDyHIDyHIEPI8gD5LkB5LkB5DkDHkOQHkeQHkeQHkeQHkeQDlRVukgoFZTed9Bs
+xTTOW3NjnNjTqwvG6gZiBmtjPaGc0M9oalgHVMDUsDUsDUMA6hgZ7Iz2RnNg3mxnNjObGc2DdbGa
+gZiBmIGYgZiBjQMaBiSMSRiIYiGMglZR96HaCmmctubHOROhguJk5GDgMlg0uhWYFKcBm6P3R/aP
+2j9gLMEHAROj9oInTGFwETgg4CJwQcBE4MLgwrGFYJDgwODAsYHBBwElccKwSVxwrhQx0gppnL7m
+w2lKlGy3DJaGS0MhkadkadoaVgaanGmpxpqcaanGnpxp6cadgadgZFONPTjT0401ONNTjT0409ON
+OwNOyNOwNOwNOwNOwNOwNOyNOyNO0MhoEw0MhsVaCS+KaZy+5sMfMiKMCECsQETETETBGYjaj07D
+t1jY7CAgO/Uu59o1pmdSKaZy+5sM9l+kX+cgQrIakU0zl9zYQZJVmtwzEQzUDMQM1AzEDNQM1oZr
+QzWgTrQzWgbzRBMFEdiPU1pSRPsmWcyM9kZ7Iz2RnsjPZGeyM9kZ7I1DAKpYIO1jKSUo1mKaZy25
+smRGO4/IRMRMRMRMdx3EFD8h+Q7gn3UlqHo6l4al4al4al4al4ah8KddUnuO47juO47iKhFQiYiY
+/IRMQ79KaZy256x6mkHZ79buhXppyw6cacacacachpyB05kFsmSPUiPcU0zltz0OyZeiZnGjYN5z
+KTHKSYykjKSMpIykjKSMpJDJSZVLJsOF29almctuRG2ZA7UIimp11C2mEspgQgUIEIEIEIEIEIEI
+EKilS+l1lTCrERH0KWZy25P0YW6euJps+V7+UIeUIeUIeUIeUIeUIeUIeUIeUIeUiKupS836tLM5
+fc+hC2fWHpd4F2LpH0qWZy+59I/RP/PSzOX3Po9+nYdh2t9vQ7juO/qUsz//2gAIAQICBj8Afy+g
+qVKlYeP2N1H8sUxJNXMzaptcbXG1xtd+Da78E1TImmLx+xuo/liS42lDNEKIUQohQoK1Uqd24vH7
+G6j+Uc1MlKiXGz7fBJSUzNcHj9jdR/KCSSZNGm0oJ/5Wo2fb4U/VptNqm1TM8fsbqP5QYndRZpQz
+yKncVOyxzhJMH7OqThMRU/nI8fsbqP5QZyFuJBbDrwmTJqKjSTormVgonsPH7G6j+UGXFvFR3KDO
+yrmIiCIoriWJRPYeP2N1H8oMuLeKjuQhPsT7E+wqJjUT2Hj9jdR/KDLn3io7lCRkmRKRNcaiew8f
+sbqP5QZc+8VHcsFPgUT2Hj9jdR/KDLi3io7l8KxUT2Hj9jdR/KDOQt4qO5fCsVE9h4/Y3Ufyh4+Q
+ufUrOEpyFX9jchuQ3IbkNyG5DchuM4VFE9h4/Y3Ufyh4+QuSLn1NrUNqG1DYhsQ2IbGm1psabENr
+Ta02obUNrSStbmJzPH7G6j+UPHygn0DOZ4/Y3UfygxVoimTkKoVKlSqEkWa4FXsTmhVCqFUKoVQY
+jVmqOPH7G6nk5QrIycZuNxuNxuUe5yrkhlC4+XYkqqVUqpVSqlVh4/Y3U8nLBQoUhJtVM9y1jmKi
+0VBVRMp5GeLx+xup5OXwTb1Ez2lSpUqSXrkZ4vH7G6nk5fNOePx+xup//9oACAEDAgY/AG2+lfxX
+QbbHUqVQqhVCqFUJTzM8T+LtBtsSi3KlSpUqVJ9ifXE/i7QbaGeBRb/BNCcjNMD+LtBtoZkplZG5
+DJZi/Cs1NxuQ3IZD+DtBtoKvYyMsyh2Ed3jnGcf1amRKRQlKpn/GY7i7QbaDrGaGUEuNtGZNRUb0
+P0dFIVEzP6DuLtBtoOtgS422Fzk6qMl94pFD+g7g7QbaDrYEuNtgzP1QT/kUih/mO4O0G2g6wlop
+cbaM0jOsUih/mO4O0G2g6wlopcbbDkZxSKH+Y7g7QbaDrCWilxtvhSKH+Y7g7QbaDrCWilxtvhSK
+H9B3B2g20HWKFIIqiJJTNFKKUUopRSilFKKZRS5/UdwdoNtB1iqpl0M3uNzjJ7jepm9Tc43KblNz
+jc43ONym9xucblJoq5GX8R3B2g20HWPt9C7iP4O0G2g5E6oUKFChQoZpgl1KFChQoUFVySmg/g7Q
+bbBQoZIdPwJQSUq4Gqvc6HT8FEKIdPwdPxB/B2g22GkZuoLllPA1U6CJ1xv4O0G2+CTihQoUKE0x
+v4O0G2+SpX4H8HaH/9oACAEBAQY/AG3G77BvcomaiZqJmomaiZqJmomaiZqJmomaiZqJmomaiZqJ
+momaiZqJmomaiZqJmomaiZqJmomaiZqJmomaiZqJmomaiZqJmomaiZqJmomaiZqJmomaiZqJmjia
+Mz9HJvAN7v4s8GZ+jk3gG938WeDM/RybwDe7W3rBpxUFBQUFBQUFBQUFBQUFAr7sNuuPBmfo5N4B
+vdrmm4KAVIVIVIVIVIVIVIVIVIVIVIVIVIX24OCLXRGtPBmfo5N4BvdrSm68oloucIr2uwu1h4Mz
+9HJvAN7taU3X3rBXtH3L2uENWeDM/RybwDe7WlN+C94GKBHjqjwZn6OTeAb3a3am/BEH5oai7x0H
+gzP0cm8A3usknBoiUWF3uPneqvqqvqqvqqvqq1X9Ufuxu81l5uXi1w/r4J2Y+AvQvP1Ufqqvqqvq
+o/VRUVcHXHwV59DoPBmfo5N4BvdZcWYFxAPqgB9znHFUKhctctctctcoi9ZLHC4gf0PgnhovOKoV
+KpVKpVKxFwV4NxBWW5xxu0HgzP0cm8A3us4/7BMu80cVFRUVBQWJWXstXuNyLcse9ywdcPJXh5vV
+7j7x5INcfY8+CvGItPu8joioqKioqKO1ZZ+Wg8GZ+jk3gG91m/8A5BMPzCNmKxN6ZsslzsAIr2Nw
+AOg+xvuIXLXtcPaVeMCE3IzaSYlXjEWXjzvUbZ2rLHy0O6eZ+jk3gG91n8gmbQjbZss/9DTVHYvn
+ozFBC7y0X+Pgv+p5vzGR2eFl3rqDtWXs0Hp5nbcm8A3us/kEzaEbeXssuN8CQr1eVmXaBsUFh4oZ
+d+D42XeuoO1ZezQenmdtybwDe6z+QTNoRt5eywVmX/7HQHMeAR4FOc9wIdC7QMxjw0XXXFfe8OJ8
+Ar2rJIjehYd66g7Vl7NB6eZ23JvAN7rP5BM2hG3l7LLx5m9YL3A/Z/kEHtgdBe70RzXm/wD1CJ8T
+BZbv9Y2X+uoKy9mg9PM7bk3gG91n8gmbQjby9lkZzYwdsV/ksYFBjjflORzCRcBferyf/MUhX+UF
+gjnOFzn/ANWX+upy9mg9PM7bk3gG91k8QTNoRt5eyy7LeMCFfd9hhovQyi4+wQCvMl/S97x/5/Ne
+1ouAsu9UdRl7NB6eZ23JvAN7rP5BM2hG3l7LXtcLwi7Iw+Suc03jyV3tdJXNaR8yg/8A+jEj/HwX
+taLmiCuGFl3qjqMvZod08ztuTeAb3WfyCZtRt5ezUQV/tChqH+uo9Vl7NDunmdtybwDe6z+QTNqN
