release: v1.1.11

Updated badge descriptions and added new badges for supported features.

.github/FUNDING.yml

@@ -0,0 +1,15 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+polar: # Replace with a single Polar username
+buy_me_a_coffee: mengmengcode
+thanks_dev: # Replace with a single thanks.dev username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/workflows/pages.yml

@@ -0,0 +1,65 @@
+name: Deploy Docs
+
+on:
+  push:
+    branches:
+      - main
+      - master
+    paths:
+      - "docs/**"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: github-pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build VitePress
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: docs/package-lock.json
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v5
+
+      - name: Install dependencies
+        working-directory: docs
+        run: npm ci
+
+      - name: Build docs
+        working-directory: docs
+        env:
+          VITEPRESS_BASE: /
+        run: npm run build
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs/.vitepress/dist
+
+  deploy:
+    name: Deploy GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.gitignore

@@ -58,9 +58,12 @@ backend/tmp/
 *.swp
 *.swo
 *~
+.claude/
 
 # OS
 .DS_Store
 Thumbs.db
 linux.txt
 push-release.ps1
+deploy.ps1
+backend/clicd

LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -10,13 +10,42 @@
   <img alt="TypeScript" src="https://img.shields.io/badge/TypeScript-5-3178C6?style=flat-square&logo=typescript&logoColor=white">
   <img alt="Vite" src="https://img.shields.io/badge/Vite-5-646CFF?style=flat-square&logo=vite&logoColor=white">
   <img alt="Tailwind CSS" src="https://img.shields.io/badge/Tailwind_CSS-3-06B6D4?style=flat-square&logo=tailwindcss&logoColor=white">
-  <img alt="LXC" src="https://img.shields.io/badge/LXC-container-111111?style=flat-square">
+  <img alt="LXC" src="https://img.shields.io/badge/LXC-Supported-111111?style=flat-square">
+  <img alt="KVM" src="https://img.shields.io/badge/KVM-Supported-EE0000?style=flat-square">
 </p>
 
-CLICD 是一个面向 LXC 的轻量容器管理面板，提供 Web 控制台、CLI、批量任务、镜像管理、NAT 端口、IPv6 分配、WebSSH、资源限制、流量限制和安全告警能力。它适合用来管理小型 VPS 上的 LXC 容器，也适合需要批量创建和分发子用户管理链接的场景。
+<p align="center">
+  <img alt="WebSSH" src="https://img.shields.io/badge/WebSSH-Built--in-009688?style=flat-square">
+  <img alt="VNC" src="https://img.shields.io/badge/VNC-Supported-7B1FA2?style=flat-square">
+  <img alt="IPv6" src="https://img.shields.io/badge/IPv6-Native-1976D2?style=flat-square">
+  <img alt="NAT" src="https://img.shields.io/badge/NAT-Port_Forwarding-FF9800?style=flat-square">
+  <img alt="REST API" src="https://img.shields.io/badge/API-REST-4CAF50?style=flat-square">
+  <img alt="Multi User" src="https://img.shields.io/badge/Multi_User-Supported-8E24AA?style=flat-square">
+  <img alt="Traffic Control" src="https://img.shields.io/badge/Traffic-Control-795548?style=flat-square">
+  <img alt="Security Alert" src="https://img.shields.io/badge/Security-Alert-orange?style=flat-square">
+  <img alt="CLI" src="https://img.shields.io/badge/CLI-Mode-424242?style=flat-square">
+  <img alt="TLS" src="https://img.shields.io/badge/TLS-Let's_Encrypt-003A70?style=flat-square&logo=letsencrypt&logoColor=white">
+</p>
 
-## 功能介绍
+CLICD is a lightweight virtualization management panel for LXC and KVM, featuring a web console, CLI management, batch operations, image management, NAT networking, IPv6 allocation, WebSSH, VNC access, resource controls, bandwidth limiting, and security alerting.
+It is designed for managing LXC containers and KVM virtual machines on VPS servers, and is particularly suitable for environments that require bulk provisioning and delegated access management through sub-user management links.
 
+CLICD 是一个面向 LXC/KVM 的轻量虚拟化管理面板，提供 Web 控制台、CLI、批量任务、镜像管理、NAT 端口、IPv6 分配、WebSSH、VNC、资源限制、流量限制和安全告警能力。它适合用来管理小型 VPS 上的 LXC 容器和 KVM 虚拟机，也适合需要批量创建和分发子用户管理链接的场景。
+
+## Features / 功能介绍
+
+### English
+1. Supports Ubuntu, Debian, Alpine, CentOS, Arch Linux, Fedora, Rocky Linux, and other operating system images. Images can be downloaded on demand through the image management interface. For hosts with limited resources, lightweight distributions such as Alpine are recommended.
+2. Supports WebSSH management, allowing users to access container terminals directly from the browser without manually copying SSH credentials.
+3. Supports NAT4 port quotas, port forwarding, and protocol restrictions, as well as public IPv6 allocation. IPv6 assignment requires the host machine to have a routable IPv6 prefix.
+4. Supports both inbound and outbound traffic limits. Containers are automatically powered off when configured limits are reached, preventing bandwidth overuse.
+5. Supports container expiration dates. Expired containers are automatically shut down, and delegated users lose access until an administrator extends the expiration period.
+6. Includes lightweight conntrack-based security monitoring. The system does not store full logs of normal connections, but generates audit alerts for suspicious activities such as port scanning, lateral scanning, brute-force attempts, SMTP abuse, UDP reflection attacks, cryptocurrency mining ports, and proxy/VPN/Tor usage.
+7. Supports delegated management links. Administrators can assign specific containers to sub-users, while ensuring that each user can only manage the containers explicitly authorized to them.
+8. Provides a REST API for automating the management of containers, tasks, images, networking, traffic controls, and security alerts.
+9. Supports operating entirely through the CLI. When the web console is not required, administrators can stop and disable the systemd service and launch CLI-only mode using `clicd cli --no-web`.
+
+### 中文
 1. 支持 Ubuntu、Debian、Alpine、CentOS、Arch Linux、Fedora、Rocky Linux 等系统镜像。镜像可以在镜像管理中按需下载；如果宿主机资源比较小，建议优先选择 Alpine 这类轻量镜像。
 2. 支持 WebSSH 管理，可以在浏览器里一键进入容器终端，不需要手动复制 SSH 密码。
 3. 支持设置 NAT4 端口数量、NAT 端口映射和协议限制，并支持分配公网 IPv6。IPv6 分配要求宿主机本身拥有可路由的 IPv6 地址段。
@@ -27,22 +56,22 @@ CLICD 是一个面向 LXC 的轻量容器管理面板，提供 Web 控制台、C
 8. 支持 API 接入，可以通过 API 完成容器、任务、镜像、端口、流量、安全告警等功能的自动化控制。
 9. 支持仅使用 CLI 管理。需要关闭 Web 控制台时，可以停止并禁用 systemd 服务，然后使用 `clicd cli --no-web` 进入命令行模式。
 
-## 技术栈
+## Technology Stack / 技术栈
 
-- Backend: Go, net/http, LXC, cgroup v2, iptables, conntrack
+- Backend: Go, net/http, LXC, KVM/libvirt, cgroup v2, iptables, conntrack
 - Frontend: React, TypeScript, Vite, Tailwind CSS, lucide-react, xterm.js
-- Runtime: Linux, systemd, LXC
+- Runtime: Linux, systemd, LXC, KVM/QEMU
 - Build: GitHub Actions, Node.js 20, Go 1.22
 
-## 安装
+## Installation / 安装
 
-一键安装：
+One-click Install / 一键安装：
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh
 ```
 
-一键卸载：
+One-click Uninstall / 一键卸载：
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh -s -- uninstall
@@ -52,6 +81,28 @@ curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh
 ![alt text](/img/image-1.png)
 ![alt text](/img/image-2.png)
 
+
+## Disclaimer/免责声明
+
+This open-source software does not distribute Windows system images, nor does it provide any means to bypass or circumvent Windows activation mechanisms.
+
+All download links provided within the software point to resources officially supplied by Microsoft. Users of this software are responsible for obtaining the appropriate licenses from Microsoft before using any Windows operating system downloaded through these links. This project does not bypass activation requirements for installed systems, nor does it assume any responsibility for the consequences of users' actions when using this software.
+
+This open-source software is intended solely for educational purposes, specifically for learning the principles of LXC and KVM. The copyright for the Windows logo and related icons belongs to Microsoft/Windows.
+
+本开源软件不提供任何 Windows 操作系统镜像的分发服务，也不包含任何绕过、破解或免除 Windows 激活机制的功能。
+
+软件内涉及的 Windows 系统下载链接均由微软官方提供。使用者在下载、安装和使用相关 Windows 系统时，应自行向微软或其授权渠道购买并获得相应的软件许可。本项目不会对安装后的 Windows 系统进行任何形式的激活绕过、破解或免激活处理。
+
+对于使用者因使用本软件而产生的任何行为及其后果，包括但不限于软件许可、系统使用、数据丢失、法律责任或其他相关问题，本项目及其开发者不承担任何责任。
+
+本开源软件仅供学习和研究 LXC、KVM 等虚拟化技术原理之目的使用，不得用于任何违反适用法律法规、软件许可协议或第三方权益的行为。
+
+本软件中涉及的 Windows 名称、标识、图标及相关知识产权均归 Microsoft Corporation 及其权利人所有。本项目与微软公司不存在任何关联、授权或合作关系。
+## Thanks/鸣谢
+
+- [Linux.do](https://linux.do) — 一个充满灵感的科技社区
+
 ## Star History
 
 <a href="https://www.star-history.com/?repos=MengMengCode%2FCLICD&type=date&legend=top-left">
@@ -61,7 +112,3 @@ curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh
    <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=MengMengCode/CLICD&type=date&legend=top-left" />
  </picture>
 </a>
-
-## 鸣谢
-
-- [Linux.do](https://linux.do) — 一个充满灵感的科技社区

backend/go.mod

@@ -1,12 +1,33 @@
 module clicd
 
-go 1.22.0
+go 1.24.0
+
+toolchain go1.24.5
 
 require (
-	github.com/golang-jwt/jwt/v5 v5.2.1
+	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/gorilla/websocket v1.5.3
-	golang.org/x/crypto v0.28.0
-	golang.org/x/term v0.28.0
+	golang.org/x/crypto v0.45.0
+	golang.org/x/term v0.37.0
 )
 
-require golang.org/x/sys v0.29.0 // indirect
+require (
+	golang.org/x/sys v0.38.0
+	modernc.org/sqlite v1.29.10
+)
+
+require (
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	golang.org/x/exp v0.0.0-20231108232855-2478ac86f678 // indirect
+	modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 // indirect
+	modernc.org/libc v1.61.13 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.8.2 // indirect
+	modernc.org/strutil v1.2.1 // indirect
+	modernc.org/token v1.1.0 // indirect
+)

backend/go.sum

@@ -1,10 +1,61 @@
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd h1:gbpYu9NMq8jhDVbvlGkMFWCjLFlqqEZjEmObmhUy6Vo=
+github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
-golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/exp v0.0.0-20231108232855-2478ac86f678 h1:mchzmB1XO2pMaKFRqk/+MV3mgGG96aqaPXaMifQU47w=
+golang.org/x/exp v0.0.0-20231108232855-2478ac86f678/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
+golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
+golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/tools v0.23.0 h1:SGsXPZ+2l4JsgaCKkx+FQ9YZ5XEtA1GZYuoDjenLjvg=
+golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=
+modernc.org/cc/v4 v4.24.4 h1:TFkx1s6dCkQpd6dKurBNmpo+G8Zl4Sq/ztJ+2+DEsh0=
+modernc.org/cc/v4 v4.24.4/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.23.16 h1:Z2N+kk38b7SfySC1ZkpGLN2vthNJP1+ZzGZIlH7uBxo=
+modernc.org/ccgo/v4 v4.23.16/go.mod h1:nNma8goMTY7aQZQNTyN9AIoJfxav4nvTnvKThAeMDdo=
+modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
+modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
+modernc.org/gc/v2 v2.6.3 h1:aJVhcqAte49LF+mGveZ5KPlsp4tdGdAOT4sipJXADjw=
+modernc.org/gc/v2 v2.6.3/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 h1:5D53IMaUuA5InSeMu9eJtlQXS2NxAhyWQvkKEgXZhHI=
+modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6/go.mod h1:Qz0X07sNOR1jWYCrJMEnbW/X55x206Q7Vt4mz6/wHp4=
+modernc.org/libc v1.61.13 h1:3LRd6ZO1ezsFiX1y+bHd1ipyEHIJKvuprv0sLTBwLW8=
+modernc.org/libc v1.61.13/go.mod h1:8F/uJWL/3nNil0Lgt1Dpz+GgkApWh04N3el3hxJcA6E=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.8.2 h1:cL9L4bcoAObu4NkxOlKWBWtNHIsnnACGF/TbqQ6sbcI=
+modernc.org/memory v1.8.2/go.mod h1:ZbjSvMO5NQ1A2i3bWeDiVMxIorXwdClKE/0SZ+BMotU=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.29.10 h1:3u93dz83myFnMilBGCOLbr+HjklS6+5rJLx4q86RDAg=
+modernc.org/sqlite v1.29.10/go.mod h1:ItX2a1OVGgNsFh6Dv60JQvGfJfTPHPVpV6DF59akYOA=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

backend/internal/api/apikey.go

@@ -2,122 +2,293 @@ package api
 
 import (
 	"crypto/rand"
-	"crypto/sha256"
 	"crypto/subtle"
 	"encoding/hex"
 	"encoding/json"
+	"fmt"
 	"net"
 	"net/http"
-	"strconv"
 	"strings"
 	"time"
 
 	"clicd/internal/config"
+
+	"golang.org/x/crypto/argon2"
 )
 
 type ApiKey struct {
-	ID          string `json:"id"`
-	Name        string `json:"name"`
-	Key         string `json:"key,omitempty"`
-	Prefix      string `json:"prefix"`
-	IPWhitelist string `json:"ip_whitelist"`
-	CreatedAt   string `json:"created_at"`
-	LastUsed    string `json:"last_used"`
+	ID             string   `json:"id"`
+	Name           string   `json:"name"`
+	Key            string   `json:"key,omitempty"`
+	Prefix         string   `json:"prefix"`
+	IPWhitelist    string   `json:"ip_whitelist"`
+	CreatedAt      string   `json:"created_at"`
+	LastUsed       string   `json:"last_used"`
+	Scopes         []string `json:"scopes,omitempty"`
+	ExpiresAt      string   `json:"expires_at,omitempty"`
+	Disabled       bool     `json:"disabled,omitempty"`
+	ContainerUUIDs []string `json:"container_uuids,omitempty"`
+	LastUsedIP     string   `json:"last_used_ip,omitempty"`
+}
+
+type apiKeyRequest struct {
+	Name           string   `json:"name"`
+	IPWhitelist    string   `json:"ip_whitelist"`
+	Scopes         []string `json:"scopes"`
+	ExpiresAt      string   `json:"expires_at"`
+	Disabled       bool     `json:"disabled"`
+	ContainerUUIDs []string `json:"container_uuids"`
+}
+
+var defaultApiKeyScopes = []string{
+	"dashboard:read",
+	"container:read",
+	"task:read",
+	"image:read",
+	"snapshot:read",
+	"routing:read",
+	"ipv6:read",
+	"host:read",
 }
 
 // HandleApiKeys handles GET (list) and POST (create) for API keys
 func HandleApiKeys(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
+		if !requireScope(w, r, "apikey:read") {
+			return
+		}
 		listApiKeys(w, r)
 	case http.MethodPost:
+		if !requireScope(w, r, "apikey:create") {
+			return
+		}
 		createApiKey(w, r)
 	default:
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 	}
 }
 
-// HandleApiKeyDelete handles DELETE for a specific API key
+// HandleApiKeyDelete handles PATCH and DELETE for a specific API key
 func HandleApiKeyDelete(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodDelete {
+	switch r.Method {
+	case http.MethodPatch:
+		if !requireScope(w, r, "apikey:update") {
+			return
+		}
+		updateApiKey(w, r)
+	case http.MethodDelete:
+		if !requireScope(w, r, "apikey:delete") {
+			return
+		}
+		deleteApiKey(w, r)
+	default:
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
-		return
 	}
-	keyID := strings.TrimPrefix(r.URL.Path, "/api/api-keys/")
-	if keyID == "" {
-		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Key ID required"})
-		return
-	}
-	config.DeleteApiKey(keyID)
-	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "API key deleted"})
+}
+
+func apiKeyIDFromPath(path string) string {
+	path = strings.TrimPrefix(path, "/api/api-keys/")
+	path = strings.TrimPrefix(path, "/api/v1/api-keys/")
+	return strings.Trim(path, "/")
 }
 
 func listApiKeys(w http.ResponseWriter, r *http.Request) {
 	keys := make([]ApiKey, 0)
 	for _, k := range config.AppConfig.ApiKeys {
-		keys = append(keys, ApiKey{
-			ID:          k.ID,
-			Name:        k.Name,
-			Prefix:      k.Prefix,
-			IPWhitelist: k.IPWhitelist,
-			CreatedAt:   k.CreatedAt,
-			LastUsed:    k.LastUsed,
-		})
+		keys = append(keys, apiKeyResponse(k))
 	}
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: keys})
 }
 
 func createApiKey(w http.ResponseWriter, r *http.Request) {
-	var req struct {
-		Name        string `json:"name"`
-		IPWhitelist string `json:"ip_whitelist"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.Name == "" {
+	var req apiKeyRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || strings.TrimSpace(req.Name) == "" {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Name is required"})
 		return
 	}
+	if req.ExpiresAt != "" && !validApiKeyTime(req.ExpiresAt) {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid expiration date"})
+		return
+	}
 
 	// Generate key: clicd_sk_ + 32 hex chars
 	rawBytes := make([]byte, 16)
-	rand.Read(rawBytes)
+	if _, err := rand.Read(rawBytes); err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to generate API key"})
+		return
+	}
 	rawKey := "clicd_sk_" + hex.EncodeToString(rawBytes)
 
+	keyHash, err := hashAPIKey(rawKey)
+	if err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to store API key"})
+		return
+	}
+
 	now := time.Now().Format("2006-01-02 15:04:05")
+	scopes := normalizeRequestedScopes(req.Scopes, defaultApiKeyScopes)
 	key := config.ApiKeyConfig{
-		ID:          generateShortID(),
-		Name:        req.Name,
-		KeyHash:     hashKey(rawKey),
-		Prefix:      rawKey[:13] + "...",
-		IPWhitelist: strings.TrimSpace(req.IPWhitelist),
-		CreatedAt:   now,
+		ID:             generateShortID(),
+		Name:           strings.TrimSpace(req.Name),
+		KeyHash:        keyHash,
+		Prefix:         rawKey[:13] + "...",
+		IPWhitelist:    strings.TrimSpace(req.IPWhitelist),
+		CreatedAt:      now,
+		Scopes:         scopes,
+		ExpiresAt:      strings.TrimSpace(req.ExpiresAt),
+		Disabled:       req.Disabled,
+		ContainerUUIDs: normalizeStringSlice(req.ContainerUUIDs),
 	}
 	config.AppConfig.ApiKeys = append(config.AppConfig.ApiKeys, key)
-	config.SaveConfig()
+	if err := config.SaveConfig(); err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to save API key"})
+		return
+	}
+	auditRequest(r, "apikey.create", key.Name, "scopes="+strings.Join(key.Scopes, ","), true, "")
 
+	resp := apiKeyResponse(key)
+	resp.Key = rawKey
 	jsonResponse(w, http.StatusCreated, APIResponse{
 		Success: true,
 		Message: "API key created. Save this key now - it won't be shown again.",
-		Data: ApiKey{
-			ID:          key.ID,
-			Name:        key.Name,
-			Key:         rawKey,
-			Prefix:      key.Prefix,
-			IPWhitelist: key.IPWhitelist,
-			CreatedAt:   key.CreatedAt,
-		},
+		Data:    resp,
 	})
 }
 
+func updateApiKey(w http.ResponseWriter, r *http.Request) {
+	keyID := apiKeyIDFromPath(r.URL.Path)
+	if keyID == "" {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Key ID required"})
+		return
+	}
+	var req apiKeyRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+	if req.ExpiresAt != "" && !validApiKeyTime(req.ExpiresAt) {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid expiration date"})
+		return
+	}
+	for i := range config.AppConfig.ApiKeys {
+		if config.AppConfig.ApiKeys[i].ID != keyID {
+			continue
+		}
+		if strings.TrimSpace(req.Name) != "" {
+			config.AppConfig.ApiKeys[i].Name = strings.TrimSpace(req.Name)
+		}
+		config.AppConfig.ApiKeys[i].IPWhitelist = strings.TrimSpace(req.IPWhitelist)
+		if len(req.Scopes) > 0 {
+			config.AppConfig.ApiKeys[i].Scopes = normalizeStringSlice(req.Scopes)
+		}
+		config.AppConfig.ApiKeys[i].ExpiresAt = strings.TrimSpace(req.ExpiresAt)
+		config.AppConfig.ApiKeys[i].Disabled = req.Disabled
+		config.AppConfig.ApiKeys[i].ContainerUUIDs = normalizeStringSlice(req.ContainerUUIDs)
+		if err := config.SaveConfig(); err != nil {
+			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to save API key"})
+			return
+		}
+		auditRequest(r, "apikey.update", config.AppConfig.ApiKeys[i].Name, "scopes="+strings.Join(config.AppConfig.ApiKeys[i].Scopes, ","), true, "")
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: apiKeyResponse(config.AppConfig.ApiKeys[i])})
+		return
+	}
+	jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "API key not found"})
+}
+
+func deleteApiKey(w http.ResponseWriter, r *http.Request) {
+	keyID := apiKeyIDFromPath(r.URL.Path)
+	if keyID == "" {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Key ID required"})
+		return
+	}
+	name := keyID
+	for _, k := range config.AppConfig.ApiKeys {
+		if k.ID == keyID {
+			name = k.Name
+			break
+		}
+	}
+	config.DeleteApiKey(keyID)
+	auditRequest(r, "apikey.delete", name, "", true, "")
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "API key deleted"})
+}
+
+func apiKeyResponse(k config.ApiKeyConfig) ApiKey {
+	return ApiKey{
+		ID:             k.ID,
+		Name:           k.Name,
+		Prefix:         k.Prefix,
+		IPWhitelist:    k.IPWhitelist,
+		CreatedAt:      k.CreatedAt,
+		LastUsed:       k.LastUsed,
+		Scopes:         normalizeApiKeyScopes(k.Scopes),
+		ExpiresAt:      k.ExpiresAt,
+		Disabled:       k.Disabled,
+		ContainerUUIDs: k.ContainerUUIDs,
+		LastUsedIP:     k.LastUsedIP,
+	}
+}
+
 func generateShortID() string {
 	b := make([]byte, 4)
 	rand.Read(b)
 	return hex.EncodeToString(b)
 }
 
-// hashKey creates a simple hash for storage (not reversible)
-func hashKey(key string) string {
-	sum := sha256.Sum256([]byte(key))
-	return hex.EncodeToString(sum[:])
+const (
+	apiKeyHashPrefix     = "argon2id"
+	apiKeyHashTime       = uint32(3)
+	apiKeyHashMemory     = uint32(64 * 1024)
+	apiKeyHashThreads    = uint8(1)
+	apiKeyHashSaltLength = 16
+	apiKeyHashKeyLength  = uint32(32)
+)
+
+// hashAPIKey stores API keys using a salted slow password-hash style function.
+func hashAPIKey(key string) (string, error) {
+	salt := make([]byte, apiKeyHashSaltLength)
+	if _, err := rand.Read(salt); err != nil {
+		return "", err
+	}
+	return hashAPIKeyWithSalt(key, salt), nil
+}
+
+func hashAPIKeyWithSalt(key string, salt []byte) string {
+	digest := argon2.IDKey([]byte(key), salt, apiKeyHashTime, apiKeyHashMemory, apiKeyHashThreads, apiKeyHashKeyLength)
+	return fmt.Sprintf("%s$v=19$m=%d,t=%d,p=%d$%s$%s",
+		apiKeyHashPrefix,
+		apiKeyHashMemory,
+		apiKeyHashTime,
+		apiKeyHashThreads,
+		hex.EncodeToString(salt),
+		hex.EncodeToString(digest),
+	)
+}
+
+func verifyAPIKeyHash(rawKey, storedHash string) bool {
+	parts := strings.Split(storedHash, "$")
+	if len(parts) != 5 || parts[0] != apiKeyHashPrefix || parts[1] != "v=19" {
+		return false
+	}
+	var memory, iterations uint32
+	var threads uint8
+	if _, err := fmt.Sscanf(parts[2], "m=%d,t=%d,p=%d", &memory, &iterations, &threads); err != nil {
+		return false
+	}
+	if memory != apiKeyHashMemory || iterations != apiKeyHashTime || threads != apiKeyHashThreads {
+		return false
+	}
+	salt, err := hex.DecodeString(parts[3])
+	if err != nil || len(salt) == 0 {
+		return false
+	}
+	expected, err := hex.DecodeString(parts[4])
+	if err != nil || len(expected) == 0 {
+		return false
+	}
+	digest := argon2.IDKey([]byte(rawKey), salt, iterations, memory, threads, uint32(len(expected)))
+	return subtle.ConstantTimeCompare(digest, expected) == 1
 }
 
 func legacyHashKey(key string) string {
@@ -128,20 +299,75 @@ func legacyHashKey(key string) string {
 	return hex.EncodeToString(b)
 }
 
-// validateApiKey checks if the given key is valid and IP is allowed
-func validateApiKey(rawKey, clientIP string) bool {
-	hashed := hashKey(rawKey)
+func matchApiKey(rawKey string) (idx int, needsRehash bool) {
 	legacyHashed := legacyHashKey(rawKey)
-	for _, k := range config.AppConfig.ApiKeys {
-		if subtle.ConstantTimeCompare([]byte(k.KeyHash), []byte(hashed)) == 1 ||
-			subtle.ConstantTimeCompare([]byte(k.KeyHash), []byte(legacyHashed)) == 1 {
-			if k.IPWhitelist == "" {
-				return true
-			}
-			return isIPAllowed(clientIP, k.IPWhitelist)
+	for i, k := range config.AppConfig.ApiKeys {
+		if verifyAPIKeyHash(rawKey, k.KeyHash) {
+			return i, false
+		}
+		if subtle.ConstantTimeCompare([]byte(k.KeyHash), []byte(legacyHashed)) == 1 {
+			return i, true
 		}
 	}
-	return false
+	return -1, false
+}
+
+// validateApiKey checks if the given key is valid and IP is allowed.
+func validateApiKey(rawKey, clientIP string) bool {
+	_, ok := validateApiKeyDetails(rawKey, clientIP)
+	return ok
+}
+
+func validateApiKeyDetails(rawKey, clientIP string) (*config.ApiKeyConfig, bool) {
+	idx, needsRehash := matchApiKey(rawKey)
+	if idx < 0 {
+		return nil, false
+	}
+	k := &config.AppConfig.ApiKeys[idx]
+	if k.Disabled || apiKeyExpired(k.ExpiresAt) {
+		return nil, false
+	}
+	if clientIP != "" && k.IPWhitelist != "" && !isIPAllowed(clientIP, k.IPWhitelist) {
+		return nil, false
+	}
+	if needsRehash {
+		if newHash, err := hashAPIKey(rawKey); err == nil {
+			config.AppConfig.ApiKeys[idx].KeyHash = newHash
+			config.SaveConfig()
+		}
+	}
+	if len(k.Scopes) == 0 {
+		k.Scopes = []string{"*"}
+	}
+	return k, true
+}
+
+func validateApiKeyRequest(r *http.Request) (*config.ApiKeyConfig, bool) {
+	apiKey := apiKeyFromRequest(r)
+	if apiKey == "" {
+		return nil, false
+	}
+	key, ok := validateApiKeyDetails(apiKey, clientIP(r))
+	if !ok {
+		return nil, false
+	}
+	updateApiKeyLastUsedForKey(key, clientIP(r))
+	return key, true
+}
+
+func authContextFromAPIKey(key *config.ApiKeyConfig) AuthContext {
+	actor := "api:" + key.ID
+	if key.Name != "" {
+		actor = "api:" + key.Name
+	}
+	return AuthContext{
+		Type:           authTypeAPIKey,
+		ApiKeyID:       key.ID,
+		ApiKeyName:     key.Name,
+		Actor:          actor,
+		Scopes:         normalizeApiKeyScopes(key.Scopes),
+		ContainerUUIDs: key.ContainerUUIDs,
+	}
 }
 
 func apiKeyFromRequest(r *http.Request) string {
@@ -156,23 +382,16 @@ func apiKeyFromRequest(r *http.Request) string {
 }
 
 func isValidApiKeyRequest(r *http.Request) bool {
-	apiKey := apiKeyFromRequest(r)
-	if apiKey == "" {
-		return false
-	}
-	if !validateApiKey(apiKey, clientIP(r)) {
-		return false
-	}
-	updateApiKeyLastUsed(apiKey)
-	return true
+	_, ok := validateApiKeyRequest(r)
+	return ok
 }
 
 // isIPAllowed checks if clientIP matches any entry in the whitelist
 func isIPAllowed(clientIP, whitelist string) bool {
-	clientIP = strings.TrimSpace(clientIP)
-	// Strip port if present
-	if idx := strings.LastIndex(clientIP, ":"); idx > strings.LastIndex(clientIP, "]") {
-		clientIP = clientIP[:idx]
+	clientIP = normalizeIPString(clientIP)
+	client := net.ParseIP(clientIP)
+	if client == nil {
+		return false
 	}
 	for _, entry := range strings.Split(whitelist, "\n") {
 		entry = strings.TrimSpace(entry)
@@ -180,77 +399,97 @@ func isIPAllowed(clientIP, whitelist string) bool {
 			continue
 		}
 		if strings.Contains(entry, "/") {
-			// CIDR match
-			if ipInCIDR(clientIP, entry) {
+			_, network, err := net.ParseCIDR(entry)
+			if err == nil && network.Contains(client) {
 				return true
 			}
-		} else if entry == clientIP {
+			continue
+		}
+		if allowed := net.ParseIP(normalizeIPString(entry)); allowed != nil && allowed.Equal(client) {
 			return true
 		}
 	}
 	return false
 }
 
-func ipInCIDR(ipStr, cidr string) bool {
-	parts := strings.Split(cidr, "/")
-	if len(parts) != 2 {
-		return false
-	}
-	// Simple prefix match for IPv4
-	ip := netParseIP(ipStr)
-	cidrIP := netParseIP(parts[0])
-	if ip == nil || cidrIP == nil {
-		return false
-	}
-	bits, err := strconv.Atoi(parts[1])
-	if err != nil || bits < 0 || bits > 32 {
-		return false
-	}
-	mask := uint32(0xFFFFFFFF) << (32 - bits)
-	ipVal := ip4ToUint32(ip)
-	cidrVal := ip4ToUint32(cidrIP)
-	return (ipVal & mask) == (cidrVal & mask)
-}
-
-func netParseIP(s string) net.IP {
+func normalizeIPString(s string) string {
 	s = strings.TrimSpace(s)
-	if idx := strings.LastIndex(s, ":"); idx > strings.LastIndex(s, "]") {
-		s = s[:idx]
+	if host, _, err := net.SplitHostPort(s); err == nil {
+		return strings.Trim(host, "[]")
 	}
-	return net.ParseIP(s)
+	return strings.Trim(s, "[]")
 }
 
-func ip4ToUint32(ip net.IP) uint32 {
-	ip = ip.To4()
-	if ip == nil {
-		return 0
-	}
-	return uint32(ip[0])<<24 | uint32(ip[1])<<16 | uint32(ip[2])<<8 | uint32(ip[3])
+func ipInCIDR(ipStr, cidr string) bool {
+	ip := net.ParseIP(normalizeIPString(ipStr))
+	_, network, err := net.ParseCIDR(cidr)
+	return err == nil && ip != nil && network.Contains(ip)
 }
 
-// updateApiKeyLastUsed marks the key as recently used
+// updateApiKeyLastUsed marks the key as recently used.
 func updateApiKeyLastUsed(rawKey string) {
-	hashed := hashKey(rawKey)
-	now := time.Now().Format("2006-01-02 15:04:05")
-	for i := range config.AppConfig.ApiKeys {
-		if config.AppConfig.ApiKeys[i].KeyHash == hashed {
-			config.AppConfig.ApiKeys[i].LastUsed = now
-			config.SaveConfig()
-			return
-		}
+	key, ok := validateApiKeyDetails(rawKey, "")
+	if !ok {
+		return
 	}
+	updateApiKeyLastUsedForKey(key, "")
+}
+
+func updateApiKeyLastUsedForKey(key *config.ApiKeyConfig, ip string) {
+	key.LastUsed = time.Now().Format("2006-01-02 15:04:05")
+	if ip != "" {
+		key.LastUsedIP = ip
+	}
+	config.SaveConfig()
 }
 
 // ApiKeyMiddleware authenticates requests via X-API-Key header or Authorization bearer.
 func ApiKeyMiddleware(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		apiKey := apiKeyFromRequest(r)
-		if apiKey == "" || !validateApiKey(apiKey, clientIP(r)) {
+		key, ok := validateApiKeyRequest(r)
+		if !ok {
 			jsonResponse(w, http.StatusUnauthorized, APIResponse{Success: false, Message: "Invalid API key or IP not in whitelist"})
 			return
 		}
-
-		updateApiKeyLastUsed(apiKey)
-		next(w, r)
+		next(w, withAuthContext(r, authContextFromAPIKey(key)))
 	}
 }
+
+func normalizeApiKeyScopes(scopes []string) []string {
+	return normalizeRequestedScopes(scopes, []string{"*"})
+}
+
+func normalizeRequestedScopes(scopes []string, fallback []string) []string {
+	result := normalizeStringSlice(scopes)
+	if len(result) == 0 {
+		return append([]string(nil), fallback...)
+	}
+	return result
+}
+
+func normalizeStringSlice(values []string) []string {
+	seen := map[string]bool{}
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value == "" || seen[value] {
+			continue
+		}
+		seen[value] = true
+		result = append(result, value)
+	}
+	return result
+}
+
+func validApiKeyTime(value string) bool {
+	_, err := time.ParseInLocation("2006-01-02 15:04:05", value, time.Local)
+	return err == nil
+}
+
+func apiKeyExpired(value string) bool {
+	if strings.TrimSpace(value) == "" {
+		return false
+	}
+	expiresAt, err := time.ParseInLocation("2006-01-02 15:04:05", value, time.Local)
+	return err == nil && !time.Now().Before(expiresAt)
+}

backend/internal/api/apikey_test.go

@@ -0,0 +1,102 @@
+package api
+
+import (
+	"strings"
+	"testing"
+
+	"clicd/internal/config"
+)
+
+func TestHashAPIKeyUsesSaltedArgon2idHash(t *testing.T) {
+	raw := "clicd_sk_0123456789abcdef0123456789abcdef"
+
+	h1, err := hashAPIKey(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	h2, err := hashAPIKey(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if h1 == h2 {
+		t.Fatal("expected salted hashes to differ")
+	}
+	if !strings.HasPrefix(h1, apiKeyHashPrefix+"$") || !strings.HasPrefix(h2, apiKeyHashPrefix+"$") {
+		t.Fatalf("expected argon2id hashes, got %q and %q", h1, h2)
+	}
+	if !verifyAPIKeyHash(raw, h1) || !verifyAPIKeyHash(raw, h2) {
+		t.Fatal("argon2id hashes did not verify")
+	}
+	if verifyAPIKeyHash(raw+"x", h1) {
+		t.Fatal("argon2id hash verified wrong key")
+	}
+}
+
+func TestValidateApiKeyAllowsArgon2idAndUpdatesLastUsed(t *testing.T) {
+	raw := "clicd_sk_0123456789abcdef0123456789abcdef"
+	hash, err := hashAPIKey(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.AppConfig = &config.ClicdConfig{
+		ApiKeys: []config.ApiKeyConfig{{
+			ID:      "key1",
+			Name:    "test",
+			KeyHash: hash,
+		}},
+	}
+
+	if !validateApiKey(raw, "127.0.0.1") {
+		t.Fatal("validateApiKey rejected valid argon2id key")
+	}
+	updateApiKeyLastUsed(raw)
+	if config.AppConfig.ApiKeys[0].LastUsed == "" {
+		t.Fatal("LastUsed was not updated")
+	}
+}
+
+func TestValidateApiKeyMigratesLegacyHash(t *testing.T) {
+	raw := "clicd_sk_0123456789abcdef0123456789abcdef"
+	config.AppConfig = &config.ClicdConfig{
+		ApiKeys: []config.ApiKeyConfig{{
+			ID:      "legacy",
+			Name:    "legacy",
+			KeyHash: legacyHashKey(raw),
+		}},
+	}
+
+	if !validateApiKey(raw, "127.0.0.1") {
+		t.Fatal("validateApiKey rejected valid legacy key")
+	}
+	migrated := config.AppConfig.ApiKeys[0].KeyHash
+	if migrated == legacyHashKey(raw) {
+		t.Fatal("legacy key hash was not migrated")
+	}
+	if !verifyAPIKeyHash(raw, migrated) {
+		t.Fatal("migrated key hash does not verify")
+	}
+}
+
+func TestValidateApiKeyAppliesIPWhitelist(t *testing.T) {
+	raw := "clicd_sk_0123456789abcdef0123456789abcdef"
+	hash, err := hashAPIKey(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.AppConfig = &config.ClicdConfig{
+		ApiKeys: []config.ApiKeyConfig{{
+			ID:          "key1",
+			Name:        "test",
+			KeyHash:     hash,
+			IPWhitelist: "192.0.2.10",
+		}},
+	}
+
+	if validateApiKey(raw, "198.51.100.10") {
+		t.Fatal("validateApiKey allowed disallowed IP")
+	}
+	if !validateApiKey(raw, "192.0.2.10") {
+		t.Fatal("validateApiKey rejected allowed IP")
+	}
+}

backend/internal/api/auth.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
 	"net/http"
 	"strings"
@@ -28,6 +29,132 @@ type APIResponse struct {
 	Data    interface{} `json:"data,omitempty"`
 }
 
+type authContextKey struct{}
+
+type AuthContext struct {
+	Type           string
+	Username       string
+	ApiKeyID       string
+	ApiKeyName     string
+	Actor          string
+	Scopes         []string
+	ContainerUUIDs []string
+}
+
+const (
+	authTypeAdmin   = "admin"
+	authTypeSubUser = "sub_user"
+	authTypeAPIKey  = "api_key"
+)
+
+func withAuthContext(r *http.Request, auth AuthContext) *http.Request {
+	return r.WithContext(context.WithValue(r.Context(), authContextKey{}, auth))
+}
+
+func authContextFromRequest(r *http.Request) (AuthContext, bool) {
+	ctx, ok := r.Context().Value(authContextKey{}).(AuthContext)
+	return ctx, ok
+}
+
+func requestActor(r *http.Request) string {
+	if ctx, ok := authContextFromRequest(r); ok && ctx.Actor != "" {
+		return ctx.Actor
+	}
+	if claims, ok := claimsFromRequest(r); ok {
+		if subUser, _ := claims["sub_user"].(string); subUser != "" {
+			return "user:" + subUser
+		}
+		if username, _ := claims["username"].(string); username != "" {
+			return username
+		}
+	}
+	return "admin"
+}
+
+func hasScope(r *http.Request, scope string) bool {
+	ctx, ok := authContextFromRequest(r)
+	if !ok {
+		return true
+	}
+	switch ctx.Type {
+	case authTypeAdmin:
+		return true
+	case authTypeSubUser:
+		return subUserScopeAllowed(scope)
+	case authTypeAPIKey:
+		return scopeAllowed(ctx.Scopes, scope)
+	default:
+		return false
+	}
+}
+
+func subUserScopeAllowed(scope string) bool {
+	switch scope {
+	case "container:read", "container:power", "container:reinstall", "container:network",
+		"dashboard:read", "image:read", "task:read", "snapshot:read", "snapshot:create", "snapshot:delete", "snapshot:restore", "snapshot:schedule",
+		"terminal:ssh", "terminal:vnc":
+		return true
+	default:
+		return false
+	}
+}
+
+func hasAnyScope(r *http.Request, scopes ...string) bool {
+	for _, scope := range scopes {
+		if hasScope(r, scope) {
+			return true
+		}
+	}
+	return false
+}
+
+func scopeAllowed(scopes []string, required string) bool {
+	for _, scope := range scopes {
+		scope = strings.TrimSpace(scope)
+		if scope == "*" || scope == "admin:*" || scope == required {
+			return true
+		}
+		if strings.HasSuffix(scope, ":*") {
+			prefix := strings.TrimSuffix(scope, "*")
+			if strings.HasPrefix(required, prefix) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func requireScope(w http.ResponseWriter, r *http.Request, scope string) bool {
+	if hasScope(r, scope) {
+		return true
+	}
+	jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Insufficient API key scope"})
+	return false
+}
+
+func ScopeMiddleware(scope string, next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !requireScope(w, r, scope) {
+			return
+		}
+		next(w, r)
+	}
+}
+
+func AnyScopeMiddleware(scopes []string, next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if hasAnyScope(r, scopes...) {
+			next(w, r)
+			return
+		}
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Insufficient API key scope"})
+	}
+}
+
+func auditRequest(r *http.Request, action, target, detail string, success bool, errMsg string) {
+	config.AddAuditLogFull(action, target, detail, requestActor(r), clientIP(r), r.UserAgent(), success, errMsg)
+}
+
 func jsonResponse(w http.ResponseWriter, status int, resp APIResponse) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)
@@ -75,8 +202,10 @@ func claimsFromToken(tokenString string) (jwt.MapClaims, bool) {
 	if subUser, _ := claims["sub_user"].(string); subUser != "" {
 		tokenVersionFloat, hasVersion := claims["token_version"].(float64)
 		tokenVersion := int(tokenVersionFloat)
+		foundSubUser := false
 		for i := range config.AppConfig.SubUsers {
 			if config.AppConfig.SubUsers[i].Username == subUser {
+				foundSubUser = true
 				stored := config.AppConfig.SubUsers[i].TokenVersion
 				// If stored version > 0, require token_version to match exactly.
 				// This also rejects legacy tokens that lack token_version entirely.
@@ -86,6 +215,9 @@ func claimsFromToken(tokenString string) (jwt.MapClaims, bool) {
 				break
 			}
 		}
+		if !foundSubUser {
+			return nil, false
+		}
 	}
 
 	return claims, ok
@@ -96,6 +228,9 @@ func claimsFromRequest(r *http.Request) (jwt.MapClaims, bool) {
 }
 
 func isSubUserRequest(r *http.Request) bool {
+	if ctx, ok := authContextFromRequest(r); ok {
+		return ctx.Type == authTypeSubUser
+	}
 	claims, ok := claimsFromRequest(r)
 	if !ok {
 		return false
@@ -210,19 +345,45 @@ func HandleCheckAuth(w http.ResponseWriter, r *http.Request) {
 func AuthMiddleware(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		tokenString := tokenFromRequest(r)
-		if !isValidToken(tokenString) && !isValidApiKeyRequest(r) {
-			jsonResponse(w, http.StatusUnauthorized, APIResponse{Success: false, Message: "Authentication required"})
+		if claims, ok := claimsFromToken(tokenString); ok {
+			if subUser, _ := claims["sub_user"].(string); subUser != "" {
+				auth := AuthContext{Type: authTypeSubUser, Username: subUser, Actor: "user:" + subUser}
+				if values, ok := claims["container_uuids"].([]interface{}); ok {
+					for _, value := range values {
+						if uuid, ok := value.(string); ok {
+							auth.ContainerUUIDs = append(auth.ContainerUUIDs, uuid)
+						}
+					}
+				}
+				next(w, withAuthContext(r, auth))
+				return
+			}
+			username, _ := claims["username"].(string)
+			if username == "" {
+				username = config.AppConfig.AdminUser
+			}
+			next(w, withAuthContext(r, AuthContext{Type: authTypeAdmin, Username: username, Actor: username}))
 			return
 		}
 
-		next(w, r)
+		if key, ok := validateApiKeyRequest(r); ok {
+			next(w, withAuthContext(r, authContextFromAPIKey(key)))
+			return
+		}
+
+		jsonResponse(w, http.StatusUnauthorized, APIResponse{Success: false, Message: "Authentication required"})
 	}
 }
 
 // AdminMiddleware requires a valid administrator token and rejects sub-user tokens.
 func AdminMiddleware(next http.HandlerFunc) http.HandlerFunc {
 	return AuthMiddleware(func(w http.ResponseWriter, r *http.Request) {
-		if isSubUserRequest(r) {
+		ctx, _ := authContextFromRequest(r)
+		if ctx.Type == authTypeSubUser {
+			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Administrator permission required"})
+			return
+		}
+		if ctx.Type == authTypeAPIKey && !scopeAllowed(ctx.Scopes, "admin:access") {
 			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Administrator permission required"})
 			return
 		}

backend/internal/api/disk_stat_fallback.go

@@ -0,0 +1,7 @@
+//go:build !linux
+
+package api
+
+func getRootDiskInfo() (DiskInfo, bool) {
+	return DiskInfo{}, false
+}

backend/internal/api/disk_stat_linux.go

@@ -0,0 +1,21 @@
+//go:build linux
+
+package api
+
+import "golang.org/x/sys/unix"
+
+func getRootDiskInfo() (DiskInfo, bool) {
+	var stat unix.Statfs_t
+	if err := unix.Statfs("/", &stat); err != nil {
+		return DiskInfo{}, false
+	}
+
+	total := float64(int64(stat.Blocks)*int64(stat.Bsize)) / (1024 * 1024 * 1024)
+	free := float64(int64(stat.Bavail)*int64(stat.Bsize)) / (1024 * 1024 * 1024)
+
+	return DiskInfo{
+		TotalGB: total,
+		UsedGB:  total - free,
+		FreeGB:  free,
+	}, true
+}

backend/internal/api/handlers.go

@@ -2,10 +2,12 @@ package api
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"strconv"
 	"strings"
 	"time"
+	"unicode"
 
 	"clicd/internal/config"
 	"clicd/internal/lxc"
@@ -18,17 +20,41 @@ var lxcManager = lxc.NewManager()
 func HandleContainers(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
+		if !requireScope(w, r, "container:read") {
+			return
+		}
 		listContainers(w, r)
 	case http.MethodPost:
+		if !requireScope(w, r, "container:create") {
+			return
+		}
+		if isAccessRestrictedRequest(r) {
+			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Container-bound API keys cannot create containers"})
+			return
+		}
 		createContainer(w, r)
 	default:
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 	}
 }
 
+// HandleContainerListAlias supports legacy integrations that call
+// /api/containers/list or /api/v1/containers/list.
