Update README.md

1.1.9 screen
update client linux and psutil
2026-08-08 21:53:57 +08:00 · 2026-07-09 19:15:34 +08:00 · 2026-07-09 18:01:57 +08:00 · 2026-07-09 17:13:58 +08:00 · 2026-07-09 17:07:59 +08:00 · 2026-07-09 16:09:02 +08:00
22 changed files with 2805 additions and 930 deletions
@@ -0,0 +1,11 @@
+.git
+.github
+.idea
+*.sublime-workspace
+server/obj
+server/sergate
+web/json/stats.json
+web/json/stats.json~
+*.bak-*
+__pycache__
+*.pyc
@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: sudo apt-get update && sudo apt-get install -y gcc g++ make libcurl4-openssl-dev python3
+
+      - name: Build server
+        run: make -C server -j2
+
+      - name: Check scripts
+        run: |
+          python3 -m py_compile server/manage_api.py clients/client-linux.py clients/client-psutil.py plugin/bot-telegram.py
+          sh -n server/entrypoint-server.sh clients/entrypoint.sh status.sh
+          node --check web/js/app.js
+
+      - name: Validate compose files
+        run: |
+          docker compose -f docker-compose-server.yml config
+          docker compose -f docker-compose-client.yml config
+
+      - name: Build Docker images
+        run: |
+          docker build -f Dockerfile.server -t serverstatus-server:test .
+          docker build -f Dockerfile.client -t serverstatus-client:test .
@@ -1,29 +0,0 @@
-# The Dockerfile for build localhost source, not git repo
-FROM debian:bookworm AS builder
-
-LABEL maintainer="cppla <https://cpp.la>"
-
-RUN apt-get update -y && apt-get -y install gcc g++ make libcurl4-openssl-dev
-
-COPY . .
-
-WORKDIR /server
-
-RUN make -j
-RUN pwd && ls -a
-
-# glibc env run
-FROM nginx:latest
-
-RUN mkdir -p /ServerStatus/server/ && ln -sf /dev/null /var/log/nginx/access.log && ln -sf /dev/null /var/log/nginx/error.log
-
-COPY --from=builder server /ServerStatus/server/
-COPY --from=builder web /usr/share/nginx/html/
-
-# china time 
-ENV TZ=Asia/Shanghai
-RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
-
-EXPOSE 80 35601
-HEALTHCHECK --interval=5s --timeout=3s --retries=3 CMD curl --fail http://localhost:80 || bash -c 'kill -s 15 -1 && (sleep 10; kill -s 9 -1)'
-CMD ["sh", "-c", "/etc/init.d/nginx start && /ServerStatus/server/sergate --config=/ServerStatus/server/config.json --web-dir=/usr/share/nginx/html"]
@@ -0,0 +1,29 @@
+FROM alpine:3.13
+
+WORKDIR /app
+
+# Runtime deps for client-linux.py and client-psutil.py
+RUN apk add --no-cache python3 py3-psutil iproute2 procps
+
+COPY clients/client-linux.py /app/client-linux.py
+COPY clients/client-psutil.py /app/client-psutil.py
+COPY clients/entrypoint.sh /app/entrypoint.sh
+
+# Default client and defaults (can be overridden by docker env)
+ENV SERVER=127.0.0.1 \
+    USER=s01 \
+    PORT=35601 \
+    PASSWORD=USER_DEFAULT_PASSWORD \
+    INTERVAL=1 \
+    PROBEPORT=80 \
+    PROBE_PROTOCOL_PREFER=ipv4 \
+    PING_PACKET_HISTORY_LEN=100 \
+    CU=cu.tz.cloudcpp.com \
+    CT=ct.tz.cloudcpp.com \
+    CM=cm.tz.cloudcpp.com \
+    CLIENT=psutil
+
+RUN chmod +x /app/entrypoint.sh
+
+ENTRYPOINT ["/app/entrypoint.sh"]
+CMD []
@@ -0,0 +1,42 @@
+FROM python:3.12-slim-bookworm AS builder
+
+LABEL maintainer="cppla <https://cpp.la>"
+
+RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources \
+    && apt-get -o Acquire::Retries=3 update -y \
+    && apt-get install -y --no-install-recommends gcc g++ make libcurl4-openssl-dev ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY server/ /server/
+
+WORKDIR /server
+
+RUN make -j && strip /server/sergate
+
+FROM debian:bookworm-slim
+
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources \
+    && apt-get -o Acquire::Retries=3 update -y \
+    && apt-get install -y --no-install-recommends nginx-light python3 openssl libcurl4 libstdc++6 tzdata \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /ServerStatus/server/ \
+    && ln -sf /dev/null /var/log/nginx/access.log \
+    && ln -sf /dev/null /var/log/nginx/error.log \
+    && rm -f /etc/nginx/sites-enabled/default
+
+COPY --from=builder /server/sergate /ServerStatus/server/sergate
+COPY server/config.json /ServerStatus/server/config.json
+COPY server/manage_api.py /ServerStatus/server/manage_api.py
+COPY server/entrypoint-server.sh /ServerStatus/server/entrypoint-server.sh
+COPY web /usr/share/nginx/html/
+COPY server/nginx-serverstatus.conf /etc/nginx/conf.d/default.conf
+
+RUN chmod +x /ServerStatus/server/entrypoint-server.sh
+
+ENV TZ=Asia/Shanghai
+RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+
+EXPOSE 80 35601
+HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD python3 -c "import os,urllib.request; pid=int(open('/tmp/serverstatus-sergate.pid').read().strip()); os.kill(pid,0); urllib.request.urlopen('http://127.0.0.1/',timeout=2).read(1)"
+CMD ["/ServerStatus/server/entrypoint-server.sh"]
@@ -1,202 +1,341 @@
-# ServerStatus中文版：   
+# ServerStatus 中文版

-* ServerStatus中文版是一个酷炫高逼格的云探针、云监控、服务器云监控、多服务器探针~。
-* 在线演示：https://tz.cloudcpp.com    
+ServerStatus 是一个轻量的服务器探针和云监控面板，支持多节点在线状态、资源占用、三网延迟、服务监测、SSL 证书检查、Watchdog 告警和 Web 配置管理。
+
+在线演示：https://tz.cloudcpp.com

 [![Python Support](https://img.shields.io/badge/python-3.6%2B%20-blue.svg)](https://github.com/cppla/ServerStatus)
 [![C++ Compiler](http://img.shields.io/badge/C++-GNU-blue.svg?style=flat&logo=cplusplus)](https://github.com/cppla/ServerStatus)
 [![License](https://img.shields.io/badge/license-MIT-4EB1BA.svg?style=flat-square)](https://github.com/cppla/ServerStatus)
-[![Version](https://img.shields.io/badge/Version-Build%201.1.7-red)](https://github.com/cppla/ServerStatus)
+[![Version](https://img.shields.io/badge/Version-Build%201.1.9-red)](https://github.com/cppla/ServerStatus)

-![Latest Host Version](https://dl.cpp.la/Archive/serverstatus_1_1_7.png)
+![Latest Host Version](https://dl.cpp.la/Archive/serverstatus_1_1_9.webp)

-`Watchdog触发式告警，interval只是为了防止频繁收到报警，并不是探测间隔。值得注意的是Exprtk使用窄字符类型，中文等Unicode字符无法解析计算。 AI已经能够取代大部分程序员`    
-    
+`Watchdog 的 `interval` 是最小通知间隔，用于避免频繁报警，并不是探测间隔。`rule` 使用 Exprtk 表达式，当前窄字符解析对中文等 Unicode 字符不友好，规则中建议使用英文、数字和字段名。`

-# 部署：

-【服务端】：
+## 一、服务端
+
 ```bash
-
-`Docker`:     
-
-wget --no-check-certificate -qO ~/serverstatus-config.json https://raw.githubusercontent.com/cppla/ServerStatus/master/server/config.json && mkdir ~/serverstatus-monthtraffic    
-docker run -d --restart=always --name=serverstatus -v ~/serverstatus-config.json:/ServerStatus/server/config.json -v ~/serverstatus-monthtraffic:/usr/share/nginx/html/json -p 80:80 -p 35601:35601 cppla/serverstatus:latest     
-
-`Docker-compose(推荐)`: docker-compose up -d
+# Docker Compose，本地构建加：--build
+ADMIN_TOKEN='your-strong-token' docker compose -f docker-compose-server.yml up -d
 ```

-【客户端】：
 ```bash
-wget --no-check-certificate -qO client-linux.py 'https://raw.githubusercontent.com/cppla/ServerStatus/master/clients/client-linux.py' && nohup python3 client-linux.py SERVER={$SERVER} USER={$USER} PASSWORD={$PASSWORD} >/dev/null 2>&1 &
+# Docker Run
+wget -qO ~/serverstatus-config.json \
+  --header='Accept: application/vnd.github.raw' \
+  'https://api.github.com/repos/cppla/ServerStatus/contents/server/config.json?ref=master'
+mkdir -p ~/serverstatus-monthtraffic

-eg:
-wget --no-check-certificate -qO client-linux.py 'https://raw.githubusercontent.com/cppla/ServerStatus/master/clients/client-linux.py' && nohup python3 client-linux.py SERVER=45.79.67.132 USER=s04  >/dev/null 2>&1 &
+docker run -d --restart=always --name=serverstatus-server \
+  -e ADMIN_TOKEN='your-strong-token' \
+  -v ~/serverstatus-config.json:/ServerStatus/server/config.json \
+  -v ~/serverstatus-monthtraffic:/usr/share/nginx/html/json \
+  -p 8080:80 -p 35601:35601 \
+  cppla/serverstatus:server
 ```

+启动后访问：

-# 教程：     
-   
-**【服务端配置】**           
-          
-#### 一、生成服务端程序              
-```
-`Debian/Ubuntu`: apt-get -y install gcc g++ make libcurl4-openssl-dev
-`Centos/Redhat`: yum -y install gcc gcc-c++ make libcurl-devel
+- WebUI：http://127.0.0.1:8080/
+- HTTP API 自检：http://127.0.0.1:8080/api/health
+- HTTP API 文档：http://127.0.0.1:8080/api/schema
+- HTTP 默认端口映射为`8080:80`，客户端连接端口为`35601`。`ADMIN_TOKEN` 可选：不设置时Web仅可查看监控数据，但web配置页无法修改。

-cd ServerStatus/server && make
-./sergate
-```
-如果没错误提示，OK，ctrl+c关闭；如果有错误提示，检查35601端口是否被占用    

-#### 二、修改配置文件         
-```diff
-! watchdog rule 可以为任何已知字段的表达式。注意Exprtk库默认使用窄字符类型，中文等Unicode字符无法解析计算，等待修复       
-! watchdog interval 最小通知间隔
-! watchdog callback 可自定义为Post方法的URL，告警内容将拼接其后并发起回调    
+## 二、客户端

-! Telegram: https://api.telegram.org/bot你自己的密钥/sendMessage?parse_mode=HTML&disable_web_page_preview=true&chat_id=你自己的标识&text=
-! Server酱: https://sctapi.ftqq.com/你自己的密钥.send?title=ServerStatus&desp=
-! PushDeer: https://api2.pushdeer.com/message/push?pushkey=你自己的密钥&text=
-! HttpBasicAuth: https://用户名:密码@你自己的域名/api/push?message=
+```bash
+# Docker Compose，本地构建加：--build
+SERVER=127.0.0.1 USER=s01 docker compose -f docker-compose-client.yml up -d --force-recreate
 ```

+```bash
+# Docker Run
+docker run -d --restart=always --name=serverstatus-client \
+  --network=host --pid=host \
+  -e SERVER=127.0.0.1 \
+  -e USER=s01 \
+  cppla/serverstatus:client
 ```
+
+```bash
+# Shell Run
+wget -qO client-linux.py --header='Accept: application/vnd.github.raw' 'https://api.github.com/repos/cppla/ServerStatus/contents/clients/client-linux.py?ref=master' && (nohup python3 client-linux.py SERVER=127.0.0.1 USER=s01  >/dev/null 2>&1 &)
+```
+
+客户端环境变量和注意事项：
+`USER` 是常见的宿主机环境变量名。如果没有显式传递，Compose 可能会把系统里的 `$USER` 解析成本机用户名。推荐优先级：1. 运行命令显式传递 `USER=...`，2. 用户修改 `docker-compose-client.yml` 里的 `USER` 默认值
+
+| 变量 | 默认值 | 说明 |
+| --- | --- | --- |
+| `SERVER` | `127.0.0.1` | 服务端地址 |
+| `USER` | `s01` | 客户端用户名，必须匹配服务端配置 |
+| `PORT` | `35601` | 服务端 sergate 端口 |
+| `PASSWORD` | `USER_DEFAULT_PASSWORD` | 客户端密码，必须匹配服务端配置 |
+| `INTERVAL` | `1` | 上报间隔 |
+| `PROBEPORT` | `80` | 探测端口 |
+| `PROBE_PROTOCOL_PREFER` | `ipv4` | 探测协议偏好 |
+| `PING_PACKET_HISTORY_LEN` | `100` | Ping 历史长度 |
+| `CU` | `cu.tz.cloudcpp.com` | 联通探测地址 |
+| `CT` | `ct.tz.cloudcpp.com` | 电信探测地址 |
+| `CM` | `cm.tz.cloudcpp.com` | 移动探测地址 |
+| `CLIENT` | `psutil` | 客户端实现，可选 `psutil` 或 `linux` |
+
+## HTTP 管理 API
+
+Docker 服务端镜像已内置 HTTP API，并通过 nginx 暴露在 Web 端口下。源码手动运行时需要单独启动 `server/manage_api.py`；如果要让 WebUI 的「配置」页可用，还需要把 `/api/` 反代到 `manage_api.py`。认证方式：
+
+```bash
+Authorization: Bearer your-strong-token
+```
+
+无需认证的接口：
+
+```bash
+curl http://127.0.0.1:8080/api/health
+curl http://127.0.0.1:8080/api/schema
+```
+
+读取完整配置：
+
+```bash
+curl -H 'Authorization: Bearer your-strong-token' \
+  http://127.0.0.1:8080/api/config
+```
+
+节点 CRUD：
+
+```bash
+curl -X POST http://127.0.0.1:8080/api/servers \
+  -H 'Authorization: Bearer your-strong-token' \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"s05","name":"node5","type":"kvm","host":"host5","location":"SG","password":"USER_DEFAULT_PASSWORD","monthstart":1}'
+
+curl -X PUT http://127.0.0.1:8080/api/servers/s05 \
+  -H 'Authorization: Bearer your-strong-token' \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"s05","name":"node5-new","type":"kvm","host":"host5","location":"SG","password":"USER_DEFAULT_PASSWORD","monthstart":1}'
+
+curl -X DELETE -H 'Authorization: Bearer your-strong-token' \
+  http://127.0.0.1:8080/api/servers/s05
+```
+
+`monitors`、`sslcerts`、`watchdog` 也支持细粒度 CRUD。更新和删除可以用数字 `index`；如果 `name` 唯一，也可以用 URL 编码后的 `name`。
+
+```bash
+curl -X POST http://127.0.0.1:8080/api/monitors \
+  -H 'Authorization: Bearer your-strong-token' \
+  -H 'Content-Type: application/json' \
+  -d '{"name":"demo","host":"https://example.com","type":"https","interval":600}'
+
+curl -X PUT http://127.0.0.1:8080/api/sslcerts/0 \
+  -H 'Authorization: Bearer your-strong-token' \
+  -H 'Content-Type: application/json' \
+  -d '{"name":"example","domain":"https://example.com","port":443,"interval":7200,"callback":"https://yourSMSurl"}'
+
+curl -X DELETE -H 'Authorization: Bearer your-strong-token' \
+  http://127.0.0.1:8080/api/watchdog/0
+```
+
+重载配置或重启 `sergate`：
+
+```bash
+curl -X POST -H 'Authorization: Bearer your-strong-token' \
+  http://127.0.0.1:8080/api/reload
+
+curl -X POST -H 'Authorization: Bearer your-strong-token' \
+  http://127.0.0.1:8080/api/restart
+```
+
+完整端点以 `/api/schema` 输出为准。
+
+## 配置文件
+
+配置文件默认路径：
+
+- Docker 服务端：`/ServerStatus/server/config.json`
+- 源码运行：`server/config.json`，或通过 `--config` 指定
+
+基础示例：
+
+```json
 {
-	"servers":
-	[
-		{
-			"username": "s01",
-			"name": "vps-1",
-			"type": "kvm",
-			"host": "chengdu",
-			"location": "🇨🇳",
-			"password": "USER_DEFAULT_PASSWORD",
-			"monthstart": 1
-		}
-	],
-	"monitors": [
-		{
-			"name": "抖音",
-			"host": "https://www.douyin.com",
-			"interval": 600,
-			"type": "https"
-		},
-		{
-			"name": "百度",
-			"host": "https://www.baidu.com",
-			"interval": 600,
-			"type": "https"
-		}
-	],
-	"sslcerts": [
-		{
-			"name": "demo域名",
-			"domain": "https://demo.example.com",
-			"port": 443,
-			"interval": 600,
-			"callback": "https://yourSMSurl"
-		}
-	],
-	"watchdog":
-	[
-	    {
-			"name": "服务器负载高监控，排除内存大于32G物理机，同时排除node1机器",
-			"rule": "cpu>90&load_1>4&memory_total<33554432&name!='node1'",
-			"interval": 600,
-			"callback": "https://yourSMSurl"
-		},
-		{
-            "name": "服务器内存使用率过高监控，排除小于1G的机器",
-            "rule": "(memory_used/memory_total)*100>90&memory_total>1048576",
-            "interval": 600,
-            "callback": "https://yourSMSurl"
-        },
-        {
-            "name": "服务器宕机告警",
-            "rule": "online4=0&online6=0",
-            "interval": 600,
-            "callback": "https://yourSMSurl"
-        },
-		{
-            "name": "DDOS和CC攻击监控，限制甲骨文机器",
-            "rule": "tcp_count>600&type='Oracle'",
-            "interval": 300,
-            "callback": "https://yourSMSurl"
-        },
-		{
-			"name": "服务器月出口流量999GB告警",
-			"rule": "(network_out-last_network_out)/1024/1024/1024>999",
-			"interval": 3600,
-			"callback": "https://yourSMSurl"
-		},
-		{
-			"name": "阿里云服务器流量18GB告警,限制username为乌兰察布",
-			"rule": "(network_out-last_network_out)/1024/1024/1024>18&(username='wlcb1'|username='wlcb2'|username='wlcb3'|username='wlcb4')",
-			"interval": 3600,
-			"callback": "https://yourSMSurl"
-		},
-		{
-			"name": "重要线路丢包率过高检查",
-			"rule": "(ping_10010>10|ping_189>10|ping_10086>10)&(host='sgp'|host='qqhk'|host='hk-21-x'|host='hk-31-x')",
-			"interval": 600,
-			"callback": "https://yourSMSurl"
-		},
-		{
-			"name": "你可以组合任何已知字段的表达式",
-			"rule": "(hdd_used/hdd_total)*100>95",
-			"interval": 1800,
-			"callback": "https://yourSMSurl"
-		}
-	]
-}          
+  "servers": [
+    {
+      "username": "s01",
+      "name": "node1",
+      "type": "kvm",
+      "host": "host1",
+      "location": "CN",
+      "password": "USER_DEFAULT_PASSWORD",
+      "monthstart": 1
+    }
+  ],
+  "monitors": [
+    {
+      "name": "example",
+      "host": "https://example.com",
+      "interval": 600,
+      "type": "https"
+    }
+  ],
+  "sslcerts": [
+    {
+      "name": "example",
+      "domain": "https://example.com",
+      "port": 443,
+      "interval": 7200,
+      "callback": "https://yourSMSurl"
+    }
+  ],
+  "watchdog": [
+    {
+      "name": "offline warning",
+      "rule": "online4=0&online6=0",
+      "interval": 600,
+      "callback": "https://yourSMSurl"
+    },
+    {
+      "name": "cpu high warning",
+      "rule": "cpu>90&load_1>5&username!='s01'",
+      "interval": 600,
+      "callback": "https://yourSMSurl"
+    }
+  ]
+}
 ```

-#### 三、拷贝ServerStatus/status到你的网站目录        
-例如：
-```
-sudo cp -r ServerStatus/web/* /home/wwwroot/default
+常见 Watchdog 回调：
+
+```text
+Telegram: https://api.telegram.org/bot你的密钥/sendMessage?parse_mode=HTML&disable_web_page_preview=true&chat_id=你的标识&text=
+Server酱: https://sctapi.ftqq.com/你的密钥.send?title=ServerStatus&desp=
+PushDeer: https://api2.pushdeer.com/message/push?pushkey=你的密钥&text=
+HttpBasicAuth: https://用户名:密码@你的域名/api/push?message=
 ```