+vL2fBP2HUeqy9mh3TzO25N4BvdZ/IJm1G3l7Pgneuo9Vl7NB6eZ23JvAN7rP5BM2o28vZ8E711Hq
+svZoPTzO25N4BvdZ/IJm3UZez4J3rqPVZezQenmdtybwDe6z+QTNuoy9nwTvXUeqy9mg9PM7bk3g
+G91n8gmbbZvEll3eX9KOiKjpjYioqKioqKin+MYLD66jL2aD08ztuTeAb3WfyCZttkefirmZrmhs
+Bfguc6ZXOdMrnOmVznTK5rplc50yuc6ZXNdMrmvmVzXTK5rplc50yuc6ZXOdMrnOmVznTK5zplFm
+Zmuc0+ZWOoy9mg9PM7bk3gG91k8QTSYKpVKpVKtVhcwLmBcwLmBVqtVrB6rCqCqVSqVSqVSqVSqV
+SqUVFRUdJKy9mh3Tze25N4BvdZIAJPuEEPtdIql0iqXSKpdIql0iqXyKpfIql8iqXyKpfIql8iqX
+yKpfIql8iqXyKpfIql8iqXyKpdIql0iqXSKpdIql0iqXSKpdIql0iqXSKpdIqDpFQdIql0iqXSKp
+dIql0ij9rpFZYOFw0Hp5vbcm8A3us+1w9wONxV4Y2QVDZBUNkFQJKgSWLGyC5bZBctsguW2QXLbI
+LltkFy2yC5bZBUNkFQ2QVDZBctsguW2QXLbIKhsguW2QXLbIKhsgqGyC5bZBctslQ2QVDZBUNkFQ
+2QVDZBUNkFQ2SobIK72tuPyCc0YBpuu0O6eb23JvAN7rMVHTBQ1nmoKChpgoavDE+CefnDQ7p5vb
+cm8A3u/iAsy6F+h3Tze25N4BvdZvKiAoqKioqKiqwqwqgqgqgqgrwcF5273G5VhVhVhVhVhVhVhV
+hVhVhVhX+8K8Ovw8EXGJ0Hp5vbcm8A3utQtwULGKubC1FYL715KIUQohRCiFEKIUVFRWJw0YHQen
+m9tybwDe74IDzWIULWEFePBY62/Qenm9tybwDe74G/wQdd9gxQ+SvtlvmnAj7fBY+Oud083tuTeA
+b3fAgNFzfEr2Dw8dF2oIMfAotfj5HXO6eb23JvAN7vgQ1rbj4lXXYeagoKCgoKCgoKCuuu8kBdj5
+653Tze25N4Bvd8bdfrndPN7bk3gG938W7p5vbcm8A3u/i3dPN7bl/9k=" transform="matrix(0.3272 0 0 0.3272 5.9824 3.0469)">
+</image>
+<rect x="19.833" y="28.5" fill="#322912" width="92.667" height="52.5"/>
+<rect x="19.833" y="81" fill="#DCDDDD" width="92.667" height="10.667"/>
+<rect x="50.167" y="101.167" fill="#DCDDDD" width="32.5" height="3.666"/>
+<rect x="59.833" y="91.667" fill="#C9CACA" width="13.5" height="9.5"/>
+<rect x="23.333" y="31.667" fill="#00A0E9" width="85.833" height="46"/>
+<polyline fill="none" stroke="#FFFFFF" stroke-width="8" stroke-miterlimit="10" points="55.591,51.929 66.042,63.104 
+	77.577,51.929 "/>
+<line fill="none" stroke="#FFFFFF" stroke-width="8" stroke-miterlimit="10" x1="66.042" y1="63.104" x2="66.043" y2="28.5"/>
+</svg>

src/web/tools/img/opr/new_folder.svg

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<rect x="26.2" y="17.403" fill="#F5D370" width="71.08" height="88.553"/>
+<g>
+	<g>
+		<polygon fill="#FFE79C" points="59.98,72.606 59.98,22.099 26.2,17.403 26.2,105.956 49.486,109.192 49.486,76.212 		"/>
+	</g>
+</g>
+<polygon fill="#FFFFFF" stroke="#727171" stroke-miterlimit="10" points="109.001,90.244 94.813,90.244 94.813,76.057 
+	87.313,76.057 87.313,90.244 73.126,90.244 73.126,97.744 87.313,97.744 87.313,111.932 94.813,111.932 94.813,97.744 
+	109.001,97.744 "/>
+</svg>

src/web/tools/img/opr/open.svg

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<g id="圖層_2">
+	<g>
+		<polygon fill="#FADA79" points="104.029,38.089 104.029,101.074 22.388,101.074 22.388,27.94 49.702,27.75 55.666,38.345 		"/>
+	</g>
+</g>
+<g id="圖層_3">
+	<g>
+		<polygon fill="#FFE79E" points="104.328,101.971 22.836,101.971 38.209,52.716 118.807,52.716 		"/>
+	</g>
+</g>
+</svg>

src/web/tools/img/opr/paste.svg

@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<image display="none" overflow="visible" width="256" height="256" xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgEAnQCdAAD/7AARRHVja3kAAQAEAAAAHgAA/+4AIUFkb2JlAGTAAAAAAQMA
+EAMCAwYAAAYmAAAKUwAAEen/2wCEABALCwsMCxAMDBAXDw0PFxsUEBAUGx8XFxcXFx8eFxoaGhoX
+Hh4jJSclIx4vLzMzLy9AQEBAQEBAQEBAQEBAQEABEQ8PERMRFRISFRQRFBEUGhQWFhQaJhoaHBoa
+JjAjHh4eHiMwKy4nJycuKzU1MDA1NUBAP0BAQEBAQEBAQEBAQP/CABEIAQEBAQMBIgACEQEDEQH/
+xADHAAEAAgMBAQAAAAAAAAAAAAAAAQQDBQcGAgEBAAMBAQAAAAAAAAAAAAAAAAEDBAIFEAAAAwUG
+BQUBAQEBAAAAAAAAAQURAgMEFBAgMDE0FRMzNQYWQCESMgdEUCIXEQAABAEEDggDBwQDAQAAAAAA
+AQIDBBGxcnMgMCExkcESMrLSM5M0NRDwUYGh0ZKiQGFxQSJS4hMjo2KCwgVQ4RQkEgABAgQGAQUB