+func HandleContainerListAlias(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet && r.Method != http.MethodPost {
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+		return
+	}
+	if !requireScope(w, r, "container:read") {
+		return
+	}
+	listContainers(w, r)
+}
+
 // HandleSingleContainer handles individual container operations by ID or name: /api/containers/{id-or-name}/...
 func HandleSingleContainer(w http.ResponseWriter, r *http.Request) {
-	path := strings.TrimPrefix(r.URL.Path, "/api/containers/")
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/containers/")
+	path = strings.TrimPrefix(path, "/api/containers/")
 	parts := strings.SplitN(path, "/", 2)
 	c := containerByIdentifier(parts[0])
 	id := 0
@@ -48,6 +74,10 @@ func HandleSingleContainer(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Container not found"})
 		return
 	}
+	if !isSnapshotAction && !isContainerAllowedForRequest(r, parts[0]) {
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to this container"})
+		return
+	}
 	if isSnapshotAction && id == 0 {
 		// For orphaned snapshots, resolve containerID from the snapshot itself
 		snapshotID := strings.TrimPrefix(action, "snapshots/")
@@ -59,45 +89,105 @@ func HandleSingleContainer(w http.ResponseWriter, r *http.Request) {
 		}
 		id = snapshot.ContainerID
 	}
+	if isSnapshotAction {
+		if c := config.FindContainer(id); c != nil && !isContainerAllowedForRequest(r, c.UUID) {
+			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to this container"})
+			return
+		}
+	}
 
 	switch {
 	case action == "start" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "container:power") {
+			return
+		}
 		HandleSingleTaskAction(w, r, id, "start")
 	case action == "stop" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "container:power") {
+			return
+		}
 		HandleSingleTaskAction(w, r, id, "stop")
 	case action == "restart" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "container:power") {
+			return
+		}
 		HandleSingleTaskAction(w, r, id, "restart")
 	case action == "reinstall" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "container:reinstall") {
+			return
+		}
 		HandleSingleTaskAction(w, r, id, "reinstall")
 	case action == "delete" && r.Method == http.MethodDelete:
+		if !requireScope(w, r, "container:delete") {
+			return
+		}
 		HandleSingleTaskAction(w, r, id, "delete")
 	case action == "reset-password" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "container:password") {
+			return
+		}
 		resetSSHPassword(w, r, id)
 	case action == "usage" && r.Method == http.MethodGet:
+		if !requireScope(w, r, "container:read") {
+			return
+		}
 		getUsage(w, r, id)
 	case action == "traffic" && r.Method == http.MethodGet:
+		if !requireScope(w, r, "container:read") {
+			return
+		}
 		getTraffic(w, r, id)
 	case action == "traffic-reset" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "container:traffic") {
+			return
+		}
 		resetTraffic(w, r, id)
 	case action == "traffic-limit" && r.Method == http.MethodPut:
+		if !requireScope(w, r, "container:traffic") {
+			return
+		}
 		updateTrafficLimit(w, r, id)
 	case action == "resource-limit" && r.Method == http.MethodPut:
+		if !requireScope(w, r, "container:resize") {
+			return
+		}
 		updateResourceLimit(w, r, id)
 	case action == "random-port" && r.Method == http.MethodGet:
+		if !requireScope(w, r, "container:network") {
+			return
+		}
 		getRandomPort(w, r, id)
 	case action == "expiry" && r.Method == http.MethodPut:
+		if !requireScope(w, r, "container:resize") {
+			return
+		}
 		updateExpiry(w, r, id)
 	case action == "ipv6" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "ipv6:assign") {
+			return
+		}
 		assignIPv6(w, r, id)
 	case action == "snapshots" || strings.HasPrefix(action, "snapshots/"):
 		handleContainerSnapshots(w, r, id, action)
 	case action == "port-mappings" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "container:network") {
+			return
+		}
 		addPortMapping(w, r, id)
 	case strings.HasPrefix(action, "port-mappings/") && r.Method == http.MethodPut:
+		if !requireScope(w, r, "container:network") {
+			return
+		}
 		updatePortMapping(w, r, id, strings.TrimPrefix(action, "port-mappings/"))
 	case strings.HasPrefix(action, "port-mappings/") && r.Method == http.MethodDelete:
+		if !requireScope(w, r, "container:network") {
+			return
+		}
 		deletePortMapping(w, r, id, strings.TrimPrefix(action, "port-mappings/"))
 	case r.Method == http.MethodGet:
+		if !requireScope(w, r, "container:read") {
+			return
+		}
 		getContainer(w, r, id)
 	default:
 		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Action not found"})
@@ -138,13 +228,38 @@ func createContainer(w http.ResponseWriter, r *http.Request) {
 	if cfg.DiskGB < 1 {
 		cfg.DiskGB = 5
 	}
-	if cfg.PortMappingCount < 2 {
+	if cfg.PortMappingCount < 0 {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Port mapping count cannot be negative"})
+		return
+	}
+	if cfg.WantsNAT() && cfg.PortMappingCount < 2 {
 		cfg.PortMappingCount = 2
+	} else if !cfg.WantsNAT() {
+		cfg.PortMappingCount = 0
+		cfg.ExtraPorts = nil
 	}
 	if cfg.PortMappingCount > 64 {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Port mapping count cannot exceed 64"})
 		return
 	}
+	if cfg.IPv4Count < 0 || cfg.IPv6Count < 0 {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "IP address count cannot be negative"})
+		return
+	}
+	if cfg.IPv4Count > 64 || cfg.IPv6Count > 64 {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "IP address count cannot exceed 64"})
+		return
+	}
+	if !cfg.AssignIPv4 && len(cfg.PublicIPv4s) == 0 {
+		cfg.IPv4Count = 0
+	}
+	if !cfg.AssignIPv6 && len(cfg.IPv6Addresses) == 0 {
+		cfg.IPv6Count = 0
+	}
+	if !hasRequestedNetwork(cfg) {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: noNetworkSelectedMessage})
+		return
+	}
 	if cfg.SnapshotLimit <= 0 {
 		cfg.SnapshotLimit = config.DefaultSnapshotLimit
 	}
@@ -177,6 +292,10 @@ func getContainer(w http.ResponseWriter, r *http.Request, id int) {
 		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Container not found"})
 		return
 	}
+	if c.IsKVM() && c.Status == "running" {
+		_, _ = kvmManager.RefreshVNCPort(c.ID)
+		_, _ = kvmManager.RefreshNetwork(c.ID)
+	}
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: c})
 }
 
@@ -298,7 +417,11 @@ func updateResourceLimit(w http.ResponseWriter, r *http.Request, id int) {
 		}
 	}
 
-	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Resource limits updated"})
+	msg := "Resource limits updated"
+	if c.IsKVM() && c.Status == "running" {
+		msg = "资源已保存，请关机重启虚拟机后生效"
+	}
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: msg})
 }
 
 func getRandomPort(w http.ResponseWriter, r *http.Request, id int) {
@@ -307,24 +430,11 @@ func getRandomPort(w http.ResponseWriter, r *http.Request, id int) {
 		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Container not found"})
 		return
 	}
-	// Find a random unused port between 10000-65535
-	used := map[int]bool{}
-	for _, pm := range c.PortMappings {
-		used[pm.HostPort] = true
-	}
-	// Also check all containers
-	for _, oc := range config.AppConfig.Containers {
-		if oc.ID == id {
-			continue
-		}
-		for _, pm := range oc.PortMappings {
-			used[pm.HostPort] = true
-		}
-	}
+	hostIP := strings.TrimSpace(r.URL.Query().Get("host_ip"))
 	// Try random ports
 	for tries := 0; tries < 100; tries++ {
 		port := 10000 + (int(time.Now().UnixNano()) % 55535)
-		if !used[port] {
+		if lxc.HostPortAvailable(c, hostIP, port, "tcp") {
 			jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: map[string]int{"port": port}})
 			return
 		}
@@ -338,6 +448,9 @@ func HandleTemplates(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "image:read") {
+		return
+	}
 	if isSubUserRequest(r) {
 		HandleEnabledImages(w, r)
 		return
@@ -352,7 +465,11 @@ func HandleDashboard(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "dashboard:read") {
+		return
+	}
 	containers, _ := listByRuntime()
+	containers = filterContainersForRequest(r, containers)
 	running := 0
 	stopped := 0
 	for _, c := range containers {
@@ -376,6 +493,9 @@ func HandleHostInfo(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "host:read") {
+		return
+	}
 	info := getHostInfo()
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: info})
 }
@@ -386,7 +506,24 @@ func resetSSHPassword(w http.ResponseWriter, r *http.Request, id int) {
 		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "容器已到期，不允许此操作"})
 		return
 	}
-	newPassword, err := resetPasswordByRuntime(id)
+	var req struct {
+		Password string `json:"password"`
+	}
+	if r.Body != nil {
+		decoder := json.NewDecoder(r.Body)
+		if err := decoder.Decode(&req); err != nil && err.Error() != "EOF" {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+			return
+		}
+	}
+	password := strings.TrimSpace(req.Password)
+	if password != "" {
+		if err := validateSSHPassword(password); err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+			return
+		}
+	}
+	newPassword, err := resetPasswordByRuntime(id, password)
 	if err != nil {
 		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: err.Error()})
 		return
@@ -398,6 +535,29 @@ func resetSSHPassword(w http.ResponseWriter, r *http.Request, id int) {
 	})
 }
 
+func validateSSHPassword(password string) error {
+	if len(password) < 8 || len(password) > 64 {
+		return fmt.Errorf("密码长度必须为 8-64 位")
+	}
+	hasLetter := false
+	hasDigit := false
+	for _, r := range password {
+		if unicode.IsSpace(r) {
+			return fmt.Errorf("密码不能包含空白字符")
+		}
+		if unicode.IsLetter(r) {
+			hasLetter = true
+		}
+		if unicode.IsDigit(r) {
+			hasDigit = true
+		}
+	}
+	if !hasLetter || !hasDigit {
+		return fmt.Errorf("密码至少需要包含字母和数字")
+	}
+	return nil
+}
+
 func addPortMapping(w http.ResponseWriter, r *http.Request, id int) {
 	var pm config.PortMapping
 	if err := json.NewDecoder(r.Body).Decode(&pm); err != nil {

backend/internal/api/host_test.go

@@ -0,0 +1,43 @@
+package api
+
+import "testing"
+
+func TestExtractCertbotVersion(t *testing.T) {
+	tests := []struct {
+		output string
+		want   string
+	}{
+		{"certbot 5.4.0", "5.4.0"},
+		{"certbot v5.10.1", "5.10.1"},
+		{"certbot, version 4.9", "4.9"},
+		{"installed", ""},
+	}
+
+	for _, tt := range tests {
+		if got := extractCertbotVersion(tt.output); got != tt.want {
+			t.Fatalf("extractCertbotVersion(%q) = %q, want %q", tt.output, got, tt.want)
+		}
+	}
+}
+
+func TestCertbotVersionAtLeast54(t *testing.T) {
+	tests := []struct {
+		version string
+		want    bool
+	}{
+		{"5.4", true},
+		{"5.4.0", true},
+		{"5.10", true},
+		{"6.0.0", true},
+		{"5.3.9", false},
+		{"4.99", false},
+		{"5", false},
+		{"", false},
+	}
+
+	for _, tt := range tests {
+		if got := certbotVersionAtLeast(tt.version, 5, 4); got != tt.want {
+			t.Fatalf("certbotVersionAtLeast(%q, 5, 4) = %v, want %v", tt.version, got, tt.want)
+		}
+	}
+}

backend/internal/api/images.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -8,6 +9,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"sync"
+	"time"
 
 	"clicd/internal/config"
 	"clicd/internal/kvm"
@@ -16,21 +18,143 @@ import (
 
 // ImageInfo represents a template image with its download/enable status.
 type ImageInfo struct {
-	ID          string `json:"id"`
-	Name        string `json:"name"`
-	Type        string `json:"type"`
-	Distro      string `json:"distro"`
-	Release     string `json:"release"`
-	Arch        string `json:"arch"`
-	Description string `json:"description"`
-	Downloaded  bool   `json:"downloaded"`
-	Enabled     bool   `json:"enabled"`
-	Downloading bool   `json:"downloading"`
-	SizeBytes   int64  `json:"size_bytes"`
+	ID              string `json:"id"`
+	Name            string `json:"name"`
+	Type            string `json:"type"`
+	Distro          string `json:"distro"`
+	Release         string `json:"release"`
+	Arch            string `json:"arch"`
+	Description     string `json:"description"`
+	Downloaded      bool   `json:"downloaded"`
+	Enabled         bool   `json:"enabled"`
+	Downloading     bool   `json:"downloading"`
+	Progress        int    `json:"progress"`
+	DownloadedBytes int64  `json:"downloaded_bytes"`
+	TotalBytes      int64  `json:"total_bytes"`
+	Stage           string `json:"stage,omitempty"`
+	Error           string `json:"error,omitempty"`
+	SizeBytes       int64  `json:"size_bytes"`
+	ManualPath      string `json:"manual_path,omitempty"`
+	Desktop         string `json:"desktop,omitempty"`
 }
 
 var imageDownloadsMu sync.Mutex
-var imageDownloads = map[string]bool{}
+var imageDownloads = map[string]*imageDownloadStatus{}
+
+type imageDownloadStatus struct {
+	Downloading     bool
+	Progress        int
+	DownloadedBytes int64
+	TotalBytes      int64
+	Stage           string
+	Error           string
+	Cancel          context.CancelFunc
+	UpdatedAt       time.Time
+}
+
+type imageDownloadSnapshot struct {
+	Downloading     bool
+	Progress        int
+	DownloadedBytes int64
+	TotalBytes      int64
+	Stage           string
+	Error           string
+}
+
+func imageDownloadInfo(id string) imageDownloadSnapshot {
+	imageDownloadsMu.Lock()
+	defer imageDownloadsMu.Unlock()
+	st := imageDownloads[id]
+	if st == nil {
+		return imageDownloadSnapshot{}
+	}
+	return imageDownloadSnapshot{
+		Downloading:     st.Downloading,
+		Progress:        st.Progress,
+		DownloadedBytes: st.DownloadedBytes,
+		TotalBytes:      st.TotalBytes,
+		Stage:           st.Stage,
+		Error:           st.Error,
+	}
+}
+
+func startImageDownload(id, stage string) (context.Context, bool) {
+	imageDownloadsMu.Lock()
+	defer imageDownloadsMu.Unlock()
+	if st := imageDownloads[id]; st != nil && st.Downloading {
+		return nil, false
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	imageDownloads[id] = &imageDownloadStatus{
+		Downloading: true,
+		Stage:       stage,
+		Cancel:      cancel,
+		UpdatedAt:   time.Now(),
+	}
+	return ctx, true
+}
+
+func updateImageDownload(id string, update func(*imageDownloadStatus)) {
+	imageDownloadsMu.Lock()
+	defer imageDownloadsMu.Unlock()
+	st := imageDownloads[id]
+	if st == nil {
+		return
+	}
+	update(st)
+	st.UpdatedAt = time.Now()
+}
+
+func finishImageDownload(id string, err error) {
+	imageDownloadsMu.Lock()
+	defer imageDownloadsMu.Unlock()
+	st := imageDownloads[id]
+	if st == nil {
+		return
+	}
+	st.Downloading = false
+	st.Cancel = nil
+	st.UpdatedAt = time.Now()
+	if err != nil {
+		st.Error = err.Error()
+		return
+	}
+	delete(imageDownloads, id)
+}
+
+func clearImageDownload(id string) {
+	imageDownloadsMu.Lock()
+	delete(imageDownloads, id)
+	imageDownloadsMu.Unlock()
+}
+
+func isImageDownloadActive(id string) bool {
+	imageDownloadsMu.Lock()
+	defer imageDownloadsMu.Unlock()
+	st := imageDownloads[id]
+	return st != nil && st.Downloading
+}
+
+func lxcImageDownloadTempName(id string) string {
+	return fmt.Sprintf("clicd-img-dl-%s", id)
+}
+
+func cleanupLXCImageDownloadTemp(id string) {
+	tmpName := lxcImageDownloadTempName(id)
+	exec.Command("lxc-destroy", "-n", tmpName, "-f").Run()
+	os.RemoveAll(filepath.Join("/var/lib/lxc", tmpName))
+}
+
+func cleanupOldImageDownloadErrors() {
+	imageDownloadsMu.Lock()
+	defer imageDownloadsMu.Unlock()
+	cutoff := time.Now().Add(-10 * time.Minute)
+	for id, st := range imageDownloads {
+		if !st.Downloading && st.UpdatedAt.Before(cutoff) {
+			delete(imageDownloads, id)
+		}
+	}
+}
 
 // isImageDownloaded checks if the LXC download cache exists for a template.
 func isImageDownloaded(distro, release, arch string) bool {
@@ -97,55 +221,78 @@ func HandleImages(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "image:read") {
+		return
+	}
 
 	enabledSet := getEnabledImageSet()
+	cleanupOldImageDownloadErrors()
 
 	templates := lxc.GetTemplates()
 	images := make([]ImageInfo, 0, len(templates)+len(kvm.GetImages()))
 	for _, t := range templates {
-		_, downloading := imageDownloads[t.ID]
+		dl := imageDownloadInfo(t.ID)
 		downloaded, size := imageDownloadedInfo(t.Distro, t.Release, t.Arch)
 		images = append(images, ImageInfo{
-			ID:          t.ID,
-			Name:        t.Name,
-			Type:        config.VirtualizationLXC,
-			Distro:      t.Distro,
-			Release:     t.Release,
-			Arch:        t.Arch,
-			Description: t.Description,
-			Downloaded:  downloaded,
-			Enabled:     enabledSet[t.ID],
-			Downloading: downloading,
-			SizeBytes:   size,
+			ID:              t.ID,
+			Name:            t.Name,
+			Type:            config.VirtualizationLXC,
+			Distro:          t.Distro,
+			Release:         t.Release,
+			Arch:            t.Arch,
+			Description:     t.Description,
+			Downloaded:      downloaded,
+			Enabled:         enabledSet[t.ID],
+			Downloading:     dl.Downloading,
+			Progress:        dl.Progress,
+			DownloadedBytes: dl.DownloadedBytes,
+			TotalBytes:      dl.TotalBytes,
+			Stage:           dl.Stage,
+			Error:           dl.Error,
+			SizeBytes:       size,
 		})
 	}
 	for _, t := range kvm.GetImages() {
-		_, downloading := imageDownloads[t.ID]
+		dl := imageDownloadInfo(t.ID)
 		downloaded, size := kvm.ImageDownloadedInfo(t.ID)
+		manualPath := ""
+		if t.Distro == "windows" {
+			manualPath = kvm.ImagePath(t.ID)
+		}
 		images = append(images, ImageInfo{
-			ID:          t.ID,
-			Name:        t.Name,
-			Type:        config.VirtualizationKVM,
-			Distro:      t.Distro,
-			Release:     t.Release,
-			Arch:        t.Arch,
-			Description: t.Description,
-			Downloaded:  downloaded,
-			Enabled:     enabledSet[t.ID],
-			Downloading: downloading,
-			SizeBytes:   size,
+			ID:              t.ID,
+			Name:            t.Name,
+			Type:            config.VirtualizationKVM,
+			Distro:          t.Distro,
+			Release:         t.Release,
+			Arch:            t.Arch,
+			Description:     t.Description,
+			Downloaded:      downloaded,
+			Enabled:         enabledSet[t.ID],
+			Downloading:     dl.Downloading,
+			Progress:        dl.Progress,
+			DownloadedBytes: dl.DownloadedBytes,
+			TotalBytes:      dl.TotalBytes,
+			Stage:           dl.Stage,
+			Error:           dl.Error,
+			SizeBytes:       size,
+			ManualPath:      manualPath,
+			Desktop:         t.Desktop,
 		})
 	}
 
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: images})
 }
 
-// HandleImageDownload downloads a template image from the LXC image server.
+// HandleImageDownload starts a template image download in the background.
 func HandleImageDownload(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "image:download") {
+		return
+	}
 
 	var req struct {
 		TemplateID string `json:"template_id"`
@@ -164,80 +311,130 @@ func HandleImageDownload(w http.ResponseWriter, r *http.Request) {
 		}
 		if ok, _ := kvm.ImageDownloadedInfo(image.ID); ok {
 			ensureImageEnabled(image.ID)
+			clearImageDownload(image.ID)
 			jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Already downloaded"})
 			return
 		}
-		imageDownloadsMu.Lock()
-		if imageDownloads[req.TemplateID] {
-			imageDownloadsMu.Unlock()
+		ctx, ok := startImageDownload(image.ID, "downloading")
+		if !ok {
 			jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "Already downloading"})
 			return
 		}
-		imageDownloads[req.TemplateID] = true
-		imageDownloadsMu.Unlock()
-		defer func() {
-			imageDownloadsMu.Lock()
-			delete(imageDownloads, req.TemplateID)
-			imageDownloadsMu.Unlock()
-		}()
-		ensureImageEnabled(image.ID)
-		if err := kvm.DownloadImage(*image); err != nil {
-			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Download failed: " + err.Error()})
-			return
-		}
-		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Downloaded successfully"})
+		go func(image kvm.Image) {
+			err := kvm.DownloadImageWithProgress(ctx, image, func(p kvm.DownloadProgress) {
+				updateImageDownload(image.ID, func(st *imageDownloadStatus) {
+					if p.Stage != "" {
+						st.Stage = p.Stage
+					}
+					if p.DownloadedBytes > 0 || p.TotalBytes > 0 {
+						st.DownloadedBytes = p.DownloadedBytes
+						st.TotalBytes = p.TotalBytes
+					}
+					st.Progress = p.Percent
+				})
+			})
+			if err != nil {
+				if ctx.Err() != nil {
+					os.Remove(kvm.ImagePath(image.ID) + ".tmp")
+					os.Remove(kvm.ImagePath(image.ID))
+					finishImageDownload(image.ID, nil)
+					return
+				}
+				finishImageDownload(image.ID, err)
+				return
+			}
+			ensureImageEnabled(image.ID)
+			finishImageDownload(image.ID, nil)
+		}(*image)
+		jsonResponse(w, http.StatusAccepted, APIResponse{Success: true, Message: "Download started"})
 		return
 	}
 
 	// Already downloaded? Just enable if needed.
 	if isImageDownloaded(tmpl.Distro, tmpl.Release, tmpl.Arch) {
 		ensureImageEnabled(tmpl.ID)
+		clearImageDownload(tmpl.ID)
 		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Already downloaded"})
 		return
 	}
 
-	// Already downloading?
-	imageDownloadsMu.Lock()
-	if imageDownloads[req.TemplateID] {
-		imageDownloadsMu.Unlock()
+	ctx, ok := startImageDownload(tmpl.ID, "lxc-create")
+	if !ok {
 		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "Already downloading"})
 		return
 	}
-	imageDownloads[req.TemplateID] = true
-	imageDownloadsMu.Unlock()
 
-	defer func() {
-		imageDownloadsMu.Lock()
-		delete(imageDownloads, req.TemplateID)
-		imageDownloadsMu.Unlock()
-	}()
-
-	// Auto-enable on download
-	ensureImageEnabled(tmpl.ID)
-
-	// Download via lxc-create with a temp container, then destroy it.
-	tmpName := fmt.Sprintf("clicd-img-dl-%s", tmpl.ID)
-	args := []string{"-n", tmpName, "-t", "download", "--",
-		"-d", tmpl.Distro, "-r", tmpl.Release, "-a", tmpl.Arch}
-	if tmpl.Variant != "" {
-		args = append(args, "--variant", tmpl.Variant)
-	}
-	cmd := exec.Command("lxc-create", args...)
-	output, err := cmd.CombinedOutput()
-
-	// Clean up the temp container unconditionally.
-	exec.Command("lxc-destroy", "-n", tmpName, "-f").Run()
-	os.RemoveAll(filepath.Join("/var/lib/lxc", tmpName))
-
-	if err != nil {
-		jsonResponse(w, http.StatusInternalServerError, APIResponse{
-			Success: false,
-			Message: fmt.Sprintf("Download failed: %v, output: %s", err, string(output)),
+	go func(tmpl lxc.Template) {
+		// Download via lxc-create with a temp container, then destroy it.
+		tmpName := lxcImageDownloadTempName(tmpl.ID)
+		args := []string{"-n", tmpName, "-t", "download", "--",
+			"-d", tmpl.Distro, "-r", tmpl.Release, "-a", tmpl.Arch}
+		if tmpl.Variant != "" {
+			args = append(args, "--variant", tmpl.Variant)
+		}
+		updateImageDownload(tmpl.ID, func(st *imageDownloadStatus) {
+			st.Stage = "lxc-create"
 		})
+		cmd := exec.CommandContext(ctx, "lxc-create", args...)
+		output, err := cmd.CombinedOutput()
+
+		// Clean up the temp container unconditionally.
+		cleanupLXCImageDownloadTemp(tmpl.ID)
+
+		if err != nil {
+			if ctx.Err() != nil {
+				finishImageDownload(tmpl.ID, nil)
+				return
+			}
+			err = fmt.Errorf("Download failed: %v, output: %s", err, string(output))
+			finishImageDownload(tmpl.ID, err)
+			return
+		}
+		ensureImageEnabled(tmpl.ID)
+		finishImageDownload(tmpl.ID, nil)
+	}(*tmpl)
+
+	jsonResponse(w, http.StatusAccepted, APIResponse{Success: true, Message: "Download started"})
+}
+
+// HandleImageCancel cancels an in-progress image download.
+func HandleImageCancel(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+		return
+	}
+	if !requireScope(w, r, "image:download") {
+		return
+	}
+	var req struct {
+		TemplateID string `json:"template_id"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.TemplateID == "" {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "template_id required"})
 		return
 	}
 
-	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Downloaded successfully"})
+	imageDownloadsMu.Lock()
+	st := imageDownloads[req.TemplateID]
+	if st == nil || !st.Downloading || st.Cancel == nil {
+		imageDownloadsMu.Unlock()
+		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "No active download"})
+		return
+	}
+	cancel := st.Cancel
+	st.Stage = "canceling"
+	st.UpdatedAt = time.Now()
+	imageDownloadsMu.Unlock()
+
+	cancel()
+	if image := kvm.FindImage(req.TemplateID); image != nil {
+		os.Remove(kvm.ImagePath(image.ID) + ".tmp")
+		os.Remove(kvm.ImagePath(image.ID))
+	}
+	if tmpl := lxc.FindTemplate(req.TemplateID); tmpl != nil {
+		go cleanupLXCImageDownloadTemp(tmpl.ID)
+	}
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Cancel requested"})
 }
 
 // HandleImageDelete deletes a cached template image from disk.
@@ -246,6 +443,9 @@ func HandleImageDelete(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "image:delete") {
+		return
+	}
 
 	var req struct {
 		TemplateID string `json:"template_id"`
@@ -254,6 +454,10 @@ func HandleImageDelete(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "template_id required"})
 		return
 	}
+	if isImageDownloadActive(req.TemplateID) {
+		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "Image is downloading; cancel it before deleting"})
+		return
+	}
 
 	tmpl := lxc.FindTemplate(req.TemplateID)
 	if tmpl == nil {
@@ -292,6 +496,9 @@ func HandleImageToggle(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "image:toggle") {
+		return
+	}
 
 	var req struct {
 		TemplateID string `json:"template_id"`
@@ -318,6 +525,9 @@ func HandleEnabledImages(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "image:read") {
+		return
+	}
 
 	runtime := runtimeFromRequest(r.URL.Query().Get("type"))
 	enabledSet := getEnabledImageSet()
@@ -328,7 +538,7 @@ func HandleEnabledImages(w http.ResponseWriter, r *http.Request) {
 			if downloaded, _ := kvm.ImageDownloadedInfo(t.ID); enabledSet[t.ID] && downloaded {
 				result = append(result, map[string]string{
 					"id": t.ID, "name": t.Name, "distro": t.Distro, "release": t.Release, "arch": t.Arch,
-					"description": t.Description, "type": config.VirtualizationKVM,
+					"description": t.Description, "type": config.VirtualizationKVM, "desktop": t.Desktop,
 				})
 			}
 		}

backend/internal/api/ipv6.go

@@ -7,6 +7,9 @@ func HandleIPv6Status(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "ipv6:read") {
+		return
+	}
 	status := lxcManager.DetectIPv6Status()
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: status})
 }

backend/internal/api/origins.go

@@ -0,0 +1,80 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"clicd/internal/config"
+)
+
+type webSSHOriginSettingsRequest struct {
+	Origins              []string `json:"origins"`
+	WebSSHAllowedOrigins []string `json:"webssh_allowed_origins"`
+}
+
+type webSSHOriginSettingsResponse struct {
+	Origins       []string `json:"origins"`
+	CurrentOrigin string   `json:"current_origin,omitempty"`
+}
+
+func HandleWebSSHOriginSettings(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: webSSHOriginSettingsStatus(r)})
+	case http.MethodPut:
+		updateWebSSHOriginSettings(w, r)
+	default:
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+	}
+}
+
+func updateWebSSHOriginSettings(w http.ResponseWriter, r *http.Request) {
+	var req webSSHOriginSettingsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+	origins := req.Origins
+	if len(origins) == 0 && len(req.WebSSHAllowedOrigins) > 0 {
+		origins = req.WebSSHAllowedOrigins
+	}
+	normalized, err := config.NormalizeAllowedOrigins(origins)
+	if err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	config.AppConfig.WebSSHAllowedOrigins = normalized
+	if err := config.SaveConfig(); err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Save Origin allowlist failed"})
+		return
+	}
+	auditRequest(r, "settings.webssh_origins", "WebSSH Origin", "origins="+strings.Join(normalized, ","), true, "")
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Origin allowlist saved", Data: webSSHOriginSettingsStatus(r)})
+}
+
+func webSSHOriginSettingsStatus(r *http.Request) webSSHOriginSettingsResponse {
+	origins := config.AppConfig.WebSSHAllowedOrigins
+	if origins == nil {
+		origins = []string{}
+	}
+	return webSSHOriginSettingsResponse{
+		Origins:       origins,
+		CurrentOrigin: requestOrigin(r),
+	}
+}
+
+func requestOrigin(r *http.Request) string {
+	host := strings.TrimSpace(r.Host)
+	if host == "" {
+		return ""
+	}
+	scheme := "http"
+	if r.TLS != nil {
+		scheme = "https"
+	}
+	if forwarded := strings.TrimSpace(r.Header.Get("X-Forwarded-Proto")); forwarded != "" {
+		scheme = strings.ToLower(strings.Split(forwarded, ",")[0])
+	}
+	return scheme + "://" + host
+}

backend/internal/api/routing.go

@@ -1,7 +1,9 @@
 package api
 
 import (
+	"encoding/json"
 	"net/http"
+	"net/netip"
 	"sort"
 	"strconv"
 
@@ -21,12 +23,24 @@ type nat4Route struct {
 	LXCName       string `json:"lxc_name"`
 	Status        string `json:"status"`
 	IP            string `json:"ip"`
+	HostIP        string `json:"host_ip"`
 	HostPort      int    `json:"host_port"`
 	ContainerPort int    `json:"container_port"`
 	Protocol      string `json:"protocol"`
 	Description   string `json:"description"`
 }
 
+type ipv4Route struct {
+	ContainerID   int    `json:"container_id"`
+	ContainerName string `json:"container_name"`
+	LXCName       string `json:"lxc_name"`
+	Status        string `json:"status"`
+	Address       string `json:"address"`
+	Interface     string `json:"interface"`
+	PrefixLen     int    `json:"prefix_len,omitempty"`
+	Gateway       string `json:"gateway,omitempty"`
+}
+
 type ipv6Route struct {
 	ContainerID   int    `json:"container_id"`
 	ContainerName string `json:"container_name"`
@@ -38,27 +52,78 @@ type ipv6Route struct {
 }
 
 type routingResponse struct {
-	NAT4            routeCapacity        `json:"nat4"`
-	IPv6            routeCapacity        `json:"ipv6"`
-	NAT4Mappings    []nat4Route          `json:"nat4_mappings"`
-	IPv6Assignments []ipv6Route          `json:"ipv6_assignments"`
-	IPv6Prefixes    []lxc.IPv6PrefixInfo `json:"ipv6_prefixes"`
+	NAT4                routeCapacity        `json:"nat4"`
+	IPv4                routeCapacity        `json:"ipv4"`
+	IPv6                routeCapacity        `json:"ipv6"`
+	HostPublicIPv4      lxc.PublicIPInfo     `json:"host_public_ipv4"`
+	PublicIPv4Addresses []lxc.PublicIPInfo   `json:"public_ipv4_addresses"`
+	IPv4Assignments     []ipv4Route          `json:"ipv4_assignments"`
+	NAT4Mappings        []nat4Route          `json:"nat4_mappings"`
+	IPv6Assignments     []ipv6Route          `json:"ipv6_assignments"`
+	IPv6Prefixes        []lxc.IPv6PrefixInfo `json:"ipv6_prefixes"`
+}
+
+type routingPoolsRequest struct {
+	Addresses    *[]string                      `json:"addresses"`
+	Items        *[]config.PublicIPv4Assignment `json:"items"`
+	IPv6Prefixes *[]config.PublicIPv6Prefix     `json:"ipv6_prefixes"`
+}
+
+type publicIPv4ScanRequest struct {
+	CIDR      string `json:"cidr"`
+	Interface string `json:"interface"`
+	Gateway   string `json:"gateway"`
+	Verify    bool   `json:"verify"`
+	Limit     int    `json:"limit"`
 }
 
 func HandleRouting(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
+	switch r.Method {
+	case http.MethodGet:
+		handleRoutingGet(w, r)
+	case http.MethodPut:
+		handleRoutingPoolsUpdate(w, r)
+	default:
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+	}
+}
+
+func HandleRoutingIPv4Scan(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+		return
+	}
+	if !requireScope(w, r, "routing:write") {
+		return
+	}
+	var req publicIPv4ScanRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+	results, err := lxc.ScanPublicIPv4Segment(req.CIDR, req.Interface, req.Gateway, req.Verify, req.Limit)
+	if err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: results})
+}
+
+func handleRoutingGet(w http.ResponseWriter, r *http.Request) {
+	if !requireScope(w, r, "routing:read") {
 		return
 	}
 
 	nat4Mappings := make([]nat4Route, 0)
 	usedPorts := map[int]bool{}
+	ipv4Assignments := make([]ipv4Route, 0)
 	ipv6Assignments := make([]ipv6Route, 0)
 
 	const nat4StartPort = 20000
 	const nat4EndPort = 65535
 
-	for _, c := range config.AppConfig.Containers {
+	for i := range config.AppConfig.Containers {
+		c := &config.AppConfig.Containers[i]
 		for _, pm := range c.PortMappings {
 			if pm.HostPort >= nat4StartPort && pm.HostPort <= nat4EndPort {
 				usedPorts[pm.HostPort] = true
@@ -69,30 +134,56 @@ func HandleRouting(w http.ResponseWriter, r *http.Request) {
 				LXCName:       c.LxcName(),
 				Status:        c.Status,
 				IP:            c.IP,
+				HostIP:        pm.HostIP,
 				HostPort:      pm.HostPort,
 				ContainerPort: pm.ContainerPort,
 				Protocol:      pm.Protocol,
 				Description:   pm.Description,
 			})
 		}
-		if c.IPv6 != "" {
+		for _, ip := range c.PublicIPv4s {
+			if ip.Address == "" {
+				continue
+			}
+			ipv4Assignments = append(ipv4Assignments, ipv4Route{
+				ContainerID:   c.ID,
+				ContainerName: c.Name,
+				LXCName:       c.LxcName(),
+				Status:        c.Status,
+				Address:       ip.Address,
+				Interface:     ip.Interface,
+				PrefixLen:     ip.PrefixLen,
+				Gateway:       ip.Gateway,
+			})
+		}
+		c.NormalizeNetworkAssignments()
+		for _, ip := range c.IPv6Addresses {
+			if ip.Address == "" {
+				continue
+			}
 			ipv6Assignments = append(ipv6Assignments, ipv6Route{
 				ContainerID:   c.ID,
 				ContainerName: c.Name,
 				LXCName:       c.LxcName(),
 				Status:        c.Status,
-				Address:       c.IPv6,
-				PrefixLen:     c.IPv6PrefixLen,
-				Interface:     c.IPv6Interface,
+				Address:       ip.Address,
+				PrefixLen:     ip.PrefixLen,
+				Interface:     ip.Interface,
 			})
 		}
 	}
 	sort.SliceStable(nat4Mappings, func(i, j int) bool {
 		if nat4Mappings[i].HostPort == nat4Mappings[j].HostPort {
+			if nat4Mappings[i].HostIP != nat4Mappings[j].HostIP {
+				return nat4Mappings[i].HostIP < nat4Mappings[j].HostIP
+			}
 			return nat4Mappings[i].ContainerName < nat4Mappings[j].ContainerName
 		}
 		return nat4Mappings[i].HostPort < nat4Mappings[j].HostPort
 	})
+	sort.SliceStable(ipv4Assignments, func(i, j int) bool {
+		return ipv4Assignments[i].Address < ipv4Assignments[j].Address
+	})
 	sort.SliceStable(ipv6Assignments, func(i, j int) bool {
 		return ipv6Assignments[i].Address < ipv6Assignments[j].Address
 	})
@@ -105,12 +196,16 @@ func HandleRouting(w http.ResponseWriter, r *http.Request) {
 	}
 
 	prefixes := lxc.DetectPublicIPv6Prefixes()
-	ipv6Total := "0"
-	ipv6Remaining := "0"
-	if len(prefixes) > 0 {
-		ipv6Total = lxc.IPv6PrefixCapacity(prefixes[0].PrefixLen)
-		ipv6Remaining = subtractCapacity(ipv6Total, len(ipv6Assignments))
+	hostPublicIPv4 := lxc.DetectPublicIPv4()
+	publicIPv4s := lxc.DetectPublicIPv4Candidates()
+	ipv4Total := len(publicIPv4s)
+	ipv4Used := len(ipv4Assignments)
+	ipv4Remaining := ipv4Total - ipv4Used
+	if ipv4Remaining < 0 {
+		ipv4Remaining = 0
 	}
+	ipv6Total := totalIPv6Capacity(prefixes)
+	ipv6Remaining := subtractCapacity(ipv6Total, len(ipv6Assignments))
 
 	jsonResponse(w, http.StatusOK, APIResponse{
 		Success: true,
@@ -120,18 +215,143 @@ func HandleRouting(w http.ResponseWriter, r *http.Request) {
 				Remaining: strconv.Itoa(nat4Remaining),
 				Total:     strconv.Itoa(totalNAT4Ports),
 			},
+			IPv4: routeCapacity{
+				Used:      ipv4Used,
+				Remaining: strconv.Itoa(ipv4Remaining),
+				Total:     strconv.Itoa(ipv4Total),
+			},
 			IPv6: routeCapacity{
 				Used:      len(ipv6Assignments),
 				Remaining: ipv6Remaining,
 				Total:     ipv6Total,
 			},
-			NAT4Mappings:    nat4Mappings,
-			IPv6Assignments: ipv6Assignments,
-			IPv6Prefixes:    prefixes,
+			HostPublicIPv4:      hostPublicIPv4,
+			PublicIPv4Addresses: publicIPv4s,
+			IPv4Assignments:     ipv4Assignments,
+			NAT4Mappings:        nat4Mappings,
+			IPv6Assignments:     ipv6Assignments,
+			IPv6Prefixes:        prefixes,
 		},
 	})
 }
 
+func handleRoutingPoolsUpdate(w http.ResponseWriter, r *http.Request) {
+	if !requireScope(w, r, "routing:write") {
+		return
+	}
+	var req routingPoolsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+
+	if req.Items != nil || req.Addresses != nil {
+		items := []config.PublicIPv4Assignment{}
+		if req.Items != nil {
+			items = *req.Items
+		} else if req.Addresses != nil {
+			items = make([]config.PublicIPv4Assignment, 0, len(*req.Addresses))
+			for _, address := range *req.Addresses {
+				items = append(items, config.PublicIPv4Assignment{Address: address})
+			}
+		}
+		normalized, err := lxc.NormalizePublicIPv4Pool(items)
+		if err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+			return
+		}
+		allowed := map[string]bool{}
+		for _, item := range normalized {
+			allowed[item.Address] = true
+		}
+		for _, c := range config.AppConfig.Containers {
+			for _, item := range c.PublicIPv4s {
+				if item.Address != "" && !allowed[item.Address] {
+					jsonResponse(w, http.StatusBadRequest, APIResponse{
+						Success: false,
+						Message: "IPv4 " + item.Address + " is assigned to container " + c.Name + " and cannot be removed from the pool",
+					})
+					return
+				}
+			}
+		}
+		config.AppConfig.PublicIPv4Pool = normalized
+	}
+
+	if req.IPv6Prefixes != nil {
+		normalized, err := lxc.NormalizePublicIPv6Prefixes(*req.IPv6Prefixes)
+		if err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+			return
+		}
+		parsedPrefixes := make([]netip.Prefix, 0, len(normalized))
+		for _, item := range normalized {
+			prefix, err := netip.ParsePrefix(item.Prefix)
+			if err == nil {
+				parsedPrefixes = append(parsedPrefixes, prefix)
+			}
+		}
+		for _, c := range config.AppConfig.Containers {
+			c.NormalizeNetworkAssignments()
+			for _, item := range c.IPv6Addresses {
+				if item.Address == "" {
+					continue
+				}
+				addr, err := netip.ParseAddr(item.Address)
+				if err != nil {
+					continue
+				}
+				contained := false
+				for _, prefix := range parsedPrefixes {
+					if prefix.Contains(addr) {
+						contained = true
+						break
+					}
+				}
+				if !contained {
+					jsonResponse(w, http.StatusBadRequest, APIResponse{
+						Success: false,
+						Message: "IPv6 " + item.Address + " is assigned to container " + c.Name + " and cannot be removed from the pool",
+					})
+					return
+				}
+			}
+		}
+		config.AppConfig.PublicIPv6Prefixes = normalized
+	}
+
+	if err := config.SaveConfig(); err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to save configuration"})
+		return
+	}
+	handleRoutingGet(w, r)
+}
+
+func totalIPv6Capacity(prefixes []lxc.IPv6PrefixInfo) string {
+	if len(prefixes) == 0 {
+		return "0"
+	}
+	var total uint64
+	for _, prefix := range prefixes {
+		capacity := lxc.IPv6PrefixCapacity(prefix.PrefixLen)
+		if capacity == "large" {
+			return "large"
+		}
+		parsed, err := strconv.ParseUint(capacity, 10, 64)
+		if err != nil {
+			continue
+		}
+		if ^uint64(0)-total < parsed {
+			return "large"
+		}
+		total += parsed
+	}
+	if total == 0 {
+		return "0"
+	}
+	return strconv.FormatUint(total, 10)
+}
+
 func subtractCapacity(total string, used int) string {
 	if total == "" || total == "0" {
 		return "0"

backend/internal/api/runtime.go

@@ -13,10 +13,16 @@ import (
 
 var kvmManager = kvm.NewManager()
 
+const noNetworkSelectedMessage = "请勾选任意一个可用网络"
+
 func runtimeFromRequest(value string) string {
 	return config.NormalizeVirtualization(value)
 }
 
+func hasRequestedNetwork(cfg lxc.ContainerConfig) bool {
+	return cfg.WantsNAT() || cfg.AssignIPv4 || len(cfg.PublicIPv4s) > 0 || cfg.AssignIPv6 || len(cfg.IPv6Addresses) > 0
+}
+
 func runtimeFromTemplateID(templateID string) string {
 	if kvm.FindImage(templateID) != nil {
 		return config.VirtualizationKVM
@@ -72,12 +78,12 @@ func reinstallByRuntime(id int, templateID string) error {
 	return lxcManager.ReinstallContainer(id, templateID)
 }
 
-func resetPasswordByRuntime(id int) (string, error) {
+func resetPasswordByRuntime(id int, password string) (string, error) {
 	c := config.FindContainer(id)
 	if c != nil && c.IsKVM() {
-		return kvmManager.ResetSSHPassword(id)
+		return kvmManager.ResetSSHPassword(id, password)
 	}
-	return lxcManager.ResetSSHPassword(id)
+	return lxcManager.ResetSSHPassword(id, password)
 }
 
 func assignIPv6ByRuntime(id int) (*config.Container, error) {

backend/internal/api/security.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
@@ -557,10 +558,10 @@ func countPorts(totalCounts map[int]int, destCounts map[int]map[string]int, port
 
 func (ss *SecurityScanner) addAlert(name, alertType, severity, srcIP, dstIP string, port int, detail, logLine string) {
 	ss.mu.Lock()
-	defer ss.mu.Unlock()
 
 	now := time.Now()
 	cutoff := now.Add(-5 * time.Minute)
+	shouldShutdown := false
 
 	for i := range ss.alerts {
 		a := &ss.alerts[i]
@@ -579,6 +580,11 @@ func (ss *SecurityScanner) addAlert(name, alertType, severity, srcIP, dstIP stri
 		if severityRank(severity) > severityRank(a.Severity) {
 			a.Severity = severity
 		}
+		shouldShutdown = config.AppConfig.SecurityAutoShutdown
+		ss.mu.Unlock()
+		if shouldShutdown {
+			autoShutdownAlertContainer(name, alertType, severity)
+		}
 		return
 	}
 
@@ -599,10 +605,16 @@ func (ss *SecurityScanner) addAlert(name, alertType, severity, srcIP, dstIP stri
 
 	ss.alerts = append(ss.alerts, alert)
 	config.AddAuditLog("security_"+alertType, name, fmt.Sprintf("[%s] %s", severity, detail), "system")
+	shouldShutdown = config.AppConfig.SecurityAutoShutdown
 
 	if len(ss.alerts) > 200 {
 		ss.alerts = ss.alerts[len(ss.alerts)-200:]
 	}
+	ss.mu.Unlock()
+
+	if shouldShutdown {
+		autoShutdownAlertContainer(name, alertType, severity)
+	}
 }
 
 func severityRank(severity string) int {
@@ -620,26 +632,68 @@ func severityRank(severity string) int {
 	}
 }
 
+func autoShutdownAlertContainer(containerName, alertType, severity string) {
+	c := config.FindContainerByName(containerName)
+	if c == nil || c.Status != "running" {
+		return
+	}
+	reason := fmt.Sprintf("%s 告警触发策略临时封禁", alertType)
+	if severity != "" {
+		reason = fmt.Sprintf("[%s] %s", severity, reason)
+	}
+	config.SetContainerPolicyBlock(c.ID, true, reason)
+	taskID, queued := globalQueue.EnqueueSecurityStop(c.ID, c.Name)
+	if queued {
+		config.AddAuditLog("security_auto_shutdown", c.Name, fmt.Sprintf("[%s] %s 告警触发自动关机任务 %s", severity, alertType, taskID), "system")
+	}
+}
+
 // HandleSecurityAlerts returns all security alerts.
 func HandleSecurityAlerts(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
-
-	ss := ensureScanner()
-	ss.mu.Lock()
-	reversed := make([]SecurityAlert, len(ss.alerts))
-	for i, a := range ss.alerts {
-		reversed[len(ss.alerts)-1-i] = a
-	}
-	ss.mu.Unlock()
-
-	if reversed == nil {
-		reversed = []SecurityAlert{}
+	if !requireScope(w, r, "security:read") {
+		return
 	}
 
-	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: reversed})
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: filterSecurityAlertsForRequest(r, mergedSecurityAlerts())})
+}
+
+// HandleSecuritySettings returns or updates security automation settings.
+func HandleSecuritySettings(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		if !requireScope(w, r, "security:read") {
+			return
+		}
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: map[string]bool{
+			"auto_shutdown": config.AppConfig.SecurityAutoShutdown,
+		}})
+	case http.MethodPut:
+		if !requireScope(w, r, "security:settings") {
+			return
+		}
+		var req struct {
+			AutoShutdown bool `json:"auto_shutdown"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+			return
+		}
+		config.AppConfig.SecurityAutoShutdown = req.AutoShutdown
+		if err := config.SaveConfig(); err != nil {
+			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: err.Error()})
+			return
+		}
+		auditRequest(r, "security.settings", "auto_shutdown", fmt.Sprintf("auto_shutdown=%v", req.AutoShutdown), true, "")
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: map[string]bool{
+			"auto_shutdown": config.AppConfig.SecurityAutoShutdown,
+		}})
+	default:
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+	}
 }
 
 // HandleSecurityCheck triggers immediate security check for a container.