-#### 四、运行服务端：             
-web-dir参数为上一步设置的网站根目录，务必修改成自己网站的路径   
-```
-./sergate --config=config.json --web-dir=/home/wwwroot/default   
-```
+## 源码编译和运行
+
+服务端依赖：

-**【客户端配置】**    
-    
-#### client-linux.py Linux版
 ```bash
-# 1、修改 client-linux.py 中的 SERVER、username、password
-python3 client-linux.py
-# 2、以传参的方式启动
-python3 client-linux.py SERVER=127.0.0.1 USER=s01
+# Debian/Ubuntu
+apt-get -y install gcc g++ make libcurl4-openssl-dev python3 nginx openssl

+# CentOS/RedHat
+yum -y install gcc gcc-c++ make libcurl-devel python3 nginx openssl
 ```

-#### client-psutil.py 跨平台版
+编译并运行 `sergate`：
+
+```bash
+cd ServerStatus/server
+make
+mkdir -p ../web/json
+./sergate --config=config.json --web-dir=../web &
+echo $! > /tmp/serverstatus-sergate.pid
+```
+
+如果只需要 HTTP API，可以再启动 `manage_api.py`：
+
+```bash
+cd ServerStatus/server
+ADMIN_TOKEN='your-strong-token' \
+CONFIG_PATH="$PWD/config.json" \
+SERGATE_PID_FILE=/tmp/serverstatus-sergate.pid \
+ADMIN_API_BIND=127.0.0.1 \
+ADMIN_API_PORT=35602 \
+python3 manage_api.py
+```
+
+源码方式直连 API：
+
+```bash
+curl http://127.0.0.1:35602/api/health
+curl -H 'Authorization: Bearer your-strong-token' \
+  http://127.0.0.1:35602/api/config
+```
+
+如果要通过 WebUI 使用「配置」页，需要 nginx 同时提供静态文件并反代 `/api/`。示例配置：
+
+```nginx
+server {
+    listen 8080;
+    server_name _;
+
+    root /path/to/ServerStatus/web;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location /json/ {
+        add_header Cache-Control "no-store";
+        try_files $uri =404;
+    }
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:35602;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 30s;
+    }
+}
+```
+
+启动失败时优先检查端口占用：`35601` 是 `sergate` 客户端上报端口，`35602` 是源码方式的管理 API 端口，`8080` 是上面示例的 Web 端口。源码手动运行没有 Docker 入口脚本守护；调用 `/api/restart` 会向 `sergate` 发送 `SIGTERM`，需要你用 systemd、supervisor 或 shell 循环自行拉起。
+
+## 客户端源码运行
+
+`client-linux.py`：
+
+```bash
+wget -qO client-linux.py \
+  --header='Accept: application/vnd.github.raw' \
+  'https://api.github.com/repos/cppla/ServerStatus/contents/clients/client-linux.py?ref=master'
+
+nohup python3 client-linux.py SERVER=127.0.0.1 USER=s01 PASSWORD=USER_DEFAULT_PASSWORD \
+  >/dev/null 2>&1 &
+```
+
+`client-psutil.py`：
+
 ```bash
-# 安装依赖
 # Debian/Ubuntu
 apt -y install python3-psutil
-# Centos/Redhat
-yum -y install python3-pip gcc python3-devel && pip3 install psutil
-# Windows: 从 https://pypi.org/project/psutil/ 安装
+
+# CentOS/RedHat
+yum -y install python3-pip gcc python3-devel
+pip3 install psutil
+
+python3 clients/client-psutil.py SERVER=127.0.0.1 USER=s01
 ```

-#### 后台运行与开机启动
+后台运行与开机启动：
+
 ```bash
-# 后台运行
-nohup python3 client-linux.py &
+nohup python3 client-linux.py SERVER=127.0.0.1 USER=s01 &

-# 开机启动 (crontab -e)
-@reboot /usr/bin/python3 /path/to/client-linux.py
+# crontab -e
+@reboot /usr/bin/python3 /path/to/client-linux.py SERVER=127.0.0.1 USER=s01
 ```

-# Make Better        
+## 本地构建镜像
+
+```bash
+docker build -f Dockerfile.server -t cppla/serverstatus:server .
+docker build -f Dockerfile.client -t cppla/serverstatus:client .
+```
+
+## Make Better

 * BotoX：https://github.com/BotoX/ServerStatus
-* mojeda: https://github.com/mojeda 
-* mojeda's ServerStatus: https://github.com/mojeda/ServerStatus
-* BlueVM's project: http://www.lowendtalk.com/discussion/comment/169690#Comment_169690
+* mojeda：https://github.com/mojeda
+* mojeda's ServerStatus：https://github.com/mojeda/ServerStatus
+* BlueVM's project：http://www.lowendtalk.com/discussion/comment/169690#Comment_169690
@@ -5,8 +5,8 @@
 # 支持操作系统： Linux, OSX, FreeBSD, OpenBSD and NetBSD, both 32-bit and 64-bit architectures
 # 说明: 默认情况下修改server和user就可以了。丢包率监测方向可以自定义，例如：CU = "www.facebook.com"。

-SERVER = "127.0.0.1"
-USER = "s01"
+SERVER = ""
+USER = ""


 PASSWORD = "USER_DEFAULT_PASSWORD"
@@ -32,6 +32,34 @@ import threading
 import platform
 from queue import Queue

+def _env_str(name, default):
+    value = os.getenv(name)
+    if value is None or value == "":
+        return default
+    return value
+
+def _env_int(name, default):
+    value = os.getenv(name)
+    if value is None or value == "":
+        return default
+    try:
+        return int(value)
+    except ValueError:
+        return default
+
+# Allow docker env overrides. 优先级：运行程序传递参数 > 用户修改的USER > Docker/系统
+SERVER = _env_str("SERVER", SERVER) if SERVER == "" else SERVER
+USER = _env_str("USER", USER) if USER == "" else USER
+PASSWORD = _env_str("PASSWORD", PASSWORD)
+PORT = _env_int("PORT", PORT)
+INTERVAL = _env_int("INTERVAL", INTERVAL)
+PROBEPORT = _env_int("PROBEPORT", PROBEPORT)
+PROBE_PROTOCOL_PREFER = _env_str("PROBE_PROTOCOL_PREFER", PROBE_PROTOCOL_PREFER)
+PING_PACKET_HISTORY_LEN = _env_int("PING_PACKET_HISTORY_LEN", PING_PACKET_HISTORY_LEN)
+CU = _env_str("CU", CU)
+CT = _env_str("CT", CT)
+CM = _env_str("CM", CM)
+
 def get_uptime():
    with open('/proc/uptime', 'r') as f:
        uptime = f.readline().split('.', 2)
@@ -53,11 +81,34 @@ def get_memory():
    return int(MemTotal), int(MemUsed), int(SwapTotal), int(SwapFree)

 def get_hdd():
-    p = subprocess.check_output(['df', '-Tlm', '--total', '-t', 'ext4', '-t', 'ext3', '-t', 'ext2', '-t', 'reiserfs', '-t', 'jfs', '-t', 'ntfs', '-t', 'fat32', '-t', 'btrfs', '-t', 'fuseblk', '-t', 'zfs', '-t', 'simfs', '-t', 'xfs']).decode("Utf-8")
-    total = p.splitlines()[-1]
-    used = total.split()[3]
-    size = total.split()[2]
-    return int(size), int(used)
+    valid_fs = {
+        "ext4", "ext3", "ext2", "reiserfs", "jfs", "btrfs", "fuseblk",
+        "zfs", "simfs", "ntfs", "fat32", "exfat", "xfs"
+    }
+    disks = {}
+    size = 0
+    used = 0
+    try:
+        with open("/proc/mounts", "r") as f:
+            for line in f:
+                parts = line.split()
+                if len(parts) < 3:
+                    continue
+                device = parts[0]
+                mountpoint = parts[1]
+                fstype = parts[2].lower()
+                if fstype not in valid_fs or device in disks:
+                    continue
+                disks[device] = mountpoint
+        for mountpoint in disks.values():
+            st = os.statvfs(mountpoint)
+            total_bytes = st.f_blocks * st.f_frsize
+            used_bytes = (st.f_blocks - st.f_bavail) * st.f_frsize
+            size += total_bytes
+            used += used_bytes
+    except Exception:
+        pass
+    return int(size / 1024 / 1024), int(used / 1024 / 1024)

 def get_time():
    with open("/proc/stat", "r") as f:
@@ -82,6 +133,73 @@ def get_cpu():
    result = 100-(t[len(t)-1]*100.00/st)
    return round(result, 1)

+def get_cpu_cores():
+    try:
+        with open('/proc/stat') as f:
+            cores = sum(1 for line in f if re.match(r'^cpu\d+\s', line))
+        if cores > 0:
+            return cores
+    except Exception:
+        pass
+    return os.cpu_count() or 0
+
+def normalize_cpu_model(value):
+    return re.sub(r'\s+', ' ', str(value or '')).strip()[:160]
+
+def is_generic_cpu_model(value):
+    v = normalize_cpu_model(value).lower().replace('-', '').replace('_', '').replace(' ', '')
+    return v in ('', 'unknown', 'x8664', 'amd64', 'i386', 'i686', 'aarch64', 'arm64') or v.startswith('armv')
+
+def get_lscpu_info():
+    result = {}
+    try:
+        output = subprocess.check_output(['lscpu'], stderr=subprocess.DEVNULL, timeout=2).decode(errors='ignore')
+        for line in output.splitlines():
+            if ':' not in line:
+                continue
+            key, value = line.split(':', 1)
+            key = key.strip().lower()
+            value = normalize_cpu_model(value)
+            if value and key not in result:
+                result[key] = value
+    except Exception:
+        pass
+    return result
+
+def get_cpuinfo_values():
+    result = {}
+    try:
+        with open('/proc/cpuinfo') as f:
+            for line in f:
+                if ':' not in line:
+                    continue
+                key, value = line.split(':', 1)
+                key = key.strip().lower()
+                value = normalize_cpu_model(value)
+                if value and key not in result:
+                    result[key] = value
+    except Exception:
+        pass
+    return result
+
+def get_cpu_model():
+    cpuinfo = get_cpuinfo_values()
+    lscpu = get_lscpu_info()
+    for value in (
+        cpuinfo.get('model name'),
+        lscpu.get('model name'),
+        cpuinfo.get('hardware'),
+        cpuinfo.get('processor'),
+        platform.processor(),
+    ):
+        value = normalize_cpu_model(value)
+        if value and not value.isdigit() and not is_generic_cpu_model(value):
+            return value
+    vendor = normalize_cpu_model(lscpu.get('vendor id') or cpuinfo.get('vendor_id'))
+    if vendor:
+        return vendor
+    return normalize_cpu_model(lscpu.get('architecture') or platform.machine() or platform.processor())
+
 def liuliang():
    NET_IN = 0
    NET_OUT = 0
@@ -454,6 +572,8 @@ if __name__ == '__main__':
                print(data)
                raise socket.error

+            CPUCores = get_cpu_cores()
+            CPUModel = get_cpu_model()
            while True:
                CPU = get_cpu()
                NET_IN, NET_OUT = liuliang()
@@ -479,6 +599,8 @@ if __name__ == '__main__':
                array['hdd_total'] = HDDTotal
                array['hdd_used'] = HDDUsed
                array['cpu'] = CPU
+                array['cpu_cores'] = CPUCores
+                array['cpu_model'] = CPUModel
                array['network_rx'] = netSpeed.get("netrx")
                array['network_tx'] = netSpeed.get("nettx")
                array['network_in'] = NET_IN
@@ -6,8 +6,8 @@
 # 支持操作系统： Linux, Windows, OSX, Sun Solaris, FreeBSD, OpenBSD and NetBSD, both 32-bit and 64-bit architectures
 # 说明: 默认情况下修改server和user就可以了。丢包率监测方向可以自定义，例如：CU = "www.facebook.com"。

-SERVER = "127.0.0.1"
-USER = "s01"
+SERVER = ""
+USER = ""


 PASSWORD = "USER_DEFAULT_PASSWORD"
@@ -32,6 +32,34 @@ import threading
 import platform
 from queue import Queue

+def _env_str(name, default):
+    value = os.getenv(name)
+    if value is None or value == "":
+        return default
+    return value
+
+def _env_int(name, default):
+    value = os.getenv(name)
+    if value is None or value == "":
+        return default
+    try:
+        return int(value)
+    except ValueError:
+        return default
+
+# Allow docker env overrides. 优先级：运行程序传递参数 > 用户修改的USER > Docker/系统
+SERVER = _env_str("SERVER", SERVER) if SERVER == "" else SERVER
+USER = _env_str("USER", USER) if USER == "" else USER
+PASSWORD = _env_str("PASSWORD", PASSWORD)
+PORT = _env_int("PORT", PORT)
+INTERVAL = _env_int("INTERVAL", INTERVAL)
+PROBEPORT = _env_int("PROBEPORT", PROBEPORT)
+PROBE_PROTOCOL_PREFER = _env_str("PROBE_PROTOCOL_PREFER", PROBE_PROTOCOL_PREFER)
+PING_PACKET_HISTORY_LEN = _env_int("PING_PACKET_HISTORY_LEN", PING_PACKET_HISTORY_LEN)
+CU = _env_str("CU", CU)
+CT = _env_str("CT", CT)
+CM = _env_str("CM", CM)
+
 def get_uptime():
    return int(time.time() - psutil.boot_time())

@@ -64,6 +92,52 @@ def get_hdd():
 def get_cpu():
    return psutil.cpu_percent(interval=INTERVAL)