+AQAAAAAAAAAAATEQIDCBQBGhsTKCIVBRkcESAiL/2gAMAwEAAhEDEQAAAPLYK+AvvY3qLPAPfoeA
+n3yXm595kvr5+6AOfugDn+u6l57mfBvfRTZ4J70eCe257Zxca9ZzsGvGwa8bBrxsGvHrFMafHkxw
+6x8/Xz52pExyfH3EtDj9V9+nl8k9aPJPWjydn0epq7tRMedpEGbl/T+X66ao10gAAAegBp8eTHDq
+8T8+dqDkBHz9rOccZCcUZkMGO0iUTFfSJiGXl/UOX7Kao10gAAAegBp8eTHDq/z9fPm6ggAgFynt
+7efhtGunVtoNXG1GqbUazQ+xdR4p7WOo47ou38tNEAAD0ANPjyY4dX+fr583UIhMAES2+o299exG
+6gAAAADBgs/ZxzSdx5QaUAHoAafHkxw6v8ffx5uoOZAEDb6jb317IbqAAAAAMf3GIzUcuI5Np+0c
+vNOD0ANPjyY4dW+fr583UI5mUABt9Rt7+NkN2cAAAAAACNfsaxwgHoAafHkxw6t8ffx5msOQhMwD
+cafcX17Ib8+PDaSqrRFVaFVaFVaFVaGHMRKncpnCwegBp8eTHDq3x9fHmaw5kAhBudNudFeyG/Pj
+w2kqq0RVWhVWhVWhVWhhzESp3KZwsHoAafHkxw6r8fePy9cwcyAITO50u50VbNDfnljwStqhFtUF
+tUFtUFtUFtgzRM07dQ4WD0ANPjyY4dU+PvH5WyUOZAEE7nS7rRXsh6GY+MErSqRaVRaVRaVRaVRa
+YssSqW6hwsHoAafHkxw6pj+8flbJg5kIEEzudLutNWzQ9DNKBKBKBKBKBKBKBNO3UOGA9ADT4c1c
+6jl5bky3dOcwRPT3MB0+OYjp244z02zj1Qvr+MNlKsskVlkVlkVlkVlkYspEqluocMB6AGnr2K4A
+AAA6ly3qR6sHxhspVlkississississjHkIlUt1DhoPQA09exXAAAAHUuW9RPVoEoEoEoEoEoEoE
+oE1bNU4cD0ANPXsVwAAAB1Hl1k7k4gO3uIDt7iA7e4gO3uIDt7iA7e4gO3uIDt9XjQpg9ADT1wAA
+AAAAAAAAAAAAA9AD/9oACAECAAEFAAcwQqCFQVx974u1LoqXRDiE/fPJ7MFnbMcuyUvnk9nZxog4
+0QcaIHor7xWSmV48ns7YDpPP8GGODDHBhjgww6467fPJ7O2W5mGeT2dstzMM8ns7ZXmYZ5PZ2yvM
+DTDTDTDTDTDTunk9nbK8yxpBpBpBpBpXTyeztleYPYew9h7D2HtdPJ/O2U5gYGGGGGGGGGHdPJ/O
+2U5uIcqRnSEKQhRuiFLlDeDTDTDTDTDTDTxWkGkGkGkGl/sf/9oACAEDAAEFABwzHDHDuOk0+EY4
+Rh5w3b5Z3of2sjXyzt+Do+Do+DoJ10rY18s7kQzJ35vD5vD5vD5vA3jO+WZXIv1wyzK5F+uGWZXI
+v1wyzK5F+oYQYQYQYQYQYV0syuRfrYwwwwwwwww7pZlcjfWz3HuPce497pZllbG+oaGkGkGkGkGl
+dLMsrY30xCjDjDjDjB+J8iDAwgwgwgwgwsX3HuPce49/9j//2gAIAQEAAQUAnl5ccnfIF4eQLw8g
+Xh5AvDyBeHkC8HF5ffedku9XnaDvcUHe4oO9xQd7ig73FB3uFCe7nTovkC8PIF4eQLw8gXh5AvDy
+BeHkC8PIF4eQLw8gXh5AvDyBeHkC8PIF4eQLw8gXhvCuFDXuum+8j9qJsGT2Ht8bD2+Nh7eGw9vD
+ZO33BKqCW5K7okjdEkbokjdEkbokglNJM1CAlT6zsXbw2Pt4bH28Nj7eE72ukTUtMQXpePhqGvlt
+QWluRibBeTPnLbQNoG0DaBtAhpLH5SBwVe5LcxUNs/hqGvltQWluP+7sCT+UrQCgFAKAUAKRYceH
+8Fq5LcxT12Goa+W1BaW6b8w6RxJ8cVRHFUxxVUcVWHFVw5AmXpm5LcxT12Goa+W1BaX0MtzFPXYa
+hr5bUFpcCSkKpzZSGykNlIbIQ2QhshDZCGxkHEb4PR/zZMjxf/MEkH+YJRF3L2vMIcbAUNfLagtL
+gI3KxFCUgzDnc3bMdFj31DXy2oLS4CNysSZda7PSMCbl+5O25hFmLyhr5bUFpcBG5WJHL/gia6oJ
+8vOS/cnbkwizF1Q18tqC0uAjcrEjfR3IyaFFOl52X7i7dmUWZuKGvltR/LgI3JxHnfkRwXjD0tEM
+HLTBCdkXZ2X7i7emUWZtUNfLaj+XARuT6AyIwtyErNplqhr5bUfy4CLyfQqRkSfaoa+W1H8uAi8m
+yNCdjO7fBG3wRt8EbfBG3wRt8EbfBG3wRt8EbfBG3wRBlocF6xX6Xaoa+W1H8uAi8n0Kv0u1Q18t
+qP5cBF5NkaI9Ddq4wq4wq4wq4wq4wq4wq4wq4wq4wq4wq4wgxokR6xX6Xaoa+W1B6bAReT6FX6Xa
+oa+W1B6bAROT6FX6Xaoa+W1B6bAROTZFhlFcoXBQuChcFC4KFwULgoXBQuChcFC4KFwQZZ2E9Yr9
+LtUNfLag9NgInI9CrdLtUNfLah7TYCJyLIsQ4blY+Kx8Vj4rHxWPisfFY+Kx8Vj4rHxWPiDGei2q
+3S7VDXy2oe02Aicj0Kt0y1Q18tqHtNgInI9CrdMtUNfCf+ESQnZRQkeHDIcOGOHDHDhjhwxw4Y4c
+McOGEYiKDZFhlFcoXBQuChcFC4KFwULgoXBQuChcFC4KFwQYBQbVbplqhrxCmY8EHPzpiunBXTgr
+pwV04K6cFdOCunB+eRIkVC9CrdMtUNfhfnHQLIsQ4blW+Kt8Vb4q3xVvirfFW+Kt8Vb4q3xVviDG
+eiWqvTLVDX4X5z0D0Kr0y1Q1+F+c9A9Cq9MtUNfhfnXQPQqnTLVDX4X510Bhhhhhhhhhhhhhhhhh
+hhhhhhhhhhhhhhhhhUI9stUNfhQFGfl4e8Ko3hVG8Ko3hVG8Ko3hVG8Ko3hVG8Ko3hVG8Ko3hVG8
+Ko3hVG8Ko3hVG8KoNXVHitUNf/gf/9oACAECAgY/ABtRtRtZP0NqNqeJ1LJBJFit/qdSyR5KclOS
+mSrmkVv9TqWTaTL+kz8HFDihxQ4of5TKdSybSdVqKWTaTqtRSybSdVqKWTaTqtRSybSdVgwwwww0
+qlk2k6rFxxxx5VLJtJ1WopZNpOq1XHHHP0ntlhGGGGG9Y//aAAgBAwIGPwAcfQfSTIfQfSjeZI/F
+NhhjNEj8VPHuOOOOeVzqXwN8DfA3wN4uOOOPSvFhhhhqV8DfA5YRxxxx/WP/2gAIAQEBBj8AiEp/
+2UUlKXVklJPuERESjuF94czi9+5rDmcXv3NYczi9+5rDmcXv3NYczi9+5rDmcXv3NYEgv9nFyqMi
+L/6HL5/3AlJ/2MSZHeMn3zmIcwid/EeQ5hE7+I8hzCJ38R5DmETv4jyHMInfxHkOYRO/iPIJaiP9
+lFZSilKSIdxmQ5nF79zWHM4vfuaw5nF79zWHM4vfuaw5nF79zWHM4vfuaw5nF79zWHM4vfuaw5nF