@@ -648,6 +702,9 @@ func HandleSecurityCheck(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "security:check") {
+		return
+	}
 
 	var req struct {
 		ContainerName string `json:"container_name"`
@@ -662,6 +719,10 @@ func HandleSecurityCheck(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Container not found or not running"})
 		return
 	}
+	if !isContainerAllowedForRequest(r, c.UUID) {
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to this container"})
+		return
+	}
 
 	ensureScanner().checkContainer(c.Name, c.IP)
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Security check completed"})
@@ -673,6 +734,9 @@ func HandleSecurityLogs(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "security:read") {
+		return
+	}
 
 	containerName := r.URL.Query().Get("container")
 	if containerName == "" {
@@ -685,6 +749,10 @@ func HandleSecurityLogs(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: []map[string]interface{}{}})
 		return
 	}
+	if !isContainerAllowedForRequest(r, c.UUID) {
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to this container"})
+		return
+	}
 
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: getConnectionLogs(c.IP)})
 }
@@ -737,14 +805,16 @@ func HandleContainerSecuritySummary(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "security:read") {
+		return
+	}
 
-	ss := ensureScanner()
-	ss.mu.Lock()
 	critical := 0
 	high := 0
 	medium := 0
 	low := 0
-	for _, a := range ss.alerts {
+	alerts := filterSecurityAlertsForRequest(r, mergedSecurityAlerts())
+	for _, a := range alerts {
 		switch a.Severity {
 		case "critical":
 			critical++
@@ -756,8 +826,7 @@ func HandleContainerSecuritySummary(w http.ResponseWriter, r *http.Request) {
 			low++
 		}
 	}
-	total := len(ss.alerts)
-	ss.mu.Unlock()
+	total := len(alerts)
 
 	summary := map[string]interface{}{
 		"total_alerts": total,
@@ -769,3 +838,131 @@ func HandleContainerSecuritySummary(w http.ResponseWriter, r *http.Request) {
 
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: summary})
 }
+
+func filterSecurityAlertsForRequest(r *http.Request, alerts []SecurityAlert) []SecurityAlert {
+	allowed, restricted := requestAllowedContainers(r)
+	if !restricted {
+		return alerts
+	}
+	filtered := make([]SecurityAlert, 0, len(alerts))
+	for _, alert := range alerts {
+		if c := config.FindContainerByName(alert.ContainerName); c != nil && isContainerAllowed(allowed, c) {
+			filtered = append(filtered, alert)
+		}
+	}
+	return filtered
+}
+
+func mergedSecurityAlerts() []SecurityAlert {
+	ss := ensureScanner()
+	ss.mu.Lock()
+	alerts := make([]SecurityAlert, len(ss.alerts))
+	copy(alerts, ss.alerts)
+	ss.mu.Unlock()
+
+	seen := make(map[string]bool)
+	for _, alert := range alerts {
+		seen[securityAlertKey(alert)] = true
+	}
+
+	for i, log := range config.AppConfig.AuditLogs {
+		alert, ok := alertFromSecurityAuditLog(log, i)
+		if !ok {
+			continue
+		}
+		key := securityAlertKey(alert)
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		alerts = append(alerts, alert)
+	}
+
+	sort.SliceStable(alerts, func(i, j int) bool {
+		ti, errI := time.Parse("2006-01-02 15:04:05", alerts[i].Timestamp)
+		tj, errJ := time.Parse("2006-01-02 15:04:05", alerts[j].Timestamp)
+		if errI == nil && errJ == nil && !ti.Equal(tj) {
+			return ti.After(tj)
+		}
+		return alerts[i].Timestamp > alerts[j].Timestamp
+	})
+
+	if len(alerts) > 200 {
+		alerts = alerts[:200]
+	}
+	if alerts == nil {
+		return []SecurityAlert{}
+	}
+	return alerts
+}
+
+func securityAlertKey(alert SecurityAlert) string {
+	return strings.Join([]string{
+		alert.Timestamp,
+		alert.ContainerName,
+		alert.Type,
+		alert.Detail,
+		strconv.Itoa(alert.TargetPort),
+	}, "\x1f")
+}
+
+func alertFromSecurityAuditLog(log config.AuditLog, index int) (SecurityAlert, bool) {
+	if !strings.HasPrefix(log.Action, "security_") || log.Action == "security_auto_shutdown" || log.Action == "security_policy_unblock" {
+		return SecurityAlert{}, false
+	}
+	alertType := strings.TrimPrefix(log.Action, "security_")
+	severity, detail := parseSecurityAuditDetail(log.Detail)
+	targetPort := parseDetailPort(detail)
+
+	targetIP := ""
+	if targetPort > 0 || alertType == "horizontal_scan" || alertType == "brute_force" {
+		targetIP = "*"
+	}
+
+	return SecurityAlert{
+		ID:            fmt.Sprintf("audit-security-%d", index),
+		ContainerName: log.Target,
+		Type:          alertType,
+		Severity:      severity,
+		SourceIP:      "",
+		TargetIP:      targetIP,
+		TargetPort:    targetPort,
+		Detail:        detail,
+		LogLine:       "",
+		Timestamp:     log.Time,
+		Count:         1,
+	}, true
+}
+
+func parseSecurityAuditDetail(detail string) (string, string) {
+	severity := "medium"
+	if strings.HasPrefix(detail, "[") {
+		if end := strings.Index(detail, "]"); end > 1 {
+			severity = detail[1:end]
+			detail = strings.TrimSpace(detail[end+1:])
+		}
+	}
+	return severity, detail
+}
+
+func parseDetailPort(detail string) int {
+	for _, marker := range []string{"端口 ", "端口"} {
+		idx := strings.Index(detail, marker)
+		if idx == -1 {
+			continue
+		}
+		start := idx + len(marker)
+		for start < len(detail) && (detail[start] == ' ' || detail[start] == ':' || detail[start] == '(') {
+			start++
+		}
+		end := start
+		for end < len(detail) && detail[end] >= '0' && detail[end] <= '9' {
+			end++
+		}
+		if end > start {
+			port, _ := strconv.Atoi(detail[start:end])
+			return port
+		}
+	}
+	return 0
+}

backend/internal/api/settings.go

@@ -20,6 +20,34 @@ type LoginLog struct {
 
 var loginLogs = make([]LoginLog, 0)
 
+// HandleLanguage returns or updates the global panel language.
+func HandleLanguage(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: map[string]string{
+			"language": config.NormalizeLanguage(config.AppConfig.Language),
+		}})
+	case http.MethodPost, http.MethodPut:
+		var req struct {
+			Language string `json:"language"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+			return
+		}
+		config.AppConfig.Language = config.NormalizeLanguage(req.Language)
+		if err := config.SaveConfig(); err != nil {
+			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to save language"})
+			return
+		}
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: map[string]string{
+			"language": config.AppConfig.Language,
+		}})
+	default:
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+	}
+}
+
 // RecordLoginLog adds a login attempt to the log (persisted to config)
 func RecordLoginLog(username, ip, userAgent string, success bool) {
 	config.AddLoginLog(username, ip, userAgent, success)
@@ -56,6 +84,9 @@ func HandleLoginLogs(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "loginlog:read") {
+		return
+	}
 
 	// Return in reverse (newest first)
 	reversed := make([]LoginLog, len(loginLogs))

backend/internal/api/snapshots.go

@@ -16,7 +16,11 @@ func HandleSnapshots(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "snapshot:read") {
+		return
+	}
 	snapshots := append([]config.Snapshot(nil), config.AppConfig.Snapshots...)
+	snapshots = filterSnapshotsForRequest(r, snapshots)
 	sortSnapshotsNewestFirst(snapshots)
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: snapshots})
 }
@@ -24,17 +28,35 @@ func HandleSnapshots(w http.ResponseWriter, r *http.Request) {
 func handleContainerSnapshots(w http.ResponseWriter, r *http.Request, containerID int, action string) {
 	switch {
 	case action == "snapshots" && r.Method == http.MethodGet:
+		if !requireScope(w, r, "snapshot:read") {
+			return
+		}
 		listContainerSnapshots(w, r, containerID)
 	case action == "snapshots" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "snapshot:create") {
+			return
+		}
 		createContainerSnapshot(w, r, containerID)
 	case action == "snapshots/schedule" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "snapshot:schedule") {
+			return
+		}
 		updateSnapshotSchedule(w, r, containerID)
 	case action == "snapshots/quota" && r.Method == http.MethodPut:
+		if !requireScope(w, r, "snapshot:schedule") {
+			return
+		}
 		updateSnapshotQuota(w, r, containerID)
 	case strings.HasPrefix(action, "snapshots/") && strings.HasSuffix(action, "/restore") && r.Method == http.MethodPost:
+		if !requireScope(w, r, "snapshot:restore") {
+			return
+		}
 		snapshotID := strings.TrimSuffix(strings.TrimPrefix(action, "snapshots/"), "/restore")
 		restoreContainerSnapshot(w, r, containerID, snapshotID)
 	case strings.HasPrefix(action, "snapshots/") && r.Method == http.MethodDelete:
+		if !requireScope(w, r, "snapshot:delete") {
+			return
+		}
 		snapshotID := strings.TrimPrefix(action, "snapshots/")
 		deleteContainerSnapshot(w, r, containerID, snapshotID)
 	default:
@@ -186,15 +208,7 @@ func restoreContainerSnapshot(w http.ResponseWriter, r *http.Request, containerI
 }
 
 func requestUser(r *http.Request) string {
-	if claims, ok := claimsFromRequest(r); ok {
-		if subUser, _ := claims["sub_user"].(string); subUser != "" {
-			return "user:" + subUser
-		}
-		if username, _ := claims["username"].(string); username != "" {
-			return username
-		}
-	}
-	return "admin"
+	return requestActor(r)
 }
 
 func sortSnapshotsNewestFirst(snapshots []config.Snapshot) {
@@ -204,3 +218,17 @@ func sortSnapshotsNewestFirst(snapshots []config.Snapshot) {
 		return tj.Before(ti)
 	})
 }
+
+func filterSnapshotsForRequest(r *http.Request, snapshots []config.Snapshot) []config.Snapshot {
+	allowed, restricted := requestAllowedContainers(r)
+	if !restricted {
+		return snapshots
+	}
+	filtered := make([]config.Snapshot, 0, len(snapshots))
+	for _, snapshot := range snapshots {
+		if c := config.FindContainer(snapshot.ContainerID); c != nil && isContainerAllowed(allowed, c) {
+			filtered = append(filtered, snapshot)
+		}
+	}
+	return filtered
+}

backend/internal/api/ssh.go

@@ -27,6 +27,7 @@ type terminalResizeMessage struct {
 
 type webSSHTicket struct {
 	ContainerName string
+	SubUser       bool
 	ExpiresAt     time.Time
 }
 
@@ -41,6 +42,9 @@ func HandleWebSSHTicket(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if !requireScope(w, r, "terminal:ssh") {
+		return
+	}
 	var req struct {
 		ContainerName string `json:"container_name"`
 	}
@@ -52,16 +56,22 @@ func HandleWebSSHTicket(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to this container"})
 		return
 	}
-	if config.FindContainerByName(req.ContainerName) == nil {
+	c := config.FindContainerByName(req.ContainerName)
+	if c == nil {
 		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Container not found"})
 		return
 	}
+	if isSubUserRequest(r) && c.PolicyBlocked {
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: policyBlockedMessage(c)})
+		return
+	}
 
 	ticket := randomHex(32)
 	webSSHTickets.Lock()
 	cleanupExpiredWebSSHTicketsLocked(time.Now())
 	webSSHTickets.items[ticket] = webSSHTicket{
 		ContainerName: req.ContainerName,
+		SubUser:       isSubUserRequest(r),
 		ExpiresAt:     time.Now().Add(60 * time.Second),
 	}
 	webSSHTickets.Unlock()
@@ -86,7 +96,8 @@ func HandleWebSSH(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !consumeWebSSHTicket(ticket, containerName) {
+	item, ok := consumeWebSSHTicket(ticket, containerName)
+	if !ok {
 		http.Error(w, "invalid or expired ticket", http.StatusUnauthorized)
 		return
 	}
@@ -96,6 +107,10 @@ func HandleWebSSH(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "container not found", http.StatusNotFound)
 		return
 	}
+	if item.SubUser && c.PolicyBlocked {
+		http.Error(w, "虚拟机被策略临时封禁", http.StatusForbidden)
+		return
+	}
 	if c.Status != "running" {
 		http.Error(w, "container is not running", http.StatusBadRequest)
 		return
@@ -359,17 +374,17 @@ func writeWebSocketText(ws *websocket.Conn, writeMu *sync.Mutex, msg string) {
 	_ = ws.WriteMessage(websocket.TextMessage, []byte(msg))
 }
 
-func consumeWebSSHTicket(ticket, containerName string) bool {
+func consumeWebSSHTicket(ticket, containerName string) (webSSHTicket, bool) {
 	now := time.Now()
 	webSSHTickets.Lock()
 	defer webSSHTickets.Unlock()
 	cleanupExpiredWebSSHTicketsLocked(now)
 	item, ok := webSSHTickets.items[ticket]
 	if !ok {
-		return false
+		return webSSHTicket{}, false
 	}
 	delete(webSSHTickets.items, ticket)
-	return item.ContainerName == containerName && now.Before(item.ExpiresAt)
+	return item, item.ContainerName == containerName && now.Before(item.ExpiresAt)
 }
 
 func cleanupExpiredWebSSHTicketsLocked(now time.Time) {

backend/internal/api/ssl.go

@@ -0,0 +1,587 @@
+package api
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"math/big"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"strings"
+	"time"
+
+	"clicd/internal/config"
+)
+
+type sslSettingsRequest struct {
+	Enabled  bool   `json:"enabled"`
+	Mode     string `json:"mode"`
+	Target   string `json:"target"`
+	Email    string `json:"email"`
+	CertPEM  string `json:"cert_pem"`
+	KeyPEM   string `json:"key_pem"`
+	ApplyNow bool   `json:"apply_now"`
+}
+
+type sslCertificateInfo struct {
+	Subject   string   `json:"subject"`
+	Issuer    string   `json:"issuer"`
+	DNSNames  []string `json:"dns_names"`
+	IPNames   []string `json:"ip_names"`
+	NotBefore string   `json:"not_before"`
+	NotAfter  string   `json:"not_after"`
+	Valid     bool     `json:"valid"`
+}
+
+type sslSavedCertificateStatus struct {
+	config.SSLConfig
+	Certificate *sslCertificateInfo `json:"certificate,omitempty"`
+}
+
+type sslSettingsResponse struct {
+	config.SSLConfig
+	DetectedHost     string                               `json:"detected_host"`
+	Certificate      *sslCertificateInfo                  `json:"certificate,omitempty"`
+	ModeCertificates map[string]sslSavedCertificateStatus `json:"mode_certificates"`
+	NeedsRestart     bool                                 `json:"needs_restart,omitempty"`
+}
+
+func HandleSSLSettings(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: sslSettingsStatus(r, false)})
+	case http.MethodPut:
+		updateSSLSettings(w, r)
+	default:
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+	}
+}
+
+func updateSSLSettings(w http.ResponseWriter, r *http.Request) {
+	var req sslSettingsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+
+	mode := config.NormalizeSSLMode(req.Mode)
+	if !req.Enabled || mode == config.SSLModeDisabled {
+		saveCurrentSSLSlot()
+		config.AppConfig.SSL = config.SSLConfig{Enabled: false, Mode: config.SSLModeDisabled}
+		if err := config.SaveConfig(); err != nil {
+			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Save SSL settings failed"})
+			return
+		}
+		restartIfRequested(req.ApplyNow)
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "SSL disabled", Data: sslSettingsStatus(r, true)})
+		return
+	}
+
+	target := strings.TrimSpace(req.Target)
+	if target == "" {
+		target = detectedRequestHost(r)
+	}
+	normalizedTarget, err := config.NormalizeSSLCertificateTarget(target)
+	if err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	target = normalizedTarget
+
+	next, err := resolveSSLModeCertificate(mode, target, strings.TrimSpace(req.Email), req.CertPEM, req.KeyPEM)
+	if err != nil {
+		_ = config.SaveConfig()
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error(), Data: sslSettingsStatus(r, false)})
+		return
+	}
+
+	if err := validateCertificatePair(next.CertPath, next.KeyPath); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	next.LastIssuedAt = time.Now().Format(time.RFC3339)
+	next.Enabled = true
+	config.AppConfig.SSL = next
+	saveSSLSlot(next)
+	if err := config.SaveConfig(); err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Save SSL settings failed"})
+		return
+	}
+
+	restartIfRequested(req.ApplyNow)
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "SSL settings saved", Data: sslSettingsStatus(r, true)})
+}
+
+func sslSettingsStatus(r *http.Request, needsRestart bool) sslSettingsResponse {
+	cfg := config.AppConfig.SSL
+	cfg.KeyPath = maskExistingPath(cfg.KeyPath)
+	resp := sslSettingsResponse{
+		SSLConfig:        cfg,
+		DetectedHost:     detectedRequestHost(r),
+		ModeCertificates: sslModeCertificatesStatus(),
+		NeedsRestart:     needsRestart,
+	}
+	if cert, err := readCertificateInfo(config.AppConfig.SSL.CertPath); err == nil {
+		resp.Certificate = cert
+	}
+	return resp
+}
+
+func resolveSSLModeCertificate(mode, target, email, certPEM, keyPEM string) (config.SSLConfig, error) {
+	if config.AppConfig.SSLCertificates == nil {
+		config.AppConfig.SSLCertificates = map[string]config.SSLConfig{}
+	}
+	next := config.AppConfig.SSLCertificates[mode]
+	next.Mode = mode
+	next.Target = target
+	if email != "" || next.Email == "" {
+		next.Email = email
+	}
+
+	var err error
+	switch mode {
+	case config.SSLModeUploaded:
+		if strings.TrimSpace(certPEM) != "" || strings.TrimSpace(keyPEM) != "" {
+			next.CertPath, next.KeyPath, err = saveUploadedCertificate(certPEM, keyPEM)
+		} else if next.CertPath == "" || next.KeyPath == "" {
+			err = fmt.Errorf("certificate and private key are required")
+		} else if !certificateUsable(next.CertPath, next.KeyPath, target) {
+			err = fmt.Errorf("uploaded certificate is expired, invalid, or does not match the target")
+		}
+	case config.SSLModeSelfSigned:
+		if !certificateUsable(next.CertPath, next.KeyPath, target) {
+			next.CertPath, next.KeyPath, err = generateSelfSignedCertificate(target)
+		}
+	case config.SSLModeLetsEncrypt:
+		if !certificateUsable(next.CertPath, next.KeyPath, target) {
+			next.CertPath, next.KeyPath, err = requestLetsEncryptCertificate(target, next.Email)
+		}
+	default:
+		err = fmt.Errorf("unsupported SSL mode")
+	}
+	if err != nil {
+		next.LastError = err.Error()
+		saveSSLSlot(next)
+		return next, err
+	}
+	next.LastError = ""
+	return next, nil
+}
+
+func sslModeCertificatesStatus() map[string]sslSavedCertificateStatus {
+	result := map[string]sslSavedCertificateStatus{}
+	for _, mode := range []string{config.SSLModeLetsEncrypt, config.SSLModeSelfSigned, config.SSLModeUploaded} {
+		cfg := config.AppConfig.SSLCertificates[mode]
+		cfg.KeyPath = maskExistingPath(cfg.KeyPath)
+		status := sslSavedCertificateStatus{SSLConfig: cfg}
+		if cert, err := readCertificateInfo(config.AppConfig.SSLCertificates[mode].CertPath); err == nil {
+			status.Certificate = cert
+		}
+		result[mode] = status
+	}
+	return result
+}
+
+func saveCurrentSSLSlot() {
+	if config.AppConfig.SSL.Mode == config.SSLModeDisabled || config.AppConfig.SSL.CertPath == "" {
+		return
+	}
+	saveSSLSlot(config.AppConfig.SSL)
+}
+
+func saveSSLSlot(ssl config.SSLConfig) {
+	mode := config.NormalizeSSLMode(ssl.Mode)
+	if mode == config.SSLModeDisabled {
+		return
+	}
+	if config.AppConfig.SSLCertificates == nil {
+		config.AppConfig.SSLCertificates = map[string]config.SSLConfig{}
+	}
+	ssl.Mode = mode
+	ssl.Enabled = false
+	config.AppConfig.SSLCertificates[mode] = ssl
+}
+
+func saveUploadedCertificate(certPEM, keyPEM string) (string, string, error) {
+	certPEM = strings.TrimSpace(certPEM)
+	keyPEM = strings.TrimSpace(keyPEM)
+	if certPEM == "" || keyPEM == "" {
+		return "", "", fmt.Errorf("certificate and private key are required")
+	}
+	if _, err := tls.X509KeyPair([]byte(certPEM), []byte(keyPEM)); err != nil {
+		return "", "", fmt.Errorf("certificate/private key mismatch: %v", err)
+	}
+	certPath, keyPath, err := config.UploadedSSLPaths()
+	if err != nil {
+		return "", "", err
+	}
+	if err := os.WriteFile(certPath, []byte(certPEM+"\n"), 0600); err != nil {
+		return "", "", err
+	}
+	if err := os.WriteFile(keyPath, []byte(keyPEM+"\n"), 0600); err != nil {
+		return "", "", err
+	}
+	return certPath, keyPath, nil
+}
+
+func generateSelfSignedCertificate(target string) (string, string, error) {
+	target = strings.TrimSpace(target)
+	normalizedTarget, err := config.NormalizeSSLCertificateTarget(target)
+	if err != nil {
+		return "", "", err
+	}
+	target = normalizedTarget
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return "", "", err
+	}
+	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	if err != nil {
+		return "", "", err
+	}
+	now := time.Now()
+	tpl := x509.Certificate{
+		SerialNumber: serial,
+		Subject: pkix.Name{
+			CommonName: target,
+		},
+		NotBefore:             now.Add(-time.Hour),
+		NotAfter:              now.AddDate(1, 0, 0),
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+	}
+	if ip := net.ParseIP(target); ip != nil {
+		tpl.IPAddresses = []net.IP{ip}
+	} else {
+		tpl.DNSNames = []string{target}
+	}
+	der, err := x509.CreateCertificate(rand.Reader, &tpl, &tpl, &key.PublicKey, key)
+	if err != nil {
+		return "", "", err
+	}
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return "", "", err
+	}
+	certPath, keyPath, err := config.SelfSignedSSLPaths()
+	if err != nil {
+		return "", "", err
+	}
+	certOut := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	keyOut := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
+	if err := os.WriteFile(certPath, certOut, 0600); err != nil {
+		return "", "", err
+	}
+	if err := os.WriteFile(keyPath, keyOut, 0600); err != nil {
+		return "", "", err
+	}
+	return certPath, keyPath, nil
+}
+
+func requestLetsEncryptCertificate(target, email string) (string, string, error) {
+	if _, err := exec.LookPath("certbot"); err != nil {
+		return "", "", fmt.Errorf("certbot is not installed on this server")
+	}
+	target = strings.TrimSpace(target)
+	normalizedTarget, err := config.NormalizeSSLCertificateTarget(target)
+	if err != nil {
+		return "", "", err
+	}
+	target = normalizedTarget
+	args := []string{"certonly", "--non-interactive", "--agree-tos", "--standalone"}
+	if email != "" {
+		args = append(args, "--email", email)
+	} else {
+		args = append(args, "--register-unsafely-without-email")
+	}
+	if net.ParseIP(target) != nil {
+		if err := ensureCertbotSupportsIPCertificates(); err != nil {
+			return "", "", err
+		}
+		args = append(args, "--preferred-profile", "shortlived", "--ip-address", target)
+	} else {
+		args = append(args, "-d", target)
+	}
+	cmd := exec.Command("certbot", args...)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return "", "", fmt.Errorf("Let's Encrypt request failed: %s", strings.TrimSpace(string(output)))
+	}
+	certPath, keyPath, err := config.LetsEncryptSSLPaths(target)
+	if err != nil {
+		return "", "", err
+	}
+	if _, err := config.ReadableFileStat(certPath); err != nil {
+		return "", "", fmt.Errorf("Let's Encrypt certificate file not found after issuance: %s", certPath)
+	}
+	if _, err := config.ReadableFileStat(keyPath); err != nil {
+		return "", "", fmt.Errorf("Let's Encrypt private key file not found after issuance: %s", keyPath)
+	}
+	return certPath, keyPath, nil
+}
+
+func ensureCertbotSupportsIPCertificates() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "certbot", "--help", "all")
+	output, err := cmd.CombinedOutput()
+	if ctx.Err() == context.DeadlineExceeded {
+		return fmt.Errorf("certbot check timed out")
+	}
+	if err != nil {
+		return fmt.Errorf("certbot capability check failed: %s", strings.TrimSpace(string(output)))
+	}
+	help := string(output)
+	if !strings.Contains(help, "--ip-address") || !strings.Contains(help, "--preferred-profile") {
+		return fmt.Errorf("current certbot does not support IP certificates; install Certbot 5.4+ from snap or another current source")
+	}
+	return nil
+}
+
+func validateCertificatePair(certPath, keyPath string) error {
+	safeCertPath, err := config.ResolveSSLPath(certPath)
+	if err != nil {
+		return err
+	}
+	safeKeyPath, err := config.ResolveSSLPath(keyPath)
+	if err != nil {
+		return err
+	}
+	certPEM, err := os.ReadFile(safeCertPath)
+	if err != nil {
+		return err
+	}
+	keyPEM, err := os.ReadFile(safeKeyPath)
+	if err != nil {
+		return err
+	}
+	if _, err := tls.X509KeyPair(certPEM, keyPEM); err != nil {
+		return fmt.Errorf("certificate/private key mismatch: %v", err)
+	}
+	return nil
+}
+
+func certificateUsable(certPath, keyPath, target string) bool {
+	if certPath == "" || keyPath == "" {
+		return false
+	}
+	if err := validateCertificatePair(certPath, keyPath); err != nil {
+		return false
+	}
+	cert, err := readLeafCertificate(certPath)
+	if err != nil {
+		return false
+	}
+	now := time.Now()
+	if now.Before(cert.NotBefore) || !now.Before(cert.NotAfter) {
+		return false
+	}
+	return certificateMatchesTarget(cert, target)
+}
+
+func certificateNeedsRenewal(certPath, keyPath, target string, renewBefore time.Duration) bool {
+	if certPath == "" || keyPath == "" {
+		return true
+	}
+	if err := validateCertificatePair(certPath, keyPath); err != nil {
+		return true
+	}
+	cert, err := readLeafCertificate(certPath)
+	if err != nil {
+		return true
+	}
+	now := time.Now()
+	if now.Before(cert.NotBefore) || !now.Before(cert.NotAfter) {
+		return true
+	}
+	if !certificateMatchesTarget(cert, target) {
+		return true
+	}
+	return cert.NotAfter.Sub(now) <= renewBefore
+}
+
+func certificateMatchesTarget(cert *x509.Certificate, target string) bool {
+	target = strings.TrimSpace(strings.Trim(target, "[]"))
+	if target == "" {
+		return true
+	}
+	if ip := net.ParseIP(target); ip != nil {
+		for _, certIP := range cert.IPAddresses {
+			if certIP.Equal(ip) {
+				return true
+			}
+		}
+		return false
+	}
+	if err := cert.VerifyHostname(target); err != nil {
+		return false
+	}
+	return true
+}
+
+func readCertificateInfo(certPath string) (*sslCertificateInfo, error) {
+	cert, err := readLeafCertificate(certPath)
+	if err != nil {
+		return nil, err
+	}
+	ipNames := make([]string, 0, len(cert.IPAddresses))
+	for _, ip := range cert.IPAddresses {
+		ipNames = append(ipNames, ip.String())
+	}
+	return &sslCertificateInfo{
+		Subject:   cert.Subject.String(),
+		Issuer:    cert.Issuer.String(),
+		DNSNames:  cert.DNSNames,
+		IPNames:   ipNames,
+		NotBefore: cert.NotBefore.Format(time.RFC3339),
+		NotAfter:  cert.NotAfter.Format(time.RFC3339),
+		Valid:     time.Now().After(cert.NotBefore) && time.Now().Before(cert.NotAfter),
+	}, nil
+}
+
+func readLeafCertificate(certPath string) (*x509.Certificate, error) {
+	if certPath == "" {
+		return nil, errors.New("certificate path is empty")
+	}
+	safeCertPath, err := config.ResolveSSLPath(certPath)
+	if err != nil {
+		return nil, err
+	}
+	data, err := os.ReadFile(safeCertPath)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, errors.New("certificate PEM is invalid")
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return nil, err
+	}
+	return cert, nil
+}
+
+func detectedRequestHost(r *http.Request) string {
+	host := strings.TrimSpace(r.Host)
+	if host == "" {
+		return firstPublicInterfaceIP()
+	}
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		host = h
+	}
+	host = strings.Trim(host, "[]")
+	if host == "localhost" || net.ParseIP(host).IsLoopback() {
+		if ip := firstPublicInterfaceIP(); ip != "" {
+			return ip
+		}
+	}
+	return host
+}
+
+func firstPublicInterfaceIP() string {
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return ""
+	}
+	for _, addr := range addrs {
+		ipNet, ok := addr.(*net.IPNet)
+		if !ok {
+			continue
+		}
+		ip := ipNet.IP.To4()
+		if ip == nil || ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() {
+			continue
+		}
+		return ip.String()
+	}
+	return ""
+}
+
+func maskExistingPath(path string) string {
+	if path == "" {
+		return ""
+	}
+	return path
+}
+
+func restartIfRequested(applyNow bool) {
+	if !applyNow {
+		return
+	}
+	go func() {
+		time.Sleep(500 * time.Millisecond)
+		_ = exec.Command("systemctl", "restart", "clicd").Start()
+	}()
+}
+
+func StartSSLRenewalMonitor() {
+	go func() {
+		time.Sleep(30 * time.Second)
+		renewSavedSSLCertificates()
+		ticker := time.NewTicker(6 * time.Hour)
+		defer ticker.Stop()
+		for range ticker.C {
+			renewSavedSSLCertificates()
+		}
+	}()
+}
+
+func renewSavedSSLCertificates() {
+	if config.AppConfig == nil || len(config.AppConfig.SSLCertificates) == 0 {
+		return
+	}
+	changed := false
+	for mode, cert := range config.AppConfig.SSLCertificates {
+		mode = config.NormalizeSSLMode(mode)
+		if cert.Target == "" || mode == config.SSLModeDisabled || mode == config.SSLModeUploaded {
+			continue
+		}
+
+		var certPath, keyPath string
+		var err error
+		switch mode {
+		case config.SSLModeLetsEncrypt:
+			if !certificateNeedsRenewal(cert.CertPath, cert.KeyPath, cert.Target, 48*time.Hour) {
+				continue
+			}
+			certPath, keyPath, err = requestLetsEncryptCertificate(cert.Target, cert.Email)
+		case config.SSLModeSelfSigned:
+			if !certificateNeedsRenewal(cert.CertPath, cert.KeyPath, cert.Target, 30*24*time.Hour) {
+				continue
+			}
+			certPath, keyPath, err = generateSelfSignedCertificate(cert.Target)
+		}
+		if err != nil {
+			cert.LastError = err.Error()
+			config.AppConfig.SSLCertificates[mode] = cert
+			changed = true
+			continue
+		}
+		cert.CertPath = certPath
+		cert.KeyPath = keyPath
+		cert.LastIssuedAt = time.Now().Format(time.RFC3339)
+		cert.LastError = ""
+		config.AppConfig.SSLCertificates[mode] = cert
+		if config.AppConfig.SSL.Enabled && config.AppConfig.SSL.Mode == mode {
+			active := cert
+			active.Enabled = true
+			config.AppConfig.SSL = active
+		}
+		changed = true
+	}
+	if changed {
+		_ = config.SaveConfig()
+	}
+}

backend/internal/api/subuser.go

@@ -49,6 +49,9 @@ func HandleSubUserCreate(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "subuser:create") {
+		return
+	}
 
 	var req struct {
 		ContainerName string `json:"container_name"`
@@ -281,13 +284,40 @@ func subUserAllowedContainers(r *http.Request) (subUserAccess, bool) {
 	return allowed, true
 }
 
+func requestAllowedContainers(r *http.Request) (subUserAccess, bool) {
+	if ctx, ok := authContextFromRequest(r); ok {
+		if ctx.Type == authTypeAPIKey && len(ctx.ContainerUUIDs) == 0 {
+			return subUserAccess{}, false
+		}
+		if ctx.Type == authTypeSubUser || ctx.Type == authTypeAPIKey {
+			allowed := subUserAccess{names: make(map[string]bool), uuids: make(map[string]bool)}
+			for _, uuid := range ctx.ContainerUUIDs {
+				allowed.uuids[uuid] = true
+			}
+			if ctx.Type == authTypeSubUser && len(ctx.ContainerUUIDs) == 0 {
+				legacy, ok := subUserAllowedContainers(r)
+				if ok {
+					return legacy, true
+				}
+			}
+			return allowed, true
+		}
+	}
+	return subUserAllowedContainers(r)
+}
+
+func isAccessRestrictedRequest(r *http.Request) bool {
+	_, restricted := requestAllowedContainers(r)
+	return restricted
+}
+
 func containerByIdentifier(identifier string) *config.Container {
 	return config.FindContainerByIdentifier(identifier)
 }
 
 func isContainerAllowedForRequest(r *http.Request, identifier string) bool {
-	allowed, isSubUser := subUserAllowedContainers(r)
-	if !isSubUser {
+	allowed, restricted := requestAllowedContainers(r)
+	if !restricted {
 		return true
 	}
 	c := containerByIdentifier(identifier)
@@ -303,6 +333,9 @@ func HandleAuditLogs(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "audit:read") {
+		return
+	}
 
 	logs := config.AppConfig.AuditLogs
 	if logs == nil {
@@ -327,12 +360,20 @@ func SubUserMiddleware(next http.HandlerFunc) http.HandlerFunc {
 		}
 
 		path := r.URL.Path
-		if path == "/api/tasks" && r.Method == http.MethodGet {
+		containerPrefix := "/api/containers/"
+		containerListPath := "/api/containers"
+		tasksPath := "/api/tasks"
+		if strings.HasPrefix(path, "/api/v1/") {
+			containerPrefix = "/api/v1/containers/"
+			containerListPath = "/api/v1/containers"
+			tasksPath = "/api/v1/tasks"
+		}
+		if path == tasksPath && r.Method == http.MethodGet {
 			next(w, r)
 			return
 		}
 
-		if path == "/api/containers" {
+		if path == containerListPath {
 			if r.Method != http.MethodGet {
 				jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Sub-users cannot create containers"})
 				return
@@ -341,8 +382,8 @@ func SubUserMiddleware(next http.HandlerFunc) http.HandlerFunc {
 			return
 		}
 
-		if len(path) > len("/api/containers/") {
-			rest := path[len("/api/containers/"):]
+		if strings.HasPrefix(path, containerPrefix) {
+			rest := path[len(containerPrefix):]
 			parts := splitPath(rest)
 			if len(parts) > 0 && parts[0] != "" {
 				c := containerByIdentifier(parts[0])
@@ -352,7 +393,11 @@ func SubUserMiddleware(next http.HandlerFunc) http.HandlerFunc {
 				}
 				action := ""
 				if len(parts) > 1 {
-					action = parts[1]
+					action = strings.Join(parts[1:], "/")
+				}
+				if c.PolicyBlocked && isSubUserBlockedAction(action, r.Method) {
+					jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: policyBlockedMessage(c)})
+					return
 				}
 				if !isSubUserContainerActionAllowed(action, r.Method) {
 					jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Action is not allowed for this link"})
@@ -369,8 +414,8 @@ func SubUserMiddleware(next http.HandlerFunc) http.HandlerFunc {
 }
 
 func filterContainersForRequest(r *http.Request, containers []config.Container) []config.Container {
-	allowed, isSubUser := subUserAllowedContainers(r)
-	if !isSubUser {
+	allowed, restricted := requestAllowedContainers(r)
+	if !restricted {
 		return containers
 	}
 	filtered := make([]config.Container, 0, len(containers))
@@ -383,33 +428,66 @@ func filterContainersForRequest(r *http.Request, containers []config.Container)
 }
 
 func filterTasksForRequest(r *http.Request, tasks []*Task) []*Task {
-	allowed, isSubUser := subUserAllowedContainers(r)
-	if !isSubUser {
-		return tasks
-	}
 	filtered := make([]*Task, 0, len(tasks))
 	for _, task := range tasks {
-		if c := config.FindContainer(task.ContainerID); c != nil && isContainerAllowed(allowed, c) {
+		if isTaskAllowedForRequest(r, task) {
 			filtered = append(filtered, task)
-			continue
-		}
-		if task.ContainerName != "" {
-			if c := config.FindContainerByName(task.ContainerName); c != nil && isContainerAllowed(allowed, c) {
-				filtered = append(filtered, task)
-				continue
-			}
-		}
-		if task.Config.Name != "" {
-			if c := config.FindContainerByName(task.Config.Name); c != nil && isContainerAllowed(allowed, c) {
-				filtered = append(filtered, task)
-			}
 		}
 	}
 	return filtered
 }
 
+func isTaskAllowedForRequest(r *http.Request, task *Task) bool {
+	allowed, restricted := requestAllowedContainers(r)
+	if !restricted {
+		return true
+	}
+	if task == nil {
+		return false
+	}
+	if c := config.FindContainer(task.ContainerID); c != nil && isContainerAllowed(allowed, c) {
+		return true
+	}
+	if task.ContainerName != "" {
+		if c := config.FindContainerByName(task.ContainerName); c != nil && isContainerAllowed(allowed, c) {
+			return true
+		}
+	}
+	if task.Config.Name != "" {
+		if c := config.FindContainerByName(task.Config.Name); c != nil && isContainerAllowed(allowed, c) {
+			return true
+		}
+	}
+	return false
+}
+
 func isContainerAllowed(allowed subUserAccess, c *config.Container) bool {
-	return c != nil && c.UUID != "" && allowed.uuids[c.UUID]
+	if c == nil {
+		return false
+	}
+	if c.UUID != "" && allowed.uuids[c.UUID] {
+		return true
+	}
+	return c.Name != "" && allowed.names[c.Name]
+}
+
+func isSubUserBlockedAction(action string, method string) bool {
+	if action == "" {
+		return method != http.MethodGet
+	}
+	switch action {
+	case "usage", "traffic":
+		return method != http.MethodGet
+	default:
+		return true
+	}
+}
+
+func policyBlockedMessage(c *config.Container) string {
+	if c != nil && c.PolicyBlockedReason != "" {
+		return "虚拟机被策略临时封禁：" + c.PolicyBlockedReason
+	}
+	return "虚拟机被策略临时封禁"
 }
 
 func isSubUserContainerActionAllowed(action string, method string) bool {
@@ -513,6 +591,9 @@ func HandleSubUserList(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "subuser:read") {
+		return
+	}
 
 	result := make([]SubUserListItem, 0, len(config.AppConfig.SubUsers))
 	for _, su := range config.AppConfig.SubUsers {
@@ -562,7 +643,8 @@ func HandleSubUserList(w http.ResponseWriter, r *http.Request) {
 
 // HandleSubUserAction handles actions on a specific sub-user
 func HandleSubUserAction(w http.ResponseWriter, r *http.Request) {
-	path := strings.TrimPrefix(r.URL.Path, "/api/sub-users/")
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/sub-users/")
+	path = strings.TrimPrefix(path, "/api/sub-users/")
 	parts := strings.SplitN(path, "/", 2)
 	subUserID := parts[0]
 	action := ""
@@ -585,6 +667,9 @@ func HandleSubUserAction(w http.ResponseWriter, r *http.Request) {
 
 	switch {
 	case action == "rotate-password" && r.Method == http.MethodPost:
+		if !requireScope(w, r, "subuser:update") {
+			return
+		}
 		password := generateRandomStr(16)
 		if hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost); err == nil {
 			target.PassHash = string(hash)
@@ -602,11 +687,17 @@ func HandleSubUserAction(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to generate password"})
 
 	case action == "audit-logs" && r.Method == http.MethodGet:
+		if !requireScope(w, r, "audit:read") {
+			return
+		}
 		// Filter audit logs for this sub-user
 		logs := filterSubUserAuditLogs(target.Username)
 		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: logs})
 
 	case action == "login-logs" && r.Method == http.MethodGet:
+		if !requireScope(w, r, "loginlog:read") {
+			return
+		}
 		// Filter login logs for this sub-user
 		logs := filterSubUserLoginLogs(target.Username)
 		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: logs})

backend/internal/api/swap.go

@@ -11,19 +11,27 @@ import (
 )
 
 type SwapInfo struct {
-	TotalMB   int64  `json:"total_mb"`
-	UsedMB    int64  `json:"used_mb"`
-	FreeMB    int64  `json:"free_mb"`
-	Enabled   bool   `json:"enabled"`
-	SwapFile  string `json:"swap_file"`
+	TotalMB  int64  `json:"total_mb"`
+	UsedMB   int64  `json:"used_mb"`
+	FreeMB   int64  `json:"free_mb"`
+	Enabled  bool   `json:"enabled"`
+	SwapFile string `json:"swap_file"`
 }
 
+const (
+	minSwapSizeMB = 128
+	maxSwapSizeMB = 262144
+)
+
 // HandleSwapInfo returns current swap status
 func HandleSwapInfo(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "swap:read") {
+		return
+	}
 
 	info := getSwapInfo()
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: info})
@@ -35,9 +43,12 @@ func HandleSwapManage(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "swap:manage") {
+		return
+	}
 
 	var req struct {
-		Action string `json:"action"` // create, enable, disable, resize
+		Action string `json:"action"`  // create, enable, disable, resize
 		SizeMB int    `json:"size_mb"` // for create/resize
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
@@ -46,54 +57,63 @@ func HandleSwapManage(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var msg string
+	var err error
 
 	switch req.Action {
 	case "create":
 		if req.SizeMB <= 0 {
 			req.SizeMB = 2048
 		}
-		err := createSwap(req.SizeMB)
-		if err != nil {
-			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: err.Error()})
-			return
+		if err = validateSwapSize(req.SizeMB); err == nil {
+			err = createSwap(req.SizeMB)
 		}
 		msg = fmt.Sprintf("已创建 %d MB SWAP", req.SizeMB)
 
 	case "enable":
-		err := enableSwap()
-		if err != nil {
-			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: err.Error()})
-			return
-		}
+		err = enableSwap()
 		msg = "SWAP 已启用"
 
 	case "disable":
-		err := disableSwap()
-		if err != nil {
-			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: err.Error()})
-			return
-		}
+		err = disableSwap()
 		msg = "SWAP 已禁用"
 
 	case "resize":
-		if req.SizeMB <= 0 {
-			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid size"})
-			return
+		if err = validateSwapSize(req.SizeMB); err == nil {
+			err = disableSwap()
+		}
+		if err == nil {
+			err = createSwap(req.SizeMB)
+		}
+		if err == nil {
+			err = enableSwap()
 		}
-		disableSwap()
-		createSwap(req.SizeMB)
-		enableSwap()
 		msg = fmt.Sprintf("SWAP 已调整为 %d MB", req.SizeMB)
 
 	default:
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid action: " + req.Action})
 		return
 	}
+	if err != nil {
+		auditRequest(r, "swap."+req.Action, "/swapfile", fmt.Sprintf("size_mb=%d", req.SizeMB), false, err.Error())
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
 
 	info := getSwapInfo()
+	auditRequest(r, "swap."+req.Action, "/swapfile", fmt.Sprintf("size_mb=%d", req.SizeMB), true, "")
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: msg, Data: info})
 }
 
+func validateSwapSize(sizeMB int) error {
+	if sizeMB < minSwapSizeMB {
+		return fmt.Errorf("swap size must be at least %d MB", minSwapSizeMB)
+	}
+	if sizeMB > maxSwapSizeMB {
+		return fmt.Errorf("swap size cannot exceed %d MB", maxSwapSizeMB)
+	}
+	return nil
+}
+
 func getSwapInfo() SwapInfo {
 	info := SwapInfo{SwapFile: "/swapfile"}
 
@@ -160,6 +180,9 @@ func createSwap(sizeMB int) error {
 func enableSwap() error {
 	swapFile := "/swapfile"
 	if _, err := os.Stat(swapFile); os.IsNotExist(err) {
+		if getSwapInfo().Enabled {
+			return nil
+		}
 		return fmt.Errorf("swap 文件不存在，请先创建")
 	}
 
@@ -180,7 +203,7 @@ func disableSwap() error {
 	cmd := exec.Command("swapoff", swapFile)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
-		if strings.Contains(string(output), "No such") {
+		if strings.Contains(string(output), "No such") || strings.Contains(string(output), "Invalid argument") {
 			return nil
 		}
 		return fmt.Errorf("禁用 swap 失败: %v, %s", err, string(output))

backend/internal/api/taskqueue.go

@@ -122,9 +122,13 @@ func (q *TaskQueue) EnqueueBatchWithAudit(taskType TaskType, ids []int, template
 }
 
 func (q *TaskQueue) EnqueueBatchCreate(configs []lxc.ContainerConfig) []string {
+	return q.EnqueueBatchCreateWithAudit(configs, "admin", "", "")
+}
+
+func (q *TaskQueue) EnqueueBatchCreateWithAudit(configs []lxc.ContainerConfig, user string, ip string, userAgent string) []string {
 	q.mu.Lock()
 	defer q.mu.Unlock()
-	return q.enqueueBatchCreateList(configs)
+	return q.enqueueBatchCreateList(configs, user, ip, userAgent)
 }
 
 func (q *TaskQueue) ActiveCreateNames() map[string]bool {
@@ -147,7 +151,7 @@ func (q *TaskQueue) ActiveCreateNames() map[string]bool {
 	return names
 }
 
-func (q *TaskQueue) enqueueBatchCreateList(configs []lxc.ContainerConfig) []string {
+func (q *TaskQueue) enqueueBatchCreateList(configs []lxc.ContainerConfig, user string, ip string, userAgent string) []string {
 	var result []string
 	for _, cfg := range configs {
 		cfgCopy := cfg
@@ -161,6 +165,9 @@ func (q *TaskQueue) enqueueBatchCreateList(configs []lxc.ContainerConfig) []stri
 			Status:        "pending",
 			CreatedAt:     time.Now().Format("2006-01-02 15:04:05"),
 			Config:        cfgCopy,
+			User:          user,
+			IP:            ip,
+			UserAgent:     userAgent,
 		}
 		q.enqueueTask(task)
 		result = append(result, task.ID)
@@ -196,6 +203,24 @@ func (q *TaskQueue) enqueueSingleWithAudit(containerID int, containerName string
 	return task.ID
 }
 
+func (q *TaskQueue) EnqueueSecurityStop(containerID int, containerName string) (string, bool) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	for _, task := range q.tasks {
+		if task.Type != TaskStop || task.ContainerID != containerID {
+			continue
+		}
+		if task.Status == "pending" || task.Status == "running" {
+			return task.ID, false
+		}
+	}
+
+	taskID := q.enqueueSingleWithAudit(containerID, containerName, TaskStop, "", "system:security", "", "")
+	q.persistTasks()
+	return taskID, true
+}
+
 // createWorker handles TaskCreate: lxc-create, resource setup, start, and SSH init.
 // If a restored task already has a same-name container in config, it resumes
 // initialization instead of creating another ct-{id}.
@@ -337,10 +362,14 @@ func (q *TaskQueue) opWorker() {
 			switch task.Type {
 			case TaskStart:
 				config.UpdateContainerStatus(task.ContainerID, "running")
+				clearPolicyBlockAfterAdminRecovery(task)
 			case TaskStop:
 				config.UpdateContainerStatus(task.ContainerID, "stopped")
 			case TaskRestart:
 				config.UpdateContainerStatus(task.ContainerID, "running")
+				clearPolicyBlockAfterAdminRecovery(task)
+			case TaskReinstall:
+				clearPolicyBlockAfterAdminRecovery(task)
 			}
 		}
 		q.persistTasks()
@@ -348,6 +377,17 @@ func (q *TaskQueue) opWorker() {
 	}
 }
 
+func clearPolicyBlockAfterAdminRecovery(task *Task) {
+	if task == nil || strings.HasPrefix(task.User, "user:") || task.User == "system:security" {
+		return
+	}
+	c := config.FindContainer(task.ContainerID)
+	if c != nil && c.PolicyBlocked {
+		config.SetContainerPolicyBlock(c.ID, false, "")
+		config.AddAuditLog("security_policy_unblock", c.Name, "管理员操作后解除策略临时封禁", task.User)
+	}
+}
+
 func resolveTaskContainer(task *Task) error {
 	if task.Type == TaskCreate {
 		return nil
@@ -391,6 +431,8 @@ func (q *TaskQueue) persistTasks() {
 			TemplateID:    t.TemplateID,
 			Config:        string(cfgJSON),
 			User:          t.User,
+			IP:            t.IP,
+			UserAgent:     t.UserAgent,
 		})
 	}
 	config.SaveTasks(saved)
@@ -423,13 +465,8 @@ func HandleSingleTaskAction(w http.ResponseWriter, r *http.Request, id int, acti
 		name = c.Name
 	}
 
-	// Determine user from JWT claims
-	user := "admin"
-	if claims, ok := claimsFromRequest(r); ok {
-		if subUser, _ := claims["sub_user"].(string); subUser != "" {
-			user = "user:" + subUser
-		}
-	}
+	// Determine user from authenticated request context.