+def get_cpu_cores():
+    return psutil.cpu_count(logical=True) or 0
+
+def normalize_cpu_model(value):
+    return " ".join(str(value or "").split())[:160]
+
+def is_generic_cpu_model(value):
+    v = normalize_cpu_model(value).lower().replace('-', '').replace('_', '').replace(' ', '')
+    return v in ('', 'unknown', 'x8664', 'amd64', 'i386', 'i686', 'aarch64', 'arm64') or v.startswith('armv')
+
+def get_platform_cpu_vendor():
+    values = [
+        platform.processor(),
+        getattr(platform.uname(), 'processor', ''),
+        platform.machine(),
+        getattr(platform.uname(), 'machine', ''),
+        platform.platform(),
+    ]
+    text = " ".join(normalize_cpu_model(v).lower() for v in values)
+    if 'genuineintel' in text:
+        return 'GenuineIntel'
+    if 'authenticamd' in text:
+        return 'AuthenticAMD'
+    if 'intel' in text:
+        return 'Intel'
+    if 'amd' in text:
+        return 'AMD'
+    if sys.platform.startswith('darwin') and platform.machine().lower() in ('arm64', 'aarch64'):
+        return 'Apple'
+    if any(token in text for token in ('aarch64', 'arm64', 'armv7', 'armv8', ' arm ')):
+        return 'ARM'
+    return ''
+
+def get_platform_cpu_arch():
+    return normalize_cpu_model(platform.machine() or platform.processor() or platform.architecture()[0])
+
+def get_cpu_model():
+    for value in (platform.processor(), getattr(platform.uname(), 'processor', '')):
+        value = normalize_cpu_model(value)
+        if value and not is_generic_cpu_model(value):
+            return value
+    vendor = normalize_cpu_model(get_platform_cpu_vendor())
+    if vendor:
+        return vendor
+    return get_platform_cpu_arch()
+
 def liuliang():
    NET_IN = 0
    NET_OUT = 0
@@ -444,6 +518,8 @@ if __name__ == '__main__':
                print(data)
                raise socket.error

+            CPUCores = get_cpu_cores()
+            CPUModel = get_cpu_model()
            while 1:
                CPU = get_cpu()
                NET_IN, NET_OUT = liuliang()
@@ -470,6 +546,8 @@ if __name__ == '__main__':
                array['hdd_total'] = HDDTotal
                array['hdd_used'] = HDDUsed
                array['cpu'] = CPU
+                array['cpu_cores'] = CPUCores
+                array['cpu_model'] = CPUModel
                array['network_rx'] = netSpeed.get("netrx")
                array['network_tx'] = netSpeed.get("nettx")
                array['network_in'] = NET_IN
@@ -493,13 +571,16 @@ if __name__ == '__main__':
                    elif 'bsd' in sysname:
                        os_name = 'bsd'
                    elif sysname.startswith('linux'):
-                        # try distro if available
-                        os_name = 'linux'
+                        # try distro from os-release
                        try:
-                            import distro  # optional
-                            os_name = distro.id() or 'linux'
+                            with open('/etc/os-release') as f:
+                                for line in f:
+                                    if line.startswith('ID='):
+                                        val = line.strip().split('=',1)[1].strip().strip('"')
+                                        if val: os_name = val
+                                        break
                        except Exception:
-                            pass
+                            os_name = 'linux'
                    else:
                        os_name = sysname or 'unknown'
                except Exception:
@@ -0,0 +1,20 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -gt 0 ]; then
+  exec "$@"
+fi
+
+case "${CLIENT:-linux}" in
+  linux|client-linux|client-linux.py)
+    exec python3 /app/client-linux.py
+    ;;
+  psutil|client-psutil|client-psutil.py)
+    exec python3 /app/client-psutil.py
+    ;;
+  *)
+    echo "Unknown CLIENT='$CLIENT'. Use 'linux' or 'psutil'." >&2
+    exit 2
+    ;;
+esac
+
@@ -0,0 +1,27 @@
+services:
+  serverstatus-client:
+    build:
+      context: .
+      dockerfile: Dockerfile.client
+    image: cppla/serverstatus:client
+    container_name: serverstatus-client
+    restart: unless-stopped
+    network_mode: host
+    pid: host
+    environment:
+      SERVER: "${SERVER:-127.0.0.1}"
+      # 注意：USER 会被 docker compose 在宿主机环境中先插值。
+      # 如果运行时没有显式传递，或传递方式不正确，可能会被 Docker/系统环境中的 $USER
+      # 替换成本机用户名，而不是期望的默认 s01。
+      # 推荐优先级：运行程序时显式传递 USER > 用户修改这里的 USER 默认值 > Docker/系统环境。
+      USER: "${USER:-s01}"
+      PORT: "${PORT:-35601}"
+      PASSWORD: "${PASSWORD:-USER_DEFAULT_PASSWORD}"
+      INTERVAL: "${INTERVAL:-1}"
+      PROBEPORT: "${PROBEPORT:-80}"
+      PROBE_PROTOCOL_PREFER: "${PROBE_PROTOCOL_PREFER:-ipv4}"
+      PING_PACKET_HISTORY_LEN: "${PING_PACKET_HISTORY_LEN:-100}"
+      CU: "${CU:-cu.tz.cloudcpp.com}"
+      CT: "${CT:-ct.tz.cloudcpp.com}"
+      CM: "${CM:-cm.tz.cloudcpp.com}"
+      CLIENT: "${CLIENT:-psutil}"
@@ -1,17 +1,18 @@
-version: "3"
 services:
-  serverstatus:
+  serverstatus-server:
    build:
      context: .
-      dockerfile: Dockerfile
-    image: cppla/serverstatus:latest
+      dockerfile: Dockerfile.server
+    image: cppla/serverstatus:server
    healthcheck:
-      test: curl --fail http://localhost:80 || bash -c 'kill -s 15 -1 && (sleep 10; kill -s 9 -1)'
+      test: ["CMD-SHELL", "python3 -c \"import os,urllib.request; pid=int(open('/tmp/serverstatus-sergate.pid').read().strip()); os.kill(pid,0); urllib.request.urlopen('http://127.0.0.1/',timeout=2).read(1)\""]
      interval: 30s
      timeout: 10s
      retries: 5
-    container_name: serverstatus
+    container_name: serverstatus-server
    restart: unless-stopped
+    environment:
+      ADMIN_TOKEN: "${ADMIN_TOKEN:-}"
    networks:
      serverstatus-network:
        ipv4_address: 172.23.0.2
@@ -1,4 +1,5 @@
 OUT = sergate
+.DEFAULT_GOAL := $(OUT)

 #CC = clang
 CC = gcc
@@ -19,10 +20,13 @@ C_OBJS := $(patsubst $(SDIR)/%.c,$(ODIR)/%.o,$(C_SRCS))
 CXX_OBJS := $(patsubst $(SDIR)/%.cpp,$(ODIR)/%.o,$(CXX_SRCS))
 OBJS := $(C_OBJS) $(CXX_OBJS)

-$(ODIR)/%.o: $(SDIR)/%.c
+$(ODIR):
+	mkdir -p $(ODIR)
+
+$(ODIR)/%.o: $(SDIR)/%.c | $(ODIR)
 	$(CC) -c $(INC) $(CFLAGS) $< -o $@

-$(ODIR)/%.o: $(SDIR)/%.cpp
+$(ODIR)/%.o: $(SDIR)/%.cpp | $(ODIR)
 	$(CXX) -c $(INC) $(CXXFLAGS) $< -o $@