+79zWHM4vfuaw5nF79zWHM4vfuaw5nF79zWHM4vfuaw5nF79zWHM4vfuaw46I3y9YRNc5pGCSV9Rk
+RfUwh6NT+o44X2kSj7iURkQ4b2Nao4b2Nao4b2Nao4b2Naoyyh5DTdI8hv7Lv4QzlLSUqbl0bROE
+bROEbROEbROEbROESE4mU/mDJ1BOoSSpZEpVd/vIxw38bWqOG/ja1Rw38bWqOG/ja1QsoVv9N1JG
+ZFkpSfcaCILZVdNByS2yJrnNIw1TTOIehjsXC7UmXgIa5eRjF4XheF4Xgk5PtKcPF+LKPwsToqmD
+x/MpitkTXOaRhqmmcQ9DHYmXyMM3JZEjN8Bm+AzfAZvgM3wBHkhXzJVidFUxh36lMVsia5zSMNU0
+ziHoY7IktOqSRfZlHJ4C48fqV5i497l+YuPl6l+Y25epfmNun1L8xt04V+YKIiFpUZEZfdluy9pq
+sToqmMO/UpitkTXOaRhqmmcQ9DH8EdFUxh36lMVsia5zSMNU0ziHoY7SpWXkZJySSS4yG29v5htv
+b+Ybb2/mG29v5htvb+Ybb2/mG29v5htj9P8A2MonrshldT23PxBTq4t8lKvkWRJ2fhHFxHs1RL/6
+4j2aoy0mb0Es5EPSXSP8K5LTE1zmkYappnEPQx2lykU1tVDvoJxl0slSTvXQbjcrkE4f7a/tQf4V
+WiJrnNIw1TTOIehjtLlIprbL2BTL6CW04Uikn8wakka4Nw/2nOz+lXzs4muc0jDVNM4h6GO0uUim
+txF8guHiEE404UikmJSlcg3D/ad7P6VfOyia5zSMNU0ziHoY7S5SKa3F9OhbD6CW04UhkYMjI1wq
+z/ad/wAVfOxia5zSMNU0ziHoY7S5SKa2yDOPCLi1YTH3VqwmFwsa2TrSykOUrv1ISHKuFcP9l3/F
+XzsImuc0jDVNM4h6GO0uUim+BuiJafQSkfpqOTsMilIysImuc0jDVNM4h6GO0uUim+CiTO8TS5rC
+JrnNIw1TTOIehjtLlIpunJUZkV+4M5WEvIZysJeQzlYS8hnKwl5DOVhLyGcrCXkM5WEvIZysJeQz
+lYS8hnKwl5DOVhLyBqSZmZlJdk8umLqlzWETXOaRhqmmcQ9DHaXKRTfBRdUuawia5zSMNU0ziHoY
+7S5SxdOUlBrPsLqY4dXjqjh1eOqOHV46o4dXjqjh1eOqOHV46o4dXjqjh1eOqOHV46o4dXjqjh1e
+OqDJTRtkRSynL5F0xdUuawia5zSMNU0ziHoY7S5SxfBRdUuawia5zSMNU0ziGoY7S5SxfBRdUuaw
+ia5zSMNU0ziHoY7S5SxdOQZmRX5SGeoZ6hnqGeoZ6hnqGeoZ6hnqGeoZ6hlEozlKS70xdUuawia5
+zSMNU0ziGoY7S5SxfBRdUuawia5zSMNU0ziGoY7S5SxdOUSTUfYQ2KuvcNirr3DYq69w2KuvcNir
+r3DYq69w2KuvcNirr3DYq69w2KuvcNirr3A5UGiTt6YuqXNYRNc5pGGqaZxDUMdpcpYvgouqXNYR
+Nc5pGGqaZxD0MdpcpYvgouqXNYRNc5pGELv5KiPAcoZUh1KFoKT7xyENuzvCHEM7whxDO8IcQzvC
+HEM7whxDO8IcQzvCHEM7wg4RKSssq+g8or3b05BmZfMhnqGeoZ6hnqGeoZ6hnqGeoZ6hnqGeoHIo
+zl7emLqlzWETXOaR9B/pOKRLfyTkF19fqMbZeExtl4TG2XhMbZeExtl4TG2XhMbZeEwpTijUr9VV
+07p/BRdUuawia5zSO1nXK6cokmr5ENirr3DYq69w2KuvcNirr3DYq69w2KuvcNirr3DYq69w2Kuv
+cNirr3DYq69wOVBok7emLqlzWETXOaR2s65XwUXVLmsImuc0jtZ1yvgouqXMdhE1zmkdrOuX8FF1
+K5rCJrnNI7WdcoXheF4XheF4XheF4XheF4XheF4XheEXUrmsImuc0jtf6TEQ403LLkpUZFKf0HGP
+esxxj3rMcY96zHGPesxxj3rMcY96zHGPesxxj3rMcY96zHGPesxxj3rMcY96zHGPesxxj3rMcY96
+zHGPesxxj3rMGRxbpkdwyNZ2ETXOaR/8D//Z" transform="matrix(0.459 0 0 0.459 5.25 4.5)">
+</image>
+<path fill="#D0B065" stroke="#B28247" stroke-width="2" stroke-miterlimit="10" d="M81.61,90.593c0,0.923-0.748,1.671-1.671,1.671
+	H24.671c-0.923,0-1.672-0.748-1.672-1.671V20.698c0-0.924,0.749-1.672,1.672-1.672h55.268c0.923,0,1.671,0.749,1.671,1.672V90.593z"
+	/>
+<rect x="41.492" y="18.085" fill="#DCDDDD" stroke="#9FA0A0" stroke-width="2" stroke-miterlimit="10" width="22.985" height="10.552"/>
+<polygon fill="#FFFFFF" stroke="#9FA0A0" stroke-width="3" stroke-miterlimit="10" points="105.714,53.116 105.714,106.334 
+	55.004,106.334 55.004,41.627 95.679,41.627 "/>
+<polyline fill="none" stroke="#9FA0A0" stroke-width="3" stroke-miterlimit="10" points="105.714,56.153 91.98,56.153 91.98,41.627 
+	"/>
+<line fill="none" stroke="#DCDDDD" stroke-width="3" stroke-miterlimit="10" x1="60.947" y1="59.234" x2="87.006" y2="59.234"/>
+<line fill="none" stroke="#DCDDDD" stroke-width="3" stroke-miterlimit="10" x1="60.947" y1="66.101" x2="100.563" y2="66.101"/>
+<line fill="none" stroke="#DCDDDD" stroke-width="3" stroke-miterlimit="10" x1="60.947" y1="72.527" x2="100.563" y2="72.527"/>
+<line fill="none" stroke="#DCDDDD" stroke-width="3" stroke-miterlimit="10" x1="60.947" y1="79.484" x2="100.563" y2="79.484"/>
+<line fill="none" stroke="#DCDDDD" stroke-width="3" stroke-miterlimit="10" x1="60.595" y1="85.998" x2="100.563" y2="85.998"/>