+	user := requestActor(r)
 	ip := clientIP(r)
 	userAgent := r.Header.Get("User-Agent")
 
@@ -484,6 +521,13 @@ func HandleBatchCreate(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "container:create") {
+		return
+	}
+	if isAccessRestrictedRequest(r) {
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Container-bound API keys cannot create containers"})
+		return
+	}
 	var req struct {
 		Containers []lxc.ContainerConfig `json:"containers"`
 	}
@@ -531,8 +575,37 @@ func HandleBatchCreate(w http.ResponseWriter, r *http.Request) {
 			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: name + ": template is not enabled or downloaded"})
 			return
 		}
-		if req.Containers[i].PortMappingCount < 2 {
+		if req.Containers[i].PortMappingCount < 0 {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": port mapping count cannot be negative"})
+			return
+		}
+		if req.Containers[i].WantsNAT() && req.Containers[i].PortMappingCount < 2 {
 			req.Containers[i].PortMappingCount = 2
+		} else if !req.Containers[i].WantsNAT() {
+			req.Containers[i].PortMappingCount = 0
+			req.Containers[i].ExtraPorts = nil
+		}
+		if req.Containers[i].PortMappingCount > 64 {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": port mapping count cannot exceed 64"})
+			return
+		}
+		if req.Containers[i].IPv4Count < 0 || req.Containers[i].IPv6Count < 0 {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": IP address count cannot be negative"})
+			return
+		}
+		if req.Containers[i].IPv4Count > 64 || req.Containers[i].IPv6Count > 64 {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": IP address count cannot exceed 64"})
+			return
+		}
+		if !req.Containers[i].AssignIPv4 && len(req.Containers[i].PublicIPv4s) == 0 {
+			req.Containers[i].IPv4Count = 0
+		}
+		if !req.Containers[i].AssignIPv6 && len(req.Containers[i].IPv6Addresses) == 0 {
+			req.Containers[i].IPv6Count = 0
+		}
+		if !hasRequestedNetwork(req.Containers[i]) {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": " + noNetworkSelectedMessage})
+			return
 		}
 		if req.Containers[i].SnapshotLimit <= 0 {
 			req.Containers[i].SnapshotLimit = config.DefaultSnapshotLimit
@@ -543,7 +616,7 @@ func HandleBatchCreate(w http.ResponseWriter, r *http.Request) {
 		}
 		requestNames[name] = true
 	}
-	ids := globalQueue.EnqueueBatchCreate(req.Containers)
+	ids := globalQueue.EnqueueBatchCreateWithAudit(req.Containers, requestActor(r), clientIP(r), r.UserAgent())
 	jsonResponse(w, http.StatusAccepted, APIResponse{Success: true, Data: ids})
 }
 
@@ -553,6 +626,10 @@ func HandleBatchAction(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !hasAnyScope(r, "container:power", "container:delete", "container:reinstall") {
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Insufficient API key scope"})
+		return
+	}
 	var req struct {
 		Action     string `json:"action"`
 		Containers []int  `json:"containers"`
@@ -564,21 +641,47 @@ func HandleBatchAction(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var taskType TaskType
+	var requiredScope string
 	switch req.Action {
 	case "start":
 		taskType = TaskStart
+		requiredScope = "container:power"
 	case "stop":
 		taskType = TaskStop
+		requiredScope = "container:power"
 	case "restart":
 		taskType = TaskRestart
+		requiredScope = "container:power"
 	case "delete":
 		taskType = TaskDelete
+		requiredScope = "container:delete"
+	case "reinstall":
+		if req.TemplateID == "" {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "template_id required"})
+			return
+		}
+		if !isTemplateEnabledAndDownloaded(req.TemplateID) {
+			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Template is not enabled or downloaded"})
+			return
+		}
+		taskType = TaskReinstall
+		requiredScope = "container:reinstall"
 	default:
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Unknown action"})
 		return
 	}
+	if !requireScope(w, r, requiredScope) {
+		return
+	}
+	for _, id := range req.Containers {
+		c := config.FindContainer(id)
+		if c == nil || !isContainerAllowedForRequest(r, c.UUID) {
+			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to one or more containers"})
+			return
+		}
+	}
 
-	ids := globalQueue.EnqueueBatch(taskType, req.Containers, req.TemplateID)
+	ids := globalQueue.EnqueueBatchWithAudit(taskType, req.Containers, req.TemplateID, requestActor(r), clientIP(r), r.UserAgent())
 	jsonResponse(w, http.StatusAccepted, APIResponse{Success: true, Data: ids})
 }
 
@@ -588,13 +691,22 @@ func HandleTaskDelete(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
-	// URL: /api/tasks/{id}
-	taskID := strings.TrimPrefix(r.URL.Path, "/api/tasks/")
+	if !requireScope(w, r, "task:delete") {
+		return
+	}
+	// URL: /api/tasks/{id} or /api/v1/tasks/{id}
+	taskID := strings.TrimPrefix(r.URL.Path, "/api/v1/tasks/")
+	taskID = strings.TrimPrefix(taskID, "/api/tasks/")
 	if taskID == "" {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Task ID required"})
 		return
 	}
 	globalQueue.mu.Lock()
+	if task := globalQueue.tasks[taskID]; task != nil && !isTaskAllowedForRequest(r, task) {
+		globalQueue.mu.Unlock()
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to this task"})
+		return
+	}
 	delete(globalQueue.tasks, taskID)
 	// Also remove from both queues if pending
 	newCreate := make([]*Task, 0, len(globalQueue.createQueue))
@@ -622,6 +734,9 @@ func HandleTasks(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
 		return
 	}
+	if !requireScope(w, r, "task:read") {
+		return
+	}
 	tasks := globalQueue.GetTasks()
 	tasks = filterTasksForRequest(r, tasks)
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: tasks})
@@ -658,6 +773,8 @@ func RestoreTasks() {
 			TemplateID:    st.TemplateID,
 			Config:        cfg,
 			User:          st.User,
+			IP:            st.IP,
+			UserAgent:     st.UserAgent,
 		}
 		if st.Status == "pending" || st.Status == "running" {
 			// Reset running tasks back to pending so they get retried

backend/internal/api/vnc.go

@@ -0,0 +1,275 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+
+	"clicd/internal/config"
+
+	"github.com/gorilla/websocket"
+)
+
+type webVNCTicket struct {
+	ContainerName string
+	ContainerUUID string
+	Username      string
+	SubUser       bool
+	ClientIP      string
+	UserAgent     string
+	ExpiresAt     time.Time
+}
+
+var webVNCTickets = struct {
+	sync.Mutex
+	items map[string]webVNCTicket
+}{items: map[string]webVNCTicket{}}
+
+func HandleVNCTicket(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+		return
+	}
+
+	if !requireScope(w, r, "terminal:vnc") {
+		return
+	}
+	var req struct {
+		ContainerName string `json:"container_name"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.ContainerName == "" {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Container name required"})
+		return
+	}
+	if !isContainerAllowedForRequest(r, req.ContainerName) {
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to this container"})
+		return
+	}
+	c := config.FindContainerByName(req.ContainerName)
+	if c == nil {
+		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Container not found"})
+		return
+	}
+	if isSubUserRequest(r) && c.PolicyBlocked {
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: policyBlockedMessage(c)})
+		return
+	}
+	if !c.IsKVM() {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "VNC console is only available for KVM VMs"})
+		return
+	}
+
+	username, isSubUser := vncRequesterIdentity(r)
+	ticket := randomHex(32)
+	webVNCTickets.Lock()
+	cleanupExpiredWebVNCTicketsLocked(time.Now())
+	webVNCTickets.items[ticket] = webVNCTicket{
+		ContainerName: c.Name,
+		ContainerUUID: c.UUID,
+		Username:      username,
+		SubUser:       isSubUser,
+		ClientIP:      clientIP(r),
+		UserAgent:     r.UserAgent(),
+		ExpiresAt:     time.Now().Add(60 * time.Second),
+	}
+	webVNCTickets.Unlock()
+
+	jsonResponse(w, http.StatusOK, APIResponse{
+		Success: true,
+		Data:    map[string]string{"ticket": ticket},
+	})
+}
+
+// HandleVNCProxy proxies a KVM VM's local libvirt VNC socket to the browser.
+func HandleVNCProxy(w http.ResponseWriter, r *http.Request) {
+	ticket := webVNCTicketFromRequest(r)
+	if ticket == "" {
+		http.Error(w, "ticket required", http.StatusUnauthorized)
+		return
+	}
+
+	containerName := r.URL.Query().Get("container")
+	if containerName == "" {
+		http.Error(w, "container name required", http.StatusBadRequest)
+		return
+	}
+
+	item, ok := consumeWebVNCTicket(ticket, containerName, r)
+	if !ok {
+		http.Error(w, "invalid or expired ticket", http.StatusUnauthorized)
+		return
+	}
+
+	c := config.FindContainerByName(containerName)
+	if c == nil || c.UUID != item.ContainerUUID {
+		http.Error(w, "container not found", http.StatusNotFound)
+		return
+	}
+	if item.SubUser && c.PolicyBlocked {
+		http.Error(w, "虚拟机被策略临时封禁", http.StatusForbidden)
+		return
+	}
+	if !c.IsKVM() {
+		http.Error(w, "VNC console is only available for KVM VMs", http.StatusBadRequest)
+		return
+	}
+	if c.Status != "running" {
+		http.Error(w, "container is not running", http.StatusBadRequest)
+		return
+	}
+
+	vncPort, err := kvmManager.RefreshVNCPort(c.ID)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("VNC display is not available: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	vncConn, err := net.DialTimeout("tcp", net.JoinHostPort("127.0.0.1", fmt.Sprintf("%d", vncPort)), 5*time.Second)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("VNC connection failed: %v", err), http.StatusBadRequest)
+		return
+	}
+	defer vncConn.Close()
+
+	responseHeader := http.Header{}
+	if protocol := webVNCResponseProtocol(r); protocol != "" {
+		responseHeader.Set("Sec-WebSocket-Protocol", protocol)
+	}
+	ws, err := upgrader.Upgrade(w, r, responseHeader)
+	if err != nil {
+		log.Printf("WebVNC upgrade failed: %v", err)
+		return
+	}
+	defer ws.Close()
+
+	log.Printf("WebVNC connected for container %s as %s (sub_user=%t) -> 127.0.0.1:%d", containerName, item.Username, item.SubUser, vncPort)
+
+	done := make(chan string, 2)
+	var writeMu sync.Mutex
+	go streamVNCToWebSocket(ws, &writeMu, vncConn, done)
+	go streamWebSocketToVNC(ws, vncConn, done)
+
+	reason := <-done
+	_ = vncConn.Close()
+	_ = ws.Close()
+	log.Printf("WebVNC disconnected for container %s as %s: %s", containerName, item.Username, reason)
+}
+
+func vncRequesterIdentity(r *http.Request) (string, bool) {
+	if ctx, ok := authContextFromRequest(r); ok {
+		switch ctx.Type {
+		case authTypeSubUser:
+			return ctx.Username, true
+		case authTypeAPIKey:
+			return ctx.Actor, false
+		case authTypeAdmin:
+			return ctx.Username, false
+		}
+	}
+	claims, ok := claimsFromRequest(r)
+	if !ok {
+		return "api-key", false
+	}
+	if subUser, ok := claims["sub_user"].(string); ok && subUser != "" {
+		return subUser, true
+	}
+	if username, ok := claims["username"].(string); ok && username != "" {
+		return username, false
+	}
+	return "unknown", false
+}
+
+func webVNCTicketFromRequest(r *http.Request) string {
+	for _, protocol := range websocket.Subprotocols(r) {
+		const prefix = "clicd-vnc-ticket."
+		if len(protocol) > len(prefix) && protocol[:len(prefix)] == prefix {
+			return protocol[len(prefix):]
+		}
+	}
+	return r.URL.Query().Get("ticket")
+}
+
+func webVNCResponseProtocol(r *http.Request) string {
+	for _, protocol := range websocket.Subprotocols(r) {
+		if protocol == "binary" {
+			return protocol
+		}
+	}
+	for _, protocol := range websocket.Subprotocols(r) {
+		const prefix = "clicd-vnc-ticket."
+		if len(protocol) > len(prefix) && protocol[:len(prefix)] == prefix {
+			return protocol
+		}
+	}
+	return ""
+}
+
+func consumeWebVNCTicket(ticket, containerName string, r *http.Request) (webVNCTicket, bool) {
+	now := time.Now()
+	webVNCTickets.Lock()
+	defer webVNCTickets.Unlock()
+	cleanupExpiredWebVNCTicketsLocked(now)
+	item, ok := webVNCTickets.items[ticket]
+	if !ok {
+		return webVNCTicket{}, false
+	}
+	delete(webVNCTickets.items, ticket)
+	return item, item.ContainerName == containerName &&
+		item.ClientIP == clientIP(r) &&
+		item.UserAgent == r.UserAgent() &&
+		now.Before(item.ExpiresAt)
+}
+
+func cleanupExpiredWebVNCTicketsLocked(now time.Time) {
+	for ticket, item := range webVNCTickets.items {
+		if !now.Before(item.ExpiresAt) {
+			delete(webVNCTickets.items, ticket)
+		}
+	}
+}
+
+func streamVNCToWebSocket(ws *websocket.Conn, writeMu *sync.Mutex, src io.Reader, done chan<- string) {
+	buf := make([]byte, 32*1024)
+	for {
+		n, err := src.Read(buf)
+		if n > 0 {
+			writeMu.Lock()
+			writeErr := ws.WriteMessage(websocket.BinaryMessage, buf[:n])
+			writeMu.Unlock()
+			if writeErr != nil {
+				done <- fmt.Sprintf("browser websocket write failed: %v", writeErr)
+				return
+			}
+		}
+		if err != nil {
+			if err == io.EOF {
+				done <- "VNC server closed connection"
+			} else {
+				done <- fmt.Sprintf("VNC server read failed: %v", err)
+			}
+			return
+		}
+	}
+}
+
+func streamWebSocketToVNC(ws *websocket.Conn, dst net.Conn, done chan<- string) {
+	for {
+		messageType, msg, err := ws.ReadMessage()
+		if err != nil {
+			done <- fmt.Sprintf("browser websocket read failed: %v", err)
+			return
+		}
+		if messageType != websocket.BinaryMessage && messageType != websocket.TextMessage {
+			continue
+		}
+		if _, err := dst.Write(msg); err != nil {
+			done <- fmt.Sprintf("VNC server write failed: %v", err)
+			return
+		}
+	}
+}

backend/internal/api/websocket.go

@@ -1,10 +1,9 @@
 package api
 
 import (
-	"net"
 	"net/http"
-	"net/url"
-	"strings"
+
+	"clicd/internal/config"
 
 	"github.com/gorilla/websocket"
 )
@@ -17,19 +16,6 @@ var upgrader = websocket.Upgrader{
 		if origin == "" {
 			return true
 		}
-		originURL, err := url.Parse(origin)
-		if err != nil {
-			return false
-		}
-		originHost := strings.ToLower(stripPort(originURL.Host))
-		requestHost := strings.ToLower(stripPort(r.Host))
-		return originHost != "" && originHost == requestHost
+		return config.IsOriginAllowed(origin, r.Host)
 	},
 }
-
-func stripPort(host string) string {
-	if parsedHost, _, err := net.SplitHostPort(host); err == nil {
-		return parsedHost
-	}
-	return strings.Trim(host, "[]")
-}

backend/internal/cli/cli_test.go

@@ -0,0 +1,54 @@
+package cli
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSafeReleaseBackupComponent(t *testing.T) {
+	tests := map[string]string{
+		"v1.2.3":              "1.2.3",
+		" release/candidate ": "release_candidate",
+		"../../etc/passwd":    "etc_passwd",
+		"":                    "unknown",
+	}
+	for input, want := range tests {
+		if got := safeReleaseBackupComponent(input); got != want {
+			t.Fatalf("safeReleaseBackupComponent(%q) = %q, want %q", input, got, want)
+		}
+	}
+}
+
+func TestCopyFileToBackupRejectsUnsafeFileName(t *testing.T) {
+	unsafeNames := []string{
+		"../clicd",
+		"..\\clicd",
+		"subdir/clicd",
+		"",
+	}
+	for _, name := range unsafeNames {
+		if _, err := copyFileToBackup("missing-source", name, 0755); err == nil || !strings.Contains(err.Error(), "unsafe backup file name") {
+			t.Fatalf("copyFileToBackup(%q) error = %v, want unsafe backup file name", name, err)
+		}
+	}
+}
+
+func TestFormatSSHAccessDoesNotExposePassword(t *testing.T) {
+	out := formatSSHAccess(2222)
+	if strings.Contains(out, "/") {
+		t.Fatalf("formatSSHAccess output contains credential separator: %q", out)
+	}
+	if strings.Contains(strings.ToLower(out), "password123") {
+		t.Fatalf("formatSSHAccess output exposed password: %q", out)
+	}
+	if !strings.Contains(out, "2222 -> 22") {
+		t.Fatalf("formatSSHAccess output = %q, want SSH port mapping", out)
+	}
+}
+
+func TestFormatSSHAccessHandlesMissingPort(t *testing.T) {
+	out := formatSSHAccess(0)
+	if !strings.Contains(out, "端口未分配") {
+		t.Fatalf("formatSSHAccess output = %q, want missing port message", out)
+	}
+}

backend/internal/config/config.go

@@ -3,7 +3,6 @@ package config
 import (
 	"crypto/rand"
 	"encoding/hex"
-	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -18,10 +17,32 @@ import (
 type PortMapping struct {
 	ContainerPort int    `json:"container_port"`
 	HostPort      int    `json:"host_port"`
+	HostIP        string `json:"host_ip,omitempty"`
 	Protocol      string `json:"protocol"`
 	Description   string `json:"description"`
 }
 
+type PublicIPv4Assignment struct {
+	Address   string `json:"address"`
+	Interface string `json:"interface,omitempty"`
+	PrefixLen int    `json:"prefix_len,omitempty"`
+	Gateway   string `json:"gateway,omitempty"`
+}
+
+type IPv6Assignment struct {
+	Address   string `json:"address"`
+	PrefixLen int    `json:"prefix_len"`
+	Interface string `json:"interface,omitempty"`
+}
+
+type PublicIPv6Prefix struct {
+	Address   string `json:"address"`
+	Prefix    string `json:"prefix,omitempty"`
+	PrefixLen int    `json:"prefix_len"`
+	Interface string `json:"interface,omitempty"`
+	Gateway   string `json:"gateway,omitempty"`
+}
+
 // SavedTask for persisting task queue across restarts
 type SavedTask struct {
 	ID            string `json:"id"`
@@ -34,6 +55,8 @@ type SavedTask struct {
 	TemplateID    string `json:"template_id,omitempty"`
 	Config        string `json:"config,omitempty"`
 	User          string `json:"user,omitempty"`
+	IP            string `json:"ip,omitempty"`
+	UserAgent     string `json:"user_agent,omitempty"`
 }
 
 // SavedLoginLog for persisting login logs
@@ -58,49 +81,61 @@ type AuditLog struct {
 	Error     string `json:"error,omitempty"`
 }
 
+type VMReadinessCheck struct {
+	Key    string `json:"key"`
+	Label  string `json:"label"`
+	OK     bool   `json:"ok"`
+	Detail string `json:"detail,omitempty"`
+}
+
 // Container represents an LXC container configuration
 type Container struct {
-	ID                            int           `json:"id"`
-	UUID                          string        `json:"uuid"`
-	Name                          string        `json:"name"`
-	Virtualization                string        `json:"virtualization,omitempty"`
-	LXCName                       string        `json:"lxc_name,omitempty"`
-	KVMName                       string        `json:"kvm_name,omitempty"`
-	DiskImage                     string        `json:"disk_image,omitempty"`
-	MACAddress                    string        `json:"mac_address,omitempty"`
-	Template                      string        `json:"template"`
-	VCPU                          float64       `json:"vcpu"`
-	RAMMB                         int           `json:"ram_mb"`
-	DiskGB                        int           `json:"disk_gb"`
-	NetworkBWMbps                 int           `json:"network_bw_mbps"`
-	MonthlyTrafficGB              int           `json:"monthly_traffic_gb"`
-	TrafficMode                   string        `json:"traffic_mode"`   // "total" or "in_out"
-	TrafficInGB                   int           `json:"traffic_in_gb"`  // 0 = unlimited
-	TrafficOutGB                  int           `json:"traffic_out_gb"` // 0 = unlimited
-	TrafficUsedRX                 int64         `json:"traffic_used_rx"`
-	TrafficUsedTX                 int64         `json:"traffic_used_tx"`
-	TrafficResetDate              string        `json:"traffic_reset_date"`
-	IOSpeedMBps                   int           `json:"io_speed_mbps"`
-	Status                        string        `json:"status"`
-	IP                            string        `json:"ip"`
-	IPv6                          string        `json:"ipv6"`
-	IPv6PrefixLen                 int           `json:"ipv6_prefix_len"`
-	IPv6Interface                 string        `json:"ipv6_interface"`
-	VNCPort                       int           `json:"vnc_port"`
-	SSHPort                       int           `json:"ssh_port"`
-	SSHPassword                   string        `json:"ssh_password"`
-	SSHHostKey                    string        `json:"ssh_host_key,omitempty"`
-	PortMappings                  []PortMapping `json:"port_mappings"`
-	PortMappingLimit              int           `json:"port_mapping_limit"`
-	SnapshotLimit                 int           `json:"snapshot_limit"`
-	CreatedAt                     string        `json:"created_at"`
-	ExpiresAt                     string        `json:"expires_at"`
-	SnapshotScheduleEnabled       bool          `json:"snapshot_schedule_enabled"`
-	SnapshotScheduleIntervalHours int           `json:"snapshot_schedule_interval_hours"`
-	SnapshotScheduleTime          string        `json:"snapshot_schedule_time"`
-	SnapshotScheduleLastRun       string        `json:"snapshot_schedule_last_run"`
-	SnapshotScheduleNextRun       string        `json:"snapshot_schedule_next_run"`
-	SnapshotScheduleCreatedBy     string        `json:"snapshot_schedule_created_by"`
+	ID                            int                    `json:"id"`
+	UUID                          string                 `json:"uuid"`
+	Name                          string                 `json:"name"`
+	Virtualization                string                 `json:"virtualization,omitempty"`
+	LXCName                       string                 `json:"lxc_name,omitempty"`
+	KVMName                       string                 `json:"kvm_name,omitempty"`
+	DiskImage                     string                 `json:"disk_image,omitempty"`
+	MACAddress                    string                 `json:"mac_address,omitempty"`
+	Template                      string                 `json:"template"`
+	VCPU                          float64                `json:"vcpu"`
+	RAMMB                         int                    `json:"ram_mb"`
+	DiskGB                        int                    `json:"disk_gb"`
+	NetworkBWMbps                 int                    `json:"network_bw_mbps"`
+	MonthlyTrafficGB              int                    `json:"monthly_traffic_gb"`
+	TrafficMode                   string                 `json:"traffic_mode"`   // "total" or "in_out"
+	TrafficInGB                   int                    `json:"traffic_in_gb"`  // 0 = unlimited
+	TrafficOutGB                  int                    `json:"traffic_out_gb"` // 0 = unlimited
+	TrafficUsedRX                 int64                  `json:"traffic_used_rx"`
+	TrafficUsedTX                 int64                  `json:"traffic_used_tx"`
+	TrafficResetDate              string                 `json:"traffic_reset_date"`
+	IOSpeedMBps                   int                    `json:"io_speed_mbps"`
+	Status                        string                 `json:"status"`
+	IP                            string                 `json:"ip"`
+	PublicIPv4s                   []PublicIPv4Assignment `json:"public_ipv4s,omitempty"`
+	IPv6                          string                 `json:"ipv6"`
+	IPv6PrefixLen                 int                    `json:"ipv6_prefix_len"`
+	IPv6Interface                 string                 `json:"ipv6_interface"`
+	IPv6Addresses                 []IPv6Assignment       `json:"ipv6_addresses,omitempty"`
+	VNCPort                       int                    `json:"vnc_port"`
+	SSHPort                       int                    `json:"ssh_port"`
+	SSHPassword                   string                 `json:"ssh_password"`
+	SSHHostKey                    string                 `json:"ssh_host_key,omitempty"`
+	PortMappings                  []PortMapping          `json:"port_mappings"`
+	PortMappingLimit              int                    `json:"port_mapping_limit"`
+	SnapshotLimit                 int                    `json:"snapshot_limit"`
+	CreatedAt                     string                 `json:"created_at"`
+	ExpiresAt                     string                 `json:"expires_at"`
+	SnapshotScheduleEnabled       bool                   `json:"snapshot_schedule_enabled"`
+	SnapshotScheduleIntervalHours int                    `json:"snapshot_schedule_interval_hours"`
+	SnapshotScheduleTime          string                 `json:"snapshot_schedule_time"`
+	SnapshotScheduleLastRun       string                 `json:"snapshot_schedule_last_run"`
+	SnapshotScheduleNextRun       string                 `json:"snapshot_schedule_next_run"`
+	SnapshotScheduleCreatedBy     string                 `json:"snapshot_schedule_created_by"`
+	PolicyBlocked                 bool                   `json:"policy_blocked"`
+	PolicyBlockedReason           string                 `json:"policy_blocked_reason,omitempty"`
+	PolicyBlockedAt               string                 `json:"policy_blocked_at,omitempty"`
 }
 
 const (
@@ -125,6 +160,101 @@ func (c *Container) IsKVM() bool {
 	return c.Runtime() == VirtualizationKVM
 }
 
+func (c *Container) NormalizeNetworkAssignments() bool {
+	changed := false
+	seenIPv4 := map[string]bool{}
+	filteredIPv4 := make([]PublicIPv4Assignment, 0, len(c.PublicIPv4s))
+	for _, item := range c.PublicIPv4s {
+		item.Address = strings.TrimSpace(item.Address)
+		item.Interface = strings.TrimSpace(item.Interface)
+		item.Gateway = strings.TrimSpace(item.Gateway)
+		if item.Address == "" || seenIPv4[item.Address] {
+			if item.Address != "" {
+				changed = true
+			}
+			continue
+		}
+		seenIPv4[item.Address] = true
+		filteredIPv4 = append(filteredIPv4, item)
+	}
+	if len(filteredIPv4) != len(c.PublicIPv4s) {
+		changed = true
+	}
+	c.PublicIPv4s = filteredIPv4
+
+	seenIPv6 := map[string]bool{}
+	filteredIPv6 := make([]IPv6Assignment, 0, len(c.IPv6Addresses)+1)
+	for _, item := range c.IPv6Addresses {
+		item.Address = strings.TrimSpace(item.Address)
+		item.Interface = strings.TrimSpace(item.Interface)
+		if item.Address == "" || seenIPv6[item.Address] {
+			if item.Address != "" {
+				changed = true
+			}
+			continue
+		}
+		seenIPv6[item.Address] = true
+		filteredIPv6 = append(filteredIPv6, item)
+	}
+	if strings.TrimSpace(c.IPv6) != "" && !seenIPv6[c.IPv6] {
+		filteredIPv6 = append([]IPv6Assignment{{
+			Address:   c.IPv6,
+			PrefixLen: c.IPv6PrefixLen,
+			Interface: c.IPv6Interface,
+		}}, filteredIPv6...)
+		changed = true
+	}
+	if len(filteredIPv6) != len(c.IPv6Addresses) {
+		changed = true
+	}
+	c.IPv6Addresses = filteredIPv6
+	if len(c.IPv6Addresses) > 0 {
+		first := c.IPv6Addresses[0]
+		if c.IPv6 != first.Address || c.IPv6PrefixLen != first.PrefixLen || c.IPv6Interface != first.Interface {
+			c.IPv6 = first.Address
+			c.IPv6PrefixLen = first.PrefixLen
+			c.IPv6Interface = first.Interface
+			changed = true
+		}
+	} else if c.IPv6 != "" || c.IPv6PrefixLen != 0 || c.IPv6Interface != "" {
+		c.IPv6 = ""
+		c.IPv6PrefixLen = 0
+		c.IPv6Interface = ""
+		changed = true
+	}
+	return changed
+}
+
+func (c *Container) PublicIPv4Addresses() []string {
+	values := make([]string, 0, len(c.PublicIPv4s))
+	for _, item := range c.PublicIPv4s {
+		if item.Address != "" {
+			values = append(values, item.Address)
+		}
+	}
+	return values
+}
+
+func (c *Container) PrimaryPublicIPv4() string {
+	if len(c.PublicIPv4s) == 0 {
+		return ""
+	}
+	return c.PublicIPv4s[0].Address
+}
+
+func (c *Container) IPv6AddressStrings() []string {
+	values := make([]string, 0, len(c.IPv6Addresses))
+	for _, item := range c.IPv6Addresses {
+		if item.Address != "" {
+			values = append(values, item.Address)
+		}
+	}
+	if len(values) == 0 && c.IPv6 != "" {
+		values = append(values, c.IPv6)
+	}
+	return values
+}
+
 // LxcName returns the internal LXC container name (ct-{id})
 func (c *Container) LxcName() string {
 	if c.LXCName != "" {
@@ -143,13 +273,18 @@ func (c *Container) VirshName() string {
 
 // SubUser represents a sub-user with access to specific containers
 type ApiKeyConfig struct {
-	ID          string `json:"id"`
-	Name        string `json:"name"`
-	KeyHash     string `json:"key_hash"`
-	Prefix      string `json:"prefix"`
-	IPWhitelist string `json:"ip_whitelist"`
-	CreatedAt   string `json:"created_at"`
-	LastUsed    string `json:"last_used"`
+	ID             string   `json:"id"`
+	Name           string   `json:"name"`
+	KeyHash        string   `json:"key_hash"`
+	Prefix         string   `json:"prefix"`
+	IPWhitelist    string   `json:"ip_whitelist"`
+	CreatedAt      string   `json:"created_at"`
+	LastUsed       string   `json:"last_used"`
+	Scopes         []string `json:"scopes,omitempty"`
+	ExpiresAt      string   `json:"expires_at,omitempty"`
+	Disabled       bool     `json:"disabled,omitempty"`
+	ContainerUUIDs []string `json:"container_uuids,omitempty"`
+	LastUsedIP     string   `json:"last_used_ip,omitempty"`
 }
 
 // DeleteApiKey removes an API key by ID
@@ -189,25 +324,50 @@ type Snapshot struct {
 	SizeBytes     int64  `json:"size_bytes"`
 }
 
+const (
+	SSLModeDisabled    = "disabled"
+	SSLModeLetsEncrypt = "letsencrypt"
+	SSLModeSelfSigned  = "self_signed"
+	SSLModeUploaded    = "uploaded"
+)
+
+type SSLConfig struct {
+	Enabled      bool   `json:"enabled"`
+	Mode         string `json:"mode"`
+	Target       string `json:"target"`
+	Email        string `json:"email,omitempty"`
+	CertPath     string `json:"cert_path,omitempty"`
+	KeyPath      string `json:"key_path,omitempty"`
+	LastIssuedAt string `json:"last_issued_at,omitempty"`
+	LastError    string `json:"last_error,omitempty"`
+}
+
 // ClicdConfig is the main configuration structure
 type ClicdConfig struct {
-	AdminUser       string          `json:"admin_user"`
-	AdminPassHash   string          `json:"admin_pass_hash"`
-	JWTSecret       string          `json:"jwt_secret"`
-	Port            int             `json:"port"`
-	DataDir         string          `json:"data_dir"`
-	Containers      []Container     `json:"containers"`
-	NextContainerID int             `json:"next_container_id"`
-	NextVNCPort     int             `json:"next_vnc_port"`
-	NextSSHPort     int             `json:"next_ssh_port"`
-	SetupComplete   bool            `json:"setup_complete"`
-	SubUsers        []SubUser       `json:"sub_users"`
-	ApiKeys         []ApiKeyConfig  `json:"api_keys"`
-	AuditLogs       []AuditLog      `json:"audit_logs"`
-	Tasks           []SavedTask     `json:"tasks"`
-	LoginLogs       []SavedLoginLog `json:"login_logs"`
-	EnabledImages   []string        `json:"enabled_images"`
-	Snapshots       []Snapshot      `json:"snapshots"`
+	AdminUser            string                 `json:"admin_user"`
+	AdminPassHash        string                 `json:"admin_pass_hash"`
+	JWTSecret            string                 `json:"jwt_secret"`
+	Port                 int                    `json:"port"`
+	DataDir              string                 `json:"data_dir"`
+	Containers           []Container            `json:"containers"`
+	NextContainerID      int                    `json:"next_container_id"`
+	NextVNCPort          int                    `json:"next_vnc_port"`
+	NextSSHPort          int                    `json:"next_ssh_port"`
+	SetupComplete        bool                   `json:"setup_complete"`
+	SubUsers             []SubUser              `json:"sub_users"`
+	ApiKeys              []ApiKeyConfig         `json:"api_keys"`
+	AuditLogs            []AuditLog             `json:"audit_logs"`
+	Tasks                []SavedTask            `json:"tasks"`
+	LoginLogs            []SavedLoginLog        `json:"login_logs"`
+	EnabledImages        []string               `json:"enabled_images"`
+	Snapshots            []Snapshot             `json:"snapshots"`
+	PublicIPv4Pool       []PublicIPv4Assignment `json:"public_ipv4_pool"`
+	PublicIPv6Prefixes   []PublicIPv6Prefix     `json:"public_ipv6_prefixes"`
+	WebSSHAllowedOrigins []string               `json:"webssh_allowed_origins"`
+	SecurityAutoShutdown bool                   `json:"security_auto_shutdown"`
+	Language             string                 `json:"language"`
+	SSL                  SSLConfig              `json:"ssl"`
+	SSLCertificates      map[string]SSLConfig   `json:"ssl_certificates"`
 }
 
 var configPath string
@@ -270,90 +430,252 @@ func InitConfig() (*ClicdConfig, error) {
 	dataDir := getDataDir()
 
 	if err := os.MkdirAll(filepath.Dir(cfgPath), 0700); err != nil {
-		return nil, fmt.Errorf("failed to create config directory: %v", err)
+		return nil, fmt.Errorf("failed to create data directory: %v", err)
 	}
 	if err := os.MkdirAll(dataDir, 0700); err != nil {
 		return nil, fmt.Errorf("failed to create data directory: %v", err)
 	}
+	if err := openConfigDB(); err != nil {
+		return nil, err
+	}
 
-	if _, err := os.Stat(cfgPath); os.IsNotExist(err) {
-		// First run: generate new config
-		adminUser := "admin"
-		adminPass := generateRandomString(16)
-		jwtSecret := generateRandomString(32)
-		hash, err := bcrypt.GenerateFromPassword([]byte(adminPass), bcrypt.DefaultCost)
-		if err != nil {
-			return nil, fmt.Errorf("failed to hash password: %v", err)
+	cfg, ok, err := loadConfigFromDB()
+	if err != nil {
+		return nil, err
+	}
+	if ok {
+		AppConfig = cfg
+		changed := normalizeConfigDefaults(dataDir)
+		if migrateLoadedConfig() {
+			changed = true
 		}
-
-		AppConfig = &ClicdConfig{
-			AdminUser:       adminUser,
-			AdminPassHash:   string(hash),
-			JWTSecret:       jwtSecret,
-			Port:            8999,
-			DataDir:         dataDir,
-			Containers:      []Container{},
-			NextContainerID: 1,
-			NextVNCPort:     5900,
-			NextSSHPort:     22000,
-			SetupComplete:   false,
-			SubUsers:        []SubUser{},
-			AuditLogs:       []AuditLog{},
-			Tasks:           []SavedTask{},
-			LoginLogs:       []SavedLoginLog{},
-			Snapshots: []Snapshot{},
+		if changed {
+			if err := SaveConfig(); err != nil {
+				return nil, err
+			}
 		}
-
-		if err := SaveConfig(); err != nil {
-			return nil, err
-		}
-
-		fmt.Println("\n========================================")
-		fmt.Println("  CLICD - LXC Container Manager")
-		fmt.Println("========================================")
-		fmt.Printf("  Username: %s\n", adminUser)
-		fmt.Printf("  Password: %s\n", adminPass)
-		fmt.Println("========================================")
-		fmt.Println("  Please save these credentials!")
-		fmt.Println("  Web Interface: http://0.0.0.0:8999")
-		fmt.Println("========================================")
-		fmt.Println()
-
 		return AppConfig, nil
 	}
 
-	// Load existing config
-	data, err := os.ReadFile(cfgPath)
+	legacy, ok, err := loadLegacyJSONConfig(cfgPath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read config: %v", err)
+		return nil, err
+	}
+	if ok {
+		AppConfig = legacy
+		normalizeConfigDefaults(dataDir)
+		migrateLoadedConfig()
+		// Always save legacy JSON data into SQLite.
+		if err := SaveConfig(); err != nil {
+			return nil, err
+		}
+		return AppConfig, nil
 	}
 
-	AppConfig = &ClicdConfig{}
-	if err := json.Unmarshal(data, AppConfig); err != nil {
-		return nil, fmt.Errorf("failed to parse config: %v", err)
+	adminUser := "admin"
+	adminPass := generateRandomString(16)
+	jwtSecret := generateRandomString(32)
+	hash, err := bcrypt.GenerateFromPassword([]byte(adminPass), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, fmt.Errorf("failed to hash password: %v", err)
 	}
 
+	AppConfig = &ClicdConfig{
+		AdminUser:            adminUser,
+		AdminPassHash:        string(hash),
+		JWTSecret:            jwtSecret,
+		Port:                 8999,
+		DataDir:              dataDir,
+		Containers:           []Container{},
+		NextContainerID:      1,
+		NextVNCPort:          5900,
+		NextSSHPort:          22000,
+		SetupComplete:        false,
+		SubUsers:             []SubUser{},
+		AuditLogs:            []AuditLog{},
+		Tasks:                []SavedTask{},
+		LoginLogs:            []SavedLoginLog{},
+		Snapshots:            []Snapshot{},
+		PublicIPv4Pool:       []PublicIPv4Assignment{},
+		PublicIPv6Prefixes:   []PublicIPv6Prefix{},
+		WebSSHAllowedOrigins: []string{},
+	}
+
+	if err := SaveConfig(); err != nil {
+		return nil, err
+	}
+
+	fmt.Println("\n========================================")
+	fmt.Println("  CLICD - LXC Container Manager")
+	fmt.Println("========================================")
+	fmt.Printf("  Username: %s\n", adminUser)
+	fmt.Printf("  Password: %s\n", adminPass)
+	fmt.Println("========================================")
+	fmt.Println("  Please save these credentials!")
+	fmt.Println("  Web Interface: http://0.0.0.0:8999")
+	fmt.Println("========================================")
+	fmt.Println()
+
+	return AppConfig, nil
+}
+
+func normalizeConfigDefaults(dataDir string) bool {
+	changed := false
 	if AppConfig.Port == 0 {
 		AppConfig.Port = 8999
+		changed = true
 	}
 	if AppConfig.NextVNCPort == 0 {
 		AppConfig.NextVNCPort = 5900
+		changed = true
 	}
 	if AppConfig.NextSSHPort == 0 {
 		AppConfig.NextSSHPort = 22000
+		changed = true
 	}
 	if AppConfig.NextContainerID == 0 {
 		AppConfig.NextContainerID = 1
+		changed = true
 	}
 	if AppConfig.DataDir == "" {
 		AppConfig.DataDir = dataDir
+		changed = true
 	}
 	if AppConfig.Containers == nil {
 		AppConfig.Containers = make([]Container, 0)
+		changed = true
 	}
 	if AppConfig.Snapshots == nil {
 		AppConfig.Snapshots = make([]Snapshot, 0)
+		changed = true
 	}
+	if AppConfig.PublicIPv4Pool == nil {
+		AppConfig.PublicIPv4Pool = make([]PublicIPv4Assignment, 0)
+		changed = true
+	}
+	if AppConfig.PublicIPv6Prefixes == nil {
+		AppConfig.PublicIPv6Prefixes = make([]PublicIPv6Prefix, 0)
+		changed = true
+	}
+	if AppConfig.WebSSHAllowedOrigins == nil {
+		AppConfig.WebSSHAllowedOrigins = make([]string, 0)
+		changed = true
+	} else if normalized, err := NormalizeAllowedOrigins(AppConfig.WebSSHAllowedOrigins); err == nil && strings.Join(normalized, "\n") != strings.Join(AppConfig.WebSSHAllowedOrigins, "\n") {
+		AppConfig.WebSSHAllowedOrigins = normalized
+		changed = true
+	}
+	if AppConfig.SubUsers == nil {
+		AppConfig.SubUsers = make([]SubUser, 0)
+		changed = true
+	}
+	if AppConfig.ApiKeys == nil {
+		AppConfig.ApiKeys = make([]ApiKeyConfig, 0)
+		changed = true
+	} else {
+		for i := range AppConfig.ApiKeys {
+			if len(AppConfig.ApiKeys[i].Scopes) == 0 {
+				AppConfig.ApiKeys[i].Scopes = []string{"*"}
+				changed = true
+			}
+		}
+	}
+	if AppConfig.AuditLogs == nil {
+		AppConfig.AuditLogs = make([]AuditLog, 0)
+		changed = true
+	}
+	if AppConfig.Tasks == nil {
+		AppConfig.Tasks = make([]SavedTask, 0)
+		changed = true
+	}
+	if AppConfig.LoginLogs == nil {
+		AppConfig.LoginLogs = make([]SavedLoginLog, 0)
+		changed = true
+	}
+	if AppConfig.EnabledImages == nil {
+		AppConfig.EnabledImages = make([]string, 0)
+		changed = true
+	}
+	if AppConfig.Language == "" {
+		AppConfig.Language = "zh"
+		changed = true
+	}
+	if AppConfig.Language != "zh" && AppConfig.Language != "en" {
+		AppConfig.Language = "zh"
+		changed = true
+	}
+	if normalizeSSLDefaults() {
+		changed = true
+	}
+	return changed
+}
+
+func NormalizeLanguage(language string) string {
+	switch strings.ToLower(strings.TrimSpace(language)) {
+	case "en", "en-us", "en_us", "english":
+		return "en"
+	default:
+		return "zh"
+	}
+}
+
+func normalizeSSLDefaults() bool {
+	changed := false
+	previousMode := AppConfig.SSL.Mode
+	AppConfig.SSL.Mode = NormalizeSSLMode(AppConfig.SSL.Mode)
+	if AppConfig.SSL.Mode != previousMode {
+		changed = true
+	}
+	if AppConfig.SSL.Mode == SSLModeDisabled {
+		if AppConfig.SSL.Enabled {
+			changed = true
+		}
+		AppConfig.SSL.Enabled = false
+	}
+	if AppConfig.SSLCertificates == nil {
+		AppConfig.SSLCertificates = map[string]SSLConfig{}
+		changed = true
+	}
+	for mode, cert := range AppConfig.SSLCertificates {
+		cert.Mode = NormalizeSSLMode(cert.Mode)
+		if cert.Mode == SSLModeDisabled {
+			delete(AppConfig.SSLCertificates, mode)
+			changed = true
+			continue
+		}
+		if AppConfig.SSLCertificates[cert.Mode] != cert {
+			changed = true
+		}
+		AppConfig.SSLCertificates[cert.Mode] = cert
+		if mode != cert.Mode {
+			delete(AppConfig.SSLCertificates, mode)
+			changed = true
+		}
+	}
+	if AppConfig.SSL.Mode != SSLModeDisabled && AppConfig.SSL.CertPath != "" && AppConfig.SSL.KeyPath != "" {
+		cert := AppConfig.SSL
+		cert.Enabled = false
+		if AppConfig.SSLCertificates[cert.Mode] != cert {
+			changed = true
+		}
+		AppConfig.SSLCertificates[cert.Mode] = cert
+	}
+	return changed
+}
+
+func NormalizeSSLMode(value string) string {
+	switch strings.ToLower(strings.TrimSpace(value)) {
+	case SSLModeLetsEncrypt:
+		return SSLModeLetsEncrypt
+	case SSLModeSelfSigned:
+		return SSLModeSelfSigned
+	case SSLModeUploaded:
+		return SSLModeUploaded
+	default:
+		return SSLModeDisabled
+	}
+}
+
+func migrateLoadedConfig() bool {
 	changed := ensureContainerUUIDs()
 	if ensureContainerVirtualization() {
 		changed = true
@@ -364,6 +686,9 @@ func InitConfig() (*ClicdConfig, error) {
 	if ensureContainerSnapshotLimits() {
 		changed = true
 	}
+	if ensureContainerNetworkAssignments() {
+		changed = true
+	}
 	if ensureContainerSnapshotScheduleDefaults() {
 		changed = true
 	}
@@ -373,13 +698,7 @@ func InitConfig() (*ClicdConfig, error) {
 	if removeLegacyVNCMappings() {
 		changed = true
 	}
-	if changed {
-		if err := SaveConfig(); err != nil {
-			return nil, err
-		}
-	}
-
-	return AppConfig, nil
+	return changed
 }
 
 func ensureContainerVirtualization() bool {
@@ -432,13 +751,16 @@ func ensureContainerUUIDs() bool {
 func ensureContainerPortMappingLimits() bool {
 	changed := false
 	for i := range AppConfig.Containers {
-		if AppConfig.Containers[i].PortMappingLimit <= 0 {
+		if AppConfig.Containers[i].PortMappingLimit < 0 {
 			limit := len(AppConfig.Containers[i].PortMappings)
 			if limit < 2 {
 				limit = 2
 			}
 			AppConfig.Containers[i].PortMappingLimit = limit
 			changed = true
+		} else if AppConfig.Containers[i].PortMappingLimit == 0 && len(AppConfig.Containers[i].PortMappings) > 0 {
+			AppConfig.Containers[i].PortMappingLimit = len(AppConfig.Containers[i].PortMappings)
+			changed = true
 		}
 	}
 	return changed
@@ -455,6 +777,16 @@ func ensureContainerSnapshotLimits() bool {
 	return changed
 }
 
+func ensureContainerNetworkAssignments() bool {
+	changed := false
+	for i := range AppConfig.Containers {
+		if AppConfig.Containers[i].NormalizeNetworkAssignments() {
+			changed = true
+		}
+	}
+	return changed
+}
+
 func migrateSubUsers() bool {
 	changed := false
 	for i := range AppConfig.SubUsers {
@@ -530,11 +862,7 @@ func removeLegacyVNCMappings() bool {
 
 // SaveConfig saves configuration to disk
 func SaveConfig() error {
-	data, err := json.MarshalIndent(AppConfig, "", "  ")
-	if err != nil {
-		return fmt.Errorf("failed to marshal config: %v", err)
-	}
-	return os.WriteFile(getConfigPath(), data, 0600)
+	return saveConfigToDB()
 }
 
 // AddContainer adds a container to the config
@@ -710,20 +1038,51 @@ func UpdateContainerStatus(id int, status string) {
 	}
 }
 
+func SetContainerPolicyBlock(id int, blocked bool, reason string) {
+	c := FindContainer(id)
+	if c == nil {
+		return
+	}
+	c.PolicyBlocked = blocked
+	if blocked {
+		c.PolicyBlockedReason = reason
+		c.PolicyBlockedAt = time.Now().Format("2006-01-02 15:04:05")
+	} else {
+		c.PolicyBlockedReason = ""
+		c.PolicyBlockedAt = ""
+	}
+	SaveConfig()
+}
+
 // UpdateVNC refreshes all container statuses
 func UpdateVNC(containers []Container) {
 	AppConfig.Containers = containers
 	SaveConfig()
 }
 
-// AllocateSSHPort allocates a new SSH port
+// AllocateSSHPort allocates a new SSH port, skipping ports already used by any container
 func AllocateSSHPort() int {
+	used := collectAllHostPorts()
 	port := AppConfig.NextSSHPort
-	AppConfig.NextSSHPort++
+	for used[port] {
+		port++
+	}
+	AppConfig.NextSSHPort = port + 1
 	SaveConfig()
 	return port
 }
 
+// collectAllHostPorts collects all host ports used by any container (LXC + KVM)
+func collectAllHostPorts() map[int]bool {
+	used := map[int]bool{}
+	for _, c := range AppConfig.Containers {
+		for _, pm := range c.PortMappings {
+			used[pm.HostPort] = true
+		}
+	}
+	return used
+}
+
 // IsValidContainerName checks if container name is valid (no duplicate check needed, ID is primary key)
 func IsValidContainerName(name string) bool {
 	return IsValidContainerNameSyntax(name)

backend/internal/config/origins.go

@@ -0,0 +1,136 @@
+package config
+
+import (
+	"fmt"
+	"net"
+	"net/url"
+	"strings"
+)
+
+// NormalizeAllowedOrigin accepts a browser Origin value such as
+// https://www.example.com and returns a canonical form for exact matching.
+func NormalizeAllowedOrigin(value string) (string, error) {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return "", nil
+	}
+	u, err := url.Parse(value)
+	if err != nil || u.Scheme == "" || u.Host == "" {
+		return "", fmt.Errorf("Origin must include scheme and host: %s", value)
+	}
+	scheme := strings.ToLower(u.Scheme)
+	if scheme != "http" && scheme != "https" {
+		return "", fmt.Errorf("Origin scheme must be http or https: %s", value)
+	}
+	if (u.Path != "" && u.Path != "/") || u.RawQuery != "" || u.Fragment != "" {
+		return "", fmt.Errorf("Origin must not include path, query, or fragment: %s", value)
+	}
+	host := normalizeOriginHostPort(u.Host, scheme)
+	if host == "" {
+		return "", fmt.Errorf("Origin host is required: %s", value)
+	}
+	return scheme + "://" + host, nil
+}
+
+func NormalizeAllowedOrigins(values []string) ([]string, error) {
+	result := make([]string, 0, len(values))
+	seen := map[string]bool{}
+	for _, value := range values {
+		origin, err := NormalizeAllowedOrigin(value)
+		if err != nil {
+			return nil, err
+		}
+		if origin == "" || seen[origin] {
+			continue
+		}
+		seen[origin] = true
+		result = append(result, origin)
+	}
+	return result, nil
+}
+
+func IsOriginAllowed(origin string, requestHost string) bool {
+	origin = strings.TrimSpace(origin)
+	if origin == "" {
+		return true
+	}
+	if isSameRequestOrigin(origin, requestHost) {
+		return true
+	}
+	normalized, err := NormalizeAllowedOrigin(origin)
+	if err != nil {
+		return false
+	}
+	if AppConfig == nil {
+		return false
+	}
+	for _, allowed := range AppConfig.WebSSHAllowedOrigins {
+		allowed, err := NormalizeAllowedOrigin(allowed)
+		if err == nil && normalized == allowed {
+			return true
+		}
+	}
+	return false
+}
+
+func isSameRequestOrigin(origin string, requestHost string) bool {
+	u, err := url.Parse(origin)
+	if err != nil || u.Host == "" {
+		return false
+	}
+	originHost := normalizeHostOnly(u.Hostname())
+	host := normalizeHostOnly(requestHost)
+	if originHost == "" || host == "" {
+		return false
+	}
+	if originHost == host {
+		return true
+	}
+	return isLoopbackHost(originHost) && isLoopbackHost(host)
+}
+
+func normalizeOriginHostPort(raw string, scheme string) string {
+	host := raw
+	port := ""
+	if h, p, err := net.SplitHostPort(raw); err == nil {
+		host = h
+		port = p
+	}
+	host = normalizeHostOnly(host)
+	if host == "" {
+		return ""
+	}
+	if (scheme == "https" && port == "443") || (scheme == "http" && port == "80") {
+		port = ""
+	}
+	if port != "" {
+		return net.JoinHostPort(host, port)
+	}
+	if strings.Contains(host, ":") && net.ParseIP(host) != nil {
+		return "[" + host + "]"
+	}
+	return host
+}
+
+func normalizeHostOnly(raw string) string {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return ""
+	}
+	if h, _, err := net.SplitHostPort(raw); err == nil {
+		raw = h
+	}
+	raw = strings.Trim(raw, "[]")
+	if ip := net.ParseIP(raw); ip != nil {
+		return strings.ToLower(ip.String())
+	}
+	return strings.TrimSuffix(strings.ToLower(raw), ".")