 $(OUT): $(OBJS)
@@ -31,4 +35,4 @@ $(OUT): $(OBJS)
 .PHONY: clean

 clean:
-	rm -f $(ODIR)/*.o $(OUT)
+	rm -f $(ODIR)/*.o $(OUT)
@@ -19,14 +19,14 @@
 			"monthstart": 1
 		},
 		{
-			"disabled": true,
 			"username": "s03",
 			"name": "node3",
 			"type": "hyper",
 			"host": "host3",
 			"location": "🇫🇷",
 			"password": "USER_DEFAULT_PASSWORD",
-			"monthstart": 1
+			"monthstart": 1,
+			"disabled": false
 		},
 		{
 			"username": "s04",
@@ -58,14 +58,14 @@
 			"domain": "https://my.cloudcpp.com",
 			"port": 443,
 			"interval": 7200,
-			"callback": "https://yourSMSurl" 
+			"callback": "https://yourSMSurl"
 		},
 		{
 			"name": "tz.cloudcpp.com",
 			"domain": "https://tz.cloudcpp.com",
 			"port": 443,
 			"interval": 7200,
-			"callback": "https://yourSMSurl" 
+			"callback": "https://yourSMSurl"
 		},
 		{
 			"name": "3.0.2.1",
@@ -0,0 +1,59 @@
+#!/bin/sh
+set -eu
+
+: "${CONFIG_PATH:=/ServerStatus/server/config.json}"
+: "${WEB_DIR:=/usr/share/nginx/html}"
+: "${SERGATE_PID_FILE:=/tmp/serverstatus-sergate.pid}"
+: "${ADMIN_API_BIND:=127.0.0.1}"
+: "${ADMIN_API_PORT:=35602}"
+
+STOPPING=0
+SERGATE_PID=""
+API_PID=""
+
+stop_all() {
+  STOPPING=1
+  if [ -n "$SERGATE_PID" ] && kill -0 "$SERGATE_PID" 2>/dev/null; then
+    kill -TERM "$SERGATE_PID" 2>/dev/null || true
+  fi
+  if [ -n "$API_PID" ] && kill -0 "$API_PID" 2>/dev/null; then
+    kill -TERM "$API_PID" 2>/dev/null || true
+  fi
+  nginx -s quit 2>/dev/null || true
+}
+
+trap 'stop_all; exit 0' INT TERM QUIT
+
+mkdir -p "$WEB_DIR/json"
+nginx
+
+CONFIG_PATH="$CONFIG_PATH" \
+STATS_PATH="${STATS_PATH:-$WEB_DIR/json/stats.json}" \
+SERGATE_PID_FILE="$SERGATE_PID_FILE" \
+ADMIN_API_BIND="$ADMIN_API_BIND" \
+ADMIN_API_PORT="$ADMIN_API_PORT" \
+ADMIN_TOKEN="${ADMIN_TOKEN:-}" \
+ADMIN_CORS_ORIGIN="${ADMIN_CORS_ORIGIN:-}" \
+  python3 /ServerStatus/server/manage_api.py &
+API_PID="$!"
+if [ -n "${ADMIN_TOKEN:-}" ]; then
+  echo "management API enabled on ${ADMIN_API_BIND}:${ADMIN_API_PORT}"
+else
+  echo "management API running in read-only discovery mode; set ADMIN_TOKEN to enable writes"
+fi
+
+while [ "$STOPPING" -eq 0 ]; do
+  /ServerStatus/server/sergate --config="$CONFIG_PATH" --web-dir="$WEB_DIR" &
+  SERGATE_PID="$!"
+  echo "$SERGATE_PID" > "$SERGATE_PID_FILE"
+  set +e
+  wait "$SERGATE_PID"
+  STATUS="$?"
+  set -e
+  rm -f "$SERGATE_PID_FILE"
+  if [ "$STOPPING" -eq 1 ]; then
+    exit "$STATUS"
+  fi
+  echo "sergate exited with status ${STATUS}; restarting in 1s"
+  sleep 1
+done
@@ -0,0 +1,621 @@
+#!/usr/bin/env python3
+import json
+import os
+import shutil
+import signal
+import tempfile
+import time
+import errno
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import unquote, urlparse
+
+
+CONFIG_PATH = os.environ.get("CONFIG_PATH", "/ServerStatus/server/config.json")
+STATS_PATH = os.environ.get("STATS_PATH", "/usr/share/nginx/html/json/stats.json")
+SERGATE_PID_FILE = os.environ.get("SERGATE_PID_FILE", "/tmp/serverstatus-sergate.pid")
+ADMIN_TOKEN = os.environ.get("ADMIN_TOKEN", "")
+API_BIND = os.environ.get("ADMIN_API_BIND", "127.0.0.1")
+API_PORT = int(os.environ.get("ADMIN_API_PORT", "35602"))
+CORS_ORIGIN = os.environ.get("ADMIN_CORS_ORIGIN", "")
+
+
+class ApiError(Exception):
+    def __init__(self, status, message, details=None):
+        super().__init__(message)
+        self.status = status
+        self.message = message
+        self.details = details
+
+
+def load_config():
+    with open(CONFIG_PATH, "r", encoding="utf-8") as f:
+        return json.load(f)
+
+
+def load_json_file(path):
+    with open(path, "r", encoding="utf-8") as f:
+        return json.load(f)
+
+
+def load_stats_file():
+    try:
+        return load_json_file(STATS_PATH)
+    except FileNotFoundError:
+        return load_json_file(f"{STATS_PATH}~")
+
+
+def write_json_file(path, data):
+    directory = os.path.dirname(path) or "."
+    os.makedirs(directory, exist_ok=True)
+    mode = os.stat(path).st_mode if os.path.exists(path) else 0o644
+    payload = json.dumps(data, ensure_ascii=False, indent="\t") + "\n"
+    fd, tmp_path = tempfile.mkstemp(prefix=".json.", suffix=".tmp", dir=directory)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write(payload)
+            f.flush()
+            os.fsync(f.fileno())
+        os.chmod(tmp_path, mode)
+        os.replace(tmp_path, path)
+    finally:
+        if os.path.exists(tmp_path):
+            os.unlink(tmp_path)
+
+
+def normalize_required_strings(item, required, kind, index=None):
+    missing = [field for field in required if item.get(field) is None or not str(item.get(field, "")).strip()]
+    if missing:
+        raise ApiError(400, f"{kind} has missing required fields", {"missing": missing, "index": index})
+    normalized = dict(item)
+    for field in required:
+        normalized[field] = str(normalized[field]).strip()
+    return normalized
+
+
+def normalize_optional_string(item, field):
+    value = item.get(field, "")
+    item[field] = "" if value is None else str(value).strip()
+
+
+def normalize_int(value, field, index=None, default=None, min_value=None, max_value=None):
+    if value in (None, ""):
+        value = default
+    try:
+        value = int(value)
+    except (TypeError, ValueError):
+        raise ApiError(400, f"{field} must be an integer", {"index": index})
+    if min_value is not None:
+        value = max(min_value, value)
+    if max_value is not None:
+        value = min(max_value, value)
+    return value
+
+
+def validate_server(server, index=None):
+    if not isinstance(server, dict):
+        raise ApiError(400, "server must be an object", {"index": index})
+    required = ["username", "name", "type", "host", "location", "password"]
+    normalized = normalize_required_strings(server, required, "server", index=index)
+    normalized["monthstart"] = normalize_int(normalized.get("monthstart"), "monthstart", index=index, default=1, min_value=1, max_value=28)
+    if "disabled" in normalized:
+        normalized["disabled"] = bool(normalized["disabled"])
+    return normalized
+
+
+def validate_monitor(monitor, index=None):
+    if not isinstance(monitor, dict):
+        raise ApiError(400, "monitor must be an object", {"index": index})
+    normalized = normalize_required_strings(monitor, ["name", "host", "type"], "monitor", index=index)
+    normalized["interval"] = normalize_int(normalized.get("interval"), "interval", index=index, default=600, min_value=1)
+    return normalized
+
+
+def validate_sslcert(sslcert, index=None):
+    if not isinstance(sslcert, dict):
+        raise ApiError(400, "sslcert must be an object", {"index": index})
+    normalized = normalize_required_strings(sslcert, ["name", "domain"], "sslcert", index=index)
+    normalized["port"] = normalize_int(normalized.get("port"), "port", index=index, default=443, min_value=1, max_value=65535)
+    normalized["interval"] = normalize_int(normalized.get("interval"), "interval", index=index, default=7200, min_value=1)
+    normalize_optional_string(normalized, "callback")
+    return normalized
+
+
+def validate_watchdog(watchdog, index=None):
+    if not isinstance(watchdog, dict):
+        raise ApiError(400, "watchdog must be an object", {"index": index})
+    normalized = normalize_required_strings(watchdog, ["name", "rule"], "watchdog", index=index)
+    normalized["interval"] = normalize_int(normalized.get("interval"), "interval", index=index, default=600, min_value=1)
+    normalize_optional_string(normalized, "callback")
+    return normalized
+
+
+COLLECTIONS = {
+    "servers": {
+        "item": "server",
+        "id_field": "username",
+        "validator": validate_server,
+        "required": ["username", "name", "type", "host", "location", "password"],
+        "optional": ["monthstart", "disabled"],
+    },
+    "monitors": {
+        "item": "monitor",
+        "id_field": "name",
+        "validator": validate_monitor,
+        "required": ["name", "host", "type"],
+        "optional": ["interval"],
+    },
+    "sslcerts": {
+        "item": "sslcert",
+        "id_field": "name",
+        "validator": validate_sslcert,
+        "required": ["name", "domain"],
+        "optional": ["port", "interval", "callback"],
+    },
+    "watchdog": {
+        "item": "watchdog",
+        "id_field": "name",
+        "validator": validate_watchdog,
+        "required": ["name", "rule"],
+        "optional": ["interval", "callback"],
+    },
+}
+
+
+def validate_config(config):
+    if not isinstance(config, dict):
+        raise ApiError(400, "config must be a JSON object")
+    config = dict(config)
+    for key, meta in COLLECTIONS.items():
+        items = config.get(key, [])
+        if not isinstance(items, list):
+            raise ApiError(400, f"{key} must be an array")
+        normalized = []
+        seen = set()
+        for index, item in enumerate(items):
+            entry = meta["validator"](item, index=index)
+            if key == "servers":
+                username = entry["username"]
+                if username in seen:
+                    raise ApiError(409, "duplicate server username", {"username": username})
+                seen.add(username)
+            normalized.append(entry)
+        config[key] = normalized
+    return config
+
+
+def write_config(config):
+    config = validate_config(config)
+    directory = os.path.dirname(CONFIG_PATH) or "."
+    os.makedirs(directory, exist_ok=True)
+    timestamp = time.strftime("%Y%m%d-%H%M%S")
+    if os.path.exists(CONFIG_PATH):
+        shutil.copy2(CONFIG_PATH, f"{CONFIG_PATH}.bak-{timestamp}")
+        mode = os.stat(CONFIG_PATH).st_mode
+    else:
+        mode = 0o644
+    data = json.dumps(config, ensure_ascii=False, indent="\t") + "\n"
+    fd, tmp_path = tempfile.mkstemp(prefix=".config.", suffix=".tmp", dir=directory)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write(data)
+            f.flush()
+            os.fsync(f.fileno())
+        os.chmod(tmp_path, mode)
+        try:
+            os.replace(tmp_path, CONFIG_PATH)
+        except OSError as exc:
+            if exc.errno != errno.EBUSY:
+                raise
+            # A single-file Docker bind mount cannot be atomically replaced.
+            # Keep the backup above, then rewrite the mounted file in place.
+            with open(CONFIG_PATH, "w", encoding="utf-8") as f:
+                f.write(data)
+                f.flush()
+                os.fsync(f.fileno())
+    finally:
+        if os.path.exists(tmp_path):
+            os.unlink(tmp_path)
+    return config
+
+
+def write_and_reload(config):
+    config = write_config(config)
+    pid = signal_sergate(signal.SIGHUP)
+    return config, pid
+
+
+def read_body(handler):
+    length = int(handler.headers.get("Content-Length", "0") or "0")
+    if length <= 0:
+        return None
+    if length > 1024 * 1024:
+        raise ApiError(413, "request body is too large")
+    raw = handler.rfile.read(length).decode("utf-8")
+    try:
+        return json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise ApiError(400, "invalid JSON body", {"error": str(exc)})
+
+
+def get_sergate_pid():
+    try:
+        with open(SERGATE_PID_FILE, "r", encoding="utf-8") as f:
+            pid = int(f.read().strip())
+        os.kill(pid, 0)
+        return pid
+    except Exception:
+        pass
+    proc_dir = "/proc"
+    if not os.path.isdir(proc_dir):
+        return None
+    for name in os.listdir(proc_dir):
+        if not name.isdigit():
+            continue
+        try:
+            with open(os.path.join(proc_dir, name, "cmdline"), "rb") as f:
+                cmdline = f.read().replace(b"\x00", b" ").decode("utf-8", "ignore")
+        except Exception:
+            continue
+        if "sergate" in cmdline:
+            return int(name)
+    return None
+
+
+def signal_sergate(sig):
+    pid = get_sergate_pid()
+    if not pid:
+        raise ApiError(503, "sergate process was not found")
+    os.kill(pid, sig)
+    return pid
+
+
+def wait_for_pid_exit(pid, timeout=2.5):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            os.kill(pid, 0)
+        except OSError:
+            return True
+        time.sleep(0.05)
+    return False
+
+
+def wait_for_sergate_pid(previous_pid=None, timeout=4.0):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        pid = get_sergate_pid()
+        if pid and pid != previous_pid:
+            return pid
+        time.sleep(0.1)
+    return get_sergate_pid()
+
+
+def find_server(config, username):
+    servers = config.get("servers", [])
+    for index, server in enumerate(servers):
+        if server.get("username") == username:
+            return index, server
+    return -1, None
+
+
+def find_collection_item(config, key, item_id):
+    items = config.get(key, [])
+    if item_id.isdigit():
+        index = int(item_id)
+        if 0 <= index < len(items):
+            return index, items[index]
+        return -1, None
+    id_field = COLLECTIONS[key]["id_field"]
+    matches = [(index, item) for index, item in enumerate(items) if str(item.get(id_field, "")) == item_id]
+    if len(matches) > 1:
+        raise ApiError(409, f"{key} has duplicate {id_field}; use numeric index instead", {"id": item_id})
+    if matches:
+        return matches[0]
+    return -1, None
+
+
+def stats_server_matches(config_server, stats_server):
+    return all(str(stats_server.get(field, "")) == str(config_server.get(field, "")) for field in ["name", "type", "host", "location"])
+
+
+def find_stats_server(stats, config_server):
+    servers = stats.get("servers", [])
+    if not isinstance(servers, list):
+        raise ApiError(500, "stats.json has invalid servers data")
+    for index, stats_server in enumerate(servers):
+        if isinstance(stats_server, dict) and stats_server_matches(config_server, stats_server):
+            return index, stats_server
+    return -1, None
+
+
+def as_counter(value, field):
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        raise ApiError(409, f"{field} is missing or invalid in stats.json")
+
+
+def require_resettable_stats(stats, server, username):
+    stats_index, stats_server = find_stats_server(stats, server)
+    if stats_index < 0:
+        raise ApiError(404, "server stats were not found", {"username": username})
+    if "network_in" not in stats_server or "network_out" not in stats_server:
+        raise ApiError(409, "server has no current traffic counters; it may be offline", {"username": username})
+    return stats_index, stats_server
+
+
+def reset_server_month_traffic(username):
+    config = load_config()
+    _, server = find_server(config, username)
+    if server is None:
+        raise ApiError(404, "server was not found", {"username": username})
+
+    require_resettable_stats(load_stats_file(), server, username)
+
+    old_pid = signal_sergate(signal.SIGTERM)
+    wait_for_pid_exit(old_pid)
+
+    stats = load_stats_file()
+    stats_index, stats_server = require_resettable_stats(stats, server, username)
+
+    network_in = as_counter(stats_server.get("network_in"), "network_in")
+    network_out = as_counter(stats_server.get("network_out"), "network_out")
+    previous_last_in = as_counter(stats_server.get("last_network_in", 0), "last_network_in")
+    previous_last_out = as_counter(stats_server.get("last_network_out", 0), "last_network_out")
+
+    stats["servers"][stats_index]["last_network_in"] = network_in
+    stats["servers"][stats_index]["last_network_out"] = network_out
+    stats["updated"] = str(int(time.time()))
+    write_json_file(STATS_PATH, stats)
+
+    new_pid = wait_for_sergate_pid(previous_pid=old_pid)
+    if new_pid:
+        os.kill(new_pid, signal.SIGHUP)
+
+    return {
+        "server": server,
+        "stats": {
+            "network_in": network_in,
+            "network_out": network_out,
+            "previous_last_network_in": previous_last_in,
+            "previous_last_network_out": previous_last_out,
+            "last_network_in": network_in,
+            "last_network_out": network_out,
+            "month_in_before": max(0, network_in - previous_last_in),
+            "month_out_before": max(0, network_out - previous_last_out),
+        },
+        "oldPid": old_pid,
+        "pid": new_pid,
+    }
+
+
+def collection_routes():
+    endpoints = []
+    for key in ["monitors", "sslcerts", "watchdog"]:
+        endpoints.extend([
+            {"method": "GET", "path": f"/api/{key}", "auth": True},
+            {"method": "POST", "path": f"/api/{key}", "auth": True, "body": f"{COLLECTIONS[key]['item']} JSON"},
+            {"method": "PUT", "path": f"/api/{key}/{{index-or-name}}", "auth": True, "body": f"{COLLECTIONS[key]['item']} JSON"},
+            {"method": "DELETE", "path": f"/api/{key}/{{index-or-name}}", "auth": True},
+        ])
+    return endpoints
+
+
+def api_schema():
+    return {
+        "auth": {
+            "type": "bearer",
+            "header": "Authorization: Bearer <ADMIN_TOKEN>",
+            "enabled": bool(ADMIN_TOKEN),
+        },
+        "endpoints": [
+            {"method": "GET", "path": "/api/health", "auth": False},
+            {"method": "GET", "path": "/api/schema", "auth": False},
+            {"method": "GET", "path": "/api/config", "auth": True},
+            {"method": "PUT", "path": "/api/config", "auth": True, "body": "full config JSON"},
+            {"method": "GET", "path": "/api/servers", "auth": True},
+            {"method": "POST", "path": "/api/servers", "auth": True, "body": "server JSON"},
+            {"method": "PUT", "path": "/api/servers/{username}", "auth": True, "body": "server JSON"},
+            {"method": "DELETE", "path": "/api/servers/{username}", "auth": True},
+            {"method": "POST", "path": "/api/servers/{username}/reset-traffic", "auth": True},
+            *collection_routes(),
+            {"method": "POST", "path": "/api/reload", "auth": True},
+            {"method": "POST", "path": "/api/restart", "auth": True},
+        ],
+        "collections": {
+            key: {
+                "item": meta["item"],
+                "idField": meta["id_field"],
+                "required": meta["required"],
+                "optional": meta["optional"],
+            }
+            for key, meta in COLLECTIONS.items()
+        },
+    }
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "ServerStatusManageAPI/1.0"
+
+    def log_message(self, fmt, *args):
+        print("%s - %s" % (self.address_string(), fmt % args), flush=True)
+
+    def end_headers(self):
+        self.send_header("Cache-Control", "no-store")
+        if CORS_ORIGIN:
+            self.send_header("Access-Control-Allow-Origin", CORS_ORIGIN)
+            self.send_header("Access-Control-Allow-Headers", "Authorization, Content-Type, X-Admin-Token")
+            self.send_header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+        super().end_headers()
+
+    def send_json(self, status, payload):
+        data = json.dumps(payload, ensure_ascii=False).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def send_error_json(self, err):
+        payload = {"ok": False, "error": err.message}
+        if err.details is not None:
+            payload["details"] = err.details
+        self.send_json(err.status, payload)
+
+    def route(self):
+        parsed = urlparse(self.path)
+        path = parsed.path.rstrip("/") or "/"
+        method = self.command.upper()
+        if method == "OPTIONS":
+            self.send_response(204)
+            self.end_headers()
+            return
+        try:
+            if path == "/api/health" and method == "GET":
+                pid = get_sergate_pid()
+                self.send_json(200, {
+                    "ok": True,
+                    "enabled": bool(ADMIN_TOKEN),
+                    "sergate": {"running": bool(pid), "pid": pid},
+                    "configPath": CONFIG_PATH,
+                })
+                return
+            if path == "/api/schema" and method == "GET":
+                self.send_json(200, {"ok": True, "schema": api_schema()})
+                return
+            self.require_auth()
+            if path == "/api/config":
+                if method == "GET":
+                    self.send_json(200, {"ok": True, "config": load_config()})
+                    return
+                if method == "PUT":
+                    config = read_body(self)
+                    config, pid = write_and_reload(config)
+                    self.send_json(200, {"ok": True, "reloaded": True, "pid": pid, "config": config})
+                    return
+            if path == "/api/servers":
+                if method == "GET":
+                    config = load_config()
+                    self.send_json(200, {"ok": True, "servers": config.get("servers", [])})
+                    return
+                if method == "POST":
+                    server = validate_server(read_body(self))
+                    config = load_config()
+                    if find_server(config, server["username"])[1] is not None:
+                        raise ApiError(409, "server username already exists", {"username": server["username"]})
+                    config.setdefault("servers", []).append(server)
+                    config, pid = write_and_reload(config)
+                    self.send_json(201, {"ok": True, "server": server, "reloaded": True, "pid": pid, "config": config})
+                    return
+            if path.startswith("/api/servers/") and path.endswith("/reset-traffic"):
+                username = unquote(path[len("/api/servers/"):-len("/reset-traffic")].rstrip("/"))
+                if not username:
+                    raise ApiError(400, "username is required")
+                if method == "POST":
+                    result = reset_server_month_traffic(username)
+                    self.send_json(200, {"ok": True, "operation": "reset-traffic", **result})
+                    return
+            if path.startswith("/api/servers/"):
+                username = unquote(path[len("/api/servers/"):])
+                if not username:
+                    raise ApiError(400, "username is required")
+                config = load_config()
+                index, existing = find_server(config, username)
+                if index < 0:
+                    raise ApiError(404, "server was not found", {"username": username})
+                if method == "PUT":
+                    server = validate_server(read_body(self))
+                    if server["username"] != username and find_server(config, server["username"])[1] is not None:
+                        raise ApiError(409, "server username already exists", {"username": server["username"]})
+                    config["servers"][index] = server
+                    config, pid = write_and_reload(config)
+                    self.send_json(200, {"ok": True, "server": server, "reloaded": True, "pid": pid, "config": config})
+                    return
+                if method == "DELETE":
+                    removed = config["servers"].pop(index)
+                    config, pid = write_and_reload(config)
+                    self.send_json(200, {"ok": True, "removed": removed, "reloaded": True, "pid": pid, "config": config})
+                    return
+            for key in ["monitors", "sslcerts", "watchdog"]:
+                base = f"/api/{key}"
+                meta = COLLECTIONS[key]
+                if path == base:
+                    if method == "GET":
+                        config = load_config()
+                        self.send_json(200, {"ok": True, key: config.get(key, [])})
+                        return
+                    if method == "POST":
+                        item = meta["validator"](read_body(self))
+                        config = load_config()
+                        config.setdefault(key, []).append(item)
+                        config, pid = write_and_reload(config)
+                        self.send_json(201, {"ok": True, meta["item"]: item, "reloaded": True, "pid": pid, "config": config})
+                        return
+                if path.startswith(base + "/"):
+                    item_id = unquote(path[len(base) + 1:])
+                    if not item_id:
+                        raise ApiError(400, "item id is required")
+                    config = load_config()
+                    index, existing = find_collection_item(config, key, item_id)
+                    if index < 0:
+                        raise ApiError(404, f"{meta['item']} was not found", {"id": item_id})
+                    if method == "PUT":
+                        item = meta["validator"](read_body(self))
+                        config[key][index] = item
+                        config, pid = write_and_reload(config)
+                        self.send_json(200, {"ok": True, meta["item"]: item, "reloaded": True, "pid": pid, "config": config})
+                        return
+                    if method == "DELETE":
+                        removed = config[key].pop(index)
+                        config, pid = write_and_reload(config)
+                        self.send_json(200, {"ok": True, "removed": removed, "reloaded": True, "pid": pid, "config": config})
+                        return
+            if path == "/api/reload" and method == "POST":
+                pid = signal_sergate(signal.SIGHUP)
+                self.send_json(200, {"ok": True, "operation": "reload", "pid": pid})
+                return
+            if path == "/api/restart" and method == "POST":
+                pid = signal_sergate(signal.SIGTERM)
+                self.send_json(202, {"ok": True, "operation": "restart", "pid": pid})
+                return
+            raise ApiError(404, "endpoint was not found")
+        except ApiError as err:
+            self.send_error_json(err)
+        except Exception as exc:
+            self.send_error_json(ApiError(500, "internal server error", {"error": str(exc)}))
+
+    def require_auth(self):
+        if not ADMIN_TOKEN:
+            raise ApiError(503, "management API is disabled; set ADMIN_TOKEN to enable it")
+        auth = self.headers.get("Authorization", "")
+        token = ""
+        if auth.lower().startswith("bearer "):
+            token = auth[7:].strip()
+        token = token or self.headers.get("X-Admin-Token", "").strip()
+        if token != ADMIN_TOKEN:
+            raise ApiError(401, "invalid or missing admin token")
+
+    def do_GET(self):
+        self.route()
+
+    def do_POST(self):
+        self.route()
+
+    def do_PUT(self):
+        self.route()
+
+    def do_DELETE(self):
+        self.route()
+
+    def do_OPTIONS(self):
+        self.route()
+
+
+def main():
+    httpd = ThreadingHTTPServer((API_BIND, API_PORT), Handler)
+    print(f"manage-api listening on {API_BIND}:{API_PORT}", flush=True)
+    httpd.serve_forever()
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,26 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location /json/ {
+        add_header Cache-Control "no-store";
+        try_files $uri =404;
+    }
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:35602;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 30s;
+    }
+}
@@ -17,6 +17,48 @@
 static volatile int gs_Running = 1;
 static volatile int gs_ReloadConfig = 0;