+<line fill="none" stroke="#DCDDDD" stroke-width="3" stroke-miterlimit="10" x1="60.595" y1="93.129" x2="100.563" y2="93.129"/>
+</svg>

src/web/tools/img/opr/share.svg

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<circle fill="#24CC29" cx="84.5" cy="42.833" r="13.833"/>
+<circle fill="#24CC29" cx="36.5" cy="67.334" r="13.833"/>
+<circle fill="#24CC29" cx="84.5" cy="92.167" r="13.833"/>
+<line fill="none" stroke="#24CC29" stroke-width="9" stroke-miterlimit="10" x1="36.5" y1="67.334" x2="84.5" y2="42.833"/>
+<line fill="none" stroke="#24CC29" stroke-width="9" stroke-miterlimit="10" x1="36.5" y1="67.334" x2="84.5" y2="92.166"/>
+</svg>

src/web/tools/img/opr/upload.svg

@@ -0,0 +1,171 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<g>
+	<circle fill="#86D1EF" cx="37.667" cy="71.896" r="25.083"/>
+	<circle fill="#86D1EF" cx="64.917" cy="58.895" r="36.249"/>
+	<circle fill="#86D1EF" cx="94.999" cy="76.729" r="20.417"/>
+	<path fill="#86D1EF" d="M96.416,95.146c0,1.104-0.777,2-1.738,2H37.156c-0.961,0-1.739-0.896-1.739-2v-31c0-1.106,0.778-2,1.739-2
+		h57.521c0.961,0,1.738,0.895,1.738,2V95.146z"/>
+</g>
+<image display="none" overflow="visible" width="512" height="512" xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgEBSwFLAAD/7AARRHVja3kAAQAEAAAAHgAA/+4AIUFkb2JlAGTAAAAAAQMA
+EAMCAwYAAAujAAASFQAAIhL/2wCEABALCwsMCxAMDBAXDw0PFxsUEBAUGx8XFxcXFx8eFxoaGhoX
+Hh4jJSclIx4vLzMzLy9AQEBAQEBAQEBAQEBAQEABEQ8PERMRFRISFRQRFBEUGhQWFhQaJhoaHBoa
+JjAjHh4eHiMwKy4nJycuKzU1MDA1NUBAP0BAQEBAQEBAQEBAQP/CABEIAgMCAwMBIgACEQEDEQH/
+xADbAAEBAQADAQEAAAAAAAAAAAAABQYCAwQBBwEBAAMBAQEAAAAAAAAAAAAAAAMEBQECBhAAAAUB
+BwMEAgICAwAAAAAAAQIDBAUAIDBARAYWNhARFFAxEhMyM3AhIjQjQxURAAECAgEPCAkDAwMFAQAA
+AAEAAgMEESBAITFBcZFy0pOzxDVGhhAwUYESIkIzUGBhocEyUhMjsdFikhQ04YJTorLCYxVFEgAB
+AQMJBgQGAgMAAAAAAAABAgARISAwMUFRcZEiAxBAYRIykoGhQlJwscHRchPhI2KCov/aAAwDAQAC
+EQMRAAAAjx/ZDKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCeKCe
+KCeKCeKCeKCeKCeKCeKCeKCeKCeKCeN08olw7kMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2AJcO5
+DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANgCXDuQwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYAlw7
+kMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2AJcO5DAAAAAAAAAAAB6e88y9SnrY/nu/RNXwfPcvUe
+H4bt1+fdX6N1+Pf5620+KfMqU6Cz8Hn2AAAAAAAAAABsAS4dyGAAAAAAAAACt68SrGj9V7Nn0C3R
+DvgAAAAB0d53PQd/xq3fztp85R0usRzAAAAAAAAAbAEuHchgAAAAAAADv9Ovs0/DVNHID14AAAAA
+AAAAdHedx0r9Gz9DUzL78paIAAAAAAAGwBLh3IYAAAAAAAr/ADX26HzkaOSDgAAAAAAAAAAAEjJf
+okmpoY99+Z2sAAAAAABsAS4dyGAAAAAAKHl3Fip28zUxQcAAAAAAAAAAAAAAh5X9GylHTiCjpgAA
+AAAbAEuHchgAAAAAqevFqwbGAHqMAAAAAA50/EslZ8HO+USQgAAAAAOvsO4LzbDH5O6ENgAAAADY
+Alw7kMAAAAA+7nNbG/lhdzQAAAAAHc0sNl3GdrBzsGZsYN7NmC1RAAAAAAYray4LWNGVuAAAAAbA
+EuHchgAAAB6dHLB30zVww9eAAAAAHc0sNl3GdrBzoAEGZsYN7NmC1RAAAAAfPp3BebQ57H3wjmAA
+AA2AJcO5DAAB29516GlSv5fDmXM8HAAAAAHd800Nl3GdrBzoAAAEGZsYF7Nmi1RAAAAAn4n9E/Pq
+GrwFLRAAAA2AJcO5DAByOzaddDTxgs0gAAAAAAL9Ly+rL3AjkAdHHxzQer1S+3vmg+fYbIcOPJ1k
+OPo8+tgh3yAAAAxG3y9a7BGZsgAAAbAEuHchgDTxtvcz/o0MkAAAAAAAC5VyN+jp+841rvLxePyW
+afvHrwBz98nxc7pnR31brr4wJYPJ8NLIBwAAABw5nc3B/QuipewCvIoagefYAGwBLh3IYPV3mnq/
+Puz86HrwAAAAAAAABz+cTr2+L2+PfvFa6B1x7Eeeq7OtLCADgAAAAAADO6J4l/OWkzeVuBHKBsAS
+4dyGNFndpZp0hp4oAAAAAAAAAAD2+L2+JPeK10Drj2I89UJYAAAAAAAAAAGP2HRFYwDs68jeA2AJ
+cO5DPv6Bgv0K9mBezAAAAAAAAAAAHt8Xt8Se8VroHXHsR56oSwAAAAAAAAAAAZnP7vCZm0Fa5sAS
+4dyGejffn/6BoZQXM4AAAAAAAAAAB7fF7fEnvFa6B1x7EeeqEsAAAAAAAAAAADCbvJVb0YZuxsAS
+4dyGcv0L873l3O9Qv5QAAAAAAAAAAD2ePnz3ZceVS6DvTJ9njsUwkiAAAAAAAAAAAZrS52C1mxlb
+mwBLh3IY1mTrz1teNXCAAAAAAAAAAAA7fbNeZKnm8jnQ9xg4AAAAAAAAAAAzWlyFe5IGXtbAEuHc