+}
+
+func isLoopbackHost(host string) bool {
+	if host == "localhost" {
+		return true
+	}
+	ip := net.ParseIP(host)
+	return ip != nil && ip.IsLoopback()
+}

backend/internal/config/ssl_paths.go

@@ -0,0 +1,175 @@
+package config
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+)
+
+const letsEncryptLiveDir = "/etc/letsencrypt/live"
+
+var dnsNamePattern = regexp.MustCompile(`^[A-Za-z0-9.-]+$`)
+
+func SSLStorageDir() string {
+	dataDir := ""
+	if AppConfig != nil {
+		dataDir = AppConfig.DataDir
+	}
+	if dataDir == "" {
+		dataDir = getDataDir()
+	}
+	return filepath.Join(dataDir, "ssl")
+}
+
+func UploadedSSLPaths() (string, string, error) {
+	dir, err := safeSSLStorageDir()
+	if err != nil {
+		return "", "", err
+	}
+	return filepath.Join(dir, "uploaded-fullchain.pem"), filepath.Join(dir, "uploaded-privkey.pem"), nil
+}
+
+func SelfSignedSSLPaths() (string, string, error) {
+	dir, err := safeSSLStorageDir()
+	if err != nil {
+		return "", "", err
+	}
+	return filepath.Join(dir, "self-signed-fullchain.pem"), filepath.Join(dir, "self-signed-privkey.pem"), nil
+}
+
+func LetsEncryptSSLPaths(target string) (string, string, error) {
+	name, err := NormalizeSSLCertificateTarget(target)
+	if err != nil {
+		return "", "", err
+	}
+	base := filepath.Join(letsEncryptLiveDir, name)
+	return filepath.Join(base, "fullchain.pem"), filepath.Join(base, "privkey.pem"), nil
+}
+
+func ResolveSSLConfigPaths(ssl SSLConfig) (string, string, error) {
+	mode := NormalizeSSLMode(ssl.Mode)
+	switch mode {
+	case SSLModeUploaded:
+		if ssl.CertPath != "" && ssl.KeyPath != "" {
+			return ResolveSSLPathPair(ssl.CertPath, ssl.KeyPath)
+		}
+		return UploadedSSLPaths()
+	case SSLModeSelfSigned:
+		if ssl.CertPath != "" && ssl.KeyPath != "" {
+			return ResolveSSLPathPair(ssl.CertPath, ssl.KeyPath)
+		}
+		return SelfSignedSSLPaths()
+	case SSLModeLetsEncrypt:
+		if strings.TrimSpace(ssl.Target) == "" && ssl.CertPath != "" && ssl.KeyPath != "" {
+			return ResolveSSLPathPair(ssl.CertPath, ssl.KeyPath)
+		}
+		return LetsEncryptSSLPaths(ssl.Target)
+	default:
+		return "", "", fmt.Errorf("SSL is disabled")
+	}
+}
+
+func ResolveSSLPathPair(certPath, keyPath string) (string, string, error) {
+	safeCertPath, err := ResolveSSLPath(certPath)
+	if err != nil {
+		return "", "", err
+	}
+	safeKeyPath, err := ResolveSSLPath(keyPath)
+	if err != nil {
+		return "", "", err
+	}
+	return safeCertPath, safeKeyPath, nil
+}
+
+func ResolveSSLPath(path string) (string, error) {
+	cleaned, err := cleanAbsolutePath(path)
+	if err != nil {
+		return "", err
+	}
+	if isPathUnder(cleaned, SSLStorageDir()) || isPathUnder(cleaned, letsEncryptLiveDir) || isPathUnder(cleaned, "/etc/letsencrypt/archive") {
+		return cleaned, nil
+	}
+	return "", fmt.Errorf("SSL path is outside allowed certificate directories")
+}
+
+func ReadableFileStat(path string) (os.FileInfo, error) {
+	safePath, err := ResolveSSLPath(path)
+	if err != nil {
+		return nil, err
+	}
+	return os.Stat(safePath)
+}
+
+func NormalizeSSLCertificateTarget(target string) (string, error) {
+	target = strings.TrimSpace(strings.Trim(target, "[]"))
+	if target == "" {
+		return "", fmt.Errorf("SSL target is required")
+	}
+	if strings.Contains(target, "/") || strings.Contains(target, "\\") || strings.Contains(target, "..") {
+		return "", fmt.Errorf("SSL target contains invalid path characters")
+	}
+	if ip := net.ParseIP(target); ip != nil {
+		return ip.String(), nil
+	}
+	if len(target) > 253 || !dnsNamePattern.MatchString(target) {
+		return "", fmt.Errorf("SSL target must be a valid IP address or DNS name")
+	}
+	labels := strings.Split(target, ".")
+	for _, label := range labels {
+		if label == "" || len(label) > 63 || strings.HasPrefix(label, "-") || strings.HasSuffix(label, "-") {
+			return "", fmt.Errorf("SSL target must be a valid IP address or DNS name")
+		}
+	}
+	return strings.ToLower(target), nil
+}
+
+func safeSSLStorageDir() (string, error) {
+	dir, err := cleanAbsolutePath(SSLStorageDir())
+	if err != nil {
+		return "", err
+	}
+	dataDir := ""
+	if AppConfig != nil {
+		dataDir = AppConfig.DataDir
+	}
+	if dataDir == "" {
+		dataDir = getDataDir()
+	}
+	if !isPathUnder(dir, dataDir) {
+		return "", fmt.Errorf("SSL storage directory is outside the data directory")
+	}
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		return "", err
+	}
+	return dir, nil
+}
+
+func cleanAbsolutePath(path string) (string, error) {
+	if strings.TrimSpace(path) == "" {
+		return "", fmt.Errorf("path is empty")
+	}
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Clean(abs), nil
+}
+
+func isPathUnder(path, root string) bool {
+	cleanPath, err := cleanAbsolutePath(path)
+	if err != nil {
+		return false
+	}
+	cleanRoot, err := cleanAbsolutePath(root)
+	if err != nil {
+		return false
+	}
+	rel, err := filepath.Rel(cleanRoot, cleanPath)
+	if err != nil {
+		return false
+	}
+	return rel == "." || (rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)))
+}

backend/internal/config/store_sqlite_test.go

@@ -0,0 +1,126 @@
+package config
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestSQLiteConfigMigratesLegacyJSONAndPersists(t *testing.T) {
+	resetConfigStoreForTest(t)
+
+	dir := t.TempDir()
+	t.Cleanup(func() {
+		resetConfigStoreForTest(t)
+	})
+	legacyPath := filepath.Join(dir, "config.json")
+	SetConfigPath(legacyPath)
+
+	legacy := ClicdConfig{
+		AdminUser:       "admin",
+		AdminPassHash:   "hash",
+		JWTSecret:       "secret",
+		Port:            8999,
+		DataDir:         dir,
+		NextContainerID: 2,
+		NextVNCPort:     5900,
+		NextSSHPort:     22000,
+		Containers: []Container{{
+			ID:               1,
+			UUID:             "uuid-1",
+			Name:             "ct1",
+			Virtualization:   "lxc",
+			Template:         "debian-12",
+			Status:           "running",
+			PortMappingLimit: 2,
+			SnapshotLimit:    3,
+			PortMappings: []PortMapping{{
+				ContainerPort: 22,
+				HostPort:      22001,
+				Protocol:      "tcp",
+				Description:   "SSH",
+			}},
+		}},
+		AuditLogs: []AuditLog{{
+			Time:   "2026-06-07 17:29:00",
+			Action: "security_horizontal_scan",
+			Target: "ct1",
+			Detail: "[medium] 可疑横向探测",
+			User:   "system",
+		}},
+		LoginLogs: []SavedLoginLog{{
+			Time:      "2026-06-07 17:29:01 CST",
+			Username:  "admin",
+			IP:        "127.0.0.1",
+			UserAgent: "test",
+			Success:   true,
+		}},
+		Tasks: []SavedTask{{
+			ID:            "task-1",
+			Type:          "create",
+			ContainerName: "ct2",
+			Status:        "pending",
+			CreatedAt:     "2026-06-07 17:29:02",
+			Config:        `{"name":"ct2","template_id":"debian-12","vcpu":1,"ram_mb":512,"disk_gb":5,"extra_ports":[80,443],"assign_ipv6":true}`,
+		}},
+		EnabledImages: []string{"debian-12"},
+		Snapshots: []Snapshot{{
+			ID:            "snap-1",
+			ContainerID:   1,
+			ContainerName: "ct1",
+			LXCName:       "ct-1",
+			CreatedAt:     "2026-06-07 17:30:00",
+			Path:          filepath.Join(dir, "snap-1"),
+		}},
+	}
+	data, err := json.Marshal(legacy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(legacyPath, data, 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg, err := InitConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(cfg.Containers) != 1 || len(cfg.Containers[0].PortMappings) != 1 {
+		t.Fatalf("legacy config was not migrated: %+v", cfg.Containers)
+	}
+	if len(cfg.Tasks) != 1 || !strings.Contains(cfg.Tasks[0].Config, `"extra_ports":[80,443]`) {
+		t.Fatalf("task config was not restored from sqlite columns: %+v", cfg.Tasks)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "config.db")); err != nil {
+		t.Fatalf("sqlite database was not created: %v", err)
+	}
+
+	cfg.Containers[0].Status = "stopped"
+	if err := SaveConfig(); err != nil {
+		t.Fatal(err)
+	}
+
+	resetConfigStoreForTest(t)
+	SetConfigPath(legacyPath)
+	cfg, err = InitConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := cfg.Containers[0].Status; got != "stopped" {
+		t.Fatalf("expected sqlite value to win after migration, got %q", got)
+	}
+}
+
+func resetConfigStoreForTest(t *testing.T) {
+	t.Helper()
+	if db != nil {
+		if err := db.Close(); err != nil {
+			t.Fatal(err)
+		}
+		db = nil
+	}
+	AppConfig = nil
+	configPath = ""
+}

backend/internal/kvm/kvm_test.go

@@ -0,0 +1,95 @@
+package kvm
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"reflect"
+	"testing"
+
+	"clicd/internal/config"
+
+	"golang.org/x/crypto/ssh"
+)
+
+func TestChpasswdStdinPreservesShellMetacharacters(t *testing.T) {
+	password := `pa'";$(touch /tmp/pwned); echo #\\word`
+	got, err := chpasswdStdin("root", password)
+	if err != nil {
+		t.Fatalf("chpasswdStdin returned error: %v", err)
+	}
+
+	want := []byte("root:" + password + "\n")
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("chpasswdStdin = %#v, want %#v", got, want)
+	}
+}
+
+func TestChpasswdStdinRejectsNewlines(t *testing.T) {
+	tests := []struct {
+		name     string
+		username string
+		password string
+	}{
+		{name: "username newline", username: "root\nadmin", password: "safe"},
+		{name: "username colon", username: "root:admin", password: "safe"},
+		{name: "password newline", username: "root", password: "safe\nroot:evil"},
+		{name: "password carriage return", username: "root", password: "safe\rroot:evil"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if _, err := chpasswdStdin(tc.username, tc.password); err == nil {
+				t.Fatal("chpasswdStdin returned nil error")
+			}
+		})
+	}
+}
+
+func TestVerifyKVMHostKeyCapturesAndRejectsMismatch(t *testing.T) {
+	key1 := testSSHPublicKey(t)
+	key2 := testSSHPublicKey(t)
+
+	saves := 0
+	c := &config.Container{}
+	save := func() error {
+		saves++
+		return nil
+	}
+
+	if err := verifyKVMHostKey(c, key1, save); err != nil {
+		t.Fatalf("first host key verification returned error: %v", err)
+	}
+	if c.SSHHostKey == "" {
+		t.Fatal("first host key verification did not capture fingerprint")
+	}
+	if c.SSHHostKey != sshHostKeyFingerprint(key1) {
+		t.Fatalf("captured fingerprint = %q, want %q", c.SSHHostKey, sshHostKeyFingerprint(key1))
+	}
+	if saves != 1 {
+		t.Fatalf("save count = %d, want 1", saves)
+	}
+
+	if err := verifyKVMHostKey(c, key1, save); err != nil {
+		t.Fatalf("same host key verification returned error: %v", err)
+	}
+	if saves != 1 {
+		t.Fatalf("save count after same key = %d, want 1", saves)
+	}
+
+	if err := verifyKVMHostKey(c, key2, save); err == nil {
+		t.Fatal("mismatched host key verification returned nil error")
+	}
+}
+
+func testSSHPublicKey(t *testing.T) ssh.PublicKey {
+	t.Helper()
+	_, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	signer, err := ssh.NewSignerFromKey(privateKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return signer.PublicKey()
+}

backend/internal/kvm/templates.go

@@ -12,6 +12,7 @@ type Image struct {
 	Arch        string `json:"arch"`
 	Description string `json:"description"`
 	URL         string `json:"url"`
+	Desktop     string `json:"desktop,omitempty"`
 }
 
 func GetImages() []Image {
@@ -22,6 +23,13 @@ func GetImages() []Image {
 			Description: "Ubuntu 24.04 LTS cloud image for KVM",
 			URL:         "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img",
 		},
+		{
+			ID: "kvm-ubuntu-noble-xfce", Name: "Ubuntu 24.04 XFCE KVM",
+			Distro: "ubuntu", Release: "noble", Arch: "amd64",
+			Description: "Ubuntu 24.04 LTS cloud image with XFCE desktop provisioned via cloud-init",
+			URL:         "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img",
+			Desktop:     "xfce",
+		},
 		{
 			ID: "kvm-ubuntu-jammy", Name: "Ubuntu 22.04 KVM",
 			Distro: "ubuntu", Release: "jammy", Arch: "amd64",
@@ -34,6 +42,13 @@ func GetImages() []Image {
 			Description: "Debian 12 generic cloud image for KVM",
 			URL:         "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2",
 		},
+		{
+			ID: "kvm-debian-bookworm-xfce", Name: "Debian 12 XFCE KVM",
+			Distro: "debian", Release: "bookworm", Arch: "amd64",
+			Description: "Debian 12 generic cloud image with XFCE desktop provisioned via cloud-init",
+			URL:         "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2",
+			Desktop:     "xfce",
+		},
 		{
 			ID: "kvm-debian-bullseye", Name: "Debian 11 KVM",
 			Distro: "debian", Release: "bullseye", Arch: "amd64",
@@ -70,6 +85,12 @@ func GetImages() []Image {
 			Description: "Rocky Linux 9 GenericCloud image for KVM",
 			URL:         "https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud-Base.latest.x86_64.qcow2",
 		},
+		{
+			ID: "kvm-windows-10", Name: "Windows 10 KVM",
+			Distro: "windows", Release: "10", Arch: "amd64",
+			Description: "Windows 10 Enterprise LTSC Evaluation",
+			URL:         "https://go.microsoft.com/fwlink/?LinkID=2195404",
+		},
 	}
 }
 
@@ -87,5 +108,20 @@ func CacheDir() string {
 }
 
 func ImagePath(id string) string {
-	return filepath.Join(CacheDir(), id+".qcow2")
+	img := FindImage(id)
+	ext := ".qcow2"
+	if img != nil && img.Distro == "windows" {
+		ext = ".iso"
+	}
+	return filepath.Join(CacheDir(), id+ext)
+}
+
+// IsWindowsImage returns true if the image distro is "windows".
+func IsWindowsImage(id string) bool {
+	img := FindImage(id)
+	return img != nil && img.Distro == "windows"
+}
+
+func virtioWinISOPath() string {
+	return filepath.Join(CacheDir(), "virtio-win.iso")
 }

backend/internal/lxc/lxc_test.go

@@ -0,0 +1,90 @@
+package lxc
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestRootfsCommandAddsSeparatorForAllowedCommand(t *testing.T) {
+	base := t.TempDir()
+	rootfs := filepath.Join(base, "ct-1", "rootfs")
+	if err := os.MkdirAll(rootfs, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	m := &Manager{LxcPath: base}
+	cmd, err := m.rootfsCommand(rootfs, "chpasswd")
+	if err != nil {
+		t.Fatalf("rootfsCommand returned error: %v", err)
+	}
+
+	want := []string{"chroot", "--", rootfs, "chpasswd"}
+	if !reflect.DeepEqual(cmd.Args, want) {
+		t.Fatalf("cmd.Args = %#v, want %#v", cmd.Args, want)
+	}
+}
+
+func TestRootfsCommandRejectsUnmanagedCommand(t *testing.T) {
+	base := t.TempDir()
+	rootfs := filepath.Join(base, "ct-1", "rootfs")
+	if err := os.MkdirAll(rootfs, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	m := &Manager{LxcPath: base}
+	if _, err := m.rootfsCommand(rootfs, "true"); err == nil {
+		t.Fatal("rootfsCommand allowed unmanaged command")
+	}
+}
+
+func TestRootfsCommandRejectsLeadingDashContainerName(t *testing.T) {
+	base := t.TempDir()
+	rootfs := filepath.Join(base, "-ct", "rootfs")
+	if err := os.MkdirAll(rootfs, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	m := &Manager{LxcPath: base}
+	if _, err := m.rootfsCommand(rootfs, "chpasswd"); err == nil {
+		t.Fatal("rootfsCommand allowed leading-dash container name")
+	}
+}
+
+func TestRootfsCommandRejectsUnsafeRootfsPaths(t *testing.T) {
+	base := t.TempDir()
+	outside := t.TempDir()
+	m := &Manager{LxcPath: base}
+
+	tests := []struct {
+		name string
+		path string
+	}{
+		{name: "outside base", path: filepath.Join(outside, "ct-1", "rootfs")},
+		{name: "base path", path: base},
+		{name: "not rootfs", path: filepath.Join(base, "ct-1", "not-rootfs")},
+		{name: "rootfs directly under base", path: filepath.Join(base, "rootfs")},
+		{name: "relative rootfs", path: filepath.Join("ct-1", "rootfs")},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if _, err := m.rootfsCommand(tc.path, "chpasswd"); err == nil {
+				t.Fatalf("rootfsCommand(%q) returned nil error", tc.path)
+			}
+		})
+	}
+}
+
+func TestSafeRootfsPathRejectsSiblingPrefix(t *testing.T) {
+	parent := t.TempDir()
+	base := filepath.Join(parent, "lxc")
+	siblingRootfs := filepath.Join(parent, "lxc-evil", "ct-1", "rootfs")
+	m := &Manager{LxcPath: base}
+
+	if _, err := m.safeRootfsPath(siblingRootfs); err == nil || !strings.Contains(err.Error(), "unsafe rootfs path") {
+		t.Fatalf("safeRootfsPath returned %v, want unsafe rootfs path error", err)
+	}
+}

backend/internal/lxc/portmap.go

@@ -2,8 +2,10 @@ package lxc
 
 import (
 	"fmt"
+	"net/netip"
 	"os/exec"
 	"strconv"
+	"strings"
 
 	"clicd/internal/config"
 )
@@ -17,6 +19,7 @@ func (m *Manager) ApplyPortMappings(id int) error {
 	if c.IP == "" {
 		return fmt.Errorf("container has no IP")
 	}
+	EnsureAssignedPublicIPv4s(c.PublicIPv4s)
 	tag := clicdTag(id)
 	bridge := "lxcbr0"
 	subnet := "10.0.3.0/24"
@@ -27,35 +30,180 @@ func (m *Manager) ApplyPortMappings(id int) error {
 
 	EnsureForwardRules(bridge)
 	m.CleanPortMappings(id)
+	deleteBridgeMasquerade(subnet)
 
 	for _, pm := range c.PortMappings {
-		cmd := exec.Command("iptables",
-			"-t", "nat",
-			"-I", "PREROUTING", "1",
-			"-p", pm.Protocol,
-			"--dport", fmt.Sprintf("%d", pm.HostPort),
-			"-j", "DNAT",
-			"--to-destination", fmt.Sprintf("%s:%d", c.IP, pm.ContainerPort),
-			"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%d", tag, pm.HostPort),
-		)
-		output, err := cmd.CombinedOutput()
-		if err != nil {
-			fmt.Printf("Warning: failed to apply port mapping %d->%s:%d: %v, output: %s\n",
-				pm.HostPort, c.IP, pm.ContainerPort, err, string(output))
-			continue
+		for _, hostIP := range expandPortMappingHostIPs(c, pm) {
+			args := []string{
+				"-t", "nat",
+				"-I", "PREROUTING", "1",
+				"-p", pm.Protocol,
+			}
+			if hostIP != "" {
+				args = append(args, "-d", hostIP)
+			}
+			args = append(args,
+				"--dport", fmt.Sprintf("%d", pm.HostPort),
+				"-j", "DNAT",
+				"--to-destination", fmt.Sprintf("%s:%d", c.IP, pm.ContainerPort),
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%s-%d", tag, natRuleIPTag(hostIP), pm.HostPort),
+			)
+			cmd := exec.Command("iptables", args...)
+			output, err := cmd.CombinedOutput()
+			if err != nil {
+				fmt.Printf("Warning: failed to apply port mapping %s:%d->%s:%d: %v, output: %s\n",
+					displayHostIP(hostIP), pm.HostPort, c.IP, pm.ContainerPort, err, string(output))
+				continue
+			}
+			fmt.Printf("Port mapping: %s:%d -> %s:%d\n", displayHostIP(hostIP), pm.HostPort, c.IP, pm.ContainerPort)
 		}
-		fmt.Printf("Port mapping: host:%d -> %s:%d\n", pm.HostPort, c.IP, pm.ContainerPort)
 	}
 
-	if exec.Command("iptables", "-t", "nat", "-C", "POSTROUTING", "-s", subnet, "-o", "eth+", "-j", "MASQUERADE").Run() != nil {
-		exec.Command("iptables", "-t", "nat", "-I", "POSTROUTING", "1", "-s", subnet, "-o", "eth+", "-j", "MASQUERADE").Run()
-	}
+	applyIPv4EgressPolicy(c, bridge, subnet, tag)
 
 	return nil
 }
 
+func applyIPv4EgressPolicy(c *config.Container, bridge, subnet, tag string) {
+	if c == nil || strings.TrimSpace(c.IP) == "" {
+		return
+	}
+	if containerAllowsPublicIPv4Egress(c) {
+		if _, ok := primaryPublicIPv4Assignment(c); ok {
+			applyPublicIPv4SNAT(c, tag)
+			return
+		}
+		ensureContainerMasquerade(c, tag)
+		return
+	}
+	ensureIPv4EgressBlocked(c, bridge, subnet, tag)
+}
+
+func containerAllowsPublicIPv4Egress(c *config.Container) bool {
+	if c == nil {
+		return false
+	}
+	if len(c.PublicIPv4s) > 0 {
+		return true
+	}
+	return c.PortMappingLimit > 0 || len(c.PortMappings) > 0
+}
+
+func ensureContainerMasquerade(c *config.Container, tag string) {
+	args := []string{
+		"-s", c.IP + "/32",
+		"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-masq", tag),
+		"-j", "MASQUERADE",
+	}
+	if host := DetectPublicIPv4(); strings.TrimSpace(host.Interface) != "" {
+		args = append([]string{"-o", strings.TrimSpace(host.Interface)}, args...)
+	} else {
+		args = append([]string{"-o", "eth+"}, args...)
+	}
+	ensureNATRule("POSTROUTING", args)
+}
+
+func ensureIPv4EgressBlocked(c *config.Container, bridge, subnet, tag string) {
+	args := []string{
+		"-i", bridge,
+		"-s", c.IP + "/32",
+		"!", "-d", subnet,
+		"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-v4-egress-block", tag),
+		"-j", "REJECT",
+	}
+	ensureFilterRule("FORWARD", args)
+}
+
+func ensureNATRule(chain string, args []string) {
+	check := append([]string{"-t", "nat", "-C", chain}, args...)
+	if exec.Command("iptables", check...).Run() == nil {
+		return
+	}
+	add := append([]string{"-t", "nat", "-I", chain, "1"}, args...)
+	exec.Command("iptables", add...).Run()
+}
+
+func ensureFilterRule(chain string, args []string) {
+	check := append([]string{"-C", chain}, args...)
+	if exec.Command("iptables", check...).Run() == nil {
+		return
+	}
+	add := append([]string{"-I", chain, "1"}, args...)
+	exec.Command("iptables", add...).Run()
+}
+
+func deleteBridgeMasquerade(subnet string) {
+	for exec.Command("iptables", "-t", "nat", "-D", "POSTROUTING", "-s", subnet, "-o", "eth+", "-j", "MASQUERADE").Run() == nil {
+	}
+}
+
+func applyPublicIPv4SNAT(c *config.Container, tag string) {
+	if c == nil || strings.TrimSpace(c.IP) == "" {
+		return
+	}
+	assignment, ok := primaryPublicIPv4Assignment(c)
+	if !ok {
+		return
+	}
+	hostIP := strings.TrimSpace(assignment.Address)
+	if hostIP == "" {
+		return
+	}
+	iface := strings.TrimSpace(assignment.Interface)
+	if iface == "" {
+		if info, ok := publicIPv4InfoByAddress(hostIP); ok {
+			iface = strings.TrimSpace(info.Interface)
+		}
+	}
+	if iface == "" {
+		if host := DetectPublicIPv4(); host.Interface != "" {
+			iface = host.Interface
+		}
+	}
+	args := []string{
+		"-t", "nat",
+		"-I", "POSTROUTING", "1",
+		"-s", c.IP + "/32",
+	}
+	if iface != "" {
+		args = append(args, "-o", iface)
+	}
+	args = append(args,
+		"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-snat-%s", tag, natRuleIPTag(hostIP)),
+		"-j", "SNAT", "--to-source", hostIP,
+	)
+	if output, err := exec.Command("iptables", args...).CombinedOutput(); err != nil {
+		fmt.Printf("Warning: failed to apply public IPv4 SNAT %s -> %s: %v, output: %s\n", c.IP, hostIP, err, string(output))
+	}
+}
+
+func primaryPublicIPv4Assignment(c *config.Container) (config.PublicIPv4Assignment, bool) {
+	if c == nil {
+		return config.PublicIPv4Assignment{}, false
+	}
+	for _, item := range c.PublicIPv4s {
+		if strings.TrimSpace(item.Address) != "" {
+			return item, true
+		}
+	}
+	return config.PublicIPv4Assignment{}, false
+}
+
 func clicdTag(id int) string { return "c" + strconv.Itoa(id) }
 
+func EnsureAllRunningPortMappings() {
+	m := NewManager()
+	for i := range config.AppConfig.Containers {
+		c := &config.AppConfig.Containers[i]
+		if c.Status != "running" || strings.TrimSpace(c.IP) == "" {
+			continue
+		}
+		if err := m.ApplyPortMappings(c.ID); err != nil {
+			fmt.Printf("Warning: failed to restore port mappings for %s: %v\n", c.Name, err)
+		}
+	}
+}
+
 // EnsureForwardRules makes sure iptables FORWARD chain allows bridge traffic.
 func EnsureForwardRules(bridge string) {
 	if bridge == "" {
@@ -81,8 +229,13 @@ func EnsureForwardRules(bridge string) {
 // CleanPortMappings removes all iptables rules for a container
 func (m *Manager) CleanPortMappings(id int) error {
 	tag := clicdTag(id)
+	for _, chain := range []string{"PREROUTING", "POSTROUTING"} {
+		cmd := exec.Command("sh", "-c",
+			fmt.Sprintf("iptables -t nat -L %s -n --line-numbers 2>/dev/null | grep 'clicd-%s-' | awk '{print $1}' | sort -rn | while read num; do iptables -t nat -D %s $num; done", chain, tag, chain))
+		cmd.Run()
+	}
 	cmd := exec.Command("sh", "-c",
-		fmt.Sprintf("iptables -t nat -L PREROUTING -n --line-numbers 2>/dev/null | grep 'clicd-%s' | awk '{print $1}' | sort -rn | while read num; do iptables -t nat -D PREROUTING $num; done", tag))
+		fmt.Sprintf("iptables -S FORWARD 2>/dev/null | grep 'clicd-%s-' | sed 's/^-A /-D /' | while read rule; do iptables $rule; done", tag))
 	cmd.Run()
 	return nil
 }
@@ -94,12 +247,26 @@ func SetupDefaultPortMappings(sshPort int) []config.PortMapping {
 	}
 }
 
+func DefaultPortMappingHostIP(assignments []config.PublicIPv4Assignment) string {
+	if len(assignments) == 1 {
+		return strings.TrimSpace(assignments[0].Address)
+	}
+	return ""
+}
+
+func defaultPortMappingHostIP(assignments []config.PublicIPv4Assignment) string {
+	return DefaultPortMappingHostIP(assignments)
+}
+
 // AddPortMapping adds a NAT rule to a container
 func (m *Manager) AddPortMapping(id int, pm config.PortMapping) ([]config.PortMapping, error) {
 	c := config.FindContainer(id)
 	if c == nil {
 		return nil, fmt.Errorf("container not found: %d", id)
 	}
+	if c.PortMappingLimit <= 0 {
+		return nil, fmt.Errorf("container has no IPv4 NAT port quota")
+	}
 	if c.PortMappingLimit > 0 && len(c.PortMappings) >= c.PortMappingLimit {
 		return nil, fmt.Errorf("port mapping quota exceeded: %d/%d", len(c.PortMappings), c.PortMappingLimit)
 	}
@@ -168,18 +335,42 @@ func normalizePortMapping(c *config.Container, skipIndex int, pm config.PortMapp
 	if pm.Protocol == "" {
 		pm.Protocol = "tcp"
 	}
+	pm.Protocol = strings.ToLower(strings.TrimSpace(pm.Protocol))
+	pm.HostIP = strings.TrimSpace(pm.HostIP)
+	if pm.HostIP != "" {
+		addr, err := netip.ParseAddr(pm.HostIP)
+		if err != nil || !addr.Is4() {
+			return pm, fmt.Errorf("host_ip must be a valid IPv4 address")
+		}
+		if !containerHasPublicIPv4(c, pm.HostIP) {
+			return pm, fmt.Errorf("host_ip %s is not assigned to this container", pm.HostIP)
+		}
+	}
 	if pm.Description == "" {
 		pm.Description = fmt.Sprintf("Port-%d", pm.ContainerPort)
 	}
 	if pm.HostPort <= 0 {
 		pm.HostPort = pm.ContainerPort
 	}
+	// Check current container's own mappings
 	for i, existing := range c.PortMappings {
 		if i == skipIndex {
 			continue
 		}
-		if existing.HostPort == pm.HostPort && existing.Protocol == pm.Protocol {
-			return pm, fmt.Errorf("host port %d/%s already mapped", pm.HostPort, pm.Protocol)
+		if portMappingsConflict(c, pm, c, existing) {
+			return pm, fmt.Errorf("host port %d/%s already mapped on the same IPv4 in this container", pm.HostPort, pm.Protocol)
+		}
+	}
+	// Check all other containers (LXC + KVM) for port conflicts
+	for _, oc := range config.AppConfig.Containers {
+		if oc.ID == c.ID {
+			continue
+		}
+		for _, existing := range oc.PortMappings {
+			oc := oc
+			if portMappingsConflict(c, pm, &oc, existing) {
+				return pm, fmt.Errorf("host port %d/%s already used on the same IPv4 by container %s (ID: %d)", pm.HostPort, pm.Protocol, oc.Name, oc.ID)
+			}
 		}
 	}
 	return pm, nil
@@ -190,14 +381,30 @@ func allocateDefaultEqualPorts(c *config.Container, count int) []int {
 		return nil
 	}
 	used := map[int]bool{}
+	// Mark current container's ports
 	for _, pm := range c.PortMappings {
-		used[pm.HostPort] = true
+		for _, hostIP := range expandPortMappingHostIPs(c, pm) {
+			used[hostPortKey(hostIP, pm.HostPort)] = true
+		}
 		used[pm.ContainerPort] = true
 	}
+	// Also mark all other containers' host ports (LXC + KVM)
+	for _, oc := range config.AppConfig.Containers {
+		if oc.ID == c.ID {
+			continue
+		}
+		for _, pm := range oc.PortMappings {
+			oc := oc
+			for _, hostIP := range expandPortMappingHostIPs(&oc, pm) {
+				used[hostPortKey(hostIP, pm.HostPort)] = true
+			}
+		}
+	}
 	ports := make([]int, 0, count)
 	next := 20000
 	for len(ports) < count {
-		if !used[next] {
+		hostIP := c.PrimaryPublicIPv4()
+		if !used[hostPortKey(hostIP, next)] && !used[next] {
 			ports = append(ports, next)
 		}
 		next++
@@ -207,3 +414,118 @@ func allocateDefaultEqualPorts(c *config.Container, count int) []int {
 	}
 	return ports
 }
+
+func HostPortAvailable(c *config.Container, hostIP string, hostPort int, protocol string) bool {
+	if c == nil || hostPort <= 0 {
+		return false
+	}
+	pm := config.PortMapping{HostIP: strings.TrimSpace(hostIP), HostPort: hostPort, Protocol: protocol}
+	for _, existing := range c.PortMappings {
+		if portMappingsConflict(c, pm, c, existing) {
+			return false
+		}
+	}
+	for _, oc := range config.AppConfig.Containers {
+		if oc.ID == c.ID {
+			continue
+		}
+		oc := oc
+		for _, existing := range oc.PortMappings {
+			if portMappingsConflict(c, pm, &oc, existing) {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func expandPortMappingHostIPs(c *config.Container, pm config.PortMapping) []string {
+	if strings.TrimSpace(pm.HostIP) != "" {
+		return []string{strings.TrimSpace(pm.HostIP)}
+	}
+	if c != nil && len(c.PublicIPv4s) > 0 {
+		values := make([]string, 0, len(c.PublicIPv4s))
+		for _, item := range c.PublicIPv4s {
+			if strings.TrimSpace(item.Address) != "" {
+				values = append(values, strings.TrimSpace(item.Address))
+			}
+		}
+		if len(values) > 0 {
+			return values
+		}
+	}
+	return []string{""}
+}
+
+func containerHasPublicIPv4(c *config.Container, hostIP string) bool {
+	if c == nil {
+		return false
+	}
+	for _, item := range c.PublicIPv4s {
+		if item.Address == hostIP {
+			return true
+		}
+	}
+	return false
+}
+
+func portMappingsConflict(aContainer *config.Container, a config.PortMapping, bContainer *config.Container, b config.PortMapping) bool {
+	if a.HostPort != b.HostPort || !protocolsOverlap(a.Protocol, b.Protocol) {
+		return false
+	}
+	aIPs := expandPortMappingHostIPs(aContainer, a)
+	bIPs := expandPortMappingHostIPs(bContainer, b)
+	for _, aIP := range aIPs {
+		for _, bIP := range bIPs {
+			if aIP == "" || bIP == "" || aIP == bIP {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func protocolsOverlap(a, b string) bool {
+	a = strings.ToLower(strings.TrimSpace(a))
+	b = strings.ToLower(strings.TrimSpace(b))
+	if a == "" {
+		a = "tcp"
+	}
+	if b == "" {
+		b = "tcp"
+	}
+	if a == b || a == "all" || b == "all" {
+		return true
+	}
+	return (a == "tcp+udp" && (b == "tcp" || b == "udp")) ||
+		(b == "tcp+udp" && (a == "tcp" || a == "udp"))
+}
+
+func natRuleIPTag(ip string) string {
+	ip = strings.TrimSpace(ip)
+	if ip == "" {
+		return "any"
+	}
+	return strings.ReplaceAll(ip, ".", "_")
+}
+
+func displayHostIP(ip string) string {
+	if strings.TrimSpace(ip) == "" {
+		return "host"
+	}
+	return ip
+}
+
+func hostPortKey(hostIP string, port int) int {
+	if hostIP == "" {
+		return port
+	}
+	sum := 0
+	for _, r := range hostIP {
+		sum = sum*31 + int(r)
+	}
+	if sum < 0 {
+		sum = -sum
+	}
+	return port + (sum % 1000000 * 100000)
+}

backend/internal/lxc/templates.go

@@ -46,17 +46,17 @@ func GetTemplates() []Template {
 		},
 		{
 			ID: "archlinux-current", Name: "Arch Linux",
-			Distro: "archlinux", Release: "current", Arch: "amd64", Variant: "cloud",
+			Distro: "archlinux", Release: "current", Arch: "amd64",
 			Description: "Arch Linux (Rolling)",
 		},
 		{
 			ID: "fedora-44", Name: "Fedora 44",
-			Distro: "fedora", Release: "44", Arch: "amd64", Variant: "cloud",
+			Distro: "fedora", Release: "44", Arch: "amd64",
 			Description: "Fedora 44",
 		},
 		{
 			ID: "rockylinux-10", Name: "Rocky Linux 10",
-			Distro: "rockylinux", Release: "10", Arch: "amd64", Variant: "cloud",
+			Distro: "rockylinux", Release: "10", Arch: "amd64",
 			Description: "Rocky Linux 10",
 		},
 	}

backend/internal/server/server.go

@@ -1,11 +1,10 @@
 package server
 
 import (
+	"crypto/tls"
 	"fmt"
 	"log"
-	"net"
 	"net/http"
-	"net/url"
 	"strings"
 
 	"clicd/internal/api"
@@ -18,16 +17,16 @@ var webFS http.FileSystem
 // corsMiddleware adds CORS headers
 func corsMiddleware(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		if origin := r.Header.Get("Origin"); origin != "" && isAllowedOrigin(origin, r.Host) {
+		if origin := r.Header.Get("Origin"); origin != "" && config.IsOriginAllowed(origin, r.Host) {
 			w.Header().Set("Access-Control-Allow-Origin", origin)
 			w.Header().Set("Vary", "Origin")
 			w.Header().Set("Access-Control-Allow-Credentials", "true")
 		}
-		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
 		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key")
 
 		if r.Method == http.MethodOptions {
-			if origin := r.Header.Get("Origin"); origin != "" && !isAllowedOrigin(origin, r.Host) {
+			if origin := r.Header.Get("Origin"); origin != "" && !config.IsOriginAllowed(origin, r.Host) {
 				w.WriteHeader(http.StatusForbidden)
 				return
 			}
@@ -39,53 +38,32 @@ func corsMiddleware(next http.HandlerFunc) http.HandlerFunc {
 	}
 }
 
-func isAllowedOrigin(origin string, requestHost string) bool {
-	u, err := url.Parse(origin)
-	if err != nil || u.Host == "" {
-		return false
-	}
-	originHost := normalizeHost(u.Host)
-	host := normalizeHost(requestHost)
-	if originHost == host {
-		return true
-	}
-	return isLoopbackHost(originHost) && isLoopbackHost(host)
-}
-
-func normalizeHost(host string) string {
-	if h, _, err := net.SplitHostPort(host); err == nil {
-		return strings.ToLower(h)
-	}
-	return strings.ToLower(host)
-}
-
-func isLoopbackHost(host string) bool {
-	if host == "localhost" {
-		return true
-	}
-	ip := net.ParseIP(host)
-	return ip != nil && ip.IsLoopback()
-}
-
 // setupRoutes configures API and static routes
 func setupRoutes(mux *http.ServeMux) {
 	// API routes
 	mux.HandleFunc("/api/login", corsMiddleware(api.HandleLogin))
+	mux.HandleFunc("/api/language", corsMiddleware(api.HandleLanguage))
 	mux.HandleFunc("/api/check-auth", corsMiddleware(api.AuthMiddleware(api.HandleCheckAuth)))
 	mux.HandleFunc("/api/change-password", corsMiddleware(api.AdminMiddleware(api.HandleAdminPasswordChange)))
 	mux.HandleFunc("/api/change-username", corsMiddleware(api.AdminMiddleware(api.HandleAdminUsernameChange)))
 	mux.HandleFunc("/api/login-logs", corsMiddleware(api.AdminMiddleware(api.HandleLoginLogs)))
+	mux.HandleFunc("/api/ssl", corsMiddleware(api.AdminMiddleware(api.HandleSSLSettings)))
+	mux.HandleFunc("/api/webssh-origins", corsMiddleware(api.AdminMiddleware(api.HandleWebSSHOriginSettings)))
 	mux.HandleFunc("/api/containers", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleContainers))))
+	mux.HandleFunc("/api/containers/list", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleContainerListAlias))))
 	mux.HandleFunc("/api/containers/", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleSingleContainer))))
 	mux.HandleFunc("/api/templates", corsMiddleware(api.AuthMiddleware(api.HandleTemplates)))
 	mux.HandleFunc("/api/images", corsMiddleware(api.AdminMiddleware(api.HandleImages)))
 	mux.HandleFunc("/api/images/download", corsMiddleware(api.AdminMiddleware(api.HandleImageDownload)))
+	mux.HandleFunc("/api/images/cancel", corsMiddleware(api.AdminMiddleware(api.HandleImageCancel)))
 	mux.HandleFunc("/api/images/delete", corsMiddleware(api.AdminMiddleware(api.HandleImageDelete)))
 	mux.HandleFunc("/api/images/toggle", corsMiddleware(api.AdminMiddleware(api.HandleImageToggle)))
 	mux.HandleFunc("/api/images/enabled", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleEnabledImages))))
 	mux.HandleFunc("/api/dashboard", corsMiddleware(api.AdminMiddleware(api.HandleDashboard)))
 	mux.HandleFunc("/api/host-info", corsMiddleware(api.AdminMiddleware(api.HandleHostInfo)))
+	mux.HandleFunc("/api/host-report", corsMiddleware(api.AdminMiddleware(api.HandleHostReport)))
 	mux.HandleFunc("/api/snapshots", corsMiddleware(api.AdminMiddleware(api.HandleSnapshots)))
+	mux.HandleFunc("/api/routing/ipv4-scan", corsMiddleware(api.AdminMiddleware(api.HandleRoutingIPv4Scan)))
 	mux.HandleFunc("/api/routing", corsMiddleware(api.AdminMiddleware(api.HandleRouting)))
 	mux.HandleFunc("/api/ipv6/status", corsMiddleware(api.AdminMiddleware(api.HandleIPv6Status)))
 	mux.HandleFunc("/api/tasks", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleTasks))))
@@ -102,13 +80,63 @@ func setupRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("/api/security/check", corsMiddleware(api.AdminMiddleware(api.HandleSecurityCheck)))
 	mux.HandleFunc("/api/security/logs", corsMiddleware(api.AdminMiddleware(api.HandleSecurityLogs)))
 	mux.HandleFunc("/api/security/summary", corsMiddleware(api.AdminMiddleware(api.HandleContainerSecuritySummary)))
+	mux.HandleFunc("/api/security/settings", corsMiddleware(api.AdminMiddleware(api.HandleSecuritySettings)))
 	mux.HandleFunc("/api/ssh-ticket", corsMiddleware(api.AuthMiddleware(api.HandleWebSSHTicket)))
 	mux.HandleFunc("/api/ssh", api.HandleWebSSH) // WebSocket
+	mux.HandleFunc("/api/vnc-ticket", corsMiddleware(api.AuthMiddleware(api.HandleVNCTicket)))
+	mux.HandleFunc("/api/vnc", api.HandleVNCProxy) // WebSocket
 
 	// API Key management
 	mux.HandleFunc("/api/api-keys", corsMiddleware(api.AdminMiddleware(api.HandleApiKeys)))
 	mux.HandleFunc("/api/api-keys/", corsMiddleware(api.AdminMiddleware(api.HandleApiKeyDelete)))
 
+	// Versioned external API routes
+	mux.HandleFunc("/api/v1/dashboard", corsMiddleware(api.AuthMiddleware(api.HandleDashboard)))
+	mux.HandleFunc("/api/v1/language", corsMiddleware(api.HandleLanguage))
+	mux.HandleFunc("/api/v1/containers", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleContainers))))
+	mux.HandleFunc("/api/v1/containers/list", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleContainerListAlias))))
+	mux.HandleFunc("/api/v1/containers/", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleSingleContainer))))
+	mux.HandleFunc("/api/v1/templates", corsMiddleware(api.AuthMiddleware(api.HandleTemplates)))
+	mux.HandleFunc("/api/v1/images", corsMiddleware(api.AuthMiddleware(api.HandleImages)))
+	mux.HandleFunc("/api/v1/images/download", corsMiddleware(api.AuthMiddleware(api.HandleImageDownload)))
+	mux.HandleFunc("/api/v1/images/cancel", corsMiddleware(api.AuthMiddleware(api.HandleImageCancel)))
+	mux.HandleFunc("/api/v1/images/delete", corsMiddleware(api.AuthMiddleware(api.HandleImageDelete)))
+	mux.HandleFunc("/api/v1/images/toggle", corsMiddleware(api.AuthMiddleware(api.HandleImageToggle)))
+	mux.HandleFunc("/api/v1/images/enabled", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleEnabledImages))))
+	mux.HandleFunc("/api/v1/host-info", corsMiddleware(api.AuthMiddleware(api.HandleHostInfo)))
+	mux.HandleFunc("/api/v1/host-report", corsMiddleware(api.AuthMiddleware(api.HandleHostReport)))
+	mux.HandleFunc("/api/v1/snapshots", corsMiddleware(api.AuthMiddleware(api.ScopeMiddleware("snapshot:read", api.HandleSnapshots))))
+	mux.HandleFunc("/api/v1/routing/ipv4-scan", corsMiddleware(api.AuthMiddleware(api.HandleRoutingIPv4Scan)))
+	mux.HandleFunc("/api/v1/routing", corsMiddleware(api.AuthMiddleware(api.HandleRouting)))
+	mux.HandleFunc("/api/v1/ipv6/status", corsMiddleware(api.AuthMiddleware(api.HandleIPv6Status)))
+	mux.HandleFunc("/api/v1/tasks", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleTasks))))
+	mux.HandleFunc("/api/v1/tasks/", corsMiddleware(api.AuthMiddleware(api.HandleTaskDelete)))
+	mux.HandleFunc("/api/v1/batch-create", corsMiddleware(api.AuthMiddleware(api.HandleBatchCreate)))
+	mux.HandleFunc("/api/v1/batch-action", corsMiddleware(api.AuthMiddleware(api.HandleBatchAction)))
+	mux.HandleFunc("/api/v1/sub-user/create", corsMiddleware(api.AuthMiddleware(api.HandleSubUserCreate)))
+	mux.HandleFunc("/api/v1/sub-users", corsMiddleware(api.AuthMiddleware(api.HandleSubUserList)))
+	mux.HandleFunc("/api/v1/sub-users/", corsMiddleware(api.AuthMiddleware(api.HandleSubUserAction)))
+	mux.HandleFunc("/api/v1/audit-logs", corsMiddleware(api.AuthMiddleware(api.HandleAuditLogs)))
+	mux.HandleFunc("/api/v1/login-logs", corsMiddleware(api.AuthMiddleware(api.HandleLoginLogs)))
+	mux.HandleFunc("/api/v1/ssl", corsMiddleware(api.AdminMiddleware(api.HandleSSLSettings)))
+	mux.HandleFunc("/api/v1/webssh-origins", corsMiddleware(api.AdminMiddleware(api.HandleWebSSHOriginSettings)))
+	mux.HandleFunc("/api/v1/security/alerts", corsMiddleware(api.AuthMiddleware(api.ScopeMiddleware("security:read", api.HandleSecurityAlerts))))
+	mux.HandleFunc("/api/v1/security/check", corsMiddleware(api.AuthMiddleware(api.ScopeMiddleware("security:check", api.HandleSecurityCheck))))
+	mux.HandleFunc("/api/v1/security/logs", corsMiddleware(api.AuthMiddleware(api.ScopeMiddleware("security:read", api.HandleSecurityLogs))))
+	mux.HandleFunc("/api/v1/security/summary", corsMiddleware(api.AuthMiddleware(api.ScopeMiddleware("security:read", api.HandleContainerSecuritySummary))))
+	mux.HandleFunc("/api/v1/security/settings", corsMiddleware(api.AuthMiddleware(api.HandleSecuritySettings)))
+	mux.HandleFunc("/api/v1/ssh-ticket", corsMiddleware(api.AuthMiddleware(api.HandleWebSSHTicket)))
+	mux.HandleFunc("/api/v1/vnc-ticket", corsMiddleware(api.AuthMiddleware(api.HandleVNCTicket)))
+	mux.HandleFunc("/api/v1/api-keys", corsMiddleware(api.AuthMiddleware(api.HandleApiKeys)))
+	mux.HandleFunc("/api/v1/api-keys/", corsMiddleware(api.AuthMiddleware(api.HandleApiKeyDelete)))
+	mux.HandleFunc("/api/v1/swap", corsMiddleware(api.AuthMiddleware(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodGet {
+			api.HandleSwapInfo(w, r)
+			return
+		}
+		api.HandleSwapManage(w, r)
+	})))
+
 	// Version (public)
 	mux.HandleFunc("/api/version", corsMiddleware(api.HandleVersion))
 
@@ -159,6 +187,63 @@ func Run() error {
 		Handler: mux,
 	}
 
+	if sslEnabled() {
+		certPath, keyPath, err := config.ResolveSSLConfigPaths(config.AppConfig.SSL)
+		if err != nil {
+			return err
+		}
+		server.TLSConfig = &tls.Config{
+			MinVersion: tls.VersionTLS12,
+			GetCertificate: func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+				safeCertPath, err := config.ResolveSSLPath(certPath)
+				if err != nil {
+					return nil, err
+				}
+				safeKeyPath, err := config.ResolveSSLPath(keyPath)
+				if err != nil {
+					return nil, err
+				}
+				cert, err := tls.LoadX509KeyPair(safeCertPath, safeKeyPath)
+				if err != nil {
+					return nil, err
+				}
+				return &cert, nil
+			},
+		}
+		log.Printf("CLICD Web Server SSL enabled on https://0.0.0.0:%d", config.AppConfig.Port)
+		return server.ListenAndServeTLS("", "")
+	}
+
 	return server.ListenAndServe()
 }
 
+func sslEnabled() bool {
+	ssl := config.AppConfig.SSL
+	if !ssl.Enabled {
+		return false
+	}
+	certPath, keyPath, err := config.ResolveSSLConfigPaths(ssl)
+	if err != nil {
+		log.Printf("SSL paths are invalid, falling back to HTTP: %v", err)
+		return false
+	}
+	safeCertPath, err := config.ResolveSSLPath(certPath)
+	if err != nil {
+		log.Printf("SSL certificate path is not allowed, falling back to HTTP: %v", err)
+		return false
+	}
+	safeKeyPath, err := config.ResolveSSLPath(keyPath)
+	if err != nil {
+		log.Printf("SSL private key path is not allowed, falling back to HTTP: %v", err)
+		return false
+	}
+	if _, err := config.ReadableFileStat(safeCertPath); err != nil {
+		log.Printf("SSL certificate is not readable, falling back to HTTP: %v", err)
+		return false
+	}
+	if _, err := config.ReadableFileStat(safeKeyPath); err != nil {
+		log.Printf("SSL private key is not readable, falling back to HTTP: %v", err)
+		return false
+	}
+	return true
+}

backend/internal/version/version.go

@@ -1,7 +1,7 @@
 package version
 
 var (
-	Version = "1.0.11"
+	Version = "1.1.11"
 	Repo    = "MengMengCode/CLICD"
 )
 
@@ -11,9 +11,3 @@ func Current() string {
 	}
 	return Version
 }
-
-
-
-
-
-

backend/main.go

@@ -50,10 +50,12 @@ func main() {
 
 		// Start security scanner
 		api.InitScanner()
+		api.StartSSLRenewalMonitor()
 
 		// Ensure iptables FORWARD rules allow managed bridge traffic.
 		lxc.EnsureForwardRules("lxcbr0")
 		lxc.EnsureForwardRules("virbr0")
+		lxc.EnsureAllAssignedPublicIPv4s()
 
 		// Start expiry scanners (stops expired/over-traffic workloads every 30s)
 		manager := lxc.NewManager()
@@ -64,6 +66,7 @@ func main() {
 		// Start usage monitors (computes CPU/network/disk rates every 5s)
 		manager.StartUsageMonitor()
 		kvmManager.StartUsageMonitor()
+		kvmManager.StartNetworkSyncMonitor()
 		kvmManager.StartIPv6Guard()
 
 		// Start scheduled snapshot scanners.