+static void JsonEscape(const char *pSrc, char *pDst, int DstSize)
+{
+	if(!pDst || DstSize <= 0)
+		return;
+	int Out = 0;
+	if(!pSrc)
+	{
+		pDst[0] = 0;
+		return;
+	}
+	for(const unsigned char *p = (const unsigned char *)pSrc; *p && Out < DstSize - 1; ++p)
+	{
+		const char *pEsc = 0;
+		switch(*p)
+		{
+		case '"': pEsc = "\\\""; break;
+		case '\\': pEsc = "\\\\"; break;
+		case '\b': pEsc = "\\b"; break;
+		case '\f': pEsc = "\\f"; break;
+		case '\n': pEsc = "\\n"; break;
+		case '\r': pEsc = "\\r"; break;
+		case '\t': pEsc = "\\t"; break;
+		default: break;
+		}
+		if(pEsc)
+		{
+			for(const char *q = pEsc; *q && Out < DstSize - 1; ++q)
+				pDst[Out++] = *q;
+		}
+		else if(*p < 0x20)
+		{
+			if(Out < DstSize - 6)
+				Out += snprintf(pDst + Out, DstSize - Out, "\\u%04x", *p);
+			else
+				break;
+		}
+		else
+			pDst[Out++] = *p;
+	}
+	pDst[Out] = 0;
+}
+
 static int64_t ParseOpenSSLEnddate(const char *line)
 {
 	// line format: notAfter=Aug 12 23:59:59 2025 GMT
@@ -153,11 +195,13 @@ names_done:
 			}
 			// alarm logic
 			if(cert->m_aExpireTS>0){
-				int days = (int)((cert->m_aExpireTS - nowt)/86400);
-				int64_t *lastAlarm = NULL; int need=0; int target=0;
-				if(days <=7 && days >3){ lastAlarm=&cert->m_aLastAlarm7; target=7; }
-				else if(days <=3 && days >1){ lastAlarm=&cert->m_aLastAlarm3; target=3; }
-				else if(days <=1){ lastAlarm=&cert->m_aLastAlarm1; target=1; }
+				// 剩余天数: 向下取整 (floor) —— 与 JSON expire_days 保持一致，用于阈值分桶和消息显示
+				int64_t secsLeft = cert->m_aExpireTS - nowt;
+				int days = (int)(secsLeft/86400);
+				int64_t *lastAlarm = NULL; int need=0;
+				if(days <=7 && days >3){ lastAlarm=&cert->m_aLastAlarm7; }
+				else if(days <=3 && days >1){ lastAlarm=&cert->m_aLastAlarm3; }
+				else if(days <=1){ lastAlarm=&cert->m_aLastAlarm1; }
 				if(lastAlarm && (*lastAlarm==0 || nowt - *lastAlarm > 20*3600)) need=1; // avoid spam, 20h
 				if(need && strlen(cert->m_aCallback)>0){
 					CURL *curl = curl_easy_init();
@@ -166,7 +210,8 @@ names_done:
 						char timebuf[32];
 						time_t expt = (time_t)cert->m_aExpireTS;
 						strftime(timebuf,sizeof(timebuf),"%Y-%m-%d %H:%M:%S", gmtime(&expt));
-						snprintf(msg,sizeof(msg),"【SSL证书提醒】%s(%s) 将在 %d 天后(%s UTC) 到期", cert->m_aName, cert->m_aDomain, target, timebuf);
+						// 使用 floor(days)
+										snprintf(msg,sizeof(msg),"【SSL证书提醒】%s(%s) 将在 %d 天后(%s UTC) 到期", cert->m_aName, cert->m_aDomain, days, timebuf);
 						char *enc = curl_easy_escape(curl,msg,0);
 						char url[1500]; snprintf(url,sizeof(url),"%s%s", cert->m_aCallback, enc?enc:"");
 						curl_easy_setopt(curl, CURLOPT_POST, 1L);
@@ -377,6 +422,10 @@ int CMain::HandleMessage(int ClientNetID, char *pMessage)
 			pClient->m_Stats.m_IOWrite = rStart["io_write"].u.integer;
 		if(rStart["cpu"].type)
 			pClient->m_Stats.m_CPU = rStart["cpu"].u.dbl;
+		if(rStart["cpu_cores"].type)
+			pClient->m_Stats.m_CPUCores = rStart["cpu_cores"].u.integer;
+		if(rStart["cpu_model"].type == json_string)
+			str_copy(pClient->m_Stats.m_aCPUModel, rStart["cpu_model"].u.string.ptr, sizeof(pClient->m_Stats.m_aCPUModel));
 		if(rStart["online4"].type && pClient->m_ClientNetType == NETTYPE_IPV6)
 			pClient->m_Stats.m_Online4 = rStart["online4"].u.boolean;
 		if(rStart["online6"].type && pClient->m_ClientNetType == NETTYPE_IPV4)
@@ -632,28 +681,38 @@ void CMain::JSONUpdateThread(void *pUser)
                    pClients[i].m_LastNetworkOUT = pClients[i].m_Stats.m_NetworkOUT;
                }

+				char aCustomEsc[2048] = { 0 };
+				char aOSEsc[128] = { 0 };
+				char aCPUModelEsc[384] = { 0 };
+				JsonEscape(pClients[i].m_Stats.m_aCustom, aCustomEsc, sizeof(aCustomEsc));
+				JsonEscape(pClients[i].m_Stats.m_aOS[0] ? pClients[i].m_Stats.m_aOS : "", aOSEsc, sizeof(aOSEsc));
+				JsonEscape(pClients[i].m_Stats.m_aCPUModel[0] ? pClients[i].m_Stats.m_aCPUModel : "", aCPUModelEsc, sizeof(aCPUModelEsc));
 				str_format(pBuf, sizeof(aFileBuf) - (pBuf - aFileBuf),
-                 "{ \"name\": \"%s\",\"type\": \"%s\",\"host\": \"%s\",\"location\": \"%s\",\"online4\": %s, \"online6\": %s, \"uptime\": \"%s\",\"load_1\": %.2f, \"load_5\": %.2f, \"load_15\": %.2f,\"ping_10010\": %.2f, \"ping_189\": %.2f, \"ping_10086\": %.2f,\"time_10010\": %" PRId64 ", \"time_189\": %" PRId64 ", \"time_10086\": %" PRId64 ", \"tcp_count\": %" PRId64 ", \"udp_count\": %" PRId64 ", \"process_count\": %" PRId64 ", \"thread_count\": %" PRId64 ", \"network_rx\": %" PRId64 ", \"network_tx\": %" PRId64 ", \"network_in\": %" PRId64 ", \"network_out\": %" PRId64 ", \"cpu\": %d, \"memory_total\": %" PRId64 ", \"memory_used\": %" PRId64 ", \"swap_total\": %" PRId64 ", \"swap_used\": %" PRId64 ", \"hdd_total\": %" PRId64 ", \"hdd_used\": %" PRId64 ", \"last_network_in\": %" PRId64 ", \"last_network_out\": %" PRId64 ",\"io_read\": %" PRId64 ", \"io_write\": %" PRId64 ",\"custom\": \"%s\", \"os\": \"%s\" },\n",
+                 "{ \"name\": \"%s\",\"type\": \"%s\",\"host\": \"%s\",\"location\": \"%s\",\"online4\": %s, \"online6\": %s, \"uptime\": \"%s\",\"load_1\": %.2f, \"load_5\": %.2f, \"load_15\": %.2f,\"ping_10010\": %.2f, \"ping_189\": %.2f, \"ping_10086\": %.2f,\"time_10010\": %" PRId64 ", \"time_189\": %" PRId64 ", \"time_10086\": %" PRId64 ", \"tcp_count\": %" PRId64 ", \"udp_count\": %" PRId64 ", \"process_count\": %" PRId64 ", \"thread_count\": %" PRId64 ", \"network_rx\": %" PRId64 ", \"network_tx\": %" PRId64 ", \"network_in\": %" PRId64 ", \"network_out\": %" PRId64 ", \"cpu\": %d, \"cpu_cores\": %" PRId64 ", \"cpu_model\": \"%s\", \"memory_total\": %" PRId64 ", \"memory_used\": %" PRId64 ", \"swap_total\": %" PRId64 ", \"swap_used\": %" PRId64 ", \"hdd_total\": %" PRId64 ", \"hdd_used\": %" PRId64 ", \"last_network_in\": %" PRId64 ", \"last_network_out\": %" PRId64 ",\"io_read\": %" PRId64 ", \"io_write\": %" PRId64 ",\"custom\": \"%s\", \"os\": \"%s\" },\n",
 					pClients[i].m_aName,pClients[i].m_aType,pClients[i].m_aHost,pClients[i].m_aLocation,
 					pClients[i].m_Stats.m_Online4 ? "true" : "false",pClients[i].m_Stats.m_Online6 ? "true" : "false",
 					aUptime, pClients[i].m_Stats.m_Load_1, pClients[i].m_Stats.m_Load_5, pClients[i].m_Stats.m_Load_15, pClients[i].m_Stats.m_ping_10010, pClients[i].m_Stats.m_ping_189, pClients[i].m_Stats.m_ping_10086,
 					pClients[i].m_Stats.m_time_10010, pClients[i].m_Stats.m_time_189, pClients[i].m_Stats.m_time_10086,pClients[i].m_Stats.m_tcpCount,pClients[i].m_Stats.m_udpCount,pClients[i].m_Stats.m_processCount,pClients[i].m_Stats.m_threadCount,
-					pClients[i].m_Stats.m_NetworkRx, pClients[i].m_Stats.m_NetworkTx, pClients[i].m_Stats.m_NetworkIN, pClients[i].m_Stats.m_NetworkOUT, (int)pClients[i].m_Stats.m_CPU, pClients[i].m_Stats.m_MemTotal, pClients[i].m_Stats.m_MemUsed,
+					pClients[i].m_Stats.m_NetworkRx, pClients[i].m_Stats.m_NetworkTx, pClients[i].m_Stats.m_NetworkIN, pClients[i].m_Stats.m_NetworkOUT, (int)pClients[i].m_Stats.m_CPU, pClients[i].m_Stats.m_CPUCores, aCPUModelEsc, pClients[i].m_Stats.m_MemTotal, pClients[i].m_Stats.m_MemUsed,
 					pClients[i].m_Stats.m_SwapTotal, pClients[i].m_Stats.m_SwapUsed, pClients[i].m_Stats.m_HDDTotal, pClients[i].m_Stats.m_HDDUsed,
 					pClients[i].m_Stats.m_NetworkIN == 0 || pClients[i].m_LastNetworkIN == 0 ? pClients[i].m_Stats.m_NetworkIN : pClients[i].m_LastNetworkIN,
 					pClients[i].m_Stats.m_NetworkOUT == 0 || pClients[i].m_LastNetworkOUT == 0 ? pClients[i].m_Stats.m_NetworkOUT : pClients[i].m_LastNetworkOUT,
 					pClients[i].m_Stats.m_IORead, pClients[i].m_Stats.m_IOWrite,
-					pClients[i].m_Stats.m_aCustom,
-					pClients[i].m_Stats.m_aOS[0] ? pClients[i].m_Stats.m_aOS : "");
+					aCustomEsc,
+					aOSEsc);
 				pBuf += strlen(pBuf);
 			}
 			else
 			{
 			    // sava network traffic record to json when close client
 			    // last_network_in == last network in record, last_network_out == last network out record
-				str_format(pBuf, sizeof(aFileBuf) - (pBuf - aFileBuf), "{ \"name\": \"%s\", \"type\": \"%s\", \"host\": \"%s\", \"location\": \"%s\", \"online4\": false, \"online6\": false, \"last_network_in\": %" PRId64 ", \"last_network_out\": %" PRId64 ", \"os\": \"%s\" },\n",
+				char aOSEsc[128] = { 0 };
+				char aCPUModelEsc[384] = { 0 };
+				JsonEscape(pClients[i].m_Stats.m_aOS[0] ? pClients[i].m_Stats.m_aOS : "", aOSEsc, sizeof(aOSEsc));
+				JsonEscape(pClients[i].m_Stats.m_aCPUModel[0] ? pClients[i].m_Stats.m_aCPUModel : "", aCPUModelEsc, sizeof(aCPUModelEsc));
+				str_format(pBuf, sizeof(aFileBuf) - (pBuf - aFileBuf), "{ \"name\": \"%s\", \"type\": \"%s\", \"host\": \"%s\", \"location\": \"%s\", \"online4\": false, \"online6\": false, \"last_network_in\": %" PRId64 ", \"last_network_out\": %" PRId64 ", \"os\": \"%s\", \"cpu_model\": \"%s\" },\n",
 					pClients[i].m_aName, pClients[i].m_aType, pClients[i].m_aHost, pClients[i].m_aLocation, pClients[i].m_LastNetworkIN, pClients[i].m_LastNetworkOUT,
-					pClients[i].m_Stats.m_aOS[0] ? pClients[i].m_Stats.m_aOS : "");
+					aOSEsc, aCPUModelEsc);
 				pBuf += strlen(pBuf);
 			}
 		}
@@ -1115,4 +1174,3 @@ int main(int argc, const char *argv[])