+hjlxH6B3ZrS7Hz4SQgAAAAAAAAAAAAAAAAAAAAAAAAAfMHr8PR1Ao6WwBLh3IYBz3ODo2Km1ceWp
+ig4AAAAAAAAAAAAAAAAAAAAAAAAPJz1n4nLjj/QB4k2AJcO5DAALup/Ob13O1D59v5YOAAAAAAAA
+AAAAAAAAAAAAAAD478xfsh52sFS+BsAS4dyGAAAVdX+f91mn+gIlrQyfo9xgAAAAAAAAAAAAAAAA
+AAADxc9evLeLw5+qFS+ABsAS4dyGAAAAPT5neaWvg1mn+i/cD6562zZTn7j1DLnNQy41DLjUMuNQ
+y41DLjUMuNQy41DLjUMuNQy41DLjUMuNQy41DLjUMuNQynm562c7IdUNixI+Kt4PHsAADYAlw7kM
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2AJcO5DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANgCXDuQ
+wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYAlw7kMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2AJcO5
+DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANgDVeUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKQP/9oA
+CAECAAEFAP4xABEStFTUDEa8EleCShY0ZmqFGIYuIIQxxTZFCilKULQgAgozIalETpjhEGxlKIQp
+AuhABBdp2wbZt8r9y2+WBbIfYbAO0L8hBOYhAIW2dQhKKsmYbYh3pdL6z3rJP+raywJgIiI03cd7
+hyn807xJBRSiFApbSywJgIiI9W7jvcLE+ClyACIoNAC4XWBMBERGy3X723xf8rls3AgXCoiKnQif
+ejJB26e1FHuWy8L3SuGaPcblwiIG7URAQL0FD5lEBAUUTHG0Id6VZlNRyGINkoCIkIBC3XYKU/Do
+j7dgG6USKoVVIyZrDQvyVvFPw6I+12ukChBDtYYheqfh0R9rx2n8VOrH8bxT8OiPtePS90+rEf7v
+DB3L0SL2LeOv09Wx/iremIU1AkUL52PZGwip9ieLfH/uw2W+s2KMYCgocTnstnPbFOl/kNtF0YlE
+UIcMKYwFBd0JroBEBI8ULRXpK8tGvLRry0a8tGvLRry0a8tGvLRry0a8tGvLRry0a8tGvLRry0a8
+tGvLRoXiQUd8YaOoc4/yX//aAAgBAwABBQD+MTGKUDvkC0aTChklK/8ASUosnRJBA1EUIcMOooRM
+FpEw0c5zjaARAUpBUlIuE1Qwjl4VKlFDqGugEQFs/wC+DePPhfs3gkwLxz9RR/vAMXN+ocCEVUMo
+e2miopR26pAtgIgLVf7U72RW7jbbNhVEpQKFOmvxuGS31q3izlJKlDic9ps2FUSlAodXTX43DdT7
+ErkRAAcvxGhHvbbNxVEpQKFl01+NuNP3Lce1PHQqjcIFAqXRRXtRFh79BDuBw7Gsx5wKtcSDj4hc
+tHBRL3ClXQCfoVz9ZimAwLuCpltAIgKMgctJqEULZMYClUOJz3XcaR/Po4/IBELpFY6RkViqksPz
+/FC8R/Po4/K7bLiioAgIdZMb1H8+jj8rxgr80usn+V4j+fRx+V5HH7K9ZMv+N4Q3xN0WMAmvGX+x
+1eJ/NC9KqYtGWOIXrAvdew4SFJXFxqf9WHjf7SYopRMZFME07Lxn8sUxa/ALblkVSlElExwpSGOL
+ViBLoxSmBSPRNRo1QK8BxXgOK8BxXgOK8BxXgOK8BxXgOK8BxXgOK8BxXgOK8BxXgOK8BxXgOK8B
+xQR640nGlCk0iJh/Jf8A/9oACAEBAAEFANXTMw31HuCercE9W4J6twT1bgnq3BPVuCercE9W4J6t
+wT1bgnq3BPVuCercE9W4J6twT1bgnq3BPVuCercE9W4J6twT1bgnq3BPVuCercE9W4J6twT1bgnq
+3BPVuCercE9W4J6twT1bgnq3BPVuCercE9W4J6twT1bgnq3BPVuCercE9W4J6twT1bgnq3BPVuCe
+rcE9W4J6twT1bgnq3BPVuCercE9W4J6twT1bgnq3BPVuCercE9W4J6v/AFJPxNa8o9fyeteUev5P
+WvKPX8nrXlHr+T1ryj1/J615R6/k9a8o9fyeteUev5PWvKPX8nrXlGMIkqpRYyRNQQsoNDCSoUaJ
+ky0do6Tx2T1ryjENo186pvpRwakdNRidJR7FGva0o3QWpaBilqX0mkNOYCTb0YpijiMnrXlGFKQx
+zMtMvF6aQcc1v3LJq6K80qQadMnTM+GyeteUYSO087d0zjmjIuCUTTVJIaYTPS7ddsphMnrXlGCa
+M3DxWMgGzMMM7ZNnicpAuGWEyeteUYGKh15A7Rm3ZpYgQAQl9OlPRiiUcDk9a8owENCHemTTIkTF
+zMIm9KomdI+AyeteUX8JDGenKUpC42ahiPkzkMQ1/k9a8ovoiLPILpJppJ4/UEOC5L/J615RetWy
+rtdkzSZN/QdQxXjKX2T1ryi90/GA1b+hLopuEpBmdk6vcnrXlF5Ax3mu8AiiqudKAVMB9Pl7Oo5y
+1wOoI7y2t7k9a8ouwATDFMgZMr9q1VdKtWqTVLoIAISkYKI3/vU4x8N7eZPWvKLvTrLyX1+1aqul
+WjRJqlYEAEJOMFAb/UDLyWN5k9a8ou4BkLRjfNWqrpVo0SapWhABCTjBQG+MUDFkWwtXt3k9a8ou
+Wce7enjtNoNjXzVqq6VaNEmqVwIAIScYKA32qm3Y93k9a8otkIY5ozTXek0k0iXzVqq6VaNEmqV0
+IAIScYKA3s43++Nu8nrXlFps1WdLRcMgwLftm6jlVo0SapXggAhKRvjjeKEA6ayf1rXWT1ryiy1a
+rO1o2NQj0cBCNwI3tKuikEr3+ymKYLKqZVU1UxTUvJtL6pO6yeteUWE0zqqREWSPQwMYICxsuXPb
+qguZIxTFMWzICAvbzVLQ5XF1k9a8osabi/rJgoNyBk7Cz4gnsJuRbgkqRYnVyuVBE5xOe8WRSXTf
+aWEKXbrNz3GT1ryjrEMBfPClKUuCSVOiozlkFygIDR1E0wkJgBLHf2Nhx+lhIKMzt3rdwWl3bduW
+QkDvDX7pm3dpykAuzuMnrXlHXT7EGrLClWWIBlDn6RvvYcfpoBEB8hfsIiI4EQAQmoABAQEBs5PW
+vKOkY1F29AAAMRG+9hx+nDz8MAhZyeteUdNKNu5sTG+9hx+nDiACE9F+GvYyeteUdIBD6YzExvvY
+cfpxD1om8bLonQW65PWvKKAO4tU/rbYmN97Dj9OJ1Qy+KnXJ615RTcvzXxUb72HH6cTKNgdMRAQH
+pk9a8oph/b3FRvvYcfpxUoh47/pk9a8opkPxd4qN97Dj9OK1Ql8H/TJ615RSY/FQhvmTExxgA9h0