@@ -72,6 +75,7 @@ func main() {
 
 		// Clean up stale container configs (LXC dir was deleted but config remains)
 		config.CleanStaleContainers()
+		lxc.EnsureAllRunningPortMappings()
 
 		// Pre-warm SSH for containers already running after host boot or service restart.
 		manager.StartSSHWarmupScanner()
@@ -105,8 +109,33 @@ func isWebPanelSystemdRunning() bool {
 func startWebPanelSystemd() {
 	cmd := exec.Command("systemctl", "start", "clicd")
 	if err := cmd.Run(); err != nil {
-		fmt.Fprintf(os.Stderr, "警告: 自动启动 Web 面板失败: %v\n", err)
+		fmt.Fprintf(os.Stderr, "%s: %v\n", mainT("警告: 自动启动 Web 面板失败"), err)
 	} else {
-		fmt.Println("Web 面板已自动启动")
+		fmt.Println(mainT("Web 面板已自动启动"))
 	}
 }
+
+func mainT(text string) string {
+	if !mainEnglish() {
+		return text
+	}
+	switch text {
+	case "警告: 自动启动 Web 面板失败":
+		return "Warning: failed to auto-start web panel"
+	case "Web 面板已自动启动":
+		return "Web panel auto-started"
+	default:
+		return text
+	}
+}
+
+func mainEnglish() bool {
+	lang := strings.ToLower(strings.TrimSpace(os.Getenv("CLICD_LANG")))
+	if lang == "en" || strings.HasPrefix(lang, "en_") || strings.HasPrefix(lang, "en-") {
+		return true
+	}
+	if lang == "zh" || strings.HasPrefix(lang, "zh_") || strings.HasPrefix(lang, "zh-") {
+		return false
+	}
+	return config.AppConfig != nil && config.NormalizeLanguage(config.AppConfig.Language) == "en"
+}

docs/.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+.vitepress/cache/
+.vitepress/dist/
+.vitepress/.temp/

docs/.vitepress/config.ts

@@ -0,0 +1,74 @@
+import { defineConfig } from 'vitepress'
+
+export default defineConfig({
+  title: 'CLICD',
+  description: '面向 LXC/KVM 的轻量虚拟化管理面板文档',
+  lang: 'zh-CN',
+  base: process.env.VITEPRESS_BASE || '/',
+  cleanUrls: true,
+  ignoreDeadLinks: true,
+  head: [
+    ['link', { rel: 'icon', href: '/favicon.svg' }],
+  ],
+  themeConfig: {
+    logo: '/favicon.svg',
+    search: {
+      provider: 'local',
+    },
+    nav: [
+      { text: '指南', link: '/guide/introduction' },
+      { text: '功能', link: '/features/dashboard' },
+      { text: '运维', link: '/operations/deployment' },
+      { text: '开发', link: '/developer/architecture' },
+    ],
+    sidebar: [
+      {
+        text: '开始',
+        items: [
+          { text: '项目介绍', link: '/guide/introduction' },
+          { text: '安装', link: '/guide/installation' },
+          { text: '升级', link: '/guide/upgrade' },
+          { text: '快速上手', link: '/guide/quick-start' },
+          { text: '配置说明', link: '/guide/configuration' },
+        ],
+      },
+      {
+        text: '功能',
+        items: [
+          { text: '控制面板', link: '/features/dashboard' },
+          { text: '容器管理', link: '/features/containers' },
+          { text: '镜像管理', link: '/features/images' },
+          { text: '网络与路由', link: '/features/networking' },
+          { text: '快照管理', link: '/features/snapshots' },
+          { text: '安全告警', link: '/features/security' },
+          { text: '子用户', link: '/features/sub-users' },
+          { text: 'API 集成', link: '/features/api' },
+          { text: '主机报告', link: '/features/host-report' },
+        ],
+      },
+      {
+        text: '运维',
+        items: [
+          { text: '部署建议', link: '/operations/deployment' },
+          { text: '故障排查', link: '/operations/troubleshooting' },
+          { text: '常见问题', link: '/operations/faq' },
+        ],
+      },
+      {
+        text: '开发',
+        items: [
+          { text: '系统架构', link: '/developer/architecture' },
+          { text: '本地构建', link: '/developer/build' },
+          { text: '发布流程', link: '/developer/release' },
+        ],
+      },
+    ],
+    socialLinks: [
+      { icon: 'github', link: 'https://github.com/MengMengCode/CLICD' },
+    ],
+    footer: {
+      message: 'CLICD 文档面向部署、使用、运维和二次开发场景。',
+      copyright: 'Copyright © CLICD contributors',
+    },
+  },
+})

docs/.vitepress/theme/custom.css

@@ -0,0 +1,26 @@
+:root {
+  --vp-c-brand-1: #0284c7;
+  --vp-c-brand-2: #0ea5e9;
+  --vp-c-brand-3: #7dd3fc;
+  --vp-c-brand-soft: rgba(14, 165, 233, 0.14);
+  --vp-home-hero-name-color: #0369a1;
+  --vp-home-hero-image-background-image: linear-gradient(135deg, #7dd3fc 0%, #38bdf8 46%, #86efac 100%);
+  --vp-home-hero-image-filter: blur(46px);
+}
+
+.dark {
+  --vp-c-brand-1: #7dd3fc;
+  --vp-c-brand-2: #38bdf8;
+  --vp-c-brand-3: #0ea5e9;
+  --vp-c-brand-soft: rgba(125, 211, 252, 0.16);
+  --vp-home-hero-name-color: #bae6fd;
+}
+
+.VPHomeHero .text {
+  max-width: 680px;
+}
+
+.vp-doc table {
+  display: table;
+  width: 100%;
+}

docs/.vitepress/theme/index.ts

@@ -0,0 +1,4 @@
+import DefaultTheme from 'vitepress/theme'
+import './custom.css'
+
+export default DefaultTheme

docs/developer/architecture.md

@@ -0,0 +1,42 @@
+# 系统架构
+
+CLICD 由 Go 后端、React 前端和宿主机虚拟化能力组成。
+
+## 后端
+
+后端入口在 `backend/main.go`，HTTP 服务路由集中在 `backend/internal/server/server.go`。主要模块：
+
+- `internal/api`：Web 面板和 `/api/v1` 的 HTTP 接口。
+- `internal/config`：配置和 SQLite 存储。
+- `internal/lxc`：LXC 容器管理。
+- `internal/kvm`：KVM/libvirt 虚拟机管理。
+- `internal/cli`：命令行管理入口。
+- `internal/server`：静态前端嵌入和 HTTP 服务。
+- `internal/version`：版本号。
+
+## 前端
+
+前端入口在 `frontend/src/main.tsx`，页面位于 `frontend/src/pages`，通用组件位于 `frontend/src/components`。
+
+主要页面：
+
+- 控制面板：`Dashboard.tsx`
+- 容器列表：`Containers.tsx`
+- 容器详情：`ContainerDetail.tsx`
+- 镜像管理：`ImageManagement.tsx`
+- 安全告警：`Security.tsx`
+- 快照管理：`Snapshots.tsx`
+- 路由管理：`Routing.tsx`
+- API 集成：`ApiIntegration.tsx`
+- 主机报告：`HostReport.tsx`
+- 子用户管理：`SubUserManagement.tsx`
+
+## 前端嵌入
+
+生产构建时，前端产物会放入 `backend/internal/server/web`，后端通过 Go embed 提供静态文件，并对非 API 路由返回 SPA 入口。
+
+## 接口分层
+
+- `/api/*`：Web 面板和兼容接口。
+- `/api/v1/*`：推荐给外部自动化系统使用的版本化接口。
+- WebSSH 和 WebVNC 使用短期票据后建立 WebSocket 连接。

docs/developer/build.md

@@ -0,0 +1,42 @@
+# 本地构建
+
+## 前端构建
+
+```bash
+cd frontend
+npm install
+npm run build
+```
+
+构建输出位于 `frontend/dist`。
+
+## 后端构建
+
+```bash
+cd backend
+go test ./...
+go build -o ../build/clicd .
+```
+
+如果要打包嵌入式 Web 面板，需要先把前端构建产物同步到后端嵌入目录。
+
+## 一键构建
+
+项目根目录提供了构建脚本：
+
+```bash
+bash build.sh
+```
+
+该脚本用于串联前端构建、静态资源同步和 Go 二进制构建。
+
+## 文档站构建
+
+```bash
+cd docs
+npm install
+npm run dev
+npm run build
+```
+
+`npm run dev` 用于本地预览，`npm run build` 用于生成静态文档。

docs/developer/release.md

@@ -0,0 +1,44 @@
+# 发布流程
+
+CLICD 的安装和升级依赖 GitHub Release 产物。发布时建议使用语义化版本标签，例如 `v1.1.6`。
+
+## 版本号
+
+版本号需要同步检查：
+
+- `backend/internal/version/version.go`
+- `frontend/package.json`
+- Release 标签。
+
+## Release 产物
+
+安装脚本会优先下载 Linux AMD64 产物：
+
+```text
+clicd-linux-amd64.tar.gz
+```
+
+在部分场景中也会尝试下载单独二进制：
+
+```text
+clicd-linux-amd64
+```
+
+## 安装脚本行为
+
+- `CLICD_VERSION=latest`：使用 GitHub `releases/latest`。
+- `CLICD_VERSION=vX.Y.Z`：下载指定标签的 Release 产物。
+
+示例：
+
+```bash
+CLICD_VERSION=v1.1.6 sh install.sh
+```
+
+## 发布后验证
+
+- 安装脚本可以下载新版本。
+- `systemctl status clicd` 正常。
+- `/api/version` 返回新版本。
+- Web 面板可以加载前端资源。
+- 容器列表、任务队列、API Key 页面可以正常打开。

docs/features/api.md

@@ -0,0 +1,136 @@
+# API 集成
+
+CLICD 对外推荐使用 `/api/v1` 接口。旧版未带版本号的接口主要用于 Web 面板和兼容场景，新接入请优先使用 `/api/v1`。
+
+## 认证
+
+API Key 可在“API 集成”页面创建和管理。请求时支持两种写法：
+
+```bash
+curl -H "X-API-Key: YOUR_API_KEY" https://panel.example.com/api/v1/containers
+```
+
+```bash
+curl -H "Authorization: Bearer YOUR_API_KEY" https://panel.example.com/api/v1/dashboard
+```
+
+## Python 示例
+
+```python
+import requests
+
+BASE_URL = "https://panel.example.com"
+API_KEY = "YOUR_API_KEY"
+
+session = requests.Session()
+session.headers.update({
+    "X-API-Key": API_KEY,
+    "Content-Type": "application/json",
+})
+
+resp = session.get(f"{BASE_URL}/api/v1/containers", timeout=15)
+resp.raise_for_status()
+containers = resp.json()
+
+print(containers)
+```
+
+创建端口映射：
+
+```python
+import requests
+
+BASE_URL = "https://panel.example.com"
+API_KEY = "YOUR_API_KEY"
+CONTAINER_ID = "example-vm"
+
+payload = {
+    "name": "web",
+    "protocol": "tcp",
+    "host_port": 18080,
+    "container_port": 80,
+}
+
+resp = requests.post(
+    f"{BASE_URL}/api/v1/containers/{CONTAINER_ID}/port-mappings",
+    headers={"X-API-Key": API_KEY},
+    json=payload,
+    timeout=15,
+)
+resp.raise_for_status()
+print(resp.json())
+```
+
+## 返回结构示例
+
+容器列表：
+
+```json
+{
+  "success": true,
+  "data": [
+    {
+      "id": 5,
+      "uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+      "name": "example-vm",
+      "status": "running",
+      "ip": "10.0.3.25",
+      "ipv6": "2001:db8:100::1005",
+      "cpu_limit": 2,
+      "memory_limit": 2048,
+      "disk_limit": 20480,
+      "traffic_limit": 107374182400,
+      "expires_at": "2026-12-31 23:59:59"
+    }
+  ]
+}
+```
+
+任务队列：
+
+```json
+{
+  "success": true,
+  "data": [
+    {
+      "id": "task-13",
+      "type": "restart",
+      "status": "running",
+      "created_at": "2026-06-09T10:00:00+08:00"
+    }
+  ]
+}
+```
+
+WebSSH 票据：
+
+```json
+{
+  "success": true,
+  "data": {
+    "ticket": "***60秒有效票据***"
+  }
+}
+```
+
+## 常用接口
+
+| 方法 | 路径 | 说明 |
+| --- | --- | --- |
+| GET | `/api/v1/dashboard` | 控制面板统计 |
+| GET | `/api/v1/host-info` | 主机资源 |
+| GET | `/api/v1/containers` | 容器列表 |
+| POST | `/api/v1/containers` | 创建容器 |
+| POST | `/api/v1/containers/{id}/start` | 开机 |
+| POST | `/api/v1/containers/{id}/stop` | 关机 |
+| POST | `/api/v1/containers/{id}/restart` | 重启 |
+| DELETE | `/api/v1/containers/{id}/delete` | 删除 |
+| GET | `/api/v1/tasks` | 任务队列 |
+| GET | `/api/v1/templates` | 模板列表 |
+| GET | `/api/v1/images` | 镜像管理列表 |
+| GET | `/api/v1/snapshots` | 快照总览 |
+| GET | `/api/v1/security/alerts` | 安全告警 |
+| GET | `/api/v1/audit-logs` | 操作日志 |
+| GET | `/api/v1/api-keys` | API Key 列表 |
+
+完整接口清单请以面板内“API 集成”页面为准。

docs/features/containers.md

@@ -0,0 +1,73 @@
+# 容器管理
+
+容器管理是 CLICD 的核心模块，覆盖创建、生命周期控制、资源限制、网络映射、流量统计、密码重置和控制台访问。
+
+## 容器列表
+
+列表页用于扫描所有容器状态。管理员可以查看全部容器，子用户只能看到授权范围内的容器。
+
+常见字段包括：
+
+- ID、UUID、名称。
+- 虚拟化类型。
+- 运行状态。
+- IP、IPv6。
+- CPU、内存、磁盘限制。
+- 流量使用量和流量上限。
+- 到期时间。
+
+## 创建容器
+
+创建时需要选择模板，并设置资源配额。批量创建可以通过面板或 API 完成，适合一次性发放多个容器。
+
+```http
+POST /api/v1/containers
+POST /api/v1/batch-create
+```
+
+## 生命周期操作
+
+```http
+POST /api/v1/containers/{id}/start
+POST /api/v1/containers/{id}/stop
+POST /api/v1/containers/{id}/restart
+POST /api/v1/containers/{id}/reinstall
+DELETE /api/v1/containers/{id}/delete
+```
+
+开关机、重装、删除等操作会进入任务队列。调用后可通过 `GET /api/v1/tasks` 查看执行状态。
+
+## 资源与流量
+
+容器详情页支持查看资源用量，调整流量限制、资源限制和到期时间。
+
+```http
+GET /api/v1/containers/{id}/usage
+GET /api/v1/containers/{id}/traffic
+POST /api/v1/containers/{id}/traffic-reset
+PUT /api/v1/containers/{id}/traffic-limit
+PUT /api/v1/containers/{id}/resource-limit
+PUT /api/v1/containers/{id}/expiry
+```
+
+## NAT 端口管理
+
+容器详情页的 NAT 端口管理支持新增、编辑和删除映射。新增和编辑会在弹窗里完成，便于集中填写名称、协议、外部端口和内部端口。
+
+```http
+GET /api/v1/containers/{id}/random-port
+POST /api/v1/containers/{id}/port-mappings
+PUT /api/v1/containers/{id}/port-mappings/{index}
+DELETE /api/v1/containers/{id}/port-mappings/{index}
+```
+
+子用户模式下，管理员可限制子用户只能调整内部端口，避免修改宿主机对外端口和协议。
+
+## 远程控制台
+
+```http
+POST /api/v1/ssh-ticket
+POST /api/v1/vnc-ticket
+```
+
+票据只适合短时间使用，返回后应立即用于 WebSSH 或 WebVNC 连接，不要持久化保存。

docs/features/dashboard.md

@@ -0,0 +1,27 @@
+# 控制面板
+
+控制面板用于查看宿主机和虚拟化资源的整体状态。
+
+## 统计项
+
+- 容器总数、运行中数量和停止数量。
+- CPU、内存、磁盘、Swap 等资源概览。
+- 主机网络和路由状态入口。
+- 任务队列状态。
+- 安全告警摘要。
+
+## 相关接口
+
+```http
+GET /api/v1/dashboard
+GET /api/v1/host-info
+GET /api/v1/routing
+GET /api/v1/ipv6/status
+GET /api/v1/tasks
+```
+
+API 需要携带 API Key：
+
+```bash
+curl -H "X-API-Key: YOUR_API_KEY" https://panel.example.com/api/v1/dashboard
+```

docs/features/host-report.md

@@ -0,0 +1,21 @@
+# 主机报告
+
+主机报告用于汇总宿主机运行环境、资源状态和虚拟化依赖，适合安装后自检、故障排查或给维护人员交付环境信息。
+
+## 查看内容
+
+- 系统版本和内核信息。
+- CPU、内存、磁盘、Swap。
+- 网络状态。
+- LXC/KVM 依赖状态。
+- CLICD 服务状态。
+
+## 相关接口
+
+```http
+GET /api/v1/host-report
+GET /api/v1/host-info
+GET /api/v1/swap
+```
+
+对外发送报告前，请先检查是否包含公网 IP、内网网段、用户名、密钥、票据或业务域名。

docs/features/images.md

@@ -0,0 +1,29 @@
+# 镜像管理
+
+镜像管理用于维护可创建容器或虚拟机的模板。
+
+## 支持的模板类型
+
+项目内置了常见 Linux 发行版模板，例如 Debian、Ubuntu、Alpine、CentOS、Fedora、Arch Linux、Rocky Linux 等。KVM 模板会使用对应发行版的云镜像资源。
+
+## 管理动作
+
+```http
+GET /api/v1/templates
+GET /api/v1/images
+POST /api/v1/images/download
+POST /api/v1/images/cancel
+DELETE /api/v1/images/delete
+PUT /api/v1/images/toggle
+```
+
+- `templates` 返回可用模板定义。
+- `images` 返回本地镜像状态。
+- `download` 下载指定模板。
+- `cancel` 取消下载任务。
+- `delete` 删除本地镜像缓存。
+- `toggle` 控制模板是否对创建流程可用。
+
+## Windows 镜像说明
+
+本项目不分发 Windows 系统镜像，也不提供绕过或规避 Windows 激活机制的功能。涉及 Windows 的下载链接应指向微软官方资源，使用者需要自行获得合法授权。

docs/features/networking.md

@@ -0,0 +1,39 @@
+# 网络与路由
+
+CLICD 提供 NAT4 端口映射、随机可用端口、IPv6 状态检查和 IPv6 分配能力。
+
+## NAT4
+
+NAT4 用于把宿主机端口转发到容器内部端口。典型用途：
+
+- 转发 SSH。
+- 暴露 Web 服务。
+- 给子用户分配固定外部端口。
+
+端口映射包含：
+
+| 字段 | 说明 |
+| --- | --- |
+| 名称 | 用于识别用途，例如 `ssh`、`web`。 |
+| 协议 | `tcp` 或 `udp`。 |
+| 外部端口 | 宿主机对外监听端口。 |
+| 内部端口 | 容器内部服务端口。 |
+
+## IPv6
+
+IPv6 分配要求宿主机本身拥有可路由 IPv6 地址段，并且系统路由、邻居发现或代理策略配置正确。
+
+```http
+GET /api/v1/ipv6/status
+POST /api/v1/containers/{id}/ipv6
+```
+
+如果宿主机没有公网 IPv6 或上游没有正确路由，面板中分配出的地址也无法从公网访问。
+
+## 路由状态
+
+```http
+GET /api/v1/routing
+```
+
+该接口用于查看 NAT、IPv6、端口容量等运行时状态。

docs/features/security.md

@@ -0,0 +1,31 @@
+# 安全告警
+
+CLICD 内置基于连接行为的轻量安全告警能力。它不保存完整正常连接日志，而是关注异常行为和高风险模式。
+
+## 覆盖场景
+
+- 端口扫描。
+- 横向扫描。
+- 爆破倾向。
+- SMTP 滥用。
+- UDP 反射风险。
+- 挖矿、代理、VPN、Tor 等可疑端口。
+
+## 接口
+
+```http
+GET /api/v1/security/alerts
+POST /api/v1/security/check
+GET /api/v1/security/logs?container={name}
+GET /api/v1/security/summary
+GET /api/v1/security/settings
+PUT /api/v1/security/settings
+```
+
+## 自动关机
+
+安全设置中可配置告警后的自动关机策略。开启前建议先观察一段时间，确认规则不会影响正常业务。
+
+## 日志建议
+
+安全告警适合做风险提示，不应替代专业防火墙、入侵检测或集中日志系统。对公网暴露服务时，仍建议结合安全组、防火墙、Fail2ban 等工具。

docs/features/snapshots.md

@@ -0,0 +1,31 @@
+# 快照管理
+
+快照用于保存容器当前状态，方便在升级、变更配置或交付前回滚。
+
+## 全局总览
+
+```http
+GET /api/v1/snapshots
+```
+
+用于查看所有容器的快照概览。
+
+## 容器快照
+
+```http
+GET /api/v1/containers/{id}/snapshots
+POST /api/v1/containers/{id}/snapshots
+DELETE /api/v1/containers/{id}/snapshots/{snapshot_id}
+POST /api/v1/containers/{id}/snapshots/{snapshot_id}/restore
+```
+
+恢复快照会改变容器状态，生产环境建议先确认当前业务是否可以中断。
+
+## 计划快照与配额
+
+```http
+POST /api/v1/containers/{id}/snapshots/schedule
+PUT /api/v1/containers/{id}/snapshots/quota
+```
+
+计划快照适合长期运行的容器。配额用于避免快照无限增长占满宿主机磁盘。

docs/features/sub-users.md

@@ -0,0 +1,28 @@
+# 子用户
+
+子用户用于把指定容器授权给其他用户管理。它适合临时交付、拼车分配、教学实验或多人共用宿主机的场景。
+
+## 创建访问链接
+
+管理员选择容器后创建子用户链接：
+
+```http
+POST /api/v1/sub-user/create
+```
+
+返回内容中可能包含用户名、初始密码、访问码或访问链接。对外展示时必须脱敏，真实值只应发送给对应用户。
+
+## 管理子用户
+
+```http
+GET /api/v1/sub-users
+POST /api/v1/sub-users/{id}/rotate-password
+GET /api/v1/sub-users/{id}/audit-logs
+GET /api/v1/sub-users/{id}/login-logs
+```
+
+轮换密码会让旧凭证失效。审计日志和登录日志可用于排查误操作或异常访问。
+
+## 权限范围
+
+子用户只能管理被授权的容器。涉及全局配置、镜像管理、安全策略、API Key 等管理员功能不会开放给子用户。

docs/guide/configuration.md

@@ -0,0 +1,30 @@
+# 配置说明
+
+CLICD 安装后会以 systemd 服务运行，运行时配置和数据库保存在宿主机本地。实际路径可能随安装脚本参数变化，默认安装建议以 `/root/.clicd/` 为主要检查位置。
+
+## 常见配置项
+
+| 配置 | 说明 |
+| --- | --- |
+| Web 端口 | 默认 `8999`，服务启动时监听 `0.0.0.0:8999`。 |
+| 管理员账号 | 用于登录 Web 面板和管理 API Key。 |
+| 数据库 | SQLite，用于保存容器元数据、子用户、审计日志、API Key 等。 |
+| NAT 端口范围 | 用于随机端口和端口映射分配。 |
+| IPv6 地址段 | 宿主机有可路由 IPv6 时可配置分配策略。 |
+| 安全告警 | 可配置自动关机等策略。 |
+
+## 服务命令
+
+```bash
+systemctl status clicd
+systemctl restart clicd
+journalctl -u clicd -n 100 --no-pager
+```
+
+## 安全建议
+
+- 不要把 Web 面板直接暴露给不可信来源。
+- 使用复杂管理员密码，并定期轮换。
+- API Key 按用途拆分权限，避免长期使用全权限密钥。
+- WebSSH、WebVNC 票据是短期凭证，不应写入日志或外发。
+- 对外文档、截图和工单里不要粘贴真实 IP、密码、API Key 或票据。

docs/guide/installation.md

@@ -0,0 +1,46 @@
+# 安装
+
+CLICD 提供一键安装脚本。脚本默认安装 GitHub Releases 的最新版本，也可以通过环境变量指定固定版本。
+
+## 环境要求
+
+- Linux x86_64 宿主机。
+- root 权限。
+- systemd。
+- 网络可访问 GitHub Release 下载地址。
+- 如果要使用 LXC，需要宿主机支持 LXC 运行环境。
+- 如果要使用 KVM，需要宿主机开启虚拟化并安装 libvirt/QEMU。
+
+## 安装最新版本
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh
+```
+
+脚本当前默认使用 `CLICD_VERSION=latest`，也就是下载 `releases/latest` 对应的 `clicd-linux-amd64.tar.gz`。
+
+## 安装指定版本
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo CLICD_VERSION=v1.1.6 sh
+```
+
+把 `v1.1.6` 替换成需要安装的 Release 标签即可。
+
+## 访问面板
+
+安装完成后，浏览器访问：
+
+```text
+http://YOUR_SERVER_IP:8999
+```
+
+首次登录请使用安装脚本输出的管理员账号信息。生产环境建议在防火墙或反向代理层限制访问来源，并尽快修改默认账号和密码。
+
+## 卸载
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh -s -- uninstall
+```
+
+卸载前请确认是否需要保留容器、镜像缓存、数据库和配置文件。

docs/guide/introduction.md

@@ -0,0 +1,29 @@
+# 项目介绍
+
+CLICD 是一个面向 LXC/KVM 的轻量虚拟化管理面板。它把常见宿主机运维动作收敛到 Web 控制台和命令行里，适合用来管理小型 VPS、独立服务器或需要批量分发容器访问权限的场景。
+
+## 核心能力
+
+- 管理 LXC 容器和 KVM 虚拟机。
+- 创建、开机、关机、重启、重装、删除容器。
+- 配置 CPU、内存、磁盘、流量限制和到期时间。
+- 管理 NAT4 端口映射，并在宿主机具备 IPv6 路由时分配公网 IPv6。
+- 在浏览器中打开 WebSSH 或 WebVNC。
+- 管理镜像下载、启用状态和本地缓存。
+- 创建、恢复、删除快照，配置计划快照和快照配额。
+- 基于连接行为生成安全告警，并保留审计日志。
+- 为指定容器创建子用户访问链接。
+- 通过 API Key 接入 `/api/v1` 自动化接口。
+
+## 适用场景
+
+- 一台宿主机上需要快速分配多个 Linux 容器。
+- 需要给用户临时发放容器控制台、SSH、VNC 或 NAT 端口管理权限。
+- 希望用 API 自动化创建容器、调整资源、重置密码或回收资源。
+- 需要一个比纯 CLI 更直观，但又不重型的平台面板。
+
+## 技术栈
+
+- 后端：Go、`net/http`、SQLite、systemd、LXC、KVM/libvirt、cgroup v2、iptables、conntrack。
+- 前端：React、TypeScript、Vite、Tailwind CSS、lucide-react、xterm.js、noVNC。
+- 发布：GitHub Actions 构建 Linux AMD64 release 产物，安装脚本默认拉取最新 Release。

docs/guide/quick-start.md

@@ -0,0 +1,36 @@
+# 快速上手
+
+下面是一条从安装后到创建第一台容器的常用路径。
+
+## 1. 登录控制台
+
+访问 `http://YOUR_SERVER_IP:8999`，使用管理员账号登录。
+
+进入面板后先检查：
+
+- 控制面板是否显示主机资源。
+- 镜像管理是否能列出模板。
+- 路由管理中 NAT 和 IPv6 状态是否符合宿主机预期。
+
+## 2. 下载镜像
+
+进入“镜像管理”，选择需要的模板并下载。宿主机资源较小时，可以优先选择 Alpine、Debian 这类轻量镜像。
+
+镜像下载是异步任务，可以在任务队列中观察进度。
+
+## 3. 创建容器
+
+进入“容器管理”，点击创建：
+
+- 选择虚拟化类型和模板。
+- 设置 CPU、内存、磁盘。
+- 设置流量限制和到期时间。
+- 如果需要外部访问，创建后到容器详情里添加 NAT 端口映射或分配 IPv6。
+
+## 4. 打开终端
+
+容器创建完成后，可以在详情页打开 WebSSH。KVM 虚拟机可使用 WebVNC 查看控制台。
+
+## 5. 分发给子用户
+
+如果需要把某个容器交给其他用户管理，进入“子用户管理”创建访问链接。子用户只会看到被授权的容器，并受到管理员配置的操作范围限制。

docs/guide/upgrade.md

@@ -0,0 +1,43 @@
+# 升级
+
+CLICD 的安装脚本和 CLI 都围绕 GitHub Release 产物工作。升级前建议先确认当前版本、备份配置和数据库。
+
+## 查看版本
+
+Web 面板侧边栏底部会显示当前版本，也可以访问：
+
+```bash
+curl http://127.0.0.1:8999/api/version
+```
+
+返回示例：
+
+```json
+{
+  "success": true,
+  "data": {
+    "version": "1.1.6"
+  }
+}
+```
+
+## 使用安装脚本升级
+
+安装脚本默认使用最新 Release：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh
+```
+
+指定版本：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo CLICD_VERSION=v1.1.6 sh
+```
+
+## 升级前检查
+
+- 确认 `/root/.clicd/` 或实际配置目录已备份。
+- 确认系统服务没有正在执行关键任务。
+- 如果正在下载镜像或恢复快照，建议等待任务完成后再升级。
+- 升级后检查 `systemctl status clicd` 和 Web 面板版本号。

docs/index.md

@@ -0,0 +1,23 @@
+---
+layout: home
+
+hero:
+  name: CLICD
+  text: 轻量 LXC/KVM 虚拟化管理面板
+  tagline: 提供 Web 控制台、CLI、容器编排、NAT/IPv6、快照、安全告警、子用户和 API 自动化能力。
+  actions:
+    - theme: brand
+      text: 开始安装
+      link: /guide/installation
+    - theme: alt
+      text: 查看 API
+      link: /features/api
+
+features:
+  - title: 面向小型宿主机
+    details: 适合在单台 VPS 或独立服务器上管理 LXC 容器与 KVM 虚拟机。
+  - title: Web 与 CLI 并行
+    details: 管理员可使用 Web 面板，也可以进入 clicd CLI 完成维护操作。
+  - title: 自动化友好
+    details: /api/v1 提供容器、镜像、快照、安全、日志、子用户和 API Key 管理接口。
+---

docs/operations/deployment.md

@@ -0,0 +1,46 @@
+# 部署建议
+
+CLICD 可以直接运行在宿主机上，也可以放在反向代理之后。生产环境建议先做好访问控制，再开放给管理员使用。
+
+## 服务暴露
+
+默认 Web 端口为 `8999`：
+
+```text
+http://YOUR_SERVER_IP:8999
+```
+
+建议：
+
+- 仅允许固定管理员 IP 访问。
+- 使用反向代理配置 HTTPS。
+- 不要在公开文档或截图里暴露真实登录地址。
+
+## systemd
+
+常用命令：
+
+```bash
+systemctl status clicd
+systemctl restart clicd
+systemctl enable clicd
+journalctl -u clicd -f
+```
+
+## 防火墙
+
+至少确认：
+
+- 面板端口只对可信来源开放。
+- NAT 映射端口按需开放。
+- SSH 管理端口不与容器映射冲突。
+- IPv6 防火墙规则与 IPv4 同步规划。
+
+## 备份
+
+建议定期备份：
+
+- CLICD 配置目录。
+- SQLite 数据库。
+- 容器配置。
+- 关键容器的快照或外部数据备份。

docs/operations/faq.md

@@ -0,0 +1,29 @@
+# 常见问题
+
+## 安装脚本默认安装哪个版本？
+
+默认安装 GitHub Releases 的最新版本。脚本中默认值是 `CLICD_VERSION=latest`，会下载 `releases/latest` 下的 Linux AMD64 产物。
+
+## 可以固定安装某个版本吗？
+
+可以：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo CLICD_VERSION=v1.1.6 sh
+```
+
+## 子用户能看到全部容器吗？
+
+不能。子用户只会看到管理员授权给他的容器。
+
+## API Key 和登录密码一样吗？
+
+不一样。API Key 在“API 集成”页面创建，用于程序化调用接口。登录密码用于 Web 面板登录。
+
+## 到达流量限制后会怎样？
+
+容器达到流量限制后会被自动关机，避免继续产生超额流量。管理员可以调整限制或重置流量。
+
+## IPv6 分配后为什么公网不通？
+
+IPv6 是否可达取决于宿主机和上游网络。需要确认宿主机拥有可路由 IPv6 地址段，并且路由、防火墙、邻居发现或代理配置正确。

docs/operations/troubleshooting.md

@@ -0,0 +1,46 @@
+# 故障排查
+
+## 服务无法访问
+
+检查服务状态：
+
+```bash
+systemctl status clicd
+journalctl -u clicd -n 100 --no-pager
+```
+
+检查端口监听：
+
+```bash
+ss -lntp | grep 8999
+```
+
+如果使用反向代理，请同时检查代理日志和上游地址。
+
+## 镜像下载失败
+
+- 确认宿主机可以访问镜像源和 GitHub Release。
+- 检查磁盘空间。
+- 在任务队列里查看失败原因。
+- 如下载卡住，可尝试取消任务后重新下载。
+
+## 容器无法联网
+
+- 检查宿主机 NAT 和转发规则。
+- 检查容器 IP 是否分配成功。
+- 检查防火墙是否拦截转发流量。
+- IPv6 场景下确认上游已经把地址段路由到宿主机。
+
+## WebSSH 或 WebVNC 连接失败
+
+- 确认容器或虚拟机正在运行。
+- WebSSH 需要容器内 SSH 服务可用。
+- WebVNC 需要 KVM 控制台可访问。
+- 票据有效期很短，过期后重新创建即可。
+
+## API 返回未授权
+
+- 确认 API Key 没有被禁用。
+- 确认请求头使用 `X-API-Key` 或 `Authorization: Bearer`。
+- 确认密钥权限范围覆盖目标接口。
+- 不要把面板登录密码当作 API Key 使用。

docs/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "clicd-docs",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vitepress dev . --host 127.0.0.1",
+    "build": "vitepress build .",
+    "preview": "vitepress preview . --host 127.0.0.1"
+  },
+  "devDependencies": {
+    "vitepress": "^1.6.4"
+  },
+  "overrides": {
+    "vite": "6.4.2"
+  }
+}

docs/public/CNAME

@@ -0,0 +1 @@
+cli.cd

docs/public/favicon.svg

@@ -0,0 +1 @@
+<svg t="1780499553554" class="icon" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" p-id="4260" width="200" height="200"><path d="M852.9 147.8c4.9 0 9.1 4.2 9.1 9.1v167.8c0 4.9-4.2 9.1-9.1 9.1H171.1c-4.9 0-9.1-4.2-9.1-9.1V156.9c0-4.9 4.2-9.1 9.1-9.1h681.8m0-50H171.1c-32.5 0-59.1 26.6-59.1 59.1v167.8c0 32.5 26.6 59.1 59.1 59.1h681.8c32.5 0 59.1-26.6 59.1-59.1V156.9c0-32.5-26.6-59.1-59.1-59.1z" p-id="4261" fill="#707070"></path><path d="M290.5 214h-60v60h60v-60zM393.5 214h-60v60h60v-60zM806 214H591v60h215v-60zM852.9 417.8c4.9 0 9.1 4.2 9.1 9.1v167.8c0 4.9-4.2 9.1-9.1 9.1H171.1c-4.9 0-9.1-4.2-9.1-9.1V426.9c0-4.9 4.2-9.1 9.1-9.1h681.8m0-50H171.1c-32.5 0-59.1 26.6-59.1 59.1v167.8c0 32.5 26.6 59.1 59.1 59.1h681.8c32.5 0 59.1-26.6 59.1-59.1V426.9c0-32.5-26.6-59.1-59.1-59.1z" p-id="4262" fill="#707070"></path><path d="M290.5 484h-60v60h60v-60zM393.5 484h-60v60h60v-60zM806 484H591v60h215v-60zM852.9 687.8c4.9 0 9.1 4.2 9.1 9.1v167.8c0 4.9-4.2 9.1-9.1 9.1H171.1c-4.9 0-9.1-4.2-9.1-9.1V696.9c0-4.9 4.2-9.1 9.1-9.1h681.8m0-50H171.1c-32.5 0-59.1 26.6-59.1 59.1v167.8c0 32.5 26.6 59.1 59.1 59.1h681.8c32.5 0 59.1-26.6 59.1-59.1V696.9c0-32.5-26.6-59.1-59.1-59.1z" p-id="4263" fill="#707070"></path><path d="M290.5 754h-60v60h60v-60zM393.5 754h-60v60h60v-60zM806 754H591v60h215v-60z" p-id="4264" fill="#707070"></path></svg>

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clicd-frontend",
   "private": true,
-  "version": "1.0.0",
+  "version": "1.1.11",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -9,6 +9,7 @@
     "preview": "vite preview"
   },
   "dependencies": {
+    "@novnc/novnc": "1.5.0",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "axios": "^1.7.7",
@@ -20,11 +21,11 @@
   "devDependencies": {
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
-    "@vitejs/plugin-react": "^4.3.4",
+    "@vitejs/plugin-react": "^5.2.0",
     "autoprefixer": "^10.4.20",
     "postcss": "^8.4.49",
     "tailwindcss": "^3.4.15",
     "typescript": "^5.6.3",
-    "vite": "^5.4.11"
+    "vite": "^8.0.16"
   }
 }

frontend/src/App.tsx

@@ -8,6 +8,7 @@ import ContainerDetail from './pages/ContainerDetail'
 import Security from './pages/Security'
 import AuditLogs from './pages/AuditLogs'
 import ApiIntegration from './pages/ApiIntegration'
+import HostReport from './pages/HostReport'
 import Settings from './pages/Settings'
 import ImageManagement from './pages/ImageManagement'
 import Snapshots from './pages/Snapshots'
@@ -64,6 +65,7 @@ function App() {
         <Route path="routing" element={<Routing />} />
         <Route path="audit-logs" element={<AuditLogs />} />
         <Route path="api-integration" element={<ApiIntegration />} />
+        <Route path="host-report" element={<HostReport />} />
         <Route path="sub-users" element={<SubUserManagement />} />
         <Route path="settings" element={<Settings />} />
       </Route>

frontend/src/components/AutoTranslate.tsx

@@ -0,0 +1,182 @@
+import { useEffect } from 'react'
+import { useLocation } from 'react-router-dom'
+import { useLanguage } from '../contexts/LanguageContext'
+import { shouldTranslateText, translateText } from '../utils/i18n'
+
+const translatedTitleAttr = 'data-i18n-title-original'
+const translatedPlaceholderAttr = 'data-i18n-placeholder-original'
+const translatedAriaLabelAttr = 'data-i18n-aria-label-original'
+
+const attributeNames = ['title', 'placeholder', 'aria-label'] as const
+const translatedTextNodes = new Set<Text>()
+const textOriginals = new WeakMap<Text, string>()
+const wholeTextSelector = 'button,a,span,label,option,th,td,p,h1,h2,h3,h4,small'
+
+export default function AutoTranslate() {
+  const { language } = useLanguage()
+  const location = useLocation()
+
+  useEffect(() => {
+    if (language === 'zh') {
+      restoreTranslatedNodes(document.body)
+      return
+    }
+
+    translateNode(document.body)
+
+    const pending = new Set<Node>()
+    let scheduled = false
+    const flush = () => {
+      scheduled = false
+      const nodes = Array.from(pending)
+      pending.clear()
+      for (const node of nodes) {
+        if (node.isConnected) translateNode(node)
+      }
+    }
+    const schedule = (node: Node) => {
+      pending.add(node)
+      if (scheduled) return
+      scheduled = true
+      window.requestAnimationFrame(flush)
+    }
+
+    const observer = new MutationObserver((mutations) => {
+      for (const mutation of mutations) {
+        if (mutation.type === 'childList') {
+          mutation.addedNodes.forEach(schedule)
+        } else {
+          schedule(mutation.target)
+        }
+      }
+    })
+    observer.observe(document.body, {
+      childList: true,
+      subtree: true,
+      characterData: true,
+      attributes: true,
+      attributeFilter: [...attributeNames],
+    })
+    return () => observer.disconnect()
+  }, [language, location.pathname, location.search])
+
+  return null
+}
+
+function translateNode(root: Node) {
+  if (root.nodeType === Node.TEXT_NODE) {
+    translateTextNode(root as Text)
+    return
+  }
+  if (!(root instanceof Element)) return
+  if (shouldSkipElement(root)) return
+
+  translateWholeTextElement(root)
+  root.querySelectorAll<HTMLElement>(wholeTextSelector).forEach(translateWholeTextElement)
+  translateElementAttributes(root)
+  const walker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT, {
+    acceptNode(node) {
+      if (!node.textContent || !shouldTranslateText(node.textContent)) return NodeFilter.FILTER_REJECT
+      const parent = node.parentElement
+      if (!parent || shouldSkipElement(parent)) {
+        return NodeFilter.FILTER_REJECT
+      }
+      return NodeFilter.FILTER_ACCEPT
+    },
+  })
+
+  const nodes: Text[] = []
+  while (walker.nextNode()) nodes.push(walker.currentNode as Text)
+  for (const node of nodes) translateTextNode(node)
+  root.querySelectorAll<HTMLElement>('[title], [placeholder], [aria-label]').forEach(translateElementAttributes)
+}
+
+function translateTextNode(node: Text) {
+  const original = node.textContent || ''
+  if (!shouldTranslateText(original)) return
+  const parent = node.parentElement
+  if (!parent || shouldSkipElement(parent)) return
+  const translated = translateText(original)
+  if (translated === original) return
+  textOriginals.set(node, original)
+  translatedTextNodes.add(node)
+  node.textContent = translated
+}
+
+function translateWholeTextElement(el: Element) {
+  if (!(el instanceof HTMLElement) || shouldSkipElement(el) || !isSimpleTextElement(el)) return
+  const original = el.textContent || ''
+  if (!shouldTranslateText(original)) return
+  const translated = translateText(original)
+  if (translated === original) return
+
+  const textNodes = directTextNodes(el)
+  if (textNodes.length === 0) return
+  textNodes.forEach((node, index) => {
+    textOriginals.set(node, node.textContent || '')
+    translatedTextNodes.add(node)
+    node.textContent = index === 0 ? translated : ''
+  })
+}
+
+function directTextNodes(el: HTMLElement) {
+  return Array.from(el.childNodes).filter((node): node is Text => node.nodeType === Node.TEXT_NODE)
+}
+
+function translateElementAttributes(el: Element) {
+  if (!(el instanceof HTMLElement)) return
+  translateAttribute(el, 'title', translatedTitleAttr)
+  translateAttribute(el, 'placeholder', translatedPlaceholderAttr)
+  translateAttribute(el, 'aria-label', translatedAriaLabelAttr)
+}
+
+function restoreTranslatedNodes(root: ParentNode) {
+  for (const node of Array.from(translatedTextNodes)) {
+    if (!node.isConnected) {
+      translatedTextNodes.delete(node)
+      continue
+    }
+    if (root instanceof Document || root.contains(node)) {
+      node.textContent = textOriginals.get(node) || node.textContent
+      translatedTextNodes.delete(node)
+    }
+  }
+  root.querySelectorAll<HTMLElement>(`[${translatedTitleAttr}]`).forEach((el) => {
+    el.setAttribute('title', el.getAttribute(translatedTitleAttr) || '')
+    el.removeAttribute(translatedTitleAttr)
+  })
+  root.querySelectorAll<HTMLInputElement | HTMLTextAreaElement>(`[${translatedPlaceholderAttr}]`).forEach((el) => {
+    el.setAttribute('placeholder', el.getAttribute(translatedPlaceholderAttr) || '')
+    el.removeAttribute(translatedPlaceholderAttr)
+  })
+  root.querySelectorAll<HTMLElement>(`[${translatedAriaLabelAttr}]`).forEach((el) => {
+    el.setAttribute('aria-label', el.getAttribute(translatedAriaLabelAttr) || '')
+    el.removeAttribute(translatedAriaLabelAttr)
+  })
+}
+
+function translateAttribute(el: HTMLElement, attr: 'title' | 'placeholder' | 'aria-label', originalAttr: string) {
+  const storedOriginal = el.getAttribute(originalAttr)
+  const original = storedOriginal || el.getAttribute(attr) || ''
+  if (!shouldTranslateText(original)) return
+  const translated = translateText(original)
+  if (translated === original) return
+  if (!storedOriginal) {
+    el.setAttribute(originalAttr, original)
+  }
+  if (el.getAttribute(attr) !== translated) {
+    el.setAttribute(attr, translated)
+  }
+}
+
+function shouldSkipElement(el: Element) {
+  return !!el.closest('script, style, code, pre, textarea, [data-no-translate]')
+}
+
+function isSimpleTextElement(el: HTMLElement) {
+  if (!el.matches(wholeTextSelector)) return false
+  if (el.querySelector('input, textarea, select, button, table, pre, code, canvas, iframe')) return false
+  const textNodes = directTextNodes(el)
+  if (textNodes.length === 0) return false
+  return Array.from(el.children).every((child) => child.tagName.toLowerCase() === 'svg')
+}

frontend/src/components/BrowserDialogTranslator.tsx

@@ -0,0 +1,19 @@
+import { useEffect } from 'react'
+import { useLanguage } from '../contexts/LanguageContext'
+
+export default function BrowserDialogTranslator() {
+  const { t } = useLanguage()
+
+  useEffect(() => {
+    const originalAlert = window.alert
+    const originalConfirm = window.confirm
+    window.alert = (message?: unknown) => originalAlert(t(String(message ?? '')))
+    window.confirm = (message?: string) => originalConfirm(t(String(message ?? '')))
+    return () => {
+      window.alert = originalAlert
+      window.confirm = originalConfirm
+    }
+  }, [t])
+
+  return null
+}

frontend/src/components/ContainerCard.tsx

@@ -56,7 +56,7 @@ export default function ContainerCard({ container, onRefresh }: ContainerCardPro
       {/* Header */}
       <div className="flex items-center justify-between mb-4">
         <div className="flex items-center gap-3">
-          <div className="w-10 h-10 bg-gray-100 rounded-lg flex items-center justify-center">
+          <div className="w-10 h-10 flex items-center justify-center">
             <Server className="w-5 h-5 text-gray-700" />
           </div>
           <div>

frontend/src/components/CreateContainerModal.tsx

@@ -2,6 +2,7 @@ import { useEffect, useMemo, useState, type ReactNode } from 'react'
 import { CalendarClock, X } from 'lucide-react'
 import { batchCreate, getIPv6Status, getEnabledImages, getHostInfo, CreateContainerRequest, HostInfo, IPv6Status, Template } from '../services/api'
 import { useDialog } from './Dialog'
+import { useLanguage, type Language } from '../contexts/LanguageContext'
 
 interface CreateContainerModalProps {
   isOpen: boolean
@@ -26,13 +27,21 @@ const defaultForm: CreateContainerRequest = {
   io_speed_mbps: 0,
   extra_ports: [],
   port_mapping_count: 2,
+  assign_nat: true,
   snapshot_limit: 1,
+  assign_ipv4: false,
+  ipv4_count: 1,
+  public_ipv4s: [],
   assign_ipv6: false,
+  ipv6_count: 1,
+  ipv6_addresses: [],
   expires_at: '',
 }
 
 export default function CreateContainerModal({ isOpen, onClose, onSuccess, existingNames = [] }: CreateContainerModalProps) {
   const dialog = useDialog()
+  const { language } = useLanguage()
+  const networkText = createNetworkText[language]
   const [templates, setTemplates] = useState<Template[]>([])
   const [loading, setLoading] = useState(false)
   const [batchCount, setBatchCount] = useState(1)
@@ -48,7 +57,10 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
       .then((res) => {
         const data = res.data.data || []
         setTemplates(data)
-        setForm((prev) => ({ ...prev, template_id: data.some((item) => item.id === prev.template_id) ? prev.template_id : (data[0]?.id || '') }))
+        setForm((prev) => {
+          const templateID = data.some((item) => item.id === prev.template_id) ? prev.template_id : (data[0]?.id || '')
+          return applyTemplateDefaults({ ...prev, template_id: templateID })
+        })
       })
       .catch(console.error)
 
@@ -71,16 +83,23 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
   }, [isOpen, form.virtualization])
 
   const ipv6Available = !!ipv6Status?.available
-  const ipv6Prefix = ipv6Status?.prefixes?.[0]?.prefix || ''
+  const ipv6Prefixes = ipv6Status?.prefixes || []
+  const ipv6Prefix = ipv6Prefixes.length > 1 ? `${ipv6Prefixes.length} prefixes configured` : (ipv6Prefixes[0]?.prefix || '')
+  const publicIPv4s = hostInfo?.network.public_ipv4_addresses || []
+  const ipv4Available = publicIPv4s.length > 0
+  const manualIPv4s = form.public_ipv4s || []
   const maxVCPU = hostInfo?.cpu.cores || 64
   const maxRAMMB = hostInfo?.ram.total_mb ? Number(hostInfo.ram.total_mb) : undefined
   const maxDiskGB = hostInfo?.disk.total_gb ? Math.max(1, Math.floor(hostInfo.disk.total_gb)) : undefined
   const resourceErrors = validateResourceInputs(form, maxVCPU, maxRAMMB, maxDiskGB)
+  const natEnabled = form.assign_nat !== false
+  const natPortCount = natEnabled ? Math.max(2, form.port_mapping_count || 2) : 0
 
   const autoPorts = useMemo(() => {
-    const count = Math.max(2, form.port_mapping_count)
+    if (!natEnabled) return []
+    const count = natPortCount
     return Array.from({ length: count - 1 }, (_, index) => 22002 + index)
-  }, [form.port_mapping_count])
+  }, [natEnabled, natPortCount])
 
   // SSH port preview (will be allocated sequentially, starting around 22000+)
   const sshPortPreview = 22000
@@ -124,7 +143,13 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
       return
     }
 
+    if (!form.assign_ipv4 && !form.assign_ipv6 && form.assign_nat === false) {
+      dialog.alert('提示', '请勾选任意一个可用网络')
+      return
+    }
+
     const boundedForm = normalizeCreateForm(form)
+    const wantsNAT = boundedForm.assign_nat !== false
 
     // Build batch of containers
     const containers: CreateContainerRequest[] = []
@@ -134,8 +159,11 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
       containers.push({
         ...boundedForm,
         name,
-        port_mapping_count: Math.max(2, boundedForm.port_mapping_count || 2),
+        assign_nat: wantsNAT,
+        port_mapping_count: wantsNAT ? Math.max(2, boundedForm.port_mapping_count || 2) : 0,
         snapshot_limit: Math.max(1, boundedForm.snapshot_limit || 3),
+        ipv4_count: boundedForm.assign_ipv4 ? Math.max(1, boundedForm.ipv4_count || 1) : 0,
+        ipv6_count: boundedForm.assign_ipv6 ? Math.max(1, boundedForm.ipv6_count || 1) : 0,
         extra_ports: [],
       })
     }
@@ -190,14 +218,14 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
             <div className="grid grid-cols-2 gap-2">
               <button
                 type="button"
-                onClick={() => setForm((prev) => ({ ...prev, virtualization: 'lxc', template_id: '' }))}
+                onClick={() => setForm((prev) => applyTemplateDefaults({ ...prev, virtualization: 'lxc', template_id: '' }))}
                 className={`rounded-md border px-3 py-2 text-sm font-medium transition-colors ${form.virtualization === 'lxc' ? 'border-black bg-black text-white' : 'border-gray-300 text-gray-700 hover:bg-gray-50'}`}
               >
                 LXC 容器
               </button>
               <button
                 type="button"
-                onClick={() => setForm((prev) => ({ ...prev, virtualization: 'kvm', template_id: '' }))}
+                onClick={() => setForm((prev) => applyTemplateDefaults({ ...prev, virtualization: 'kvm', template_id: '' }))}
                 className={`rounded-md border px-3 py-2 text-sm font-medium transition-colors ${form.virtualization === 'kvm' ? 'border-black bg-black text-white' : 'border-gray-300 text-gray-700 hover:bg-gray-50'}`}
               >
                 KVM 虚拟机
@@ -213,7 +241,7 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
             ) : (
             <select
               value={form.template_id}
-              onChange={(event) => setForm({ ...form, template_id: event.target.value })}
+              onChange={(event) => setForm(applyTemplateDefaults({ ...form, template_id: event.target.value }))}
               className={inputClass}
             >
               {templates.map((template) => (
@@ -223,23 +251,160 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
               ))}
             </select>
             )}
+
           </Field>
 
-          <label className={`flex items-start gap-3 rounded-md border px-3 py-2 text-sm ${ipv6Available ? 'border-gray-200 bg-white' : 'border-gray-200 bg-gray-50 text-gray-400'}`}>
-            <input
-              type="checkbox"
-              checked={!!form.assign_ipv6}
-              disabled={!ipv6Available}
-              onChange={(event) => setForm({ ...form, assign_ipv6: event.target.checked })}
-              className="mt-1"
-            />
-            <span className="min-w-0">
-              <span className="block font-medium text-gray-800">Public IPv6</span>
-              <span className="block text-xs text-gray-500 truncate">
-                {ipv6Available ? `Use ${ipv6Prefix}` : (ipv6Status?.reason || 'Checking IPv6 prefix...')}
+          <div className={`rounded-md border px-3 py-2 text-sm ${ipv4Available ? 'border-gray-200 bg-white' : 'border-gray-200 bg-gray-50 text-gray-400'}`}>
+            <label className="flex items-start gap-3">
+              <input
+                type="checkbox"
+                checked={!!form.assign_ipv4}
+                disabled={!ipv4Available}
+                onChange={(event) => setForm({ ...form, assign_ipv4: event.target.checked, public_ipv4s: event.target.checked ? form.public_ipv4s : [] })}
+                className="mt-1"
+              />
+              <span className="min-w-0">
+                <span className="block font-medium text-gray-800">{networkText.publicIPv4}</span>
+                <span className="block text-xs text-gray-500">
+                  {ipv4Available ? formatAllocatableIPv4Count(publicIPv4s.length, language) : networkText.noAllocatableIPv4}
+                </span>
               </span>
-            </span>
-          </label>
+            </label>
+            {form.assign_ipv4 && (
+              <div className="mt-3 space-y-3 pl-6">
+                <div className="grid grid-cols-2 gap-3">
+                  <label className="flex items-center gap-2 text-xs text-gray-600">
+                    <input
+                      type="radio"
+                      checked={manualIPv4s.length === 0}
+                      onChange={() => setForm({ ...form, public_ipv4s: [] })}
+                    />
+                    Auto assign
+                  </label>
+                  <Field label="IPv4 count">
+                    <NumberInput
+                      value={form.ipv4_count || 1}
+                      min={1}
+                      max={Math.max(1, publicIPv4s.length)}
+                      onChange={(value) => setForm({ ...form, ipv4_count: Math.max(1, Math.round(value || 1)) })}
+                    />
+                  </Field>
+                </div>
+                <div className="space-y-1.5">
+                  <label className="flex items-center gap-2 text-xs text-gray-600">