 	return RetVal;
 }
-
@@ -76,8 +76,10 @@ class CMain
 			int64_t m_threadCount;
 			int64_t m_IORead;
 			int64_t m_IOWrite;
+			int64_t m_CPUCores;
 			double m_CPU;
 			char m_aCustom[1024];
+			char m_aCPUModel[192];
 			// OS name reported by client (e.g. linux/windows/darwin/freebsd)
 			char m_aOS[64];
 			// Options
@@ -1,19 +1,19 @@
-:root{--bg:#0f1115;--bg-alt:#171a21;--border:#262a33;--text:#e2e8f0;--text-dim:#7a899d;--accent:#3b82f6;--accent-glow:#60a5fa;--danger:#ef4444;--warn:#f59e0b;--ok:#10b981;--radius:10px;--radius-sm:4px;--shadow:0 4px 12px -2px rgba(0,0,0,.4);--font:system-ui,-apple-system,Segoe UI,Roboto,Ubuntu,Cantarell,'Noto Sans SC',sans-serif;--trans:.25s cubic-bezier(.4,0,.2,1);--logo-start:#3b82f6;--logo-end:#2563eb;--logo-accent-grad-start:#5fa8ff;--logo-accent-grad-end:#93c5fd}
-body.light{--bg:#f6f7f9;--bg-alt:#ffffff;--border:#e2e8f0;--text:#1e293b;--text-dim:#64748b;--accent:#2563eb;--accent-glow:#3b82f6;--shadow:0 4px 20px -4px rgba(0,0,0,.08);--logo-start:#2563eb;--logo-end:#1d4ed8;--logo-accent-grad-start:#1d4ed8;--logo-accent-grad-end:#60a5fa}
+:root{color-scheme:dark;--bg:#0d1117;--bg-alt:#171d27;--surface:#1d2530;--surface-soft:#151b24;--border:#334155;--text:#f1f5f9;--text-dim:#a7b4c8;--accent:#3b82f6;--accent-glow:#7db5ff;--danger:#f05252;--warn:#fbbf24;--ok:#10b981;--radius:10px;--radius-sm:4px;--shadow:0 8px 22px -10px rgba(0,0,0,.75);--font:system-ui,-apple-system,Segoe UI,Roboto,Ubuntu,Cantarell,'Noto Sans SC',sans-serif;--trans:.25s cubic-bezier(.4,0,.2,1);--logo-start:#3b82f6;--logo-end:#2563eb;--logo-accent-grad-start:#8bc1ff;--logo-accent-grad-end:#d4e8ff}
+body.light{color-scheme:light;--bg:#f6f7f9;--bg-alt:#ffffff;--surface:#ffffff;--surface-soft:#f8fafc;--border:#e2e8f0;--text:#1e293b;--text-dim:#64748b;--accent:#2563eb;--accent-glow:#3b82f6;--shadow:0 4px 20px -4px rgba(0,0,0,.08);--logo-start:#2563eb;--logo-end:#1d4ed8;--logo-accent-grad-start:#1d4ed8;--logo-accent-grad-end:#60a5fa}
 *{box-sizing:border-box}
 html,body{height:100%;margin:0;padding:0;font-family:var(--font);background:var(--bg);color:var(--text);-webkit-font-smoothing:antialiased}
-html.light{background:var(--bg)}
+html.light{background:var(--bg);color-scheme:light}
 body,button{font-size:14px;line-height:1.35}
 a{color:var(--accent);text-decoration:none}
 a:hover{color:var(--accent-glow)}
 .topbar{position:sticky;top:0;z-index:20;display:flex;align-items:center;gap:1rem;padding:.75rem 1.25rem;background:var(--bg-alt);border-bottom:1px solid var(--border)}
 .brand{font-weight:600;letter-spacing:.5px;font-size:15px}
 .nav{display:flex;gap:.5rem}
-.nav button{background:transparent;border:1px solid var(--border);color:var(--text-dim);padding:.45rem .9rem;border-radius:var(--radius-sm);cursor:pointer;display:flex;align-items:center;gap:.35rem;transition:var(--trans);font-weight:500}
-.nav button.active,.nav button:hover{color:var(--text);background:var(--accent);border-color:var(--accent);box-shadow:0 0 0 1px var(--accent-glow),0 4px 10px -2px rgba(0,0,0,.5)}
+.nav button{background:var(--surface-soft);border:1px solid var(--border);color:var(--text-dim);padding:.45rem .9rem;border-radius:var(--radius-sm);cursor:pointer;display:flex;align-items:center;gap:.35rem;transition:var(--trans);font-weight:600}
+.nav button.active,.nav button:hover{color:#fff;background:var(--accent);border-color:var(--accent);box-shadow:0 0 0 1px var(--accent-glow),0 4px 10px -2px rgba(0,0,0,.5)}
 .actions{margin-left:auto;display:flex;align-items:center;gap:.75rem}
 .actions button{background:var(--bg);border:1px solid var(--border);color:var(--text-dim);height:32px;width:38px;border-radius:8px;cursor:pointer;display:grid;place-items:center;transition:var(--trans)}
-.actions button:hover{color:var(--text);border-color:var(--accent);background:var(--accent)}
+.actions button:hover{color:#fff;border-color:var(--accent);background:var(--accent)}
 .wrapper{max-width:1680px;margin:1.2rem auto;padding:0 1.2rem;display:flex;flex-direction:column;gap:1.25rem}
 .notice{padding:.9rem 1rem;border:1px solid var(--border);background:linear-gradient(145deg,var(--bg-alt),var(--bg));border-radius:var(--radius);display:flex;align-items:center;gap:.75rem;font-size:13px}
 .notice.info:before{content:"";width:8px;height:8px;border-radius:50%;background:var(--accent);box-shadow:0 0 0 4px color-mix(in srgb,var(--accent) 20%,transparent)}
@@ -21,71 +21,29 @@ a:hover{color:var(--accent-glow)}
 .panel.active{display:flex}
 .table-wrap{overflow:auto;border:1px solid var(--border);border-radius:var(--radius);background:var(--bg-alt);box-shadow:var(--shadow)}
 table.data{width:100%;border-collapse:separate;border-spacing:0;min-width:960px}
-table.data thead th{position:sticky;top:0;background:var(--bg-alt);font-weight:500;text-align:left;font-size:12px;text-transform:uppercase;letter-spacing:.5px;color:var(--text-dim);padding:.7rem .75rem;border-bottom:1px solid var(--border);white-space:nowrap}
+table.data thead th{position:sticky;top:0;background:var(--surface-soft);font-weight:700;text-align:left;font-size:12px;text-transform:uppercase;letter-spacing:.5px;color:var(--text-dim);padding:.7rem .75rem;border-bottom:1px solid var(--border);white-space:nowrap}
 table.data tbody td{padding:.55rem .75rem;border-bottom:1px solid var(--border);font-size:13px;vertical-align:middle;white-space:nowrap}
-/* 防止数值变化导致列抖动：为月流量(7)/当前网络(8)/总流量(9)设置固定宽度并使用等宽数字 */
+/* 防止数值变化导致列抖动 */
 table.data th,table.data td{font-variant-numeric:tabular-nums}
-/* 月流量(2) 左对齐；当前网络(8)/总流量(9) 居中 */
-#serversTable thead th:nth-child(2),#serversTable tbody td:nth-child(2){
-	/* 月流量列：向左贴近协议（减小左 padding），同时加大右 padding 拉开与节点距离 */
-	width:128px;min-width:128px;max-width:128px;font-variant-numeric:tabular-nums;letter-spacing:.3px;text-align:center;padding:0 1.05rem 0 .15rem;
-}
-/* 节点列加宽，避免被月流量胶囊视觉挤压 */
-#serversTable thead th:nth-child(3),#serversTable tbody td:nth-child(3){
-	width:160px;min-width:160px;max-width:160px;
-}
-/* 协议列继续收紧右侧 padding 与固定宽度 */
-#serversTable thead th:nth-child(1),#serversTable tbody td:nth-child(1){
-	padding-right:.14rem;width:78px;min-width:78px;max-width:78px; /* 扩大协议列并恢复适度间距 */
-}
-/* 让双色胶囊更靠近协议列 */
-#serversTable tbody td:nth-child(2) .caps-traffic.duo{margin-left:-6px;} /* 向协议方向微移，视觉更靠近；右侧 padding 增大避免靠近节点 */
-#serversTable thead th:nth-child(8),#serversTable tbody td:nth-child(8),
-#serversTable thead th:nth-child(9),#serversTable tbody td:nth-child(9){
-	width:132px;min-width:132px;max-width:132px;font-variant-numeric:tabular-nums;letter-spacing:.3px;text-align:center;
-	    /* 进一步拉开与 CPU/内存/硬盘 组的视觉距离 */
-	    padding-right:1.95rem;
-}
-/* CPU / 内存 / 硬盘 列：居中 + 固定宽度 与仪表盘一致 */
-#serversTable thead th:nth-child(10),#serversTable tbody td:nth-child(10),
-#serversTable thead th:nth-child(11),#serversTable tbody td:nth-child(11),
-#serversTable thead th:nth-child(12),#serversTable tbody td:nth-child(12){
-	width:70px;min-width:70px;max-width:70px;text-align:center;padding-left:1.1rem;padding-right:0; /* 继续右移并贴近右侧列 */
-}
 /* 月流量胶囊 */
 .caps-traffic{display:inline-flex;align-items:center;gap:6px;background:linear-gradient(145deg,var(--bg),var(--bg-alt));border:1px solid var(--border);padding:3px 12px 3px 10px;border-radius:999px;font-size:12px;line-height:1;font-weight:500;position:relative;box-shadow:0 2px 4px -2px rgba(0,0,0,.35),0 0 0 1px rgba(255,255,255,.03);}
 .caps-traffic:before{content:"";position:absolute;inset:0;border-radius:inherit;background:radial-gradient(circle at 20% 20%,rgba(255,255,255,.06),transparent 70%);pointer-events:none;}
-.caps-traffic .io{display:inline-flex;align-items:center;gap:2px;font-variant-numeric:tabular-nums;letter-spacing:.3px;}
-.caps-traffic .io.in{color:var(--ok);}
-.caps-traffic .io.out{color:var(--accent);}
-.caps-traffic .sep{opacity:.4;font-size:11px;display:none;}
 .caps-traffic.sm{padding:2px 8px 2px 7px;font-size:11px;gap:5px;}
-.caps-traffic.sm .io{font-size:11px;}
-/* 双色胶囊：左红右黄 */
+/* 双色胶囊 */
 .caps-traffic.duo{background:none;border:0;gap:0;padding:0;box-shadow:none;position:relative;border-radius:999px;overflow:hidden;font-size:12px;}
-/* 宽度按内容自适应（不再拉伸占满列），每半边仅为其文本 + padding，可容纳最大 111.1MB */
+/* 宽度按内容自适应，每半边仅为其文本 + padding */
 .caps-traffic.duo .half{flex:0 0 auto;display:flex;align-items:center;justify-content:center;padding:2px 4px;font-variant-numeric:tabular-nums;font-weight:600;line-height:1.25; /* 与 .pill 保持一致高度 */ letter-spacing:.25px;color:#fff;font-size:12px;white-space:nowrap;}
-/* 双色胶囊配色：
-	normal (默认): 左白(#fff) 右蓝(accent)
-	heavy (>=500GB 任一方向): 左黄(warn) 右红(danger)
-*/
-/* normal 初始：淡绿色(入) + 淡蓝色(出) */
 .caps-traffic.duo.normal .half.in{background:#d1fae5;color:#065f46;} /* emerald-100 / text-emerald-800 */
-body.light .caps-traffic.duo.normal .half.in{background:#d1fae5;color:#065f46;}
 .caps-traffic.duo.normal .half.out{background:#bfdbfe;color:#1e3a8a;} /* blue-200 / text-blue-900 */
-body.light .caps-traffic.duo.normal .half.out{background:#bfdbfe;color:#1e3a8a;}
-
-.caps-traffic.duo.heavy .half.in{background:var(--warn);color:#111;}
-body.light .caps-traffic.duo.heavy .half.in{background:var(--warn);color:#111;}
-.caps-traffic.duo.heavy .half.out{background:var(--danger);color:#fff;}
-body.light .caps-traffic.duo.heavy .half.out{color:#fff;}
+.caps-traffic.duo.heavy .half.in{background:#fde68a;color:#78350f;}
+.caps-traffic.duo.heavy .half.out{background:#fbbf24;color:#111827;}

 /* 半之间分隔线 */
 .caps-traffic.duo .half + .half{border-left:1px solid rgba(0,0,0,.18);} 
 body.light .caps-traffic.duo .half + .half{border-left:1px solid rgba(0,0,0,.08);} 
 .caps-traffic.duo.sm .half{padding:1px 4px;font-size:10px;min-width:0;}
 table.data tbody tr:last-child td{border-bottom:none}
-table.data tbody tr:hover{background:rgba(255,255,255,.04)}
+table.data tbody tr:hover{background:rgba(59,130,246,.045)}
 .badge{display:inline-block;padding:2px 6px;font-size:11px;border-radius:12px;font-weight:500;line-height:1.2;background:var(--bg);border:1px solid var(--border);color:var(--text-dim)}
 .badge.ok{background:rgba(16,185,129,.15);color:var(--ok);border-color:rgba(16,185,129,.3)}
 .badge.warn{background:rgba(245,158,11,.15);color:var(--warn);border-color:rgba(245,158,11,.4)}
@@ -108,16 +66,6 @@ table.data tbody tr:hover{background:rgba(255,255,255,.04)}
 .kv{display:flex;justify-content:space-between;gap:1rem;padding:.5rem .75rem;background:linear-gradient(145deg,var(--bg),var(--bg-alt));border:1px solid var(--border);border-radius:10px}
 .kv span{white-space:nowrap}
 .mono{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px}
-/* 资源使用百分比色彩标签 */
-/* 回退：移除资源使用百分比彩色标签样式 */
-
-/* 详情弹窗三列信息行 */
-
-/* 旧 spark 样式已移除，现使用半圆仪表盘 */
-/* 全圆旧样式（保留以便回退） */
-.gauge{--p:0;--col:var(--accent);width:74px;height:74px;position:relative;display:grid;place-items:center;font-size:11px;font-family:ui-monospace,monospace;font-weight:600;color:var(--text);}
-.gauge:before{content:"";position:absolute;inset:0;border-radius:50%;background:conic-gradient(var(--col) calc(var(--p)*1turn),rgba(255,255,255,0.06) 0);mask:radial-gradient(circle at 50% 50%,transparent 58%,#000 59%);-webkit-mask:radial-gradient(circle at 50% 50%,transparent 58%,#000 59%);border:1px solid var(--border);box-shadow:0 2px 6px -2px rgba(0,0,0,.4),0 0 0 1px rgba(255,255,255,.05);} 
-.gauge span{position:relative;z-index:1}

 /* 半圆仪表盘 */
 .gauge-half{--p:0;width:60px;height:34px;position:relative;display:flex;flex-direction:column;align-items:center;justify-content:flex-start;font-family:ui-monospace,monospace;font-size:10px;font-weight:600;gap:0;color:var(--text);}
@@ -128,15 +76,13 @@ table.data tbody tr:hover{background:rgba(255,255,255,.04)}
 .gauge-half path.arc{stroke:var(--gauge-base,#3b82f6);stroke-width:8;stroke-dasharray:126;stroke-dashoffset:calc(126*(1 - var(--p)));transition:stroke-dashoffset .8s cubic-bezier(.4,0,.2,1),stroke .35s;filter:drop-shadow(0 1px 2px rgba(0,0,0,.45));}
 .gauge-half[data-type=mem] path.arc{--gauge-base:#10b981}
 .gauge-half[data-type=hdd] path.arc{--gauge-base:#06b6d4}
-/* 阈值颜色：>=50% 警告黄，>=90% 危险红 */
+/* 阈值颜色：CPU>=75%、内存>=80%、硬盘>=85% 警告黄，>=90% 危险红 */
 .gauge-half[data-warn] path.arc{stroke:var(--warn)}
 .gauge-half[data-bad] path.arc{stroke:var(--danger)}
-/* 指针：以中心(50,50)为原点旋转；半圆角度范围 180deg -> 从 180deg (左) 到 0deg(右) */
 .gauge-half span{line-height:1;position:relative;top:-6px;font-size:12px;}
 /* 亮色模式细化对比度 */
 body.light .gauge-half path.track{stroke:color-mix(in srgb,var(--text-dim) 28%,transparent)}
 body.light .gauge-half path.arc{filter:none}
-body.light .gauge-half .needle{background:linear-gradient(var(--text),var(--text-dim))}

 /* status pill */
 .pill{display:inline-block;padding:2px 8px;font-size:12px;font-weight:600;border-radius:999px;letter-spacing:.45px;min-width:48px;text-align:center;line-height:1.25;border:0;box-shadow:0 2px 4px -1px rgba(0,0,0,.4),0 0 0 1px rgba(255,255,255,.04);transition:var(--trans);color:#fff}
@@ -144,6 +90,23 @@ body.light .gauge-half .needle{background:linear-gradient(var(--text),var(--text
 .pill.off{background:var(--danger)}
 .pill.on:hover{filter:brightness(1.1)}
 .pill.off:hover{filter:brightness(1.1)}
+.proto-signal{display:inline-grid;grid-template-columns:1fr 1fr;width:18px;height:18px;border-radius:50%;overflow:hidden;vertical-align:middle;border:1px solid color-mix(in srgb,var(--border) 80%,transparent);box-shadow:0 2px 5px -2px rgba(0,0,0,.55),0 0 0 1px rgba(255,255,255,.04)}
+.proto-signal i{display:block;min-width:0;background:color-mix(in srgb,var(--text-dim) 42%,var(--bg-alt));}
+.proto-signal[data-v4="1"] .v4,.proto-signal[data-v6="1"] .v6{background:#22c55e}
+.proto-signal[data-state="ipv4"] .v4{background:#22c55e}
+.proto-signal[data-state="ipv6"] .v6{background:#22c55e}
+.proto-signal[data-state="offline"] .v4,.proto-signal[data-state="offline"] .v6{background:var(--danger)}
+body.light .proto-signal{border-color:color-mix(in srgb,var(--border) 92%,#94a3b8);box-shadow:0 1px 3px rgba(15,23,42,.12)}
+body.light .proto-signal i{background:#cbd5e1}
+.virt-pill{--virt:var(--accent);display:inline-flex;align-items:center;justify-content:center;min-width:50px;padding:2px 9px;border-radius:999px;border:1px solid color-mix(in srgb,var(--virt) 42%,var(--border));background:color-mix(in srgb,var(--virt) 14%,var(--bg-alt));color:color-mix(in srgb,var(--virt) 72%,#fff);font-size:12px;font-weight:650;line-height:1.2;letter-spacing:.25px;white-space:nowrap}
+body.light .virt-pill{background:color-mix(in srgb,var(--virt) 12%,#fff);color:color-mix(in srgb,var(--virt) 68%,#111827)}
+.node-name{display:inline-block;max-width:160px;overflow:hidden;text-overflow:ellipsis;vertical-align:middle;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:13px;font-weight:750;letter-spacing:.15px;color:var(--text)}
+.row-server[data-online="0"] .node-name{color:color-mix(in srgb,var(--text) 72%,var(--text-dim));font-weight:650}
+.row-server:hover .node-name{color:var(--accent)}
+.load-with-cores{display:inline-flex;align-items:flex-start;gap:.28rem;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-weight:700;line-height:1;white-space:nowrap}
+.load-value{display:inline-block;min-width:2.55rem}
+.load-core-bubble{display:inline-flex;align-items:center;justify-content:center;height:14px;min-width:24px;padding:0 5px;margin-top:-6px;border-radius:999px;border:1px solid color-mix(in srgb,var(--accent) 34%,var(--border));background:color-mix(in srgb,var(--accent) 13%,var(--bg-alt));color:color-mix(in srgb,var(--accent) 74%,#fff);font-size:9px;font-weight:800;line-height:1;letter-spacing:0;box-shadow:0 1px 3px rgba(0,0,0,.22)}
+body.light .load-core-bubble{background:color-mix(in srgb,var(--accent) 8%,#fff);color:color-mix(in srgb,var(--accent) 78%,#111827);box-shadow:0 1px 2px rgba(15,23,42,.08)}

 /* buckets CU/CT/CM (simple version) */
 .buckets{display:flex;align-items:flex-end;gap:8px;min-width:140px}
@@ -154,12 +117,6 @@ body.light .gauge-half .needle{background:linear-gradient(var(--text),var(--text
 .bucket label{position:absolute;left:0;right:0;bottom:2px;font-size:10px;text-align:center;color:var(--text-dim);pointer-events:none}
 .bucket:hover label{color:var(--text)}

-/* 居中联通电信移动列 */
-#serversTable thead th:last-child, #serversTable tbody td:last-child { text-align:center; }
-/* 放大第13列宽度以容纳更宽水桶 */
-#serversTable thead th:nth-child(13),#serversTable tbody td:nth-child(13){
-	width:150px;min-width:150px;max-width:150px;padding-left:0;padding-right:.55rem; /* 去除左 padding 进一步贴近 */
-}
 /* 调整“总流量”表头（第9列）padding 使标题文字居中，不受正文额外右 padding 影响 */
 #serversTable thead th:nth-child(9){padding-left:.75rem;padding-right:.75rem;}
 .buckets{justify-content:center}
@@ -196,42 +153,50 @@ body.light .gauge-half .needle{background:linear-gradient(var(--text),var(--text
 	.modal-content{max-height:65vh;overflow:auto;}
 }

-/* SSL 表（证书）列宽与换行修正，避免复用服务器列宽导致名称与域名重叠 */
-#sslTable th,#sslTable td{white-space:nowrap;padding:.55rem .75rem;}
-#sslTable th:nth-child(1),#sslTable td:nth-child(1){width:140px;min-width:120px;}
-/* 域名允许换行以防过长挤压 */
-#sslTable th:nth-child(2),#sslTable td:nth-child(2){white-space:normal;max-width:320px;overflow-wrap:anywhere;}
-
-/* === 覆盖：要求三个表 (servers / monitors / ssl) 全部改为自动宽度 === */
-/* 1. 取消全局 table.data 的 min-width 对这三个表的影响 */
+/* 三个数据表使用自动宽度，按关键列单独约束 */
 #serversTable,#monitorsTable,#sslTable{min-width:0;}
-/* 2. 统一去除之前为 serversTable 设定的列固定宽度，允许浏览器自动分配 */
 #serversTable thead th,#serversTable tbody td,
 #monitorsTable thead th,#monitorsTable tbody td,
 #sslTable thead th,#sslTable tbody td{
 	width:auto!important;min-width:0!important;max-width:none!important;
 	padding:.55rem .7rem;
 }
-/* 3. 允许证书域名不受 max-width 限制（如仍需换行可保留 overflow-wrap） */
 #sslTable th:nth-child(2),#sslTable td:nth-child(2){max-width:none;white-space:normal;overflow-wrap:anywhere;}
-/* 4. 取消“联通|电信|移动”列固定宽度 */
-#serversTable thead th:nth-child(13),#serversTable tbody td:nth-child(13){width:auto!important;min-width:0!important;}
-/* 5. 如需稍微限制仪表盘相关列最小可读宽度，可设定一个较小下限 (可选) -- 暂不设置，完全交由自动布局 */
+#serversTable thead th:nth-child(13),#serversTable tbody td:nth-child(13){width:112px!important;min-width:112px!important;max-width:112px!important;padding-left:0!important;padding-right:0!important;text-align:center;}