+YCoYrVhQ+fTJ615R0i1fuj8SioKShDlOXq/XAw4rVn49MnrXlHTS7j7GWKQcKIiR+iYBfNwBd+Y4
+YvVh/wDk6ZPWvKOmm3X0v/WdTK/OR6ZPWvKOiahklGbkrpt6uIgASC/kPemT1ryjrpd/8TerzDoG
+sf1yeteUdUlToqRz0j5r6tqZ99znrk9a8osQ0mZg5Icpy+qSb4jFoc5lD9cnrXlFmBmfHEBAQ9SO
+cqZJiSM/c2MnrXlFqEnvpoBAweoCIAE9M+Sazk9a8otxU6syFs6QdJenKKETJMzxnNvJ615RcNXj
+hopH6lbrUUxTl9LfyzRiWRl3T81vJ615RdNJF4zFpqog03k2LmgEB9GMcpAdT0c2p7qR44oxjGG4
+yeteUXqT96jSeopQlF1U+Ct1ua3Y5rdjmt2Oa3Y5rdjmt2Oa3Y5rdjmt2Oa3Y5rdjmt2Oa3Y5rdj
+mt2Oa3Y5rdjmt2Oa3Y5rdjmt2Oa3Y5rdjmt2Oa3Y5rdjmt2Oa3Y5rdjmt2Oa3Y5rdbmjaqfDSuoJ
+RSlXLhcbvJ615R6/k9a8o9fyeteUev5PWvKPX8nrXlHr+T1ryj1/J615R6/k9a8o9fyeteUev5PW
+vKPX8nKf7/r/AP1f/9oACAECAgY/APhi4Ak8Go5fyaK8A0VKbqU0F4hoOVcfuzlApv3hyQ8s/UPN
+wFDOSAm6W4h44s9OQ+TZhC0UbrzKyo8zczkhwm3EPBYq06K0/bc+dfTULZ8rQM1Yt3F6ulPnw3H9
+iR+Q+s+EiksEiqYzFzOCo4TDixFRiJ46hrgJhwios8xJ2BCzGo2zBdSmInYBwtNDBI9IdLcIqLPM
+SZAQsxqNswpPGF004RewVqRPtq8Zhwios8xJlBC6ajbLSq0OwmuZXWfKZUTbtepsu17A2gSn+0vm
+f2KoHTfNFaQ8GnYVrhYNpUnqHmziHMIOTWZbiz0ZTZU3KoOMoAUkuYJFQm6GO03tGa5VC42NynwN
+skH2h86dpvnCPUIpZxkLNwnTtN87zChcfGuQu8Tp2m+dB9qvnIWngDOkbY1zqvD5yE/5ZcZ6LW3z
+x4kCSFV0G/fEo/2Mlx6VU/feyo0Bio1yghZh6T9N65EnKKTbMcqsyfMM9Jfuz1FwYpRBNZrM08Fx
+4Nmcv5tFKh5tScGpODUnBqTg1Jwak4NScGpODUnBqTg1Jwak4NScGpODUnBqTg1JwaHMfBsiXcTF
+nqJPxM//2gAIAQMCBj8A+GL1EJFpg3UV/iGy6eJaCEebRQjzbNp4KaPMi8fZnoUFXHeOZagkM7SH
+KPcacGetRUeMt4JBtDOX/YPPFshj7TTuvKnMvyF7cyzzGbBBcRWGCNaBqX99zOnpnN6jZ/M+NPUO
+So+3+Nx5U9aqOAtZ53AaKz+B+k+VqoSHsVqpVMZEk8amepJdaIzDxUwPqEFXzw0hVmV9Jh5ggU8e
+AYABwGw6mmIeoWTAf0ryn6TuYvV7RSylmlRfLeYIFJt4BgAHASDqaYhWLJhCq3ON4miSXAMU6UB7
+qzczzLeYIFPHgwADgJR1EDL6hZLWiw82My9uRB/rH/UygD2g47XJxZyoja4soCokSnH1pd4zP6km
+Kuq6yaGmsuKYB9YZ7DT0y+1X22hKuk+TPBBHBiAXrqH3lvEGdqZ02+puZBeJRUaEh5ZSzSovm3PY
+bRc0C6a5km8VFgpPiLDJI95CZ0bRdOA+kwUODPFcjTT+RnRtF07ymnTh4VSNP8TOjaLp0p9yflI0
+1WEjGdB2wqhOo8flIU6lOYeE84GHFnUXTwPtBMlSKqU3b4vUNeUfWS9PWijjw3sJSHlRcGSgekec
+o6umI+pNvEb1+xYzHpFgmCpGRfkb2ctJHy3blSComoMF6mZVQqE05QChYWel+meEQ2VSVXwahPc3
+SO4N0juDdI7g3SO4N0juDdI7g3SO4N0juDdI7g3SO4N0juDdI7g3SO4N0juDdI7g3SO4NHlT4s/U
+WVcEwZyEhPxM/9oACAEBAQY/AJ6DLz8zBhMc0Mhw4z2tb3Gmw1rqFtObz8TKW05vPxMpbTm8/Eyl
+tObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TK
+W05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxM
+pbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/E
+yltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8
+TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vP
+xMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8/EyltObz8TKW05vPxMpbTm8
+/Eyl2v7yP2v/AIX36fuvp+7/AHPY+5b+bs2Kban8dujZ6gcPa2p/Hbo2eoHD2tqfx26NnqBw9ran
+8dujZ6gcPa2p/Hbo2eoHD2tqfx26NnqBw9ran8dujZ6gcPa2p/Hbo2eoHD2tqfx26NnqBw9ran8d
+ujZXv42Ofign9FYlYvWxw/UL/Gf7v3X+M73furMrE6mk/ovyQYjMZjh+or7h7W1P47dGyuR9iC5z
+T4iKG/1GgIGYjNhj6WAuPvoVLw+Mf5uoH/TQvxy8Np6eyKcKsVVEWGyJjNDv1VmAGHpYS33CwqZa
+O5v8YgDveKET9v7rR4oZ7Xut+5FrgWuFsGwa54e1tT+O3RsrYNYC5xsAAUkoOmCJdhuGy/BcQLYX
+3HjxxO8cFrn+zMQmxOgkWReNtF0lE7J/44lkdTguxMQyzoPhN42q34e1tT+O3RsrURI34IJukd4j
+2NQECGA67ENlxvmsyyI0PYbbXCkIxJF3Yd/xO+U3jcRhR2FjxcPwrXh7W1P47dGysxCl2F7rpuAd
+JKESLRGmLfaI7rcUfGt/tzDA8XDdF4oxYVMWX+ofM3GFacPa2p/Hbo2Vl2vkgNPeiH9G+1CFAb2W
+3TdcekmuaDZBTpiRFD7boNw4qLXCgiwQay4e1tT+O3RsrER44LZYHrf7B7E2HDaGsaKGtFoV4Y0A
+BkyMD7/tRhxGlr2mhzTbBrHh7W1P47dGysBHjAiWaf6z0BBjAGtaKABaAr4xoIDZlosfzHQUWPHZ
+c00EG4aw4e1tT+O3Rs5+g92AyzEd8B7SmwobQ1jBQ1ouD0AZuXb+Zo/I0eIdN+sOHtbU/jt0bOeZ
+AhClzzReF0psCELDfmddcbp9Bf3cEfhiHvgeFx/fn+HtbU/jt0bOe/uIg/PGFNnwtuDr9BvgxBSx
+4oIT4D7QNLT0tuHnuHtbU/jt0bOdD3imDB7z/abjaxDITS5xuBUxooYfpaO177C7kY0+1v8AqqXt
+7TPrbZFY/ehimNBsjpLbo57h7W1P47dGznA0WSbATIVHfPeiH+R/asBDhi+bgCEOGMZ10nlIIpBt