+                    <input
+                      type="radio"
+                      checked={manualIPv4s.length > 0}
+                      onChange={() => setForm({ ...form, public_ipv4s: publicIPv4s[0]?.address ? [publicIPv4s[0].address] : [], ipv4_count: 1 })}
+                    />
+                    Manual select
+                  </label>
+                  {manualIPv4s.length > 0 && (
+                    <div className="grid gap-1.5 sm:grid-cols-2">
+                      {publicIPv4s.map((ip) => (
+                        <label key={`${ip.interface}-${ip.address}`} className="flex min-w-0 items-center gap-2 rounded border border-gray-200 px-2 py-1.5 text-xs text-gray-700">
+                          <input
+                            type="checkbox"
+                            checked={manualIPv4s.includes(ip.address)}
+                            onChange={(event) => {
+                              const next = event.target.checked
+                                ? [...manualIPv4s, ip.address]
+                                : manualIPv4s.filter((value) => value !== ip.address)
+                              setForm({ ...form, public_ipv4s: next, ipv4_count: Math.max(1, next.length || 1) })
+                            }}
+                          />
+                          <span className="truncate font-mono">{ip.address}</span>
+                          <span className="shrink-0 text-gray-400">{ip.interface}</span>
+                          {ip.gateway && <span className="shrink-0 text-gray-400">gw {ip.gateway}</span>}
+                        </label>
+                      ))}
+                    </div>
+                  )}
+                </div>
+              </div>
+            )}
+          </div>
+
+          <div className={`rounded-md border px-3 py-2 text-sm ${ipv6Available ? 'border-gray-200 bg-white' : 'border-gray-200 bg-gray-50 text-gray-400'}`}>
+            <div className="flex items-start justify-between gap-3">
+              <label className="flex min-w-0 flex-1 items-start gap-3">
+                <input
+                  type="checkbox"
+                  checked={!!form.assign_ipv6}
+                  disabled={!ipv6Available}
+                  onChange={(event) => setForm({ ...form, assign_ipv6: event.target.checked })}
+                  className="mt-1"
+                />
+                <span className="min-w-0">
+              <span className="block font-medium text-gray-800">{networkText.publicIPv6}</span>
+              <span className="block text-xs text-gray-500 truncate">
+                    {ipv6Available ? `${networkText.use} ${ipv6Prefix}` : (ipv6Status?.reason || networkText.checkingIPv6Prefix)}
+              </span>
+                </span>
+              </label>
+              {form.assign_ipv6 && (
+                <span className="block w-24 shrink-0">
+                  <NumberInput
+                    value={form.ipv6_count || 1}
+                    min={1}
+                    max={64}
+                    onChange={(value) => setForm({ ...form, ipv6_count: Math.max(1, Math.round(value || 1)) })}
+                  />
+                </span>
+              )}
+            </div>
+          </div>
+
+          <div className="rounded-md border border-gray-200 bg-white px-3 py-2 text-sm">
+            <div className="flex items-start justify-between gap-3">
+              <label className="flex min-w-0 flex-1 items-start gap-3">
+                <input
+                  type="checkbox"
+                  checked={natEnabled}
+                  onChange={(event) => {
+                    const checked = event.target.checked
+                    setForm({
+                      ...form,
+                      assign_nat: checked,
+                      port_mapping_count: checked ? Math.max(2, form.port_mapping_count || 2) : 0,
+                      extra_ports: [],
+                    })
+                  }}
+                  className="mt-1"
+                />
+                <span className="min-w-0">
+                  <span className="block font-medium text-gray-800">{networkText.publicNAT}</span>
+                  <span className="block text-xs text-gray-500">
+                    {natEnabled ? formatNATPortCount(natPortCount, language) : networkText.noNATPorts}
+                  </span>
+                </span>
+              </label>
+              {natEnabled && (
+                <span className="block w-24 shrink-0">
+                  <NumberInput
+                    value={natPortCount}
+                    min={2}
+                    max={64}
+                    onChange={(value) => setForm({ ...form, port_mapping_count: Math.max(2, value || 2), assign_nat: true })}
+                  />
+                </span>
+              )}
+            </div>
+            {natEnabled && (
+              <div className="mt-2 pl-6">
+                <div className="flex flex-wrap gap-1.5">
+                  <span className="inline-flex px-2 py-1 bg-emerald-50 text-emerald-700 rounded text-xs font-mono">
+                    {isWindowsTemplate(form.template_id) ? 'RDP' : 'SSH'}: {sshPortPreview} -&gt; {isWindowsTemplate(form.template_id) ? 3389 : 22}
+                  </span>
+                  {autoPorts.map((port) => (
+                    <span key={port} className="inline-flex px-2 py-1 bg-gray-100 text-gray-700 rounded text-xs font-mono">
+                      {port} -&gt; {port}
+                    </span>
+                  ))}
+                </div>
+              </div>
+            )}
+          </div>
 
           <div className="grid grid-cols-2 gap-4">
             <Field label="vCPU">
@@ -315,25 +480,6 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
             )}
           </div>
 
-          <Field label="NAT 端口映射数量">
-            <NumberInput
-              value={form.port_mapping_count}
-              min={2}
-              max={64}
-              onChange={(value) => setForm({ ...form, port_mapping_count: Math.max(2, value || 2) })}
-            />
-            <div className="mt-2 flex flex-wrap gap-1.5">
-              <span className="inline-flex px-2 py-1 bg-emerald-50 text-emerald-700 rounded text-xs font-mono">
-                SSH: {sshPortPreview} -&gt; 22
-              </span>
-              {autoPorts.map((port) => (
-                <span key={port} className="inline-flex px-2 py-1 bg-gray-100 text-gray-700 rounded text-xs font-mono">
-                  {port} -&gt; {port}
-                </span>
-              ))}
-            </div>
-          </Field>
-
           <Field label="子用户快照上限">
             <NumberInput
               value={form.snapshot_limit}
@@ -435,7 +581,10 @@ function NumberInput({
 
 function validateResourceInputs(form: CreateContainerRequest, maxVCPU: number, maxRAMMB?: number, maxDiskGB?: number) {
   const errors: Partial<Record<'vcpu' | 'ram_mb' | 'disk_gb', string>> = {}
-  const minVCPU = form.virtualization === 'kvm' ? 1 : 0.25
+  const windows = isWindowsTemplate(form.template_id)
+  const minVCPU = windows ? 2 : (form.virtualization === 'kvm' ? 1 : 0.25)
+  const minRAMMB = windows ? 2048 : 128
+  const minDiskGB = windows ? 30 : 1
 
   if (!Number.isFinite(form.vcpu)) {
     errors.vcpu = '请输入 vCPU'
@@ -449,16 +598,16 @@ function validateResourceInputs(form: CreateContainerRequest, maxVCPU: number, m
 
   if (!Number.isFinite(form.ram_mb)) {
     errors.ram_mb = '请输入内存'
-  } else if (form.ram_mb < 128) {
-    errors.ram_mb = '不能小于 128 MB'
+  } else if (form.ram_mb < minRAMMB) {
+    errors.ram_mb = `不能小于 ${minRAMMB} MB`
   } else if (maxRAMMB && form.ram_mb > maxRAMMB) {
     errors.ram_mb = `不能大于 ${maxRAMMB} MB`
   }
 
   if (!Number.isFinite(form.disk_gb)) {
     errors.disk_gb = '请输入磁盘'
-  } else if (form.disk_gb < 1) {
-    errors.disk_gb = '不能小于 1 GB'
+  } else if (form.disk_gb < minDiskGB) {
+    errors.disk_gb = `不能小于 ${minDiskGB} GB`
   } else if (maxDiskGB && form.disk_gb > maxDiskGB) {
     errors.disk_gb = `不能大于 ${maxDiskGB} GB`
   }
@@ -467,15 +616,42 @@ function validateResourceInputs(form: CreateContainerRequest, maxVCPU: number, m
 }
 
 function normalizeCreateForm(form: CreateContainerRequest): CreateContainerRequest {
+  const normalized = applyTemplateDefaults(form)
+  const wantsNAT = normalized.assign_nat !== false
+  const wantsIPv4 = !!normalized.assign_ipv4
+  const wantsIPv6 = !!normalized.assign_ipv6
+  return {
+    ...normalized,
+    vcpu: normalized.virtualization === 'kvm' ? Math.round(normalized.vcpu) : normalizeLXCvCPU(normalized.vcpu),
+    ram_mb: Math.round(normalized.ram_mb),
+    disk_gb: Math.round(normalized.disk_gb),
+    assign_nat: wantsNAT,
+    port_mapping_count: wantsNAT ? clampInt(normalized.port_mapping_count, 2, 64, 2) : 0,
+    assign_ipv4: wantsIPv4,
+    ipv4_count: wantsIPv4 ? clampInt(normalized.ipv4_count || 1, 1, 64, 1) : 0,
+    public_ipv4s: wantsIPv4 ? (normalized.public_ipv4s || []) : [],
+    assign_ipv6: wantsIPv6,
+    ipv6_count: wantsIPv6 ? clampInt(normalized.ipv6_count || 1, 1, 64, 1) : 0,
+    ipv6_addresses: wantsIPv6 ? (normalized.ipv6_addresses || []) : [],
+    snapshot_limit: clampInt(normalized.snapshot_limit, 1, undefined, 3),
+  }
+}
+
+function applyTemplateDefaults(form: CreateContainerRequest): CreateContainerRequest {
+  if (!isWindowsTemplate(form.template_id)) return form
   return {
     ...form,
-    vcpu: form.virtualization === 'kvm' ? Math.round(form.vcpu) : normalizeLXCvCPU(form.vcpu),
-    ram_mb: Math.round(form.ram_mb),
-    disk_gb: Math.round(form.disk_gb),
-    snapshot_limit: clampInt(form.snapshot_limit, 1, undefined, 3),
+    virtualization: 'kvm',
+    vcpu: Math.max(2, Math.round(Number.isFinite(form.vcpu) ? form.vcpu : 2)),
+    ram_mb: Math.max(2048, Math.round(Number.isFinite(form.ram_mb) ? form.ram_mb : 2048)),
+    disk_gb: Math.max(30, Math.round(Number.isFinite(form.disk_gb) ? form.disk_gb : 30)),
   }
 }
 
+function isWindowsTemplate(templateID: string) {
+  return templateID.toLowerCase().includes('windows')
+}
+
 function normalizeLXCvCPU(value: number) {
   const rounded = Math.round((Number.isFinite(value) ? value : 1) * 4) / 4
   return Number(rounded.toFixed(2))
@@ -486,5 +662,38 @@ function clampInt(value: number, min: number, max?: number, fallback = min) {
   return Math.min(Math.max(next, min), max ?? next)
 }
 
+const createNetworkText = {
+  zh: {
+    publicIPv4: '公网 IPv4',
+    noAllocatableIPv4: '未检测到可分配公网 IPv4',
+    publicIPv6: '公网 IPv6',
+    use: '使用',
+    checkingIPv6Prefix: '正在检测 IPv6 前缀...',
+    publicNAT: '公网 NAT',
+    noNATPorts: '不分配 NAT 端口',
+  },
+  en: {
+    publicIPv4: 'Public IPv4',
+    noAllocatableIPv4: 'No allocatable public IPv4 detected',
+    publicIPv6: 'Public IPv6',
+    use: 'Use',
+    checkingIPv6Prefix: 'Checking IPv6 prefix...',
+    publicNAT: 'Public NAT',
+    noNATPorts: 'No NAT ports will be assigned',
+  },
+} as const
+
+function formatAllocatableIPv4Count(count: number, language: Language) {
+  return language === 'en'
+    ? `${count} allocatable address${count === 1 ? '' : 'es'} detected`
+    : `检测到 ${count} 个可分配地址`
+}
+
+function formatNATPortCount(count: number, language: Language) {
+  return language === 'en'
+    ? `${count} NAT ports will be assigned`
+    : `将分配 ${count} 个 NAT 端口`
+}
+
 const inputClass =
   'w-full px-3 py-2 border border-gray-300 rounded-md text-sm text-black bg-white focus:outline-none focus:ring-2 focus:ring-black focus:border-black'

frontend/src/components/Dialog.tsx

@@ -1,5 +1,6 @@
 import { useState, useCallback, createContext, useContext, ReactNode } from 'react'
 import { AlertTriangle, CheckCircle, X } from 'lucide-react'
+import { useLanguage } from '../contexts/LanguageContext'
 
 type DialogType = 'confirm' | 'alert'
 
@@ -20,6 +21,7 @@ const DialogContext = createContext<DialogContextType | undefined>(undefined)
 
 export function DialogProvider({ children }: { children: ReactNode }) {
   const [dialog, setDialog] = useState<DialogState>({ open: false, type: 'alert', title: '', message: '' })
+  const { t } = useLanguage()
 
   const confirm = useCallback((title: string, message: string) => {
     return new Promise<boolean>((resolve) => {
@@ -50,7 +52,7 @@ export function DialogProvider({ children }: { children: ReactNode }) {
               }`}>
                 {dialog.type === 'confirm' ? <AlertTriangle className="w-4 h-4" /> : <CheckCircle className="w-4 h-4" />}
               </div>
-              <h3 className="text-sm font-semibold text-black flex-1">{dialog.title}</h3>
+              <h3 className="text-sm font-semibold text-black flex-1">{t(dialog.title)}</h3>
               {dialog.type === 'alert' && (
                 <button onClick={() => close(true)} className="p-1 text-gray-400 hover:text-black rounded">
                   <X className="w-4 h-4" />
@@ -58,7 +60,7 @@ export function DialogProvider({ children }: { children: ReactNode }) {
               )}
             </div>
             <div className="px-5 py-4">
-              <p className="text-sm text-gray-600">{dialog.message}</p>
+              <p className="text-sm text-gray-600">{t(dialog.message)}</p>
             </div>
             <div className="flex justify-end gap-2 px-5 py-3 bg-gray-50 border-t border-gray-100">
               {dialog.type === 'confirm' && (
@@ -66,7 +68,7 @@ export function DialogProvider({ children }: { children: ReactNode }) {
                   onClick={() => close(false)}
                   className="px-4 py-2 text-sm text-gray-700 hover:bg-gray-200 rounded-md transition-colors"
                 >
-                  取消
+                  {t('取消')}
                 </button>
               )}
               <button
@@ -77,7 +79,7 @@ export function DialogProvider({ children }: { children: ReactNode }) {
                     : 'bg-black text-white hover:bg-gray-800'
                 }`}
               >
-                {dialog.type === 'confirm' ? '确认' : '确定'}
+                {dialog.type === 'confirm' ? t('确认') : t('确定')}
               </button>
             </div>
           </div>

frontend/src/components/Layout.tsx

@@ -1,12 +1,16 @@
 import { Outlet } from 'react-router-dom'
 import Sidebar from './Sidebar'
 import { useState } from 'react'
+import AutoTranslate from './AutoTranslate'
+import BrowserDialogTranslator from './BrowserDialogTranslator'
 
 export default function Layout() {
   const [sidebarCollapsed, setSidebarCollapsed] = useState(false)
 
   return (
     <div className="min-h-screen bg-gray-50 flex dark:bg-gray-950">
+      <AutoTranslate />
+      <BrowserDialogTranslator />
       <Sidebar collapsed={sidebarCollapsed} onToggle={() => setSidebarCollapsed(!sidebarCollapsed)} />
       <main className={`flex-1 transition-all duration-300 ${sidebarCollapsed ? 'ml-16' : 'ml-60'}`}>
         <div className="p-6">

frontend/src/components/RingStats.tsx

@@ -16,8 +16,8 @@ export function RingStat({ value, max = 100, label, subLabel, size = 120, stroke
 
   const radius = (size - strokeWidth) / 2
   const circumference = radius * 2 * Math.PI
-  const percentage = Math.min(Math.max(value / max * 100, 0), 100)
-  const strokeDashoffset = circumference - (percentage / 100) * circumference
+  const percentage = max === Infinity ? Math.max(value, 0) : Math.min(Math.max(value / max * 100, 0), 100)
+  const strokeDashoffset = circumference - (Math.min(percentage, 100) / 100) * circumference
 
   const bgStroke = isDark ? '#374151' : '#f3f4f6'
   const progressStroke = isDark ? '#f9fafb' : '#000000'
@@ -51,7 +51,7 @@ export function RingStat({ value, max = 100, label, subLabel, size = 120, stroke
         </svg>
         {/* Center value */}
         <div className="absolute inset-0 flex flex-col items-center justify-center">
-          <span className="text-2xl font-bold text-black dark:text-white">{value.toFixed(percentage < 1 ? 2 : 1)}%</span>
+          <span className="text-2xl font-bold text-black dark:text-white">{percentage.toFixed(percentage < 1 ? 2 : 1)}%</span>
         </div>
       </div>
       <div className="mt-2 text-center">
@@ -73,7 +73,6 @@ interface RingStatsProps {
   swapUsed?: number
   swapTotal?: number
   loadPercent: number
-  loadStatus: string
   diskPercent: number
   diskUsed: number
   diskTotal: number
@@ -90,7 +89,6 @@ export default function RingStats({
   swapUsed = 0,
   swapTotal = 0,
   loadPercent,
-  loadStatus,
   diskPercent,
   diskUsed,
   diskTotal,
@@ -125,8 +123,8 @@ export default function RingStats({
         )}
         <RingStat
           value={loadPercent}
+          max={Infinity}
           label="负载"
-          subLabel={loadStatus}
         />
         <RingStat
           value={diskPercent}

frontend/src/components/Sidebar.tsx

@@ -4,6 +4,7 @@ import {
   ChevronLeft,
   ChevronRight,
   Code2,
+  Cpu,
   Camera,
   LayoutDashboard,
   LogOut,
@@ -18,6 +19,7 @@ import {
   UserCog,
 } from 'lucide-react'
 import { useAuth } from '../contexts/AuthContext'
+import { useLanguage } from '../contexts/LanguageContext'
 import { useTheme } from '../contexts/ThemeContext'
 import { getVersion } from '../services/api'
 import AppIcon from './AppIcon'
@@ -27,11 +29,40 @@ interface SidebarProps {
   onToggle: () => void
 }
 
+function GitHubIcon({ className = '' }: { className?: string }) {
+  return (
+    <svg
+      className={className}
+      viewBox="0 0 1024 1024"
+      version="1.1"
+      xmlns="http://www.w3.org/2000/svg"
+      aria-hidden="true"
+    >
+      <path
+        d="M512 42.666667A464.64 464.64 0 0 0 42.666667 502.186667 460.373333 460.373333 0 0 0 363.52 938.666667c23.466667 4.266667 32-9.813333 32-22.186667v-78.08c-130.56 27.733333-158.293333-61.44-158.293333-61.44a122.026667 122.026667 0 0 0-52.053334-67.413333c-42.666667-28.16 3.413333-27.733333 3.413334-27.733334a98.56 98.56 0 0 1 71.68 47.36 101.12 101.12 0 0 0 136.533333 37.973334 99.413333 99.413333 0 0 1 29.866667-61.44c-104.106667-11.52-213.333333-50.773333-213.333334-226.986667a177.066667 177.066667 0 0 1 47.36-124.16 161.28 161.28 0 0 1 4.693334-121.173333s39.68-12.373333 128 46.933333a455.68 455.68 0 0 1 234.666666 0c89.6-59.306667 128-46.933333 128-46.933333a161.28 161.28 0 0 1 4.693334 121.173333A177.066667 177.066667 0 0 1 810.666667 477.866667c0 176.64-110.08 215.466667-213.333334 226.986666a106.666667 106.666667 0 0 1 32 85.333334v125.866666c0 14.933333 8.533333 26.88 32 22.186667A460.8 460.8 0 0 0 981.333333 502.186667 464.64 464.64 0 0 0 512 42.666667"
+        fill="currentColor"
+      />
+    </svg>
+  )
+}
+
+function LanguageIcon({ className = '' }: { className?: string }) {
+  return (
+    <svg className={className} viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
+      <path
+        d="M213.333333 640v85.333333a85.333333 85.333333 0 0 0 78.933334 85.12L298.666667 810.666667h128v85.333333H298.666667a170.666667 170.666667 0 0 1-170.666667-170.666667v-85.333333h85.333333z m554.666667-213.333333l187.733333 469.333333h-91.946666l-51.242667-128h-174.506667l-51.157333 128h-91.904L682.666667 426.666667h85.333333z m-42.666667 123.093333L672.128 682.666667h106.325333L725.333333 549.76zM341.333333 85.333333v85.333334h170.666667v298.666666H341.333333v128H256v-128H85.333333V170.666667h170.666667V85.333333h85.333333z m384 42.666667a170.666667 170.666667 0 0 1 170.666667 170.666667v85.333333h-85.333333V298.666667a85.333333 85.333333 0 0 0-85.333334-85.333334h-128V128h128zM256 256H170.666667v128h85.333333V256z m170.666667 0H341.333333v128h85.333334V256z"
+        fill="currentColor"
+      />
+    </svg>
+  )
+}
+
 export default function Sidebar({ collapsed, onToggle }: SidebarProps) {
   const navigate = useNavigate()
   const location = useLocation()
   const { logout, isSubUser } = useAuth()
   const { theme, toggleTheme } = useTheme()
+  const { language, toggleLanguage, t } = useLanguage()
   const [version, setVersion] = useState('')
 
   useEffect(() => {
@@ -54,6 +85,7 @@ export default function Sidebar({ collapsed, onToggle }: SidebarProps) {
   const isRoutingPage = location.pathname.startsWith('/routing')
   const isAuditLogsPage = location.pathname.startsWith('/audit-logs')
   const isApiIntegrationPage = location.pathname.startsWith('/api-integration')
+  const isHostReportPage = location.pathname.startsWith('/host-report')
   const isSecurityPage = location.pathname.startsWith('/security')
   const isSettingsPage = location.pathname.startsWith('/settings')
 
@@ -66,21 +98,21 @@ export default function Sidebar({ collapsed, onToggle }: SidebarProps) {
       <div className="flex items-center justify-between h-14 px-4 border-b border-gray-200 dark:border-gray-700">
         {!collapsed && (
           <div className="flex items-center gap-2">
-            <div className="w-7 h-7 bg-gray-100 rounded flex items-center justify-center dark:bg-gray-800">
+            <div className="w-7 h-7 flex items-center justify-center">
               <AppIcon className="w-5 h-5" />
             </div>
             <span className="font-bold text-black text-sm dark:text-white">CLICD</span>
           </div>
         )}
         {collapsed && (
-          <div className="w-7 h-7 bg-gray-100 rounded flex items-center justify-center mx-auto dark:bg-gray-800">
+          <div className="w-7 h-7 flex items-center justify-center mx-auto">
             <AppIcon className="w-5 h-5" />
           </div>
         )}
         <button
           onClick={onToggle}
           className="p-1 rounded hover:bg-gray-100 text-gray-500 dark:hover:bg-gray-800 dark:text-gray-400"
-          title="切换侧边栏"
+          title={t('切换侧边栏')}
         >
           {collapsed ? (
             <ChevronRight className="w-4 h-4" />
@@ -205,6 +237,18 @@ export default function Sidebar({ collapsed, onToggle }: SidebarProps) {
               {!collapsed && <span>API 集成</span>}
             </button>
 
+            <button
+              onClick={() => navigate('/host-report')}
+              className={`w-full flex items-center gap-3 px-3 py-2.5 rounded-md text-sm transition-colors ${
+                isHostReportPage
+                  ? 'bg-black text-white dark:bg-white dark:text-black'
+                  : 'text-gray-700 hover:bg-gray-100 dark:text-gray-300 dark:hover:bg-gray-800'
+              }`}
+            >
+              <Cpu className="w-4 h-4" />
+              {!collapsed && <span>宿主机信息</span>}
+            </button>
+
             <button
               onClick={() => navigate('/settings')}
               className={`w-full flex items-center gap-3 px-3 py-2.5 rounded-md text-sm transition-colors ${
@@ -222,26 +266,56 @@ export default function Sidebar({ collapsed, onToggle }: SidebarProps) {
 
       <div className="border-t border-gray-200 dark:border-gray-700 p-2 space-y-1">
         {/* Theme Toggle */}
-        <button
-          onClick={toggleTheme}
-          className="w-full flex items-center gap-3 px-3 py-2.5 rounded-md text-sm text-gray-600 hover:bg-gray-100 transition-colors dark:text-gray-400 dark:hover:bg-gray-800"
-          title={theme === 'dark' ? '切换亮色模式' : '切换暗黑模式'}
-        >
-          {theme === 'dark' ? (
-            <Sun className="w-4 h-4" />
-          ) : (
-            <Moon className="w-4 h-4" />
-          )}
-          {!collapsed && <span>{theme === 'dark' ? '亮色模式' : '暗黑模式'}</span>}
-        </button>
+        <div className={collapsed ? 'space-y-1' : 'flex items-center gap-1'}>
+          <button
+            onClick={toggleTheme}
+            className={`${collapsed ? 'w-full justify-center' : 'flex-1'} flex items-center gap-3 px-3 py-2.5 rounded-md text-sm text-gray-600 hover:bg-gray-100 transition-colors dark:text-gray-400 dark:hover:bg-gray-800`}
+            title={t(theme === 'dark' ? '切换亮色模式' : '切换暗黑模式')}
+          >
+            {theme === 'dark' ? (
+              <Sun className="w-4 h-4" />
+            ) : (
+              <Moon className="w-4 h-4" />
+            )}
+            {!collapsed && <span>{theme === 'dark' ? '亮色模式' : '暗黑模式'}</span>}
+          </button>
+
+          <button
+            onClick={() => { void toggleLanguage() }}
+            className={`${collapsed ? 'w-full' : 'w-10'} flex items-center justify-center rounded-md px-2 py-2.5 text-sm text-gray-600 hover:bg-gray-100 transition-colors dark:text-gray-400 dark:hover:bg-gray-800`}
+            title={language === 'en' ? '切换中文' : 'Switch to English'}
+          >
+            <LanguageIcon className="h-4 w-4" />
+          </button>
+        </div>
 
         {/* Version */}
         {version && (
           <div className={`px-3 py-2 text-xs text-gray-400 dark:text-gray-500 ${collapsed ? 'text-center' : ''}`}>
             {collapsed ? (
-              <span title={`v${version}`}>v{version.split('.').slice(0, 2).join('.')}</span>
+              <a
+                href="https://github.com/MengMengCode/CLICD"
+                target="_blank"
+                rel="noreferrer"
+                title={`CLICD v${version}`}
+                className="inline-flex items-center justify-center rounded text-gray-400 transition-colors hover:text-gray-900 dark:text-gray-500 dark:hover:text-white"
+              >
+                <GitHubIcon className="h-4 w-4" />
+              </a>
             ) : (
-              <span>v{version}</span>
+              <div className="flex min-w-0 items-center gap-2">
+                <a
+                  href="https://github.com/MengMengCode/CLICD"
+                  target="_blank"
+                  rel="noreferrer"
+                  title="CLICD"
+                  className="inline-flex min-w-0 items-center gap-1 rounded text-gray-500 transition-colors hover:text-gray-950 dark:text-gray-400 dark:hover:text-white"
+                >
+                  <GitHubIcon className="h-3.5 w-3.5 shrink-0" />
+                  <span className="truncate">CLICD</span>
+                </a>
+                <span className="shrink-0">v{version}</span>
+              </div>
             )}
           </div>
         )}

frontend/src/components/WebVNCViewer.tsx

@@ -0,0 +1,200 @@
+import { useEffect, useRef, useState } from 'react'
+import { Monitor, RefreshCw, Send, X } from 'lucide-react'
+import RFBModule from '@novnc/novnc/lib/rfb'
+import { createVNCTicket, getWebVNCUrl } from '../services/api'
+
+type RFBConstructor = new (
+  target: HTMLElement,
+  url: string,
+  options?: { credentials?: Record<string, string>; shared?: boolean; repeaterID?: string; wsProtocols?: string[] }
+) => RFBInstance
+
+interface RFBInstance extends EventTarget {
+  scaleViewport: boolean
+  resizeSession: boolean
+  focusOnClick: boolean
+  viewOnly: boolean
+  qualityLevel: number
+  compressionLevel: number
+  background: string
+  disconnect(): void
+  sendCtrlAltDel(): void
+}
+
+const RFB = resolveRFBConstructor(RFBModule)
+
+function resolveRFBConstructor(moduleValue: unknown): RFBConstructor {
+  if (typeof moduleValue === 'function') {
+    return moduleValue as RFBConstructor
+  }
+  const maybeDefault = (moduleValue as { default?: unknown })?.default
+  if (typeof maybeDefault === 'function') {
+    return maybeDefault as RFBConstructor
+  }
+  throw new Error('noVNC RFB constructor is unavailable')
+}
+
+interface WebVNCViewerProps {
+  containerName: string
+  onClose: () => void
+}
+
+export default function WebVNCViewer({ containerName, onClose }: WebVNCViewerProps) {
+  const screenRef = useRef<HTMLDivElement>(null)
+  const rfbRef = useRef<RFBInstance | null>(null)
+  const [status, setStatus] = useState<'connecting' | 'connected' | 'disconnected' | 'error'>('connecting')
+  const [errorMsg, setErrorMsg] = useState('')
+
+  const cleanup = () => {
+    if (rfbRef.current) {
+      rfbRef.current.disconnect()
+      rfbRef.current = null
+    }
+  }
+
+  const ensureResizeObserver = () => {
+    if ('ResizeObserver' in window) return
+
+    class FallbackResizeObserver {
+      private target: Element | null = null
+      private timer = 0
+      private lastWidth = -1
+      private lastHeight = -1
+
+      constructor(private callback: ResizeObserverCallback) {}
+
+      observe = (target: Element) => {
+        this.target = target
+        this.check()
+        this.timer = window.setInterval(this.check, 250)
+        window.addEventListener('resize', this.check)
+      }
+
+      unobserve = () => this.disconnect()
+
+      disconnect = () => {
+        if (this.timer) window.clearInterval(this.timer)
+        this.timer = 0
+        window.removeEventListener('resize', this.check)
+        this.target = null
+      }
+
+      private check = () => {
+        if (!this.target) return
+        const contentRect = this.target.getBoundingClientRect()
+        if (contentRect.width === this.lastWidth && contentRect.height === this.lastHeight) return
+        this.lastWidth = contentRect.width
+        this.lastHeight = contentRect.height
+        this.callback([{ target: this.target, contentRect } as ResizeObserverEntry], this as unknown as ResizeObserver)
+      }
+    }
+
+    ;(window as unknown as { ResizeObserver: typeof ResizeObserver }).ResizeObserver = FallbackResizeObserver as unknown as typeof ResizeObserver
+  }
+
+  const connect = async () => {
+    const target = screenRef.current
+    if (!target) return
+
+    cleanup()
+    target.innerHTML = ''
+    setStatus('connecting')
+    setErrorMsg('')
+
+    let ticket = ''
+    try {
+      const response = await createVNCTicket(containerName)
+      ticket = response.data.data?.ticket || ''
+    } catch (err: unknown) {
+      const error = err as { response?: { data?: { message?: string } } }
+      setStatus('error')
+      setErrorMsg(error.response?.data?.message || 'WebVNC ticket 创建失败，请重新登录后再试')
+      return
+    }
+
+    if (!ticket) {
+      setStatus('error')
+      setErrorMsg('WebVNC ticket 为空，请重新登录后再试')
+      return
+    }
+
+    try {
+      ensureResizeObserver()
+      const rfb = new RFB(target, getWebVNCUrl(containerName), {
+        wsProtocols: ['binary', `clicd-vnc-ticket.${ticket}`],
+      })
+      rfb.scaleViewport = true
+      rfb.resizeSession = false
+      rfb.focusOnClick = true
+      rfb.qualityLevel = 6
+      rfb.compressionLevel = 2
+      rfb.background = '#050505'
+      rfb.addEventListener('connect', () => setStatus('connected'))
+      rfb.addEventListener('disconnect', (event) => {
+        const detail = (event as CustomEvent<{ clean?: boolean }>).detail
+        setStatus((current) => current === 'error' ? current : 'disconnected')
+        if (detail && detail.clean === false) {
+          setErrorMsg('WebVNC 连接已断开，请确认虚拟机正在运行且 VNC 控制台可用')
+        }
+      })
+      rfb.addEventListener('securityfailure', () => {
+        setStatus('error')
+        setErrorMsg('VNC 安全协商失败')
+      })
+      rfb.addEventListener('credentialsrequired', () => {
+        setStatus('error')
+        setErrorMsg('当前 VNC 控制台要求密码，暂不支持自动输入')
+      })
+      rfbRef.current = rfb
+    } catch (err) {
+      console.error(err)
+      setStatus('error')
+      const message = err instanceof Error && err.message ? `：${err.message}` : ''
+      setErrorMsg(`WebVNC 初始化失败${message}`)
+    }
+  }
+
+  useEffect(() => {
+    const timer = window.setTimeout(connect, 100)
+    return () => {
+      window.clearTimeout(timer)
+      cleanup()
+    }
+  }, [containerName])
+
+  return (
+    <div className="flex h-full flex-col overflow-hidden rounded-lg border border-gray-200 bg-white">
+      <div className="flex shrink-0 items-center justify-between border-b border-gray-200 bg-gray-50 px-4 py-2.5">
+        <div className="flex items-center gap-2">
+          <Monitor className="h-4 w-4 text-gray-600" />
+          <span className="text-sm font-medium text-black">WebVNC - {containerName}</span>
+          {status === 'connected' && <span className="rounded bg-green-100 px-1.5 py-0.5 text-xs text-green-700">已连接</span>}
+          {status === 'connecting' && <span className="rounded bg-yellow-100 px-1.5 py-0.5 text-xs text-yellow-700">连接中...</span>}
+          {status === 'disconnected' && <span className="rounded bg-gray-100 px-1.5 py-0.5 text-xs text-gray-600">已断开</span>}
+          {status === 'error' && <span className="rounded bg-red-100 px-1.5 py-0.5 text-xs text-red-700">连接失败</span>}
+        </div>
+        <div className="flex items-center gap-1">
+          <button onClick={() => rfbRef.current?.sendCtrlAltDel()} className="inline-flex items-center gap-1 rounded px-2 py-1.5 text-xs text-gray-500 hover:bg-gray-200" title="发送 Ctrl+Alt+Del">
+            <Send className="h-3.5 w-3.5" />
+            Ctrl+Alt+Del
+          </button>
+          <button onClick={connect} className="rounded p-1.5 text-xs text-gray-500 hover:bg-gray-200" title="重新连接">
+            <RefreshCw className="h-3.5 w-3.5" />
+          </button>
+          <button onClick={onClose} className="rounded p-1.5 text-gray-500 hover:bg-gray-200" title="关闭">
+            <X className="h-4 w-4" />
+          </button>
+        </div>
+      </div>
+
+      <div className="relative min-h-0 flex-1 overflow-hidden bg-black">
+        <div ref={screenRef} className="h-full w-full [&>div]:h-full [&>div]:w-full [&_canvas]:block" />
+        {(status === 'connecting' || status === 'error' || (status === 'disconnected' && errorMsg)) && (
+          <div className={`absolute inset-x-0 bottom-0 border-t px-4 py-2 text-sm ${status === 'error' ? 'border-red-900 bg-red-950 text-red-100' : 'border-gray-800 bg-gray-950 text-gray-200'}`}>
+            {status === 'connecting' ? '正在连接 KVM VNC 控制台...' : (errorMsg || 'WebVNC 已断开')}
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}

frontend/src/contexts/LanguageContext.tsx

@@ -0,0 +1,72 @@
+import { ReactNode, createContext, useContext, useEffect, useMemo, useState } from 'react'
+import { translateText } from '../utils/i18n'
+import { getLanguage, updateLanguage } from '../services/api'
+
+export type Language = 'zh' | 'en'
+
+interface LanguageContextValue {
+  language: Language
+  setLanguage: (language: Language) => void
+  toggleLanguage: () => Promise<void>
+  t: (value: string) => string
+}
+
+const LanguageContext = createContext<LanguageContextValue | undefined>(undefined)
+function initialLanguage(): Language {
+  return 'zh'
+}
+
+export function LanguageProvider({ children }: { children: ReactNode }) {
+  const [language, setLanguageState] = useState<Language>(initialLanguage)
+
+  const setLanguageLocal = (next: Language) => {
+    setLanguageState(next)
+  }
+
+  const setLanguage = (next: Language) => {
+    setLanguageLocal(next)
+    updateLanguage(next).catch(() => {})
+  }
+
+  const value = useMemo<LanguageContextValue>(() => ({
+    language,
+    setLanguage,
+    toggleLanguage: async () => {
+      const next = language === 'zh' ? 'en' : 'zh'
+      setLanguageLocal(next)
+      try {
+        const res = await updateLanguage(next)
+        setLanguageLocal(res.data.data?.language || next)
+      } catch {
+        setLanguageLocal(language)
+      }
+    },
+    t: (text: string) => language === 'en' ? translateText(text) : text,
+  }), [language])
+
+  useEffect(() => {
+    getLanguage()
+      .then((res) => {
+        const serverLanguage = res.data.data?.language
+        if (serverLanguage === 'zh' || serverLanguage === 'en') {
+          setLanguageLocal(serverLanguage)
+        }
+      })
+      .catch(() => {})
+  }, [])
+
+  useEffect(() => {
+    document.documentElement.lang = language === 'en' ? 'en' : 'zh-CN'
+    document.documentElement.dataset.language = language
+  }, [language])
+
+  return <LanguageContext.Provider value={value}>{children}</LanguageContext.Provider>
+}
+
+export function useLanguage() {
+  const context = useContext(LanguageContext)
+  if (!context) {
+    throw new Error('useLanguage must be used within LanguageProvider')
+  }
+  return context
+}

frontend/src/main.tsx

@@ -4,6 +4,7 @@ import { BrowserRouter } from 'react-router-dom'
 import App from './App'
 import { AuthProvider } from './contexts/AuthContext'
 import { ThemeProvider } from './contexts/ThemeContext'
+import { LanguageProvider } from './contexts/LanguageContext'
 import { DialogProvider } from './components/Dialog'
 import './index.css'
 
@@ -11,11 +12,13 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
   <React.StrictMode>
     <BrowserRouter>
       <ThemeProvider>
-        <AuthProvider>
-          <DialogProvider>
-            <App />
-          </DialogProvider>
-        </AuthProvider>
+        <LanguageProvider>
+          <AuthProvider>
+            <DialogProvider>
+              <App />
+            </DialogProvider>
+          </AuthProvider>
+        </LanguageProvider>
       </ThemeProvider>
     </BrowserRouter>
   </React.StrictMode>,

frontend/src/novnc.d.ts

@@ -0,0 +1,14 @@
+declare module '@novnc/novnc/lib/rfb' {
+  export default class RFB extends EventTarget {
+    constructor(target: HTMLElement, url: string, options?: { credentials?: Record<string, string>; shared?: boolean; repeaterID?: string; wsProtocols?: string[] })
+    scaleViewport: boolean
+    resizeSession: boolean
+    focusOnClick: boolean
+    viewOnly: boolean
+    qualityLevel: number
+    compressionLevel: number
+    background: string
+    disconnect(): void
+    sendCtrlAltDel(): void
+  }
+}

frontend/src/pages/Containers.tsx

@@ -392,11 +392,18 @@ export default function Containers() {
                   const isRunning = container.status === 'running'
                   const task = (container.id > 0 ? taskStatusMap[container.id] : taskNameMap[container.name]) || container.createTask
                   const isPlaceholder = !!container.isPlaceholder
+                  const isPolicyBlocked = !!container.policy_blocked
                   const usage = usageByName[container.name]
+                  const isKVM = (container.virtualization || 'lxc') === 'kvm'
 
-                  const cpuPct = isRunning ? clamp(usage?.cpu_usage_pct || 0) : 0
-                  const ramPct = isRunning && container.ram_mb > 0
-                    ? clamp(((usage?.memory_usage_bytes || 0) / (container.ram_mb * 1024 * 1024)) * 100)
+                  const cpuPct = isRunning
+                    ? clamp((usage?.cpu_usage_pct || 0) / (isKVM ? (container.vcpu || 1) : 1))
+                    : 0
+                  const ramTotalBytes = usage?.memory_total_bytes && usage.memory_total_bytes > 0
+                    ? usage.memory_total_bytes
+                    : container.ram_mb * 1024 * 1024
+                  const ramPct = isRunning && ramTotalBytes > 0
+                    ? clamp(((usage?.memory_usage_bytes || 0) / ramTotalBytes) * 100)
                     : 0
                   const diskPct = container.disk_gb > 0
                     ? clamp(((usage?.disk_usage_bytes || 0) / (container.disk_gb * 1024 * 1024 * 1024)) * 100)
@@ -430,7 +437,7 @@ export default function Containers() {
                         </button>
                       </td>
                       <td className="px-2.5 py-2 align-top">
-                        <StatusBadge running={isRunning} task={task} placeholder={isPlaceholder} />
+                        <StatusBadge running={isRunning} task={task} placeholder={isPlaceholder} policyBlocked={isPolicyBlocked} />
                       </td>
                       <td className="px-2.5 py-2 align-top text-xs text-gray-600 whitespace-nowrap">
                         <span className="inline-flex items-center gap-1">
@@ -574,8 +581,17 @@ type DisplayContainer = Container & {
   createTask?: Task
 }
 
-function StatusBadge({ running, task, placeholder }: { running: boolean; task?: Task; placeholder?: boolean }) {
+function StatusBadge({ running, task, placeholder, policyBlocked }: { running: boolean; task?: Task; placeholder?: boolean; policyBlocked?: boolean }) {
   const baseClass = "inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium whitespace-nowrap"
+  if (policyBlocked) {
+    return (
+      <span className={`${baseClass} bg-red-50 text-red-700`}>
+        <span className="w-1.5 h-1.5 rounded-full bg-red-500"></span>
+        策略封禁
+      </span>
+    )
+  }
+
   if (task?.status === 'failed') {
     return (
       <span className={`${baseClass} bg-red-50 text-red-700`}>
@@ -688,14 +704,16 @@ function toPlaceholder(cfg: CreateContainerRequest): DisplayContainer {
     io_speed_mbps: cfg.io_speed_mbps,
     status: 'creating',
     ip: '',
+    public_ipv4s: [],
     ipv6: '',
     ipv6_prefix_len: 0,
     ipv6_interface: '',
+    ipv6_addresses: [],
     vnc_port: 0,
     ssh_port: 0,
     ssh_password: '',
     port_mappings: [],
-    port_mapping_limit: 2,
+    port_mapping_limit: cfg.assign_nat === false ? 0 : (cfg.port_mapping_count || 0),
     snapshot_limit: cfg.snapshot_limit || 3,
     created_at: '',