-/* === 新增：为“月流量 / 当前网络 / 总流量”三列设置最小宽度，防止内容被压缩换行或挤压 === */
-/* 目标最小宽度按示例 "111.1GB|111.1GB" 设计（13 个字符左右），取 16ch 留余量 */
-#serversTable thead th:nth-child(2),#serversTable tbody td:nth-child(2),
 #serversTable thead th:nth-child(8),#serversTable tbody td:nth-child(8),
 #serversTable thead th:nth-child(9),#serversTable tbody td:nth-child(9){
-	min-width:22ch !important; /* 保留自动宽度，但不小于此值 */
+	min-width:20ch !important; /* 保留自动宽度，但不小于此值 */
 	text-align:center;
 	font-variant-numeric:tabular-nums;
 }
+#serversTable thead th:nth-child(2),#serversTable tbody td:nth-child(2){
+	width:134px!important;min-width:134px!important;max-width:134px!important;text-align:center;padding-left:.35rem!important;padding-right:.35rem!important;font-variant-numeric:tabular-nums;
+}
+#serversTable thead th:nth-child(1),#serversTable tbody td:nth-child(1){
+	width:46px!important;min-width:46px!important;max-width:46px!important;text-align:center;padding-left:0!important;padding-right:0!important;
+}
+#serversTable thead th:nth-child(3),#serversTable tbody td:nth-child(3){
+	text-align:left;padding-left:18px!important;
+}
+#serversTable tbody td:nth-child(13) .buckets{
+	min-width:112px;
+	gap:6px;
+	margin:0 auto;
+	justify-content:center;
+}
 .cards .card{border:1px solid var(--border);border-radius:12px;padding:.75rem .85rem;background:linear-gradient(145deg,var(--bg),var(--bg-alt));display:flex;flex-direction:column;gap:.45rem;position:relative;}
-.cards .card.offline{opacity:.6;}
-.cards .card.high-load{border-color:rgba(239,68,68,.6);background:linear-gradient(180deg, rgba(239,68,68,.22), rgba(239,68,68,.12));box-shadow:0 0 0 1px rgba(239,68,68,.48),0 6px 18px -6px rgba(239,68,68,.28);} 
-table.data tbody tr.high-load{background:rgba(239,68,68,.18) !important;} 
-table.data tbody tr.high-load:hover{background:rgba(239,68,68,.26) !important;} 
+.cards .card.offline{filter:saturate(.92);}
+.cards .card.alert-critical{border-color:rgba(239,68,68,.6);background:linear-gradient(180deg, rgba(239,68,68,.22), rgba(239,68,68,.12)), var(--bg-alt);box-shadow:0 0 0 1px rgba(239,68,68,.48),0 6px 18px -6px rgba(239,68,68,.28);}
+.cards .card.alert-warning{border-color:rgba(245,158,11,.55);background:linear-gradient(180deg, rgba(245,158,11,.16), rgba(245,158,11,.08)), var(--bg-alt);box-shadow:0 0 0 1px rgba(245,158,11,.32),0 6px 18px -8px rgba(245,158,11,.22);}
+table.data tbody tr.alert-critical{background:rgba(239,68,68,.18) !important;}
+table.data tbody tr.alert-critical:hover{background:rgba(239,68,68,.21) !important;}
+table.data tbody tr.alert-warning{background:rgba(245,158,11,.12) !important;}
+table.data tbody tr.alert-warning:hover{background:rgba(245,158,11,.14) !important;}
+
+/* SSL 域名告警底色：与高负载相同 */
+#sslTable td.alert-domain{background:rgba(239,68,68,.18) !important;}
+#sslTable tr:hover td.alert-domain{background:rgba(239,68,68,.26) !important;}

 /* OS 着色（更明显）：
 	1) 为各 OS 类定义 --os-color 变量
@@ -239,11 +204,15 @@ table.data tbody tr.high-load:hover{background:rgba(239,68,68,.26) !important;}
 	3) 行背景叠加轻度渐变以提示 OS
 */
 table.data tbody tr[class*="os-"]{box-shadow:inset 4px 0 0 0 var(--os-color, transparent);background:linear-gradient(180deg, color-mix(in srgb, var(--os-color, transparent) 10%, transparent), transparent 60%);} 
-table.data tbody tr[class*="os-"]:hover{background:linear-gradient(180deg, color-mix(in srgb, var(--os-color, transparent) 16%, transparent), transparent 65%);} 
+table.data tbody tr[class*="os-"]:hover{background:linear-gradient(180deg, color-mix(in srgb, var(--os-color, transparent) 12%, transparent), transparent 65%);}
 .cards .card[class*="os-"]{border-color:color-mix(in srgb, var(--os-color, var(--accent)) 60%, transparent);box-shadow:0 0 0 1px color-mix(in srgb, var(--os-color, var(--accent)) 40%, transparent),0 4px 16px -6px color-mix(in srgb, var(--os-color, #000) 35%, transparent);} 
 /* 弹窗 OS 着色：左侧彩条 + 渐变与卡片一致 */
 /* 取消弹窗背景着色，改为仅在标题展示系统胶囊 */
 .os-chip{display:inline-flex;align-items:center;padding:2px 8px;margin-left:.5rem;border-radius:999px;font-size:12px;font-weight:600;line-height:1.2;background:var(--os-color, var(--border));color:#fff;border:0;white-space:nowrap;}
+.spec-chip{display:inline-flex;align-items:center;padding:2px 8px;margin-left:.4rem;border-radius:999px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;font-weight:750;line-height:1.2;background:color-mix(in srgb,var(--accent) 16%,var(--bg-alt));color:color-mix(in srgb,var(--accent) 72%,#fff);border:1px solid color-mix(in srgb,var(--accent) 38%,var(--border));white-space:nowrap;}
+body.light .spec-chip{background:color-mix(in srgb,var(--accent) 10%,#fff);color:color-mix(in srgb,var(--accent) 78%,#111827)}
+.cpu-model-chip{display:inline-block;max-width:min(240px,58vw);overflow:hidden;text-overflow:ellipsis;vertical-align:middle;padding:2px 8px;margin-left:.4rem;border-radius:999px;border:1px solid color-mix(in srgb,var(--text-dim) 34%,var(--border));background:color-mix(in srgb,var(--text-dim) 12%,var(--bg-alt));color:color-mix(in srgb,var(--text) 84%,var(--text-dim));font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;font-weight:700;line-height:1.2;white-space:nowrap;}
+body.light .cpu-model-chip{background:color-mix(in srgb,var(--text-dim) 9%,#fff);color:color-mix(in srgb,var(--text) 82%,#111827)}

 /* 为常见系统赋色 */
 .os-linux{--os-color: rgba(16,185,129,.85);}   /* 绿色 (通用 Linux，保持不变) */
@@ -268,8 +237,10 @@ table.data tbody tr[class*="os-"]:hover{background:linear-gradient(180deg, color

 /* 旧进度条相关样式已清理 */
 .cards .card-header{display:flex;align-items:center;justify-content:space-between;gap:.5rem;}
-.cards .card-title{font-weight:600;font-size:.95rem;}
-.cards .tag{font-size:.65rem;padding:.15rem .4rem;border-radius:4px;background:var(--border);letter-spacing:.5px;}
+.cards .card-title{display:flex;align-items:center;flex-wrap:wrap;gap:.24rem .34rem;min-width:0;font-weight:600;font-size:.95rem;}
+.cards .card-spec-chip{display:inline-flex;align-items:center;justify-content:center;height:16px;padding:0 6px;border-radius:999px;border:1px solid color-mix(in srgb,var(--accent) 34%,var(--border));background:color-mix(in srgb,var(--accent) 13%,var(--bg-alt));color:color-mix(in srgb,var(--accent) 74%,#fff);font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:10px;font-weight:800;line-height:1;letter-spacing:0;white-space:nowrap}
+body.light .cards .card-spec-chip{background:color-mix(in srgb,var(--accent) 8%,#fff);color:color-mix(in srgb,var(--accent) 78%,#111827)}
+.cards .tag{font-size:.65rem;padding:.15rem .4rem;border-radius:4px;background:var(--surface);color:var(--text);letter-spacing:.5px;}
 .cards .status-pill{font-size:.6rem;padding:.2rem .45rem;border-radius:999px;font-weight:500;}
 .cards .status-pill.on{background:var(--ok);color:#fff;}
 .cards .status-pill.off{background:var(--danger);color:#fff;}
@@ -277,10 +248,10 @@ table.data tbody tr[class*="os-"]:hover{background:linear-gradient(180deg, color
 .cards .kvlist div{display:flex;flex-direction:column;}
 .cards .kvlist span.key{opacity:.6;}
 .cards .buckets{margin-top:.25rem;}
-.cards .expand-btn{position:absolute;top:.5rem;right:.5rem;background:transparent;border:0;color:var(--text-dim);cursor:pointer;font-size:.9rem;padding:.2rem;}
-.cards .expand-btn:focus, .cards .expand-btn:hover{color:var(--text);}
-.cards .expand-area{margin-top:.4rem;display:none;animation:fadeIn .25s ease;}
-.cards .card.expanded .expand-area{display:block;}
+/* 证书卡片：域名告警底色（与高负载卡片风格一致） */
+.cards .kvlist .alert-domain{background:rgba(239,68,68,.18);border:1px solid rgba(239,68,68,.35);border-radius:8px;padding:.4rem .5rem;}
+.cards .kvlist .alert-domain .key{opacity:.85}
+/* 移除移动端卡片展开箭头与展开区域（已按需简化交互） */
 /* 旧移动端 latency spark 样式移除 */

 /* 简易信号格，用于服务连通性延迟展示 */
@@ -310,3 +281,126 @@ table.data tbody tr[class*="os-"]:hover{background:linear-gradient(180deg, color
 .brand:hover .logo-mark{transform:translateY(-2px) scale(1.05)}
 .brand:hover .logo-text{color:var(--text)}
@media (max-width:640px){.brand .logo-text{font-size:15px}.brand .logo-mark{width:30px;height:30px}}
+
+/* 运维控制台增强 */
+.ops-overview{display:grid;grid-template-columns:repeat(5,minmax(140px,1fr));gap:.75rem}
+.overview-card{border:1px solid var(--border);background:linear-gradient(180deg,var(--surface-soft),var(--bg-alt));border-radius:8px;padding:.8rem .9rem;display:flex;flex-direction:column;gap:.25rem;min-height:82px}
+.overview-card .label{font-size:12px;color:var(--text-dim)}
+.overview-card .value{font-size:24px;line-height:1;font-weight:700;font-variant-numeric:tabular-nums}
+.overview-card .hint{font-size:12px;color:var(--text-dim);line-height:1.3}
+.overview-card.ok{border-color:rgba(16,185,129,.35)}
+.overview-card.warn{border-color:rgba(245,158,11,.45)}
+.overview-card.err{border-color:rgba(239,68,68,.5)}
+.overview-card.traffic-down{border-color:rgba(16,185,129,.38)}
+.overview-card.traffic-up{border-color:rgba(59,130,246,.38)}
+.ops-toolbar{display:flex;align-items:end;gap:.75rem;flex-wrap:wrap;border:1px solid var(--border);background:var(--bg-alt);border-radius:8px;padding:.75rem}
+.search-field,.select-field{display:flex;flex-direction:column;gap:.3rem;color:var(--text-dim);font-size:12px}
+.search-field input,.select-field select,.config-form input,.config-form textarea{border:1px solid var(--border);background:var(--bg);color:var(--text);border-radius:6px;padding:0 .65rem;outline:none;transition:var(--trans)}
+.search-field input::placeholder,.config-form input::placeholder,.config-form textarea::placeholder{color:color-mix(in srgb,var(--text-dim) 78%,transparent);opacity:1}
+.search-field input,.select-field select,.config-form input{height:36px}
+.config-form textarea{min-height:92px;resize:vertical;padding:.55rem .65rem;line-height:1.45;font-family:ui-monospace,SFMono-Regular,Menlo,monospace}
+.search-field input:focus,.select-field select:focus,.config-form input:focus,.config-form textarea:focus{border-color:var(--accent);box-shadow:0 0 0 3px color-mix(in srgb,var(--accent) 18%,transparent)}
+.search-field input{min-width:280px}
+.segmented{display:inline-flex;border:1px solid var(--border);border-radius:7px;overflow:hidden;background:var(--surface-soft)}
+.segmented button{height:36px;border:0;border-right:1px solid var(--border);background:transparent;color:var(--text-dim);padding:0 .8rem;cursor:pointer}
+.segmented button:last-child{border-right:0}
+.segmented button.active,.segmented button:hover{background:var(--accent);color:#fff}
+.icon-text,.primary-btn,.warn-btn,.danger-btn{height:36px;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);padding:0 .75rem;cursor:pointer;transition:var(--trans);font-weight:600}
+.icon-text:hover{border-color:var(--accent);color:var(--accent)}
+.primary-btn{background:var(--accent);border-color:var(--accent);color:#fff}
+.primary-btn:hover{filter:brightness(1.08)}
+.warn-btn{background:rgba(245,158,11,.14);border-color:rgba(245,158,11,.42);color:var(--warn)}
+.warn-btn:hover{background:var(--warn);border-color:var(--warn);color:#111827}
+.danger-btn{background:rgba(239,68,68,.14);border-color:rgba(239,68,68,.38);color:var(--danger)}
+.danger-btn:hover{background:var(--danger);color:#fff}
+th[data-sort]{cursor:pointer;user-select:none}
+th[data-sort]:after{content:"";display:inline-block;margin-left:6px;border:4px solid transparent;border-top-color:color-mix(in srgb,var(--text-dim) 70%,transparent);transform:translateY(2px);opacity:.45}
+th[data-sort].sorted-asc:after{border-top-color:transparent;border-bottom-color:var(--accent);transform:translateY(-2px)}
+th[data-sort].sorted-desc:after{border-top-color:var(--accent);opacity:1}
+.section-head h2{margin:0;font-size:18px}
+.section-head p{margin:.25rem 0 0}
+.empty-state{border:1px dashed var(--border);border-radius:8px;background:var(--bg-alt);padding:1.25rem;color:var(--text-dim);text-align:center}
+
+/* 右侧详情抽屉 */
+.drawer-backdrop{align-items:stretch;justify-content:flex-end;padding:0;background:rgba(0,0,0,.48)}
+.detail-drawer{height:100dvh;max-height:100dvh;width:min(620px,100vw);max-width:min(620px,100vw);border-radius:0;border-top:0;border-right:0;border-bottom:0;padding:1.1rem;overflow:auto;animation:slideIn .24s ease}
+.detail-drawer.alert-critical{border-color:rgba(239,68,68,.6);background:linear-gradient(180deg, rgba(239,68,68,.16), rgba(239,68,68,.08)), var(--bg-alt);box-shadow:0 0 0 1px rgba(239,68,68,.38),0 10px 28px -10px rgba(239,68,68,.28)}
+.detail-drawer.alert-warning{border-color:rgba(245,158,11,.55);background:linear-gradient(180deg, rgba(245,158,11,.14), rgba(245,158,11,.06)), var(--bg-alt);box-shadow:0 0 0 1px rgba(245,158,11,.28),0 10px 28px -10px rgba(245,158,11,.2)}
+.modal-title{padding-right:2.2rem;display:flex;align-items:center;flex-wrap:wrap;gap:.32rem .4rem}
+.modal-title .os-chip,.modal-title .spec-chip,.modal-title .cpu-model-chip{margin-left:0}
+.detail-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:.55rem}
+.detail-section{border:1px solid var(--border);border-radius:8px;background:linear-gradient(145deg,var(--bg),var(--bg-alt));padding:.75rem;display:flex;flex-direction:column;gap:.65rem}
+.detail-section h4{margin:0;font-size:13px;color:var(--text-dim);font-weight:700;letter-spacing:.4px}
+.detail-section .kv{display:grid;grid-template-columns:max-content minmax(0,1fr);align-items:flex-start;gap:.6rem;min-width:0}
+.detail-section .kv span{min-width:0;white-space:normal}
+.detail-section .kv>span:last-child{text-align:right;overflow-wrap:anywhere;word-break:break-word}
+.detail-section .mono{display:block;white-space:normal;overflow-wrap:anywhere;word-break:break-word;line-height:1.45}
+.detail-inline{display:inline-flex;align-items:center;justify-content:flex-end;gap:.45rem;white-space:nowrap!important}
+.detail-inline .mono{display:inline!important;white-space:nowrap!important;line-height:1}
+.detail-values{display:flex;flex-wrap:wrap;justify-content:flex-end;gap:.15rem .55rem}
+.detail-values span{white-space:nowrap!important}
+.resource-section{gap:.5rem}
+.resource-meter{display:flex;flex-direction:column;gap:.26rem;min-width:0}
+.resource-meter-head,.resource-mini{display:flex;align-items:center;justify-content:space-between;gap:.55rem;font-size:12px;min-width:0}
+.resource-meter-head span,.resource-mini span{color:var(--text-dim);white-space:nowrap}
+.resource-meter-head strong,.resource-mini strong{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11px;font-weight:700;text-align:right;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+.resource-track{height:7px;border-radius:999px;background:color-mix(in srgb,var(--text-dim) 16%,transparent);overflow:hidden;border:1px solid color-mix(in srgb,var(--border) 75%,transparent)}
+.resource-track i{display:block;height:100%;width:var(--p);border-radius:inherit;background:var(--accent);transition:width .5s ease}
+.resource-meter[data-kind=mem] .resource-track i{background:var(--ok)}
+.resource-meter[data-kind=swap] .resource-track i{background:#14b8a6}
+.resource-meter[data-kind=hdd] .resource-track i{background:#06b6d4}
+.resource-meter[data-level=warn] .resource-track i{background:var(--warn)}
+.resource-meter[data-level=bad] .resource-track i{background:var(--danger)}
+.resource-mini{border-top:1px solid var(--border);padding-top:.45rem}
+.chart-section{gap:.55rem}
+.chart-head{display:flex;align-items:center;justify-content:space-between;gap:.75rem;flex-wrap:wrap}
+.chart-head h4{margin:0}
+.chart-legend{display:inline-flex;align-items:center;justify-content:flex-end;gap:.7rem;flex-wrap:wrap;font-size:11px;color:var(--text-dim)}
+.chart-legend span{display:inline-flex;align-items:center;gap:.28rem;white-space:nowrap}
+.chart-legend i{display:inline-block;width:10px;height:3px;border-radius:999px;box-shadow:0 0 0 1px rgba(0,0,0,.16)}
+.detail-chart{width:100%;border:1px solid var(--border);border-radius:8px;background:var(--bg)}
+@keyframes slideIn{from{transform:translateX(22px);opacity:.7}to{transform:translateX(0);opacity:1}}
+
+/* 管理配置 */
+.config-grid{display:grid;grid-template-columns:minmax(320px,.95fr) minmax(320px,1.05fr);gap:.9rem;align-items:start}
+.admin-card{border:1px solid var(--border);border-radius:8px;background:var(--bg-alt);padding:1rem;display:flex;flex-direction:column;gap:.85rem}
+.section-head{display:flex;align-items:flex-start;justify-content:space-between;gap:1rem}
+.section-actions{display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;justify-content:flex-end}
+.admin-status{border:1px solid var(--border);border-radius:8px;background:var(--bg);padding:.75rem;font-size:13px;color:var(--text-dim)}
+.admin-status.ok{border-color:rgba(16,185,129,.35);color:var(--ok)}
+.admin-status.err{border-color:rgba(239,68,68,.45);color:var(--danger)}
+.admin-login,.config-actions,.form-actions{display:flex;align-items:end;gap:.65rem;flex-wrap:wrap}
+.config-tabs{align-self:flex-start;max-width:100%}
+.config-list{display:flex;flex-direction:column;gap:.5rem}
+.config-row{display:grid;grid-template-columns:1fr auto;gap:.75rem;align-items:center;border:1px solid var(--border);border-radius:8px;background:var(--bg);padding:.7rem;cursor:pointer}
+.config-row:hover,.config-row.active{border-color:var(--accent)}
+.config-row .name{font-weight:700}
+.config-row .meta{font-size:12px;color:var(--text-dim);margin-top:.2rem;word-break:break-all}
+.config-form{display:flex;flex-direction:column;gap:.75rem}
+.config-fields{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:.75rem}
+.config-form label{display:flex;flex-direction:column;gap:.3rem;color:var(--text-dim);font-size:12px}
+.config-form label.wide{grid-column:1/-1}
+.config-form .check-row{flex-direction:row;align-items:center;gap:.5rem}
+.config-form .check-row input{height:auto}
+.config-form .form-actions{grid-column:1/-1}
+.config-form input[name=password],.config-form textarea[name=rule]{font-family:ui-monospace,SFMono-Regular,Menlo,monospace}
+.config-form button:disabled{opacity:.5;cursor:not-allowed}
+
+@media (max-width:980px){
+	.ops-overview{grid-template-columns:repeat(2,minmax(0,1fr))}
+	.config-grid{grid-template-columns:1fr}
+	.search-field input{min-width:220px}
+}
+@media (max-width:700px){
+	.ops-overview{display:none}
+}
+@media (max-width:640px){
+	.ops-toolbar{align-items:stretch}
+	.search-field,.select-field,.search-field input,.select-field select,.segmented,.icon-text,.primary-btn,.warn-btn,.danger-btn{width:100%}
+	.segmented button{flex:1;padding:0 .35rem}
+	.section-head{flex-direction:column}
+	.section-actions{width:100%;justify-content:stretch}
+	.detail-grid,.config-fields{grid-template-columns:1fr}
+	.detail-drawer{width:100vw;height:100dvh;max-height:100dvh;padding:calc(.95rem + env(safe-area-inset-top)) .95rem calc(.95rem + env(safe-area-inset-bottom));}
+	.detail-drawer .modal-content{max-height:none;overflow:visible;}
+}
@@ -1,11 +1,7 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none">
-  <defs>
-    <linearGradient id="g" x1="8" y1="8" x2="56" y2="56" gradientUnits="userSpaceOnUse">
-      <stop offset="0" stop-color="#3b82f6" />
-      <stop offset="1" stop-color="#2563eb" />
-    </linearGradient>
-  </defs>
-  <rect x="8" y="12" width="48" height="40" rx="12" fill="url(#g)" />
-  <path stroke="#fff" stroke-width="4" stroke-linecap="round" stroke-linejoin="round" d="M22 38v-8l6 4 8-10 6 6v8" />
-  <circle cx="22" cy="22" r="4" fill="#fff" />
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 86" fill="none">
+  <path d="M4 46H28L38 34L55 82L65 4L74 47H88M100 47H110M122 47H126"
+        stroke="#111827"
+        stroke-width="8"
+        stroke-linecap="round"
+        stroke-linejoin="round" />
 </svg>
@@ -6,17 +6,14 @@
    <meta name="description" content="云监控,ServerStatus中文版,ServerStatus,ServerStatus cppla" />
    <title>云监控</title>
    <link rel="icon" type="image/svg+xml" href="favicon.svg" />
-    <link rel="alternate icon" href="favicon.ico" />
-    <link rel="stylesheet" href="css/app.css" />
+    <link rel="stylesheet" href="css/app.css?v=20260709-19" />
 </head>
 <body>
    <header class="topbar">
        <div class="brand" title="云监控">
            <span class="logo-mark" aria-hidden="true">
-                <svg viewBox="0 0 24 24" width="20" height="20" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-                    <path d="M7.5 17a4.5 4.5 0 0 1-.9-8.92A6 6 0 0 1 18.4 9.6 4 4 0 0 1 18 17H7.5Z" />
-                    <rect x="9" y="11" width="6" height="4" rx="1" />
-                    <path d="M11 15v2.5a.5.5 0 0 0 .5.5h1" />
+                <svg viewBox="0 0 128 86" width="24" height="18" fill="none" stroke="currentColor" stroke-width="8" stroke-linecap="round" stroke-linejoin="round">
+                    <path d="M4 46H28L38 34L55 82L65 4L74 47H88M100 47H110M122 47H126" />
                </svg>
            </span>
            <span class="logo-text"><span class="logo-accent">云</span>监控</span>
@@ -25,6 +22,7 @@
            <button data-tab="servers" class="active">主机</button>
            <button data-tab="monitors">服务</button>
            <button data-tab="ssl">证书</button>
+            <button data-tab="config">配置</button>
        </nav>
        <div class="actions">
            <button id="themeToggle" title="切换主题 (当前: 自动或手动)" aria-label="切换主题">🌓</button>
@@ -35,24 +33,59 @@
    <main class="wrapper">
        <div id="notice" class="notice info">初始化中...</div>