+hGPBFMI/M36awoKd2R+KL32ddsc7w9ran8dujZzgiOFMOB3jfuVgIcMXzcAQhwxZ8TrpNSQRSDbC
+MaCKYRtj6awc9opiQe829dHO8Pa2p/Hbo2c40vFESN33Xrg58Q4Yvm4AhDhiz4nXSasgikG2EY0E
+UwjbH08+WmyCKCFFg3A6lt42uc4e1tT+O3Rs5rswGFwuutNHWmxZl33ogshvhB+PPiHDF83AEIcM
+WfE66TzJBFINsIxoIphG2Pp5+FNAW+47qtc5w9ran8dujZzAawFzjYAFtCNPWBbEIW/9yEOE0MYL
+TQKBz4hwxfNwBCHDFnxOuk82QRSDbCMaCKYRtj6eeigClzB2x1c5w9ran8dujZVtgwW9p7vd7Sg8
+0RJg23m57G1gIUO2bZ6AhDhiz4nXSedIIpBthfehD8RNkfSedcw2nAjCnwz4XEYDzfD2tqfx26Nl
+U2DBbS52ADpKDGCmIfniXSf2rExiO9EPuFX2WjtG70LvNsdIQc00g1TobhSHCgp0M22kjnY4FgOP
+aHXzfD2tqfx26NlS2HDHae40ADpVBoMd9mI74CsoNHRZqixhs3Ty9LTbCDmmkGqjUWu0edZNAUse
+Oy49BHN8Pa2p/Hbo2VP99GHfd5QNwfVWbpdx7zTS28al0GEaXN+ZwueypLjZYLYQiQz2mutGodFc
+aA0WL6c823Ek9fOuhRWh7HWwUXyT6f8A1v8AgUYcZhY4XCOZ4e1tT+O3RsqGwz5be9EPsCDWihoF
+AA6BWYiQzQ5tooNiEQ4t0G0bysGldp7g0C6SjClTbsOifsn1L7y+qEfmb+yphvFN1psEcnaivA6B
+dKoHdhN+VvxNYGHHYHi4bovFGLApiwLv1Nv8xw9ran8dujZUCI4flj9517witqGxHNHQCQu+4uvm
+nkf1VL73JSLBVH3X0dHaKpJpPSayoNkJ01JNoNt8Ifq1UG3VcPa2p/Hbo2csKD4SaXYoslACwBYA
+rl/VUvvVwZyVbZFmKwf9wquHtbU/jt0bOWNMkWgGN67Jrp/VUvvVxQbINtfehD8EU0j+Luip4e1t
+T+O3Rs5YXTEpeeux8K6f1VL71cvgPFhwsHoNwp8F4ocwkGo4e1tT+O3Rs5AOlQof0saMArp/VUvv
+V0ycYLD+6+/cNRw9ran8dujZyQ29LgPfXb+qpferqLCu9mlt8WUQbYt8vD2tqfx26NnJAx2/rXb+
+qpferuNDuBxIvGzy8Pa2p/Hbo2ckE9D2/rXb+qpfertr/wDkYPdY5eHtbU/jt0bORruggprhacAc
+NdOb0ixUvPSKK7l33aCOXh7W1P47dGzll4lvuAf0934V0Hi5bvIOaaQaj7TTYHzX67l755eHtbU/
+jt0bOV8E24Tvc6u+7ZbdaV3qWnCvmpvBdmGOyOm7Xkuz2E+/l4e1tT+O3Rs5ftONDYw7PXbHprsC
+1DaBh5eHtbU/jt0bOVsRpocwgg3lDjttPFJ9huj0wSbQtqNFuOcaLwscvD2tqfx26NlQ6SiGw7vQ
+790emIr6aHOHZbfNRw9ran8dujZUNiwzQ9hBBvJkdts2Ht6HXfS7ZVhpZB+bGNRw9ran8dujZU94
+0wIliIPig9hpa4Ugi6D6VfFJ75sMHS4pz3mlzjST7TUcPa2p/Hbo2VQlJl34XfI4+E9F5Ui16TL3
+mhrRSSehEt8lliGPjU8Pa2p/Hbo2VbZWbdTDtMiHw+w+xBzTSDZBHpGk2ALZRlZY/hae+4eI/tVc
+Pa2p/Hbo2cwIUWmJL9F1t5CLAeHtPRbF/wBHl8Rwa1tkk2kZeVJbAtOfdf8A6VfD2tqfx26NnMiJ
+AeWG6LhvhCHNj7MT6vAf2QcwhzTaIs+jPyO7US5DbZJVDz2IQ+WGLXX08xw9ran8dujZzdMCIQPo
+NluBBs3CLT9bLIwIfajNJPhJoOAqkWfQ1LiGjpNhEfc+68eFln32kWQB9hhuiy7Ci5xLnG2TZPM8
+Pa2p/Hbo2c9+KM9o6KSRgKsxA/GaPhQu9Dhm9SF5LMJXkMwleQzCV5DMJXkMwleQzCV5DMJXkMwl
+eQzCV5DMJXkMwleQzCV5DMJXkMwleQzCV5DMJXkMwleQzCV5DMJXkMwleQzCV5DMJXkMwleQzCV5
+DMJXkMwleQzCV5DMJXkMwleQzCV5DMJXkMwleQzCV3YcNt8ErzQwfxAH60qmNFc/GJI5zh7W1P47
+dGz1A4e1tT+O3Rs9QOHtbU/jt0bPUDh7W1P47dGz1A4e1tT+O3Rs9QOHtbU/jt0bPUDh7W1P47dG
+z1A4e1tT+O3Rs9QOHtbU/jt0bPUDh7W1P47dGz1A4e1tRti2x/l+faHmLd5bvLd5bvLd5bvLd5bv
+Ld5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvL
+d5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5bvLd5f/AJX+H/t8zQf+
+S//Z" transform="matrix(0.2174 0 0 0.2174 8.354 3.207)">
+</image>
+<polyline fill="none" stroke="#FFFFFF" stroke-width="10" stroke-miterlimit="10" points="78.459,66.957 64.917,52.479 
+	49.973,66.957 "/>
+<line fill="none" stroke="#FFFFFF" stroke-width="10" stroke-miterlimit="10" x1="64.917" y1="52.479" x2="64.917" y2="97.313"/>
+</svg>

src/web/tools/img/wifi.svg

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="128px" height="128px" viewBox="0 0 128 128" enable-background="new 0 0 128 128" xml:space="preserve">
+<circle fill="#231815" stroke="#231815" stroke-miterlimit="10" cx="64" cy="98.551" r="8.801"/>
+<path fill="none" stroke="#231815" stroke-width="14" stroke-miterlimit="10" d="M10.296,49.66
+	c29.139-29.141,76.297-29.141,105.436,0"/>
+<path fill="none" stroke="#231815" stroke-width="14" stroke-miterlimit="10" d="M28.269,65.352
+	c19.917-19.917,52.152-19.917,72.068,0"/>
+<path fill="none" stroke="#231815" stroke-width="14" stroke-miterlimit="10" d="M45.548,81.838
+	c10.367-10.367,27.145-10.367,37.509,0"/>
+</svg>