     expires_at: cfg.expires_at,
@@ -803,6 +821,7 @@ function getSystemFilterValue(template: string) {
   if (normalized.startsWith('archlinux')) return 'archlinux'
   if (normalized.startsWith('fedora')) return 'fedora'
   if (normalized.startsWith('rockylinux')) return 'rockylinux'
+  if (normalized.startsWith('windows')) return 'windows'
   return normalized || 'unknown'
 }
 
@@ -815,6 +834,7 @@ function getSystemFilterLabel(system: string) {
     archlinux: 'Arch Linux',
     fedora: 'Fedora',
     rockylinux: 'Rocky Linux',
+    windows: 'Windows',
     unknown: '未知系统',
   }
   return labels[system] || system
@@ -944,6 +964,7 @@ function getTemplateName(id: string) {
     'kvm-debian-bookworm': 'Debian 12',
     'kvm-debian-bullseye': 'Debian 11',
     'kvm-rockylinux-9': 'Rocky 9',
+    'kvm-windows-10': 'Windows 10',
   }
   return map[id] || id
 }
@@ -958,6 +979,7 @@ function getTemplateIcon(id: string): ReactNode {
   if (id.startsWith('archlinux')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M504.149333 7.850667c-44.373333 108.544-70.997333 179.2-120.149333 284.330666 30.037333 32.085333 67.242667 69.290667 127.317333 111.274667-64.512-26.624-108.544-53.248-141.653333-80.896-63.146667 131.413333-161.792 318.464-361.813333 678.229333 157.696-90.794667 279.552-146.773333 393.216-168.277333-4.778667-21.162667-7.509333-43.690667-7.509334-67.584l0.341334-5.12c2.389333-100.693333 54.954667-178.517333 117.077333-173.056s110.592 91.477333 107.861333 192.170667c-0.341333 18.090667-2.389333 36.522667-6.485333 54.272 112.64 21.845333 233.130667 77.824 388.437333 167.594666l-83.968-155.648c-40.96-31.744-83.968-73.386667-171.349333-118.101333 60.074667 15.701333 103.082667 33.792 136.533333 53.930667-265.557333-493.909333-287.061333-559.786667-377.856-773.12z" fill="#1793D1"/></svg>
   if (id.startsWith('fedora')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M512 0C229.344 0 0.224 229.024 0 511.648V907.84a116.384 116.384 0 0 0 116.384 116.128h395.808c282.656-0.128 511.776-229.28 511.776-512 0-282.752-229.248-512-512-512z m196.064 237.952c-16.16 0-22.016-3.104-45.728-3.104a126.848 126.848 0 0 0-126.848 126.624v110.208c0 9.888 8.032 17.92 17.92 17.92h83.328c31.072 0 56.16 24.736 56.16 55.904 0 31.328-25.344 55.968-56.736 55.968h-100.608v127.36a240.32 240.32 0 0 1-240.288 240.288h-1.248a190.944 190.944 0 0 1-53.216-7.52l1.344 0.32c-27.168-7.072-49.376-29.408-49.376-55.296 0-31.328 22.752-54.112 56.736-54.112 16.128 0 22.016 3.072 45.696 3.072a126.848 126.848 0 0 0 126.848-126.624v-110.208a17.92 17.92 0 0 0-17.92-17.888h-83.328a55.808 55.808 0 0 1-56.096-55.904c0-31.328 25.344-55.968 56.736-55.968h100.576v-127.36a240.32 240.32 0 0 1 240.288-240.288c20.128 0 34.432 2.272 53.088 7.136 27.168 7.136 49.408 29.44 49.408 55.296 0 31.36-22.752 54.144-56.736 54.144z" fill="#294172"/></svg>
   if (id.startsWith('rockylinux')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M995.498667 680.362667c18.474667-52.778667 28.501333-109.568 28.501333-168.704C1024 229.077333 794.752 0 512 0S0 229.077333 0 511.658667c0 139.818667 56.106667 266.496 147.114667 358.826666L666.453333 351.530667l128.213334 128.170666 200.832 200.704z m-93.525334 162.816l-235.52-235.349334-368.896 368.597334A510.506667 510.506667 0 0 0 512 1023.274667c156.16 0 296.106667-69.888 389.973333-180.053334h0.042667z" fill="#10B981"/></svg>
+  if (id.startsWith('windows')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M56.888889 227.555556l398.222222-70.542223V512H56.888889V227.555556z m0 625.777777l398.222222 70.542223V568.888889H56.888889v284.444444zM512 147.342222L1024 56.888889v455.111111H512V147.342222z m0 786.204445L1024 1024v-455.111111H512v364.657778z" fill="#16C6FE"/></svg>
   return null
 }
 

frontend/src/pages/Dashboard.tsx

@@ -119,8 +119,7 @@ export default function Dashboard() {
           ramPercent={host.ram.total_mb > 0 ? (host.ram.used_mb / host.ram.total_mb) * 100 : 0}
           ramUsed={host.ram.used_mb}
           ramTotal={host.ram.total_mb}
-          loadPercent={Math.min((host.load.load1 / host.cpu.cores) * 100, 100)}
-          loadStatus={host.load.load1 < host.cpu.cores * 0.7 ? '正常' : host.load.load1 < host.cpu.cores * 1.0 ? '中等' : '高'}
+          loadPercent={(host.load.load1 / Math.max(host.cpu.cores, 1)) * 100}
           diskPercent={host.disk.total_gb > 0 ? (host.disk.used_gb / host.disk.total_gb) * 100 : 0}
           diskUsed={host.disk.used_gb * 1024}
           diskTotal={host.disk.total_gb * 1024}

frontend/src/pages/HostReport.tsx

@@ -0,0 +1,527 @@
+import { ReactNode, useCallback, useEffect, useState } from 'react'
+import {
+  Activity,
+  CheckCircle2,
+  Cpu,
+  HardDrive,
+  MemoryStick,
+  RefreshCw,
+  XCircle,
+} from 'lucide-react'
+import { getHostReport, HostProbeReport } from '../services/api'
+import { useLanguage, type Language } from '../contexts/LanguageContext'
+import { translateText } from '../utils/i18n'
+
+export default function HostReport() {
+  const { language } = useLanguage()
+  const text = hostReportText[language]
+  const [report, setReport] = useState<HostProbeReport | null>(null)
+  const [loading, setLoading] = useState(true)
+
+  const fetchReport = useCallback(async () => {
+    setLoading(true)
+    try {
+      const res = await getHostReport()
+      setReport(res.data.data || null)
+    } catch (err) {
+      console.error(err)
+    } finally {
+      setLoading(false)
+    }
+  }, [])
+
+  useEffect(() => {
+    fetchReport()
+  }, [fetchReport])
+
+  return (
+    <div className="space-y-6" data-no-translate>
+      <div className="flex flex-wrap items-start justify-between gap-3">
+        <div>
+          <h1 className="text-2xl font-bold text-black">{text.title}</h1>
+          <p className="mt-1 text-sm text-gray-500">{text.subtitle}</p>
+        </div>
+        <button onClick={fetchReport} disabled={loading} className="inline-flex items-center gap-1.5 rounded-md border border-gray-200 px-3 py-2 text-sm text-gray-600 hover:bg-gray-50 disabled:opacity-50">
+          <RefreshCw className={`h-4 w-4 ${loading ? 'animate-spin' : ''}`} />
+          {text.refresh}
+        </button>
+      </div>
+
+      {loading && !report ? (
+        <div className="rounded-lg border border-gray-200 bg-white py-14 text-center text-sm text-gray-400">{text.loading}</div>
+      ) : !report ? (
+        <div className="rounded-lg border border-gray-200 bg-white py-14 text-center text-sm text-gray-400">{text.emptyReport}</div>
+      ) : (
+        <div className="space-y-5">
+          <div className="grid gap-3 md:grid-cols-2 xl:grid-cols-4">
+            <ProbeMetric icon={<Cpu className="h-4 w-4" />} label="CPU" value={report.cpu.model || 'Unknown'} sub={formatCPUThreads(report.cpu.cores, report.cpu.threads, language)} />
+            <ProbeMetric icon={<MemoryStick className="h-4 w-4" />} label="RAM" value={formatMB(report.memory.total_mb)} sub={formatUsedMemory(report.memory.used_mb, language)} />
+            <ProbeMetric icon={<HardDrive className="h-4 w-4" />} label="DISK" value={formatDiskCount(report.disks.length, language)} sub={report.disks.map(d => diskTypeLabel(d, language)).filter(Boolean).join(' / ') || 'Unknown'} />
+            <ProbeMetric icon={<Activity className="h-4 w-4" />} label={text.runtimeStatus} value={translateDynamic(report.system.uptime_text, language)} sub={formatProcessCount(report.system.process_count, language)} />
+          </div>
+
+          <ProbeSection title={text.systemOverview}>
+            <ProbeRows rows={[
+              [text.hostname, report.hostname],
+              [text.os, report.os],
+              [text.kernel, report.kernel],
+              [text.generatedAt, report.generated_at],
+              [text.cpuArch, report.cpu.architecture],
+              [text.cpuVirtualization, report.cpu.virtualization ? `${text.supported} (${report.cpu.virtualization_key})` : text.notDetected],
+              [text.cpuIntegratedGPU, report.cpu.has_integrated_gpu ? text.detected : text.notDetected],
+              [text.gpu, report.gpus.length ? formatItemCount(report.gpus.length, language) : text.notDetected],
+              [text.runtimeCapability, runtimeModeLabel(report.runtime.support_mode, language)],
+              [text.kvmNested, `${report.runtime.nested_virtualization ? text.supported : text.notDetected} (${translateDynamic(report.runtime.nested_detail || '-', language)})`],
+            ]} />
+          </ProbeSection>
+
+          <ProbeSection title={text.publicNetwork}>
+            <ProbeRows rows={[
+              [text.publicIPv4, report.public_ipv4.length ? report.public_ipv4.join('\n') : text.notDetected],
+              [text.ipv4Address, report.ipv4_addresses?.length ? report.ipv4_addresses.map(formatIPv4Address).join('\n') : text.notDetected],
+              [text.ipv4Prefix, report.ipv4_prefixes?.length ? report.ipv4_prefixes.map(formatIPv4Prefix).join('\n') : text.notDetected],
+              [text.ipv6Address, report.ipv6_addresses.length ? report.ipv6_addresses.map(ip => `${ip.address}/${ip.prefix_len} (${ip.interface})`).join('\n') : text.notDetected],
+              [text.ipv6Prefix, report.ipv6_prefixes?.length ? report.ipv6_prefixes.map(formatIPv6Prefix).join('\n') : text.notDetected],
+              [text.gateway, report.gateways.length ? report.gateways.map(g => `${g.family}: ${g.gateway || '-'} dev ${g.interface || '-'}`).join('\n') : text.notDetected],
+            ]} />
+          </ProbeSection>
+
+          <ProbeTable
+            title={text.memoryModules}
+            empty={text.noMemoryModules}
+            headers={[text.slot, text.capacity, text.type, text.frequency, text.vendor, text.modelSerial]}
+            rows={(report.memory.modules || []).map(m => [
+              m.locator || '-',
+              m.size || '-',
+              m.type || '-',
+              m.speed || '-',
+              m.manufacturer || '-',
+              [m.part_number, m.serial_number].filter(Boolean).join(' / ') || '-',
+            ])}
+          />
+
+          <ProbeTable
+            title={text.disksHealth}
+            empty={text.noDisks}
+            headers={[text.device, text.model, text.capacity, text.type, text.mountPoint, text.health, text.lifetime, text.powerOn, text.reads, text.writes, text.commands, text.eraseCount]}
+            rows={report.disks.map(d => [
+              `${d.path || d.name}\n${d.serial || ''}`,
+              d.model || '-',
+              formatBytes(d.size_bytes),
+              diskTypeLabel(d, language),
+              d.mountpoints?.length ? d.mountpoints.join('\n') : '-',
+              `${diskHealthLabel(d.health, language)}\n${diskHealthDetail(d, language)}`,
+              d.virtual ? text.unsupported : formatLifeUsed(d.smart?.life_used_percent, language),
+              d.virtual ? text.unsupported : (d.smart?.power_on_hours ? `${d.smart.power_on_hours} ${text.hours}\n${formatPowerOnDays(d.smart.power_on_hours, language)}` : '-'),
+              d.virtual ? text.unsupported : formatBytes(d.smart?.read_data_bytes || 0),
+              d.virtual ? text.unsupported : formatBytes(d.smart?.written_data_bytes || 0),
+              d.virtual ? text.unsupported : formatCommands(d.smart?.read_commands, d.smart?.write_commands, language),
+              d.virtual ? text.unsupported : formatWear(d.smart?.wear_leveling_count, d.smart?.erase_count, d.smart?.power_cycle_count, language),
+            ])}
+          />
+
+          <ProbeTable
+            title={text.networkInterfaces}
+            empty={text.noNetworkInterfaces}
+            headers={[text.nic, text.status, text.driverSpeed, 'MAC', 'IPv4', 'IPv6']}
+            rows={report.network_interfaces.map(n => [
+              `${n.name}\n${n.model || ''}`,
+              n.state || '-',
+              `${n.driver || '-'}\n${n.speed_mbps > 0 ? `${n.speed_mbps} Mbps` : '-'}`,
+              n.mac || '-',
+              n.ipv4?.length ? n.ipv4.map(ip => `${ip.address}/${ip.prefix_len}`).join('\n') : '-',
+              n.ipv6?.length ? n.ipv6.map(ip => `${ip.address}/${ip.prefix_len} ${ip.scope}`).join('\n') : '-',
+            ])}
+          />
+
+          <ProbeTable
+            title={text.gpus}
+            empty={text.noGPUs}
+            headers={[text.name, text.vendor, text.type, text.driver]}
+            rows={report.gpus.map(g => [g.name, g.vendor || '-', gpuTypeLabel(g.type, language), g.driver || '-'])}
+          />
+
+          <ProbeSection title={text.environmentSupport}>
+            <div className="grid gap-2 md:grid-cols-2">
+              {report.environment.map(item => (
+                <div key={item.key} className="flex items-start gap-2 rounded-lg border border-gray-200 bg-white px-3 py-2">
+                  {item.ok ? <CheckCircle2 className="mt-0.5 h-4 w-4 shrink-0 text-green-600" /> : <XCircle className={`mt-0.5 h-4 w-4 shrink-0 ${item.required ? 'text-red-600' : 'text-amber-600'}`} />}
+                  <div className="min-w-0">
+                    <div className="flex flex-wrap items-center gap-2 text-xs font-medium text-gray-800">
+                      <span>{translateDynamic(item.label, language)}</span>
+                      <span className={`rounded px-1.5 py-0.5 text-[10px] ${item.required ? 'bg-gray-100 text-gray-600' : 'bg-blue-50 text-blue-700'}`}>
+                        {item.required ? text.required : text.optional}
+                      </span>
+                    </div>
+                    <div className="mt-1 break-all font-mono text-[11px] text-gray-500">{translateDynamic(item.detail || '-', language)}</div>
+                  </div>
+                </div>
+              ))}
+            </div>
+          </ProbeSection>
+        </div>
+      )}
+    </div>
+  )
+}
+
+function ProbeMetric({ icon, label, value, sub }: { icon: ReactNode; label: string; value: string; sub: string }) {
+  return (
+    <div className="rounded-lg border border-gray-200 bg-white px-3 py-3">
+      <div className="mb-2 flex items-center gap-2 text-xs font-medium text-gray-500">
+        {icon}
+        {label}
+      </div>
+      <div className="line-clamp-2 break-words text-sm font-semibold text-gray-900" title={value}>{value}</div>
+      <div className="mt-1 truncate text-xs text-gray-500" title={sub}>{sub}</div>
+    </div>
+  )
+}
+
+const hostReportText = {
+  zh: {
+    title: '宿主机信息',
+    subtitle: '硬件、网络、磁盘健康与运行环境探测报告',
+    refresh: '刷新',
+    loading: '正在探测宿主机环境...',
+    emptyReport: '暂未获取到宿主机信息',
+    runtimeStatus: '运行状态',
+    systemOverview: '系统概览',
+    hostname: '主机名',
+    os: '操作系统',
+    kernel: '内核',
+    generatedAt: '生成时间',
+    cpuArch: 'CPU 架构',
+    cpuVirtualization: 'CPU 虚拟化指令',
+    cpuIntegratedGPU: 'CPU 核显',
+    gpu: '显卡',
+    runtimeCapability: '运行能力',
+    kvmNested: 'KVM 嵌套虚拟化',
+    supported: '支持',
+    detected: '检测到',
+    notDetected: '未检测到',
+    publicNetwork: '公网与路由',
+    publicIPv4: '公网 IPv4',
+    ipv4Address: 'IPv4 地址',
+    ipv4Prefix: 'IPv4 段',
+    ipv6Address: 'IPv6 地址',
+    ipv6Prefix: 'IPv6 段',
+    gateway: '网关',
+    memoryModules: '内存条',
+    noMemoryModules: '未检测到内存条明细，可能缺少 dmidecode 或权限受限',
+    slot: '插槽',
+    capacity: '容量',
+    type: '类型',
+    frequency: '频率',
+    vendor: '厂商',
+    modelSerial: '型号/序列号',
+    disksHealth: '硬盘与健康',
+    noDisks: '未检测到硬盘',
+    device: '设备',
+    model: '型号',
+    mountPoint: '挂载点',
+    health: '健康',
+    lifetime: '寿命',
+    powerOn: '通电',
+    reads: '读取',
+    writes: '写入',
+    commands: '命令数',
+    eraseCount: '擦写',
+    virtualDisk: '虚拟磁盘',
+    virtualDiskDetail: '虚拟磁盘，真实 SMART/寿命/通电数据需在物理宿主机查看',
+    unsupported: '不支持',
+    hours: '小时',
+    used: '已用',
+    remaining: '剩余',
+    read: '读',
+    write: '写',
+    wear: '磨损',
+    erase: '擦写',
+    powerCycles: '启停',
+    networkInterfaces: '网卡',
+    noNetworkInterfaces: '未检测到网卡',
+    nic: '网卡',
+    status: '状态',
+    driverSpeed: '驱动/速率',
+    gpus: '显卡',
+    noGPUs: '未检测到显卡',
+    name: '名称',
+    driver: '驱动',
+    environmentSupport: '环境支持',
+    required: '必要',
+    optional: '可选',
+  },
+  en: {
+    title: 'Host Info',
+    subtitle: 'Hardware, network, disk health, and runtime environment report',
+    refresh: 'Refresh',
+    loading: 'Probing host environment...',
+    emptyReport: 'No host information available',
+    runtimeStatus: 'Runtime Status',
+    systemOverview: 'System Overview',
+    hostname: 'Hostname',
+    os: 'Operating System',
+    kernel: 'Kernel',
+    generatedAt: 'Generated At',
+    cpuArch: 'CPU Architecture',
+    cpuVirtualization: 'CPU Virtualization',
+    cpuIntegratedGPU: 'CPU Integrated GPU',
+    gpu: 'GPU',
+    runtimeCapability: 'Runtime Capability',
+    kvmNested: 'KVM Nested Virtualization',
+    supported: 'Supported',
+    detected: 'Detected',
+    notDetected: 'Not detected',
+    publicNetwork: 'Public Network & Routing',
+    publicIPv4: 'Public IPv4',
+    ipv4Address: 'IPv4 Addresses',
+    ipv4Prefix: 'IPv4 Prefixes',
+    ipv6Address: 'IPv6 Addresses',
+    ipv6Prefix: 'IPv6 Prefixes',
+    gateway: 'Gateway',
+    memoryModules: 'Memory Modules',
+    noMemoryModules: 'No memory module details detected. dmidecode may be missing or permissions may be limited.',
+    slot: 'Slot',
+    capacity: 'Capacity',
+    type: 'Type',
+    frequency: 'Frequency',
+    vendor: 'Vendor',
+    modelSerial: 'Model / Serial',
+    disksHealth: 'Disks & Health',
+    noDisks: 'No disks detected',
+    device: 'Device',
+    model: 'Model',
+    mountPoint: 'Mount Point',
+    health: 'Health',
+    lifetime: 'Lifetime',
+    powerOn: 'Power-on',
+    reads: 'Reads',
+    writes: 'Writes',
+    commands: 'Commands',
+    eraseCount: 'Erase Count',
+    virtualDisk: 'Virtual Disk',
+    virtualDiskDetail: 'Virtual disk. Real SMART, lifetime, and power-on data must be checked on the physical host.',
+    unsupported: 'Unsupported',
+    hours: 'hours',
+    used: 'used',
+    remaining: 'remaining',
+    read: 'Read',
+    write: 'Write',
+    wear: 'Wear',
+    erase: 'Erase',
+    powerCycles: 'Power cycles',
+    networkInterfaces: 'Network Interfaces',
+    noNetworkInterfaces: 'No network interfaces detected',
+    nic: 'NIC',
+    status: 'Status',
+    driverSpeed: 'Driver / Speed',
+    gpus: 'GPUs',
+    noGPUs: 'No GPUs detected',
+    name: 'Name',
+    driver: 'Driver',
+    environmentSupport: 'Environment Support',
+    required: 'Required',
+    optional: 'Optional',
+  },
+} as const
+
+function ProbeSection({ title, children }: { title: string; children: ReactNode }) {
+  return (
+    <section>
+      <h2 className="mb-2 text-sm font-semibold text-black">{title}</h2>
+      {children}
+    </section>
+  )
+}
+
+function ProbeRows({ rows }: { rows: Array<[string, string]> }) {
+  return (
+    <div className="overflow-hidden rounded-lg border border-gray-200 bg-white">
+      {rows.map(([label, value]) => (
+        <div key={label} className="grid gap-2 border-b border-gray-100 px-3 py-2 text-xs last:border-b-0 md:grid-cols-[160px_1fr]">
+          <div className="font-medium text-gray-500">{label}</div>
+          <div className="whitespace-pre-wrap break-words font-mono text-gray-800">{value || '-'}</div>
+        </div>
+      ))}
+    </div>
+  )
+}
+
+function ProbeTable({ title, headers, rows, empty }: { title: string; headers: string[]; rows: string[][]; empty: string }) {
+  return (
+    <section>
+      <h2 className="mb-2 text-sm font-semibold text-black">{title}</h2>
+      {rows.length === 0 ? (
+        <div className="rounded-lg border border-gray-200 bg-white px-3 py-3 text-xs text-gray-400">{empty}</div>
+      ) : (
+        <div className="overflow-x-auto rounded-lg border border-gray-200 bg-white">
+          <table className="w-full text-xs">
+            <thead>
+              <tr className="border-b border-gray-100 bg-gray-50 text-left text-gray-500">
+                {headers.map(header => <th key={header} className="px-3 py-2 font-medium">{header}</th>)}
+              </tr>
+            </thead>
+            <tbody className="divide-y divide-gray-100">
+              {rows.map((row, rowIndex) => (
+                <tr key={rowIndex} className="align-top">
+                  {row.map((cell, cellIndex) => (
+                    <td key={cellIndex} className="max-w-[280px] whitespace-pre-wrap break-words px-3 py-2 text-gray-700">
+                      {cell || '-'}
+                    </td>
+                  ))}
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      )}
+    </section>
+  )
+}
+
+function formatIPv4Address(ip: HostProbeReport['ipv4_addresses'][number]) {
+  return `${ip.address}/${ip.prefix_len} (${ip.interface})`
+}
+
+function formatIPv4Prefix(prefix: HostProbeReport['ipv4_prefixes'][number]) {
+  const parts = [
+    prefix.prefix || '-',
+    prefix.subnet_mask ? `mask ${prefix.subnet_mask}` : '',
+    prefix.gateway ? `via ${prefix.gateway}` : '',
+    prefix.interface ? `dev ${prefix.interface}` : '',
+    prefix.source ? `[${prefix.source}]` : '',
+  ].filter(Boolean)
+  return parts.join(' ')
+}
+
+function formatIPv6Prefix(prefix: HostProbeReport['ipv6_prefixes'][number]) {
+  const value = prefix.prefix || prefix.address || '-'
+  const cidr = value.includes('/') || !prefix.prefix_len ? value : `${value}/${prefix.prefix_len}`
+  return `${cidr} via ${prefix.gateway || '-'}`
+}
+
+function formatMB(value: number) {
+  if (!value) return '-'
+  if (value >= 1024) return `${(value / 1024).toFixed(1)} GB`
+  return `${value} MB`
+}
+
+function formatCPUThreads(cores: number, threads: number, language: Language) {
+  return language === 'en' ? `${cores} cores / ${threads} threads` : `${cores} 核 / ${threads} 线程`
+}
+
+function formatUsedMemory(usedMB: number, language: Language) {
+  return language === 'en' ? `${formatMB(usedMB)} used` : `${formatMB(usedMB)} 已用`
+}
+
+function formatDiskCount(count: number, language: Language) {
+  return language === 'en' ? `${count} disk${count === 1 ? '' : 's'}` : `${count} 块硬盘`
+}
+
+function formatProcessCount(count: number, language: Language) {
+  return language === 'en' ? `${count} process${count === 1 ? '' : 'es'}` : `${count} 个进程`
+}
+
+function formatItemCount(count: number, language: Language) {
+  return language === 'en' ? `${count} item${count === 1 ? '' : 's'}` : `${count} 个`
+}
+
+function formatBytes(value: number) {
+  if (!value) return '-'
+  const units = ['B', 'KB', 'MB', 'GB', 'TB', 'PB']
+  let next = value
+  let index = 0
+  while (next >= 1024 && index < units.length - 1) {
+    next /= 1024
+    index++
+  }
+  return `${next.toFixed(index === 0 ? 0 : 1)} ${units[index]}`
+}
+
+function formatLifeUsed(value: number | undefined, language: Language) {
+  if (value === undefined || value === null) return '-'
+  const text = hostReportText[language]
+  return `${value}% ${text.used}\n${Math.max(0, 100 - value)}% ${text.remaining}`
+}
+
+function formatPowerOnDays(hours: number, language: Language) {
+  const days = Math.floor(hours / 24)
+  const rest = hours % 24
+  return language === 'en'
+    ? (days > 0 ? `${days} days ${rest} hours` : `${hours} hours`)
+    : (days > 0 ? `${days} 天 ${rest} 小时` : `${hours} 小时`)
+}
+
+function formatCommands(read: number | undefined, write: number | undefined, language: Language) {
+  if (!read && !write) return '-'
+  const text = hostReportText[language]
+  return `${text.read} ${formatCount(read || 0)}\n${text.write} ${formatCount(write || 0)}`
+}
+
+function formatCount(value: number) {
+  if (!value) return '-'
+  if (value >= 1_000_000_000) return `${(value / 1_000_000_000).toFixed(1)}B`
+  if (value >= 1_000_000) return `${(value / 1_000_000).toFixed(1)}M`
+  if (value >= 1_000) return `${(value / 1_000).toFixed(1)}K`
+  return `${value}`
+}
+
+function formatWear(wear: string | undefined, erase: string | undefined, powerCycles: number | undefined, language: Language) {
+  const text = hostReportText[language]
+  const rows: string[] = []
+  if (wear) rows.push(`${text.wear} ${wear}`)
+  if (erase) rows.push(`${text.erase} ${erase}`)
+  if (powerCycles) rows.push(`${text.powerCycles} ${powerCycles}`)
+  return rows.length ? rows.join('\n') : '-'
+}
+
+function runtimeModeLabel(value: string, language: Language) {
+  switch (value) {
+    case 'kvm_lxc':
+      return language === 'en' ? 'KVM + LXC supported' : '支持 KVM + LXC'
+    case 'lxc_only':
+      return language === 'en' ? 'LXC only' : '仅支持 LXC'
+    default:
+      return language === 'en' ? 'Runtime requirements not met' : '未满足运行环境'
+  }
+}
+
+function diskHealthLabel(value: string, language: Language) {
+  const text = hostReportText[language]
+  switch (value) {
+    case 'ok':
+      return language === 'en' ? 'Healthy' : '健康'
+    case 'failed':
+      return language === 'en' ? 'Failed' : '异常'
+    case 'virtual':
+      return text.virtualDisk
+    default:
+      return language === 'en' ? 'Unknown' : '未知'
+  }
+}
+
+function diskHealthDetail(d: { virtual?: boolean; health_detail?: string }, language: Language) {
+  if (d.virtual) return hostReportText[language].virtualDiskDetail
+  return translateDynamic(d.health_detail || '', language)
+}
+
+function diskTypeLabel(d: { type?: string; rotational?: boolean; virtual?: boolean }, language: Language) {
+  if (d.virtual || d.type === 'Virtual') return hostReportText[language].virtualDisk
+  return d.type || (d.rotational ? 'HDD' : 'SSD')
+}
+
+function gpuTypeLabel(value: string, language: Language) {
+  if (value === 'integrated') return language === 'en' ? 'Integrated' : '核显'
+  if (value === 'discrete') return language === 'en' ? 'Discrete' : '独显'
+  return value || '-'
+}
+
+function translateDynamic(value: string, language: Language) {
+  if (language !== 'en' || !value) return value
+  return translateText(value)
+    .replace(/寿命已用\s*(\d+)%/g, 'Lifetime used $1%')
+    .replace(/通电\s*(\d+)h/g, 'Power-on $1h')
+    .replace(/写入\s*([^|]+)/g, 'Written $1')
+    .replace(/读取\s*([^|]+)/g, 'Read $1')
+    .replace(/介质错误\s*(\d+)/g, 'Media errors $1')
+}

frontend/src/pages/ImageManagement.tsx

@@ -9,10 +9,13 @@ import {
   ToggleRight,
   Loader2,
   AlertCircle,
+  X,
 } from 'lucide-react'
-import { getImages, downloadImage, deleteImage, toggleImage, ImageInfo } from '../services/api'
+import { getImages, downloadImage, cancelImageDownload, deleteImage, toggleImage, ImageInfo } from '../services/api'
+import { useDialog } from '../components/Dialog'
 
 export default function ImageManagement() {
+  const dialog = useDialog()
   const [images, setImages] = useState<ImageInfo[]>([])
   const [loading, setLoading] = useState(true)
   const [actionLoading, setActionLoading] = useState<string | null>(null)
@@ -32,10 +35,14 @@ export default function ImageManagement() {
 
   useEffect(() => {
     fetchImages()
-    const interval = setInterval(fetchImages, 5000)
-    return () => clearInterval(interval)
   }, [fetchImages])
 
+  useEffect(() => {
+    const hasDownloads = images.some((img) => img.downloading)
+    const interval = setInterval(fetchImages, hasDownloads ? 1500 : 5000)
+    return () => clearInterval(interval)
+  }, [fetchImages, images])
+
   const handleDownload = async (templateId: string) => {
     setActionLoading(templateId)
     setError('')
@@ -43,15 +50,27 @@ export default function ImageManagement() {
       await downloadImage(templateId)
       await fetchImages()
     } catch (err: unknown) {
-      const msg = err instanceof Error ? err.message : '下载失败'
-      setError(msg)
+      setError(apiErrorMessage(err, '下载失败'))
+    } finally {
+      setActionLoading(null)
+    }
+  }
+
+  const handleCancelDownload = async (templateId: string) => {
+    setActionLoading(templateId)
+    setError('')
+    try {
+      await cancelImageDownload(templateId)
+      await fetchImages()
+    } catch (err: unknown) {
+      setError(apiErrorMessage(err, '取消失败'))
     } finally {
       setActionLoading(null)
     }
   }
 
   const handleDelete = async (templateId: string) => {
-    if (!window.confirm('确定要删除该镜像缓存吗？删除后需要重新下载才能使用。')) return
+    if (!(await dialog.confirm('删除镜像', '确定要删除该镜像缓存吗？删除后需要重新下载才能使用。'))) return
     setActionLoading(templateId)
     setError('')
     try {
@@ -124,6 +143,7 @@ export default function ImageManagement() {
         downloadedCount={lxcImages.filter((img) => img.downloaded).length}
         totalCount={lxcImages.length}
         onDownload={handleDownload}
+        onCancelDownload={handleCancelDownload}
         onDelete={handleDelete}
         onToggle={handleToggle}
       />
@@ -135,6 +155,7 @@ export default function ImageManagement() {
         downloadedCount={kvmImages.filter((img) => img.downloaded).length}
         totalCount={kvmImages.length}
         onDownload={handleDownload}
+        onCancelDownload={handleCancelDownload}
         onDelete={handleDelete}
         onToggle={handleToggle}
       />
@@ -149,6 +170,7 @@ function ImageTable({
   downloadedCount,
   totalCount,
   onDownload,
+  onCancelDownload,
   onDelete,
   onToggle,
 }: {
@@ -158,6 +180,7 @@ function ImageTable({
   downloadedCount: number
   totalCount: number
   onDownload: (id: string) => void
+  onCancelDownload: (id: string) => void
   onDelete: (id: string) => void
   onToggle: (id: string, enabled: boolean) => void
 }) {
@@ -201,12 +224,13 @@ function ImageTable({
                   <tr key={img.id} className="hover:bg-gray-50 transition-colors">
                     <td className="px-4 py-3">
                       <div className="flex items-center gap-3">
-                        <span className="w-8 h-8 bg-gray-100 rounded-lg flex items-center justify-center flex-shrink-0">
+                        <span className="w-8 h-8 flex items-center justify-center flex-shrink-0">
                           {getTemplateIcon(img.id)}
                         </span>
                         <div>
                           <span className="font-medium text-gray-900 text-sm">{img.name}</span>
                           <p className="text-[11px] text-gray-400">{img.description}</p>
+
                         </div>
                       </div>
                     </td>
@@ -240,13 +264,18 @@ function ImageTable({
                         )}
 
                         {img.downloading && (
-                          <span className="inline-flex items-center gap-1.5 px-3 py-1.5 bg-amber-50 border border-amber-200 rounded-md text-amber-700 text-xs font-medium">
-                            <Loader2 className="w-3.5 h-3.5 animate-spin" />
-                            下载中...
-                          </span>
+                          <button
+                            onClick={() => onCancelDownload(img.id)}
+                            disabled={isBusy}
+                            className="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-md border border-red-200 text-red-600 hover:bg-red-50 transition-colors text-xs font-medium disabled:opacity-50"
+                            title="取消下载并清理临时文件"
+                          >
+                            {isBusy ? <Loader2 className="w-3.5 h-3.5 animate-spin" /> : <X className="w-3.5 h-3.5" />}
+                            {isBusy ? '取消中...' : '取消'}
+                          </button>
                         )}
 
-                        {img.downloaded && (
+                        {img.downloaded && !img.downloading && (
                           <>
                             <button
                               onClick={() => onToggle(img.id, img.enabled)}
@@ -285,10 +314,33 @@ function ImageTable({
 
 function StatusBadge({ img }: { img: ImageInfo }) {
   if (img.downloading) {
+    const progress = Math.max(0, Math.min(100, img.progress || 0))
+    const showProgress = img.stage === 'downloading' && progress > 0
     return (
-      <span className="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium bg-amber-50 text-amber-700">
-        <span className="w-1.5 h-1.5 rounded-full bg-amber-500 animate-pulse" />
-        下载中
+      <div className="inline-flex flex-col gap-1">
+        <span
+          className="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium bg-amber-50 text-amber-700"
+          title={downloadStatusTitle(img)}
+        >
+          <span className="w-1.5 h-1.5 rounded-full bg-amber-500 animate-pulse" />
+          {downloadStatusLabel(img)}
+        </span>
+        {showProgress && (
+          <span className="block h-1 w-24 overflow-hidden rounded-full bg-amber-100">
+            <span className="block h-full rounded-full bg-amber-500 transition-all" style={{ width: `${progress}%` }} />
+          </span>
+        )}
+      </div>
+    )
+  }
+  if (img.error) {
+    return (
+      <span
+        className="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium bg-red-50 text-red-600"
+        title={img.error}
+      >
+        <AlertCircle className="w-3 h-3" />
+        下载失败
       </span>
     )
   }
@@ -316,6 +368,27 @@ function StatusBadge({ img }: { img: ImageInfo }) {
   )
 }
 
+function downloadStatusLabel(img: ImageInfo) {
+  if (img.stage === 'canceling') return '取消中'
+  if (img.stage === 'converting') return '转换中'
+  if (img.stage === 'lxc-create') return '下载中'
+  if (img.progress > 0) return `下载中 ${Math.min(100, img.progress)}%`
+  return '下载中'
+}
+
+function downloadStatusTitle(img: ImageInfo) {
+  const parts = [downloadStatusLabel(img)]
+  if (img.stage) parts.push(`阶段：${img.stage}`)
+  if (img.downloaded_bytes > 0 || img.total_bytes > 0) {
+    parts.push(`${formatSize(img.downloaded_bytes)} / ${formatSize(img.total_bytes)}`)
+  }
+  return parts.join('，')
+}
+
+function isWindowsImage(img: ImageInfo) {
+  return img.distro === 'windows' || img.id.toLowerCase().includes('windows')
+}
+
 function getTemplateIcon(id: string): ReactNode {
   const size = 'w-5 h-5'
   id = id.startsWith('kvm-') ? id.slice(4) : id
@@ -326,9 +399,15 @@ function getTemplateIcon(id: string): ReactNode {
   if (id.startsWith('archlinux')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M504.149333 7.850667c-44.373333 108.544-70.997333 179.2-120.149333 284.330666 30.037333 32.085333 67.242667 69.290667 127.317333 111.274667-64.512-26.624-108.544-53.248-141.653333-80.896-63.146667 131.413333-161.792 318.464-361.813333 678.229333 157.696-90.794667 279.552-146.773333 393.216-168.277333-4.778667-21.162667-7.509333-43.690667-7.509334-67.584l0.341334-5.12c2.389333-100.693333 54.954667-178.517333 117.077333-173.056s110.592 91.477333 107.861333 192.170667c-0.341333 18.090667-2.389333 36.522667-6.485333 54.272 112.64 21.845333 233.130667 77.824 388.437333 167.594666l-83.968-155.648c-40.96-31.744-83.968-73.386667-171.349333-118.101333 60.074667 15.701333 103.082667 33.792 136.533333 53.930667-265.557333-493.909333-287.061333-559.786667-377.856-773.12z" fill="#1793D1"/></svg>
   if (id.startsWith('fedora')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M512 0C229.344 0 0.224 229.024 0 511.648V907.84a116.384 116.384 0 0 0 116.384 116.128h395.808c282.656-0.128 511.776-229.28 511.776-512 0-282.752-229.248-512-512-512z m196.064 237.952c-16.16 0-22.016-3.104-45.728-3.104a126.848 126.848 0 0 0-126.848 126.624v110.208c0 9.888 8.032 17.92 17.92 17.92h83.328c31.072 0 56.16 24.736 56.16 55.904 0 31.328-25.344 55.968-56.736 55.968h-100.608v127.36a240.32 240.32 0 0 1-240.288 240.288h-1.248a190.944 190.944 0 0 1-53.216-7.52l1.344 0.32c-27.168-7.072-49.376-29.408-49.376-55.296 0-31.328 22.752-54.112 56.736-54.112 16.128 0 22.016 3.072 45.696 3.072a126.848 126.848 0 0 0 126.848-126.624v-110.208a17.92 17.92 0 0 0-17.92-17.888h-83.328a55.808 55.808 0 0 1-56.096-55.904c0-31.328 25.344-55.968 56.736-55.968h100.576v-127.36a240.32 240.32 0 0 1 240.288-240.288c20.128 0 34.432 2.272 53.088 7.136 27.168 7.136 49.408 29.44 49.408 55.296 0 31.36-22.752 54.144-56.736 54.144z" fill="#294172"/></svg>
   if (id.startsWith('rockylinux')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M995.498667 680.362667c18.474667-52.778667 28.501333-109.568 28.501333-168.704C1024 229.077333 794.752 0 512 0S0 229.077333 0 511.658667c0 139.818667 56.106667 266.496 147.114667 358.826666L666.453333 351.530667l128.213334 128.170666 200.832 200.704z m-93.525334 162.816l-235.52-235.349334-368.896 368.597334A510.506667 510.506667 0 0 0 512 1023.274667c156.16 0 296.106667-69.888 389.973333-180.053334h0.042667z" fill="#10B981"/></svg>
+  if (id.startsWith('windows')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M56.888889 227.555556l398.222222-70.542223V512H56.888889V227.555556z m0 625.777777l398.222222 70.542223V568.888889H56.888889v284.444444zM512 147.342222L1024 56.888889v455.111111H512V147.342222z m0 786.204445L1024 1024v-455.111111H512v364.657778z" fill="#16C6FE"/></svg>
   return null
 }
 
+function apiErrorMessage(err: unknown, fallback: string) {
+  const error = err as { response?: { data?: { message?: string } }; message?: string }
+  return error.response?.data?.message || error.message || fallback
+}
+
 function formatSize(bytes: number): string {
   if (bytes <= 0) return '-'
   if (bytes < 1024) return `${bytes} B`

frontend/src/pages/Login.tsx

@@ -2,16 +2,21 @@ import { FormEvent, useState } from 'react'
 import { Lock, User } from 'lucide-react'
 import AppIcon from '../components/AppIcon'
 import { useAuth } from '../contexts/AuthContext'
+import { useLanguage } from '../contexts/LanguageContext'
+import AutoTranslate from '../components/AutoTranslate'
+import BrowserDialogTranslator from '../components/BrowserDialogTranslator'
 
-async function sha256Hash(input: string): Promise<string> {
-  const msgBuffer = new TextEncoder().encode(input)
-  const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer)
-  const hashArray = Array.from(new Uint8Array(hashBuffer))
-  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('')
+function LanguageIcon({ className = '' }: { className?: string }) {
+  return (
+    <svg className={className} viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
+      <path d="M213.333333 640v85.333333a85.333333 85.333333 0 0 0 78.933334 85.12L298.666667 810.666667h128v85.333333H298.666667a170.666667 170.666667 0 0 1-170.666667-170.666667v-85.333333h85.333333z m554.666667-213.333333l187.733333 469.333333h-91.946666l-51.242667-128h-174.506667l-51.157333 128h-91.904L682.666667 426.666667h85.333333z m-42.666667 123.093333L672.128 682.666667h106.325333L725.333333 549.76zM341.333333 85.333333v85.333334h170.666667v298.666666H341.333333v128H256v-128H85.333333V170.666667h170.666667V85.333333h85.333333z m384 42.666667a170.666667 170.666667 0 0 1 170.666667 170.666667v85.333333h-85.333333V298.666667a85.333333 85.333333 0 0 0-85.333334-85.333334h-128V128h128zM256 256H170.666667v128h85.333333V256z m170.666667 0H341.333333v128h85.333334V256z" fill="currentColor" />
+    </svg>
+  )
 }
 
 export default function Login() {
   const { login, accessCodeLogin } = useAuth()
+  const { language, toggleLanguage, t } = useLanguage()
   const [username, setUsername] = useState('')
   const [password, setPassword] = useState('')
   const [error, setError] = useState('')
@@ -36,7 +41,7 @@ export default function Login() {
       }
     } catch (err: unknown) {
       const error = err as { response?: { data?: { message?: string } } }
-      setError(error.response?.data?.message || '登录失败，请检查用户名和密码')
+      setError(error.response?.data?.message || t('登录失败，请检查用户名和密码'))
     } finally {
       setLoading(false)
     }
@@ -44,10 +49,20 @@ export default function Login() {
 
   return (
     <div className="min-h-screen flex items-center justify-center bg-gray-50 px-4">
+      <AutoTranslate />
+      <BrowserDialogTranslator />
+      <button
+        type="button"
+        onClick={() => { void toggleLanguage() }}
+        className="absolute right-4 top-4 inline-flex items-center gap-1.5 rounded-md border border-gray-200 bg-white px-3 py-1.5 text-xs font-medium text-gray-600 shadow-sm hover:bg-gray-50"
+      >
+        <LanguageIcon className="h-3.5 w-3.5" />
+        {language === 'en' ? '中文' : 'English'}
+      </button>
       <div className="w-full max-w-md">
         <div className="bg-white rounded-lg border border-gray-200 shadow-sm p-8">
             <div className="flex flex-col items-center mb-8">
-              <div className="w-16 h-16 rounded-lg border border-gray-200 bg-gray-50 flex items-center justify-center mb-4">
+              <div className="w-16 h-16 flex items-center justify-center mb-4">
                 <AppIcon className="w-10 h-10" />
               </div>
               <h1 className="text-2xl font-bold text-gray-950">CLICD</h1>
@@ -113,7 +128,7 @@ export default function Login() {
           </form>
         </div>
 
-        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.0.0</p>
+        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.1.11</p>
       </div>
     </div>
   )