+        <section class="ops-overview" id="overviewCards" aria-label="运行概览"></section>
+
+        <section class="ops-toolbar" id="serversToolbar" aria-label="主机筛选" style="display:none;">
+            <label class="search-field">
+                <span>搜索</span>
+                <input id="serverSearch" type="search" autocomplete="off" placeholder="节点 / 地区 / 系统 / 主机名" />
+            </label>
+            <div class="segmented" id="statusFilter" role="group" aria-label="状态筛选">
+                <button data-filter="all" class="active">全部</button>
+                <button data-filter="online">在线</button>
+                <button data-filter="offline">离线</button>
+                <button data-filter="alert" title="只显示在线但资源、丢包或流量异常的节点">异常</button>
+            </div>
+            <label class="select-field">
+                <span>系统</span>
+                <select id="osFilter">
+                    <option value="all">全部系统</option>
+                </select>
+            </label>
+            <label class="select-field">
+                <span>排序</span>
+                <select id="sortSelect">
+                    <option value="name">节点</option>
+                    <option value="status">在线状态</option>
+                    <option value="load">负载</option>
+                    <option value="cpu">CPU</option>
+                    <option value="memory">内存</option>
+                    <option value="hdd">硬盘</option>
+                    <option value="traffic">月流量</option>
+                    <option value="loss">丢包</option>
+                </select>
+            </label>
+            <button id="sortDirection" class="icon-text" title="切换排序方向">降序</button>
+        </section>
+
        <section id="panel-servers" class="panel active" aria-labelledby="主机">
            <div class="table-wrap">
                <table class="data" id="serversTable">
                    <thead>
                    <tr>
-                        <th>协议</th>
-                        <th>月流量 ↓|↑</th>
-                        <th>节点</th>
-                        <th>虚拟化</th>
-                        <th>位置</th>
+                        <th data-sort="status">协议</th>
+                        <th data-sort="traffic">月流量 ↓|↑</th>
+                        <th data-sort="name">节点</th>
+                        <th data-sort="type">虚拟化</th>
+                        <th data-sort="location">位置</th>
                        <th>在线</th>
-                        <th>负载</th>
+                        <th data-sort="load">负载</th>
                        <th>当前网络 ↓|↑</th>
                        <th>总流量 ↓|↑</th>
-                        <th>CPU</th>
-                        <th>内存</th>
-                        <th>硬盘</th>
-                        <th style="text-align:center;">联通|电信|移动</th>
+                        <th data-sort="cpu">CPU</th>
+                        <th data-sort="memory">内存</th>
+                        <th data-sort="hdd">硬盘</th>
+                        <th data-sort="loss" style="text-align:center;">联通|电信|移动</th>
                    </tr>
                    </thead>
                    <tbody id="serversBody"></tbody>
@@ -99,21 +132,74 @@
            <!-- 移动端卡片布局 (证书) -->
            <div id="sslCards" class="cards" style="display:none;"></div>
        </section>
+
+        <section id="panel-config" class="panel" aria-labelledby="配置">
+            <div class="config-grid">
+                <section class="admin-card">
+                    <div class="section-head">
+                        <div>
+                            <h2>配置管理</h2>
+                            <p class="muted">可编辑节点、服务监测、证书与告警规则，保存后自动重载。</p>
+                        </div>
+                        <div class="section-actions">
+                            <button id="adminReload" class="icon-text">重载配置</button>
+                            <button id="adminRestart" class="danger-btn">重启服务</button>
+                        </div>
+                    </div>
+                    <div id="adminStatus" class="admin-status">正在检测管理 API...</div>
+                    <form id="adminTokenForm" class="admin-login">
+                        <label class="search-field">
+                            <span>管理令牌</span>
+                            <input id="adminToken" type="password" autocomplete="current-password" placeholder="ADMIN_TOKEN" />
+                        </label>
+                        <button type="submit" class="primary-btn">连接</button>
+                    </form>
+                    <div class="segmented config-tabs" id="configTypeTabs" role="group" aria-label="配置类型">
+                        <button type="button" data-type="servers" class="active">节点</button>
+                        <button type="button" data-type="monitors">监测</button>
+                        <button type="button" data-type="sslcerts">证书</button>
+                        <button type="button" data-type="watchdog">告警</button>
+                    </div>
+                    <div class="config-actions">
+                        <button id="addConfigItemBtn" class="primary-btn">新增节点</button>
+                        <button id="refreshConfigBtn" class="icon-text">刷新配置</button>
+                    </div>
+                    <div id="configItemList" class="config-list"></div>
+                </section>
+                <section class="admin-card">
+                    <div class="section-head">
+                        <div>
+                            <h2 id="configEditorTitle">新增节点</h2>
+                            <p class="muted" id="configEditorHint">保存后会写入 config.json，并向 sergate 发送 SIGHUP 重载。</p>
+                        </div>
+                    </div>
+                    <form id="configForm" class="config-form">
+                        <div id="configFields" class="config-fields"></div>
+                        <div class="form-actions">
+                            <button type="submit" class="primary-btn">保存配置</button>
+                            <button type="button" id="resetTrafficBtn" class="warn-btn" style="display:none;">重置月流量</button>
+                            <button type="button" id="deleteConfigItemBtn" class="danger-btn">删除配置</button>
+                            <button type="button" id="resetConfigFormBtn" class="icon-text">清空</button>
+                        </div>
+                    </form>
+                </section>
+            </div>
+        </section>
    </main>

-    <!-- 详情弹窗 -->
-    <div id="detailModal" class="modal-backdrop" style="display:none;">
-        <div class="modal-box" role="dialog" aria-modal="true" aria-labelledby="detailTitle">
+    <!-- 详情抽屉 -->
+    <div id="detailModal" class="modal-backdrop drawer-backdrop" style="display:none;">
+        <aside class="modal-box detail-drawer" role="dialog" aria-modal="true" aria-labelledby="detailTitle">
            <button class="modal-close" id="detailClose" aria-label="关闭">×</button>
            <h3 id="detailTitle" class="modal-title">节点详情</h3>
            <div id="detailContent" class="modal-content">加载中...</div>
-        </div>
+        </aside>
    </div>

    <footer class="footer">
        <a href="https://github.com/cppla/ServerStatus" target="_blank" rel="noopener">ServerStatus中文版</a>
    </footer>

-    <script src="js/app.js" defer></script>
+    <script src="js/app.js?v=20260709-19" defer></script>
 </body>
-</html>
+</html>
Author	SHA1	Message	Date
cpplaandGitHub	5322a9105e	Update README.md CI / validate (push) Has been cancelled Details 1.1.9 screen	2026-07-09 19:15:34 +08:00
cppla	3b0705edc1	update client linux and psutil	2026-07-09 18:01:57 +08:00
cppla	2b799a524f	raw域名被限流，替换为api	2026-07-09 17:13:58 +08:00
cppla	783d27732d	cpu short	2026-07-09 17:07:59 +08:00
cppla	efb2768fa8	1.1.9	2026-07-09 16:09:02 +08:00
cppla	a8fc0b81ab	1.1.9 CI / validate (push) Has been cancelled Details	2026-07-09 10:43:40 +08:00
cppla	66e6179332	update	2026-07-09 10:10:08 +08:00
cppla	6ad3a8c294	update CI / validate (push) Has been cancelled Details	2026-07-07 17:39:32 +08:00
cppla	03db91c873	update	2026-07-07 17:27:29 +08:00
cppla	007c9bccd5	new style	2026-07-07 16:52:04 +08:00
cppla	e8e90275a2	增加月流量重置按钮 CI / validate (push) Has been cancelled Details	2026-07-06 14:02:12 +08:00
cppla	8e4590699b	update css for nomac CI / validate (push) Has been cancelled Details	2026-07-02 16:24:04 +08:00
cppla	51ae186243	update	2026-07-02 13:07:35 +08:00
cppla	bbec425c51	少于10时折叠筛选	2026-07-02 12:02:36 +08:00
cppla	e0aae47efc	update css CI / validate (push) Has been cancelled Details	2026-07-01 19:17:07 +08:00
cppla	a31fb176c4	update CI / validate (push) Has been cancelled Details	2026-07-01 17:53:28 +08:00
cppla	f19d10966d	update version 1.1.8	2026-07-01 17:13:30 +08:00
cppla	9ac276d443	更新说明	2026-07-01 15:32:17 +08:00
cppla	c58eaf6ff5	version 1.1.8	2026-07-01 11:55:45 +08:00
cppla	f24a70b9d7	修复传递参数优先级的问题，防止错误获取系统变量	2026-03-20 11:51:05 +08:00
cppla	23a620274d	linux尝试从os中获取信息	2026-02-28 14:10:35 +08:00
cppla	e903200d66	默认psutil，容器下获取更精准的宿主机读写情况	2026-02-28 11:58:00 +08:00
cppla	57c74b0c9e	update	2026-02-27 18:40:30 +08:00
cppla	caf5d5c34d	update	2026-02-27 18:35:57 +08:00
cppla	ed64656a06	修复bug	2026-02-27 17:57:31 +08:00
cppla	bbde4cb1e9	fix bug	2026-02-27 17:52:03 +08:00
cppla	678cf43077	fix bug	2026-02-27 17:24:33 +08:00
cppla	4bbd54dd06	fix bug	2026-02-27 17:12:31 +08:00
cppla	eea08f529e	fix bug	2026-02-27 17:12:12 +08:00
cppla	d1ad6b0f43	client alpine images	2026-02-27 15:36:01 +08:00
cppla	570e14c1fa	update docker compose	2026-02-27 13:27:58 +08:00
cppla	7b9da31db0	add client docker	2026-02-26 18:10:24 +08:00
cppla	6552959ef3	解决总流量pb显示异常的问题	2026-02-10 16:56:33 +08:00
cppla	14ee075853	ai fix a bug	2025-10-16 10:03:06 +08:00
cppla	c1955d7ca5	AI fix AI Bug	2025-10-09 10:46:35 +08:00
cppla	41ec81bed3	del not used variable	2025-09-12 10:38:56 +08:00
cppla	1557673db2	ssl expire tips bug	2025-09-12 10:33:09 +08:00
cppla	565f8c7ce0	修复ssl提醒的bug	2025-09-11 11:49:59 +08:00